From 60defc5dbde98bd2ee7daa09c9e3562d1c8703b7 Mon Sep 17 00:00:00 2001
From: claracruz <clara.udofa@elastic.co>
Date: Mon, 6 Feb 2023 16:26:51 +0000
Subject: [PATCH 001/134] Update ECMA copy (#150197)

Fixes: #149159
Fixes: #150244

This PR applies ECMA copy improvements

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../components/move_data/move_data.test.tsx    |  2 +-
 .../components/move_data/move_data.tsx         | 18 +++++++-----------
 .../public/application/components/app.tsx      | 18 +++++++++---------
 3 files changed, 17 insertions(+), 21 deletions(-)

diff --git a/src/plugins/home/public/application/components/move_data/move_data.test.tsx b/src/plugins/home/public/application/components/move_data/move_data.test.tsx
index 9c92afbf01ac3..7f8e3a1bfcf7a 100644
--- a/src/plugins/home/public/application/components/move_data/move_data.test.tsx
+++ b/src/plugins/home/public/application/components/move_data/move_data.test.tsx
@@ -17,6 +17,6 @@ describe('MoveData', () => {
     const component = shallowWithIntl(<MoveData addBasePath={addBasePathMock} />);
 
     const $button = component.find('EuiButton');
-    expect($button.props().href).toBe('/app/management/data/migrate_data');
+    expect($button.props().href).toBe('https://ela.st/cloud-migration');
   });
 });
diff --git a/src/plugins/home/public/application/components/move_data/move_data.tsx b/src/plugins/home/public/application/components/move_data/move_data.tsx
index ce97e71a6ecd8..c3e0181aa4f64 100644
--- a/src/plugins/home/public/application/components/move_data/move_data.tsx
+++ b/src/plugins/home/public/application/components/move_data/move_data.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { FC, MouseEvent } from 'react';
+import React, { FC } from 'react';
 import {
   EuiButton,
   EuiFlexGroup,
@@ -19,18 +19,17 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
-import { createAppNavigationHandler } from '../app_navigation_handler';
 
 interface Props {
   addBasePath: (path: string) => string;
 }
 
 export const MoveData: FC<Props> = ({ addBasePath }) => {
-  const migrateDataUrl = '/app/management/data/migrate_data';
+  const migrateDataUrl = 'https://ela.st/cloud-migration';
   const buttonLabel = (
     <FormattedMessage
       id="home.addData.moveYourDataButtonLabel"
-      defaultMessage="Explore the benefits"
+      defaultMessage="Move to Elastic Cloud"
     />
   );
 
@@ -50,7 +49,7 @@ export const MoveData: FC<Props> = ({ addBasePath }) => {
             <h4>
               <FormattedMessage
                 id="home.addData.moveYourDataTitle"
-                defaultMessage="Considering Elastic Cloud?"
+                defaultMessage="Try managed Elastic"
               />
             </h4>
           </EuiTitle>
@@ -58,18 +57,15 @@ export const MoveData: FC<Props> = ({ addBasePath }) => {
           <EuiText size="s">
             <FormattedMessage
               id="home.addData.moveYourDataToElasticCloud"
-              defaultMessage="Moving your data to Elastic Cloud is easy and can save you time and money."
+              defaultMessage="Deploy, scale, and upgrade your stack faster with Elastic Cloud. We’ll help you quickly move your data."
             />
           </EuiText>
           <EuiSpacer size="m" />
-          {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
           <EuiButton
             data-test-subj="migrate_data_to_cloud__migrate_data_docs_link"
             color="primary"
-            href={addBasePath(migrateDataUrl)}
-            onClick={(event: MouseEvent) => {
-              createAppNavigationHandler(migrateDataUrl)(event);
-            }}
+            href={migrateDataUrl}
+            target="_blank"
           >
             {buttonLabel}
           </EuiButton>
diff --git a/x-pack/plugins/cloud_integrations/cloud_data_migration/public/application/components/app.tsx b/x-pack/plugins/cloud_integrations/cloud_data_migration/public/application/components/app.tsx
index d48cb672e05c3..2823a44c09a23 100755
--- a/x-pack/plugins/cloud_integrations/cloud_data_migration/public/application/components/app.tsx
+++ b/x-pack/plugins/cloud_integrations/cloud_data_migration/public/application/components/app.tsx
@@ -72,7 +72,7 @@ export const CloudDataMigrationApp = ({ http, breadcrumbService }: CloudDataMigr
             <h1>
               <FormattedMessage
                 id="xpack.cloudDataMigration.migrateToCloudTitle"
-                defaultMessage="Elastic Cloud helps your data work harder."
+                defaultMessage="Be faster and more efficient with Elastic Cloud"
               />
             </h1>
           </EuiTitle>
@@ -86,7 +86,7 @@ export const CloudDataMigrationApp = ({ http, breadcrumbService }: CloudDataMigr
                 <EuiText css={styles.listItemCss} size="s" color="subdued">
                   <FormattedMessage
                     id="xpack.cloudDataMigration.deployInSeconds.text"
-                    defaultMessage="Deploy Elastic quickly and scale up to petabytes of data with a click."
+                    defaultMessage="Deploy and scale a secure Elastic Stack in minutes"
                   />
                 </EuiText>
               }
@@ -97,8 +97,8 @@ export const CloudDataMigrationApp = ({ http, breadcrumbService }: CloudDataMigr
               label={
                 <EuiText css={styles.listItemCss} size="s" color="subdued">
                   <FormattedMessage
-                    id="xpack.cloudDataMigration.freeUpEngineering.text"
-                    defaultMessage="Streamline your Elastic workflow and free up your team. Manage multiple deployments from a single view and centralize your monitoring data."
+                    id="xpack.cloudDataMigration.monitorDeployments.text"
+                    defaultMessage="Monitor and manage multiple deployments from a single place"
                   />
                 </EuiText>
               }
@@ -109,8 +109,8 @@ export const CloudDataMigrationApp = ({ http, breadcrumbService }: CloudDataMigr
               label={
                 <EuiText css={styles.listItemCss} size="s" color="subdued">
                   <FormattedMessage
-                    id="xpack.cloudDataMigration.getHelpFromCreators.text"
-                    defaultMessage="Get support from the creators of Elastic to help you ingest all sorts of data and tune your performance."
+                    id="xpack.cloudDataMigration.upgrade.text"
+                    defaultMessage="Upgrade to newer versions much more easily"
                   />
                 </EuiText>
               }
@@ -121,8 +121,8 @@ export const CloudDataMigrationApp = ({ http, breadcrumbService }: CloudDataMigr
               label={
                 <EuiText css={styles.listItemCss} size="s" color="subdued">
                   <FormattedMessage
-                    id="xpack.cloudDataMigration.getInstantAccess.text"
-                    defaultMessage="Access the latest version of Elastic with features you want, like anomaly detection, searchable snapshots, advanced security, and so much more."
+                    id="xpack.cloudDataMigration.slaBackedSupport.text"
+                    defaultMessage="Get all of your questions answered with SLA-backed support"
                   />
                 </EuiText>
               }
@@ -141,7 +141,7 @@ export const CloudDataMigrationApp = ({ http, breadcrumbService }: CloudDataMigr
             >
               <FormattedMessage
                 id="xpack.cloudDataMigration.readInstructionsButtonLabel"
-                defaultMessage="Help me move"
+                defaultMessage="Move to Elastic Cloud"
               />
             </EuiButton>
           </div>

From 45e57768daadd91d8757f5398cd7070932e9f941 Mon Sep 17 00:00:00 2001
From: jennypavlova <dzheni.pavlova@elastic.co>
Date: Mon, 6 Feb 2023 17:44:09 +0100
Subject: [PATCH 002/134] [Infrastructure UI] Inventory educate about show
 button (#149981)

Closes [#149615](https://github.com/elastic/kibana/issues/149615)

## Summary

This PR adds a tooltip educating the user about the filter in the Show
drop-down list.

Testing
- Navigate to the Inventory Page and the new tour should be visible:
<img width="708" alt="image"
src="https://user-images.githubusercontent.com/14139027/216096889-486f07f0-f182-4f20-a4f4-bb8c535d4af9.png">

- if it's dismissed (after the button is clicked it should not be
visible anymore until the session is active - can be tested with page
refresh or navigating to a different page and back)
- If it's not dismissed it should be persisted per user/browser session
- can be also checked with page refresh
---
 .../components/dropdown_button.tsx            | 38 ++++++++----
 .../components/kubernetes_tour.tsx            | 60 +++++++++++++++++++
 .../waffle/waffle_inventory_switcher.tsx      |  1 +
 .../test/functional/apps/infra/home_page.ts   | 29 +++++++--
 .../test/functional/apps/infra/hosts_view.ts  |  2 +
 .../page_objects/infra_home_page.ts           | 14 +++++
 6 files changed, 127 insertions(+), 17 deletions(-)
 create mode 100644 x-pack/plugins/infra/public/pages/metrics/inventory_view/components/kubernetes_tour.tsx

diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/dropdown_button.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/dropdown_button.tsx
index 89bc192606944..0e4aa275a7879 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/dropdown_button.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/dropdown_button.tsx
@@ -8,6 +8,7 @@
 import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty } from '@elastic/eui';
 import React, { ReactNode } from 'react';
 import { withTheme, EuiTheme } from '@kbn/kibana-react-plugin/common';
+import { KubernetesTour } from './kubernetes_tour';
 
 interface Props {
   'data-test-subj'?: string;
@@ -15,10 +16,26 @@ interface Props {
   onClick: () => void;
   theme: EuiTheme | undefined;
   children: ReactNode;
+  showKubernetesInfo?: boolean;
 }
 
+const ButtonLabel = ({ label, theme }: { label: string; theme?: EuiTheme }) => (
+  <EuiFlexItem
+    grow={false}
+    style={{
+      padding: 12,
+      background: theme?.eui.euiFormInputGroupLabelBackground,
+      fontSize: '0.75em',
+      fontWeight: 600,
+      color: theme?.eui.euiTitleColor,
+    }}
+  >
+    {label}
+  </EuiFlexItem>
+);
+
 export const DropdownButton = withTheme((props: Props) => {
-  const { onClick, label, theme, children } = props;
+  const { onClick, label, theme, children, showKubernetesInfo } = props;
   return (
     <EuiFlexGroup
       alignItems="center"
@@ -28,18 +45,13 @@ export const DropdownButton = withTheme((props: Props) => {
         boxShadow: `0px 3px 2px ${theme?.eui.euiTableActionsBorderColor}, 0px 1px 1px ${theme?.eui.euiTableActionsBorderColor}`,
       }}
     >
-      <EuiFlexItem
-        grow={false}
-        style={{
-          padding: 12,
-          background: theme?.eui.euiFormInputGroupLabelBackground,
-          fontSize: '0.75em',
-          fontWeight: 600,
-          color: theme?.eui.euiTitleColor,
-        }}
-      >
-        {label}
-      </EuiFlexItem>
+      {showKubernetesInfo ? (
+        <KubernetesTour>
+          <ButtonLabel label={label} theme={theme} />
+        </KubernetesTour>
+      ) : (
+        <ButtonLabel label={label} theme={theme} />
+      )}
       <EuiFlexItem grow={false}>
         <EuiButtonEmpty
           data-test-subj={props['data-test-subj']}
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/kubernetes_tour.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/kubernetes_tour.tsx
new file mode 100644
index 0000000000000..787aa9f416266
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/kubernetes_tour.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { ReactElement } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiTourStep, EuiText, EuiButtonEmpty } from '@elastic/eui';
+import useLocalStorage from 'react-use/lib/useLocalStorage';
+
+interface Props {
+  children: ReactElement;
+}
+
+export const KUBERNETES_TOUR_STORAGE_KEY = 'isKubernetesTourSeen';
+
+export const KubernetesTour = ({ children }: Props) => {
+  const [isTourSeen, setIsTourSeen] = useLocalStorage(KUBERNETES_TOUR_STORAGE_KEY, false);
+  const markTourAsSeen = () => setIsTourSeen(true);
+
+  return (
+    <div>
+      <EuiTourStep
+        content={
+          <EuiText size="s" color="subdued" data-test-subj="infra-kubernetesTour-text">
+            {i18n.translate('xpack.infra.homePage.kubernetesTour.text', {
+              defaultMessage:
+                'Click here to see your infrastructure in different ways, including Kubernetes pods.',
+            })}
+          </EuiText>
+        }
+        isStepOpen={!isTourSeen}
+        maxWidth={350}
+        onFinish={markTourAsSeen}
+        step={1}
+        stepsTotal={1}
+        title={i18n.translate('xpack.infra.homePage.kubernetesTour.title', {
+          defaultMessage: 'Want a different view?',
+        })}
+        anchorPosition="downCenter"
+        footerAction={
+          <EuiButtonEmpty
+            data-test-subj="infra-kubernetesTour-dismiss"
+            size="s"
+            color="text"
+            onClick={markTourAsSeen}
+          >
+            {i18n.translate('xpack.infra.homePage.kubernetesTour.dismiss', {
+              defaultMessage: 'Dismiss',
+            })}
+          </EuiButtonEmpty>
+        }
+      >
+        {children}
+      </EuiTourStep>
+    </div>
+  );
+};
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_inventory_switcher.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_inventory_switcher.tsx
index 6234dcc0bbf0b..e3ca9b770e2ef 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_inventory_switcher.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/waffle_inventory_switcher.tsx
@@ -124,6 +124,7 @@ export const WaffleInventorySwitcher: React.FC = () => {
       data-test-subj={'openInventorySwitcher'}
       onClick={openPopover}
       label={i18n.translate('xpack.infra.waffle.showLabel', { defaultMessage: 'Show' })}
+      showKubernetesInfo={true}
     >
       {selectedText}
     </DropdownButton>
diff --git a/x-pack/test/functional/apps/infra/home_page.ts b/x-pack/test/functional/apps/infra/home_page.ts
index 1c0323808270d..54435f11a33e1 100644
--- a/x-pack/test/functional/apps/infra/home_page.ts
+++ b/x-pack/test/functional/apps/infra/home_page.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import { KUBERNETES_TOUR_STORAGE_KEY } from '@kbn/infra-plugin/public/pages/metrics/inventory_view/components/kubernetes_tour';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { DATES } from './constants';
 
@@ -59,10 +60,10 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         await pageObjects.common.navigateToApp('infraOps');
         await pageObjects.infraHome.waitForLoading();
       });
-      after(
-        async () =>
-          await esArchiver.unload('x-pack/test/functional/es_archives/infra/metrics_and_logs')
-      );
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/infra/metrics_and_logs');
+        await browser.removeLocalStorageItem(KUBERNETES_TOUR_STORAGE_KEY);
+      });
 
       it('renders the correct page title', async () => {
         await pageObjects.header.waitUntilLoadingHasFinished();
@@ -71,6 +72,26 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         expect(documentTitle).to.contain('Inventory - Infrastructure - Observability - Elastic');
       });
 
+      it('renders the kubernetes tour component and allows user to dismiss it without seeing it again', async () => {
+        await pageObjects.header.waitUntilLoadingHasFinished();
+        const kubernetesTourText =
+          'Click here to see your infrastructure in different ways, including Kubernetes pods.';
+        const ensureKubernetesTourVisible =
+          await pageObjects.infraHome.ensureKubernetesTourIsVisible();
+
+        expect(ensureKubernetesTourVisible).to.contain(kubernetesTourText);
+
+        // Persist after refresh
+        await browser.refresh();
+        await pageObjects.infraHome.waitForLoading();
+
+        expect(ensureKubernetesTourVisible).to.contain(kubernetesTourText);
+
+        await pageObjects.infraHome.clickDismissKubernetesTourButton();
+
+        await pageObjects.infraHome.ensureKubernetesTourIsClosed();
+      });
+
       it('renders an empty data prompt for dates with no data', async () => {
         await pageObjects.infraHome.goToTime(DATE_WITHOUT_DATA);
         await pageObjects.infraHome.getNoMetricsDataPrompt();
diff --git a/x-pack/test/functional/apps/infra/hosts_view.ts b/x-pack/test/functional/apps/infra/hosts_view.ts
index 9975a2772a193..224a924b7c1fa 100644
--- a/x-pack/test/functional/apps/infra/hosts_view.ts
+++ b/x-pack/test/functional/apps/infra/hosts_view.ts
@@ -108,6 +108,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       before(async () => {
         await esArchiver.load('x-pack/test/functional/es_archives/infra/metrics_and_logs');
         await pageObjects.common.navigateToApp('infraOps');
+        await pageObjects.infraHome.clickDismissKubernetesTourButton();
         await pageObjects.infraHostsView.clickTryHostViewBadge();
       });
       after(async () => {
@@ -126,6 +127,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       before(async () => {
         await esArchiver.load('x-pack/test/functional/es_archives/infra/metrics_and_logs');
         await loginWithReadOnlyUserAndNavigateToInfra();
+        await pageObjects.infraHome.clickDismissKubernetesTourButton();
         await pageObjects.infraHostsView.clickTryHostViewBadge();
       });
       after(async () => {
diff --git a/x-pack/test/functional/page_objects/infra_home_page.ts b/x-pack/test/functional/page_objects/infra_home_page.ts
index cb01de3c596e3..a13c9a89ae0cb 100644
--- a/x-pack/test/functional/page_objects/infra_home_page.ts
+++ b/x-pack/test/functional/page_objects/infra_home_page.ts
@@ -376,5 +376,19 @@ export function InfraHomePageProvider({ getService, getPageObjects }: FtrProvide
     async ensureSuggestionsPanelVisible() {
       await testSubjects.find('infraSuggestionsPanel');
     },
+
+    async ensureKubernetesTourIsVisible() {
+      const container = await testSubjects.find('infra-kubernetesTour-text');
+      const containerText = await container.getVisibleText();
+      return containerText;
+    },
+
+    async ensureKubernetesTourIsClosed() {
+      await testSubjects.missingOrFail('infra-kubernetesTour-text');
+    },
+
+    async clickDismissKubernetesTourButton() {
+      return await testSubjects.click('infra-kubernetesTour-dismiss');
+    },
   };
 }

From 8733774e8137fb531d4531fad58e09b65bba8689 Mon Sep 17 00:00:00 2001
From: Wafaa Nasr <wafaa.nasr@elastic.co>
Date: Mon, 6 Feb 2023 16:47:22 +0000
Subject: [PATCH 003/134] [Security Solution][Platform] - Add connectors to
 import/export API (#148703)

## Summary

- [x] Addresses https://github.com/elastic/kibana/issues/118774
- [x] Enable Security Rule to be **imported** even if one of its
connectors has a missing secret
- [x] Shows **Warning Callout** in the Import Modal when missing secrets
connector is imported.
- [x] Added Link `connectors` to the connectors page in the same tab, so
that the user can fix imported connectors.
- [x] Added `Overwrite existing connectors with conflicting action "id"`
option to the Import Modal

## Cases:

> **Export:**
> - Export Rule(s) with connectors through `Export All` or `Bulk
Actions`
>
> **Import:**
>     - Import Rule with correct connectors data
> - Import Rule with missing secrets' connectors by showing a warning
callout
> - Re-Import connectors even if they were stored when overwrite is true
>
> **Error:**
> - Showing an error message when the user has a Read Actions permission
and stops the importing => ` You may not have actions privileges
required to import rules with actions ...`
> - Showing an error message when the user has an old imported rule
missing all the connectors data **OR** these connectors were not in the
user's env => `X connector is missing. Connector id missing is: X`
> - Showing an error if the new connectors defined in the exported file
are not corresponding to the actions array under the rules param => `X
connector is missing. Connector id missing is: X`
> - **Showing a ` conflict` error in case of existing connectors and
re-importing again with an `overwrite` false => this won't happen in
case of implementing the `Skipping action-connectors importing if all
connectors have been imported/created before`**
>
> **Skip importing:**
> - Skipping action-connectors importing if the `actions` array is
empty, even if the user has exported-connectors in the file
> - Skipping action-connectors importing if all connectors have been
imported/created before
>



### Screenshots
>
>  **1. Importing Connectors successfully**
> <img width="1219" alt="image"
src="https://user-images.githubusercontent.com/12671903/216049657-a313033b-e45e-4c99-b6ca-ed3070f15a97.png">
>
>  **2. Importing Connectors with warnings**
<img width="1208" alt="image"
src="https://user-images.githubusercontent.com/12671903/216980057-b5cdfe38-da1b-479b-8cfd-81f16037ff1d.png">

**3.Connector Page**

<img width="1701" alt="image"
src="https://user-images.githubusercontent.com/12671903/216049911-da29abc8-e20c-49d2-a507-ab382372b4f6.png">


## New text: @nastasha-solomon

**1. Warning message**

 title => could be ` 1 connector imported` or `x connectors imported`
message => ` 1 connector has sensitive information that requires
updates. review in connectors` or `x connectors have sensitive
information that requires updates. review in connectors`

<img width="588" alt="image"
src="https://user-images.githubusercontent.com/12671903/216103805-9946b080-07d3-4e8b-93aa-b5e1dcaa415d.png">

**2. New `Overwrite` checkbox**
<img width="431" alt="image"
src="https://user-images.githubusercontent.com/12671903/216106354-3d435d64-0fa5-467b-90f1-effb2c0aef2a.png">


**3. Success Toast message**

<img width="434" alt="image"
src="https://user-images.githubusercontent.com/12671903/216104454-2d83744b-efbc-40c1-9e69-7e8b0670dd19.png">

**4. Error messages**
   a. Missing import action privileges
<img width="438" alt="image"
src="https://user-images.githubusercontent.com/12671903/216116350-f306d744-eef4-4064-b4f8-e794db4ad78e.png">

   b. Missing connectors
<img width="353" alt="image"
src="https://user-images.githubusercontent.com/12671903/216104979-370f6826-8150-45d5-8724-6ca50f99ad71.png">
<img width="357" alt="image"
src="https://user-images.githubusercontent.com/12671903/216106067-e6132a93-d36e-4bdf-b1bf-e6ddd1cf8a4e.png">




- [x] References: Use **getImporter** and **getExporter** from Saved
Object [Connectors SO import/export
implementation](https://github.com/elastic/kibana/pull/98802) ,
[Kibana-Core
confirmation](https://elastic.slack.com/archives/C5TQ33ND8/p1673275186013589
)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../src/import_query_schema/index.test.ts     |  21 +
 .../src/import_query_schema/index.ts          |   4 +-
 .../rules_client/lib/validate_actions.ts      |  35 +-
 .../server/rules_client/methods/create.ts     |   8 +-
 .../server/rules_client/methods/update.ts     |  17 +-
 .../server/rules_client/tests/create.test.ts  | 116 +++
 .../server/rules_client/tests/update.test.ts  | 149 ++++
 .../import_rules/response_schema.test.ts      | 222 ++++++
 .../api/rules/import_rules/response_schema.ts |   6 +-
 .../export_rules_details_schema.mock.ts       |  19 +
 .../export_rules_details_schema.test.ts       |  20 +-
 .../export/export_rules_details_schema.ts     |  46 +-
 .../model/import/rule_to_import.mock.ts       |  38 +
 .../schemas/response/index.ts                 |   1 +
 .../schemas/response/warning_schema/index.ts  |  24 +
 .../security_solution/cypress/objects/rule.ts |   5 +
 .../cypress/screens/alerts_detection_rules.ts |   7 +-
 .../cypress/tasks/alerts_detection_rules.ts   |   8 +-
 .../__snapshots__/index.test.tsx.snap         | 514 ++++++++++++-
 .../action_connectors_warning.test.tsx.snap   | 678 ++++++++++++++++++
 .../action_connectors_warning.test.tsx        | 104 +++
 .../action_connectors_warning/index.tsx       |  65 ++
 .../import_data_modal/index.test.tsx          | 114 ++-
 .../components/import_data_modal/index.tsx    |  77 +-
 .../import_data_modal/translations.ts         |  49 +-
 .../import_data_modal/utils.test.ts           | 291 +++++++-
 .../components/import_data_modal/utils.ts     |  94 ++-
 .../rule_management/api/api.test.ts           |  10 +
 .../rule_management/api/api.ts                |   7 +-
 .../rule_management/logic/types.ts            |   6 +
 .../pages/rule_management/index.tsx           |   1 +
 .../api/rules/bulk_actions/route.ts           |  12 +-
 .../api/rules/export_rules/route.ts           |  27 +-
 .../api/rules/import_rules/route.test.ts      |  48 ++
 .../api/rules/import_rules/route.ts           |  46 +-
 .../logic/crud/create_rules.ts                |   3 +
 .../rule_management/logic/crud/patch_rules.ts |   3 +
 .../logic/export/get_export_all.test.ts       | 191 ++++-
 .../logic/export/get_export_all.ts            |  20 +-
 .../export/get_export_by_object_ids.test.ts   | 193 ++++-
 .../logic/export/get_export_by_object_ids.ts  |  29 +-
 .../logic/export/get_export_details_ndjson.ts |  20 +-
 .../get_export_rule_action_connectors.ts      |  92 +++
 .../import_rule_action_connectors.test.ts     | 383 ++++++++++
 .../import_rule_action_connectors.ts          |  84 +++
 .../logic/import/action_connectors/types.ts   |  44 ++
 .../import/action_connectors/utils/index.ts   | 129 ++++
 .../import/create_rules_stream_from_ndjson.ts |   8 +
 .../logic/import/import_rules_utils.ts        |   7 +-
 .../plugins/security_solution/tsconfig.json   |   2 +
 .../basic/tests/export_rules.ts               |   5 +
 .../basic/tests/import_rules.ts               |  36 +
 .../group1/export_rules.ts                    |   5 +
 .../group10/import_rules.ts                   | 334 ++++++++-
 .../group10/perform_bulk_action.ts            |  94 +++
 .../security_and_spaces/tests/import_rules.ts |  86 ++-
 56 files changed, 4475 insertions(+), 182 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/common/detection_engine/schemas/response/warning_schema/index.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/__snapshots__/action_connectors_warning.test.tsx.snap
 create mode 100644 x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/action_connectors_warning.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/index.tsx
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_rule_action_connectors.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.test.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/types.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/utils/index.ts

diff --git a/packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.test.ts b/packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.test.ts
index d2f84b4ee3708..ab1f35c54b5db 100644
--- a/packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.test.ts
+++ b/packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.test.ts
@@ -16,6 +16,7 @@ describe('importQuerySchema', () => {
       as_new_list: false,
       overwrite: true,
       overwrite_exceptions: true,
+      overwrite_action_connectors: true,
     };
     const decoded = importQuerySchema.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -30,6 +31,7 @@ describe('importQuerySchema', () => {
       as_new_list: false,
       overwrite: 'wrong',
       overwrite_exceptions: true,
+      overwrite_action_connectors: true,
     };
     const decoded = importQuerySchema.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -48,6 +50,7 @@ describe('importQuerySchema', () => {
       as_new_list: false,
       overwrite: true,
       overwrite_exceptions: 'wrong',
+      overwrite_action_connectors: true,
     };
     const decoded = importQuerySchema.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -58,6 +61,24 @@ describe('importQuerySchema', () => {
     ]);
     expect(message.schema).toEqual({});
   });
+  test('it should NOT validate a non boolean value for "overwrite_action_connectors"', () => {
+    const payload: Omit<ImportQuerySchema, 'overwrite_action_connectors'> & {
+      overwrite_action_connectors: string;
+    } = {
+      as_new_list: false,
+      overwrite: true,
+      overwrite_exceptions: true,
+      overwrite_action_connectors: 'wrong',
+    };
+    const decoded = importQuerySchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = foldLeftRight(checked);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "wrong" supplied to "overwrite_action_connectors"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
 
   test('it should NOT allow an extra key to be sent in', () => {
     const payload: ImportQuerySchema & {
diff --git a/packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.ts b/packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.ts
index ca0e35c4aa176..5b1ee38bb0855 100644
--- a/packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.ts
@@ -14,6 +14,7 @@ export const importQuerySchema = t.exact(
   t.partial({
     overwrite: DefaultStringBooleanFalse,
     overwrite_exceptions: DefaultStringBooleanFalse,
+    overwrite_action_connectors: DefaultStringBooleanFalse,
     as_new_list: DefaultStringBooleanFalse,
   })
 );
@@ -21,9 +22,10 @@ export const importQuerySchema = t.exact(
 export type ImportQuerySchema = t.TypeOf<typeof importQuerySchema>;
 export type ImportQuerySchemaDecoded = Omit<
   ImportQuerySchema,
-  'overwrite' | 'overwrite_exceptions' | 'as_new_list'
+  'overwrite' | 'overwrite_exceptions' | 'as_new_list' | 'overwrite_action_connectors'
 > & {
   overwrite: boolean;
   overwrite_exceptions: boolean;
+  overwrite_action_connectors: boolean;
   as_new_list: boolean;
 };
diff --git a/x-pack/plugins/alerting/server/rules_client/lib/validate_actions.ts b/x-pack/plugins/alerting/server/rules_client/lib/validate_actions.ts
index 3c97080e2d655..ea6145b8f6e99 100644
--- a/x-pack/plugins/alerting/server/rules_client/lib/validate_actions.ts
+++ b/x-pack/plugins/alerting/server/rules_client/lib/validate_actions.ts
@@ -17,7 +17,10 @@ import { parseDuration } from '../../lib';
 export async function validateActions(
   context: RulesClientContext,
   alertType: UntypedNormalizedRuleType,
-  data: Pick<RawRule, 'notifyWhen' | 'throttle' | 'schedule'> & { actions: NormalizedAlertAction[] }
+  data: Pick<RawRule, 'notifyWhen' | 'throttle' | 'schedule'> & {
+    actions: NormalizedAlertAction[];
+  },
+  allowMissingConnectorSecrets?: boolean
 ): Promise<void> {
   const { actions, notifyWhen, throttle } = data;
   const hasRuleLevelNotifyWhen = typeof notifyWhen !== 'undefined';
@@ -35,20 +38,26 @@ export async function validateActions(
   const actionsUsingConnectorsWithMissingSecrets = actionResults.filter(
     (result) => result.isMissingSecrets
   );
-
   if (actionsUsingConnectorsWithMissingSecrets.length) {
-    errors.push(
-      i18n.translate('xpack.alerting.rulesClient.validateActions.misconfiguredConnector', {
-        defaultMessage: 'Invalid connectors: {groups}',
-        values: {
-          groups: actionsUsingConnectorsWithMissingSecrets
-            .map((connector) => connector.name)
-            .join(', '),
-        },
-      })
-    );
+    if (allowMissingConnectorSecrets) {
+      context.logger.error(
+        `Invalid connectors with "allowMissingConnectorSecrets": ${actionsUsingConnectorsWithMissingSecrets
+          .map((connector) => connector.name)
+          .join(', ')}`
+      );
+    } else {
+      errors.push(
+        i18n.translate('xpack.alerting.rulesClient.validateActions.misconfiguredConnector', {
+          defaultMessage: 'Invalid connectors: {groups}',
+          values: {
+            groups: actionsUsingConnectorsWithMissingSecrets
+              .map((connector) => connector.name)
+              .join(', '),
+          },
+        })
+      );
+    }
   }
-
   // check for actions with invalid action groups
   const { actionGroups: alertTypeActionGroups } = alertType;
   const usedAlertActionGroups = actions.map((action) => action.group);
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/create.ts b/x-pack/plugins/alerting/server/rules_client/methods/create.ts
index e8dcefe4a9ef1..09dc8f62494b8 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/create.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/create.ts
@@ -46,11 +46,12 @@ export interface CreateOptions<Params extends RuleTypeParams> {
     | 'nextRun'
   > & { actions: NormalizedAlertAction[] };
   options?: SavedObjectOptions;
+  allowMissingConnectorSecrets?: boolean;
 }
 
 export async function create<Params extends RuleTypeParams = never>(
   context: RulesClientContext,
-  { data, options }: CreateOptions<Params>
+  { data, options, allowMissingConnectorSecrets }: CreateOptions<Params>
 ): Promise<SanitizedRule<Params>> {
   const id = options?.id || SavedObjectsUtils.generateId();
 
@@ -104,10 +105,11 @@ export async function create<Params extends RuleTypeParams = never>(
     }
   }
 
-  await validateActions(context, ruleType, data);
+  await validateActions(context, ruleType, data, allowMissingConnectorSecrets);
   await withSpan({ name: 'validateActions', type: 'rules' }, () =>
-    validateActions(context, ruleType, data)
+    validateActions(context, ruleType, data, allowMissingConnectorSecrets)
   );
+
   // Throw error if schedule interval is less than the minimum and we are enforcing it
   const intervalInMs = parseDuration(data.schedule.interval);
   if (
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/update.ts b/x-pack/plugins/alerting/server/rules_client/methods/update.ts
index 8fa3855b95707..5e116f9f21b28 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/update.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/update.ts
@@ -38,22 +38,23 @@ export interface UpdateOptions<Params extends RuleTypeParams> {
     throttle?: string | null;
     notifyWhen?: RuleNotifyWhenType | null;
   };
+  allowMissingConnectorSecrets?: boolean;
 }
 
 export async function update<Params extends RuleTypeParams = never>(
   context: RulesClientContext,
-  { id, data }: UpdateOptions<Params>
+  { id, data, allowMissingConnectorSecrets }: UpdateOptions<Params>
 ): Promise<PartialRule<Params>> {
   return await retryIfConflicts(
     context.logger,
     `rulesClient.update('${id}')`,
-    async () => await updateWithOCC<Params>(context, { id, data })
+    async () => await updateWithOCC<Params>(context, { id, data, allowMissingConnectorSecrets })
   );
 }
 
 async function updateWithOCC<Params extends RuleTypeParams>(
   context: RulesClientContext,
-  { id, data }: UpdateOptions<Params>
+  { id, data, allowMissingConnectorSecrets }: UpdateOptions<Params>
 ): Promise<PartialRule<Params>> {
   let alertSavedObject: SavedObject<RawRule>;
 
@@ -99,7 +100,11 @@ async function updateWithOCC<Params extends RuleTypeParams>(
 
   context.ruleTypeRegistry.ensureRuleTypeEnabled(alertSavedObject.attributes.alertTypeId);
 
-  const updateResult = await updateAlert<Params>(context, { id, data }, alertSavedObject);
+  const updateResult = await updateAlert<Params>(
+    context,
+    { id, data, allowMissingConnectorSecrets },
+    alertSavedObject
+  );
 
   await Promise.all([
     alertSavedObject.attributes.apiKey
@@ -138,7 +143,7 @@ async function updateWithOCC<Params extends RuleTypeParams>(
 
 async function updateAlert<Params extends RuleTypeParams>(
   context: RulesClientContext,
-  { id, data }: UpdateOptions<Params>,
+  { id, data, allowMissingConnectorSecrets }: UpdateOptions<Params>,
   { attributes, version }: SavedObject<RawRule>
 ): Promise<PartialRule<Params>> {
   const ruleType = context.ruleTypeRegistry.get(attributes.alertTypeId);
@@ -156,7 +161,7 @@ async function updateAlert<Params extends RuleTypeParams>(
 
   // Validate
   const validatedAlertTypeParams = validateRuleTypeParams(data.params, ruleType.validate?.params);
-  await validateActions(context, ruleType, data);
+  await validateActions(context, ruleType, data, allowMissingConnectorSecrets);
 
   // Throw error if schedule interval is less than the minimum and we are enforcing it
   const intervalInMs = parseDuration(data.schedule.interval);
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/create.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/create.test.ts
index c11dc8be21ca4..dddfbe85f9ee3 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/create.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/create.test.ts
@@ -3047,4 +3047,120 @@ describe('create()', () => {
     expect(unsecuredSavedObjectsClient.create).not.toHaveBeenCalled();
     expect(taskManager.schedule).not.toHaveBeenCalled();
   });
+  test('should create a rule even if action is missing secret when allowMissingConnectorSecrets is true', async () => {
+    const data = getMockData({
+      actions: [
+        {
+          group: 'default',
+          id: '1',
+          params: {
+            foo: true,
+          },
+        },
+        {
+          group: 'default',
+          id: '1',
+          params: {
+            foo: true,
+          },
+        },
+        {
+          group: 'default',
+          id: '2',
+          params: {
+            foo: true,
+          },
+        },
+      ],
+    });
+    actionsClient.getBulk.mockReset();
+    actionsClient.getBulk.mockResolvedValue([
+      {
+        id: '1',
+        actionTypeId: '.slack',
+        config: {},
+        isMissingSecrets: true,
+        name: 'Slack connector',
+        isPreconfigured: false,
+        isDeprecated: false,
+      },
+    ]);
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
+      id: '1',
+      type: 'alert',
+      attributes: {
+        alertTypeId: '123',
+        schedule: { interval: '1m' },
+        params: {
+          bar: true,
+        },
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        notifyWhen: null,
+        actions: [
+          {
+            group: 'default',
+            actionRef: 'action_0',
+            actionTypeId: '.slack',
+            params: {
+              foo: true,
+            },
+          },
+        ],
+      },
+      references: [
+        {
+          name: 'action_0',
+          type: 'action',
+          id: '1',
+        },
+        {
+          name: 'action_1',
+          type: 'action',
+          id: '1',
+        },
+        {
+          name: 'action_2',
+          type: 'action',
+          id: '2',
+        },
+      ],
+    });
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
+      id: '1',
+      type: 'alert',
+      attributes: {
+        actions: [],
+        scheduledTaskId: 'task-123',
+      },
+      references: [],
+    });
+    const result = await rulesClient.create({ data, allowMissingConnectorSecrets: true });
+    expect(result).toMatchInlineSnapshot(`
+      Object {
+        "actions": Array [
+          Object {
+            "actionTypeId": ".slack",
+            "group": "default",
+            "id": "1",
+            "params": Object {
+              "foo": true,
+            },
+          },
+        ],
+        "alertTypeId": "123",
+        "createdAt": 2019-02-12T21:01:22.479Z,
+        "id": "1",
+        "notifyWhen": null,
+        "params": Object {
+          "bar": true,
+        },
+        "schedule": Object {
+          "interval": "1m",
+        },
+        "scheduledTaskId": "task-123",
+        "updatedAt": 2019-02-12T21:01:22.479Z,
+      }
+    `);
+  });
 });
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/update.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/update.test.ts
index 44c4eeb50fe27..4d16f3e5d66a0 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/update.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/update.test.ts
@@ -2022,6 +2022,155 @@ describe('update()', () => {
     expect(unsecuredSavedObjectsClient.create).not.toHaveBeenCalled();
     expect(taskManager.schedule).not.toHaveBeenCalled();
   });
+  test('should update a rule even if action is missing secret when allowMissingConnectorSecrets is true', async () => {
+    // Reset from default behaviour
+    actionsClient.getBulk.mockReset();
+    actionsClient.getBulk.mockResolvedValue([
+      {
+        id: '1',
+        actionTypeId: '.slack',
+        config: {},
+        isMissingSecrets: true,
+        name: 'slack connector',
+        isPreconfigured: false,
+        isDeprecated: false,
+      },
+    ]);
+    actionsClient.isPreconfigured.mockReset();
+    actionsClient.isPreconfigured.mockReturnValueOnce(false);
+    actionsClient.isPreconfigured.mockReturnValueOnce(true);
+    actionsClient.isPreconfigured.mockReturnValueOnce(true);
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
+      id: '1',
+      type: 'alert',
+      attributes: {
+        enabled: true,
+        schedule: { interval: '1m' },
+        params: {
+          bar: true,
+        },
+        actions: [
+          {
+            group: 'default',
+            actionRef: 'action_0',
+            actionTypeId: '.slack',
+            params: {
+              foo: true,
+            },
+          },
+        ],
+        notifyWhen: 'onActiveAlert',
+        scheduledTaskId: 'task-123',
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+      },
+      references: [
+        {
+          name: 'action_0',
+          type: 'action',
+          id: '1',
+        },
+        {
+          name: 'param:soRef_0',
+          type: 'someSavedObjectType',
+          id: '9',
+        },
+      ],
+    });
+    const result = await rulesClient.update({
+      id: '1',
+      data: {
+        schedule: { interval: '1m' },
+        name: 'abc',
+        tags: ['foo'],
+        params: {
+          bar: true,
+        },
+        throttle: null,
+        notifyWhen: 'onActiveAlert',
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
+      },
+      allowMissingConnectorSecrets: true,
+    });
+
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenNthCalledWith(
+      1,
+      'alert',
+      {
+        actions: [
+          {
+            group: 'default',
+            actionRef: 'action_0',
+            actionTypeId: '.slack',
+            params: {
+              foo: true,
+            },
+          },
+        ],
+        alertTypeId: 'myType',
+        apiKey: null,
+        apiKeyOwner: null,
+        consumer: 'myApp',
+        enabled: true,
+        meta: { versionApiKeyLastmodified: 'v7.10.0' },
+        name: 'abc',
+        notifyWhen: 'onActiveAlert',
+        params: { bar: true },
+        schedule: { interval: '1m' },
+        scheduledTaskId: 'task-123',
+        tags: ['foo'],
+        throttle: null,
+        updatedAt: '2019-02-12T21:01:22.479Z',
+        updatedBy: 'elastic',
+      },
+      {
+        id: '1',
+        overwrite: true,
+        references: [{ id: '1', name: 'action_0', type: 'action' }],
+        version: '123',
+      }
+    );
+
+    expect(result).toMatchInlineSnapshot(`
+      Object {
+        "actions": Array [
+          Object {
+            "actionTypeId": ".slack",
+            "group": "default",
+            "id": "1",
+            "params": Object {
+              "foo": true,
+            },
+          },
+        ],
+        "createdAt": 2019-02-12T21:01:22.479Z,
+        "enabled": true,
+        "id": "1",
+        "notifyWhen": "onActiveAlert",
+        "params": Object {
+          "bar": true,
+        },
+        "schedule": Object {
+          "interval": "1m",
+        },
+        "scheduledTaskId": "task-123",
+        "updatedAt": 2019-02-12T21:01:22.479Z,
+      }
+    `);
+    expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
+      namespace: 'default',
+    });
+    expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
+    expect(actionsClient.isPreconfigured).toHaveBeenCalledTimes(1);
+  });
 
   test('logs warning when creating with an interval less than the minimum configured one when enforce = false', async () => {
     actionsClient.getBulk.mockReset();
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/import_rules/response_schema.test.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/import_rules/response_schema.test.ts
index 2f11e1a9c120f..b2ff257ba2c4e 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/import_rules/response_schema.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/import_rules/response_schema.test.ts
@@ -24,6 +24,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -42,6 +46,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -60,6 +68,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [{ error: { status_code: 400, message: 'some message' } }],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -81,6 +93,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -102,6 +118,10 @@ describe('Import rules response schema', () => {
       ],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -120,6 +140,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -140,6 +164,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: true,
       exceptions_success_count: -1,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -178,6 +206,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded as UnsafeCastForTest);
@@ -217,6 +249,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: 'hello',
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded as UnsafeCastForTest);
@@ -238,6 +274,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -262,6 +302,10 @@ describe('Import rules response schema', () => {
       exceptions_errors: [],
       exceptions_success: true,
       exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
     };
     const decoded = ImportRulesResponse.decode(payload);
     const checked = exactCheck(payload, decoded);
@@ -270,4 +314,182 @@ describe('Import rules response schema', () => {
     expect(getPaths(left(message.errors))).toEqual(['invalid keys "invalid_data"']);
     expect(message.schema).toEqual({});
   });
+
+  test('it should validate an empty import response with a single connectors error', () => {
+    const payload: ImportRulesResponse = {
+      success: false,
+      success_count: 0,
+      rules_count: 0,
+      errors: [],
+      exceptions_errors: [],
+      exceptions_success: true,
+      exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [{ error: { status_code: 400, message: 'some message' } }],
+      action_connectors_warnings: [],
+    };
+    const decoded = ImportRulesResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+  test('it should validate an empty import response with multiple errors', () => {
+    const payload: ImportRulesResponse = {
+      success: false,
+      success_count: 0,
+      rules_count: 0,
+      errors: [
+        { error: { status_code: 400, message: 'some message' } },
+        { error: { status_code: 500, message: 'some message' } },
+      ],
+      exceptions_errors: [],
+      exceptions_success: true,
+      exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [{ error: { status_code: 400, message: 'some message' } }],
+      action_connectors_warnings: [],
+    };
+    const decoded = ImportRulesResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+  test('it should NOT validate action_connectors_success that is not boolean', () => {
+    type UnsafeCastForTest = Either<
+      Errors,
+      {
+        success: boolean;
+        action_connectors_success: string;
+        success_count: number;
+        errors: Array<
+          {
+            id?: string | undefined;
+            rule_id?: string | undefined;
+          } & {
+            error: {
+              status_code: number;
+              message: string;
+            };
+          }
+        >;
+      }
+    >;
+    const payload: Omit<ImportRulesResponse, 'action_connectors_success'> & {
+      action_connectors_success: string;
+    } = {
+      success: true,
+      success_count: 0,
+      rules_count: 0,
+      errors: [],
+      exceptions_errors: [],
+      exceptions_success: true,
+      exceptions_success_count: 0,
+      action_connectors_success: 'invalid',
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
+    };
+    const decoded = ImportRulesResponse.decode(payload);
+    const checked = exactCheck(payload, decoded as UnsafeCastForTest);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "invalid" supplied to "action_connectors_success"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+  test('it should NOT validate a action_connectors_success_count that is a negative number', () => {
+    const payload: ImportRulesResponse = {
+      success: false,
+      success_count: 0,
+      rules_count: 0,
+      errors: [],
+      exceptions_errors: [],
+      exceptions_success: true,
+      exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: -1,
+      action_connectors_errors: [],
+      action_connectors_warnings: [],
+    };
+    const decoded = ImportRulesResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "-1" supplied to "action_connectors_success_count"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+  test('it should  validate a action_connectors_warnings after importing successfully', () => {
+    const payload: ImportRulesResponse = {
+      success: false,
+      success_count: 0,
+      rules_count: 0,
+      errors: [],
+      exceptions_errors: [],
+      exceptions_success: true,
+      exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 1,
+      action_connectors_errors: [],
+      action_connectors_warnings: [{ type: 'type', message: 'message', actionPath: 'actionPath' }],
+    };
+    const decoded = ImportRulesResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+  test('it should NOT validate a action_connectors_warnings that is not WarningSchema', () => {
+    type UnsafeCastForTest = Either<
+      Errors,
+      {
+        success: boolean;
+        action_connectors_warnings: string;
+        success_count: number;
+        errors: Array<
+          {
+            id?: string | undefined;
+            rule_id?: string | undefined;
+          } & {
+            error: {
+              status_code: number;
+              message: string;
+            };
+          }
+        >;
+      }
+    >;
+    const payload: Omit<ImportRulesResponse, 'action_connectors_warnings'> & {
+      action_connectors_warnings: string;
+    } = {
+      success: true,
+      success_count: 0,
+      rules_count: 0,
+      errors: [],
+      exceptions_errors: [],
+      exceptions_success: true,
+      exceptions_success_count: 0,
+      action_connectors_success: true,
+      action_connectors_success_count: 0,
+      action_connectors_errors: [],
+      action_connectors_warnings: 'invalid',
+    };
+    const decoded = ImportRulesResponse.decode(payload);
+    const checked = exactCheck(payload, decoded as UnsafeCastForTest);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "invalid" supplied to "action_connectors_warnings"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
 });
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/import_rules/response_schema.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/import_rules/response_schema.ts
index 77ccd0812c2c9..99212b902c4d3 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/import_rules/response_schema.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/import_rules/response_schema.ts
@@ -7,7 +7,7 @@
 
 import * as t from 'io-ts';
 import { PositiveInteger } from '@kbn/securitysolution-io-ts-types';
-import { errorSchema } from '../../../../schemas/response/error_schema';
+import { errorSchema, warningSchema } from '../../../../schemas/response';
 
 export type ImportRulesResponse = t.TypeOf<typeof ImportRulesResponse>;
 export const ImportRulesResponse = t.exact(
@@ -19,5 +19,9 @@ export const ImportRulesResponse = t.exact(
     success: t.boolean,
     success_count: PositiveInteger,
     errors: t.array(errorSchema),
+    action_connectors_errors: t.array(errorSchema),
+    action_connectors_warnings: t.array(warningSchema),
+    action_connectors_success: t.boolean,
+    action_connectors_success_count: PositiveInteger,
   })
 );
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.mock.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.mock.ts
index 64b82abdb3755..9a26b1a09f066 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.mock.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.mock.ts
@@ -8,6 +8,7 @@
 import { getExceptionExportDetailsMock } from '@kbn/lists-plugin/common/schemas/response/exception_export_details_schema.mock';
 import type { ExportExceptionDetailsMock } from '@kbn/lists-plugin/common/schemas/response/exception_export_details_schema.mock';
 import type { ExportRulesDetails } from './export_rules_details_schema';
+import type { DefaultActionConnectorDetails } from '../../../../../server/lib/detection_engine/rule_management/logic/export/get_export_rule_action_connectors';
 
 interface RuleDetailsMock {
   totalCount?: number;
@@ -16,6 +17,23 @@ interface RuleDetailsMock {
   missingRules?: Array<Record<'rule_id', string>>;
 }
 
+export const getActionConnectorDetailsMock = (): DefaultActionConnectorDetails => ({
+  exported_action_connector_count: 0,
+  missing_action_connection_count: 0,
+  missing_action_connections: [],
+  excluded_action_connection_count: 0,
+  excluded_action_connections: [],
+});
+export const getOutputDetailsSampleWithActionConnectors = (): ExportRulesDetails => ({
+  ...getOutputDetailsSample(),
+  ...getExceptionExportDetailsMock(),
+  exported_action_connector_count: 1,
+  missing_action_connection_count: 0,
+  missing_action_connections: [],
+  excluded_action_connection_count: 0,
+  excluded_action_connections: [],
+});
+
 export const getOutputDetailsSample = (ruleDetails?: RuleDetailsMock): ExportRulesDetails => ({
   exported_count: ruleDetails?.totalCount ?? 0,
   exported_rules_count: ruleDetails?.rulesCount ?? 0,
@@ -29,6 +47,7 @@ export const getOutputDetailsSampleWithExceptions = (
 ): ExportRulesDetails => ({
   ...getOutputDetailsSample(ruleDetails),
   ...getExceptionExportDetailsMock(exceptionDetails),
+  ...getActionConnectorDetailsMock(),
 });
 
 export const getSampleDetailsAsNdjson = (sample: ExportRulesDetails): string => {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.test.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.test.ts
index 2c84a34b34928..a91f59924ef72 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.test.ts
@@ -18,15 +18,16 @@ import { exactCheck, foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts
 
 import {
   getOutputDetailsSample,
+  getOutputDetailsSampleWithActionConnectors,
   getOutputDetailsSampleWithExceptions,
 } from './export_rules_details_schema.mock';
 import type { ExportRulesDetails } from './export_rules_details_schema';
-import { exportRulesDetailsWithExceptionsSchema } from './export_rules_details_schema';
+import { exportRulesDetailsWithExceptionsAndConnectorsSchema } from './export_rules_details_schema';
 
-describe('exportRulesDetailsWithExceptionsSchema', () => {
+describe('exportRulesDetailsWithExceptionsAndConnectorsSchema', () => {
   test('it should validate export details response', () => {
     const payload = getOutputDetailsSample();
-    const decoded = exportRulesDetailsWithExceptionsSchema.decode(payload);
+    const decoded = exportRulesDetailsWithExceptionsAndConnectorsSchema.decode(payload);
     const checked = exactCheck(payload, decoded);
     const message = pipe(checked, foldLeftRight);
 
@@ -36,7 +37,7 @@ describe('exportRulesDetailsWithExceptionsSchema', () => {
 
   test('it should validate export details with exceptions details response', () => {
     const payload = getOutputDetailsSampleWithExceptions();
-    const decoded = exportRulesDetailsWithExceptionsSchema.decode(payload);
+    const decoded = exportRulesDetailsWithExceptionsAndConnectorsSchema.decode(payload);
     const checked = exactCheck(payload, decoded);
     const message = pipe(checked, foldLeftRight);
 
@@ -44,12 +45,21 @@ describe('exportRulesDetailsWithExceptionsSchema', () => {
     expect(message.schema).toEqual(payload);
   });
 
+  test('it should validate export details with action connectors details response', () => {
+    const payload = getOutputDetailsSampleWithActionConnectors();
+    const decoded = exportRulesDetailsWithExceptionsAndConnectorsSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
   test('it should strip out extra keys', () => {
     const payload: ExportRulesDetails & {
       extraKey?: string;
     } = getOutputDetailsSample();
     payload.extraKey = 'some extra key';
-    const decoded = exportRulesDetailsWithExceptionsSchema.decode(payload);
+    const decoded = exportRulesDetailsWithExceptionsAndConnectorsSchema.decode(payload);
     const message = pipe(decoded, foldLeftRight);
 
     expect(getPaths(left(message.errors))).toEqual([]);
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.ts
index 85b423135566b..205861bdd42a7 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/export/export_rules_details_schema.ts
@@ -9,13 +9,6 @@ import * as t from 'io-ts';
 import { exportExceptionDetails } from '@kbn/securitysolution-io-ts-list-types';
 import { NonEmptyString } from '@kbn/securitysolution-io-ts-types';
 
-const createSchema = <Required extends t.Props, Optional extends t.Props>(
-  requiredFields: Required,
-  optionalFields: Optional
-) => {
-  return t.intersection([t.exact(t.type(requiredFields)), t.exact(t.partial(optionalFields))]);
-};
-
 const exportRulesDetails = {
   exported_count: t.number,
   exported_rules_count: t.number,
@@ -28,11 +21,38 @@ const exportRulesDetails = {
   ),
   missing_rules_count: t.number,
 };
+const excludedActionConnectors = t.intersection([
+  t.exact(
+    t.type({
+      id: NonEmptyString,
+      type: NonEmptyString,
+    })
+  ),
+  t.exact(t.partial({ reason: t.string })),
+]);
+
+const exportRuleActionConnectorsDetails = {
+  exported_action_connector_count: t.number,
+  missing_action_connection_count: t.number,
+  missing_action_connections: t.array(
+    t.exact(
+      t.type({
+        id: NonEmptyString,
+        type: NonEmptyString,
+      })
+    )
+  ),
+  excluded_action_connection_count: t.number,
+  excluded_action_connections: t.array(excludedActionConnectors),
+};
 
-// With exceptions
-export const exportRulesDetailsWithExceptionsSchema = createSchema(
-  exportRulesDetails,
-  exportExceptionDetails
-);
+// With exceptions and connectors
+export const exportRulesDetailsWithExceptionsAndConnectorsSchema = t.intersection([
+  t.exact(t.type(exportRulesDetails)),
+  t.exact(t.partial(exportExceptionDetails)),
+  t.exact(t.partial(exportRuleActionConnectorsDetails)),
+]);
 
-export type ExportRulesDetails = t.TypeOf<typeof exportRulesDetailsWithExceptionsSchema>;
+export type ExportRulesDetails = t.TypeOf<
+  typeof exportRulesDetailsWithExceptionsAndConnectorsSchema
+>;
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/import/rule_to_import.mock.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/import/rule_to_import.mock.ts
index d1dc9e8ac4663..cec58d1c5fdc6 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/import/rule_to_import.mock.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/model/import/rule_to_import.mock.ts
@@ -80,3 +80,41 @@ export const getImportThreatMatchRulesSchemaMock = (ruleId = 'rule-1'): RuleToIm
     },
   ],
 });
+
+export const webHookConnector = {
+  id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+  type: 'action',
+  updated_at: '2023-01-25T14:35:52.852Z',
+  created_at: '2023-01-25T14:35:52.852Z',
+  version: 'WzUxNTksMV0=',
+  attributes: {
+    actionTypeId: '.webhook',
+    name: 'webhook',
+    isMissingSecrets: false,
+    config: {},
+    secrets: {},
+  },
+  references: [],
+  migrationVersion: { action: '8.3.0' },
+  coreMigrationVersion: '8.7.0',
+};
+
+export const ruleWithConnectorNdJSON = (): string => {
+  const items = [
+    {
+      ...getImportRulesSchemaMock(),
+      actions: [
+        {
+          group: 'default',
+          id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+          action_type_id: '.webhook',
+          params: {},
+        },
+      ],
+    },
+    webHookConnector,
+  ];
+  const stringOfExceptions = items.map((item) => JSON.stringify(item));
+
+  return stringOfExceptions.join('\n');
+};
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/index.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/index.ts
index b20a956525e2e..76da687604028 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/index.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/index.ts
@@ -6,3 +6,4 @@
  */
 
 export * from './error_schema';
+export * from './warning_schema';
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/warning_schema/index.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/warning_schema/index.ts
new file mode 100644
index 0000000000000..1a401d1941cb0
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/warning_schema/index.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+const partial = t.exact(
+  t.partial({
+    buttonLabel: t.string,
+  })
+);
+const required = t.exact(
+  t.type({
+    type: t.string,
+    message: t.string,
+    actionPath: t.string,
+  })
+);
+
+export const warningSchema = t.intersection([partial, required]);
+export type WarningSchema = t.TypeOf<typeof warningSchema>;
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index 20f41f938502b..a80c7099c31ff 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -573,6 +573,11 @@ export const expectedExportedRule = (ruleResponse: Cypress.Response<RuleResponse
     missing_exception_list_items: [],
     missing_exception_lists: [],
     missing_exception_lists_count: 0,
+    exported_action_connector_count: 0,
+    missing_action_connection_count: 0,
+    missing_action_connections: [],
+    excluded_action_connection_count: 0,
+    excluded_action_connections: [],
   };
 
   return `${JSON.stringify(rule)}\n${JSON.stringify(details)}\n`;
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
index a90609fc30531..870faea26a360 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
@@ -123,10 +123,13 @@ export const TOASTER_BODY = '[data-test-subj="globalToastList"] [data-test-subj=
 
 export const TOASTER_ERROR_BTN = '[data-test-subj="errorToastBtn"]';
 
-export const RULE_IMPORT_OVERWRITE_CHECKBOX = '[id="import-data-modal-checkbox-label"]';
+export const RULE_IMPORT_OVERWRITE_CHECKBOX = '[id="importDataModalCheckboxLabel"]';
 
 export const RULE_IMPORT_OVERWRITE_EXCEPTIONS_CHECKBOX =
-  '[id="import-data-modal-exceptions-checkbox-label"]';
+  '[id="importDataModalExceptionsCheckboxLabel"]';
+
+export const RULE_IMPORT_OVERWRITE_CONNECTORS_CHECKBOX =
+  '[id="importDataModalActionConnectorsCheckbox"]';
 
 export const RULES_TAGS_POPOVER_BTN = '[data-test-subj="tagsDisplayPopoverButton"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
index 821b4c415fdd8..83492ef9c4437 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
@@ -56,6 +56,7 @@ import {
   MODAL_CONFIRMATION_CANCEL_BTN,
   MODAL_CONFIRMATION_BODY,
   RULE_SEARCH_FIELD,
+  RULE_IMPORT_OVERWRITE_CONNECTORS_CHECKBOX,
 } from '../screens/alerts_detection_rules';
 import { EUI_CHECKBOX } from '../screens/common/controls';
 import { ALL_ACTIONS } from '../screens/rule_details';
@@ -382,13 +383,18 @@ const selectOverwriteExceptionsRulesImport = () => {
     .pipe(($el) => $el.trigger('click'))
     .should('be.checked');
 };
-
+const selectOverwriteConnectorsRulesImport = () => {
+  cy.get(RULE_IMPORT_OVERWRITE_CONNECTORS_CHECKBOX)
+    .pipe(($el) => $el.trigger('click'))
+    .should('be.checked');
+};
 export const importRulesWithOverwriteAll = (rulesFile: string) => {
   cy.get(RULE_IMPORT_MODAL).click();
   cy.get(INPUT_FILE).should('exist');
   cy.get(INPUT_FILE).trigger('click', { force: true }).attachFile(rulesFile).trigger('change');
   selectOverwriteRulesImport();
   selectOverwriteExceptionsRulesImport();
+  selectOverwriteConnectorsRulesImport();
   cy.get(RULE_IMPORT_MODAL_BUTTON).last().click({ force: true });
   cy.get(INPUT_FILE).should('not.exist');
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/import_data_modal/__snapshots__/index.test.tsx.snap
index 47dd897f71ffb..3378225f6b602 100644
--- a/x-pack/plugins/security_solution/public/common/components/import_data_modal/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/__snapshots__/index.test.tsx.snap
@@ -90,13 +90,521 @@ Object {
               <div
                 class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
               />
+              <div
+                class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
+              />
+              <div
+                class="euiCheckbox emotion-euiCheckbox"
+              >
+                <input
+                  class="euiCheckbox__input"
+                  data-test-subj="importDataModalCheckboxLabel"
+                  id="importDataModalCheckboxLabel"
+                  type="checkbox"
+                />
+                <div
+                  class="euiCheckbox__square"
+                />
+                <label
+                  class="euiCheckbox__label"
+                  for="importDataModalCheckboxLabel"
+                >
+                  checkBoxLabel
+                </label>
+              </div>
+            </div>
+          </div>
+          <div
+            class="euiModalFooter emotion-euiModalFooter"
+          >
+            <button
+              class="euiButtonEmpty css-9t7nyf-empty-primary"
+              type="button"
+            >
+              <span
+                class="euiButtonContent euiButtonEmpty__content"
+              >
+                <span
+                  class="euiButtonEmpty__text"
+                >
+                  Cancel
+                </span>
+              </span>
+            </button>
+            <button
+              class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-isDisabled-m-fill-disabled"
+              data-test-subj="import-data-modal-button"
+              disabled=""
+              type="button"
+            >
+              <span
+                class="emotion-euiButtonDisplayContent"
+              >
+                <span
+                  class="eui-textTruncate"
+                >
+                  submitBtnText
+                </span>
+              </span>
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </body>,
+  "container": <div />,
+  "debug": [Function],
+  "findAllByAltText": [Function],
+  "findAllByDisplayValue": [Function],
+  "findAllByLabelText": [Function],
+  "findAllByPlaceholderText": [Function],
+  "findAllByRole": [Function],
+  "findAllByTestId": [Function],
+  "findAllByText": [Function],
+  "findAllByTitle": [Function],
+  "findByAltText": [Function],
+  "findByDisplayValue": [Function],
+  "findByLabelText": [Function],
+  "findByPlaceholderText": [Function],
+  "findByRole": [Function],
+  "findByTestId": [Function],
+  "findByText": [Function],
+  "findByTitle": [Function],
+  "getAllByAltText": [Function],
+  "getAllByDisplayValue": [Function],
+  "getAllByLabelText": [Function],
+  "getAllByPlaceholderText": [Function],
+  "getAllByRole": [Function],
+  "getAllByTestId": [Function],
+  "getAllByText": [Function],
+  "getAllByTitle": [Function],
+  "getByAltText": [Function],
+  "getByDisplayValue": [Function],
+  "getByLabelText": [Function],
+  "getByPlaceholderText": [Function],
+  "getByRole": [Function],
+  "getByTestId": [Function],
+  "getByText": [Function],
+  "getByTitle": [Function],
+  "queryAllByAltText": [Function],
+  "queryAllByDisplayValue": [Function],
+  "queryAllByLabelText": [Function],
+  "queryAllByPlaceholderText": [Function],
+  "queryAllByRole": [Function],
+  "queryAllByTestId": [Function],
+  "queryAllByText": [Function],
+  "queryAllByTitle": [Function],
+  "queryByAltText": [Function],
+  "queryByDisplayValue": [Function],
+  "queryByLabelText": [Function],
+  "queryByPlaceholderText": [Function],
+  "queryByRole": [Function],
+  "queryByTestId": [Function],
+  "queryByText": [Function],
+  "queryByTitle": [Function],
+  "rerender": [Function],
+  "unmount": [Function],
+}
+`;
+
+exports[`ImportDataModal should import file, with warnings 1`] = `
+Object {
+  "asFragment": [Function],
+  "baseElement": <body>
+    <div />
+    <div
+      class="euiOverlayMask emotion-euiOverlayMask-aboveHeader"
+      data-euiportal="true"
+      data-relative-to-header="above"
+    >
+      <div
+        data-eui="EuiFocusTrap"
+      >
+        <div
+          class="euiModal emotion-euiModal"
+          style="max-inline-size: 750px;"
+          tabindex="0"
+        >
+          <button
+            aria-label="Closes this modal window"
+            class="euiButtonIcon euiButtonIcon--xSmall euiModal__closeIcon emotion-euiButtonIcon-empty-text-hoverStyles-euiModal__closeIcon"
+            type="button"
+          >
+            <span
+              aria-hidden="true"
+              class="euiButtonIcon__icon"
+              color="inherit"
+              data-euiicon-type="cross"
+            />
+          </button>
+          <div
+            class="euiModalHeader emotion-euiModalHeader"
+          >
+            <h1
+              class="euiTitle euiModalHeader__title emotion-euiTitle-m"
+            >
+              title
+            </h1>
+          </div>
+          <div
+            class="euiModalBody emotion-euiModalBody"
+          >
+            <div
+              class="euiModalBody__overflow emotion-euiModalBody__overflow"
+            >
+              <div
+                class="euiText emotion-euiText-s"
+              >
+                <h4>
+                  description
+                </h4>
+              </div>
+              <div
+                class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
+              />
+              <div
+                class="euiFilePicker euiFilePicker--large euiFilePicker--fullWidth euiFilePicker-hasFiles"
+              >
+                <div
+                  class="euiFilePicker__wrap"
+                >
+                  <input
+                    accept=".ndjson"
+                    aria-describedby="rule-file-picker-filePicker__prompt"
+                    class="euiFilePicker__input"
+                    data-test-subj="rule-file-picker"
+                    id="rule-file-picker"
+                    type="file"
+                  />
+                  <div
+                    class="euiFilePicker__prompt"
+                    id="rule-file-picker-filePicker__prompt"
+                  >
+                    <span
+                      aria-hidden="true"
+                      class="euiFilePicker__icon"
+                      color="primary"
+                      data-euiicon-type="importAction"
+                    />
+                    <div
+                      class="euiFilePicker__promptText"
+                    >
+                      subtitle
+                    </div>
+                    <button
+                      aria-label="Clear selected files"
+                      class="euiButtonEmpty euiButtonEmpty--xSmall euiFilePicker__clearButton css-9t7nyf-empty-primary"
+                      type="button"
+                    >
+                      <span
+                        class="euiButtonContent euiButtonEmpty__content"
+                      >
+                        <span
+                          class="euiButtonEmpty__text"
+                        >
+                          Remove
+                        </span>
+                      </span>
+                    </button>
+                  </div>
+                </div>
+              </div>
+              <div
+                class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
+              />
+              <div
+                class="euiPanel euiPanel--warning euiPanel--paddingMedium euiCallOut euiCallOut--warning emotion-euiPanel-none-m-warning-euiCallOut"
+                data-test-subj="actionConnectorsWarningsCallOut"
+              >
+                <h2
+                  class="euiTitle euiCallOutHeader__title emotion-euiTitle-xs-euiCallOutHeader-warning"
+                >
+                  <span
+                    aria-hidden="true"
+                    class="emotion-euiCallOut__icon"
+                    color="inherit"
+                    data-euiicon-type="alert"
+                  />
+                  <span
+                    data-test-subj="actionConnectorsWarningsCallOutTitle"
+                  >
+                    1 connector imported
+                  </span>
+                </h2>
+                <div
+                  class="euiText emotion-euiText-s-euiTextColor-default-euiCallOut__description"
+                >
+                  <div
+                    class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-stretch-column"
+                  >
+                    <div
+                      class="euiFlexItem emotion-euiFlexItem-grow-1"
+                      data-test-subj="actionConnectorsWarningsCallOutMessage"
+                    >
+                      <div
+                        class="euiText emotion-euiText-xs"
+                      >
+                        1 connector has sensitive information that requires updates.
+                      </div>
+                    </div>
+                    <div
+                      class="euiFlexItem emotion-euiFlexItem-grow-1"
+                    >
+                      <div
+                        class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-flexEnd-columnReverse"
+                      >
+                        <button
+                          class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-m-base-warning"
+                          data-test-subj="actionConnectorsWarningsCallOutButton"
+                          type="button"
+                        >
+                          <span
+                            class="emotion-euiButtonDisplayContent"
+                          >
+                            <span
+                              class="eui-textTruncate"
+                            >
+                              buttonLabel
+                            </span>
+                          </span>
+                        </button>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </div>
+              <div
+                class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
+              />
+              <div
+                class="euiCheckbox emotion-euiCheckbox"
+              >
+                <input
+                  class="euiCheckbox__input"
+                  data-test-subj="importDataModalCheckboxLabel"
+                  id="importDataModalCheckboxLabel"
+                  type="checkbox"
+                />
+                <div
+                  class="euiCheckbox__square"
+                />
+                <label
+                  class="euiCheckbox__label"
+                  for="importDataModalCheckboxLabel"
+                >
+                  checkBoxLabel
+                </label>
+              </div>
+            </div>
+          </div>
+          <div
+            class="euiModalFooter emotion-euiModalFooter"
+          >
+            <button
+              class="euiButtonEmpty css-9t7nyf-empty-primary"
+              type="button"
+            >
+              <span
+                class="euiButtonContent euiButtonEmpty__content"
+              >
+                <span
+                  class="euiButtonEmpty__text"
+                >
+                  Cancel
+                </span>
+              </span>
+            </button>
+            <button
+              class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-isDisabled-m-fill-disabled"
+              data-test-subj="import-data-modal-button"
+              disabled=""
+              type="button"
+            >
+              <span
+                class="emotion-euiButtonDisplayContent"
+              >
+                <span
+                  class="eui-textTruncate"
+                >
+                  submitBtnText
+                </span>
+              </span>
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </body>,
+  "container": <div />,
+  "debug": [Function],
+  "findAllByAltText": [Function],
+  "findAllByDisplayValue": [Function],
+  "findAllByLabelText": [Function],
+  "findAllByPlaceholderText": [Function],
+  "findAllByRole": [Function],
+  "findAllByTestId": [Function],
+  "findAllByText": [Function],
+  "findAllByTitle": [Function],
+  "findByAltText": [Function],
+  "findByDisplayValue": [Function],
+  "findByLabelText": [Function],
+  "findByPlaceholderText": [Function],
+  "findByRole": [Function],
+  "findByTestId": [Function],
+  "findByText": [Function],
+  "findByTitle": [Function],
+  "getAllByAltText": [Function],
+  "getAllByDisplayValue": [Function],
+  "getAllByLabelText": [Function],
+  "getAllByPlaceholderText": [Function],
+  "getAllByRole": [Function],
+  "getAllByTestId": [Function],
+  "getAllByText": [Function],
+  "getAllByTitle": [Function],
+  "getByAltText": [Function],
+  "getByDisplayValue": [Function],
+  "getByLabelText": [Function],
+  "getByPlaceholderText": [Function],
+  "getByRole": [Function],
+  "getByTestId": [Function],
+  "getByText": [Function],
+  "getByTitle": [Function],
+  "queryAllByAltText": [Function],
+  "queryAllByDisplayValue": [Function],
+  "queryAllByLabelText": [Function],
+  "queryAllByPlaceholderText": [Function],
+  "queryAllByRole": [Function],
+  "queryAllByTestId": [Function],
+  "queryAllByText": [Function],
+  "queryAllByTitle": [Function],
+  "queryByAltText": [Function],
+  "queryByDisplayValue": [Function],
+  "queryByLabelText": [Function],
+  "queryByPlaceholderText": [Function],
+  "queryByRole": [Function],
+  "queryByTestId": [Function],
+  "queryByText": [Function],
+  "queryByTitle": [Function],
+  "rerender": [Function],
+  "unmount": [Function],
+}
+`;
+
+exports[`ImportDataModal should import file, with warnings but no action_connectors_success_count 1`] = `
+Object {
+  "asFragment": [Function],
+  "baseElement": <body>
+    <div />
+    <div
+      class="euiOverlayMask emotion-euiOverlayMask-aboveHeader"
+      data-euiportal="true"
+      data-relative-to-header="above"
+    >
+      <div
+        data-eui="EuiFocusTrap"
+      >
+        <div
+          class="euiModal emotion-euiModal"
+          style="max-inline-size: 750px;"
+          tabindex="0"
+        >
+          <button
+            aria-label="Closes this modal window"
+            class="euiButtonIcon euiButtonIcon--xSmall euiModal__closeIcon emotion-euiButtonIcon-empty-text-hoverStyles-euiModal__closeIcon"
+            type="button"
+          >
+            <span
+              aria-hidden="true"
+              class="euiButtonIcon__icon"
+              color="inherit"
+              data-euiicon-type="cross"
+            />
+          </button>
+          <div
+            class="euiModalHeader emotion-euiModalHeader"
+          >
+            <h1
+              class="euiTitle euiModalHeader__title emotion-euiTitle-m"
+            >
+              title
+            </h1>
+          </div>
+          <div
+            class="euiModalBody emotion-euiModalBody"
+          >
+            <div
+              class="euiModalBody__overflow emotion-euiModalBody__overflow"
+            >
+              <div
+                class="euiText emotion-euiText-s"
+              >
+                <h4>
+                  description
+                </h4>
+              </div>
+              <div
+                class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
+              />
+              <div
+                class="euiFilePicker euiFilePicker--large euiFilePicker--fullWidth euiFilePicker-hasFiles"
+              >
+                <div
+                  class="euiFilePicker__wrap"
+                >
+                  <input
+                    accept=".ndjson"
+                    aria-describedby="rule-file-picker-filePicker__prompt"
+                    class="euiFilePicker__input"
+                    data-test-subj="rule-file-picker"
+                    id="rule-file-picker"
+                    type="file"
+                  />
+                  <div
+                    class="euiFilePicker__prompt"
+                    id="rule-file-picker-filePicker__prompt"
+                  >
+                    <span
+                      aria-hidden="true"
+                      class="euiFilePicker__icon"
+                      color="primary"
+                      data-euiicon-type="importAction"
+                    />
+                    <div
+                      class="euiFilePicker__promptText"
+                    >
+                      subtitle
+                    </div>
+                    <button
+                      aria-label="Clear selected files"
+                      class="euiButtonEmpty euiButtonEmpty--xSmall euiFilePicker__clearButton css-9t7nyf-empty-primary"
+                      type="button"
+                    >
+                      <span
+                        class="euiButtonContent euiButtonEmpty__content"
+                      >
+                        <span
+                          class="euiButtonEmpty__text"
+                        >
+                          Remove
+                        </span>
+                      </span>
+                    </button>
+                  </div>
+                </div>
+              </div>
+              <div
+                class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
+              />
+              <div
+                class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
+              />
               <div
                 class="euiCheckbox emotion-euiCheckbox"
               >
                 <input
                   class="euiCheckbox__input"
-                  data-test-subj="import-data-modal-checkbox-label"
-                  id="import-data-modal-checkbox-label"
+                  data-test-subj="importDataModalCheckboxLabel"
+                  id="importDataModalCheckboxLabel"
                   type="checkbox"
                 />
                 <div
@@ -104,7 +612,7 @@ Object {
                 />
                 <label
                   class="euiCheckbox__label"
-                  for="import-data-modal-checkbox-label"
+                  for="importDataModalCheckboxLabel"
                 >
                   checkBoxLabel
                 </label>
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/__snapshots__/action_connectors_warning.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/__snapshots__/action_connectors_warning.test.tsx.snap
new file mode 100644
index 0000000000000..fba4aa3d0fb96
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/__snapshots__/action_connectors_warning.test.tsx.snap
@@ -0,0 +1,678 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`ActionConnectorWarnings should not render if importedActionConnectorsCount is falsy and empty warnings array 1`] = `
+Object {
+  "asFragment": [Function],
+  "baseElement": <body>
+    <div />
+  </body>,
+  "container": <div />,
+  "debug": [Function],
+  "findAllByAltText": [Function],
+  "findAllByDisplayValue": [Function],
+  "findAllByLabelText": [Function],
+  "findAllByPlaceholderText": [Function],
+  "findAllByRole": [Function],
+  "findAllByTestId": [Function],
+  "findAllByText": [Function],
+  "findAllByTitle": [Function],
+  "findByAltText": [Function],
+  "findByDisplayValue": [Function],
+  "findByLabelText": [Function],
+  "findByPlaceholderText": [Function],
+  "findByRole": [Function],
+  "findByTestId": [Function],
+  "findByText": [Function],
+  "findByTitle": [Function],
+  "getAllByAltText": [Function],
+  "getAllByDisplayValue": [Function],
+  "getAllByLabelText": [Function],
+  "getAllByPlaceholderText": [Function],
+  "getAllByRole": [Function],
+  "getAllByTestId": [Function],
+  "getAllByText": [Function],
+  "getAllByTitle": [Function],
+  "getByAltText": [Function],
+  "getByDisplayValue": [Function],
+  "getByLabelText": [Function],
+  "getByPlaceholderText": [Function],
+  "getByRole": [Function],
+  "getByTestId": [Function],
+  "getByText": [Function],
+  "getByTitle": [Function],
+  "queryAllByAltText": [Function],
+  "queryAllByDisplayValue": [Function],
+  "queryAllByLabelText": [Function],
+  "queryAllByPlaceholderText": [Function],
+  "queryAllByRole": [Function],
+  "queryAllByTestId": [Function],
+  "queryAllByText": [Function],
+  "queryAllByTitle": [Function],
+  "queryByAltText": [Function],
+  "queryByDisplayValue": [Function],
+  "queryByLabelText": [Function],
+  "queryByPlaceholderText": [Function],
+  "queryByRole": [Function],
+  "queryByTestId": [Function],
+  "queryByText": [Function],
+  "queryByTitle": [Function],
+  "rerender": [Function],
+  "unmount": [Function],
+}
+`;
+
+exports[`ActionConnectorWarnings should not render if importedActionConnectorsCount is truthy and empty warnings array 1`] = `
+Object {
+  "asFragment": [Function],
+  "baseElement": <body>
+    <div />
+  </body>,
+  "container": <div />,
+  "debug": [Function],
+  "findAllByAltText": [Function],
+  "findAllByDisplayValue": [Function],
+  "findAllByLabelText": [Function],
+  "findAllByPlaceholderText": [Function],
+  "findAllByRole": [Function],
+  "findAllByTestId": [Function],
+  "findAllByText": [Function],
+  "findAllByTitle": [Function],
+  "findByAltText": [Function],
+  "findByDisplayValue": [Function],
+  "findByLabelText": [Function],
+  "findByPlaceholderText": [Function],
+  "findByRole": [Function],
+  "findByTestId": [Function],
+  "findByText": [Function],
+  "findByTitle": [Function],
+  "getAllByAltText": [Function],
+  "getAllByDisplayValue": [Function],
+  "getAllByLabelText": [Function],
+  "getAllByPlaceholderText": [Function],
+  "getAllByRole": [Function],
+  "getAllByTestId": [Function],
+  "getAllByText": [Function],
+  "getAllByTitle": [Function],
+  "getByAltText": [Function],
+  "getByDisplayValue": [Function],
+  "getByLabelText": [Function],
+  "getByPlaceholderText": [Function],
+  "getByRole": [Function],
+  "getByTestId": [Function],
+  "getByText": [Function],
+  "getByTitle": [Function],
+  "queryAllByAltText": [Function],
+  "queryAllByDisplayValue": [Function],
+  "queryAllByLabelText": [Function],
+  "queryAllByPlaceholderText": [Function],
+  "queryAllByRole": [Function],
+  "queryAllByTestId": [Function],
+  "queryAllByText": [Function],
+  "queryAllByTitle": [Function],
+  "queryByAltText": [Function],
+  "queryByDisplayValue": [Function],
+  "queryByLabelText": [Function],
+  "queryByPlaceholderText": [Function],
+  "queryByRole": [Function],
+  "queryByTestId": [Function],
+  "queryByText": [Function],
+  "queryByTitle": [Function],
+  "rerender": [Function],
+  "unmount": [Function],
+}
+`;
+
+exports[`ActionConnectorWarnings should render if 1 connectors were imported and use the warning message with the correct imported number 1`] = `
+Object {
+  "asFragment": [Function],
+  "baseElement": <body>
+    <div>
+      <div
+        class="euiPanel euiPanel--warning euiPanel--paddingMedium euiCallOut euiCallOut--warning emotion-euiPanel-none-m-warning-euiCallOut"
+        data-test-subj="actionConnectorsWarningsCallOut"
+      >
+        <h2
+          class="euiTitle euiCallOutHeader__title emotion-euiTitle-xs-euiCallOutHeader-warning"
+        >
+          <span
+            aria-hidden="true"
+            class="emotion-euiCallOut__icon"
+            color="inherit"
+            data-euiicon-type="alert"
+          />
+          <span
+            data-test-subj="actionConnectorsWarningsCallOutTitle"
+          >
+            1 connector imported
+          </span>
+        </h2>
+        <div
+          class="euiText emotion-euiText-s-euiTextColor-default-euiCallOut__description"
+        >
+          <div
+            class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-stretch-column"
+          >
+            <div
+              class="euiFlexItem emotion-euiFlexItem-grow-1"
+              data-test-subj="actionConnectorsWarningsCallOutMessage"
+            >
+              <div
+                class="euiText emotion-euiText-xs"
+              >
+                1 connector has sensitive information that requires updates.
+              </div>
+            </div>
+            <div
+              class="euiFlexItem emotion-euiFlexItem-grow-1"
+            >
+              <div
+                class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-flexEnd-columnReverse"
+              >
+                <button
+                  class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-m-base-warning"
+                  data-test-subj="actionConnectorsWarningsCallOutButton"
+                  type="button"
+                >
+                  <span
+                    class="emotion-euiButtonDisplayContent"
+                  >
+                    <span
+                      class="eui-textTruncate"
+                    >
+                      Go to connectors
+                    </span>
+                  </span>
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </body>,
+  "container": <div>
+    <div
+      class="euiPanel euiPanel--warning euiPanel--paddingMedium euiCallOut euiCallOut--warning emotion-euiPanel-none-m-warning-euiCallOut"
+      data-test-subj="actionConnectorsWarningsCallOut"
+    >
+      <h2
+        class="euiTitle euiCallOutHeader__title emotion-euiTitle-xs-euiCallOutHeader-warning"
+      >
+        <span
+          aria-hidden="true"
+          class="emotion-euiCallOut__icon"
+          color="inherit"
+          data-euiicon-type="alert"
+        />
+        <span
+          data-test-subj="actionConnectorsWarningsCallOutTitle"
+        >
+          1 connector imported
+        </span>
+      </h2>
+      <div
+        class="euiText emotion-euiText-s-euiTextColor-default-euiCallOut__description"
+      >
+        <div
+          class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-stretch-column"
+        >
+          <div
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
+            data-test-subj="actionConnectorsWarningsCallOutMessage"
+          >
+            <div
+              class="euiText emotion-euiText-xs"
+            >
+              1 connector has sensitive information that requires updates.
+            </div>
+          </div>
+          <div
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
+          >
+            <div
+              class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-flexEnd-columnReverse"
+            >
+              <button
+                class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-m-base-warning"
+                data-test-subj="actionConnectorsWarningsCallOutButton"
+                type="button"
+              >
+                <span
+                  class="emotion-euiButtonDisplayContent"
+                >
+                  <span
+                    class="eui-textTruncate"
+                  >
+                    Go to connectors
+                  </span>
+                </span>
+              </button>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>,
+  "debug": [Function],
+  "findAllByAltText": [Function],
+  "findAllByDisplayValue": [Function],
+  "findAllByLabelText": [Function],
+  "findAllByPlaceholderText": [Function],
+  "findAllByRole": [Function],
+  "findAllByTestId": [Function],
+  "findAllByText": [Function],
+  "findAllByTitle": [Function],
+  "findByAltText": [Function],
+  "findByDisplayValue": [Function],
+  "findByLabelText": [Function],
+  "findByPlaceholderText": [Function],
+  "findByRole": [Function],
+  "findByTestId": [Function],
+  "findByText": [Function],
+  "findByTitle": [Function],
+  "getAllByAltText": [Function],
+  "getAllByDisplayValue": [Function],
+  "getAllByLabelText": [Function],
+  "getAllByPlaceholderText": [Function],
+  "getAllByRole": [Function],
+  "getAllByTestId": [Function],
+  "getAllByText": [Function],
+  "getAllByTitle": [Function],
+  "getByAltText": [Function],
+  "getByDisplayValue": [Function],
+  "getByLabelText": [Function],
+  "getByPlaceholderText": [Function],
+  "getByRole": [Function],
+  "getByTestId": [Function],
+  "getByText": [Function],
+  "getByTitle": [Function],
+  "queryAllByAltText": [Function],
+  "queryAllByDisplayValue": [Function],
+  "queryAllByLabelText": [Function],
+  "queryAllByPlaceholderText": [Function],
+  "queryAllByRole": [Function],
+  "queryAllByTestId": [Function],
+  "queryAllByText": [Function],
+  "queryAllByTitle": [Function],
+  "queryByAltText": [Function],
+  "queryByDisplayValue": [Function],
+  "queryByLabelText": [Function],
+  "queryByPlaceholderText": [Function],
+  "queryByRole": [Function],
+  "queryByTestId": [Function],
+  "queryByText": [Function],
+  "queryByTitle": [Function],
+  "rerender": [Function],
+  "unmount": [Function],
+}
+`;
+
+exports[`ActionConnectorWarnings should render if 2 connectors were imported and use the button label when is set 1`] = `
+Object {
+  "asFragment": [Function],
+  "baseElement": <body>
+    <div>
+      <div
+        class="euiPanel euiPanel--warning euiPanel--paddingMedium euiCallOut euiCallOut--warning emotion-euiPanel-none-m-warning-euiCallOut"
+        data-test-subj="actionConnectorsWarningsCallOut"
+      >
+        <h2
+          class="euiTitle euiCallOutHeader__title emotion-euiTitle-xs-euiCallOutHeader-warning"
+        >
+          <span
+            aria-hidden="true"
+            class="emotion-euiCallOut__icon"
+            color="inherit"
+            data-euiicon-type="alert"
+          />
+          <span
+            data-test-subj="actionConnectorsWarningsCallOutTitle"
+          >
+            2 connectors imported
+          </span>
+        </h2>
+        <div
+          class="euiText emotion-euiText-s-euiTextColor-default-euiCallOut__description"
+        >
+          <div
+            class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-stretch-column"
+          >
+            <div
+              class="euiFlexItem emotion-euiFlexItem-grow-1"
+              data-test-subj="actionConnectorsWarningsCallOutMessage"
+            >
+              <div
+                class="euiText emotion-euiText-xs"
+              >
+                2 connectors have sensitive information that requires updates.
+              </div>
+            </div>
+            <div
+              class="euiFlexItem emotion-euiFlexItem-grow-1"
+            >
+              <div
+                class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-flexEnd-columnReverse"
+              >
+                <button
+                  class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-m-base-warning"
+                  data-test-subj="actionConnectorsWarningsCallOutButton"
+                  type="button"
+                >
+                  <span
+                    class="emotion-euiButtonDisplayContent"
+                  >
+                    <span
+                      class="eui-textTruncate"
+                    >
+                      Connectors
+                    </span>
+                  </span>
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </body>,
+  "container": <div>
+    <div
+      class="euiPanel euiPanel--warning euiPanel--paddingMedium euiCallOut euiCallOut--warning emotion-euiPanel-none-m-warning-euiCallOut"
+      data-test-subj="actionConnectorsWarningsCallOut"
+    >
+      <h2
+        class="euiTitle euiCallOutHeader__title emotion-euiTitle-xs-euiCallOutHeader-warning"
+      >
+        <span
+          aria-hidden="true"
+          class="emotion-euiCallOut__icon"
+          color="inherit"
+          data-euiicon-type="alert"
+        />
+        <span
+          data-test-subj="actionConnectorsWarningsCallOutTitle"
+        >
+          2 connectors imported
+        </span>
+      </h2>
+      <div
+        class="euiText emotion-euiText-s-euiTextColor-default-euiCallOut__description"
+      >
+        <div
+          class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-stretch-column"
+        >
+          <div
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
+            data-test-subj="actionConnectorsWarningsCallOutMessage"
+          >
+            <div
+              class="euiText emotion-euiText-xs"
+            >
+              2 connectors have sensitive information that requires updates.
+            </div>
+          </div>
+          <div
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
+          >
+            <div
+              class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-flexEnd-columnReverse"
+            >
+              <button
+                class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-m-base-warning"
+                data-test-subj="actionConnectorsWarningsCallOutButton"
+                type="button"
+              >
+                <span
+                  class="emotion-euiButtonDisplayContent"
+                >
+                  <span
+                    class="eui-textTruncate"
+                  >
+                    Connectors
+                  </span>
+                </span>
+              </button>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>,
+  "debug": [Function],
+  "findAllByAltText": [Function],
+  "findAllByDisplayValue": [Function],
+  "findAllByLabelText": [Function],
+  "findAllByPlaceholderText": [Function],
+  "findAllByRole": [Function],
+  "findAllByTestId": [Function],
+  "findAllByText": [Function],
+  "findAllByTitle": [Function],
+  "findByAltText": [Function],
+  "findByDisplayValue": [Function],
+  "findByLabelText": [Function],
+  "findByPlaceholderText": [Function],
+  "findByRole": [Function],
+  "findByTestId": [Function],
+  "findByText": [Function],
+  "findByTitle": [Function],
+  "getAllByAltText": [Function],
+  "getAllByDisplayValue": [Function],
+  "getAllByLabelText": [Function],
+  "getAllByPlaceholderText": [Function],
+  "getAllByRole": [Function],
+  "getAllByTestId": [Function],
+  "getAllByText": [Function],
+  "getAllByTitle": [Function],
+  "getByAltText": [Function],
+  "getByDisplayValue": [Function],
+  "getByLabelText": [Function],
+  "getByPlaceholderText": [Function],
+  "getByRole": [Function],
+  "getByTestId": [Function],
+  "getByText": [Function],
+  "getByTitle": [Function],
+  "queryAllByAltText": [Function],
+  "queryAllByDisplayValue": [Function],
+  "queryAllByLabelText": [Function],
+  "queryAllByPlaceholderText": [Function],
+  "queryAllByRole": [Function],
+  "queryAllByTestId": [Function],
+  "queryAllByText": [Function],
+  "queryAllByTitle": [Function],
+  "queryByAltText": [Function],
+  "queryByDisplayValue": [Function],
+  "queryByLabelText": [Function],
+  "queryByPlaceholderText": [Function],
+  "queryByRole": [Function],
+  "queryByTestId": [Function],
+  "queryByText": [Function],
+  "queryByTitle": [Function],
+  "rerender": [Function],
+  "unmount": [Function],
+}
+`;
+
+exports[`ActionConnectorWarnings should render if 2 connectors were imported and use the warning message with the correct imported number 1`] = `
+Object {
+  "asFragment": [Function],
+  "baseElement": <body>
+    <div>
+      <div
+        class="euiPanel euiPanel--warning euiPanel--paddingMedium euiCallOut euiCallOut--warning emotion-euiPanel-none-m-warning-euiCallOut"
+        data-test-subj="actionConnectorsWarningsCallOut"
+      >
+        <h2
+          class="euiTitle euiCallOutHeader__title emotion-euiTitle-xs-euiCallOutHeader-warning"
+        >
+          <span
+            aria-hidden="true"
+            class="emotion-euiCallOut__icon"
+            color="inherit"
+            data-euiicon-type="alert"
+          />
+          <span
+            data-test-subj="actionConnectorsWarningsCallOutTitle"
+          >
+            2 connectors imported
+          </span>
+        </h2>
+        <div
+          class="euiText emotion-euiText-s-euiTextColor-default-euiCallOut__description"
+        >
+          <div
+            class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-stretch-column"
+          >
+            <div
+              class="euiFlexItem emotion-euiFlexItem-grow-1"
+              data-test-subj="actionConnectorsWarningsCallOutMessage"
+            >
+              <div
+                class="euiText emotion-euiText-xs"
+              >
+                2 connectors have sensitive information that requires updates.
+              </div>
+            </div>
+            <div
+              class="euiFlexItem emotion-euiFlexItem-grow-1"
+            >
+              <div
+                class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-flexEnd-columnReverse"
+              >
+                <button
+                  class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-m-base-warning"
+                  data-test-subj="actionConnectorsWarningsCallOutButton"
+                  type="button"
+                >
+                  <span
+                    class="emotion-euiButtonDisplayContent"
+                  >
+                    <span
+                      class="eui-textTruncate"
+                    >
+                      Go to connectors
+                    </span>
+                  </span>
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </body>,
+  "container": <div>
+    <div
+      class="euiPanel euiPanel--warning euiPanel--paddingMedium euiCallOut euiCallOut--warning emotion-euiPanel-none-m-warning-euiCallOut"
+      data-test-subj="actionConnectorsWarningsCallOut"
+    >
+      <h2
+        class="euiTitle euiCallOutHeader__title emotion-euiTitle-xs-euiCallOutHeader-warning"
+      >
+        <span
+          aria-hidden="true"
+          class="emotion-euiCallOut__icon"
+          color="inherit"
+          data-euiicon-type="alert"
+        />
+        <span
+          data-test-subj="actionConnectorsWarningsCallOutTitle"
+        >
+          2 connectors imported
+        </span>
+      </h2>
+      <div
+        class="euiText emotion-euiText-s-euiTextColor-default-euiCallOut__description"
+      >
+        <div
+          class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-stretch-column"
+        >
+          <div
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
+            data-test-subj="actionConnectorsWarningsCallOutMessage"
+          >
+            <div
+              class="euiText emotion-euiText-xs"
+            >
+              2 connectors have sensitive information that requires updates.
+            </div>
+          </div>
+          <div
+            class="euiFlexItem emotion-euiFlexItem-grow-1"
+          >
+            <div
+              class="euiFlexGroup emotion-euiFlexGroup-none-flexStart-flexEnd-columnReverse"
+            >
+              <button
+                class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-m-base-warning"
+                data-test-subj="actionConnectorsWarningsCallOutButton"
+                type="button"
+              >
+                <span
+                  class="emotion-euiButtonDisplayContent"
+                >
+                  <span
+                    class="eui-textTruncate"
+                  >
+                    Go to connectors
+                  </span>
+                </span>
+              </button>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>,
+  "debug": [Function],
+  "findAllByAltText": [Function],
+  "findAllByDisplayValue": [Function],
+  "findAllByLabelText": [Function],
+  "findAllByPlaceholderText": [Function],
+  "findAllByRole": [Function],
+  "findAllByTestId": [Function],
+  "findAllByText": [Function],
+  "findAllByTitle": [Function],
+  "findByAltText": [Function],
+  "findByDisplayValue": [Function],
+  "findByLabelText": [Function],
+  "findByPlaceholderText": [Function],
+  "findByRole": [Function],
+  "findByTestId": [Function],
+  "findByText": [Function],
+  "findByTitle": [Function],
+  "getAllByAltText": [Function],
+  "getAllByDisplayValue": [Function],
+  "getAllByLabelText": [Function],
+  "getAllByPlaceholderText": [Function],
+  "getAllByRole": [Function],
+  "getAllByTestId": [Function],
+  "getAllByText": [Function],
+  "getAllByTitle": [Function],
+  "getByAltText": [Function],
+  "getByDisplayValue": [Function],
+  "getByLabelText": [Function],
+  "getByPlaceholderText": [Function],
+  "getByRole": [Function],
+  "getByTestId": [Function],
+  "getByText": [Function],
+  "getByTitle": [Function],
+  "queryAllByAltText": [Function],
+  "queryAllByDisplayValue": [Function],
+  "queryAllByLabelText": [Function],
+  "queryAllByPlaceholderText": [Function],
+  "queryAllByRole": [Function],
+  "queryAllByTestId": [Function],
+  "queryAllByText": [Function],
+  "queryAllByTitle": [Function],
+  "queryByAltText": [Function],
+  "queryByDisplayValue": [Function],
+  "queryByLabelText": [Function],
+  "queryByPlaceholderText": [Function],
+  "queryByRole": [Function],
+  "queryByTestId": [Function],
+  "queryByText": [Function],
+  "queryByTitle": [Function],
+  "rerender": [Function],
+  "unmount": [Function],
+}
+`;
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/action_connectors_warning.test.tsx b/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/action_connectors_warning.test.tsx
new file mode 100644
index 0000000000000..a71ce2beeaebe
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/action_connectors_warning.test.tsx
@@ -0,0 +1,104 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { render } from '@testing-library/react';
+import { ActionConnectorWarnings } from '.';
+
+jest.mock('../../../lib/kibana/kibana_react', () => ({
+  useKibana: jest.fn().mockReturnValue({
+    services: { http: { basePath: { prepend: jest.fn() } } },
+  }),
+}));
+describe('ActionConnectorWarnings', () => {
+  test('should not render if importedActionConnectorsCount is falsy and empty warnings array', () => {
+    const wrapper = render(
+      <ActionConnectorWarnings actionConnectorsWarnings={[]} importedActionConnectorsCount={0} />
+    );
+    expect(wrapper).toMatchSnapshot();
+    expect(wrapper.queryByTestId('actionConnectorsWarningsCallOut')).not.toBeInTheDocument();
+  });
+  test('should not render if importedActionConnectorsCount is truthy and empty warnings array', () => {
+    const wrapper = render(
+      <ActionConnectorWarnings actionConnectorsWarnings={[]} importedActionConnectorsCount={2} />
+    );
+    expect(wrapper).toMatchSnapshot();
+    expect(wrapper.queryByTestId('actionConnectorsWarningsCallOut')).not.toBeInTheDocument();
+  });
+  test('should render if 1 connectors were imported and use the warning message with the correct imported number', () => {
+    const wrapper = render(
+      <ActionConnectorWarnings
+        actionConnectorsWarnings={[
+          {
+            actionPath: '/',
+            buttonLabel: '',
+            message: '1 connector has sensitive information that requires updates.',
+            type: '',
+          },
+        ]}
+        importedActionConnectorsCount={1}
+      />
+    );
+    const { getByTestId } = wrapper;
+    expect(wrapper).toMatchSnapshot();
+    expect(getByTestId('actionConnectorsWarningsCallOutTitle').textContent).toBe(
+      '1 connector imported'
+    );
+    expect(getByTestId('actionConnectorsWarningsCallOutMessage').textContent).toBe(
+      '1 connector has sensitive information that requires updates.'
+    );
+  });
+  test('should render if 2 connectors were imported and use the warning message with the correct imported number', () => {
+    const wrapper = render(
+      <ActionConnectorWarnings
+        actionConnectorsWarnings={[
+          {
+            actionPath: '/',
+            buttonLabel: '',
+            message: '2 connectors have sensitive information that requires updates.',
+            type: '',
+          },
+        ]}
+        importedActionConnectorsCount={2}
+      />
+    );
+    const { getByTestId } = wrapper;
+    expect(wrapper).toMatchSnapshot();
+    expect(getByTestId('actionConnectorsWarningsCallOutTitle').textContent).toBe(
+      '2 connectors imported'
+    );
+    expect(getByTestId('actionConnectorsWarningsCallOutMessage').textContent).toBe(
+      '2 connectors have sensitive information that requires updates.'
+    );
+    expect(getByTestId('actionConnectorsWarningsCallOutButton').textContent).toBe(
+      'Go to connectors'
+    );
+  });
+  test('should render if 2 connectors were imported and use the button label when is set', () => {
+    const wrapper = render(
+      <ActionConnectorWarnings
+        actionConnectorsWarnings={[
+          {
+            actionPath: '/',
+            buttonLabel: 'Connectors',
+            message: '2 connectors have sensitive information that requires updates.',
+            type: '',
+          },
+        ]}
+        importedActionConnectorsCount={2}
+      />
+    );
+    const { getByTestId } = wrapper;
+    expect(wrapper).toMatchSnapshot();
+    expect(getByTestId('actionConnectorsWarningsCallOutTitle').textContent).toBe(
+      '2 connectors imported'
+    );
+    expect(getByTestId('actionConnectorsWarningsCallOutMessage').textContent).toBe(
+      '2 connectors have sensitive information that requires updates.'
+    );
+    expect(getByTestId('actionConnectorsWarningsCallOutButton').textContent).toBe('Connectors');
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/index.tsx b/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/index.tsx
new file mode 100644
index 0000000000000..ad72893f66d87
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/action_connectors_warning/index.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import type { FC } from 'react';
+
+import { EuiButton, EuiCallOut, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
+import type { WarningSchema } from '../../../../../common/detection_engine/schemas/response';
+import { useKibana } from '../../../lib/kibana/kibana_react';
+import * as i18n from '../translations';
+
+interface ActionConnectorWarningsComponentProps {
+  actionConnectorsWarnings: WarningSchema[];
+  importedActionConnectorsCount?: number;
+}
+const ActionConnectorWarningsComponent: FC<ActionConnectorWarningsComponentProps> = ({
+  actionConnectorsWarnings,
+  importedActionConnectorsCount,
+}) => {
+  const { http } = useKibana().services;
+
+  if (!importedActionConnectorsCount || !actionConnectorsWarnings.length) return null;
+  const { actionPath, message, buttonLabel } = actionConnectorsWarnings[0];
+
+  return (
+    <EuiCallOut
+      data-test-subj="actionConnectorsWarningsCallOut"
+      size="m"
+      heading="h2"
+      iconType="alert"
+      title={
+        <span data-test-subj="actionConnectorsWarningsCallOutTitle">
+          {i18n.ACTION_CONNECTORS_WARNING_TITLE(importedActionConnectorsCount)}
+        </span>
+      }
+      color="warning"
+    >
+      <EuiFlexGroup direction="column" gutterSize="none">
+        <EuiFlexItem data-test-subj="actionConnectorsWarningsCallOutMessage">
+          <EuiText size="xs">{message}</EuiText>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiFlexGroup gutterSize="none" direction="columnReverse" alignItems="flexEnd">
+            <EuiButton
+              data-test-subj="actionConnectorsWarningsCallOutButton"
+              color="warning"
+              href={http.basePath.prepend(actionPath)}
+            >
+              {buttonLabel || i18n.ACTION_CONNECTORS_WARNING_BUTTON}
+            </EuiButton>
+          </EuiFlexGroup>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiCallOut>
+  );
+};
+
+ActionConnectorWarningsComponent.displayName = 'ActionConnectorWarningsComponent';
+
+export const ActionConnectorWarnings = React.memo(ActionConnectorWarningsComponent);
+
+ActionConnectorWarnings.displayName = 'ActionConnectorWarnings';
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/import_data_modal/index.test.tsx
index 515019785534f..1986539e578e0 100644
--- a/x-pack/plugins/security_solution/public/common/components/import_data_modal/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/index.test.tsx
@@ -12,6 +12,11 @@ import { ImportDataModalComponent } from '.';
 
 jest.mock('../../lib/kibana');
 
+jest.mock('../../lib/kibana/kibana_react', () => ({
+  useKibana: jest.fn().mockReturnValue({
+    services: { http: { basePath: { prepend: jest.fn() } } },
+  }),
+}));
 jest.mock('../../hooks/use_app_toasts', () => ({
   useAppToasts: jest.fn().mockReturnValue({
     addError: jest.fn(),
@@ -25,6 +30,9 @@ const importData = jest.fn().mockReturnValue({ success: true, errors: [] });
 const file = new File(['file'], 'image1.png', { type: 'image/png' });
 
 describe('ImportDataModal', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
   test('renders correctly against snapshot', () => {
     const wrapper = render(
       <ImportDataModalComponent
@@ -92,17 +100,22 @@ describe('ImportDataModal', () => {
         successMessage={jest.fn((totalCount) => 'successMessage')}
         title="title"
         showExceptionsCheckBox={true}
+        showActionConnectorsCheckBox={true}
       />
     );
     const overwriteCheckbox: HTMLInputElement = queryByTestId(
-      'import-data-modal-checkbox-label'
+      'importDataModalCheckboxLabel'
     ) as HTMLInputElement;
     const exceptionCheckbox: HTMLInputElement = queryByTestId(
-      'import-data-modal-exceptions-checkbox-label'
+      'importDataModalExceptionsCheckboxLabel'
+    ) as HTMLInputElement;
+    const connectorsCheckbox: HTMLInputElement = queryByTestId(
+      'importDataModalActionConnectorsCheckbox'
     ) as HTMLInputElement;
 
     await waitFor(() => fireEvent.click(overwriteCheckbox));
     await waitFor(() => fireEvent.click(exceptionCheckbox));
+    await waitFor(() => fireEvent.click(connectorsCheckbox));
 
     await waitFor(() =>
       fireEvent.change(queryByTestId('rule-file-picker') as HTMLInputElement, {
@@ -111,6 +124,7 @@ describe('ImportDataModal', () => {
     );
     expect(overwriteCheckbox.checked).toBeTruthy();
     expect(exceptionCheckbox.checked).toBeTruthy();
+    expect(connectorsCheckbox.checked).toBeTruthy();
 
     await waitFor(() => {
       fireEvent.click(queryByTestId('import-data-modal-button') as HTMLButtonElement);
@@ -120,6 +134,7 @@ describe('ImportDataModal', () => {
 
     expect(overwriteCheckbox.checked).toBeFalsy();
     expect(exceptionCheckbox.checked).toBeFalsy();
+    expect(connectorsCheckbox.checked).toBeFalsy();
   });
   test('should uncheck the selected checkboxes after closing the Flyout', async () => {
     const { queryByTestId, getAllByRole } = render(
@@ -138,20 +153,25 @@ describe('ImportDataModal', () => {
         successMessage={jest.fn((totalCount) => 'successMessage')}
         title="title"
         showExceptionsCheckBox={true}
+        showActionConnectorsCheckBox={true}
       />
     );
 
     const closeButton = getAllByRole('button')[0];
 
     const overwriteCheckbox: HTMLInputElement = queryByTestId(
-      'import-data-modal-checkbox-label'
+      'importDataModalCheckboxLabel'
     ) as HTMLInputElement;
     const exceptionCheckbox: HTMLInputElement = queryByTestId(
-      'import-data-modal-exceptions-checkbox-label'
+      'importDataModalExceptionsCheckboxLabel'
+    ) as HTMLInputElement;
+    const connectorsCheckbox: HTMLInputElement = queryByTestId(
+      'importDataModalActionConnectorsCheckbox'
     ) as HTMLInputElement;
 
     await waitFor(() => fireEvent.click(overwriteCheckbox));
     await waitFor(() => fireEvent.click(exceptionCheckbox));
+    await waitFor(() => fireEvent.click(connectorsCheckbox));
 
     await waitFor(() =>
       fireEvent.change(queryByTestId('rule-file-picker') as HTMLInputElement, {
@@ -168,5 +188,91 @@ describe('ImportDataModal', () => {
 
     expect(overwriteCheckbox.checked).toBeFalsy();
     expect(exceptionCheckbox.checked).toBeFalsy();
+    expect(connectorsCheckbox.checked).toBeFalsy();
+  });
+
+  test('should import file, with warnings but no action_connectors_success_count', async () => {
+    const importWithWarning = jest.fn().mockReturnValue({
+      ...importData(),
+      action_connectors_warnings: [
+        { message: 'message', actionPath: 'path', buttonLabel: 'buttonLabel' },
+      ],
+      action_connectors_success_count: 0,
+    });
+    const wrapper = render(
+      <ImportDataModalComponent
+        showModal={true}
+        closeModal={closeModal}
+        importComplete={importComplete}
+        checkBoxLabel="checkBoxLabel"
+        description="description"
+        errorMessage={jest.fn()}
+        failedDetailed={jest.fn()}
+        importData={importWithWarning}
+        showCheckBox={true}
+        submitBtnText="submitBtnText"
+        subtitle="subtitle"
+        successMessage={jest.fn((totalCount) => 'successMessage')}
+        title="title"
+      />
+    );
+    const { queryByTestId } = wrapper;
+    await waitFor(() => {
+      fireEvent.change(queryByTestId('rule-file-picker') as HTMLInputElement, {
+        target: { files: [file] },
+      });
+    });
+    await waitFor(() => {
+      fireEvent.click(queryByTestId('import-data-modal-button') as HTMLButtonElement);
+    });
+    expect(wrapper).toMatchSnapshot();
+    expect(queryByTestId('actionConnectorsWarningsCallOut')).not.toBeInTheDocument();
+    expect(importWithWarning).toHaveBeenCalled();
+    expect(closeModal).not.toHaveBeenCalled();
+    expect(importComplete).toHaveBeenCalled();
+  });
+  test('should import file, with warnings', async () => {
+    const importWithWarning = jest.fn().mockReturnValue({
+      ...importData(),
+      action_connectors_warnings: [
+        {
+          message: '1 connector has sensitive information that requires updates.',
+          actionPath: 'path',
+          buttonLabel: 'buttonLabel',
+        },
+      ],
+      action_connectors_success_count: 1,
+    });
+    const wrapper = render(
+      <ImportDataModalComponent
+        showModal={true}
+        closeModal={closeModal}
+        importComplete={importComplete}
+        checkBoxLabel="checkBoxLabel"
+        description="description"
+        errorMessage={jest.fn()}
+        failedDetailed={jest.fn()}
+        importData={importWithWarning}
+        showCheckBox={true}
+        submitBtnText="submitBtnText"
+        subtitle="subtitle"
+        successMessage={jest.fn((totalCount) => 'successMessage')}
+        title="title"
+      />
+    );
+    const { queryByTestId } = wrapper;
+    await waitFor(() => {
+      fireEvent.change(queryByTestId('rule-file-picker') as HTMLInputElement, {
+        target: { files: [file] },
+      });
+    });
+    await waitFor(() => {
+      fireEvent.click(queryByTestId('import-data-modal-button') as HTMLButtonElement);
+    });
+    expect(wrapper).toMatchSnapshot();
+    expect(queryByTestId('actionConnectorsWarningsCallOut')).toBeInTheDocument();
+    expect(importWithWarning).toHaveBeenCalled();
+    expect(importComplete).toHaveBeenCalled();
+    expect(closeModal).not.toHaveBeenCalled();
   });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/import_data_modal/index.tsx
index a291265bc234d..1b2cf3e516e5e 100644
--- a/x-pack/plugins/security_solution/public/common/components/import_data_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/index.tsx
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import React, { useCallback, useState } from 'react';
 import {
   EuiButton,
   EuiButtonEmpty,
@@ -18,7 +19,7 @@ import {
   EuiSpacer,
   EuiText,
 } from '@elastic/eui';
-import React, { useCallback, useState } from 'react';
+import type { WarningSchema } from '../../../../common/detection_engine/schemas/response';
 
 import type {
   ImportDataResponse,
@@ -27,6 +28,7 @@ import type {
 import { useAppToasts } from '../../hooks/use_app_toasts';
 import * as i18n from './translations';
 import { showToasterMessage } from './utils';
+import { ActionConnectorWarnings } from './action_connectors_warning';
 
 interface ImportDataModalProps {
   checkBoxLabel: string;
@@ -43,6 +45,7 @@ interface ImportDataModalProps {
   subtitle: string;
   successMessage: (totalCount: number) => string;
   title: string;
+  showActionConnectorsCheckBox?: boolean;
 }
 
 /**
@@ -59,6 +62,7 @@ export const ImportDataModalComponent = ({
   importData,
   showCheckBox = true,
   showExceptionsCheckBox = false,
+  showActionConnectorsCheckBox = false,
   showModal,
   submitBtnText,
   subtitle,
@@ -69,15 +73,35 @@ export const ImportDataModalComponent = ({
   const [isImporting, setIsImporting] = useState(false);
   const [overwrite, setOverwrite] = useState(false);
   const [overwriteExceptions, setOverwriteExceptions] = useState(false);
+  const [overwriteActionConnectors, setOverwriteActionConnectors] = useState(false);
   const { addError, addSuccess } = useAppToasts();
-
+  const [actionConnectorsWarnings, setActionConnectorsWarnings] = useState<WarningSchema[] | []>(
+    []
+  );
+  const [importedActionConnectorsCount, setImportedActionConnectorsCount] = useState<
+    number | undefined
+  >(0);
   const cleanupAndCloseModal = useCallback(() => {
-    setIsImporting(false);
-    setSelectedFiles(null);
     closeModal();
     setOverwrite(false);
     setOverwriteExceptions(false);
-  }, [setIsImporting, setSelectedFiles, closeModal, setOverwrite, setOverwriteExceptions]);
+    setOverwriteActionConnectors(false);
+    setActionConnectorsWarnings([]);
+  }, [closeModal, setOverwrite, setOverwriteExceptions]);
+
+  const onImportComplete = useCallback(
+    (callCleanup: boolean) => {
+      setIsImporting(false);
+      setSelectedFiles(null);
+      importComplete();
+
+      if (callCleanup) {
+        importComplete();
+        cleanupAndCloseModal();
+      }
+    },
+    [cleanupAndCloseModal, importComplete]
+  );
 
   const importDataCallback = useCallback(async () => {
     if (selectedFiles != null) {
@@ -85,25 +109,28 @@ export const ImportDataModalComponent = ({
       const abortCtrl = new AbortController();
 
       try {
-        const importResponse = await importData({
+        const { action_connectors_warnings: warnings, ...importResponse } = await importData({
           fileToImport: selectedFiles[0],
           overwrite,
           overwriteExceptions,
+          overwriteActionConnectors,
           signal: abortCtrl.signal,
         });
+        const connectorsCount = importResponse.action_connectors_success_count;
+        setActionConnectorsWarnings(warnings as WarningSchema[]);
+        setImportedActionConnectorsCount(connectorsCount);
 
         showToasterMessage({
           importResponse,
           exceptionsIncluded: showExceptionsCheckBox,
+          actionConnectorsIncluded: showActionConnectorsCheckBox,
           successMessage,
           errorMessage,
           errorMessageDetailed: failedDetailed,
           addError,
           addSuccess,
         });
-
-        importComplete();
-        cleanupAndCloseModal();
+        onImportComplete(!warnings?.length);
       } catch (error) {
         cleanupAndCloseModal();
         addError(error, { title: errorMessage(1) });
@@ -114,13 +141,15 @@ export const ImportDataModalComponent = ({
     importData,
     overwrite,
     overwriteExceptions,
+    overwriteActionConnectors,
     showExceptionsCheckBox,
     successMessage,
     errorMessage,
     failedDetailed,
     addError,
     addSuccess,
-    importComplete,
+    showActionConnectorsCheckBox,
+    onImportComplete,
     cleanupAndCloseModal,
   ]);
 
@@ -136,6 +165,9 @@ export const ImportDataModalComponent = ({
     setOverwriteExceptions((shouldOverwrite) => !shouldOverwrite);
   }, []);
 
+  const handleActionConnectorsCheckboxClick = useCallback(() => {
+    setOverwriteActionConnectors((shouldOverwrite) => !shouldOverwrite);
+  }, []);
   return (
     <>
       {showModal && (
@@ -163,24 +195,41 @@ export const ImportDataModalComponent = ({
               isLoading={isImporting}
             />
             <EuiSpacer size="s" />
+
+            <ActionConnectorWarnings
+              actionConnectorsWarnings={actionConnectorsWarnings}
+              importedActionConnectorsCount={importedActionConnectorsCount}
+            />
+
+            <EuiSpacer size="s" />
+
             {showCheckBox && (
               <>
                 <EuiCheckbox
-                  data-test-subj="import-data-modal-checkbox-label"
-                  id="import-data-modal-checkbox-label"
+                  data-test-subj="importDataModalCheckboxLabel"
+                  id="importDataModalCheckboxLabel"
                   label={checkBoxLabel}
                   checked={overwrite}
                   onChange={handleCheckboxClick}
                 />
                 {showExceptionsCheckBox && (
                   <EuiCheckbox
-                    data-test-subj="import-data-modal-exceptions-checkbox-label"
-                    id="import-data-modal-exceptions-checkbox-label"
+                    data-test-subj="importDataModalExceptionsCheckboxLabel"
+                    id="importDataModalExceptionsCheckboxLabel"
                     label={i18n.OVERWRITE_EXCEPTIONS_LABEL}
                     checked={overwriteExceptions}
                     onChange={handleExceptionsCheckboxClick}
                   />
                 )}
+                {showActionConnectorsCheckBox && (
+                  <EuiCheckbox
+                    data-test-subj="importDataModalActionConnectorsCheckbox"
+                    id="importDataModalActionConnectorsCheckbox"
+                    label={i18n.OVERWRITE_ACTION_CONNECTORS_LABEL}
+                    checked={overwriteActionConnectors}
+                    onChange={handleActionConnectorsCheckboxClick}
+                  />
+                )}
               </>
             )}
           </EuiModalBody>
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/translations.ts b/x-pack/plugins/security_solution/public/common/components/import_data_modal/translations.ts
index 763396ae62d79..11ae7dd972a57 100644
--- a/x-pack/plugins/security_solution/public/common/components/import_data_modal/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/translations.ts
@@ -20,7 +20,12 @@ export const OVERWRITE_EXCEPTIONS_LABEL = i18n.translate(
     defaultMessage: 'Overwrite existing exception lists with conflicting "list_id"',
   }
 );
-
+export const OVERWRITE_ACTION_CONNECTORS_LABEL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteActionConnectorsLabel',
+  {
+    defaultMessage: 'Overwrite existing connectors with conflicting action "id"',
+  }
+);
 export const SUCCESSFULLY_IMPORTED_EXCEPTIONS = (totalExceptions: number) =>
   i18n.translate(
     'xpack.securitySolution.detectionEngine.components.importRuleModal.exceptionsSuccessLabel',
@@ -30,6 +35,15 @@ export const SUCCESSFULLY_IMPORTED_EXCEPTIONS = (totalExceptions: number) =>
         'Successfully imported {totalExceptions} {totalExceptions, plural, =1 {exception} other {exceptions}}.',
     }
   );
+export const SUCCESSFULLY_IMPORTED_CONNECTORS = (totalConnectors: number) =>
+  i18n.translate(
+    'xpack.securitySolution.detectionEngine.components.importRuleModal.connectorsSuccessLabel',
+    {
+      values: { totalConnectors },
+      defaultMessage:
+        'Successfully imported {totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}}.',
+    }
+  );
 
 export const IMPORT_FAILED = (totalExceptions: number) =>
   i18n.translate(
@@ -40,3 +54,36 @@ export const IMPORT_FAILED = (totalExceptions: number) =>
         'Failed to import {totalExceptions} {totalExceptions, plural, =1 {exception} other {exceptions}}',
     }
   );
+export const IMPORT_CONNECTORS_FAILED = (totalConnectors: number) =>
+  i18n.translate(
+    'xpack.securitySolution.detectionEngine.components.importRuleModal.importConnectorsFailedLabel',
+    {
+      values: { totalConnectors },
+      defaultMessage:
+        'Failed to import {totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}}',
+    }
+  );
+
+export const ACTION_CONNECTORS_WARNING_TITLE = (totalConnectors: number) =>
+  i18n.translate(
+    'xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsWarningTitle',
+    {
+      values: { totalConnectors },
+      defaultMessage:
+        '{totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}} imported',
+    }
+  );
+
+export const ACTION_CONNECTORS_WARNING_BUTTON = i18n.translate(
+  'xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsWarningButton',
+  {
+    defaultMessage: 'Go to connectors',
+  }
+);
+
+export const ACTION_CONNECTORS_ADDITIONAL_PRIVILEGES = i18n.translate(
+  'xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsAdditionalPrivilegesError',
+  {
+    defaultMessage: 'You need additional privileges to import rules with actions.',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/utils.test.ts b/x-pack/plugins/security_solution/public/common/components/import_data_modal/utils.test.ts
index b5609a79eba6c..6b432edfb5bd1 100644
--- a/x-pack/plugins/security_solution/public/common/components/import_data_modal/utils.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/utils.test.ts
@@ -9,7 +9,7 @@ import { showToasterMessage } from './utils';
 
 describe('showToasterMessage', () => {
   describe('exceptionsIncluded is false', () => {
-    it('displays main success message if import was successful', () => {
+    it('should display main success message if import was successful', () => {
       const addError = jest.fn();
       const addSuccess = jest.fn();
 
@@ -20,6 +20,7 @@ describe('showToasterMessage', () => {
           errors: [],
         },
         exceptionsIncluded: false,
+        actionConnectorsIncluded: false,
         successMessage: (msg) => `success: ${msg}`,
         errorMessage: (msg) => `error: ${msg}`,
         errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
@@ -32,7 +33,7 @@ describe('showToasterMessage', () => {
       expect(addError).not.toHaveBeenCalled();
     });
 
-    it('displays main error message if import was not successful', () => {
+    it('should display main error message if import was not successful', () => {
       const addError = jest.fn();
       const addSuccess = jest.fn();
 
@@ -51,6 +52,7 @@ describe('showToasterMessage', () => {
           ],
         },
         exceptionsIncluded: false,
+        actionConnectorsIncluded: false,
         successMessage: (msg) => `success: ${msg}`,
         errorMessage: (msg) => `error: ${msg}`,
         errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
@@ -67,7 +69,7 @@ describe('showToasterMessage', () => {
   });
 
   describe('exceptionsIncluded is true', () => {
-    it('displays success message for rules and exceptions if both succeed', () => {
+    it('should display success message for rules and exceptions if both succeed', () => {
       const addError = jest.fn();
       const addSuccess = jest.fn();
 
@@ -82,6 +84,7 @@ describe('showToasterMessage', () => {
           exceptions_success_count: 1,
         },
         exceptionsIncluded: true,
+        actionConnectorsIncluded: false,
         successMessage: (msg) => `success: ${msg}`,
         errorMessage: (msg) => `error: ${msg}`,
         errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
@@ -95,7 +98,7 @@ describe('showToasterMessage', () => {
       expect(addError).not.toHaveBeenCalled();
     });
 
-    it('displays error message for rules and exceptions if both fail', () => {
+    it('should display error message for rules and exceptions if both fail', () => {
       const addError = jest.fn();
       const addSuccess = jest.fn();
 
@@ -133,6 +136,7 @@ describe('showToasterMessage', () => {
           exceptions_success_count: 0,
         },
         exceptionsIncluded: true,
+        actionConnectorsIncluded: false,
         successMessage: (msg) => `success: ${msg}`,
         errorMessage: (msg) => `error: ${msg}`,
         errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
@@ -154,7 +158,7 @@ describe('showToasterMessage', () => {
       expect(addSuccess).not.toHaveBeenCalled();
     });
 
-    it('displays only a rule toaster if no exceptions were imported', () => {
+    it('should display only a rule toaster if no exceptions were imported', () => {
       const addError = jest.fn();
       const addSuccess = jest.fn();
 
@@ -169,6 +173,7 @@ describe('showToasterMessage', () => {
           exceptions_success_count: 0,
         },
         exceptionsIncluded: true,
+        actionConnectorsIncluded: false,
         successMessage: (msg) => `success: ${msg}`,
         errorMessage: (msg) => `error: ${msg}`,
         errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
@@ -181,7 +186,7 @@ describe('showToasterMessage', () => {
       expect(addError).not.toHaveBeenCalled();
     });
 
-    it('displays only an exceptions toaster if no rules were imported', () => {
+    it('should display only an exceptions toaster if no rules were imported', () => {
       const addError = jest.fn();
       const addSuccess = jest.fn();
 
@@ -196,6 +201,7 @@ describe('showToasterMessage', () => {
           exceptions_success_count: 1,
         },
         exceptionsIncluded: true,
+        actionConnectorsIncluded: false,
         successMessage: (msg) => `success: ${msg}`,
         errorMessage: (msg) => `error: ${msg}`,
         errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
@@ -208,4 +214,277 @@ describe('showToasterMessage', () => {
       expect(addError).not.toHaveBeenCalled();
     });
   });
+
+  describe('actionConnectorsIncluded is false', () => {
+    it('should display main success message if import was successful', () => {
+      const addError = jest.fn();
+      const addSuccess = jest.fn();
+
+      showToasterMessage({
+        importResponse: {
+          success: true,
+          success_count: 1,
+          errors: [],
+        },
+        exceptionsIncluded: false,
+        actionConnectorsIncluded: false,
+        successMessage: (msg) => `success: ${msg}`,
+        errorMessage: (msg) => `error: ${msg}`,
+        errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
+        addError,
+        addSuccess,
+      });
+
+      expect(addSuccess).toHaveBeenCalledTimes(1);
+      expect(addSuccess).toHaveBeenCalledWith('success: 1');
+      expect(addError).not.toHaveBeenCalled();
+    });
+
+    it('should display main error message if import was not successful', () => {
+      const addError = jest.fn();
+      const addSuccess = jest.fn();
+
+      showToasterMessage({
+        importResponse: {
+          success: false,
+          success_count: 0,
+          errors: [
+            {
+              rule_id: 'rule_id',
+              error: {
+                status_code: 400,
+                message: 'an error message',
+              },
+            },
+          ],
+        },
+        exceptionsIncluded: false,
+        actionConnectorsIncluded: false,
+        successMessage: (msg) => `success: ${msg}`,
+        errorMessage: (msg) => `error: ${msg}`,
+        errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
+        addError,
+        addSuccess,
+      });
+
+      expect(addError).toHaveBeenCalledTimes(1);
+      expect(addError).toHaveBeenCalledWith(new Error('errorDetailed: an error message'), {
+        title: 'error: 1',
+      });
+      expect(addSuccess).not.toHaveBeenCalled();
+    });
+  });
+  describe('actionConnectorsIncluded is true', () => {
+    it('should display success message for rules and connectors if both succeed', () => {
+      const addError = jest.fn();
+      const addSuccess = jest.fn();
+
+      showToasterMessage({
+        importResponse: {
+          success: true,
+          success_count: 1,
+          rules_count: 1,
+          errors: [],
+          exceptions_errors: [],
+          exceptions_success: true,
+          exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_errors: [],
+          action_connectors_success_count: 1,
+        },
+        exceptionsIncluded: false,
+        actionConnectorsIncluded: true,
+        successMessage: (msg) => `success: ${msg}`,
+        errorMessage: (msg) => `error: ${msg}`,
+        errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
+        addError,
+        addSuccess,
+      });
+
+      expect(addSuccess).toHaveBeenCalledTimes(2);
+      expect(addSuccess).toHaveBeenNthCalledWith(1, 'success: 1');
+      expect(addSuccess).toHaveBeenNthCalledWith(2, 'Successfully imported 1 connector.');
+      expect(addError).not.toHaveBeenCalled();
+    });
+
+    it('should display 1 error message for rules and connectors even when both fail', () => {
+      const addError = jest.fn();
+      const addSuccess = jest.fn();
+
+      showToasterMessage({
+        importResponse: {
+          success: false,
+          success_count: 1,
+          rules_count: 2,
+          action_connectors_success: false,
+          errors: [
+            {
+              rule_id: 'rule_id',
+              error: {
+                status_code: 400,
+                message: 'an error message',
+              },
+            },
+          ],
+          action_connectors_errors: [
+            {
+              rule_id: 'rule_id',
+              error: {
+                status_code: 400,
+                message: 'an error message',
+              },
+            },
+            {
+              rule_id: 'rule_id_1',
+              error: {
+                status_code: 400,
+                message: 'another error message',
+              },
+            },
+          ],
+          exceptions_success: true,
+          exceptions_success_count: 0,
+        },
+        exceptionsIncluded: false,
+        actionConnectorsIncluded: true,
+        successMessage: (msg) => `success: ${msg}`,
+        errorMessage: (msg) => `error: ${msg}`,
+        errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
+        addError,
+        addSuccess,
+      });
+
+      expect(addError).toHaveBeenCalledTimes(1);
+
+      expect(addError).toHaveBeenCalledWith(
+        new Error('errorDetailed: an error message. errorDetailed: another error message'),
+        {
+          title: 'Failed to import 2 connectors',
+        }
+      );
+      expect(addSuccess).not.toHaveBeenCalled();
+    });
+
+    it('should display only a rule toaster if no connectors were imported', () => {
+      const addError = jest.fn();
+      const addSuccess = jest.fn();
+
+      showToasterMessage({
+        importResponse: {
+          success: true,
+          success_count: 1,
+          rules_count: 1,
+          errors: [],
+          exceptions_errors: [],
+          exceptions_success: true,
+          exceptions_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_success: true,
+        },
+        exceptionsIncluded: true,
+        actionConnectorsIncluded: false,
+        successMessage: (msg) => `success: ${msg}`,
+        errorMessage: (msg) => `error: ${msg}`,
+        errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
+        addError,
+        addSuccess,
+      });
+
+      expect(addSuccess).toHaveBeenCalledTimes(1);
+      expect(addSuccess).toHaveBeenNthCalledWith(1, 'success: 1');
+      expect(addError).not.toHaveBeenCalled();
+    });
+
+    it('should display only a connector toaster if no rules were imported', () => {
+      const addError = jest.fn();
+      const addSuccess = jest.fn();
+
+      showToasterMessage({
+        importResponse: {
+          success: true,
+          success_count: 0,
+          rules_count: 0,
+          errors: [],
+          exceptions_errors: [],
+          exceptions_success: true,
+          exceptions_success_count: 0,
+          action_connectors_success_count: 1,
+          action_connectors_success: true,
+        },
+        exceptionsIncluded: true,
+        actionConnectorsIncluded: true,
+        successMessage: (msg) => `success: ${msg}`,
+        errorMessage: (msg) => `error: ${msg}`,
+        errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
+        addError,
+        addSuccess,
+      });
+
+      expect(addSuccess).toHaveBeenCalledTimes(1);
+      expect(addSuccess).toHaveBeenNthCalledWith(1, 'Successfully imported 1 connector.');
+      expect(addError).not.toHaveBeenCalled();
+    });
+    it('should display the user friendly message in case of additional privileges', () => {
+      const addError = jest.fn();
+      const addSuccess = jest.fn();
+
+      showToasterMessage({
+        importResponse: {
+          success: false,
+          success_count: 1,
+          rules_count: 2,
+          action_connectors_success: false,
+          errors: [
+            {
+              rule_id: 'unknown',
+              error: {
+                status_code: 403,
+                message:
+                  'You may not have actions privileges required to import rules with actions',
+              },
+            },
+          ],
+          action_connectors_errors: [
+            {
+              rule_id: 'unknown',
+              error: {
+                status_code: 403,
+                message:
+                  'You may not have actions privileges required to import rules with actions',
+              },
+            },
+            {
+              rule_id: 'unknown',
+              error: {
+                status_code: 403,
+                message:
+                  'You may not have actions privileges required to import rules with actions',
+              },
+            },
+          ],
+          exceptions_success: true,
+          exceptions_success_count: 0,
+        },
+        exceptionsIncluded: false,
+        actionConnectorsIncluded: true,
+        successMessage: (msg) => `success: ${msg}`,
+        errorMessage: (msg) => `error: ${msg}`,
+        errorMessageDetailed: (msg) => `errorDetailed: ${msg}`,
+        addError,
+        addSuccess,
+      });
+
+      expect(addError).toHaveBeenCalledTimes(1);
+
+      expect(addError).toHaveBeenCalledWith(
+        new Error(
+          'errorDetailed: You need additional privileges to import rules with actions.. errorDetailed: You need additional privileges to import rules with actions.'
+        ),
+        {
+          title: 'Failed to import 2 connectors',
+        }
+      );
+      expect(addSuccess).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/import_data_modal/utils.ts b/x-pack/plugins/security_solution/public/common/components/import_data_modal/utils.ts
index 8211c01a7bffa..92c6f9f666e4b 100644
--- a/x-pack/plugins/security_solution/public/common/components/import_data_modal/utils.ts
+++ b/x-pack/plugins/security_solution/public/common/components/import_data_modal/utils.ts
@@ -30,9 +30,32 @@ export const formatError = (
   return error;
 };
 
+const mapErrorMessageToUserMessage = (
+  actionConnectorsErrors: Array<ImportRulesResponseError | ImportResponseError>
+) => {
+  return actionConnectorsErrors.map((connectorError) => {
+    const { error } = connectorError;
+    const { status_code: statusCode, message: originalMessage } = error || {};
+    let message;
+    switch (statusCode) {
+      case 403:
+        message = i18n.ACTION_CONNECTORS_ADDITIONAL_PRIVILEGES;
+        break;
+
+      default:
+        message = originalMessage;
+
+        break;
+    }
+
+    return { ...connectorError, error: { ...error, message } };
+  });
+};
+
 export const showToasterMessage = ({
   importResponse,
   exceptionsIncluded,
+  actionConnectorsIncluded,
   successMessage,
   errorMessage,
   errorMessageDetailed,
@@ -41,53 +64,68 @@ export const showToasterMessage = ({
 }: {
   importResponse: ImportDataResponse;
   exceptionsIncluded: boolean;
+  actionConnectorsIncluded: boolean;
   successMessage: (totalCount: number) => string;
   errorMessage: (totalCount: number) => string;
   errorMessageDetailed: (message: string) => string;
   addError: (error: unknown, options: ErrorToastOptions) => Toast;
   addSuccess: (toastOrTitle: ToastInput, options?: ToastOptions | undefined) => Toast;
 }) => {
-  // if import includes exceptions
-  if (exceptionsIncluded) {
-    // rules response actions
-    if (importResponse.success && importResponse.success_count > 0) {
-      addSuccess(successMessage(importResponse.success_count));
-    }
-
-    if (importResponse.errors.length > 0 && importResponse.rules_count) {
-      const error = formatError(errorMessageDetailed, importResponse, importResponse.errors);
-      addError(error, {
-        title: errorMessage(importResponse.rules_count - importResponse.success_count),
-      });
-    }
-
-    // exceptions response actions
+  if (importResponse.success) {
+    if (importResponse.success_count > 0) addSuccess(successMessage(importResponse.success_count));
     if (
+      exceptionsIncluded &&
       importResponse.exceptions_success &&
       importResponse.exceptions_success_count != null &&
       importResponse.exceptions_success_count > 0
     ) {
       addSuccess(i18n.SUCCESSFULLY_IMPORTED_EXCEPTIONS(importResponse.exceptions_success_count));
     }
+    if (
+      actionConnectorsIncluded &&
+      importResponse.action_connectors_success &&
+      importResponse.action_connectors_success_count != null &&
+      importResponse.action_connectors_success_count > 0
+    ) {
+      addSuccess(
+        i18n.SUCCESSFULLY_IMPORTED_CONNECTORS(importResponse.action_connectors_success_count)
+      );
+    }
+    return;
+  }
+
+  if (importResponse.errors.length > 0) {
+    if (
+      actionConnectorsIncluded &&
+      importResponse.action_connectors_errors != null &&
+      importResponse.action_connectors_errors.length > 0
+    ) {
+      const userErrorMessages = mapErrorMessageToUserMessage(
+        importResponse.action_connectors_errors
+      );
+      const connectorError = formatError(errorMessageDetailed, importResponse, userErrorMessages);
 
-    if (importResponse.exceptions_errors != null && importResponse.exceptions_errors.length > 0) {
-      const error = formatError(
+      return addError(connectorError, {
+        title: i18n.IMPORT_CONNECTORS_FAILED(userErrorMessages.length),
+      });
+    }
+    const ruleError = formatError(errorMessageDetailed, importResponse, importResponse.errors);
+    addError(ruleError, { title: errorMessage(importResponse.errors.length) });
+
+    if (
+      exceptionsIncluded &&
+      importResponse.exceptions_errors != null &&
+      importResponse.exceptions_errors.length > 0
+    ) {
+      const exceptionError = formatError(
         errorMessageDetailed,
         importResponse,
         importResponse.exceptions_errors
       );
 
-      addError(error, { title: i18n.IMPORT_FAILED(importResponse.exceptions_errors.length) });
-    }
-  } else {
-    // rules response actions
-    if (importResponse.success) {
-      addSuccess(successMessage(importResponse.success_count));
-    }
-
-    if (importResponse.errors.length > 0) {
-      const error = formatError(errorMessageDetailed, importResponse, importResponse.errors);
-      addError(error, { title: errorMessage(importResponse.errors.length) });
+      addError(exceptionError, {
+        title: i18n.IMPORT_FAILED(importResponse.exceptions_errors.length),
+      });
     }
   }
 };
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts
index bf1ac32d2bc78..a1d59efa4c30a 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts
@@ -493,6 +493,7 @@ describe('Detections Rules API', () => {
         },
         query: {
           overwrite: false,
+          overwrite_action_connectors: false,
           overwrite_exceptions: false,
         },
       });
@@ -510,6 +511,7 @@ describe('Detections Rules API', () => {
         query: {
           overwrite: true,
           overwrite_exceptions: false,
+          overwrite_action_connectors: false,
         },
       });
     });
@@ -523,6 +525,10 @@ describe('Detections Rules API', () => {
         exceptions_errors: [],
         exceptions_success: true,
         exceptions_success_count: 0,
+        action_connectors_success: true,
+        action_connectors_success_count: 0,
+        action_connectors_errors: [],
+        action_connectors_warnings: [],
       });
       const resp = await importRules({ fileToImport, signal: abortCtrl.signal });
       expect(resp).toEqual({
@@ -533,6 +539,10 @@ describe('Detections Rules API', () => {
         exceptions_errors: [],
         exceptions_success: true,
         exceptions_success_count: 0,
+        action_connectors_success: true,
+        action_connectors_success_count: 0,
+        action_connectors_errors: [],
+        action_connectors_warnings: [],
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts
index c867b6b3fd792..aec165167db59 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts
@@ -341,6 +341,7 @@ export const importRules = async ({
   fileToImport,
   overwrite = false,
   overwriteExceptions = false,
+  overwriteActionConnectors = false,
   signal,
 }: ImportDataProps): Promise<ImportDataResponse> => {
   const formData = new FormData();
@@ -351,7 +352,11 @@ export const importRules = async ({
     {
       method: 'POST',
       headers: { 'Content-Type': undefined },
-      query: { overwrite, overwrite_exceptions: overwriteExceptions },
+      query: {
+        overwrite,
+        overwrite_exceptions: overwriteExceptions,
+        overwrite_action_connectors: overwriteActionConnectors,
+      },
       body: formData,
       signal,
     }
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/types.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/types.ts
index 6b520659090d9..246a000356761 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/types.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/types.ts
@@ -29,6 +29,7 @@ import {
 import type { NamespaceType } from '@kbn/securitysolution-io-ts-list-types';
 
 import { PositiveInteger } from '@kbn/securitysolution-io-ts-types';
+import type { WarningSchema } from '../../../../common/detection_engine/schemas/response';
 import { RuleExecutionSummary } from '../../../../common/detection_engine/rule_monitoring';
 import {
   AlertSuppression,
@@ -267,6 +268,7 @@ export interface ImportDataProps {
   fileToImport: File;
   overwrite?: boolean;
   overwriteExceptions?: boolean;
+  overwriteActionConnectors?: boolean;
   signal: AbortSignal;
 }
 
@@ -304,6 +306,10 @@ export interface ImportDataResponse {
   exceptions_success?: boolean;
   exceptions_success_count?: number;
   exceptions_errors?: ExceptionsImportError[];
+  action_connectors_success?: boolean;
+  action_connectors_success_count?: number;
+  action_connectors_errors?: Array<ImportRulesResponseError | ImportResponseError>;
+  action_connectors_warnings?: WarningSchema[];
 }
 
 export interface ExportDocumentsProps {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/rule_management/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/rule_management/index.tsx
index f02075809a46d..a26517e447d7a 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/rule_management/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/rule_management/index.tsx
@@ -108,6 +108,7 @@ const RulesPageComponent: React.FC = () => {
         title={i18n.IMPORT_RULE}
         showExceptionsCheckBox
         showCheckBox
+        showActionConnectorsCheckBox
       />
 
       <RulesTableContextProvider>
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts
index 2234f09cb1888..e3fabc5366980 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts
@@ -326,12 +326,18 @@ export const performBulkActionRoute = (
           'alerting',
           'licensing',
           'lists',
+          'actions',
         ]);
 
         const rulesClient = ctx.alerting.getRulesClient();
         const exceptionsClient = ctx.lists?.getExceptionListClient();
         const savedObjectsClient = ctx.core.savedObjects.client;
 
+        const { getExporter, getClient } = (await ctx.core).savedObjects;
+        const client = getClient({ includedHiddenTypes: ['action'] });
+
+        const exporter = getExporter(client);
+
         const mlAuthz = buildMlAuthz({
           license: ctx.licensing.license,
           ml,
@@ -556,10 +562,12 @@ export const performBulkActionRoute = (
               exceptionsClient,
               savedObjectsClient,
               rules.map(({ params }) => ({ rule_id: params.ruleId })),
-              logger
+              logger,
+              exporter,
+              request
             );
 
-            const responseBody = `${exported.rulesNdjson}${exported.exceptionLists}${exported.exportDetails}`;
+            const responseBody = `${exported.rulesNdjson}${exported.exceptionLists}${exported.actionConnectors}${exported.exportDetails}`;
 
             return response.ok({
               headers: {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/export_rules/route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/export_rules/route.ts
index ec96f38f5f86e..a1a5f798fc002 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/export_rules/route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/export_rules/route.ts
@@ -45,8 +45,14 @@ export const exportRulesRoute = (
       const siemResponse = buildSiemResponse(response);
       const rulesClient = (await context.alerting).getRulesClient();
       const exceptionsClient = (await context.lists)?.getExceptionListClient();
-      const savedObjectsClient = (await context.core).savedObjects.client;
+      const {
+        getExporter,
+        getClient,
+        client: savedObjectsClient,
+      } = (await context.core).savedObjects;
 
+      const client = getClient({ includedHiddenTypes: ['action'] });
+      const actionsExporter = getExporter(client);
       try {
         const exportSizeLimit = config.maxRuleImportExportSize;
         if (request.body?.objects != null && request.body.objects.length > exportSizeLimit) {
@@ -66,20 +72,29 @@ export const exportRulesRoute = (
           }
         }
 
-        const exportedRulesAndExceptions =
+        const exportedRulesAndReferences =
           request.body?.objects != null
             ? await getExportByObjectIds(
                 rulesClient,
                 exceptionsClient,
                 savedObjectsClient,
                 request.body.objects,
-                logger
+                logger,
+                actionsExporter,
+                request
               )
-            : await getExportAll(rulesClient, exceptionsClient, savedObjectsClient, logger);
+            : await getExportAll(
+                rulesClient,
+                exceptionsClient,
+                savedObjectsClient,
+                logger,
+                actionsExporter,
+                request
+              );
 
         const responseBody = request.query.exclude_export_details
-          ? exportedRulesAndExceptions.rulesNdjson
-          : `${exportedRulesAndExceptions.rulesNdjson}${exportedRulesAndExceptions.exceptionLists}${exportedRulesAndExceptions.exportDetails}`;
+          ? exportedRulesAndReferences.rulesNdjson
+          : `${exportedRulesAndReferences.rulesNdjson}${exportedRulesAndReferences.exceptionLists}${exportedRulesAndReferences.actionConnectors}${exportedRulesAndReferences.exportDetails}`;
 
         return response.ok({
           headers: {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.test.ts
index 3d466d2505074..bb1bb7d55244a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.test.ts
@@ -107,6 +107,10 @@ describe('Import rules route', () => {
         exceptions_errors: [],
         exceptions_success: true,
         exceptions_success_count: 0,
+        action_connectors_success: true,
+        action_connectors_success_count: 0,
+        action_connectors_warnings: [],
+        action_connectors_errors: [],
       });
     });
 
@@ -146,6 +150,10 @@ describe('Import rules route', () => {
         exceptions_errors: [],
         exceptions_success: true,
         exceptions_success_count: 0,
+        action_connectors_success: true,
+        action_connectors_success_count: 0,
+        action_connectors_warnings: [],
+        action_connectors_errors: [],
       });
     });
 
@@ -171,6 +179,10 @@ describe('Import rules route', () => {
         exceptions_errors: [],
         exceptions_success: true,
         exceptions_success_count: 0,
+        action_connectors_success: true,
+        action_connectors_success_count: 0,
+        action_connectors_warnings: [],
+        action_connectors_errors: [],
       });
     });
 
@@ -196,6 +208,10 @@ describe('Import rules route', () => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_warnings: [],
+          action_connectors_errors: [],
         });
       });
 
@@ -218,6 +234,10 @@ describe('Import rules route', () => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_warnings: [],
+          action_connectors_errors: [],
         });
       });
     });
@@ -242,6 +262,10 @@ describe('Import rules route', () => {
         rules_count: 2,
         exceptions_success: true,
         exceptions_success_count: 0,
+        action_connectors_success: true,
+        action_connectors_success_count: 0,
+        action_connectors_warnings: [],
+        action_connectors_errors: [],
       });
     });
 
@@ -262,6 +286,10 @@ describe('Import rules route', () => {
         exceptions_errors: [],
         exceptions_success: true,
         exceptions_success_count: 0,
+        action_connectors_success: true,
+        action_connectors_success_count: 0,
+        action_connectors_warnings: [],
+        action_connectors_errors: [],
       });
     });
 
@@ -302,6 +330,10 @@ describe('Import rules route', () => {
         exceptions_errors: [],
         exceptions_success: true,
         exceptions_success_count: 0,
+        action_connectors_success: true,
+        action_connectors_success_count: 0,
+        action_connectors_warnings: [],
+        action_connectors_errors: [],
       });
     });
 
@@ -332,6 +364,10 @@ describe('Import rules route', () => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_warnings: [],
+          action_connectors_errors: [],
         });
       });
 
@@ -353,6 +389,10 @@ describe('Import rules route', () => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_warnings: [],
+          action_connectors_errors: [],
         });
       });
     });
@@ -387,6 +427,10 @@ describe('Import rules route', () => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_warnings: [],
+          action_connectors_errors: [],
         });
       });
 
@@ -407,6 +451,10 @@ describe('Import rules route', () => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_warnings: [],
+          action_connectors_errors: [],
         });
       });
     });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.ts
index e306caac12194..ddcbf2cbdd6e4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.ts
@@ -16,7 +16,6 @@ import type { ImportQuerySchemaDecoded } from '@kbn/securitysolution-io-ts-types
 import { importQuerySchema } from '@kbn/securitysolution-io-ts-types';
 
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../../../common/constants';
-import type { RuleToImport } from '../../../../../../../common/detection_engine/rule_management';
 import { ImportRulesResponse } from '../../../../../../../common/detection_engine/rule_management';
 
 import type { SecuritySolutionPluginRouter } from '../../../../../../types';
@@ -28,7 +27,6 @@ import { isBulkError, isImportRegular, buildSiemResponse } from '../../../../rou
 
 import {
   getTupleDuplicateErrorsAndUniqueRules,
-  getInvalidConnectors,
   migrateLegacyActionsIds,
 } from '../../../utils/utils';
 import { createRulesAndExceptionsStreamFromNdJson } from '../../../logic/import/create_rules_stream_from_ndjson';
@@ -38,6 +36,7 @@ import { importRules as importRulesHelper } from '../../../logic/import/import_r
 import { getReferencedExceptionLists } from '../../../logic/import/gather_referenced_exceptions';
 import { importRuleExceptions } from '../../../logic/import/import_rule_exceptions';
 import type { HapiReadableStream } from '../../../logic/import/hapi_readable_stream';
+import { importRuleActionConnectors } from '../../../logic/import/action_connectors/import_rule_action_connectors';
 
 const CHUNK_PARSED_OBJECT_SIZE = 50;
 
@@ -81,6 +80,8 @@ export const importRulesRoute = (
         const actionSOClient = ctx.core.savedObjects.getClient({
           includedHiddenTypes: ['action'],
         });
+        const actionsImporter = ctx.core.savedObjects.getImporter(actionSOClient);
+
         const savedObjectsClient = ctx.core.savedObjects.client;
         const exceptionsClient = ctx.lists?.getExceptionListClient();
 
@@ -104,7 +105,7 @@ export const importRulesRoute = (
 
         // parse file to separate out exceptions from rules
         const readAllStream = createRulesAndExceptionsStreamFromNdJson(objectLimit);
-        const [{ exceptions, rules }] = await createPromiseFromStreams<
+        const [{ exceptions, rules, actionConnectors }] = await createPromiseFromStreams<
           RuleExceptionsPromiseFromStreams[]
         >([request.body.file as HapiReadableStream, ...readAllStream]);
 
@@ -119,7 +120,6 @@ export const importRulesRoute = (
           overwrite: request.query.overwrite_exceptions,
           maxExceptionsImportSize: objectLimit,
         });
-
         // report on duplicate rules
         const [duplicateIdErrors, parsedObjectsWithoutDuplicateErrors] =
           getTupleDuplicateErrorsAndUniqueRules(rules, request.query.overwrite);
@@ -129,20 +129,23 @@ export const importRulesRoute = (
           actionSOClient
         );
 
-        let parsedRules;
-        let actionErrors: BulkError[] = [];
-        const actualRules = rules.filter((rule): rule is RuleToImport => !(rule instanceof Error));
-
-        if (actualRules.some((rule) => rule.actions && rule.actions.length > 0)) {
-          const [nonExistentActionErrors, uniqueParsedObjects] = await getInvalidConnectors(
-            migratedParsedObjectsWithoutDuplicateErrors,
-            actionsClient
-          );
-          parsedRules = uniqueParsedObjects;
-          actionErrors = nonExistentActionErrors;
-        } else {
-          parsedRules = migratedParsedObjectsWithoutDuplicateErrors;
-        }
+        // import actions-connectors
+        const {
+          successCount: actionConnectorSuccessCount,
+          success: actionConnectorSuccess,
+          warnings: actionConnectorWarnings,
+          errors: actionConnectorErrors,
+        } = await importRuleActionConnectors({
+          actionConnectors,
+          actionsClient,
+          actionsImporter,
+          rules: migratedParsedObjectsWithoutDuplicateErrors,
+          overwrite: request.query.overwrite_action_connectors,
+        });
+        const parsedRules = actionConnectorErrors.length
+          ? []
+          : migratedParsedObjectsWithoutDuplicateErrors;
+
         // gather all exception lists that the imported rules reference
         const foundReferencedExceptionLists = await getReferencedExceptionLists({
           rules: parsedRules,
@@ -153,7 +156,7 @@ export const importRulesRoute = (
 
         const importRuleResponse: ImportRuleResponse[] = await importRulesHelper({
           ruleChunks: chunkParseObjects,
-          rulesResponseAcc: [...actionErrors, ...duplicateIdErrors],
+          rulesResponseAcc: [...actionConnectorErrors, ...duplicateIdErrors],
           mlAuthz,
           overwriteRules: request.query.overwrite,
           rulesClient,
@@ -161,6 +164,7 @@ export const importRulesRoute = (
           exceptionsClient,
           spaceId: ctx.securitySolution.getSpaceId(),
           existingLists: foundReferencedExceptionLists,
+          allowMissingConnectorSecrets: !!actionConnectors.length,
         });
 
         const errorsResp = importRuleResponse.filter((resp) => isBulkError(resp)) as BulkError[];
@@ -179,6 +183,10 @@ export const importRulesRoute = (
           exceptions_errors: exceptionsErrors,
           exceptions_success: exceptionsSuccess,
           exceptions_success_count: exceptionsSuccessCount,
+          action_connectors_success: actionConnectorSuccess,
+          action_connectors_success_count: actionConnectorSuccessCount,
+          action_connectors_errors: actionConnectorErrors,
+          action_connectors_warnings: actionConnectorWarnings,
         };
 
         const [validated, errors] = validate(importRules, ImportRulesResponse);
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/crud/create_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/crud/create_rules.ts
index f621542fe433f..416edb039919e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/crud/create_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/crud/create_rules.ts
@@ -19,6 +19,7 @@ export interface CreateRulesOptions<T extends RuleCreateProps = RuleCreateProps>
   id?: string;
   immutable?: boolean;
   defaultEnabled?: boolean;
+  allowMissingConnectorSecrets?: boolean;
 }
 
 export const createRules = async ({
@@ -27,6 +28,7 @@ export const createRules = async ({
   id,
   immutable = false,
   defaultEnabled = true,
+  allowMissingConnectorSecrets,
 }: CreateRulesOptions): Promise<SanitizedRule<RuleParams>> => {
   const internalRule = convertCreateAPIToInternalSchema(params, immutable, defaultEnabled);
   const rule = await rulesClient.create<RuleParams>({
@@ -34,6 +36,7 @@ export const createRules = async ({
       id,
     },
     data: internalRule,
+    allowMissingConnectorSecrets,
   });
 
   // Mute the rule if it is first created with the explicit no actions
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/crud/patch_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/crud/patch_rules.ts
index 656366ec9f92b..45d1a21325abd 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/crud/patch_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/crud/patch_rules.ts
@@ -16,12 +16,14 @@ export interface PatchRulesOptions {
   rulesClient: RulesClient;
   nextParams: PatchRuleRequestBody;
   existingRule: RuleAlertType | null | undefined;
+  allowMissingConnectorSecrets?: boolean;
 }
 
 export const patchRules = async ({
   rulesClient,
   existingRule,
   nextParams,
+  allowMissingConnectorSecrets,
 }: PatchRulesOptions): Promise<PartialRule<RuleParams> | null> => {
   if (existingRule == null) {
     return null;
@@ -32,6 +34,7 @@ export const patchRules = async ({
   const update = await rulesClient.update({
     id: existingRule.id,
     data: patchedRule,
+    allowMissingConnectorSecrets,
   });
 
   if (nextParams.throttle !== undefined) {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.test.ts
index b7395236a2152..d5511ccf7b1cc 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.test.ts
@@ -24,13 +24,17 @@ import { getQueryRuleParams } from '../../../rule_schema/mocks';
 import { getExceptionListClientMock } from '@kbn/lists-plugin/server/services/exception_lists/exception_list_client.mock';
 import type { loggingSystemMock } from '@kbn/core/server/mocks';
 import { requestContextMock } from '../../../routes/__mocks__/request_context';
+import { savedObjectsExporterMock } from '@kbn/core-saved-objects-import-export-server-mocks';
+import { mockRouter } from '@kbn/core-http-router-server-mocks';
+import { Readable } from 'stream';
 
 const exceptionsClient = getExceptionListClientMock();
 
 describe('getExportAll', () => {
   let logger: ReturnType<typeof loggingSystemMock.createLogger>;
   const { clients } = requestContextMock.createTools();
-
+  const exporterMock = savedObjectsExporterMock.create();
+  const requestMock = mockRouter.createKibanaRequest();
   beforeEach(async () => {
     clients.savedObjectsClient.find.mockResolvedValue(getEmptySavedObjectsResponse());
   });
@@ -55,7 +59,9 @@ describe('getExportAll', () => {
       rulesClient,
       exceptionsClient,
       clients.savedObjectsClient,
-      logger
+      logger,
+      exporterMock,
+      requestMock
     );
     const rulesJson = JSON.parse(exports.rulesNdjson);
     const detailsJson = JSON.parse(exports.exportDetails);
@@ -114,6 +120,11 @@ describe('getExportAll', () => {
       missing_exception_lists_count: 0,
       missing_rules: [],
       missing_rules_count: 0,
+      excluded_action_connection_count: 0,
+      excluded_action_connections: [],
+      exported_action_connector_count: 0,
+      missing_action_connection_count: 0,
+      missing_action_connections: [],
     });
   });
 
@@ -133,12 +144,186 @@ describe('getExportAll', () => {
       rulesClient,
       exceptionsClient,
       clients.savedObjectsClient,
-      logger
+      logger,
+      exporterMock,
+      requestMock
     );
     expect(exports).toEqual({
       rulesNdjson: '',
       exportDetails: getSampleDetailsAsNdjson(details),
       exceptionLists: '',
+      actionConnectors: '',
+    });
+  });
+  test('it will export with rule and action connectors', async () => {
+    const rulesClient = rulesClientMock.create();
+    const result = getFindResultWithSingleHit();
+    const alert = {
+      ...getRuleMock(getQueryRuleParams()),
+      actions: [
+        {
+          group: 'default',
+          id: '123',
+          params: {
+            message: 'Rule {{context.rule.name}} generated {{state.signals_count}} alerts',
+          },
+          actionTypeId: '.slack',
+        },
+      ],
+    };
+
+    alert.params = {
+      ...alert.params,
+      filters: [{ query: { match_phrase: { 'host.name': 'some-host' } } }],
+      threat: getThreatMock(),
+      meta: { someMeta: 'someField' },
+      timelineId: 'some-timeline-id',
+      timelineTitle: 'some-timeline-title',
+    };
+    result.data = [alert];
+    rulesClient.find.mockResolvedValue(result);
+    let eventCount = 0;
+    const readable = new Readable({
+      objectMode: true,
+      read() {
+        if (eventCount === 0) {
+          eventCount += 1;
+          return this.push({
+            id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+            type: 'action',
+            updated_at: '2023-01-11T11:30:31.683Z',
+            created_at: '2023-01-11T11:30:31.683Z',
+            version: 'WzE2MDYsMV0=',
+            attributes: {
+              actionTypeId: '.slack',
+              name: 'slack',
+              isMissingSecrets: true,
+              config: {},
+              secrets: {},
+            },
+            references: [],
+            migrationVersion: { action: '8.3.0' },
+            coreMigrationVersion: '8.7.0',
+          });
+        }
+        if (eventCount === 1) {
+          eventCount += 1;
+          return this.push({
+            exportedCount: 1,
+            missingRefCount: 0,
+            missingReferences: [],
+            excludedObjectsCount: 0,
+            excludedObjects: [],
+          });
+        }
+        return this.push(null);
+      },
+    });
+
+    const exporterMockWithConnector = {
+      exportByObjects: () => jest.fn().mockReturnValueOnce(readable),
+
+      exportByTypes: jest.fn(),
+    };
+    const exports = await getExportAll(
+      rulesClient,
+      exceptionsClient,
+      clients.savedObjectsClient,
+      logger,
+      exporterMockWithConnector as never,
+      requestMock
+    );
+    const rulesJson = JSON.parse(exports.rulesNdjson);
+    const detailsJson = JSON.parse(exports.exportDetails);
+    const actionConnectorsJSON = JSON.parse(exports.actionConnectors);
+    expect(rulesJson).toEqual({
+      author: ['Elastic'],
+      actions: [
+        {
+          group: 'default',
+          id: '123',
+          params: {
+            message: 'Rule {{context.rule.name}} generated {{state.signals_count}} alerts',
+          },
+          action_type_id: '.slack',
+        },
+      ],
+      building_block_type: 'default',
+      created_at: '2019-12-13T16:40:33.400Z',
+      updated_at: '2019-12-13T16:40:33.400Z',
+      created_by: 'elastic',
+      description: 'Detecting root and admin users',
+      enabled: true,
+      false_positives: [],
+      filters: [{ query: { match_phrase: { 'host.name': 'some-host' } } }],
+      from: 'now-6m',
+      id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      immutable: false,
+      index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+      interval: '5m',
+      rule_id: 'rule-1',
+      language: 'kuery',
+      license: 'Elastic License',
+      output_index: '.siem-signals',
+      max_signals: 10000,
+      risk_score: 50,
+      risk_score_mapping: [],
+      name: 'Detect Root/Admin Users',
+      query: 'user.name: root or user.name: admin',
+      references: ['http://example.com', 'https://example.com'],
+      related_integrations: [],
+      required_fields: [],
+      setup: '',
+      timeline_id: 'some-timeline-id',
+      timeline_title: 'some-timeline-title',
+      meta: { someMeta: 'someField' },
+      severity: 'high',
+      severity_mapping: [],
+      updated_by: 'elastic',
+      tags: [],
+      to: 'now',
+      type: 'query',
+      threat: getThreatMock(),
+      throttle: 'rule',
+      note: '# Investigative notes',
+      version: 1,
+      exceptions_list: getListArrayMock(),
+    });
+    expect(detailsJson).toEqual({
+      exported_exception_list_count: 1,
+      exported_exception_list_item_count: 1,
+      exported_count: 4,
+      exported_rules_count: 1,
+      missing_exception_list_item_count: 0,
+      missing_exception_list_items: [],
+      missing_exception_lists: [],
+      missing_exception_lists_count: 0,
+      missing_rules: [],
+      missing_rules_count: 0,
+      excluded_action_connection_count: 0,
+      excluded_action_connections: [],
+      exported_action_connector_count: 1,
+      missing_action_connection_count: 0,
+      missing_action_connections: [],
+    });
+    expect(actionConnectorsJSON).toEqual({
+      attributes: {
+        actionTypeId: '.slack',
+        config: {},
+        isMissingSecrets: true,
+        name: 'slack',
+        secrets: {},
+      },
+      coreMigrationVersion: '8.7.0',
+      created_at: '2023-01-11T11:30:31.683Z',
+      id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+      migrationVersion: {
+        action: '8.3.0',
+      },
+      references: [],
+      type: 'action',
+      updated_at: '2023-01-11T11:30:31.683Z',
+      version: 'WzE2MDYsMV0=',
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts
index 058559de7db59..88f3e9019d493 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts
@@ -7,13 +7,14 @@
 
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
-import type { Logger } from '@kbn/core/server';
+import type { ISavedObjectsExporter, KibanaRequest, Logger } from '@kbn/core/server';
 import type { ExceptionListClient } from '@kbn/lists-plugin/server';
 import type { RulesClient, RuleExecutorServices } from '@kbn/alerting-plugin/server';
 import { getNonPackagedRules } from '../search/get_existing_prepackaged_rules';
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
 import { transformAlertsToRules } from '../../utils/utils';
 import { getRuleExceptionsForExport } from './get_export_rule_exceptions';
+import { getRuleActionConnectorsForExport } from './get_export_rule_action_connectors';
 
 // eslint-disable-next-line no-restricted-imports
 import { legacyGetBulkRuleActionsSavedObject } from '../../../rule_actions_legacy';
@@ -22,11 +23,14 @@ export const getExportAll = async (
   rulesClient: RulesClient,
   exceptionsClient: ExceptionListClient | undefined,
   savedObjectsClient: RuleExecutorServices['savedObjectsClient'],
-  logger: Logger
+  logger: Logger,
+  actionsExporter: ISavedObjectsExporter,
+  request: KibanaRequest
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
   exceptionLists: string | null;
+  actionConnectors: string;
 }> => {
   const ruleAlertTypes = await getNonPackagedRules({ rulesClient });
   const alertIds = ruleAlertTypes.map((rule) => rule.id);
@@ -44,7 +48,15 @@ export const getExportAll = async (
   const { exportData: exceptionLists, exportDetails: exceptionDetails } =
     await getRuleExceptionsForExport(exceptions, exceptionsClient);
 
+  // Retrieve Action-Connectors
+  const { actionConnectors, actionConnectorDetails } = await getRuleActionConnectorsForExport(
+    rules,
+    actionsExporter,
+    request
+  );
+
   const rulesNdjson = transformDataToNdjson(rules);
-  const exportDetails = getExportDetailsNdjson(rules, [], exceptionDetails);
-  return { rulesNdjson, exportDetails, exceptionLists };
+  const exportDetails = getExportDetailsNdjson(rules, [], exceptionDetails, actionConnectorDetails);
+
+  return { rulesNdjson, exportDetails, exceptionLists, actionConnectors };
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.test.ts
index 02b83342cd846..570954ba9c8b0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.test.ts
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { Readable } from 'stream';
 import type { RulesErrors } from './get_export_by_object_ids';
 import { getExportByObjectIds, getRulesFromObjects } from './get_export_by_object_ids';
 import type { FindHit } from '../../../routes/__mocks__/request_responses';
@@ -22,6 +22,8 @@ import {
 } from '../../../../../../common/detection_engine/rule_management/mocks';
 import { getQueryRuleParams } from '../../../rule_schema/mocks';
 import { getExceptionListClientMock } from '@kbn/lists-plugin/server/services/exception_lists/exception_list_client.mock';
+import { savedObjectsExporterMock } from '@kbn/core-saved-objects-import-export-server-mocks';
+import { mockRouter } from '@kbn/core-http-router-server-mocks';
 
 const exceptionsClient = getExceptionListClientMock();
 import type { loggingSystemMock } from '@kbn/core/server/mocks';
@@ -30,6 +32,8 @@ import { requestContextMock } from '../../../routes/__mocks__/request_context';
 describe('get_export_by_object_ids', () => {
   let logger: ReturnType<typeof loggingSystemMock.createLogger>;
   const { clients } = requestContextMock.createTools();
+  const exporterMock = savedObjectsExporterMock.create();
+  const requestMock = mockRouter.createKibanaRequest();
 
   beforeEach(() => {
     jest.resetAllMocks();
@@ -50,7 +54,9 @@ describe('get_export_by_object_ids', () => {
         exceptionsClient,
         clients.savedObjectsClient,
         objects,
-        logger
+        logger,
+        exporterMock,
+        requestMock
       );
       const exportsObj = {
         rulesNdjson: JSON.parse(exports.rulesNdjson),
@@ -112,6 +118,11 @@ describe('get_export_by_object_ids', () => {
           missing_exception_lists_count: 0,
           missing_rules: [],
           missing_rules_count: 0,
+          excluded_action_connection_count: 0,
+          excluded_action_connections: [],
+          exported_action_connector_count: 0,
+          missing_action_connection_count: 0,
+          missing_action_connections: [],
         },
       });
     });
@@ -137,7 +148,9 @@ describe('get_export_by_object_ids', () => {
         exceptionsClient,
         clients.savedObjectsClient,
         objects,
-        logger
+        logger,
+        exporterMock,
+        requestMock
       );
       const details = getOutputDetailsSampleWithExceptions({
         missingRules: [{ rule_id: 'rule-1' }],
@@ -147,6 +160,180 @@ describe('get_export_by_object_ids', () => {
         rulesNdjson: '',
         exportDetails: getSampleDetailsAsNdjson(details),
         exceptionLists: '',
+        actionConnectors: '',
+      });
+    });
+
+    test('it will export with rule and action connectors', async () => {
+      const rulesClient = rulesClientMock.create();
+      const result = getFindResultWithSingleHit();
+      const alert = {
+        ...getRuleMock(getQueryRuleParams()),
+        actions: [
+          {
+            group: 'default',
+            id: '123',
+            params: {
+              message: 'Rule {{context.rule.name}} generated {{state.signals_count}} alerts',
+            },
+            actionTypeId: '.slack',
+          },
+        ],
+      };
+
+      alert.params = {
+        ...alert.params,
+        filters: [{ query: { match_phrase: { 'host.name': 'some-host' } } }],
+        threat: getThreatMock(),
+        meta: { someMeta: 'someField' },
+        timelineId: 'some-timeline-id',
+        timelineTitle: 'some-timeline-title',
+      };
+      result.data = [alert];
+      rulesClient.find.mockResolvedValue(result);
+      let eventCount = 0;
+      const readable = new Readable({
+        objectMode: true,
+        read() {
+          if (eventCount === 0) {
+            eventCount += 1;
+            return this.push({
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+              type: 'action',
+              updated_at: '2023-01-11T11:30:31.683Z',
+              created_at: '2023-01-11T11:30:31.683Z',
+              version: 'WzE2MDYsMV0=',
+              attributes: {
+                actionTypeId: '.slack',
+                name: 'slack',
+                isMissingSecrets: true,
+                config: {},
+                secrets: {},
+              },
+              references: [],
+              migrationVersion: { action: '8.3.0' },
+              coreMigrationVersion: '8.7.0',
+            });
+          }
+          if (eventCount === 1) {
+            eventCount += 1;
+            return this.push({
+              exportedCount: 1,
+              missingRefCount: 0,
+              missingReferences: [],
+              excludedObjectsCount: 0,
+              excludedObjects: [],
+            });
+          }
+          return this.push(null);
+        },
+      });
+      const objects = [{ rule_id: 'rule-1' }];
+      const exporterMockWithConnector = {
+        exportByObjects: () => jest.fn().mockReturnValueOnce(readable),
+
+        exportByTypes: jest.fn(),
+      };
+      const exports = await getExportByObjectIds(
+        rulesClient,
+        exceptionsClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        exporterMockWithConnector as never,
+        requestMock
+      );
+      const rulesJson = JSON.parse(exports.rulesNdjson);
+      const detailsJson = JSON.parse(exports.exportDetails);
+      const actionConnectorsJSON = JSON.parse(exports.actionConnectors);
+      expect(rulesJson).toEqual({
+        author: ['Elastic'],
+        actions: [
+          {
+            group: 'default',
+            id: '123',
+            params: {
+              message: 'Rule {{context.rule.name}} generated {{state.signals_count}} alerts',
+            },
+            action_type_id: '.slack',
+          },
+        ],
+        building_block_type: 'default',
+        created_at: '2019-12-13T16:40:33.400Z',
+        updated_at: '2019-12-13T16:40:33.400Z',
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        false_positives: [],
+        filters: [{ query: { match_phrase: { 'host.name': 'some-host' } } }],
+        from: 'now-6m',
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        interval: '5m',
+        rule_id: 'rule-1',
+        language: 'kuery',
+        license: 'Elastic License',
+        output_index: '.siem-signals',
+        max_signals: 10000,
+        risk_score: 50,
+        risk_score_mapping: [],
+        name: 'Detect Root/Admin Users',
+        query: 'user.name: root or user.name: admin',
+        references: ['http://example.com', 'https://example.com'],
+        related_integrations: [],
+        required_fields: [],
+        setup: '',
+        timeline_id: 'some-timeline-id',
+        timeline_title: 'some-timeline-title',
+        meta: { someMeta: 'someField' },
+        severity: 'high',
+        severity_mapping: [],
+        updated_by: 'elastic',
+        tags: [],
+        to: 'now',
+        type: 'query',
+        threat: getThreatMock(),
+        throttle: 'rule',
+        note: '# Investigative notes',
+        version: 1,
+        exceptions_list: getListArrayMock(),
+      });
+      expect(detailsJson).toEqual({
+        exported_exception_list_count: 0,
+        exported_exception_list_item_count: 0,
+        exported_count: 2,
+        exported_rules_count: 1,
+        missing_exception_list_item_count: 0,
+        missing_exception_list_items: [],
+        missing_exception_lists: [],
+        missing_exception_lists_count: 0,
+        missing_rules: [],
+        missing_rules_count: 0,
+        excluded_action_connection_count: 0,
+        excluded_action_connections: [],
+        exported_action_connector_count: 1,
+        missing_action_connection_count: 0,
+        missing_action_connections: [],
+      });
+      expect(actionConnectorsJSON).toEqual({
+        attributes: {
+          actionTypeId: '.slack',
+          config: {},
+          isMissingSecrets: true,
+          name: 'slack',
+          secrets: {},
+        },
+        coreMigrationVersion: '8.7.0',
+        created_at: '2023-01-11T11:30:31.683Z',
+        id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+        migrationVersion: {
+          action: '8.3.0',
+        },
+        references: [],
+        type: 'action',
+        updated_at: '2023-01-11T11:30:31.683Z',
+        version: 'WzE2MDYsMV0=',
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.ts
index e15ab98e0d0ca..90938420e64b5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.ts
@@ -6,9 +6,10 @@
  */
 
 import { chunk } from 'lodash';
+
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
-import type { Logger } from '@kbn/core/server';
+import type { ISavedObjectsExporter, KibanaRequest, Logger } from '@kbn/core/server';
 import type { ExceptionListClient } from '@kbn/lists-plugin/server';
 import type { RulesClient, RuleExecutorServices } from '@kbn/alerting-plugin/server';
 
@@ -17,6 +18,7 @@ import { getExportDetailsNdjson } from './get_export_details_ndjson';
 import { isAlertType } from '../../../rule_schema';
 import { findRules } from '../search/find_rules';
 import { getRuleExceptionsForExport } from './get_export_rule_exceptions';
+import { getRuleActionConnectorsForExport } from './get_export_rule_action_connectors';
 
 // eslint-disable-next-line no-restricted-imports
 import { legacyGetBulkRuleActionsSavedObject } from '../../../rule_actions_legacy';
@@ -44,11 +46,14 @@ export const getExportByObjectIds = async (
   exceptionsClient: ExceptionListClient | undefined,
   savedObjectsClient: RuleExecutorServices['savedObjectsClient'],
   objects: Array<{ rule_id: string }>,
-  logger: Logger
+  logger: Logger,
+  actionsExporter: ISavedObjectsExporter,
+  request: KibanaRequest
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
   exceptionLists: string | null;
+  actionConnectors: string;
 }> => {
   const rulesAndErrors = await getRulesFromObjects(
     rulesClient,
@@ -56,23 +61,33 @@ export const getExportByObjectIds = async (
     objects,
     logger
   );
+  const { rules, missingRules } = rulesAndErrors;
 
   // Retrieve exceptions
-  const exceptions = rulesAndErrors.rules.flatMap((rule) => rule.exceptions_list ?? []);
+  const exceptions = rules.flatMap((rule) => rule.exceptions_list ?? []);
   const { exportData: exceptionLists, exportDetails: exceptionDetails } =
     await getRuleExceptionsForExport(exceptions, exceptionsClient);
 
-  const rulesNdjson = transformDataToNdjson(rulesAndErrors.rules);
+  // Retrieve Action-Connectors
+  const { actionConnectors, actionConnectorDetails } = await getRuleActionConnectorsForExport(
+    rules,
+    actionsExporter,
+    request
+  );
+
+  const rulesNdjson = transformDataToNdjson(rules);
   const exportDetails = getExportDetailsNdjson(
-    rulesAndErrors.rules,
-    rulesAndErrors.missingRules,
-    exceptionDetails
+    rules,
+    missingRules,
+    exceptionDetails,
+    actionConnectorDetails
   );
 
   return {
     rulesNdjson,
     exportDetails,
     exceptionLists,
+    actionConnectors,
   };
 };
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_details_ndjson.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_details_ndjson.ts
index 465c4b53b1e51..9efbe665812c9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_details_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_details_ndjson.ts
@@ -8,23 +8,29 @@
 import type { ExportExceptionDetails } from '@kbn/securitysolution-io-ts-list-types';
 import type { ExportRulesDetails } from '../../../../../../common/detection_engine/rule_management';
 import type { RuleResponse } from '../../../../../../common/detection_engine/rule_schema';
+import type { DefaultActionConnectorDetails } from './get_export_rule_action_connectors';
 
 export const getExportDetailsNdjson = (
   rules: RuleResponse[],
   missingRules: Array<{ rule_id: string }> = [],
-  exceptionDetails?: ExportExceptionDetails
+  exceptionDetails?: ExportExceptionDetails,
+  actionConnectorDetails?: DefaultActionConnectorDetails
 ): string => {
+  let exportedCount = rules.length;
+  if (actionConnectorDetails != null)
+    exportedCount += actionConnectorDetails.exported_action_connector_count;
+  if (exceptionDetails != null)
+    exportedCount +=
+      exceptionDetails.exported_exception_list_count +
+      exceptionDetails.exported_exception_list_item_count;
+
   const stringified: ExportRulesDetails = {
-    exported_count:
-      exceptionDetails == null
-        ? rules.length
-        : rules.length +
-          exceptionDetails.exported_exception_list_count +
-          exceptionDetails.exported_exception_list_item_count,
+    exported_count: exportedCount,
     exported_rules_count: rules.length,
     missing_rules: missingRules,
     missing_rules_count: missingRules.length,
     ...exceptionDetails,
+    ...actionConnectorDetails,
   };
   return `${JSON.stringify(stringified)}\n`;
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_rule_action_connectors.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_rule_action_connectors.ts
new file mode 100644
index 0000000000000..04472ff6b4598
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_rule_action_connectors.ts
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { KibanaRequest } from '@kbn/core-http-server';
+import type { SavedObjectTypeIdTuple } from '@kbn/core-saved-objects-common';
+import type {
+  SavedObjectsExportResultDetails,
+  ISavedObjectsExporter,
+  SavedObjectsExportExcludedObject,
+  SavedObject,
+} from '@kbn/core-saved-objects-server';
+import { createConcatStream, createMapStream, createPromiseFromStreams } from '@kbn/utils';
+import type { RuleResponse } from '../../../../../../common/detection_engine/rule_schema';
+
+export interface DefaultActionConnectorDetails {
+  exported_action_connector_count: number;
+  missing_action_connection_count: number;
+  missing_action_connections: SavedObjectTypeIdTuple[];
+  excluded_action_connection_count: number;
+  excluded_action_connections: SavedObjectsExportExcludedObject[];
+}
+
+const defaultActionConnectorDetails: DefaultActionConnectorDetails = {
+  exported_action_connector_count: 0,
+  missing_action_connection_count: 0,
+  missing_action_connections: [],
+  excluded_action_connection_count: 0,
+  excluded_action_connections: [],
+};
+
+const mapExportedActionConnectorsDetailsToDefault = (
+  exportDetails: SavedObjectsExportResultDetails
+): DefaultActionConnectorDetails => {
+  return {
+    exported_action_connector_count: exportDetails.exportedCount,
+    missing_action_connection_count: exportDetails.missingRefCount,
+    missing_action_connections: exportDetails.missingReferences,
+    excluded_action_connection_count: exportDetails.excludedObjectsCount,
+    excluded_action_connections: exportDetails.excludedObjects,
+  };
+};
+
+export const getRuleActionConnectorsForExport = async (
+  rules: RuleResponse[],
+  actionsExporter: ISavedObjectsExporter,
+  request: KibanaRequest
+) => {
+  const exportedActionConnectors: {
+    actionConnectors: string;
+    actionConnectorDetails: DefaultActionConnectorDetails;
+  } = {
+    actionConnectors: '',
+    actionConnectorDetails: defaultActionConnectorDetails,
+  };
+
+  const actionsIds = [...new Set(rules.flatMap((rule) => rule.actions.map(({ id }) => id)))];
+
+  if (!actionsIds.length) return exportedActionConnectors;
+
+  const getActionsByObjectsParam = actionsIds.map((id) => ({ type: 'action', id }));
+  const actionDetails = await actionsExporter.exportByObjects({
+    objects: getActionsByObjectsParam,
+    request,
+  });
+
+  if (!actionDetails) {
+    exportedActionConnectors.actionConnectorDetails = {
+      exported_action_connector_count: 0,
+      missing_action_connection_count: actionsIds.length,
+      missing_action_connections: [], // TODO: check how to generate SO
+      excluded_action_connection_count: 0,
+      excluded_action_connections: [],
+    };
+    return exportedActionConnectors;
+  }
+
+  const actionsConnectorsToExport: SavedObject[] = await createPromiseFromStreams([
+    actionDetails,
+    createMapStream((obj: SavedObject | SavedObjectsExportResultDetails) => {
+      if ('exportedCount' in obj)
+        exportedActionConnectors.actionConnectorDetails =
+          mapExportedActionConnectorsDetailsToDefault(obj);
+      else return JSON.stringify(obj);
+    }),
+    createConcatStream([]),
+  ]);
+  exportedActionConnectors.actionConnectors = actionsConnectorsToExport.join('\n');
+  return exportedActionConnectors;
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.test.ts
new file mode 100644
index 0000000000000..455274006297e
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.test.ts
@@ -0,0 +1,383 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { actionsClientMock } from '@kbn/actions-plugin/server/actions_client.mock';
+import {
+  getImportRulesSchemaMock,
+  webHookConnector,
+} from '../../../../../../../common/detection_engine/rule_management/model/import/rule_to_import.mock';
+import { importRuleActionConnectors } from './import_rule_action_connectors';
+import { coreMock } from '@kbn/core/server/mocks';
+
+const rules = [
+  {
+    ...getImportRulesSchemaMock(),
+    actions: [
+      {
+        group: 'default',
+        id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+        action_type_id: '.webhook',
+        params: {},
+      },
+    ],
+  },
+];
+const rulesWithoutActions = [
+  {
+    ...getImportRulesSchemaMock(),
+    actions: [],
+  },
+];
+const actionConnectors = [webHookConnector];
+const actionsClient = actionsClientMock.create();
+actionsClient.getAll.mockResolvedValue([]);
+const core = coreMock.createRequestHandlerContext();
+
+describe('checkRuleExceptionReferences', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+  it('should show an error message when the user has a Read Actions permission and stops the importing ', async () => {
+    const newCore = coreMock.createRequestHandlerContext();
+    const error = {
+      output: { payload: { message: 'Unable to bulk_create action' }, statusCode: 403 },
+    };
+    newCore.savedObjects.getImporter = jest.fn().mockReturnValueOnce({
+      import: jest.fn().mockImplementation(() => {
+        throw error;
+      }),
+    });
+    const actionsImporter2 = newCore.savedObjects.getImporter;
+
+    const res = await importRuleActionConnectors({
+      actionConnectors,
+      actionsClient,
+      actionsImporter: actionsImporter2() as never,
+      rules,
+      overwrite: false,
+    });
+
+    expect(res).toEqual({
+      success: false,
+      successCount: 0,
+      errors: [
+        {
+          error: {
+            message:
+              'You may not have actions privileges required to import rules with actions: Unable to bulk_create action',
+            status_code: 403,
+          },
+          rule_id: '(unknown id)',
+        },
+      ],
+      warnings: [],
+    });
+  });
+
+  it('should return import 1 connector successfully', async () => {
+    core.savedObjects.getImporter = jest.fn().mockReturnValueOnce({
+      import: jest.fn().mockResolvedValue({
+        success: true,
+        successCount: 1,
+        successResults: [],
+        errors: [],
+        warnings: [],
+      }),
+    });
+    const actionsImporter = core.savedObjects.getImporter;
+
+    const res = await importRuleActionConnectors({
+      actionConnectors,
+      actionsClient,
+      actionsImporter: actionsImporter() as never,
+      rules,
+      overwrite: false,
+    });
+
+    expect(res).toEqual({
+      success: true,
+      successCount: 1,
+      successResults: [],
+      errors: [],
+      warnings: [],
+    });
+  });
+  it('should return import 1 connector successfully only if id is duplicated', async () => {
+    core.savedObjects.getImporter = jest.fn().mockReturnValueOnce({
+      import: jest.fn().mockResolvedValue({
+        success: true,
+        successCount: 1,
+        successResults: [],
+        errors: [],
+        warnings: [],
+      }),
+    });
+    const actionsImporter = core.savedObjects.getImporter;
+
+    const ruleWith2Connectors = [
+      {
+        ...getImportRulesSchemaMock(),
+        actions: [
+          {
+            group: 'default',
+            id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+            params: {
+              message: 'Rule {{context.rule.name}} generated {{state.signals_count}} alerts',
+            },
+            action_type_id: '.slack',
+          },
+          {
+            group: 'default',
+            id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+            params: {
+              message: 'Rule {{context.rule.name}} generated {{state.signals_count}} alerts',
+            },
+            action_type_id: '.slack',
+          },
+        ],
+      },
+    ];
+    const res = await importRuleActionConnectors({
+      actionConnectors,
+      actionsClient,
+      actionsImporter: actionsImporter() as never,
+      rules: ruleWith2Connectors,
+      overwrite: false,
+    });
+
+    expect(res).toEqual({
+      success: true,
+      successCount: 1,
+      successResults: [],
+      errors: [],
+      warnings: [],
+    });
+  });
+
+  it('should show an error message when the user has an old imported rule with a missing connector data', async () => {
+    const actionsImporter = core.savedObjects.getImporter;
+
+    const res = await importRuleActionConnectors({
+      actionConnectors: [],
+      actionsClient,
+      actionsImporter: actionsImporter() as never,
+      rules,
+      overwrite: false,
+    });
+
+    expect(res).toEqual({
+      success: false,
+      successCount: 0,
+      errors: [
+        {
+          error: {
+            message:
+              '1 connector is missing. Connector id missing is: cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+            status_code: 404,
+          },
+          rule_id: 'rule-1',
+        },
+      ],
+      warnings: [],
+    });
+  });
+  it('should show an error message when the user has an old imported rule with a 2 missing connectors data', async () => {
+    const actionsImporter = core.savedObjects.getImporter;
+
+    const res = await importRuleActionConnectors({
+      actionConnectors: [],
+      actionsClient,
+      actionsImporter: actionsImporter() as never,
+      rules: [
+        {
+          ...getImportRulesSchemaMock(),
+          actions: [
+            {
+              group: 'default',
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+              action_type_id: '.webhook',
+              params: {},
+            },
+            {
+              group: 'default',
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf2',
+              action_type_id: '.webhook',
+              params: {},
+            },
+          ],
+        },
+      ],
+      overwrite: false,
+    });
+
+    expect(res).toEqual({
+      success: false,
+      successCount: 0,
+      errors: [
+        {
+          error: {
+            message:
+              '2 connectors are missing. Connector ids missing are: cabc78e0-9031-11ed-b076-53cc4d57aaf1, cabc78e0-9031-11ed-b076-53cc4d57aaf2',
+            status_code: 404,
+          },
+          rule_id: 'rule-1',
+        },
+      ],
+      warnings: [],
+    });
+  });
+  it('should show an error message when the user has 2 imported rules with a 2 missing connectors data', async () => {
+    const actionsImporter = core.savedObjects.getImporter;
+
+    const res = await importRuleActionConnectors({
+      actionConnectors: [],
+      actionsClient,
+      actionsImporter: actionsImporter() as never,
+      rules: [
+        {
+          ...getImportRulesSchemaMock(),
+          actions: [
+            {
+              group: 'default',
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+              action_type_id: '.webhook',
+              params: {},
+            },
+          ],
+        },
+        {
+          ...getImportRulesSchemaMock('rule-2'),
+          actions: [
+            {
+              group: 'default',
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf2',
+              action_type_id: '.webhook',
+              params: {},
+            },
+          ],
+        },
+      ],
+      overwrite: false,
+    });
+
+    expect(res).toEqual({
+      success: false,
+      successCount: 0,
+      errors: [
+        {
+          error: {
+            message:
+              '2 connectors are missing. Connector ids missing are: cabc78e0-9031-11ed-b076-53cc4d57aaf1, cabc78e0-9031-11ed-b076-53cc4d57aaf2',
+            status_code: 404,
+          },
+          rule_id: 'rule-1,rule-2',
+        },
+      ],
+      warnings: [],
+    });
+  });
+
+  it('should skip importing the action-connectors if the actions array is empty, even if the user has exported-connectors in the file', async () => {
+    core.savedObjects.getImporter = jest.fn().mockReturnValue({
+      import: jest.fn().mockResolvedValue({
+        success: true,
+        successCount: 2,
+        successResults: [],
+        errors: [],
+        warnings: [],
+      }),
+    });
+    const actionsImporter2 = core.savedObjects.getImporter;
+    const actionsImporter2Import = actionsImporter2().import;
+
+    const res = await importRuleActionConnectors({
+      actionConnectors,
+      actionsClient,
+      actionsImporter: actionsImporter2Import as never,
+      rules: rulesWithoutActions,
+      overwrite: false,
+    });
+
+    expect(res).toEqual({
+      success: true,
+      successCount: 0,
+      errors: [],
+      warnings: [],
+    });
+    expect(actionsImporter2Import).not.toBeCalled();
+  });
+
+  it('should skip importing the action-connectors if all connectors have been imported/created before', async () => {
+    actionsClient.getAll.mockResolvedValue([
+      {
+        actionTypeId: '.webhook',
+        name: 'webhook',
+        isPreconfigured: true,
+        id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+        referencedByCount: 1,
+        isDeprecated: false,
+      },
+    ]);
+    const actionsImporter2 = core.savedObjects.getImporter;
+    const actionsImporter2Import = actionsImporter2().import;
+
+    const res = await importRuleActionConnectors({
+      actionConnectors,
+      actionsClient,
+      actionsImporter: actionsImporter2Import as never,
+      rules,
+      overwrite: false,
+    });
+
+    expect(res).toEqual({
+      success: true,
+      successCount: 0,
+      errors: [],
+      warnings: [],
+    });
+    expect(actionsImporter2Import).not.toBeCalled();
+  });
+
+  it('should not skip importing the action-connectors if all connectors have been imported/created before when overwrite is true', async () => {
+    core.savedObjects.getImporter = jest.fn().mockReturnValueOnce({
+      import: jest.fn().mockResolvedValue({
+        success: true,
+        successCount: 1,
+        successResults: [],
+        errors: [],
+        warnings: [],
+      }),
+    });
+    const actionsImporter = core.savedObjects.getImporter;
+
+    actionsClient.getAll.mockResolvedValue([
+      {
+        actionTypeId: '.webhook',
+        name: 'webhook',
+        isPreconfigured: true,
+        id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+        referencedByCount: 1,
+        isDeprecated: false,
+      },
+    ]);
+
+    const res = await importRuleActionConnectors({
+      actionConnectors,
+      actionsClient,
+      actionsImporter: actionsImporter() as never,
+      rules,
+      overwrite: true,
+    });
+
+    expect(res).toEqual({
+      success: true,
+      successCount: 1,
+      errors: [],
+      warnings: [],
+      successResults: [],
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.ts
new file mode 100644
index 0000000000000..3d2fc9fb7c6b6
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.ts
@@ -0,0 +1,84 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { Readable } from 'stream';
+
+import type { SavedObjectsImportResponse } from '@kbn/core-saved-objects-common';
+import type { SavedObject } from '@kbn/core-saved-objects-server';
+
+import type { WarningSchema } from '../../../../../../../common/detection_engine/schemas/response';
+import {
+  checkIfActionsHaveMissingConnectors,
+  filterExistingActionConnectors,
+  getActionConnectorRules,
+  handleActionsHaveNoConnectors,
+  mapSOErrorToRuleError,
+  returnErroredImportResult,
+} from './utils';
+import type { ImportRuleActionConnectorsParams, ImportRuleActionConnectorsResult } from './types';
+
+export const importRuleActionConnectors = async ({
+  actionConnectors,
+  actionsClient,
+  actionsImporter,
+  rules,
+  overwrite,
+}: ImportRuleActionConnectorsParams): Promise<ImportRuleActionConnectorsResult> => {
+  try {
+    const actionConnectorRules = getActionConnectorRules(rules);
+    const actionsIds: string[] = Object.keys(actionConnectorRules);
+
+    if (!actionsIds.length)
+      return {
+        success: true,
+        errors: [],
+        successCount: 0,
+        warnings: [],
+      };
+
+    if (overwrite && !actionConnectors.length)
+      return handleActionsHaveNoConnectors(actionsIds, actionConnectorRules);
+
+    let actionConnectorsToImport: SavedObject[] = actionConnectors;
+
+    if (!overwrite) {
+      const newIdsToAdd = await filterExistingActionConnectors(actionsClient, actionsIds);
+
+      const foundMissingConnectors = checkIfActionsHaveMissingConnectors(
+        actionConnectors,
+        newIdsToAdd,
+        actionConnectorRules
+      );
+      if (foundMissingConnectors) return foundMissingConnectors;
+      // filter out existing connectors
+      actionConnectorsToImport = actionConnectors.filter(({ id }) => newIdsToAdd.includes(id));
+    }
+    if (!actionConnectorsToImport.length)
+      return {
+        success: true,
+        errors: [],
+        successCount: 0,
+        warnings: [],
+      };
+
+    const readStream = Readable.from(actionConnectorsToImport);
+    const { success, successCount, successResults, warnings, errors }: SavedObjectsImportResponse =
+      await actionsImporter.import({
+        readStream,
+        overwrite,
+        createNewCopies: false,
+      });
+    return {
+      success,
+      successCount,
+      successResults,
+      errors: errors ? mapSOErrorToRuleError(errors) : [],
+      warnings: (warnings as WarningSchema[]) || [],
+    };
+  } catch (error) {
+    return returnErroredImportResult(error);
+  }
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/types.ts
new file mode 100644
index 0000000000000..8ba6c41c42dde
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/types.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { ISavedObjectsImporter, SavedObject } from '@kbn/core-saved-objects-server';
+import type { ActionsClient } from '@kbn/actions-plugin/server';
+import type {
+  SavedObjectsImportFailure,
+  SavedObjectsImportSuccess,
+} from '@kbn/core-saved-objects-common';
+import type { RuleToImport } from '../../../../../../../common/detection_engine/rule_management';
+import type { WarningSchema } from '../../../../../../../common/detection_engine/schemas/response';
+import type { BulkError } from '../../../../routes/utils';
+
+export interface ImportRuleActionConnectorsResult {
+  success: boolean;
+  successCount: number;
+  successResults?: SavedObjectsImportSuccess[];
+  errors: BulkError[] | [];
+  warnings: WarningSchema[] | [];
+}
+
+export interface ImportRuleActionConnectorsParams {
+  actionConnectors: SavedObject[];
+  actionsClient: ActionsClient;
+  actionsImporter: ISavedObjectsImporter;
+  rules: Array<RuleToImport | Error>;
+  overwrite: boolean;
+}
+
+export interface SOError {
+  output: { statusCode: number; payload: { message: string } };
+}
+
+export interface ConflictError {
+  type: string;
+}
+
+export type ErrorType = SOError | ConflictError | SavedObjectsImportFailure | Error;
+export interface ActionRules {
+  [actionsIds: string]: string[];
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/utils/index.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/utils/index.ts
new file mode 100644
index 0000000000000..6d9b3b9da9e6d
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/utils/index.ts
@@ -0,0 +1,129 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { pick } from 'lodash';
+import type { SavedObjectsImportFailure } from '@kbn/core-saved-objects-common';
+import type { SavedObject } from '@kbn/core-saved-objects-server';
+import type { ActionsClient } from '@kbn/actions-plugin/server';
+import type { BulkError } from '../../../../../routes/utils';
+import { createBulkErrorObject } from '../../../../../routes/utils';
+import type { RuleToImport } from '../../../../../../../../common/detection_engine/rule_management';
+import type {
+  ActionRules,
+  ConflictError,
+  ErrorType,
+  ImportRuleActionConnectorsResult,
+  SOError,
+} from '../types';
+
+export const returnErroredImportResult = (error: ErrorType): ImportRuleActionConnectorsResult => ({
+  success: false,
+  errors: [handleActionConnectorsErrors(error)],
+  successCount: 0,
+  warnings: [],
+});
+
+export const handleActionsHaveNoConnectors = (
+  actionsIds: string[],
+  actionConnectorRules: ActionRules
+): ImportRuleActionConnectorsResult => {
+  const ruleIds: string = [...new Set(Object.values(actionConnectorRules).flat())].join();
+
+  if (actionsIds && actionsIds.length) {
+    const errors: BulkError[] = [];
+    const errorMessage =
+      actionsIds.length > 1
+        ? 'connectors are missing. Connector ids missing are:'
+        : 'connector is missing. Connector id missing is:';
+    errors.push(
+      createBulkErrorObject({
+        statusCode: 404,
+        message: `${actionsIds.length} ${errorMessage} ${actionsIds.join(', ')}`,
+        ruleId: ruleIds,
+      })
+    );
+    return {
+      success: false,
+      errors,
+      successCount: 0,
+      warnings: [],
+    };
+  }
+  return {
+    success: true,
+    errors: [],
+    successCount: 0,
+    warnings: [],
+  };
+};
+
+export const handleActionConnectorsErrors = (error: ErrorType, id?: string): BulkError => {
+  let statusCode: number | null = null;
+  let message: string = '';
+  if ('output' in error) {
+    statusCode = (error as SOError).output.statusCode;
+    message = (error as SOError).output.payload?.message;
+  }
+  switch (statusCode) {
+    case null:
+      return createBulkErrorObject({
+        statusCode: 500,
+        message:
+          (error as ConflictError)?.type === 'conflict'
+            ? 'There is a conflict'
+            : (error as Error).message
+            ? (error as Error).message
+            : '',
+      });
+
+    case 403:
+      return createBulkErrorObject({
+        id,
+        statusCode,
+        message: `You may not have actions privileges required to import rules with actions: ${message}`,
+      });
+
+    default:
+      return createBulkErrorObject({
+        id,
+        statusCode,
+        message,
+      });
+  }
+};
+
+export const mapSOErrorToRuleError = (errors: SavedObjectsImportFailure[]): BulkError[] => {
+  return errors.map(({ id, error }) => handleActionConnectorsErrors(error, id));
+};
+
+export const filterExistingActionConnectors = async (
+  actionsClient: ActionsClient,
+  actionsIds: string[]
+) => {
+  const storedConnectors = await actionsClient.getAll();
+  const storedActionIds: string[] = storedConnectors.map(({ id }) => id);
+  return actionsIds.filter((id) => !storedActionIds.includes(id));
+};
+export const getActionConnectorRules = (rules: Array<RuleToImport | Error>) =>
+  rules.reduce((acc: { [actionsIds: string]: string[] }, rule) => {
+    if (rule instanceof Error) return acc;
+    rule.actions?.forEach(({ id }) => (acc[id] = [...(acc[id] || []), rule.rule_id]));
+    return acc;
+  }, {});
+export const checkIfActionsHaveMissingConnectors = (
+  actionConnectors: SavedObject[],
+  newIdsToAdd: string[],
+  actionConnectorRules: ActionRules
+) => {
+  // if new action-connectors don't have exported connectors will fail with missing connectors
+  if (actionConnectors.length < newIdsToAdd.length) {
+    const actionConnectorsIds = actionConnectors.map(({ id }) => id);
+    const missingActionConnector = newIdsToAdd.filter((id) => !actionConnectorsIds.includes(id));
+    const missingActionRules = pick(actionConnectorRules, [...missingActionConnector]);
+    return handleActionsHaveNoConnectors(missingActionConnector, missingActionRules);
+  }
+  return null;
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.ts
index e325496225d9f..4414b6063c473 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.ts
@@ -24,6 +24,7 @@ import type {
   ImportExceptionsListSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 
+import type { SavedObject } from '@kbn/core-saved-objects-server';
 import {
   RuleToImport,
   validateRuleToImport,
@@ -41,7 +42,9 @@ export const validateRulesStream = (): Transform => {
   return createMapStream<{
     exceptions: Array<ImportExceptionsListSchema | ImportExceptionListItemSchema | Error>;
     rules: Array<RuleToImport | Error>;
+    actionConnectors: SavedObject[];
   }>((items) => ({
+    actionConnectors: items.actionConnectors,
     exceptions: items.exceptions,
     rules: validateRules(items.rules),
   }));
@@ -80,10 +83,14 @@ export const sortImports = (): Transform => {
   return createReduceStream<{
     exceptions: Array<ImportExceptionsListSchema | ImportExceptionListItemSchema | Error>;
     rules: Array<RuleToImport | Error>;
+    actionConnectors: SavedObject[];
   }>(
     (acc, importItem) => {
       if (has('list_id', importItem) || has('item_id', importItem) || has('entries', importItem)) {
         return { ...acc, exceptions: [...acc.exceptions, importItem] };
+      }
+      if (has('attributes', importItem)) {
+        return { ...acc, actionConnectors: [...acc.actionConnectors, importItem] };
       } else {
         return { ...acc, rules: [...acc.rules, importItem] };
       }
@@ -91,6 +98,7 @@ export const sortImports = (): Transform => {
     {
       exceptions: [],
       rules: [],
+      actionConnectors: [],
     }
   );
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.ts
index 694bc916fefe3..5a8d6f9a34e87 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { SavedObjectsClientContract } from '@kbn/core/server';
+import type { SavedObject, SavedObjectsClientContract } from '@kbn/core/server';
 import type {
   ImportExceptionsListSchema,
   ImportExceptionListItemSchema,
@@ -31,6 +31,7 @@ export type PromiseFromStreams = RuleToImport | Error;
 export interface RuleExceptionsPromiseFromStreams {
   rules: PromiseFromStreams[];
   exceptions: Array<ImportExceptionsListSchema | ImportExceptionListItemSchema>;
+  actionConnectors: SavedObject[];
 }
 
 /**
@@ -60,6 +61,7 @@ export const importRules = async ({
   exceptionsClient,
   spaceId,
   existingLists,
+  allowMissingConnectorSecrets,
 }: {
   ruleChunks: PromiseFromStreams[][];
   rulesResponseAcc: ImportRuleResponse[];
@@ -70,6 +72,7 @@ export const importRules = async ({
   exceptionsClient: ExceptionListClient | undefined;
   spaceId: string;
   existingLists: Record<string, ExceptionListSchema>;
+  allowMissingConnectorSecrets?: boolean;
 }) => {
   let importRuleResponse: ImportRuleResponse[] = [...rulesResponseAcc];
 
@@ -118,6 +121,7 @@ export const importRules = async ({
                       ...parsedRule,
                       exceptions_list: [...exceptions],
                     },
+                    allowMissingConnectorSecrets,
                   });
                   resolve({
                     rule_id: parsedRule.rule_id,
@@ -136,6 +140,7 @@ export const importRules = async ({
                       ...parsedRule,
                       exceptions_list: [...exceptions],
                     },
+                    allowMissingConnectorSecrets,
                   });
                   resolve({
                     rule_id: parsedRule.rule_id,
diff --git a/x-pack/plugins/security_solution/tsconfig.json b/x-pack/plugins/security_solution/tsconfig.json
index 4522a35f793ec..531fd7c0a6f38 100644
--- a/x-pack/plugins/security_solution/tsconfig.json
+++ b/x-pack/plugins/security_solution/tsconfig.json
@@ -133,6 +133,8 @@
     "@kbn/cypress-config",
     "@kbn/controls-plugin",
     "@kbn/shared-ux-utility",
+    "@kbn/core-saved-objects-common",
+    "@kbn/core-saved-objects-import-export-server-mocks",
     "@kbn/user-profile-components",
     "@kbn/guided-onboarding",
     "@kbn/securitysolution-ecs",
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/export_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/export_rules.ts
index 833b9ccb9ee1f..2d1ddd342a549 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/export_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/export_rules.ts
@@ -87,6 +87,11 @@ export default ({ getService }: FtrProviderContext): void => {
           missing_exception_lists_count: 0,
           missing_rules: [],
           missing_rules_count: 0,
+          excluded_action_connection_count: 0,
+          excluded_action_connections: [],
+          exported_action_connector_count: 0,
+          missing_action_connection_count: 0,
+          missing_action_connections: [],
         });
       });
 
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
index d32e93b481547..2630174529b75 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
@@ -73,6 +73,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -147,6 +151,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -170,6 +178,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -227,6 +239,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -245,6 +261,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -277,6 +297,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -301,6 +325,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -365,6 +393,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -404,6 +436,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group1/export_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group1/export_rules.ts
index b30e16681d488..60af78ec6cff9 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group1/export_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group1/export_rules.ts
@@ -88,6 +88,11 @@ export default ({ getService }: FtrProviderContext): void => {
           missing_exception_lists_count: 0,
           missing_rules: [],
           missing_rules_count: 0,
+          excluded_action_connection_count: 0,
+          excluded_action_connections: [],
+          exported_action_connector_count: 0,
+          missing_action_connection_count: 0,
+          missing_action_connections: [],
         });
       });
 
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_rules.ts
index 48c4408e8555e..169fe074604fa 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_rules.ts
@@ -135,9 +135,14 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
-      it('should successfully import rules with actions when user has "read" actions privileges', async () => {
+
+      it('should not import rules with actions when user has "read" actions privileges', async () => {
         // create a new action
         const { body: hookAction } = await supertest
           .post('/api/actions/action')
@@ -149,27 +154,71 @@ export default ({ getService }: FtrProviderContext): void => {
           actions: [
             {
               group: 'default',
-              id: hookAction.id,
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
               action_type_id: hookAction.actionTypeId,
               params: {},
             },
           ],
         };
+        const ruleWithConnector = {
+          id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf1',
+          type: 'action',
+          updated_at: '2023-01-25T14:35:52.852Z',
+          created_at: '2023-01-25T14:35:52.852Z',
+          version: 'WzUxNTksMV0=',
+          attributes: {
+            actionTypeId: '.webhook',
+            name: 'webhook',
+            isMissingSecrets: true,
+            config: {},
+            secrets: {},
+          },
+          references: [],
+          migrationVersion: { action: '8.3.0' },
+          coreMigrationVersion: '8.7.0',
+        };
+
         const { body } = await supertestWithoutAuth
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .auth(ROLES.hunter, 'changeme')
           .set('kbn-xsrf', 'true')
-          .attach('file', ruleToNdjson(simpleRule), 'rules.ndjson')
+          .attach(
+            'file',
+            Buffer.from(toNdJsonString([simpleRule, ruleWithConnector])),
+            'rules.ndjson'
+          )
           .expect(200);
 
         expect(body).to.eql({
-          errors: [],
-          success: true,
-          success_count: 1,
+          errors: [
+            {
+              error: {
+                message:
+                  'You may not have actions privileges required to import rules with actions: Unable to bulk_create action',
+                status_code: 403,
+              },
+              rule_id: '(unknown id)',
+            },
+          ],
+          success: false,
+          success_count: 0,
           rules_count: 1,
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: false,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [
+            {
+              error: {
+                message:
+                  'You may not have actions privileges required to import rules with actions: Unable to bulk_create action',
+                status_code: 403,
+              },
+              rule_id: '(unknown id)',
+            },
+          ],
+          action_connectors_warnings: [],
         });
       });
       it('should not import rules with actions when a user has no actions privileges', async () => {
@@ -184,17 +233,39 @@ export default ({ getService }: FtrProviderContext): void => {
           actions: [
             {
               group: 'default',
-              id: hookAction.id,
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57axy1',
               action_type_id: hookAction.actionTypeId,
               params: {},
             },
           ],
         };
+        const ruleWithConnector = {
+          id: 'cabc78e0-9031-11ed-b076-53cc4d57axy1',
+          type: 'action',
+          updated_at: '2023-01-25T14:35:52.852Z',
+          created_at: '2023-01-25T14:35:52.852Z',
+          version: 'WzUxNTksMV0=',
+          attributes: {
+            actionTypeId: '.webhook',
+            name: 'webhook',
+            isMissingSecrets: true,
+            config: {},
+            secrets: {},
+          },
+          references: [],
+          migrationVersion: { action: '8.3.0' },
+          coreMigrationVersion: '8.7.0',
+        };
+
         const { body } = await supertestWithoutAuth
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .auth(ROLES.hunter_no_actions, 'changeme')
           .set('kbn-xsrf', 'true')
-          .attach('file', ruleToNdjson(simpleRule), 'rules.ndjson')
+          .attach(
+            'file',
+            Buffer.from(toNdJsonString([simpleRule, ruleWithConnector])),
+            'rules.ndjson'
+          )
           .expect(200);
         expect(body).to.eql({
           success: false,
@@ -208,18 +279,24 @@ export default ({ getService }: FtrProviderContext): void => {
               },
               rule_id: '(unknown id)',
             },
-            {
-              error: {
-                message: `1 connector is missing. Connector id missing is: ${hookAction.id}`,
-                status_code: 404,
-              },
-              rule_id: 'rule-1',
-            },
           ],
           rules_count: 1,
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: false,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [
+            {
+              error: {
+                message:
+                  'You may not have actions privileges required to import rules with actions: Unauthorized to get actions',
+                status_code: 403,
+              },
+              rule_id: '(unknown id)',
+            },
+          ],
+          action_connectors_warnings: [],
         });
       });
     });
@@ -367,6 +444,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -404,6 +485,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -430,6 +515,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -448,6 +537,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -480,6 +573,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -504,6 +601,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -568,6 +669,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -607,6 +712,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -688,6 +797,78 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: false,
+          action_connectors_success_count: 0,
+          action_connectors_warnings: [],
+          action_connectors_errors: [
+            {
+              rule_id: 'rule-1',
+              error: {
+                status_code: 404,
+                message: '1 connector is missing. Connector id missing is: 123',
+              },
+            },
+          ],
+        });
+      });
+      it('should give single connector warning back if we have a single connector missing secret', async () => {
+        const simpleRule: ReturnType<typeof getSimpleRule> = {
+          ...getSimpleRule('rule-1'),
+          actions: [
+            {
+              group: 'default',
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf9',
+              action_type_id: '.webhook',
+              params: {},
+            },
+          ],
+        };
+        const ruleWithConnector = {
+          id: 'cabc78e0-9031-11ed-b076-53cc4d57aaf9',
+          type: 'action',
+          updated_at: '2023-01-25T14:35:52.852Z',
+          created_at: '2023-01-25T14:35:52.852Z',
+          version: 'WzUxNTksMV0=',
+          attributes: {
+            actionTypeId: '.webhook',
+            name: 'webhook',
+            isMissingSecrets: true,
+            config: {},
+            secrets: {},
+          },
+          references: [],
+          migrationVersion: { action: '8.3.0' },
+          coreMigrationVersion: '8.7.0',
+        };
+        const { body } = await supertest
+          .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
+          .set('kbn-xsrf', 'true')
+          .attach(
+            'file',
+            Buffer.from(toNdJsonString([simpleRule, ruleWithConnector])),
+            'rules.ndjson'
+          )
+          .expect(200);
+
+        expect(body).to.eql({
+          success: true,
+          success_count: 1,
+          rules_count: 1,
+          errors: [],
+          exceptions_errors: [],
+          exceptions_success: true,
+          exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 1,
+          action_connectors_warnings: [
+            {
+              actionPath: '/app/management/insightsAndAlerting/triggersActionsConnectors',
+              buttonLabel: 'Go to connectors',
+              message: '1 connector has sensitive information that require updates.',
+              type: 'action_required',
+            },
+          ],
+          action_connectors_errors: [],
         });
       });
 
@@ -709,6 +890,7 @@ export default ({ getService }: FtrProviderContext): void => {
             },
           ],
         };
+
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
           .set('kbn-xsrf', 'true')
@@ -722,10 +904,14 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
-      it('should be able to import 2 rules with action connectors that exist', async () => {
+      it('should be able to import 2 rules with action connectors', async () => {
         // create a new action
         const { body: hookAction } = await supertest
           .post('/api/actions/action')
@@ -738,7 +924,7 @@ export default ({ getService }: FtrProviderContext): void => {
           actions: [
             {
               group: 'default',
-              id: hookAction.id,
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57abc6',
               action_type_id: hookAction.actionTypeId,
               params: {},
             },
@@ -750,18 +936,57 @@ export default ({ getService }: FtrProviderContext): void => {
           actions: [
             {
               group: 'default',
-              id: hookAction.id,
-              action_type_id: hookAction.actionTypeId,
+              id: 'f4e74ab0-9e59-11ed-a3db-f9134a9ce951',
+              action_type_id: '.index',
               params: {},
             },
           ],
         };
+
+        const connector1 = {
+          id: 'cabc78e0-9031-11ed-b076-53cc4d57abc6',
+          type: 'action',
+          updated_at: '2023-01-25T14:35:52.852Z',
+          created_at: '2023-01-25T14:35:52.852Z',
+          version: 'WzUxNTksMV0=',
+          attributes: {
+            actionTypeId: '.webhook',
+            name: 'webhook',
+            isMissingSecrets: false,
+            config: {},
+            secrets: {},
+          },
+          references: [],
+          migrationVersion: { action: '8.3.0' },
+          coreMigrationVersion: '8.7.0',
+        };
+        const connector2 = {
+          id: 'f4e74ab0-9e59-11ed-a3db-f9134a9ce951',
+          type: 'action',
+          updated_at: '2023-01-25T14:35:52.852Z',
+          created_at: '2023-01-25T14:35:52.852Z',
+          version: 'WzUxNTksMV0=',
+          attributes: {
+            actionTypeId: '.index',
+            name: 'index',
+            isMissingSecrets: false,
+            config: {},
+            secrets: {},
+          },
+          references: [],
+          migrationVersion: { action: '8.3.0' },
+          coreMigrationVersion: '8.7.0',
+        };
         const rule1String = JSON.stringify(rule1);
         const rule2String = JSON.stringify(rule2);
-        const buffer = Buffer.from(`${rule1String}\n${rule2String}\n`);
+        const connector12String = JSON.stringify(connector1);
+        const connector22String = JSON.stringify(connector2);
+        const buffer = Buffer.from(
+          `${rule1String}\n${rule2String}\n${connector12String}\n${connector22String}\n`
+        );
 
         const { body } = await supertest
-          .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
+          .post(`${DETECTION_ENGINE_RULES_URL}/_import?overwrite=true`)
           .set('kbn-xsrf', 'true')
           .attach('file', buffer, 'rules.ndjson')
           .expect(200);
@@ -774,6 +999,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 2,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -790,7 +1019,7 @@ export default ({ getService }: FtrProviderContext): void => {
           actions: [
             {
               group: 'default',
-              id: hookAction.id,
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aayo',
               action_type_id: hookAction.actionTypeId,
               params: {},
             },
@@ -802,15 +1031,36 @@ export default ({ getService }: FtrProviderContext): void => {
           actions: [
             {
               group: 'default',
-              id: '123', // <-- This does not exist
-              action_type_id: hookAction.actionTypeId,
+              id: 'cabc78e0-9031-11ed-b076-53cc4d57aa22', // <-- This does not exist
+              action_type_id: '.index',
               params: {},
             },
           ],
         };
+
+        const connector = {
+          id: 'cabc78e0-9031-11ed-b076-53cc4d57aayo',
+          type: 'action',
+          updated_at: '2023-01-25T14:35:52.852Z',
+          created_at: '2023-01-25T14:35:52.852Z',
+          version: 'WzUxNTksMV0=',
+          attributes: {
+            actionTypeId: '.webhook',
+            name: 'webhook',
+            isMissingSecrets: false,
+            config: {},
+            secrets: {},
+          },
+          references: [],
+          migrationVersion: { action: '8.3.0' },
+          coreMigrationVersion: '8.7.0',
+        };
+
         const rule1String = JSON.stringify(rule1);
         const rule2String = JSON.stringify(rule2);
-        const buffer = Buffer.from(`${rule1String}\n${rule2String}\n`);
+        const connector2String = JSON.stringify(connector);
+
+        const buffer = Buffer.from(`${rule1String}\n${rule2String}\n${connector2String}\n`);
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
@@ -820,20 +1070,34 @@ export default ({ getService }: FtrProviderContext): void => {
 
         expect(body).to.eql({
           success: false,
-          success_count: 1,
+          success_count: 0,
           rules_count: 2,
           errors: [
             {
               rule_id: 'rule-2',
               error: {
                 status_code: 404,
-                message: '1 connector is missing. Connector id missing is: 123',
+                message:
+                  '1 connector is missing. Connector id missing is: cabc78e0-9031-11ed-b076-53cc4d57aa22',
               },
             },
           ],
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: false,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [
+            {
+              error: {
+                status_code: 404,
+                message:
+                  '1 connector is missing. Connector id missing is: cabc78e0-9031-11ed-b076-53cc4d57aa22',
+              },
+              rule_id: 'rule-2',
+            },
+          ],
+          action_connectors_warnings: [],
         });
       });
 
@@ -974,6 +1238,10 @@ export default ({ getService }: FtrProviderContext): void => {
             exceptions_errors: [],
             exceptions_success: true,
             exceptions_success_count: 1,
+            action_connectors_success: true,
+            action_connectors_success_count: 0,
+            action_connectors_errors: [],
+            action_connectors_warnings: [],
           });
         });
 
@@ -1045,6 +1313,10 @@ export default ({ getService }: FtrProviderContext): void => {
             exceptions_errors: [],
             exceptions_success: true,
             exceptions_success_count: 0,
+            action_connectors_success: true,
+            action_connectors_success_count: 0,
+            action_connectors_errors: [],
+            action_connectors_warnings: [],
           });
         });
 
@@ -1144,6 +1416,10 @@ export default ({ getService }: FtrProviderContext): void => {
             exceptions_errors: [],
             exceptions_success: true,
             exceptions_success_count: 1,
+            action_connectors_success: true,
+            action_connectors_success_count: 0,
+            action_connectors_errors: [],
+            action_connectors_warnings: [],
           });
         });
 
@@ -1274,6 +1550,10 @@ export default ({ getService }: FtrProviderContext): void => {
             exceptions_errors: [],
             exceptions_success: true,
             exceptions_success_count: 1,
+            action_connectors_success: true,
+            action_connectors_success_count: 0,
+            action_connectors_errors: [],
+            action_connectors_warnings: [],
           });
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/perform_bulk_action.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/perform_bulk_action.ts
index 06e55fdfdda1b..13f1f99fc3b23 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/perform_bulk_action.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/perform_bulk_action.ts
@@ -106,6 +106,100 @@ export default ({ getService }: FtrProviderContext): void => {
         missing_exception_lists_count: 0,
         missing_rules: [],
         missing_rules_count: 0,
+        excluded_action_connection_count: 0,
+        excluded_action_connections: [],
+        exported_action_connector_count: 0,
+        missing_action_connection_count: 0,
+        missing_action_connections: [],
+      });
+    });
+    it('should export rules with actions connectors', async () => {
+      // create new actions
+      const webHookAction = await createWebHookConnector();
+
+      const defaultRuleAction = {
+        id: webHookAction.id,
+        action_type_id: '.webhook',
+        group: 'default',
+        params: {
+          body: '{"test":"a default action"}',
+        },
+      };
+
+      const ruleId = 'rule-1';
+      await createRule(supertest, log, {
+        ...getSimpleRule(ruleId),
+        actions: [defaultRuleAction],
+      });
+      const exportedConnectors = {
+        attributes: {
+          actionTypeId: '.webhook',
+          config: {
+            hasAuth: true,
+            method: 'post',
+            url: 'http://localhost',
+          },
+          isMissingSecrets: true,
+          name: 'Some connector',
+          secrets: {},
+        },
+        coreMigrationVersion: '8.7.0',
+        id: webHookAction.id,
+        migrationVersion: {
+          action: '8.3.0',
+        },
+        references: [],
+        type: 'action',
+      };
+
+      const { body } = await postBulkAction()
+        .send({ query: '', action: BulkActionType.export })
+        .expect(200)
+        .expect('Content-Type', 'application/ndjson')
+        .expect('Content-Disposition', 'attachment; filename="rules_export.ndjson"')
+        .parse(binaryToString);
+
+      const [ruleJson, connectorsJson, exportDetailsJson] = body.toString().split(/\n/);
+
+      const rule = removeServerGeneratedProperties(JSON.parse(ruleJson));
+      expect(rule).to.eql({
+        ...getSimpleRuleOutput(),
+        throttle: 'rule',
+        actions: [
+          {
+            action_type_id: '.webhook',
+            group: 'default',
+            id: webHookAction.id,
+            params: {
+              body: '{"test":"a default action"}',
+            },
+          },
+        ],
+      });
+      const { attributes, id, type } = JSON.parse(connectorsJson);
+      expect(attributes.actionTypeId).to.eql(exportedConnectors.attributes.actionTypeId);
+      expect(id).to.eql(exportedConnectors.id);
+      expect(type).to.eql(exportedConnectors.type);
+      expect(attributes.name).to.eql(exportedConnectors.attributes.name);
+      expect(attributes.secrets).to.eql(exportedConnectors.attributes.secrets);
+      expect(attributes.isMissingSecrets).to.eql(exportedConnectors.attributes.isMissingSecrets);
+      const exportDetails = JSON.parse(exportDetailsJson);
+      expect(exportDetails).to.eql({
+        exported_exception_list_count: 0,
+        exported_exception_list_item_count: 0,
+        exported_count: 2,
+        exported_rules_count: 1,
+        missing_exception_list_item_count: 0,
+        missing_exception_list_items: [],
+        missing_exception_lists: [],
+        missing_exception_lists_count: 0,
+        missing_rules: [],
+        missing_rules_count: 0,
+        excluded_action_connection_count: 0,
+        excluded_action_connections: [],
+        exported_action_connector_count: 1,
+        missing_action_connection_count: 0,
+        missing_action_connections: [],
       });
     });
 
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
index 3ff748fa5259d..135bf49c15ff9 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
@@ -133,6 +133,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
       it('should successfully import rules with actions when user has "read" actions privileges', async () => {
@@ -168,6 +172,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
       it('should not import rules with actions when a user has no actions privileges', async () => {
@@ -202,7 +210,7 @@ export default ({ getService }: FtrProviderContext): void => {
             {
               error: {
                 message:
-                  'You may not have actions privileges required to import rules with actions: Unauthorized to get actions',
+                  'You may not have actions privileges required to import rules with actions: Unable to bulk_create action',
                 status_code: 403,
               },
               rule_id: '(unknown id)',
@@ -218,6 +226,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
     });
@@ -268,6 +280,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -305,6 +321,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -331,6 +351,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -349,6 +373,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -381,6 +409,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -405,6 +437,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -469,6 +505,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -508,6 +548,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -589,6 +633,18 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [
+            {
+              rule_id: 'rule-1',
+              error: {
+                status_code: 404,
+                message: '1 connector is missing. Connector id missing is: 123',
+              },
+            },
+          ],
+          action_connectors_warnings: [],
         });
       });
 
@@ -623,6 +679,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -675,6 +735,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -735,6 +799,10 @@ export default ({ getService }: FtrProviderContext): void => {
           exceptions_errors: [],
           exceptions_success: true,
           exceptions_success_count: 0,
+          action_connectors_success: true,
+          action_connectors_success_count: 0,
+          action_connectors_errors: [],
+          action_connectors_warnings: [],
         });
       });
 
@@ -875,6 +943,10 @@ export default ({ getService }: FtrProviderContext): void => {
             exceptions_errors: [],
             exceptions_success: true,
             exceptions_success_count: 1,
+            action_connectors_success: true,
+            action_connectors_success_count: 0,
+            action_connectors_errors: [],
+            action_connectors_warnings: [],
           });
         });
 
@@ -946,6 +1018,10 @@ export default ({ getService }: FtrProviderContext): void => {
             exceptions_errors: [],
             exceptions_success: true,
             exceptions_success_count: 0,
+            action_connectors_success: true,
+            action_connectors_success_count: 0,
+            action_connectors_errors: [],
+            action_connectors_warnings: [],
           });
         });
 
@@ -1045,6 +1121,10 @@ export default ({ getService }: FtrProviderContext): void => {
             exceptions_errors: [],
             exceptions_success: true,
             exceptions_success_count: 1,
+            action_connectors_success: true,
+            action_connectors_success_count: 0,
+            action_connectors_errors: [],
+            action_connectors_warnings: [],
           });
         });
 
@@ -1175,6 +1255,10 @@ export default ({ getService }: FtrProviderContext): void => {
             exceptions_errors: [],
             exceptions_success: true,
             exceptions_success_count: 1,
+            action_connectors_success: true,
+            action_connectors_success_count: 0,
+            action_connectors_errors: [],
+            action_connectors_warnings: [],
           });
         });
       });

From 7ee34928adbd7e6f063d0aa7c4d3d4fb5dc856b9 Mon Sep 17 00:00:00 2001
From: "Quynh Nguyen (Quinn)" <43350163+qn895@users.noreply.github.com>
Date: Mon, 6 Feb 2023 12:11:11 -0600
Subject: [PATCH 004/134] [ML] Fix saved search filters not behaving correctly
 for complex filters (#149459)

## Summary

Addresses https://github.com/elastic/kibana/issues/147705 and fix an
issue with ML filter bar in Data Visualizer and AIOps pape not
supporting complex filters correctly in 8.7. Changes include:
- Using the `getSavedSearch` utility to get the `selectedSavedSearch`
instead of the SavedSearchSimpleObj (which we previously manually parsed
the json search source).
- This requires some additional page dependency to be injected.
- Rename `currentSavedSearch` to `deprecatedSavedSearchObj` for clarity.
Note that not all deprecatedSavedSearchObj has been replaced with the
new `selectedSavedSearch`. Areas that still use the
deprecatedSavedSearchObj:
   - AD job creator

Potential todos:
- Support for loading the saved time range & refresh interval upon
restoring the saved search
- Support for AggregateQuery (currently, we only support lucene and
kuery query types) #150091

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../public/application/utils/search_utils.ts  |  45 +++--
 .../change_point_detetion_root.tsx            |   5 +-
 .../explain_log_rate_spikes_app_state.tsx     |   8 +-
 .../explain_log_rate_spikes_page.tsx          |  12 +-
 .../log_categorization_app_state.tsx          |   3 +-
 .../log_categorization_page.tsx               |  16 +-
 x-pack/plugins/aiops/public/hooks/use_data.ts |  27 ++-
 .../aiops/public/hooks/use_data_source.ts     |   5 +-
 x-pack/plugins/data_visualizer/kibana.json    |   3 +-
 .../common/util/field_types_utils.ts          |   2 +-
 .../index_data_visualizer_view.tsx            |  11 +-
 .../components/search_panel/search_panel.tsx  |   2 +-
 .../grid_embeddable/grid_embeddable.tsx       |   8 +-
 .../hooks/use_data_visualizer_grid_data.ts    |   4 +-
 .../index_data_visualizer.tsx                 |  42 ++--
 .../utils/saved_search_utils.test.ts          | 183 +++++++++++++++---
 .../utils/saved_search_utils.ts               |  66 ++++---
 x-pack/plugins/data_visualizer/tsconfig.json  |   1 +
 x-pack/plugins/ml/kibana.json                 |   1 +
 .../aiops/change_point_detection.tsx          |   2 +-
 .../aiops/explain_log_rate_spikes.tsx         |   2 +-
 .../application/aiops/log_categorization.tsx  |   2 +-
 x-pack/plugins/ml/public/application/app.tsx  |   4 +
 .../data_recognizer/data_recognizer.d.ts      |   4 +-
 .../ml/__mocks__/kibana_context_value.ts      |   8 +-
 .../contexts/ml/__mocks__/saved_search.ts     |   2 +-
 .../application/contexts/ml/ml_context.ts     |   5 +-
 .../contexts/ml/use_current_saved_search.ts   |  20 --
 .../application/contexts/ml/use_ml_context.ts |   5 +-
 .../configuration_step_form.tsx               |   8 +-
 .../configuration_step/use_saved_search.ts    |  11 +-
 .../jobs/new_job/pages/job_type/page.tsx      |  31 ++-
 .../jobs/new_job/pages/new_job/page.tsx       |   4 +-
 .../new_job/pages/new_job/wizard_steps.tsx    |   6 +-
 .../jobs/new_job/recognize/page.tsx           |  29 ++-
 .../ml/public/application/routing/router.tsx  |   6 +
 .../routing/routes/access_denied.tsx          |   9 +-
 .../routes/aiops/change_point_detection.tsx   |  15 +-
 .../routes/aiops/explain_log_rate_spikes.tsx  |  20 +-
 .../routes/aiops/log_categorization.tsx       |  18 +-
 .../analytics_job_creation.tsx                |  17 +-
 .../analytics_job_exploration.tsx             |   1 +
 .../analytics_jobs_list.tsx                   |   1 +
 .../data_frame_analytics/analytics_map.tsx    |   1 +
 .../analytics_source_selection.tsx            |   1 +
 .../routes/datavisualizer/datavisualizer.tsx  |  17 +-
 .../routes/datavisualizer/file_based.tsx      |  19 +-
 .../routes/datavisualizer/index_based.tsx     |  18 +-
 .../application/routing/routes/explorer.tsx   |   1 +
 .../application/routing/routes/jobs_list.tsx  |   1 +
 .../routing/routes/new_job/from_lens.tsx      |  13 +-
 .../routing/routes/new_job/from_map.tsx       |  15 +-
 .../routes/new_job/index_or_search.tsx        |   1 +
 .../routing/routes/new_job/job_type.tsx       |   1 +
 .../routing/routes/new_job/recognize.tsx      |   4 +-
 .../routing/routes/new_job/wizard.tsx         |   1 +
 .../routing/routes/notifications.tsx          |  20 +-
 .../application/routing/routes/overview.tsx   |  20 +-
 .../routing/routes/settings/calendar_list.tsx |  18 +-
 .../routes/settings/calendar_new_edit.tsx     |  18 +-
 .../routing/routes/settings/filter_list.tsx   |  18 +-
 .../routes/settings/filter_list_new_edit.tsx  |  18 +-
 .../routing/routes/settings/settings.tsx      |  18 +-
 .../routing/routes/timeseriesexplorer.tsx     |   1 +
 .../routes/trained_models/models_list.tsx     |   1 +
 .../routes/trained_models/nodes_list.tsx      |   1 +
 .../application/routing/use_resolver.test.ts  |  23 ++-
 .../application/routing/use_resolver.ts       |  27 ++-
 x-pack/plugins/ml/tsconfig.json               |   1 +
 69 files changed, 629 insertions(+), 322 deletions(-)
 delete mode 100644 x-pack/plugins/ml/public/application/contexts/ml/use_current_saved_search.ts

diff --git a/x-pack/plugins/aiops/public/application/utils/search_utils.ts b/x-pack/plugins/aiops/public/application/utils/search_utils.ts
index 3bd0ea7a96523..f8f570d475fc0 100644
--- a/x-pack/plugins/aiops/public/application/utils/search_utils.ts
+++ b/x-pack/plugins/aiops/public/application/utils/search_utils.ts
@@ -11,8 +11,8 @@
 import { cloneDeep } from 'lodash';
 import { IUiSettingsClient } from '@kbn/core/public';
 import { getEsQueryConfig, SearchSource } from '@kbn/data-plugin/common';
-import { SavedSearch } from '@kbn/discover-plugin/public';
-import { FilterManager } from '@kbn/data-plugin/public';
+import type { SavedSearch } from '@kbn/discover-plugin/public';
+import { FilterManager, isQuery, mapAndFlattenFilters } from '@kbn/data-plugin/public';
 import {
   fromKueryExpression,
   toElasticsearchQuery,
@@ -20,6 +20,7 @@ import {
   buildEsQuery,
   Query,
   Filter,
+  AggregateQuery,
 } from '@kbn/es-query';
 import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { DataView } from '@kbn/data-views-plugin/public';
@@ -88,14 +89,15 @@ export function getQueryFromSavedSearchObject(savedSearch: SavedSearchSavedObjec
  * Should also form a valid query if only the query or filters is provided
  */
 export function createMergedEsQuery(
-  query?: Query,
+  query?: Query | AggregateQuery,
   filters?: Filter[],
   dataView?: DataView,
   uiSettings?: IUiSettingsClient
 ) {
   let combinedQuery: QueryDslQueryContainer = getDefaultQuery();
 
-  if (query && query.language === SEARCH_QUERY_LANGUAGE.KUERY) {
+  // FIXME: Add support for AggregateQuery type #150091
+  if (isQuery(query) && query.language === SEARCH_QUERY_LANGUAGE.KUERY) {
     const ast = fromKueryExpression(query.query);
     if (query.query !== '') {
       combinedQuery = toElasticsearchQuery(ast, dataView);
@@ -127,6 +129,14 @@ export function createMergedEsQuery(
   return combinedQuery;
 }
 
+function getSavedSearchSource(savedSearch: SavedSearch) {
+  return savedSearch &&
+    'searchSource' in savedSearch &&
+    savedSearch?.searchSource instanceof SearchSource
+    ? savedSearch.searchSource
+    : undefined;
+}
+
 /**
  * Extract query data from the saved search object
  * with overrides from the provided query data and/or filters
@@ -141,7 +151,7 @@ export function getEsQueryFromSavedSearch({
 }: {
   dataView: DataView;
   uiSettings: IUiSettingsClient;
-  savedSearch: SavedSearchSavedObject | SavedSearch | null | undefined;
+  savedSearch: SavedSearch | null | undefined;
   query?: Query;
   filters?: Filter[];
   filterManager?: FilterManager;
@@ -151,17 +161,13 @@ export function getEsQueryFromSavedSearch({
   const userQuery = query;
   const userFilters = filters;
 
+  const savedSearchSource = getSavedSearchSource(savedSearch);
+
   // If saved search has a search source with nested parent
   // e.g. a search coming from Dashboard saved search embeddable
   // which already combines both the saved search's original query/filters and the Dashboard's
   // then no need to process any further
-  if (
-    savedSearch &&
-    'searchSource' in savedSearch &&
-    savedSearch?.searchSource instanceof SearchSource &&
-    savedSearch.searchSource.getParent() !== undefined &&
-    userQuery
-  ) {
+  if (savedSearchSource && savedSearchSource.getParent() !== undefined && userQuery) {
     // Flattened query from search source may contain a clause that narrows the time range
     // which might interfere with global time pickers so we need to remove
     const savedQuery =
@@ -181,12 +187,8 @@ export function getEsQueryFromSavedSearch({
     };
   }
 
-  // If saved search is an json object with the original query and filter
-  // retrieve the parsed query and filter
-  const savedSearchData = getQueryFromSavedSearchObject(savedSearch);
-
   // If no saved search available, use user's query and filters
-  if (!savedSearchData && userQuery) {
+  if (!savedSearch && userQuery) {
     if (filterManager && userFilters) filterManager.addFilters(userFilters);
 
     const combinedQuery = createMergedEsQuery(
@@ -205,11 +207,12 @@ export function getEsQueryFromSavedSearch({
 
   // If saved search available, merge saved search with the latest user query or filters
   // which might differ from extracted saved search data
-  if (savedSearchData) {
+  if (savedSearchSource) {
     const globalFilters = filterManager?.getGlobalFilters();
-    const currentQuery = userQuery ?? savedSearchData?.query;
-    const currentFilters = userFilters ?? savedSearchData?.filter;
-
+    // FIXME: Add support for AggregateQuery type #150091
+    const currentQuery = userQuery ?? (savedSearchSource.getField('query') as Query);
+    const currentFilters =
+      userFilters ?? mapAndFlattenFilters(savedSearchSource.getField('filter') as Filter[]);
     if (filterManager) filterManager.setFilters(currentFilters);
     if (globalFilters) filterManager?.addFilters(globalFilters);
 
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detetion_root.tsx b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detetion_root.tsx
index fb9dbc5156ed4..d2d275f0b2251 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detetion_root.tsx
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detetion_root.tsx
@@ -11,7 +11,7 @@ import { pick } from 'lodash';
 import { EuiSpacer } from '@elastic/eui';
 
 import { DataView } from '@kbn/data-views-plugin/common';
-import { SavedSearch } from '@kbn/saved-search-plugin/public';
+import type { SavedSearch } from '@kbn/saved-search-plugin/public';
 import { StorageContextProvider } from '@kbn/ml-local-storage';
 import { UrlStateProvider } from '@kbn/ml-url-state';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
@@ -20,7 +20,6 @@ import { UI_SETTINGS } from '@kbn/data-plugin/common';
 import { toMountPoint, wrapWithTheme } from '@kbn/kibana-react-plugin/public';
 
 import { DataSourceContext } from '../../hooks/use_data_source';
-import { SavedSearchSavedObject } from '../../application/utils/search_utils';
 import { AiopsAppContext, AiopsAppDependencies } from '../../hooks/use_aiops_app_context';
 import { AIOPS_STORAGE_KEYS } from '../../types/storage';
 
@@ -33,7 +32,7 @@ const localStorage = new Storage(window.localStorage);
 
 export interface ChangePointDetectionAppStateProps {
   dataView: DataView;
-  savedSearch: SavedSearch | SavedSearchSavedObject | null;
+  savedSearch: SavedSearch | null;
   appDependencies: AiopsAppDependencies;
 }
 
diff --git a/x-pack/plugins/aiops/public/components/explain_log_rate_spikes/explain_log_rate_spikes_app_state.tsx b/x-pack/plugins/aiops/public/components/explain_log_rate_spikes/explain_log_rate_spikes_app_state.tsx
index ae67c55d87f05..f43b60d7daffa 100644
--- a/x-pack/plugins/aiops/public/components/explain_log_rate_spikes/explain_log_rate_spikes_app_state.tsx
+++ b/x-pack/plugins/aiops/public/components/explain_log_rate_spikes/explain_log_rate_spikes_app_state.tsx
@@ -21,11 +21,7 @@ import { DatePickerContextProvider } from '@kbn/ml-date-picker';
 import { UI_SETTINGS } from '@kbn/data-plugin/common';
 import { toMountPoint, wrapWithTheme } from '@kbn/kibana-react-plugin/public';
 
-import {
-  SEARCH_QUERY_LANGUAGE,
-  SearchQueryLanguage,
-  SavedSearchSavedObject,
-} from '../../application/utils/search_utils';
+import { SEARCH_QUERY_LANGUAGE, SearchQueryLanguage } from '../../application/utils/search_utils';
 import type { AiopsAppDependencies } from '../../hooks/use_aiops_app_context';
 import { AiopsAppContext } from '../../hooks/use_aiops_app_context';
 import { DataSourceContext } from '../../hooks/use_data_source';
@@ -41,7 +37,7 @@ export interface ExplainLogRateSpikesAppStateProps {
   /** The data view to analyze. */
   dataView: DataView;
   /** The saved search to analyze. */
-  savedSearch: SavedSearch | SavedSearchSavedObject | null;
+  savedSearch: SavedSearch | null;
   /** App dependencies */
   appDependencies: AiopsAppDependencies;
 }
diff --git a/x-pack/plugins/aiops/public/components/explain_log_rate_spikes/explain_log_rate_spikes_page.tsx b/x-pack/plugins/aiops/public/components/explain_log_rate_spikes/explain_log_rate_spikes_page.tsx
index 8f4504070cc08..6c277456d2ec3 100644
--- a/x-pack/plugins/aiops/public/components/explain_log_rate_spikes/explain_log_rate_spikes_page.tsx
+++ b/x-pack/plugins/aiops/public/components/explain_log_rate_spikes/explain_log_rate_spikes_page.tsx
@@ -67,11 +67,11 @@ export const ExplainLogRateSpikesPage: FC = () => {
   );
   const [globalState, setGlobalState] = useUrlState('_g');
 
-  const [currentSavedSearch, setCurrentSavedSearch] = useState(savedSearch);
+  const [selectedSavedSearch, setSelectedSavedSearch] = useState(savedSearch);
 
   useEffect(() => {
     if (savedSearch) {
-      setCurrentSavedSearch(savedSearch);
+      setSelectedSavedSearch(savedSearch);
     }
   }, [savedSearch]);
 
@@ -84,8 +84,8 @@ export const ExplainLogRateSpikesPage: FC = () => {
     }) => {
       // When the user loads a saved search and then clears or modifies the query
       // we should remove the saved search and replace it with the index pattern id
-      if (currentSavedSearch !== null) {
-        setCurrentSavedSearch(null);
+      if (selectedSavedSearch !== null) {
+        setSelectedSavedSearch(null);
       }
 
       setAiopsListState({
@@ -96,7 +96,7 @@ export const ExplainLogRateSpikesPage: FC = () => {
         filters: searchParams.filters,
       });
     },
-    [currentSavedSearch, aiopsListState, setAiopsListState]
+    [selectedSavedSearch, aiopsListState, setAiopsListState]
   );
 
   const {
@@ -108,7 +108,7 @@ export const ExplainLogRateSpikesPage: FC = () => {
     searchString,
     searchQuery,
   } = useData(
-    { currentDataView: dataView, currentSavedSearch },
+    { selectedDataView: dataView, selectedSavedSearch },
     aiopsListState,
     setGlobalState,
     currentSelectedChangePoint,
diff --git a/x-pack/plugins/aiops/public/components/log_categorization/log_categorization_app_state.tsx b/x-pack/plugins/aiops/public/components/log_categorization/log_categorization_app_state.tsx
index 235aa1a518403..b554013393926 100644
--- a/x-pack/plugins/aiops/public/components/log_categorization/log_categorization_app_state.tsx
+++ b/x-pack/plugins/aiops/public/components/log_categorization/log_categorization_app_state.tsx
@@ -17,7 +17,6 @@ import { UI_SETTINGS } from '@kbn/data-plugin/common';
 import { toMountPoint, wrapWithTheme } from '@kbn/kibana-react-plugin/public';
 
 import { DataSourceContext } from '../../hooks/use_data_source';
-import { SavedSearchSavedObject } from '../../application/utils/search_utils';
 import type { AiopsAppDependencies } from '../../hooks/use_aiops_app_context';
 import { AIOPS_STORAGE_KEYS } from '../../types/storage';
 import { AiopsAppContext } from '../../hooks/use_aiops_app_context';
@@ -28,7 +27,7 @@ const localStorage = new Storage(window.localStorage);
 
 export interface LogCategorizationAppStateProps {
   dataView: DataView;
-  savedSearch: SavedSearch | SavedSearchSavedObject | null;
+  savedSearch: SavedSearch | null;
   appDependencies: AiopsAppDependencies;
 }
 
diff --git a/x-pack/plugins/aiops/public/components/log_categorization/log_categorization_page.tsx b/x-pack/plugins/aiops/public/components/log_categorization/log_categorization_page.tsx
index ab66a75754e63..feb6ef9c9b31c 100644
--- a/x-pack/plugins/aiops/public/components/log_categorization/log_categorization_page.tsx
+++ b/x-pack/plugins/aiops/public/components/log_categorization/log_categorization_page.tsx
@@ -52,13 +52,19 @@ export const LogCategorizationPage: FC = () => {
   const [selectedField, setSelectedField] = useState<string | undefined>();
   const [selectedCategory, setSelectedCategory] = useState<Category | null>(null);
   const [categories, setCategories] = useState<Category[] | null>(null);
-  const [currentSavedSearch, setCurrentSavedSearch] = useState(savedSearch);
+  const [selectedSavedSearch, setSelectedDataView] = useState(savedSearch);
   const [loading, setLoading] = useState(false);
   const [totalCount, setTotalCount] = useState(0);
   const [eventRate, setEventRate] = useState<EventRate>([]);
   const [pinnedCategory, setPinnedCategory] = useState<Category | null>(null);
   const [sparkLines, setSparkLines] = useState<SparkLinesPerCategory>({});
 
+  useEffect(() => {
+    if (savedSearch) {
+      setSelectedDataView(savedSearch);
+    }
+  }, [savedSearch]);
+
   useEffect(
     function cancelRequestOnLeave() {
       return () => {
@@ -77,8 +83,8 @@ export const LogCategorizationPage: FC = () => {
     }) => {
       // When the user loads saved search and then clear or modify the query
       // we should remove the saved search and replace it with the index pattern id
-      if (currentSavedSearch !== null) {
-        setCurrentSavedSearch(null);
+      if (selectedSavedSearch !== null) {
+        setSelectedDataView(null);
       }
 
       setAiopsListState({
@@ -89,7 +95,7 @@ export const LogCategorizationPage: FC = () => {
         filters: searchParams.filters,
       });
     },
-    [currentSavedSearch, aiopsListState, setAiopsListState]
+    [selectedSavedSearch, aiopsListState, setAiopsListState]
   );
 
   const {
@@ -102,7 +108,7 @@ export const LogCategorizationPage: FC = () => {
     searchQuery,
     intervalMs,
   } = useData(
-    { currentDataView: dataView, currentSavedSearch },
+    { selectedDataView: dataView, selectedSavedSearch },
     aiopsListState,
     setGlobalState,
     undefined,
diff --git a/x-pack/plugins/aiops/public/hooks/use_data.ts b/x-pack/plugins/aiops/public/hooks/use_data.ts
index 3cace69ed4e98..ff04b27b44e3c 100644
--- a/x-pack/plugins/aiops/public/hooks/use_data.ts
+++ b/x-pack/plugins/aiops/public/hooks/use_data.ts
@@ -16,10 +16,7 @@ import { mlTimefilterRefresh$, useTimefilter } from '@kbn/ml-date-picker';
 
 import type { DocumentStatsSearchStrategyParams } from '../get_document_stats';
 import type { AiOpsIndexBasedAppState } from '../components/explain_log_rate_spikes/explain_log_rate_spikes_app_state';
-import {
-  getEsQueryFromSavedSearch,
-  SavedSearchSavedObject,
-} from '../application/utils/search_utils';
+import { getEsQueryFromSavedSearch } from '../application/utils/search_utils';
 import type { GroupTableItem } from '../components/spike_analysis_table/types';
 
 import { useTimeBuckets } from './use_time_buckets';
@@ -31,9 +28,9 @@ const DEFAULT_BAR_TARGET = 75;
 
 export const useData = (
   {
-    currentDataView,
-    currentSavedSearch,
-  }: { currentDataView: DataView; currentSavedSearch: SavedSearch | SavedSearchSavedObject | null },
+    selectedDataView,
+    selectedSavedSearch,
+  }: { selectedDataView: DataView; selectedSavedSearch: SavedSearch | null },
   aiopsListState: AiOpsIndexBasedAppState,
   onUpdate: (params: Dictionary<unknown>) => void,
   selectedChangePoint?: ChangePoint,
@@ -55,9 +52,9 @@ export const useData = (
   /** Prepare required params to pass to search strategy **/
   const { searchQueryLanguage, searchString, searchQuery } = useMemo(() => {
     const searchData = getEsQueryFromSavedSearch({
-      dataView: currentDataView,
+      dataView: selectedDataView,
       uiSettings,
-      savedSearch: currentSavedSearch,
+      savedSearch: selectedSavedSearch,
       filterManager,
     });
 
@@ -82,8 +79,8 @@ export const useData = (
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [
-    currentSavedSearch?.id,
-    currentDataView.id,
+    selectedSavedSearch?.id,
+    selectedDataView.id,
     aiopsListState.searchString,
     aiopsListState.searchQueryLanguage,
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -96,7 +93,7 @@ export const useData = (
   const _timeBuckets = useTimeBuckets();
 
   const timefilter = useTimefilter({
-    timeRangeSelector: currentDataView?.timeFieldName !== undefined,
+    timeRangeSelector: selectedDataView?.timeFieldName !== undefined,
     autoRefreshSelector: true,
   });
 
@@ -138,10 +135,10 @@ export const useData = (
         earliest: timefilterActiveBounds.min?.valueOf(),
         latest: timefilterActiveBounds.max?.valueOf(),
         intervalMs: _timeBuckets.getInterval()?.asMilliseconds(),
-        index: currentDataView.getIndexPattern(),
+        index: selectedDataView.getIndexPattern(),
         searchQuery,
-        timeFieldName: currentDataView.timeFieldName,
-        runtimeFieldMap: currentDataView.getRuntimeMappings(),
+        timeFieldName: selectedDataView.timeFieldName,
+        runtimeFieldMap: selectedDataView.getRuntimeMappings(),
       });
       setLastRefresh(Date.now());
     }
diff --git a/x-pack/plugins/aiops/public/hooks/use_data_source.ts b/x-pack/plugins/aiops/public/hooks/use_data_source.ts
index e67aad07a338c..64cf4fe8ec521 100644
--- a/x-pack/plugins/aiops/public/hooks/use_data_source.ts
+++ b/x-pack/plugins/aiops/public/hooks/use_data_source.ts
@@ -7,12 +7,11 @@
 
 import { createContext, useContext } from 'react';
 import { DataView } from '@kbn/data-views-plugin/common';
-import { SavedSearch } from '@kbn/saved-search-plugin/public';
-import { SavedSearchSavedObject } from '../application/utils/search_utils';
+import type { SavedSearch } from '@kbn/saved-search-plugin/public';
 
 export const DataSourceContext = createContext<{
   dataView: DataView | never;
-  savedSearch: SavedSearch | SavedSearchSavedObject | null;
+  savedSearch: SavedSearch | null;
 }>({
   get dataView(): never {
     throw new Error('DataSourceContext is not implemented');
diff --git a/x-pack/plugins/data_visualizer/kibana.json b/x-pack/plugins/data_visualizer/kibana.json
index 98d27ba9f0481..e7a136c1d5c83 100644
--- a/x-pack/plugins/data_visualizer/kibana.json
+++ b/x-pack/plugins/data_visualizer/kibana.json
@@ -32,7 +32,8 @@
     "fieldFormats",
     "uiActions",
     "lens",
-    "cloudChat"
+    "cloudChat",
+    "savedSearch"
   ],
   "owner": {
     "name": "Machine Learning UI",
diff --git a/x-pack/plugins/data_visualizer/public/application/common/util/field_types_utils.ts b/x-pack/plugins/data_visualizer/public/application/common/util/field_types_utils.ts
index fb782a02a08d4..5afa3869abd88 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/util/field_types_utils.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/util/field_types_utils.ts
@@ -8,7 +8,7 @@
 import { i18n } from '@kbn/i18n';
 import { DataViewField } from '@kbn/data-views-plugin/public';
 import { ES_FIELD_TYPES, KBN_FIELD_TYPES } from '@kbn/field-types';
-import { SupportedFieldType } from '../../../../common/types';
+import type { SupportedFieldType } from '../../../../common/types';
 import { SUPPORTED_FIELD_TYPES } from '../../../../common/constants';
 
 export const getJobTypeLabel = (type: string) => {
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
index 9f969fac23a38..ea72215a89598 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
@@ -36,6 +36,7 @@ import {
 } from '@kbn/ml-date-picker';
 import { useStorage } from '@kbn/ml-local-storage';
 
+import type { SavedSearch } from '@kbn/saved-search-plugin/public';
 import { useCurrentEuiTheme } from '../../../common/hooks/use_current_eui_theme';
 import {
   DV_FROZEN_TIER_PREFERENCE,
@@ -57,7 +58,7 @@ import {
   DataVisualizerIndexBasedPageUrlState,
 } from '../../types/index_data_visualizer_state';
 import { SEARCH_QUERY_LANGUAGE, SearchQueryLanguage } from '../../types/combined_query';
-import { SupportedFieldType, SavedSearchSavedObject } from '../../../../../common/types';
+import type { SupportedFieldType } from '../../../../../common/types';
 import { useDataVisualizerKibana } from '../../../kibana_context';
 import { FieldCountPanel } from '../../../common/components/field_count_panel';
 import { DocumentCountContent } from '../../../common/components/document_count_content';
@@ -129,7 +130,7 @@ export const getDefaultDataVisualizerListState = (
 
 export interface IndexDataVisualizerViewProps {
   currentDataView: DataView;
-  currentSavedSearch: SavedSearchSavedObject | null;
+  currentSavedSearch: SavedSearch | null;
   currentSessionId?: string;
   getAdditionalLinks?: GetAdditionalLinks;
 }
@@ -178,12 +179,6 @@ export const IndexDataVisualizerView: FC<IndexDataVisualizerViewProps> = (dataVi
 
   const { currentDataView, currentSessionId, getAdditionalLinks } = dataVisualizerProps;
 
-  useEffect(() => {
-    if (dataVisualizerProps?.currentSavedSearch !== undefined) {
-      setCurrentSavedSearch(dataVisualizerProps?.currentSavedSearch);
-    }
-  }, [dataVisualizerProps?.currentSavedSearch]);
-
   useEffect(() => {
     if (!currentDataView.isTimeBased()) {
       toasts.addWarning({
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/search_panel/search_panel.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/search_panel/search_panel.tsx
index ac93003d1817e..9aeab958683e7 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/search_panel/search_panel.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/search_panel/search_panel.tsx
@@ -21,7 +21,7 @@ import { DataView, DataViewField } from '@kbn/data-views-plugin/public';
 import { isDefined } from '@kbn/ml-is-defined';
 import { DataVisualizerFieldNamesFilter } from './field_name_filter';
 import { DataVisualizerFieldTypeFilter } from './field_type_filter';
-import { SupportedFieldType } from '../../../../../common/types';
+import type { SupportedFieldType } from '../../../../../common/types';
 import { SearchQueryLanguage } from '../../types/combined_query';
 import { useDataVisualizerKibana } from '../../../kibana_context';
 import { createMergedEsQuery } from '../../utils/saved_search_utils';
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable.tsx
index 6534ace2343d8..d9cd0dfbaccfd 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/embeddables/grid_embeddable/grid_embeddable.tsx
@@ -27,8 +27,8 @@ import { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-pl
 import type { Query } from '@kbn/es-query';
 import { DataView, DataViewField } from '@kbn/data-views-plugin/public';
 import { DatePickerContextProvider } from '@kbn/ml-date-picker';
-import { SavedSearch } from '@kbn/discover-plugin/public';
-import { SamplingOption } from '../../../../../common/types/field_stats';
+import type { SavedSearch } from '@kbn/discover-plugin/public';
+import type { SamplingOption } from '../../../../../common/types/field_stats';
 import { DATA_VISUALIZER_GRID_EMBEDDABLE_TYPE } from './constants';
 import { EmbeddableLoading } from './embeddable_loading_fallback';
 import { DataVisualizerStartDependencies } from '../../../../plugin';
@@ -38,7 +38,7 @@ import {
 } from '../../../common/components/stats_table';
 import { FieldVisConfig } from '../../../common/components/stats_table/types';
 import { getDefaultDataVisualizerListState } from '../../components/index_data_visualizer_view/index_data_visualizer_view';
-import type { DataVisualizerTableState, SavedSearchSavedObject } from '../../../../../common/types';
+import type { DataVisualizerTableState } from '../../../../../common/types';
 import type { DataVisualizerIndexBasedAppState } from '../../types/index_data_visualizer_state';
 import { IndexBasedDataVisualizerExpandedRow } from '../../../common/components/expanded_row/index_based_expanded_row';
 import { useDataVisualizerGridData } from '../../hooks/use_data_visualizer_grid_data';
@@ -46,7 +46,7 @@ import { useDataVisualizerGridData } from '../../hooks/use_data_visualizer_grid_
 export type DataVisualizerGridEmbeddableServices = [CoreStart, DataVisualizerStartDependencies];
 export interface DataVisualizerGridInput {
   dataView: DataView;
-  savedSearch?: SavedSearch | SavedSearchSavedObject | null;
+  savedSearch?: SavedSearch | null;
   query?: Query;
   visibleFieldNames?: string[];
   filters?: Filter[];
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts
index 858df7c6366b7..66902ed0fe190 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts
@@ -98,7 +98,7 @@ export const useDataVisualizerGridData = (
   );
 
   /** Prepare required params to pass to search strategy **/
-  const { searchQueryLanguage, searchString, searchQuery } = useMemo(() => {
+  const { searchQueryLanguage, searchString, searchQuery, queryOrAggregateQuery } = useMemo(() => {
     const filterManager = data.query.filterManager;
     const searchData = getEsQueryFromSavedSearch({
       dataView: currentDataView,
@@ -123,6 +123,7 @@ export const useDataVisualizerGridData = (
       };
     } else {
       return {
+        queryOrAggregateQuery: searchData.queryOrAggregateQuery,
         searchQuery: searchData.searchQuery,
         searchString: searchData.searchString,
         searchQueryLanguage: searchData.queryLanguage,
@@ -563,6 +564,7 @@ export const useDataVisualizerGridData = (
     progress: combinedProgress,
     overallStatsProgress,
     configs,
+    queryOrAggregateQuery,
     searchQueryLanguage,
     searchString,
     searchQuery,
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx
index f7c70625f0e65..7633d63286f8e 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx
@@ -11,7 +11,6 @@ import { useHistory, useLocation } from 'react-router-dom';
 import { parse, stringify } from 'query-string';
 import { isEqual } from 'lodash';
 import { encode } from '@kbn/rison';
-import { SimpleSavedObject } from '@kbn/core/public';
 import { i18n } from '@kbn/i18n';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
 import {
@@ -33,14 +32,15 @@ import {
   type Dictionary,
   type SetUrlState,
 } from '@kbn/ml-url-state';
+import { getSavedSearch, type SavedSearch } from '@kbn/saved-search-plugin/public';
 import { getCoreStart, getPluginsStart } from '../../kibana_services';
 import {
-  IndexDataVisualizerViewProps,
+  type IndexDataVisualizerViewProps,
   IndexDataVisualizerView,
 } from './components/index_data_visualizer_view';
 import { useDataVisualizerKibana } from '../kibana_context';
-import { GetAdditionalLinks } from '../common/components/results_links';
-import { DATA_VISUALIZER_APP_LOCATOR, IndexDataVisualizerLocatorParams } from './locator';
+import type { GetAdditionalLinks } from '../common/components/results_links';
+import { DATA_VISUALIZER_APP_LOCATOR, type IndexDataVisualizerLocatorParams } from './locator';
 import { DATA_VISUALIZER_INDEX_VIEWER } from './constants/index_data_visualizer_viewer';
 import { INDEX_DATA_VISUALIZER_NAME } from '../common/constants';
 import { DV_STORAGE_KEYS } from './types/storage';
@@ -100,9 +100,7 @@ export const DataVisualizerStateContextProvider: FC<DataVisualizerStateContextPr
   const { search: urlSearchString } = useLocation();
 
   const [currentDataView, setCurrentDataView] = useState<DataView | undefined>(undefined);
-  const [currentSavedSearch, setCurrentSavedSearch] = useState<SimpleSavedObject<unknown> | null>(
-    null
-  );
+  const [currentSavedSearch, setCurrentSavedSearch] = useState<SavedSearch | null>(null);
 
   const [currentSessionId, setCurrentSessionId] = useState<string | undefined>(undefined);
 
@@ -161,21 +159,21 @@ export const DataVisualizerStateContextProvider: FC<DataVisualizerStateContextPr
       if (typeof parsedQueryString?.savedSearchId === 'string') {
         const savedSearchId = parsedQueryString.savedSearchId;
         try {
-          const savedSearch = await savedObjectsClient.get('search', savedSearchId);
-          const dataViewId = savedSearch.references.find((ref) => ref.type === 'index-pattern')?.id;
-          if (dataViewId !== undefined && savedSearch) {
-            try {
-              const dataView = await dataViews.get(dataViewId);
-              setCurrentSavedSearch(savedSearch);
-              setCurrentDataView(dataView);
-            } catch (e) {
-              toasts.addError(e, {
-                title: i18n.translate('xpack.dataVisualizer.index.dataViewErrorMessage', {
-                  defaultMessage: 'Error finding data view',
-                }),
-              });
-            }
+          const savedSearch = await getSavedSearch(savedSearchId, {
+            search,
+            savedObjectsClient,
+          });
+          const dataView = savedSearch.searchSource.getField('index');
+
+          if (!dataView) {
+            toasts.addDanger({
+              title: i18n.translate('xpack.dataVisualizer.index.dataViewErrorMessage', {
+                defaultMessage: 'Error finding data view',
+              }),
+            });
           }
+          setCurrentSavedSearch(savedSearch);
+          setCurrentDataView(dataView);
         } catch (e) {
           toasts.addError(e, {
             title: i18n.translate('xpack.dataVisualizer.index.savedSearchErrorMessage', {
@@ -192,7 +190,7 @@ export const DataVisualizerStateContextProvider: FC<DataVisualizerStateContextPr
       }
     };
     getDataView();
-  }, [savedObjectsClient, toasts, dataViews, urlSearchString]);
+  }, [savedObjectsClient, toasts, dataViews, urlSearchString, search]);
 
   const setUrlState: SetUrlState = useCallback(
     (
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts
index 4fa100c3fcb92..b872dfb91b00d 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.test.ts
@@ -12,11 +12,14 @@ import {
 } from './saved_search_utils';
 import type { SavedSearchSavedObject } from '../../../../common/types';
 import type { SavedSearch } from '@kbn/discover-plugin/public';
-import type { Filter, FilterStateStore } from '@kbn/es-query';
+import { type Filter, FilterStateStore } from '@kbn/es-query';
 import { stubbedSavedObjectIndexPattern } from '@kbn/data-views-plugin/common/data_view.stub';
 import { DataView } from '@kbn/data-views-plugin/public';
 import { fieldFormatsMock } from '@kbn/field-formats-plugin/common/mocks';
 import { uiSettingsServiceMock } from '@kbn/core/public/mocks';
+import { createSearchSourceMock } from '@kbn/data-plugin/public/mocks';
+import { Query } from '@kbn/es-query';
+import { FilterMetaParams } from '@kbn/es-query/src/filters/build_filters';
 
 // helper function to create data views
 function createMockDataView(id: string) {
@@ -45,6 +48,73 @@ function createMockDataView(id: string) {
 const mockDataView = createMockDataView('test-mock-data-view');
 const mockUiSettings = uiSettingsServiceMock.createStartContract();
 
+const luceneSavedSearch: SavedSearch = {
+  title: 'farequote_filter_and_kuery',
+  description: '',
+  columns: ['_source'],
+  searchSource: createSearchSourceMock({
+    index: mockDataView,
+    query: { query: 'responsetime > 49', language: 'lucene' } as Query,
+    filter: [
+      {
+        meta: {
+          alias: null,
+          disabled: false,
+          negate: false,
+          params: [
+            {
+              meta: {
+                alias: null,
+                disabled: false,
+                field: 'airline',
+                index: 'cb8808e0-9bfb-11ed-bb38-2b1bd55401e7',
+                key: 'airline',
+                negate: false,
+                params: {
+                  query: 'ACA',
+                },
+                type: 'phrase',
+              },
+              query: {
+                match_phrase: {
+                  airline: 'ACA',
+                },
+              },
+            },
+            {
+              meta: {
+                alias: null,
+                disabled: false,
+                field: 'airline',
+                index: 'cb8808e0-9bfb-11ed-bb38-2b1bd55401e7',
+                key: 'airline',
+                negate: false,
+                params: {
+                  query: 'FFT',
+                },
+                type: 'phrase',
+              },
+              query: {
+                match_phrase: {
+                  airline: 'FFT',
+                },
+              },
+            },
+          ] as FilterMetaParams,
+          // @ts-expect-error SavedSearch needs to be updated with CombinedFilterMeta
+          relation: 'OR',
+          type: 'combined',
+          index: 'cb8808e0-9bfb-11ed-bb38-2b1bd55401e7',
+        },
+        query: {},
+        $state: {
+          store: FilterStateStore.APP_STATE,
+        },
+      },
+    ],
+  }),
+} as unknown as SavedSearch;
+
 // @ts-expect-error We don't need the full object here
 const luceneSavedSearchObj: SavedSearchSavedObject = {
   attributes: {
@@ -75,12 +145,27 @@ const kqlSavedSearch: SavedSearch = {
   title: 'farequote_filter_and_kuery',
   description: '',
   columns: ['_source'],
-  // @ts-expect-error this isn't a valid SavedSearch object... but does anyone care?
-  kibanaSavedObjectMeta: {
-    searchSourceJSON:
-      '{"highlightAll":true,"version":true,"query":{"query":"responsetime > 49","language":"kuery"},"filter":[{"meta":{"index":"90a978e0-1c80-11ec-b1d7-f7e5cf21b9e0","negate":false,"disabled":false,"alias":null,"type":"phrase","key":"airline","value":"ASA","params":{"query":"ASA","type":"phrase"}},"query":{"match":{"airline":{"query":"ASA","type":"phrase"}}},"$state":{"store":"appState"}}],"indexRefName":"kibanaSavedObjectMeta.searchSourceJSON.index"}',
-  },
-};
+  searchSource: createSearchSourceMock({
+    index: mockDataView,
+    query: { query: 'responsetime > 49', language: 'kuery' } as Query,
+    filter: [
+      {
+        meta: {
+          index: '90a978e0-1c80-11ec-b1d7-f7e5cf21b9e0',
+          negate: false,
+          disabled: false,
+          alias: null,
+          type: 'phrase',
+          key: 'airline',
+          value: 'ASA',
+          params: { query: 'ASA', type: 'phrase' },
+        },
+        query: { match: { airline: { query: 'ASA', type: 'phrase' } } },
+        $state: { store: FilterStateStore.APP_STATE },
+      },
+    ],
+  }),
+} as unknown as SavedSearch;
 
 describe('getQueryFromSavedSearchObject()', () => {
   it('should return parsed searchSourceJSON with query and filter', () => {
@@ -107,26 +192,24 @@ describe('getQueryFromSavedSearchObject()', () => {
       version: true,
     });
     expect(getQueryFromSavedSearchObject(kqlSavedSearch)).toEqual({
+      query: { query: 'responsetime > 49', language: 'kuery' },
+      index: 'test-mock-data-view',
       filter: [
         {
-          $state: { store: 'appState' },
           meta: {
-            alias: null,
-            disabled: false,
             index: '90a978e0-1c80-11ec-b1d7-f7e5cf21b9e0',
-            key: 'airline',
             negate: false,
-            params: { query: 'ASA', type: 'phrase' },
+            disabled: false,
+            alias: null,
             type: 'phrase',
+            key: 'airline',
             value: 'ASA',
+            params: { query: 'ASA', type: 'phrase' },
           },
           query: { match: { airline: { query: 'ASA', type: 'phrase' } } },
+          $state: { store: 'appState' },
         },
       ],
-      highlightAll: true,
-      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
-      query: { language: 'kuery', query: 'responsetime > 49' },
-      version: true,
     });
   });
   it('should return undefined if invalid searchSourceJSON', () => {
@@ -222,27 +305,55 @@ describe('getEsQueryFromSavedSearch()', () => {
     expect(
       getEsQueryFromSavedSearch({
         dataView: mockDataView,
-        savedSearch: luceneSavedSearchObj,
+        savedSearch: luceneSavedSearch,
         uiSettings: mockUiSettings,
       })
     ).toEqual({
       queryLanguage: 'lucene',
+      queryOrAggregateQuery: {
+        language: 'lucene',
+        query: 'responsetime > 49',
+      },
       searchQuery: {
         bool: {
-          filter: [{ match_phrase: { airline: { query: 'ASA' } } }],
-          must: [{ query_string: { query: 'responsetime:>50' } }],
+          filter: [
+            {
+              bool: {
+                should: [
+                  {
+                    bool: {
+                      must: [],
+                      filter: [{ match_phrase: { airline: 'ACA' } }],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                  {
+                    bool: {
+                      must: [],
+                      filter: [{ match_phrase: { airline: 'FFT' } }],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                ],
+                minimum_should_match: 1,
+              },
+            },
+          ],
+          must: [{ query_string: { query: 'responsetime > 49' } }],
           must_not: [],
           should: [],
         },
       },
-      searchString: 'responsetime:>50',
+      searchString: 'responsetime > 49',
     });
   });
   it('should override original saved search with the provided query ', () => {
     expect(
       getEsQueryFromSavedSearch({
         dataView: mockDataView,
-        savedSearch: luceneSavedSearchObj,
+        savedSearch: luceneSavedSearch,
         uiSettings: mockUiSettings,
         query: {
           query: 'responsetime:>100',
@@ -251,9 +362,34 @@ describe('getEsQueryFromSavedSearch()', () => {
       })
     ).toEqual({
       queryLanguage: 'lucene',
+      queryOrAggregateQuery: { language: 'lucene', query: 'responsetime:>100' },
       searchQuery: {
         bool: {
-          filter: [{ match_phrase: { airline: { query: 'ASA' } } }],
+          filter: [
+            {
+              bool: {
+                should: [
+                  {
+                    bool: {
+                      must: [],
+                      filter: [{ match_phrase: { airline: 'ACA' } }],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                  {
+                    bool: {
+                      must: [],
+                      filter: [{ match_phrase: { airline: 'FFT' } }],
+                      should: [],
+                      must_not: [],
+                    },
+                  },
+                ],
+                minimum_should_match: 1,
+              },
+            },
+          ],
           must: [{ query_string: { query: 'responsetime:>100' } }],
           must_not: [],
           should: [],
@@ -267,7 +403,7 @@ describe('getEsQueryFromSavedSearch()', () => {
     expect(
       getEsQueryFromSavedSearch({
         dataView: mockDataView,
-        savedSearch: luceneSavedSearchObj,
+        savedSearch: luceneSavedSearch,
         uiSettings: mockUiSettings,
         query: {
           query: 'responsetime:>100',
@@ -299,6 +435,7 @@ describe('getEsQueryFromSavedSearch()', () => {
       })
     ).toEqual({
       queryLanguage: 'lucene',
+      queryOrAggregateQuery: { language: 'lucene', query: 'responsetime:>100' },
       searchQuery: {
         bool: {
           filter: [],
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.ts
index a4678c5ec5dec..c3473c170b370 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/utils/saved_search_utils.ts
@@ -16,13 +16,13 @@ import {
   buildEsQuery,
   Query,
   Filter,
+  AggregateQuery,
 } from '@kbn/es-query';
 import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
-import { SearchSource } from '@kbn/data-plugin/common';
 import { DataView } from '@kbn/data-views-plugin/public';
-import { SavedSearch } from '@kbn/discover-plugin/public';
-import { getEsQueryConfig } from '@kbn/data-plugin/common';
-import { FilterManager } from '@kbn/data-plugin/public';
+import type { SavedSearch } from '@kbn/saved-search-plugin/public';
+import { getEsQueryConfig, isQuery, SearchSource } from '@kbn/data-plugin/common';
+import { FilterManager, mapAndFlattenFilters } from '@kbn/data-plugin/public';
 import { SEARCH_QUERY_LANGUAGE, SearchQueryLanguage } from '../types/combined_query';
 import { isSavedSearchSavedObject, SavedSearchSavedObject } from '../../../../common/types';
 
@@ -45,10 +45,12 @@ export function getDefaultQuery() {
  * from a saved search or saved search object
  */
 export function getQueryFromSavedSearchObject(savedSearch: SavedSearchSavedObject | SavedSearch) {
-  const search = isSavedSearchSavedObject(savedSearch)
-    ? savedSearch?.attributes?.kibanaSavedObjectMeta
-    : // @ts-ignore
-      savedSearch?.kibanaSavedObjectMeta;
+  if (!isSavedSearchSavedObject(savedSearch)) {
+    return savedSearch.searchSource.getSerializedFields();
+  }
+  const search =
+    savedSearch?.attributes?.kibanaSavedObjectMeta ?? // @ts-ignore
+    savedSearch?.kibanaSavedObjectMeta;
 
   const parsed =
     typeof search?.searchSourceJSON === 'string'
@@ -75,14 +77,14 @@ export function getQueryFromSavedSearchObject(savedSearch: SavedSearchSavedObjec
  * Should also form a valid query if only the query or filters is provided
  */
 export function createMergedEsQuery(
-  query?: Query,
+  query?: Query | AggregateQuery | undefined,
   filters?: Filter[],
   dataView?: DataView,
   uiSettings?: IUiSettingsClient
 ) {
   let combinedQuery: QueryDslQueryContainer = getDefaultQuery();
 
-  if (query && query.language === SEARCH_QUERY_LANGUAGE.KUERY) {
+  if (isQuery(query) && query.language === SEARCH_QUERY_LANGUAGE.KUERY) {
     const ast = fromKueryExpression(query.query);
     if (query.query !== '') {
       combinedQuery = toElasticsearchQuery(ast, dataView);
@@ -114,6 +116,14 @@ export function createMergedEsQuery(
   return combinedQuery;
 }
 
+function getSavedSearchSource(savedSearch: SavedSearch) {
+  return savedSearch &&
+    'searchSource' in savedSearch &&
+    savedSearch?.searchSource instanceof SearchSource
+    ? savedSearch.searchSource
+    : undefined;
+}
+
 /**
  * Extract query data from the saved search object
  * with overrides from the provided query data and/or filters
@@ -128,7 +138,7 @@ export function getEsQueryFromSavedSearch({
 }: {
   dataView: DataView;
   uiSettings: IUiSettingsClient;
-  savedSearch: SavedSearchSavedObject | SavedSearch | null | undefined;
+  savedSearch: SavedSearch | null | undefined;
   query?: Query;
   filters?: Filter[];
   filterManager?: FilterManager;
@@ -138,17 +148,13 @@ export function getEsQueryFromSavedSearch({
   const userQuery = query;
   const userFilters = filters;
 
+  const savedSearchSource = getSavedSearchSource(savedSearch);
+
   // If saved search has a search source with nested parent
   // e.g. a search coming from Dashboard saved search embeddable
   // which already combines both the saved search's original query/filters and the Dashboard's
   // then no need to process any further
-  if (
-    savedSearch &&
-    'searchSource' in savedSearch &&
-    savedSearch?.searchSource instanceof SearchSource &&
-    savedSearch.searchSource.getParent() !== undefined &&
-    userQuery
-  ) {
+  if (savedSearchSource && savedSearchSource.getParent() !== undefined && userQuery) {
     // Flattened query from search source may contain a clause that narrows the time range
     // which might interfere with global time pickers so we need to remove
     const savedQuery =
@@ -168,13 +174,9 @@ export function getEsQueryFromSavedSearch({
     };
   }
 
-  // If saved search is an json object with the original query and filter
-  // retrieve the parsed query and filter
-  const savedSearchData = getQueryFromSavedSearchObject(savedSearch);
-
   // If no saved search available, use user's query and filters
-  if (!savedSearchData && userQuery) {
-    if (filterManager && userFilters) filterManager.addFilters(userFilters, false);
+  if (!savedSearch && userQuery) {
+    if (filterManager && userFilters) filterManager.addFilters(userFilters);
 
     const combinedQuery = createMergedEsQuery(
       userQuery,
@@ -190,13 +192,14 @@ export function getEsQueryFromSavedSearch({
     };
   }
 
-  // If saved search available, merge saved search with latest user query or filters
+  // If saved search available, merge saved search with the latest user query or filters
   // which might differ from extracted saved search data
-  if (savedSearchData) {
+  if (savedSearchSource) {
     const globalFilters = filterManager?.getGlobalFilters();
-    const currentQuery = userQuery ?? savedSearchData?.query;
-    const currentFilters = userFilters ?? savedSearchData?.filter;
-
+    // FIXME: Add support for AggregateQuery type #150091
+    const currentQuery = userQuery ?? (savedSearchSource.getField('query') as Query);
+    const currentFilters =
+      userFilters ?? mapAndFlattenFilters(savedSearchSource.getField('filter') as Filter[]);
     if (filterManager) filterManager.setFilters(currentFilters);
     if (globalFilters) filterManager?.addFilters(globalFilters);
 
@@ -209,8 +212,9 @@ export function getEsQueryFromSavedSearch({
 
     return {
       searchQuery: combinedQuery,
-      searchString: currentQuery.query,
-      queryLanguage: currentQuery.language as SearchQueryLanguage,
+      searchString: currentQuery?.query ?? '',
+      queryLanguage: (currentQuery?.language as SearchQueryLanguage) ?? 'kuery',
+      queryOrAggregateQuery: currentQuery,
     };
   }
 }
diff --git a/x-pack/plugins/data_visualizer/tsconfig.json b/x-pack/plugins/data_visualizer/tsconfig.json
index fd61172e31587..7472c3910f7fe 100644
--- a/x-pack/plugins/data_visualizer/tsconfig.json
+++ b/x-pack/plugins/data_visualizer/tsconfig.json
@@ -56,6 +56,7 @@
     "@kbn/ml-date-picker",
     "@kbn/ml-is-defined",
     "@kbn/ml-query-utils",
+    "@kbn/saved-search-plugin",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/ml/kibana.json b/x-pack/plugins/ml/kibana.json
index b794f3ba39a03..bf734f14afe1d 100644
--- a/x-pack/plugins/ml/kibana.json
+++ b/x-pack/plugins/ml/kibana.json
@@ -50,6 +50,7 @@
     "lens",
     "maps",
     "savedObjects",
+    "savedSearch",
     "usageCollection",
     "unifiedFieldList",
     "unifiedSearch"
diff --git a/x-pack/plugins/ml/public/application/aiops/change_point_detection.tsx b/x-pack/plugins/ml/public/application/aiops/change_point_detection.tsx
index 3ee53940add2b..b3d3a537b9be1 100644
--- a/x-pack/plugins/ml/public/application/aiops/change_point_detection.tsx
+++ b/x-pack/plugins/ml/public/application/aiops/change_point_detection.tsx
@@ -25,7 +25,7 @@ export const ChangePointDetectionPage: FC = () => {
 
   const context = useMlContext();
   const dataView = context.currentDataView;
-  const savedSearch = context.currentSavedSearch;
+  const savedSearch = context.selectedSavedSearch;
 
   return (
     <>
diff --git a/x-pack/plugins/ml/public/application/aiops/explain_log_rate_spikes.tsx b/x-pack/plugins/ml/public/application/aiops/explain_log_rate_spikes.tsx
index c7abf7385c3b0..031297c55929a 100644
--- a/x-pack/plugins/ml/public/application/aiops/explain_log_rate_spikes.tsx
+++ b/x-pack/plugins/ml/public/application/aiops/explain_log_rate_spikes.tsx
@@ -25,7 +25,7 @@ export const ExplainLogRateSpikesPage: FC = () => {
 
   const context = useMlContext();
   const dataView = context.currentDataView;
-  const savedSearch = context.currentSavedSearch;
+  const savedSearch = context.selectedSavedSearch;
 
   return (
     <>
diff --git a/x-pack/plugins/ml/public/application/aiops/log_categorization.tsx b/x-pack/plugins/ml/public/application/aiops/log_categorization.tsx
index a78a1e3815be8..cdc0c079d541c 100644
--- a/x-pack/plugins/ml/public/application/aiops/log_categorization.tsx
+++ b/x-pack/plugins/ml/public/application/aiops/log_categorization.tsx
@@ -25,7 +25,7 @@ export const LogCategorizationPage: FC = () => {
 
   const context = useMlContext();
   const dataView = context.currentDataView;
-  const savedSearch = context.currentSavedSearch;
+  const savedSearch = context.selectedSavedSearch;
 
   return (
     <>
diff --git a/x-pack/plugins/ml/public/application/app.tsx b/x-pack/plugins/ml/public/application/app.tsx
index d10eb2c8e63ec..5e5099937c7e1 100644
--- a/x-pack/plugins/ml/public/application/app.tsx
+++ b/x-pack/plugins/ml/public/application/app.tsx
@@ -78,6 +78,10 @@ const App: FC<AppProps> = ({ coreStart, deps, appMountParams }) => {
     config: coreStart.uiSettings!,
     setBreadcrumbs: coreStart.chrome!.setBreadcrumbs,
     redirectToMlAccessDeniedPage,
+    getSavedSearchDeps: {
+      search: deps.data.search,
+      savedObjectsClient: coreStart.savedObjects.client,
+    },
   };
 
   const services = {
diff --git a/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts b/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts
index a2ce2dcea2273..8cd013732b726 100644
--- a/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts
+++ b/x-pack/plugins/ml/public/application/components/data_recognizer/data_recognizer.d.ts
@@ -7,11 +7,11 @@
 
 import { FC } from 'react';
 import type { DataView } from '@kbn/data-views-plugin/public';
-import { SavedSearchSavedObject } from '../../../../common/types/kibana';
+import { type SavedSearch } from '@kbn/saved-search-plugin/public';
 
 declare const DataRecognizer: FC<{
   indexPattern: DataView;
-  savedSearch: SavedSearchSavedObject | null;
+  savedSearch: SavedSearch | null;
   results: {
     count: number;
     onChange?: Function;
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/kibana_context_value.ts b/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/kibana_context_value.ts
index 642bc4baee712..1e783660a338e 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/kibana_context_value.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/kibana_context_value.ts
@@ -8,7 +8,10 @@
 import { dataViewMock } from './data_view';
 import { dataViewsContractMock } from './data_view_contract';
 import { kibanaConfigMock } from './kibana_config';
-import { savedSearchMock } from './saved_search';
+import { deprecatedSavedSearchSimpleObjMock } from './saved_search';
+import { SavedSearch } from '@kbn/saved-search-plugin/public';
+
+const mockSavedSearch: SavedSearch = {} as unknown as SavedSearch;
 
 export const kibanaContextValueMock = {
   combinedQuery: {
@@ -16,7 +19,8 @@ export const kibanaContextValueMock = {
     language: 'the-query-language',
   },
   currentDataView: dataViewMock,
-  currentSavedSearch: savedSearchMock,
+  deprecatedSavedSearchObj: deprecatedSavedSearchSimpleObjMock,
+  selectedSavedSearch: mockSavedSearch,
   dataViewsContract: dataViewsContractMock,
   kibanaConfig: kibanaConfigMock,
 };
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/saved_search.ts b/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/saved_search.ts
index b9475996c79d8..f16b4f311f2e4 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/saved_search.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/__mocks__/saved_search.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export const savedSearchMock: any = {
+export const deprecatedSavedSearchSimpleObjMock: any = {
   id: 'the-saved-search-id',
   type: 'search',
   attributes: {
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts b/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
index 8b755b02f99b9..65a14111a8a8f 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
@@ -7,13 +7,16 @@
 
 import React from 'react';
 import type { DataView, DataViewsContract } from '@kbn/data-views-plugin/public';
+import type { SavedSearch } from '@kbn/saved-search-plugin/public';
 import type { SavedSearchSavedObject } from '../../../../common/types/kibana';
 import type { MlServicesContext } from '../../app';
 
 export interface MlContextValue {
   combinedQuery: any;
   currentDataView: DataView; // TODO this should be DataView or null
-  currentSavedSearch: SavedSearchSavedObject | null;
+  // @deprecated currentSavedSearch is of SavedSearchSavedObject type, change to selectedSavedSearch
+  deprecatedSavedSearchObj: SavedSearchSavedObject | null;
+  selectedSavedSearch: SavedSearch | null;
   dataViewsContract: DataViewsContract;
   kibanaConfig: any; // IUiSettingsClient;
   kibanaVersion: string;
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/use_current_saved_search.ts b/x-pack/plugins/ml/public/application/contexts/ml/use_current_saved_search.ts
deleted file mode 100644
index 1d55d0d454725..0000000000000
--- a/x-pack/plugins/ml/public/application/contexts/ml/use_current_saved_search.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { useContext } from 'react';
-
-import { MlContext } from './ml_context';
-
-export const useCurrentSavedSearch = () => {
-  const context = useContext(MlContext);
-
-  if (context.currentSavedSearch === undefined) {
-    throw new Error('currentSavedSearch is undefined');
-  }
-
-  return context.currentSavedSearch;
-};
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/use_ml_context.ts b/x-pack/plugins/ml/public/application/contexts/ml/use_ml_context.ts
index 1a07cb0338855..f9ee39921087f 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/use_ml_context.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/use_ml_context.ts
@@ -15,7 +15,10 @@ export const useMlContext = () => {
   if (
     context.combinedQuery === undefined ||
     context.currentDataView === undefined ||
-    context.currentSavedSearch === undefined ||
+    // @deprecated currentSavedSearch is of SavedSearchSavedObject type
+    // and should be migrated to selectedSavedSearch
+    context.deprecatedSavedSearchObj === undefined ||
+    context.selectedSavedSearch === undefined ||
     context.dataViewsContract === undefined ||
     context.kibanaConfig === undefined
   ) {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx
index 094cc405c7297..9da07dc0e6116 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx
@@ -121,7 +121,7 @@ export const ConfigurationStepForm: FC<ConfigurationStepProps> = ({
   setCurrentStep,
 }) => {
   const mlContext = useMlContext();
-  const { currentSavedSearch, currentDataView } = mlContext;
+  const { currentDataView, selectedSavedSearch } = mlContext;
   const { savedSearchQuery, savedSearchQueryStr } = useSavedSearch();
 
   const [fieldOptionsFetchFail, setFieldOptionsFetchFail] = useState<boolean>(false);
@@ -611,9 +611,9 @@ export const ConfigurationStepForm: FC<ConfigurationStepProps> = ({
                 </EuiText>
               )}
               <EuiBadge color="hollow">
-                {savedSearchQuery !== null
-                  ? currentSavedSearch?.attributes.title
-                  : currentDataView.title}
+                {selectedSavedSearch !== null
+                  ? selectedSavedSearch.title
+                  : currentDataView.getName()}
               </EuiBadge>
             </Fragment>
           }
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/use_saved_search.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/use_saved_search.ts
index 37526b6e66ff8..ab7cd1d6c1c59 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/use_saved_search.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/use_saved_search.ts
@@ -10,12 +10,13 @@ import {
   buildEsQuery,
   buildQueryFromFilters,
   decorateQuery,
+  Filter,
   fromKueryExpression,
+  Query,
   toElasticsearchQuery,
 } from '@kbn/es-query';
 import { useMlContext } from '../../../../../contexts/ml';
 import { SEARCH_QUERY_LANGUAGE } from '../../../../../../../common/constants/search';
-import { getQueryFromSavedSearchObject } from '../../../../../util/index_utils';
 
 // `undefined` is used for a non-initialized state
 // `null` is set if no saved search is used
@@ -33,14 +34,16 @@ export function useSavedSearch() {
   const [savedSearchQueryStr, setSavedSearchQueryStr] = useState<SavedSearchQueryStr>(undefined);
 
   const mlContext = useMlContext();
-  const { currentSavedSearch, currentDataView, kibanaConfig } = mlContext;
+  const { currentDataView, kibanaConfig, selectedSavedSearch } = mlContext;
 
   const getQueryData = () => {
     let qry: any = {};
     let qryString;
 
-    if (currentSavedSearch !== null) {
-      const { query, filter } = getQueryFromSavedSearchObject(currentSavedSearch);
+    if (selectedSavedSearch) {
+      // FIXME: Add support for AggregateQuery type #150091
+      const query = selectedSavedSearch.searchSource.getField('query') as Query;
+      const filter = (selectedSavedSearch.searchSource.getField('filter') ?? []) as Filter[];
       const queryLanguage = query.language;
       qryString = query.query;
 
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
index 7d25031dc766c..ec08e25bb6f15 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
@@ -21,7 +21,6 @@ import { ES_FIELD_TYPES } from '@kbn/field-types';
 import { useMlKibana, useNavigateToPath } from '../../../../contexts/kibana';
 
 import { useMlContext } from '../../../../contexts/ml';
-import { isSavedSearchSavedObject } from '../../../../../../common/types/kibana';
 import { DataRecognizer } from '../../../../components/data_recognizer';
 import { addItemToRecentlyAccessed } from '../../../../util/recently_accessed';
 import { timeBasedIndexCheck } from '../../../../util/index_utils';
@@ -46,7 +45,7 @@ export const Page: FC = () => {
 
   const [recognizerResultsCount, setRecognizerResultsCount] = useState(0);
 
-  const { currentSavedSearch, currentDataView } = mlContext;
+  const { currentDataView, selectedSavedSearch } = mlContext;
 
   const isTimeBasedIndex = timeBasedIndexCheck(currentDataView);
   const hasGeoFields = useMemo(
@@ -58,27 +57,27 @@ export const Page: FC = () => {
     [currentDataView]
   );
   const indexWarningTitle =
-    !isTimeBasedIndex && isSavedSearchSavedObject(currentSavedSearch)
+    !isTimeBasedIndex && selectedSavedSearch
       ? i18n.translate(
           'xpack.ml.newJob.wizard.jobType.dataViewFromSavedSearchNotTimeBasedMessage',
           {
             defaultMessage:
               '{savedSearchTitle} uses data view {dataViewName} which is not time based',
             values: {
-              savedSearchTitle: currentSavedSearch.attributes.title as string,
-              dataViewName: currentDataView.title,
+              savedSearchTitle: selectedSavedSearch.title ?? '',
+              dataViewName: currentDataView.getName(),
             },
           }
         )
       : i18n.translate('xpack.ml.newJob.wizard.jobType.dataViewNotTimeBasedMessage', {
           defaultMessage: 'Data view {dataViewName} is not time based',
-          values: { dataViewName: currentDataView.title },
+          values: { dataViewName: currentDataView.getName() },
         });
 
-  const pageTitleLabel = isSavedSearchSavedObject(currentSavedSearch)
+  const pageTitleLabel = selectedSavedSearch
     ? i18n.translate('xpack.ml.newJob.wizard.jobType.savedSearchPageTitleLabel', {
         defaultMessage: 'saved search {savedSearchTitle}',
-        values: { savedSearchTitle: currentSavedSearch.attributes.title as string },
+        values: { savedSearchTitle: selectedSavedSearch.title ?? '' },
       })
     : i18n.translate('xpack.ml.newJob.wizard.jobType.dataViewPageTitleLabel', {
         defaultMessage: 'data view {dataViewName}',
@@ -93,23 +92,23 @@ export const Page: FC = () => {
   };
 
   const getUrlParams = () => {
-    return !isSavedSearchSavedObject(currentSavedSearch)
+    return !selectedSavedSearch
       ? `?index=${currentDataView.id}`
-      : `?savedSearchId=${currentSavedSearch.id}`;
+      : `?savedSearchId=${selectedSavedSearch.id}`;
   };
 
   const addSelectionToRecentlyAccessed = async () => {
-    const title = !isSavedSearchSavedObject(currentSavedSearch)
-      ? currentDataView.title
-      : (currentSavedSearch.attributes.title as string);
+    const title = !selectedSavedSearch
+      ? currentDataView.getName()
+      : selectedSavedSearch.title ?? '';
     const mlLocator = share.url.locators.get(ML_APP_LOCATOR)!;
 
     const dataVisualizerLink = await mlLocator.getUrl(
       {
         page: ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER,
         pageState: {
-          ...(currentSavedSearch?.id
-            ? { savedSearchId: currentSavedSearch.id }
+          ...(selectedSavedSearch?.id
+            ? { savedSearchId: selectedSavedSearch.id }
             : { index: currentDataView.id }),
         },
       },
@@ -295,7 +294,7 @@ export const Page: FC = () => {
         <EuiFlexGrid gutterSize="l" columns={4}>
           <DataRecognizer
             indexPattern={currentDataView}
-            savedSearch={currentSavedSearch}
+            savedSearch={selectedSavedSearch}
             results={recognizerResults}
           />
         </EuiFlexGrid>
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/page.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/page.tsx
index 4d27dba214242..57e0a6d75720e 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/page.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/page.tsx
@@ -64,7 +64,7 @@ export const Page: FC<PageProps> = ({ existingJobsAndGroups, jobType }) => {
     () =>
       jobCreatorFactory(jobType)(
         mlContext.currentDataView,
-        mlContext.currentSavedSearch,
+        mlContext.deprecatedSavedSearchObj,
         mlContext.combinedQuery
       ),
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -148,7 +148,7 @@ export const Page: FC<PageProps> = ({ existingJobsAndGroups, jobType }) => {
       jobCreator.modelChangeAnnotations = true;
     }
 
-    if (mlContext.currentSavedSearch !== null) {
+    if (mlContext.selectedSavedSearch !== null) {
       // Jobs created from saved searches cannot be cloned in the wizard as the
       // ML job config holds no reference to the saved search ID.
       jobCreator.createdBy = null;
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
index 81e42a3e4062a..db8374f4bec44 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
@@ -71,15 +71,15 @@ export const WizardSteps: FC<Props> = ({ currentStep, setCurrentStep }) => {
   const [advancedExpanded, setAdvancedExpanded] = useState(false);
   const [additionalExpanded, setAdditionalExpanded] = useState(false);
   function getSummaryStepTitle() {
-    if (mlContext.currentSavedSearch !== null) {
+    if (mlContext.selectedSavedSearch) {
       return i18n.translate('xpack.ml.newJob.wizard.stepComponentWrapper.summaryTitleSavedSearch', {
         defaultMessage: 'New job from saved search {title}',
-        values: { title: mlContext.currentSavedSearch.attributes.title as string },
+        values: { title: mlContext.selectedSavedSearch.title ?? '' },
       });
     } else if (mlContext.currentDataView.id !== undefined) {
       return i18n.translate('xpack.ml.newJob.wizard.stepComponentWrapper.summaryTitleDataView', {
         defaultMessage: 'New job from data view {dataViewName}',
-        values: { dataViewName: mlContext.currentDataView.title },
+        values: { dataViewName: mlContext.currentDataView.getName() },
       });
     }
     return '';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
index 1dbf2b2e99a84..5881f76632e70 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
@@ -92,23 +92,18 @@ export const Page: FC<PageProps> = ({ moduleId, existingGroupIds }) => {
   const [jobsAwaitingNodeCount, setJobsAwaitingNodeCount] = useState(0);
   // #endregion
 
-  const {
-    currentSavedSearch: savedSearch,
-    currentDataView: dataView,
-    combinedQuery,
-  } = useMlContext();
-  const pageTitle =
-    savedSearch !== null
-      ? i18n.translate('xpack.ml.newJob.recognize.savedSearchPageTitle', {
-          defaultMessage: 'saved search {savedSearchTitle}',
-          values: { savedSearchTitle: savedSearch.attributes.title as string },
-        })
-      : i18n.translate('xpack.ml.newJob.recognize.dataViewPageTitle', {
-          defaultMessage: 'data view {dataViewName}',
-          values: { dataViewName: dataView.getName() },
-        });
-  const displayQueryWarning = savedSearch !== null;
-  const tempQuery = savedSearch === null ? undefined : combinedQuery;
+  const { selectedSavedSearch, currentDataView: dataView, combinedQuery } = useMlContext();
+  const pageTitle = selectedSavedSearch
+    ? i18n.translate('xpack.ml.newJob.recognize.savedSearchPageTitle', {
+        defaultMessage: 'saved search {savedSearchTitle}',
+        values: { savedSearchTitle: selectedSavedSearch.title ?? '' },
+      })
+    : i18n.translate('xpack.ml.newJob.recognize.dataViewPageTitle', {
+        defaultMessage: 'data view {dataViewName}',
+        values: { dataViewName: dataView.getName() },
+      });
+  const displayQueryWarning = selectedSavedSearch !== null;
+  const tempQuery = selectedSavedSearch === null ? undefined : combinedQuery;
 
   /**
    * Loads recognizer module configuration.
diff --git a/x-pack/plugins/ml/public/application/routing/router.tsx b/x-pack/plugins/ml/public/application/routing/router.tsx
index e050bea78a5c9..4b9dab76994ed 100644
--- a/x-pack/plugins/ml/public/application/routing/router.tsx
+++ b/x-pack/plugins/ml/public/application/routing/router.tsx
@@ -19,6 +19,8 @@ import type { DataViewsContract } from '@kbn/data-views-plugin/public';
 
 import { EuiLoadingContent } from '@elastic/eui';
 import { UrlStateProvider } from '@kbn/ml-url-state';
+import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
+import { SavedObjectsClientContract } from '@kbn/core/public';
 import { MlNotificationsContextProvider } from '../contexts/ml/ml_notifications_context';
 import { MlContext, MlContextValue } from '../contexts/ml';
 
@@ -65,6 +67,10 @@ export interface PageDependencies {
   dataViewsContract: DataViewsContract;
   setBreadcrumbs: ChromeStart['setBreadcrumbs'];
   redirectToMlAccessDeniedPage: () => Promise<void>;
+  getSavedSearchDeps: {
+    search: DataPublicPluginStart['search'];
+    savedObjectsClient: SavedObjectsClientContract;
+  };
 }
 
 export const PageLoader: FC<{ context: MlContextValue }> = ({ context, children }) => {
diff --git a/x-pack/plugins/ml/public/application/routing/routes/access_denied.tsx b/x-pack/plugins/ml/public/application/routing/routes/access_denied.tsx
index 1868c521c72fd..d07f760adf791 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/access_denied.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/access_denied.tsx
@@ -30,7 +30,14 @@ export const accessDeniedRouteFactory = (): MlRoute => ({
 });
 
 const PageWrapper: FC<PageProps> = ({ deps }) => {
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {});
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {}
+  );
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/aiops/change_point_detection.tsx b/x-pack/plugins/ml/public/application/routing/routes/aiops/change_point_detection.tsx
index 8d85c09f5ddf1..c825c579e6497 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/aiops/change_point_detection.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/aiops/change_point_detection.tsx
@@ -43,10 +43,17 @@ export const changePointDetectionRouteFactory = (
 
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
   const { index, savedSearchId }: Record<string, any> = parse(location.search, { sort: false });
-  const { context } = useResolver(index, savedSearchId, deps.config, deps.dataViewsContract, {
-    checkBasicLicense,
-    cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
-  });
+  const { context } = useResolver(
+    index,
+    savedSearchId,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkBasicLicense,
+      cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
+    }
+  );
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/aiops/explain_log_rate_spikes.tsx b/x-pack/plugins/ml/public/application/routing/routes/aiops/explain_log_rate_spikes.tsx
index ac9728f0c54a0..b946f1a651099 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/aiops/explain_log_rate_spikes.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/aiops/explain_log_rate_spikes.tsx
@@ -50,15 +50,23 @@ export const explainLogRateSpikesRouteFactory = (
   disabled: !AIOPS_ENABLED,
 });
 
-const PageWrapper: FC<PageProps> = ({ location, deps }) => {
+const PageWrapper: FC<PageProps> = ({ location, deps, ...restProps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
   const { index, savedSearchId }: Record<string, any> = parse(location.search, { sort: false });
-  const { context } = useResolver(index, savedSearchId, deps.config, deps.dataViewsContract, {
-    checkBasicLicense,
-    cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-  });
+  const { context } = useResolver(
+    index,
+    savedSearchId,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkBasicLicense,
+      cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+    }
+  );
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/aiops/log_categorization.tsx b/x-pack/plugins/ml/public/application/routing/routes/aiops/log_categorization.tsx
index e3aebb87b5341..6002d86a69520 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/aiops/log_categorization.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/aiops/log_categorization.tsx
@@ -50,11 +50,19 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
   const { index, savedSearchId }: Record<string, any> = parse(location.search, { sort: false });
-  const { context } = useResolver(index, savedSearchId, deps.config, deps.dataViewsContract, {
-    checkBasicLicense,
-    cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-  });
+  const { context } = useResolver(
+    index,
+    savedSearchId,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkBasicLicense,
+      cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+    }
+  );
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_creation.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_creation.tsx
index fa0899ea23475..9466c271f31b0 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_creation.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_creation.tsx
@@ -48,11 +48,18 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
     sort: false,
   });
 
-  const { context } = useResolver(index, savedSearchId, deps.config, deps.dataViewsContract, {
-    ...basicResolvers(deps),
-    analyticsFields: () =>
-      loadNewJobCapabilities(index, savedSearchId, deps.dataViewsContract, DATA_FRAME_ANALYTICS),
-  });
+  const { context } = useResolver(
+    index,
+    savedSearchId,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      ...basicResolvers(deps),
+      analyticsFields: () =>
+        loadNewJobCapabilities(index, savedSearchId, deps.dataViewsContract, DATA_FRAME_ANALYTICS),
+    }
+  );
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
index d47780553eede..1d4e483126e7f 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
@@ -46,6 +46,7 @@ const PageWrapper: FC<PageProps> = ({ deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     basicResolvers(deps)
   );
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
index fd3a365d01179..0b94eb490c778 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
@@ -44,6 +44,7 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     basicResolvers(deps)
   );
   return (
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_map.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_map.tsx
index faae919f722c8..853be56943341 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_map.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_map.tsx
@@ -45,6 +45,7 @@ const PageWrapper: FC<PageProps> = ({ deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     basicResolvers(deps)
   );
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_source_selection.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_source_selection.tsx
index e9ffcc509b153..6d255a8fb5fb3 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_source_selection.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_source_selection.tsx
@@ -44,6 +44,7 @@ const PageWrapper: FC<PageProps> = ({ deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     basicResolvers(deps)
   );
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/datavisualizer.tsx b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/datavisualizer.tsx
index ad01c2d97b718..29f9063cddd38 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/datavisualizer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/datavisualizer.tsx
@@ -35,11 +35,18 @@ export const selectorRouteFactory = (
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkBasicLicense,
-    checkFindFileStructurePrivilege: () =>
-      checkFindFileStructurePrivilegeResolver(redirectToMlAccessDeniedPage),
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkBasicLicense,
+      checkFindFileStructurePrivilege: () =>
+        checkFindFileStructurePrivilegeResolver(redirectToMlAccessDeniedPage),
+    }
+  );
   return (
     <PageLoader context={context}>
       <DatavisualizerSelector />
diff --git a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
index 3d048e8d40283..3e58a2b2bd08f 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
@@ -45,12 +45,19 @@ export const fileBasedRouteFactory = (
 const PageWrapper: FC<PageProps> = ({ deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkBasicLicense,
-    cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
-    checkFindFileStructurePrivilege: () =>
-      checkFindFileStructurePrivilegeResolver(redirectToMlAccessDeniedPage),
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkBasicLicense,
+      cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
+      checkFindFileStructurePrivilege: () =>
+        checkFindFileStructurePrivilegeResolver(redirectToMlAccessDeniedPage),
+    }
+  );
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/index_based.tsx b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/index_based.tsx
index 1ba865435280c..acd51501092b8 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/index_based.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/index_based.tsx
@@ -47,11 +47,19 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
   const { index, savedSearchId }: Record<string, any> = parse(location.search, { sort: false });
-  const { context } = useResolver(index, savedSearchId, deps.config, deps.dataViewsContract, {
-    checkBasicLicense,
-    cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-  });
+  const { context } = useResolver(
+    index,
+    savedSearchId,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkBasicLicense,
+      cacheDataViewsContract: () => cacheDataViewsContract(deps.dataViewsContract),
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+    }
+  );
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
index e7e672248f625..99c3f3ff38a68 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
@@ -75,6 +75,7 @@ const PageWrapper: FC<PageProps> = ({ deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     {
       ...basicResolvers(deps),
       jobs: mlJobService.loadJobsWrapper,
diff --git a/x-pack/plugins/ml/public/application/routing/routes/jobs_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/jobs_list.tsx
index 68c0cdbe6a24f..bcf8929c7f470 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/jobs_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/jobs_list.tsx
@@ -50,6 +50,7 @@ const PageWrapper: FC<PageProps> = ({ deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     basicResolvers(deps)
   );
   const timefilter = useTimefilter({ timeRangeSelector: false, autoRefreshSelector: true });
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/from_lens.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/from_lens.tsx
index a0690b4987bc0..0a9d1a30aad62 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/from_lens.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/from_lens.tsx
@@ -30,9 +30,16 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
     }
   );
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    redirect: () => resolver(lensId, vis, from, to, query, filters, layerIndex),
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      redirect: () => resolver(lensId, vis, from, to, query, filters, layerIndex),
+    }
+  );
   return (
     <PageLoader context={context}>
       {<Redirect to={createPath(ML_PAGES.ANOMALY_DETECTION_CREATE_JOB)} />}
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/from_map.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/from_map.tsx
index 3f1ebb04162e6..e63a00735b348 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/from_map.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/from_map.tsx
@@ -36,10 +36,17 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
     sort: false,
   });
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    redirect: () =>
-      resolver(dashboard, dataViewId, embeddable, geoField, splitField, from, to, layer),
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      redirect: () =>
+        resolver(dashboard, dataViewId, embeddable, geoField, splitField, from, to, layer),
+    }
+  );
   return (
     <PageLoader context={context}>
       {<Redirect to={createPath(ML_PAGES.ANOMALY_DETECTION_CREATE_JOB)} />}
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/index_or_search.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/index_or_search.tsx
index 0383b48eabadc..fa35731e567c7 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/index_or_search.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/index_or_search.tsx
@@ -206,6 +206,7 @@ const PageWrapper: FC<IndexOrSearchPageProps> = ({ nextStepPath, deps, mode }) =
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     mode === MODE.NEW_JOB ? newJobResolvers : dataVizResolvers
   );
   return (
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/job_type.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/job_type.tsx
index e1d38875bc1dd..e4c9fa21cbd46 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/job_type.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/job_type.tsx
@@ -41,6 +41,7 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
     savedSearchId,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     basicResolvers(deps)
   );
   return (
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/recognize.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/recognize.tsx
index a68bb0d861a5c..1c1c54aebc4cc 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/recognize.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/recognize.tsx
@@ -55,6 +55,8 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
     savedSearchId,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+
     {
       ...basicResolvers(deps),
       existingJobsAndGroups: mlJobService.getJobAndGroupIds,
@@ -77,7 +79,7 @@ const CheckViewOrCreateWrapper: FC<PageProps> = ({ location, deps }) => {
   const navigateToPath = useNavigateToPath();
 
   // the single resolver checkViewOrCreateJobs redirects only. so will always reject
-  useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
+  useResolver(undefined, undefined, deps.config, deps.dataViewsContract, deps.getSavedSearchDeps, {
     checkViewOrCreateJobs: () =>
       checkViewOrCreateJobs(moduleId, dataViewId, createLinkWithUserDefaults, navigateToPath),
   });
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/wizard.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/wizard.tsx
index 8a4640a346a85..4300d73ae010e 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/wizard.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/wizard.tsx
@@ -200,6 +200,7 @@ const PageWrapper: FC<WizardPageProps> = ({ location, jobType, deps }) => {
     savedSearchId,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     {
       ...basicResolvers(deps),
       privileges: () => checkCreateJobsCapabilitiesResolver(redirectToJobsManagementPage),
diff --git a/x-pack/plugins/ml/public/application/routing/routes/notifications.tsx b/x-pack/plugins/ml/public/application/routing/routes/notifications.tsx
index cb7cbc0c48c6e..843cf54087c8f 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/notifications.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/notifications.tsx
@@ -46,12 +46,20 @@ export const notificationsRouteFactory = (
 const PageWrapper: FC<PageProps> = ({ deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkFullLicense,
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-    getMlNodeCount,
-    loadMlServerInfo,
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkFullLicense,
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+      getMlNodeCount,
+      loadMlServerInfo,
+    }
+  );
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
 
   return (
diff --git a/x-pack/plugins/ml/public/application/routing/routes/overview.tsx b/x-pack/plugins/ml/public/application/routing/routes/overview.tsx
index 139e4635ce412..111a1ae77916c 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/overview.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/overview.tsx
@@ -50,12 +50,20 @@ export const overviewRouteFactory = (
 const PageWrapper: FC<PageProps> = ({ deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkFullLicense,
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-    getMlNodeCount,
-    loadMlServerInfo,
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkFullLicense,
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+      getMlNodeCount,
+      loadMlServerInfo,
+    }
+  );
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
 
   return (
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_list.tsx
index e257f0cde5aac..2d43c5ab5675c 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_list.tsx
@@ -41,11 +41,19 @@ export const calendarListRouteFactory = (
 const PageWrapper: FC<PageProps> = ({ deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkFullLicense,
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-    getMlNodeCount,
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkFullLicense,
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+      getMlNodeCount,
+    }
+  );
 
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_new_edit.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_new_edit.tsx
index 9753e790cd543..775ba25523a9d 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_new_edit.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/calendar_new_edit.tsx
@@ -85,11 +85,19 @@ const PageWrapper: FC<NewCalendarPageProps> = ({ location, mode, deps }) => {
     ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE
   );
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkFullLicense,
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-    checkMlNodesAvailable: () => checkMlNodesAvailable(redirectToJobsManagementPage),
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkFullLicense,
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+      checkMlNodesAvailable: () => checkMlNodesAvailable(redirectToJobsManagementPage),
+    }
+  );
 
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list.tsx
index d4e8b61ef4870..abbe806716feb 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list.tsx
@@ -41,11 +41,19 @@ export const filterListRouteFactory = (
 const PageWrapper: FC<PageProps> = ({ deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkFullLicense,
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-    getMlNodeCount,
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkFullLicense,
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+      getMlNodeCount,
+    }
+  );
 
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list_new_edit.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list_new_edit.tsx
index c501760080624..9afa6ec8c8557 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list_new_edit.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/filter_list_new_edit.tsx
@@ -89,11 +89,19 @@ const PageWrapper: FC<NewFilterPageProps> = ({ location, mode, deps }) => {
     ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE
   );
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkFullLicense,
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-    checkMlNodesAvailable: () => checkMlNodesAvailable(redirectToJobsManagementPage),
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkFullLicense,
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+      checkMlNodesAvailable: () => checkMlNodesAvailable(redirectToJobsManagementPage),
+    }
+  );
 
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/settings/settings.tsx b/x-pack/plugins/ml/public/application/routing/routes/settings/settings.tsx
index 2e994cc4f85f9..2b9af849e2157 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/settings/settings.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/settings/settings.tsx
@@ -41,11 +41,19 @@ export const settingsRouteFactory = (
 const PageWrapper: FC<PageProps> = ({ deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
-  const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    checkFullLicense,
-    checkGetJobsCapabilities: () => checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
-    getMlNodeCount,
-  });
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    {
+      checkFullLicense,
+      checkGetJobsCapabilities: () =>
+        checkGetJobsCapabilitiesResolver(redirectToMlAccessDeniedPage),
+      getMlNodeCount,
+    }
+  );
 
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: false });
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
index e89a2cff13873..729bb5ae821d8 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
@@ -79,6 +79,7 @@ const PageWrapper: FC<PageProps> = ({ deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     {
       ...basicResolvers(deps),
       jobs: mlJobService.loadJobsWrapper,
diff --git a/x-pack/plugins/ml/public/application/routing/routes/trained_models/models_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/trained_models/models_list.tsx
index e2b0b2709df52..46fd368829344 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/trained_models/models_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/trained_models/models_list.tsx
@@ -47,6 +47,7 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     basicResolvers(deps)
   );
   return (
diff --git a/x-pack/plugins/ml/public/application/routing/routes/trained_models/nodes_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/trained_models/nodes_list.tsx
index e6003f161b1c6..78d99daf0d2d7 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/trained_models/nodes_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/trained_models/nodes_list.tsx
@@ -46,6 +46,7 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
     undefined,
     deps.config,
     deps.dataViewsContract,
+    deps.getSavedSearchDeps,
     basicResolvers(deps)
   );
   useTimefilter({ timeRangeSelector: false, autoRefreshSelector: true });
diff --git a/x-pack/plugins/ml/public/application/routing/use_resolver.test.ts b/x-pack/plugins/ml/public/application/routing/use_resolver.test.ts
index 714df97142cca..a75448459be96 100644
--- a/x-pack/plugins/ml/public/application/routing/use_resolver.test.ts
+++ b/x-pack/plugins/ml/public/application/routing/use_resolver.test.ts
@@ -13,7 +13,7 @@ import { useCreateAndNavigateToMlLink } from '../contexts/kibana/use_create_url'
 import { useNotifications } from '../contexts/kibana';
 import type { DataViewsContract } from '@kbn/data-views-plugin/public';
 
-import { useResolver } from './use_resolver';
+import { type GetSavedSearchPageDeps, useResolver } from './use_resolver';
 
 jest.mock('../contexts/kibana/use_create_url', () => {
   return {
@@ -47,7 +47,14 @@ describe('useResolver', () => {
 
   it('should accept undefined as dataViewId and savedSearchId.', async () => {
     const { result, waitForNextUpdate } = renderHook(() =>
-      useResolver(undefined, undefined, {} as IUiSettingsClient, {} as DataViewsContract, {})
+      useResolver(
+        undefined,
+        undefined,
+        {} as IUiSettingsClient,
+        {} as DataViewsContract,
+        {} as GetSavedSearchPageDeps,
+        {}
+      )
     );
 
     await act(async () => {
@@ -66,9 +73,10 @@ describe('useResolver', () => {
           },
         },
         currentDataView: null,
-        currentSavedSearch: null,
+        deprecatedSavedSearchObj: null,
         dataViewsContract: {},
         kibanaConfig: {},
+        selectedSavedSearch: null,
       },
       results: {},
     });
@@ -78,7 +86,14 @@ describe('useResolver', () => {
 
   it('should add an error toast and redirect if dataViewId is an empty string.', async () => {
     const { result } = renderHook(() =>
-      useResolver('', undefined, {} as IUiSettingsClient, {} as DataViewsContract, {})
+      useResolver(
+        '',
+        undefined,
+        {} as IUiSettingsClient,
+        {} as DataViewsContract,
+        {} as GetSavedSearchPageDeps,
+        {}
+      )
     );
 
     await act(async () => {});
diff --git a/x-pack/plugins/ml/public/application/routing/use_resolver.ts b/x-pack/plugins/ml/public/application/routing/use_resolver.ts
index 6e16b1d42e6f6..0f999329b2fa1 100644
--- a/x-pack/plugins/ml/public/application/routing/use_resolver.ts
+++ b/x-pack/plugins/ml/public/application/routing/use_resolver.ts
@@ -6,21 +6,27 @@
  */
 
 import { useEffect, useState } from 'react';
-import { IUiSettingsClient } from '@kbn/core/public';
+import type { IUiSettingsClient, SavedObjectsClientContract } from '@kbn/core/public';
 import { i18n } from '@kbn/i18n';
 import type { DataViewsContract } from '@kbn/data-views-plugin/public';
+import { getSavedSearch } from '@kbn/saved-search-plugin/public';
+import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import {
   getDataViewById,
   getDataViewAndSavedSearch,
-  DataViewAndSavedSearch,
+  type DataViewAndSavedSearch,
 } from '../util/index_utils';
 import { createSearchItems } from '../jobs/new_job/utils/new_job_utils';
-import { ResolverResults, Resolvers } from './resolvers';
-import { MlContextValue } from '../contexts/ml';
+import type { ResolverResults, Resolvers } from './resolvers';
+import type { MlContextValue } from '../contexts/ml';
 import { useNotifications } from '../contexts/kibana';
 import { useCreateAndNavigateToMlLink } from '../contexts/kibana/use_create_url';
 import { ML_PAGES } from '../../../common/constants/locator';
 
+export interface GetSavedSearchPageDeps {
+  search: DataPublicPluginStart['search'];
+  savedObjectsClient: SavedObjectsClientContract;
+}
 /**
  * Hook to resolve route specific requirements
  * @param dataViewId optional Kibana data view id, used for wizards
@@ -34,6 +40,10 @@ export const useResolver = (
   savedSearchId: string | undefined,
   config: IUiSettingsClient,
   dataViewsContract: DataViewsContract,
+  getSavedSearchDeps: {
+    search: DataPublicPluginStart['search'];
+    savedObjectsClient: SavedObjectsClientContract;
+  },
   resolvers: Resolvers
 ): { context: MlContextValue; results: ResolverResults } => {
   const notifications = useNotifications();
@@ -76,25 +86,28 @@ export const useResolver = (
           savedSearch: null,
           dataView: null,
         };
+        let savedSearch = null;
 
         if (savedSearchId !== undefined) {
+          savedSearch = await getSavedSearch(savedSearchId, getSavedSearchDeps);
           dataViewAndSavedSearch = await getDataViewAndSavedSearch(savedSearchId);
         } else if (dataViewId !== undefined) {
           dataViewAndSavedSearch.dataView = await getDataViewById(dataViewId);
         }
 
-        const { savedSearch, dataView } = dataViewAndSavedSearch;
+        const { savedSearch: deprecatedSavedSearchObj, dataView } = dataViewAndSavedSearch;
 
         const { combinedQuery } = createSearchItems(
           config,
           dataView !== null ? dataView : undefined,
-          savedSearch
+          deprecatedSavedSearchObj
         );
 
         setContext({
           combinedQuery,
           currentDataView: dataView,
-          currentSavedSearch: savedSearch,
+          deprecatedSavedSearchObj,
+          selectedSavedSearch: savedSearch,
           dataViewsContract,
           kibanaConfig: config,
         });
diff --git a/x-pack/plugins/ml/tsconfig.json b/x-pack/plugins/ml/tsconfig.json
index d613793099257..5dc4bfd67dc58 100644
--- a/x-pack/plugins/ml/tsconfig.json
+++ b/x-pack/plugins/ml/tsconfig.json
@@ -79,5 +79,6 @@
     "@kbn/shared-ux-link-redirect-app",
     "@kbn/react-field",
     "@kbn/unified-field-list-plugin",
+    "@kbn/saved-search-plugin",
   ],
 }

From 8eb89aaf19dd9f48912157b33d2e39bfb14ed1de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?=
 <alejandro.haro@elastic.co>
Date: Mon, 6 Feb 2023 19:21:08 +0100
Subject: [PATCH 005/134] Add FTRs to the `cloud_links` plugin (#150220)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Resolves https://github.com/elastic/kibana/issues/149206
---
 .buildkite/ftr_configs.yml                    |   1 +
 x-pack/test/functional_cloud/config.ts        |  63 ++++++++
 .../functional_cloud/ftr_provider_context.ts  |  13 ++
 x-pack/test/functional_cloud/services.ts      |  10 ++
 x-pack/test/functional_cloud/test_utils.ts    | 138 ++++++++++++++++++
 .../functional_cloud/tests/cloud_links.ts     |  62 ++++++++
 x-pack/test/functional_cloud/tests/index.ts   |  14 ++
 7 files changed, 301 insertions(+)
 create mode 100644 x-pack/test/functional_cloud/config.ts
 create mode 100644 x-pack/test/functional_cloud/ftr_provider_context.ts
 create mode 100644 x-pack/test/functional_cloud/services.ts
 create mode 100644 x-pack/test/functional_cloud/test_utils.ts
 create mode 100644 x-pack/test/functional_cloud/tests/cloud_links.ts
 create mode 100644 x-pack/test/functional_cloud/tests/index.ts

diff --git a/.buildkite/ftr_configs.yml b/.buildkite/ftr_configs.yml
index 0b56007cf9aeb..5c3f6aef0271e 100644
--- a/.buildkite/ftr_configs.yml
+++ b/.buildkite/ftr_configs.yml
@@ -243,6 +243,7 @@ enabled:
   - x-pack/test/functional/config_security_basic.ts
   - x-pack/test/functional/config.ccs.ts
   - x-pack/test/functional/config.firefox.js
+  - x-pack/test/functional_cloud/config.ts
   - x-pack/test/kubernetes_security/basic/config.ts
   - x-pack/test/licensing_plugin/config.public.ts
   - x-pack/test/licensing_plugin/config.ts
diff --git a/x-pack/test/functional_cloud/config.ts b/x-pack/test/functional_cloud/config.ts
new file mode 100644
index 0000000000000..db0f19f9c21cc
--- /dev/null
+++ b/x-pack/test/functional_cloud/config.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { resolve } from 'path';
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(require.resolve('../functional/config.base.js'));
+
+  const kibanaPort = functionalConfig.get('servers.kibana.port');
+  const idpPath = resolve(
+    __dirname,
+    '../security_api_integration/fixtures/saml/saml_provider/metadata.xml'
+  );
+  const samlIdPPlugin = resolve(
+    __dirname,
+    '../security_api_integration/fixtures/saml/saml_provider'
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    rootTags: ['skipCloud'],
+    testFiles: [require.resolve('./tests')],
+    security: { disableTestUser: true },
+    junit: {
+      reportName: 'Cloud Integrations Functional Tests',
+    },
+    esTestCluster: {
+      ...functionalConfig.get('esTestCluster'),
+      serverArgs: [
+        ...functionalConfig.get('esTestCluster.serverArgs'),
+        'xpack.security.authc.token.enabled=true',
+        'xpack.security.authc.realms.saml.cloud-saml-kibana.order=0',
+        `xpack.security.authc.realms.saml.cloud-saml-kibana.idp.metadata.path=${idpPath}`,
+        'xpack.security.authc.realms.saml.cloud-saml-kibana.idp.entity_id=http://www.elastic.co/saml1',
+        `xpack.security.authc.realms.saml.cloud-saml-kibana.sp.entity_id=http://localhost:${kibanaPort}`,
+        `xpack.security.authc.realms.saml.cloud-saml-kibana.sp.logout=http://localhost:${kibanaPort}/logout`,
+        `xpack.security.authc.realms.saml.cloud-saml-kibana.sp.acs=http://localhost:${kibanaPort}/api/security/saml/callback`,
+        'xpack.security.authc.realms.saml.cloud-saml-kibana.attributes.principal=urn:oid:0.0.7',
+      ],
+    },
+    kbnTestServer: {
+      ...functionalConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...functionalConfig.get('kbnTestServer.serverArgs'),
+        `--plugin-path=${samlIdPPlugin}`,
+        '--xpack.cloud.id=ftr_fake_cloud_id',
+        '--xpack.cloud.base_url=https://cloud.elastic.co',
+        '--xpack.cloud.deployment_url=/deployments/deploymentId',
+        '--xpack.cloud.organization_url=/organization/organizationId',
+        '--xpack.cloud.profile_url=/user/userId',
+        '--xpack.security.authc.selector.enabled=false',
+        `--xpack.security.authc.providers=${JSON.stringify({
+          basic: { 'cloud-basic': { order: 1 } },
+          saml: { 'cloud-saml-kibana': { order: 0, realm: 'cloud-saml-kibana' } },
+        })}`,
+      ],
+    },
+  };
+}
diff --git a/x-pack/test/functional_cloud/ftr_provider_context.ts b/x-pack/test/functional_cloud/ftr_provider_context.ts
new file mode 100644
index 0000000000000..d6c0afa5ceffd
--- /dev/null
+++ b/x-pack/test/functional_cloud/ftr_provider_context.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { GenericFtrProviderContext } from '@kbn/test';
+import { pageObjects } from '../functional/page_objects';
+import { services } from './services';
+
+export type FtrProviderContext = GenericFtrProviderContext<typeof services, typeof pageObjects>;
+export { pageObjects };
diff --git a/x-pack/test/functional_cloud/services.ts b/x-pack/test/functional_cloud/services.ts
new file mode 100644
index 0000000000000..9508ce5eba16d
--- /dev/null
+++ b/x-pack/test/functional_cloud/services.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { services as functionalServices } from '../functional/services';
+
+export const services = functionalServices;
diff --git a/x-pack/test/functional_cloud/test_utils.ts b/x-pack/test/functional_cloud/test_utils.ts
new file mode 100644
index 0000000000000..65d0d7ece02c4
--- /dev/null
+++ b/x-pack/test/functional_cloud/test_utils.ts
@@ -0,0 +1,138 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import Fs from 'fs/promises';
+import Path from 'path';
+import { isEqualWith } from 'lodash';
+import type { Ecs, KibanaExecutionContext } from '@kbn/core/server';
+import type { RetryService } from '@kbn/ftr-common-functional-services';
+import { concatMap, defer, filter, firstValueFrom, ReplaySubject, scan, timeout } from 'rxjs';
+
+export const logFilePath = Path.resolve(__dirname, './kibana.log');
+export const ANY = Symbol('any');
+
+let logstream$: ReplaySubject<Ecs> | undefined;
+
+export function getExecutionContextFromLogRecord(record: Ecs | undefined): KibanaExecutionContext {
+  if (record?.log?.logger !== 'execution_context' || !record?.message) {
+    throw new Error(`The record is not an entry of execution context`);
+  }
+  return JSON.parse(record.message);
+}
+
+export function isExecutionContextLog(
+  record: Ecs | undefined,
+  executionContext: KibanaExecutionContext
+) {
+  try {
+    const object = getExecutionContextFromLogRecord(record);
+    return isEqualWith(object, executionContext, function customizer(obj1: any, obj2: any) {
+      if (obj2 === ANY) return true;
+    });
+  } catch (e) {
+    return false;
+  }
+}
+
+// to avoid splitting log record containing \n symbol
+const endOfLine = /(?<=})\s*\n/;
+export async function assertLogContains({
+  description,
+  predicate,
+  retry,
+}: {
+  description: string;
+  predicate: (record: Ecs) => boolean;
+  retry: RetryService;
+}): Promise<void> {
+  // logs are written to disk asynchronously. I sacrificed performance to reduce flakiness.
+  await retry.waitFor(description, async () => {
+    if (!logstream$) {
+      logstream$ = getLogstream$();
+    }
+    try {
+      await firstValueFrom(logstream$.pipe(filter(predicate), timeout(5_000)));
+      return true;
+    } catch (err) {
+      return false;
+    }
+  });
+}
+
+/**
+ * Creates an observable that continuously tails the log file.
+ */
+function getLogstream$(): ReplaySubject<Ecs> {
+  const stream$ = new ReplaySubject<Ecs>();
+
+  defer(async function* () {
+    const fd = await Fs.open(logFilePath, 'rs');
+    while (!stream$.isStopped) {
+      const { bytesRead, buffer } = await fd.read();
+      if (bytesRead) {
+        yield buffer.toString('utf8', 0, bytesRead);
+      }
+    }
+    await fd.close();
+  })
+    .pipe(
+      scan<string, { buffer: string; records: Ecs[] }>(
+        ({ buffer }, chunk) => {
+          const logString = buffer.concat(chunk);
+          const lines = logString.split(endOfLine);
+          const lastLine = lines.pop();
+          const records = lines.map((s) => JSON.parse(s));
+
+          let leftover = '';
+          if (lastLine) {
+            try {
+              const validRecord = JSON.parse(lastLine);
+              records.push(validRecord);
+            } catch (err) {
+              leftover = lastLine;
+            }
+          }
+
+          return { buffer: leftover, records };
+        },
+        {
+          records: [], // The ECS entries in the logs
+          buffer: '', // Accumulated leftovers from the previous operation
+        }
+      ),
+      concatMap(({ records }) => records)
+    )
+    .subscribe(stream$);
+
+  // let the content start flowing
+  stream$.subscribe();
+
+  return stream$;
+}
+
+export function closeLogstream() {
+  logstream$?.complete();
+  logstream$ = undefined;
+}
+
+/**
+ * Truncates the log file to avoid tests looking at the logs from previous executions.
+ */
+export async function clearLogFile() {
+  closeLogstream();
+  await Fs.writeFile(logFilePath, '', 'utf8');
+  await forceSyncLogFile();
+  logstream$ = getLogstream$();
+}
+
+/**
+ * Force the completion of all the pending I/O operations in the OS related to the log file.
+ */
+export async function forceSyncLogFile() {
+  const fileDescriptor = await Fs.open(logFilePath);
+  await fileDescriptor.datasync();
+  await fileDescriptor.close();
+}
diff --git a/x-pack/test/functional_cloud/tests/cloud_links.ts b/x-pack/test/functional_cloud/tests/cloud_links.ts
new file mode 100644
index 0000000000000..4eabec139cbe1
--- /dev/null
+++ b/x-pack/test/functional_cloud/tests/cloud_links.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const find = getService('find');
+  const PageObjects = getPageObjects(['common', 'header']);
+
+  describe('Cloud Links integration', function () {
+    before(async () => {
+      // Create role mapping so user gets superuser access
+      await getService('esSupertest')
+        .post('/_security/role_mapping/cloud-saml-kibana')
+        .send({
+          roles: ['superuser'],
+          enabled: true,
+          rules: { field: { 'realm.name': 'cloud-saml-kibana' } },
+        })
+        .expect(200);
+    });
+
+    beforeEach(async () => {
+      await PageObjects.common.navigateToUrl('home');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+    });
+
+    it('The button "Setup guides" is loaded', async () => {
+      expect(await find.byCssSelector('[data-test-subj="guideButtonRedirect"]')).to.not.be(null);
+      const cloudLink = await find.byLinkText('Setup guides');
+      expect(cloudLink).to.not.be(null);
+    });
+
+    it('"Manage this deployment" is appended to the nav list', async () => {
+      await PageObjects.common.clickAndValidate('toggleNavButton', 'collapsibleNavCustomNavLink');
+      const cloudLink = await find.byLinkText('Manage this deployment');
+      expect(cloudLink).to.not.be(null);
+    });
+
+    describe('Fills up the user menu items', () => {
+      it('Shows the button Edit profile', async () => {
+        await PageObjects.common.clickAndValidate('userMenuButton', 'userMenuLink__Edit profile');
+        const cloudLink = await find.byLinkText('Edit profile');
+        expect(cloudLink).to.not.be(null);
+      });
+
+      it('Shows the button Account & Billing', async () => {
+        await PageObjects.common.clickAndValidate(
+          'userMenuButton',
+          'userMenuLink__Account & Billing'
+        );
+        const cloudLink = await find.byLinkText('Account & Billing');
+        expect(cloudLink).to.not.be(null);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/functional_cloud/tests/index.ts b/x-pack/test/functional_cloud/tests/index.ts
new file mode 100644
index 0000000000000..c2609c5c2cac3
--- /dev/null
+++ b/x-pack/test/functional_cloud/tests/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('Cloud Integrations', function () {
+    loadTestFile(require.resolve('./cloud_links'));
+  });
+}

From 85b481bd38eeb4c2a0a3e6784d601d72774edc15 Mon Sep 17 00:00:00 2001
From: Aleksandr Maus <aleksandr.maus@elastic.co>
Date: Mon, 6 Feb 2023 13:23:21 -0500
Subject: [PATCH 006/134] Osquery: Update exported fields reference for osquery
 5.7.0 (#150216)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Update exported fields reference for osquery 5.7.0.

## Related PR

- Requires https://github.com/elastic/beats/pull/34468
- Requires https://github.com/elastic/integrations/pull/5175

Co-authored-by: Patryk Kopyciński <contact@patrykkopycinski.com>
---
 .../exported-fields-reference.asciidoc        | 142 ++++++++++++++----
 1 file changed, 113 insertions(+), 29 deletions(-)

diff --git a/docs/osquery/exported-fields-reference.asciidoc b/docs/osquery/exported-fields-reference.asciidoc
index c27b6e67a4062..fc16ec3e0d9d0 100644
--- a/docs/osquery/exported-fields-reference.asciidoc
+++ b/docs/osquery/exported-fields-reference.asciidoc
@@ -82,7 +82,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *activity* - keyword, number.long
 
-* _unified_log.activity_ - the activity ID associate with the entry.
+* _unified_log.activity_ - the activity ID associate with the entry
 
 *actual* - keyword, number.long
 
@@ -101,7 +101,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _arp_cache.address_ - IPv4 address target
 * _dns_resolvers.address_ - Resolver IP/IPv6 address
 * _etc_hosts.address_ - IP address mapping
-* _fbsd_kmods.address_ - Kernel module address
 * _interface_addresses.address_ - Specific address for interface
 * _kernel_modules.address_ - Kernel module address
 * _listening_ports.address_ - Specific address for bind
@@ -187,7 +186,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _deb_packages.arch_ - Package architecture
 * _docker_version.arch_ - Hardware architecture
 * _os_version.arch_ - OS Architecture
-* _pkg_packages.arch_ - Architecture(s) supported
 * _rpm_packages.arch_ - Architecture(s) supported
 * _seccomp_events.arch_ - Information about the CPU architecture
 * _signature.arch_ - If applicable, the arch of the signed code
@@ -247,6 +245,42 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _chassis_info.audible_alarm_ - If TRUE, the frame is equipped with an audible alarm.
 
+*audit_account_logon* - keyword, number.long
+
+* _security_profile_info.audit_account_logon_ - Determines whether the operating system MUST audit each time this computer validates the credentials of an account
+
+*audit_account_manage* - keyword, number.long
+
+* _security_profile_info.audit_account_manage_ - Determines whether the operating system MUST audit each event of account management on a computer
+
+*audit_ds_access* - keyword, number.long
+
+* _security_profile_info.audit_ds_access_ - Determines whether the operating system MUST audit each instance of user attempts to access an Active Directory object that has its own system access control list (SACL) specified
+
+*audit_logon_events* - keyword, number.long
+
+* _security_profile_info.audit_logon_events_ - Determines whether the operating system MUST audit each instance of a user attempt to log on or log off this computer
+
+*audit_object_access* - keyword, number.long
+
+* _security_profile_info.audit_object_access_ - Determines whether the operating system MUST audit each instance of user attempts to access a non-Active Directory object that has its own SACL specified
+
+*audit_policy_change* - keyword, number.long
+
+* _security_profile_info.audit_policy_change_ - Determines whether the operating system MUST audit each instance of user attempts to change user rights assignment policy, audit policy, account policy, or trust policy
+
+*audit_privilege_use* - keyword, number.long
+
+* _security_profile_info.audit_privilege_use_ - Determines whether the operating system MUST audit each instance of user attempts to exercise a user right
+
+*audit_process_tracking* - keyword, number.long
+
+* _security_profile_info.audit_process_tracking_ - Determines whether the operating system MUST audit process-related events
+
+*audit_system_events* - keyword, number.long
+
+* _security_profile_info.audit_system_events_ - Determines whether the operating system MUST audit System Change, System Startup, System Shutdown, Authentication Component Load, and Loss or Excess of Security events
+
 *auid* - keyword
 
 * _process_events.auid_ - Audit User ID at process start
@@ -625,7 +659,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _ntfs_journal_events.category_ - The category that the event originated from
 * _power_sensors.category_ - The sensor category: currents, voltage, wattage
 * _system_extensions.category_ - System extension category
-* _unified_log.category_ - The category of the os_log_t used
+* _unified_log.category_ - the category of the os_log_t used
 * _yara_events.category_ - The category of the file
 
 *cdhash* - keyword, text.text
@@ -731,6 +765,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _wmi_filter_consumer_binding.class_ - The name of the class.
 * _wmi_script_event_consumers.class_ - The name of the class.
 
+*clear_text_password* - keyword, number.long
+
+* _security_profile_info.clear_text_password_ - Determines whether passwords MUST be stored by using reversible encryption
+
 *client_app_id* - keyword, text.text
 
 * _windows_update_history.client_app_id_ - Identifier of the client application that processed an update
@@ -767,6 +805,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _os_version.codename_ - OS version codename
 
+*codesigning_flags* - keyword, text.text
+
+* _es_process_events.codesigning_flags_ - Codesigning flags matching one of these options, in a comma separated list: NOT_VALID, ADHOC, NOT_RUNTIME, INSTALLER. See kern/cs_blobs.h in XNU for descriptions.
+
 *collect_cross_processes* - keyword, number.long
 
 * _carbon_black_info.collect_cross_processes_ - If the sensor is configured to cross process events
@@ -848,7 +890,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _authorized_keys.comment_ - Optional comment
 * _docker_image_history.comment_ - Instruction comment
 * _etc_protocols.comment_ - Comment with protocol description
-* _etc_services.comment_ - Optional comment for a service
+* _etc_services.comment_ - Optional comment for a service.
 * _groups.comment_ - Remarks or comments associated with the group
 * _keychain_items.comment_ - Optional keychain comment
 
@@ -1092,7 +1134,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _docker_image_history.created_ - Time of creation as UNIX time
 * _docker_images.created_ - Time of creation as UNIX time
 * _docker_networks.created_ - Time of creation as UNIX time
-* _keychain_items.created_ - Data item was created
+* _keychain_items.created_ - Date item was created
 
 *created_at* - keyword, text.text
 
@@ -1590,6 +1632,14 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _processes.elevated_token_ - Process uses elevated token yes=1, no=0
 
+*enable_admin_account* - keyword, number.long
+
+* _security_profile_info.enable_admin_account_ - Determines whether the Administrator account on the local computer is enabled
+
+*enable_guest_account* - keyword, number.long
+
+* _security_profile_info.enable_guest_account_ - Determines whether the Guest account on the local computer is enabled
+
 *enable_ipv6* - keyword, number.long
 
 * _docker_networks.enable_ipv6_ - 1 if IPv6 is enabled on this network. 0 otherwise
@@ -1949,7 +1999,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *firmware_type* - keyword, text.text
 
-* _platform_info.firmware_type_ - The type of firmware (Uefi, Bios, Unknown).
+* _platform_info.firmware_type_ - The type of firmware (uefi, bios, iboot, openfirmware, unknown).
 
 *firmware_version* - keyword, text.text
 
@@ -1972,10 +2022,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _pipes.flags_ - The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes
 * _routes.flags_ - Flags to describe route
 
-*flatsize* - keyword, number.long
-
-* _pkg_packages.flatsize_ - Package size in bytes
-
 *folder_id* - keyword, text.text
 
 * _ycloud_instance_metadata.folder_id_ - Folder identifier for the VM
@@ -1984,6 +2030,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _systemd_units.following_ - The name of another unit that this unit follows in state
 
+*force_logoff_when_expire* - keyword, number.long
+
+* _security_profile_info.force_logoff_when_expire_ - Determines whether SMB client sessions with the SMB server will be forcibly disconnected when the client's logon hours expire
+
 *forced* - keyword, number.long
 
 * _preferences.forced_ - 1 if the value is forced/managed, else 0
@@ -2250,7 +2300,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *hostname* - keyword, text.text
 
-* _curl_certificate.hostname_ - Hostname to CURL (domain[:port], for example, osquery.io)
+* _curl_certificate.hostname_ - Hostname to CURL (domain[:port], e.g. osquery.io)
 * _system_info.hostname_ - Network hostname including domain
 * _ycloud_instance_metadata.hostname_ - Hostname of the VM
 
@@ -2626,7 +2676,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *is_active* - keyword, number.long
 
-* _running_apps.is_active_ - 1 if the application is in focus, 0 otherwise
+* _running_apps.is_active_ - (DEPRECATED)
 
 *is_hidden* - keyword, number.long
 
@@ -2949,6 +2999,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _shared_memory.locked_ - 1 if segment is locked else 0
 
+*lockout_bad_count* - keyword, number.long
+
+* _security_profile_info.lockout_bad_count_ - Number of failed logon attempts after which a user account MUST be locked out
+
 *log_file_disk_quota_mb* - keyword, number.long
 
 * _carbon_black_info.log_file_disk_quota_mb_ - Event file disk quota in MB
@@ -2997,10 +3051,18 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _logon_sessions.logon_time_ - The time the session owner logged on.
 
+*logon_to_change_password* - keyword, number.long
+
+* _security_profile_info.logon_to_change_password_ - Determines if logon session is required to change the password
+
 *logon_type* - keyword, text.text
 
 * _logon_sessions.logon_type_ - The logon method.
 
+*lsa_anonymous_name_lookup* - keyword, number.long
+
+* _security_profile_info.lsa_anonymous_name_lookup_ - Determines if an anonymous user is allowed to query the local LSA policy
+
 *mac* - keyword, text.text
 
 * _arp_cache.mac_ - MAC address of broadcasted address
@@ -3110,7 +3172,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *max_rows* - keyword, number.long
 
-* _unified_log.max_rows_ - The max number of rows returned (defaults to 100).
+* _unified_log.max_rows_ - the max number of rows returned (defaults to 100)
 
 *max_speed* - keyword, number.long
 
@@ -3124,6 +3186,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _shared_resources.maximum_allowed_ - Limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum property is set to FALSE.
 
+*maximum_password_age* - keyword, number.long
+
+* _security_profile_info.maximum_password_age_ - Determines the maximum number of days that a password can be used before the client requires the user to change it
+
 *md5* - keyword, text.text
 
 * _acpi_tables.md5_ - MD5 hash of table content
@@ -3240,7 +3306,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _lxd_cluster_members.message_ - Message from the node (Online/Offline)
 * _selinux_events.message_ - Message
 * _syslog_events.message_ - The syslog message
-* _unified_log.message_ - Composed message
+* _unified_log.message_ - composed message
 * _user_events.message_ - Message from the event
 
 *metadata_endpoint* - keyword, text.text
@@ -3297,6 +3363,14 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _memory_devices.min_voltage_ - Minimum operating voltage of device in millivolts
 
+*minimum_password_age* - keyword, number.long
+
+* _security_profile_info.minimum_password_age_ - Determines the minimum number of days that a password must be used before the user can change it
+
+*minimum_password_length* - keyword, number.long
+
+* _security_profile_info.minimum_password_length_ - Determines the least number of characters that can make up a password for a user account
+
 *minimum_system_version* - keyword, text.text
 
 * _apps.minimum_system_version_ - Minimum version of macOS required for the app to run
@@ -3459,7 +3533,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _etc_protocols.name_ - Protocol name
 * _etc_services.name_ - Service name
 * _fan_speed_sensors.name_ - Fan name
-* _fbsd_kmods.name_ - Module name
 * _firefox_addons.name_ - Addon display name
 * _homebrew_packages.name_ - Package name
 * _ie_extensions.name_ - Extension display name
@@ -3491,7 +3564,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _package_install_history.name_ - Package display name
 * _physical_disk_performance.name_ - Name of the physical disk
 * _pipes.name_ - Name of the pipe
-* _pkg_packages.name_ - Package name
 * _power_sensors.name_ - Name of power source
 * _processes.name_ - The process path or shorthand argv[0]
 * _programs.name_ - Commonly used product name.
@@ -3529,7 +3601,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *native* - keyword, number.long
 
 * _browser_plugins.native_ - Plugin requires native execution
-* _firefox_addons.native_ - 1 If the addon includes binary components else 0
 
 *net_namespace* - keyword, text.text
 
@@ -3561,6 +3632,14 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _docker_container_stats.network_tx_bytes_ - Total network bytes transmitted
 
+*new_administrator_name* - keyword, text.text
+
+* _security_profile_info.new_administrator_name_ - Determines the name of the Administrator account on the local computer
+
+*new_guest_name* - keyword, text.text
+
+* _security_profile_info.new_guest_name_ - Determines the name of the Guest account on the local computer
+
 *next_run_time* - keyword, number.long
 
 * _scheduled_tasks.next_run_time_ - Timestamp the task is scheduled to run next
@@ -3916,6 +3995,14 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _wifi_networks.passpoint_ - 1 if Passpoint is supported, 0 otherwise
 
+*password_complexity* - keyword, number.long
+
+* _security_profile_info.password_complexity_ - Determines whether passwords must meet a series of strong-password guidelines
+
+*password_history_size* - keyword, number.long
+
+* _security_profile_info.password_history_size_ - Number of unique new passwords that must be associated with a user account before an old password can be reused
+
 *password_last_set_time* - keyword, number.double
 
 * _account_policy_data.password_last_set_time_ - The time the password was last changed
@@ -4150,10 +4237,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _processes.pid_ - Process (or thread) ID
 * _running_apps.pid_ - The pid of the application
 * _seccomp_events.pid_ - Process ID
-* _services.pid_ - The Process ID of the service
+* _services.pid_ - the Process ID of the service
 * _shared_memory.pid_ - Process ID to last use the segment
 * _socket_events.pid_ - Process (or thread) ID
-* _unified_log.pid_ - The pid of the process that made the entry
+* _unified_log.pid_ - the pid of the process that made the entry
 * _user_events.pid_ - Process (or thread) ID
 * _windows_crashes.pid_ - Process ID of the crashed process
 * _windows_eventlog.pid_ - Process ID which emitted the event record
@@ -4327,7 +4414,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *process* - keyword, text.text
 
 * _alf_explicit_auths.process_ - Process name explicitly allowed
-* _unified_log.process_ - The name of the process that made the entry
+* _unified_log.process_ - the name of the process that made the entry
 
 *process_being_tapped* - keyword, number.long
 
@@ -4560,7 +4647,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *refs* - keyword, number.long
 
-* _fbsd_kmods.refs_ - Module reverse dependencies
 * _kernel_extensions.refs_ - Reference count
 
 *region* - keyword, text.text
@@ -4875,7 +4961,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *sender* - keyword, text.text
 
 * _asl.sender_ - Sender's identification string.  Default is process name.
-* _unified_log.sender_ - The name of the binary image that made the entry
+* _unified_log.sender_ - the name of the binary image that made the entry
 
 *sensor_backend_server* - keyword, text.text
 
@@ -5101,7 +5187,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _device_file.size_ - Size of file in bytes
 * _disk_events.size_ - Size of partition in bytes
 * _docker_image_history.size_ - Size of instruction in bytes
-* _fbsd_kmods.size_ - Size of module content
 * _file.size_ - Size of file in bytes
 * _file_events.size_ - Size of file in bytes
 * _kernel_extensions.size_ - Bytes of wired memory used by extension
@@ -5337,7 +5422,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *storage* - keyword, number.long
 
-* _unified_log.storage_ - The storage category for the entry.
+* _unified_log.storage_ - the storage category for the entry
 
 *storage_driver* - keyword, text.text
 
@@ -5416,7 +5501,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *subsystem* - keyword, text.text
 
 * _system_controls.subsystem_ - Subsystem ID, control type
-* _unified_log.subsystem_ - The subsystem of the os_log_t used
+* _unified_log.subsystem_ - the subsystem of the os_log_t used
 
 *subsystem_model* - keyword, text.text
 
@@ -5585,7 +5670,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _bpf_process_events.tid_ - Thread ID
 * _bpf_socket_events.tid_ - Thread ID
-* _unified_log.tid_ - The tid of the thread that made the entry
+* _unified_log.tid_ - the tid of the thread that made the entry
 * _windows_crashes.tid_ - Thread ID of the crashed thread
 * _windows_eventlog.tid_ - Thread ID which emitted the event record
 
@@ -5637,7 +5722,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *timestamp* - keyword, text.text
 
 * _time.timestamp_ - Current timestamp (log format) in UTC
-* _unified_log.timestamp_ - Unix timestamp associated with the entry
+* _unified_log.timestamp_ - unix timestamp associated with the entry
 * _windows_eventlog.timestamp_ - Timestamp to selectively filter the events
 
 *timestamp_ms* - keyword, number.long
@@ -6078,7 +6163,6 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _osquery_packs.version_ - Minimum osquery version that this query will run on
 * _package_install_history.version_ - Package display version
 * _package_receipts.version_ - Installed package version
-* _pkg_packages.version_ - Package version
 * _platform_info.version_ - Platform code version
 * _portage_keywords.version_ - The version which are affected by the use flags, empty means all
 * _portage_packages.version_ - The version which are affected by the use flags, empty means all

From 551f0f9e5c9b5c48613004976c6ed89989936448 Mon Sep 17 00:00:00 2001
From: Drew Tate <andrew.tate@elastic.co>
Date: Mon, 6 Feb 2023 13:11:41 -0600
Subject: [PATCH 007/134] [Lens] don't block render on missing sort field
 (#150356)

---
 .../form_based/operations/definitions/last_value.test.tsx      | 3 ---
 .../form_based/operations/definitions/last_value.tsx           | 1 -
 2 files changed, 4 deletions(-)

diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.test.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.test.tsx
index be43974b7ba44..3471c82a43fa4 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.test.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.test.tsx
@@ -980,9 +980,6 @@ describe('last_value', () => {
                 "dimensionId": "col1",
                 "id": "dimensionButton",
               },
-              Object {
-                "id": "visualization",
-              },
               Object {
                 "id": "embeddableBadge",
               },
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.tsx
index 46a9335f20d1c..1f0e50ecb2ac6 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.tsx
@@ -86,7 +86,6 @@ function getInvalidSortFieldMessage(
       displayLocations: [
         { id: 'toolbar' },
         { id: 'dimensionButton', dimensionId: columnId },
-        { id: 'visualization' },
         { id: 'embeddableBadge' },
       ],
     };

From a290e4038fee6e25dc3674dae4861e875be81465 Mon Sep 17 00:00:00 2001
From: Sander Philipse <94373878+sphilipse@users.noreply.github.com>
Date: Mon, 6 Feb 2023 20:14:09 +0100
Subject: [PATCH 008/134] [Enterprise Search] Add toggle for HTML extraction
 (#150352)

## Summary
This adds a toggle to enable/disable full html extraction for Elastic
crawlers.


https://user-images.githubusercontent.com/94373878/217030130-8b377aad-dbbf-4b55-87ae-b0a94ac060a6.mov
---
 .../common/types/connectors.ts                |   4 +-
 .../update_html_extraction_api_logic.test.ts  |  36 ++++++
 .../update_html_extraction_api_logic.ts       |  44 +++++++
 .../crawler_configuration.tsx                 | 107 ++++++++++++++++++
 .../crawler_configuration_logic.ts            |  85 ++++++++++++++
 .../search_index/index_view_logic.ts          |   6 +
 .../components/search_index/search_index.tsx  |  12 ++
 .../lib/crawler/put_html_extraction.test.ts   |  51 +++++++++
 .../server/lib/crawler/put_html_extraction.ts |  32 ++++++
 .../enterprise_search/crawler/crawler.ts      |  40 +++++++
 10 files changed, 416 insertions(+), 1 deletion(-)
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/crawler/update_html_extraction_api_logic.test.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/crawler/update_html_extraction_api_logic.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/crawler/crawler_configuration/crawler_configuration.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/crawler/crawler_configuration/crawler_configuration_logic.ts
 create mode 100644 x-pack/plugins/enterprise_search/server/lib/crawler/put_html_extraction.test.ts
 create mode 100644 x-pack/plugins/enterprise_search/server/lib/crawler/put_html_extraction.ts

diff --git a/x-pack/plugins/enterprise_search/common/types/connectors.ts b/x-pack/plugins/enterprise_search/common/types/connectors.ts
index 87ccbad824e1f..78f3f9e6a51e4 100644
--- a/x-pack/plugins/enterprise_search/common/types/connectors.ts
+++ b/x-pack/plugins/enterprise_search/common/types/connectors.ts
@@ -10,7 +10,9 @@ export interface KeyValuePair {
   value: string | null;
 }
 
-export type ConnectorConfiguration = Record<string, KeyValuePair | null>;
+export type ConnectorConfiguration = Record<string, KeyValuePair | null> & {
+  extract_full_html?: { label: string; value: boolean };
+};
 
 export interface ConnectorScheduling {
   enabled: boolean;
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/crawler/update_html_extraction_api_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/crawler/update_html_extraction_api_logic.test.ts
new file mode 100644
index 0000000000000..163a29e07f42e
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/crawler/update_html_extraction_api_logic.test.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { mockHttpValues } from '../../../__mocks__/kea_logic';
+
+import { updateHtmlExtraction } from './update_html_extraction_api_logic';
+
+describe('UpdateHtmlExtractionApiLogic', () => {
+  const { http } = mockHttpValues;
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+  describe('updateHtmlExtraction', () => {
+    it('calls correct api', async () => {
+      const indexName = 'elastic-co-crawler';
+
+      http.get.mockReturnValue(Promise.resolve());
+
+      const result = updateHtmlExtraction({ htmlExtraction: true, indexName });
+
+      expect(http.put).toHaveBeenCalledWith(
+        `/internal/enterprise_search/indices/${indexName}/crawler/html_extraction`,
+        {
+          body: JSON.stringify({
+            extract_full_html: true,
+          }),
+        }
+      );
+      await expect(result).resolves.toEqual({ htmlExtraction: true });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/crawler/update_html_extraction_api_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/crawler/update_html_extraction_api_logic.ts
new file mode 100644
index 0000000000000..e6ddcc5f82071
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/crawler/update_html_extraction_api_logic.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Actions } from '../../../shared/api_logic/create_api_logic';
+
+import { createApiLogic } from '../../../shared/api_logic/create_api_logic';
+import { HttpLogic } from '../../../shared/http';
+
+export interface UpdateHtmlExtractionArgs {
+  htmlExtraction: boolean;
+  indexName: string;
+}
+
+export interface UpdateHtmlExtractionResponse {
+  htmlExtraction: boolean;
+}
+
+export const updateHtmlExtraction = async ({
+  htmlExtraction,
+  indexName,
+}: UpdateHtmlExtractionArgs) => {
+  const route = `/internal/enterprise_search/indices/${indexName}/crawler/html_extraction`;
+
+  const params = { extract_full_html: htmlExtraction };
+
+  await HttpLogic.values.http.put(route, {
+    body: JSON.stringify(params),
+  });
+  return { htmlExtraction };
+};
+
+export const UpdateHtmlExtractionApiLogic = createApiLogic(
+  ['update_html_extraction_api_logic'],
+  updateHtmlExtraction
+);
+
+export type UpdateHtmlExtractionActions = Actions<
+  UpdateHtmlExtractionArgs,
+  UpdateHtmlExtractionResponse
+>;
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/crawler/crawler_configuration/crawler_configuration.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/crawler/crawler_configuration/crawler_configuration.tsx
new file mode 100644
index 0000000000000..4741525a85b72
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/crawler/crawler_configuration/crawler_configuration.tsx
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { useActions, useValues } from 'kea';
+
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLink,
+  EuiSpacer,
+  EuiSplitPanel,
+  EuiSwitch,
+  EuiText,
+  EuiTitle,
+} from '@elastic/eui';
+
+import { i18n } from '@kbn/i18n';
+
+import { Status } from '../../../../../../../common/types/api';
+
+import { IndexViewLogic } from '../../index_view_logic';
+
+import { CrawlerConfigurationLogic } from './crawler_configuration_logic';
+
+export const CrawlerConfiguration: React.FC = () => {
+  const { htmlExtraction } = useValues(IndexViewLogic);
+  const { status } = useValues(CrawlerConfigurationLogic);
+  const { updateHtmlExtraction } = useActions(CrawlerConfigurationLogic);
+  return (
+    <>
+      <EuiSpacer />
+      <EuiSplitPanel.Outer hasBorder hasShadow={false}>
+        <EuiSplitPanel.Inner>
+          <EuiTitle size="s">
+            <h3>
+              {i18n.translate(
+                'xpack.enterpriseSearch.content.crawler.crawlerConfiguration.extractHTML.title',
+                { defaultMessage: 'Store full HTML' }
+              )}
+            </h3>
+          </EuiTitle>
+          <EuiSpacer />
+          <EuiText size="s">
+            <p>
+              {i18n.translate(
+                'xpack.enterpriseSearch.content.crawler.crawlerConfiguration.extractHTML.addExtraFieldDescription',
+                {
+                  defaultMessage:
+                    'Add an extra field in all documents with the value of the full HTML of the page being crawled.',
+                }
+              )}
+            </p>
+          </EuiText>
+          <EuiSpacer />
+          <EuiText size="s">
+            <p>
+              {i18n.translate(
+                'xpack.enterpriseSearch.content.crawler.crawlerConfiguration.extractHTML.increasedSizeWarning',
+                {
+                  defaultMessage:
+                    'This may dramatically increase the index size if the site being crawled is large.',
+                }
+              )}
+            </p>
+          </EuiText>
+        </EuiSplitPanel.Inner>
+        <EuiSplitPanel.Inner color="subdued">
+          <EuiFlexGroup>
+            <EuiFlexItem grow={false}>
+              <EuiSwitch
+                data-telemetry-id="entSearchContent-crawler-configuration-extractHtml"
+                label={i18n.translate(
+                  'xpack.enterpriseSearch.content.crawler.crawlerConfiguration.extractHTML.extractionSwitchLabel',
+                  {
+                    defaultMessage: 'Content extraction.',
+                  }
+                )}
+                disabled={status === Status.LOADING}
+                checked={htmlExtraction ?? false}
+                onChange={(event) => updateHtmlExtraction(event.target.checked)}
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiLink
+                href="TODO"
+                data-telemetry-id="entSearchContent-crawler-configuration-learnMoreExtraction"
+              >
+                {i18n.translate(
+                  'xpack.enterpriseSearch.content.crawler.crawlerConfiguration.extractHTML.learnMoreLink',
+                  {
+                    defaultMessage: 'Learn more about storing full HTML.',
+                  }
+                )}
+              </EuiLink>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiSplitPanel.Inner>
+      </EuiSplitPanel.Outer>
+    </>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/crawler/crawler_configuration/crawler_configuration_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/crawler/crawler_configuration/crawler_configuration_logic.ts
new file mode 100644
index 0000000000000..9298ca3b32585
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/crawler/crawler_configuration/crawler_configuration_logic.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { kea, MakeLogicType } from 'kea';
+
+import { Status } from '../../../../../../../common/types/api';
+import { Connector } from '../../../../../../../common/types/connectors';
+
+import {
+  UpdateHtmlExtractionActions,
+  UpdateHtmlExtractionApiLogic,
+} from '../../../../api/crawler/update_html_extraction_api_logic';
+import { CachedFetchIndexApiLogicActions } from '../../../../api/index/cached_fetch_index_api_logic';
+import { isCrawlerIndex } from '../../../../utils/indices';
+import { IndexViewLogic } from '../../index_view_logic';
+
+interface CrawlerConfigurationLogicActions {
+  apiError: UpdateHtmlExtractionActions['apiError'];
+  apiSuccess: UpdateHtmlExtractionActions['apiSuccess'];
+  fetchIndex: () => void;
+  fetchIndexApiSuccess: CachedFetchIndexApiLogicActions['apiSuccess'];
+  htmlExtraction: boolean;
+  makeRequest: UpdateHtmlExtractionActions['makeRequest'];
+  updateHtmlExtraction(htmlExtraction: boolean): { htmlExtraction: boolean };
+}
+
+interface CrawlerConfigurationLogicValues {
+  connector: Connector | undefined;
+  indexName: string;
+  localHtmlExtraction: boolean | null;
+  status: Status;
+}
+
+export const CrawlerConfigurationLogic = kea<
+  MakeLogicType<CrawlerConfigurationLogicValues, CrawlerConfigurationLogicActions>
+>({
+  actions: {
+    updateHtmlExtraction: (htmlExtraction) => ({ htmlExtraction }),
+  },
+  connect: {
+    actions: [
+      IndexViewLogic,
+      ['fetchIndex', 'fetchIndexApiSuccess'],
+      UpdateHtmlExtractionApiLogic,
+      ['apiSuccess', 'makeRequest'],
+    ],
+    values: [IndexViewLogic, ['connector', 'indexName'], UpdateHtmlExtractionApiLogic, ['status']],
+  },
+  listeners: ({ actions, values }) => ({
+    apiSuccess: () => {
+      actions.fetchIndex();
+    },
+    updateHtmlExtraction: ({ htmlExtraction }) => {
+      actions.makeRequest({ htmlExtraction, indexName: values.indexName });
+    },
+  }),
+  path: ['enterprise_search', 'search_index', 'crawler', 'configuration'],
+  reducers: {
+    localHtmlExtraction: [
+      null,
+      {
+        apiSuccess: (_, { htmlExtraction }) => htmlExtraction,
+        fetchIndexApiSuccess: (_, index) => {
+          if (isCrawlerIndex(index)) {
+            return index.connector.configuration.extract_full_html?.value ?? null;
+          }
+          return null;
+        },
+      },
+    ],
+  },
+  selectors: ({ selectors }) => ({
+    htmlExtraction: [
+      () => [selectors.connector, selectors.localHtmlExtraction],
+      (connector: Connector | null, localHtmlExtraction: boolean | null) =>
+        localHtmlExtraction !== null
+          ? localHtmlExtraction
+          : connector?.configuration.extract_full_html?.value ?? false,
+    ],
+  }),
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/index_view_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/index_view_logic.ts
index 26c1f823b479d..4ed5b7cef1b41 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/index_view_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/index_view_logic.ts
@@ -70,6 +70,7 @@ export interface IndexViewValues {
   hasAdvancedFilteringFeature: boolean;
   hasBasicFilteringFeature: boolean;
   hasFilteringFeature: boolean;
+  htmlExtraction: boolean | undefined;
   index: ElasticsearchViewIndex | undefined;
   indexData: typeof CachedFetchIndexApiLogic.values.indexData;
   indexName: string;
@@ -214,6 +215,11 @@ export const IndexViewLogic = kea<MakeLogicType<IndexViewValues, IndexViewAction
       () => [selectors.hasAdvancedFilteringFeature, selectors.hasBasicFilteringFeature],
       (advancedFeature: boolean, basicFeature: boolean) => advancedFeature || basicFeature,
     ],
+    htmlExtraction: [
+      () => [selectors.connector],
+      (connector: Connector | undefined) =>
+        connector?.configuration.extract_full_html?.value ?? undefined,
+    ],
     index: [
       () => [selectors.indexData],
       (data: IndexViewValues['indexData']) => (data ? indexToViewIndex(data) : undefined),
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/search_index.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/search_index.tsx
index 5c5b691d42ce1..b09a0a9d8a96a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/search_index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/search_index.tsx
@@ -36,6 +36,7 @@ import { ConnectorSchedulingComponent } from './connector/connector_scheduling';
 import { ConnectorSyncRules } from './connector/sync_rules/connector_rules';
 import { AutomaticCrawlScheduler } from './crawler/automatic_crawl_scheduler/automatic_crawl_scheduler';
 import { CrawlCustomSettingsFlyout } from './crawler/crawl_custom_settings_flyout/crawl_custom_settings_flyout';
+import { CrawlerConfiguration } from './crawler/crawler_configuration/crawler_configuration';
 import { SearchIndexDomainManagement } from './crawler/domain_management/domain_management';
 import { SearchIndexDocuments } from './documents';
 import { SearchIndexIndexMappings } from './index_mappings';
@@ -56,6 +57,7 @@ export enum SearchIndexTabId {
   SCHEDULING = 'scheduling',
   // crawler indices
   DOMAIN_MANAGEMENT = 'domain_management',
+  CRAWLER_CONFIGURATION = 'crawler_configuration',
 }
 
 export const SearchIndex: React.FC = () => {
@@ -164,6 +166,16 @@ export const SearchIndex: React.FC = () => {
         defaultMessage: 'Manage Domains',
       }),
     },
+    {
+      content: <CrawlerConfiguration />,
+      id: SearchIndexTabId.CRAWLER_CONFIGURATION,
+      name: i18n.translate(
+        'xpack.enterpriseSearch.content.searchIndex.crawlerConfigurationTabLabel',
+        {
+          defaultMessage: 'Configuration',
+        }
+      ),
+    },
     {
       content: <AutomaticCrawlScheduler />,
       id: SearchIndexTabId.SCHEDULING,
diff --git a/x-pack/plugins/enterprise_search/server/lib/crawler/put_html_extraction.test.ts b/x-pack/plugins/enterprise_search/server/lib/crawler/put_html_extraction.test.ts
new file mode 100644
index 0000000000000..d859d9639b2b6
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/server/lib/crawler/put_html_extraction.test.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IScopedClusterClient } from '@kbn/core/server';
+
+import { CONNECTORS_INDEX } from '../..';
+import { Connector } from '../../../common/types/connectors';
+
+import { updateHtmlExtraction } from './put_html_extraction';
+
+describe('updateHtmlExtraction lib function', () => {
+  const mockClient = {
+    asCurrentUser: {
+      update: jest.fn(),
+    },
+    asInternalUser: {},
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should update connector configuration', async () => {
+    mockClient.asCurrentUser.update.mockResolvedValue(true);
+    const mockConnector = {
+      configuration: { test: { label: 'haha', value: 'this' } },
+      id: 'connectorId',
+    };
+
+    await updateHtmlExtraction(
+      mockClient as unknown as IScopedClusterClient,
+      true,
+      mockConnector as any as Connector
+    );
+    expect(mockClient.asCurrentUser.update).toHaveBeenCalledWith({
+      doc: {
+        configuration: {
+          ...mockConnector.configuration,
+          extract_full_html: { label: 'Extract full HTML', value: true },
+        },
+      },
+      id: 'connectorId',
+      index: CONNECTORS_INDEX,
+      refresh: 'wait_for',
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/server/lib/crawler/put_html_extraction.ts b/x-pack/plugins/enterprise_search/server/lib/crawler/put_html_extraction.ts
new file mode 100644
index 0000000000000..bf7c18a575853
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/server/lib/crawler/put_html_extraction.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IScopedClusterClient } from '@kbn/core-elasticsearch-server';
+
+import { CONNECTORS_INDEX } from '../..';
+import { Connector } from '../../../common/types/connectors';
+
+export async function updateHtmlExtraction(
+  client: IScopedClusterClient,
+  htmlExtraction: boolean,
+  connector: Connector
+) {
+  return await client.asCurrentUser.update({
+    doc: {
+      configuration: {
+        ...connector.configuration,
+        extract_full_html: {
+          label: 'Extract full HTML',
+          value: htmlExtraction,
+        },
+      },
+    },
+    id: connector.id,
+    index: CONNECTORS_INDEX,
+    refresh: 'wait_for',
+  });
+}
diff --git a/x-pack/plugins/enterprise_search/server/routes/enterprise_search/crawler/crawler.ts b/x-pack/plugins/enterprise_search/server/routes/enterprise_search/crawler/crawler.ts
index c3b034f0b6ce7..08cea961709fc 100644
--- a/x-pack/plugins/enterprise_search/server/routes/enterprise_search/crawler/crawler.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/enterprise_search/crawler/crawler.ts
@@ -6,6 +6,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+
 import { i18n } from '@kbn/i18n';
 
 import { ENTERPRISE_SEARCH_CONNECTOR_CRAWLER_SERVICE_TYPE } from '../../../../common/constants';
@@ -15,6 +16,7 @@ import { addConnector } from '../../../lib/connectors/add_connector';
 import { deleteConnectorById } from '../../../lib/connectors/delete_connector';
 import { fetchConnectorByIndexName } from '../../../lib/connectors/fetch_connectors';
 import { fetchCrawlerByIndexName } from '../../../lib/crawler/fetch_crawlers';
+import { updateHtmlExtraction } from '../../../lib/crawler/put_html_extraction';
 import { deleteIndex } from '../../../lib/indices/delete_index';
 import { RouteDependencies } from '../../../plugin';
 import { createError } from '../../../utils/create_error';
@@ -389,6 +391,44 @@ export function registerCrawlerRoutes(routeDependencies: RouteDependencies) {
     })
   );
 
+  router.put(
+    {
+      path: '/internal/enterprise_search/indices/{indexName}/crawler/html_extraction',
+      validate: {
+        body: schema.object({
+          extract_full_html: schema.boolean(),
+        }),
+        params: schema.object({
+          indexName: schema.string(),
+        }),
+      },
+    },
+    elasticsearchErrorHandler(log, async (context, request, response) => {
+      const { client } = (await context.core).elasticsearch;
+
+      const connector = await fetchConnectorByIndexName(client, request.params.indexName);
+      if (
+        connector &&
+        connector.service_type === ENTERPRISE_SEARCH_CONNECTOR_CRAWLER_SERVICE_TYPE
+      ) {
+        await updateHtmlExtraction(client, request.body.extract_full_html, connector);
+        return response.ok();
+      } else {
+        return createError({
+          errorCode: ErrorCode.RESOURCE_NOT_FOUND,
+          message: i18n.translate(
+            'xpack.enterpriseSearch.server.routes.updateHtmlExtraction.noCrawlerFound',
+            {
+              defaultMessage: 'Could not find a crawler for this index',
+            }
+          ),
+          response,
+          statusCode: 404,
+        });
+      }
+    })
+  );
+
   registerCrawlerCrawlRulesRoutes(routeDependencies);
   registerCrawlerEntryPointRoutes(routeDependencies);
   registerCrawlerSitemapRoutes(routeDependencies);

From 6e36fdbe53451fa4ca8cbf86302a931f73b3d977 Mon Sep 17 00:00:00 2001
From: Kfir Peled <61654899+kfirpeled@users.noreply.github.com>
Date: Mon, 6 Feb 2023 21:44:15 +0200
Subject: [PATCH 009/134] [Cloud Security] added
 `/internal/cloud_security_posture/status` basic tests (#150102)

---
 .../plugins/cloud_security_posture/README.md  |   5 +
 .../apis/cloud_security_posture/index.ts      |   1 +
 .../apis/cloud_security_posture/status.ts     | 125 ++++++++++++++++++
 x-pack/test/tsconfig.json                     |   1 +
 4 files changed, 132 insertions(+)
 create mode 100644 x-pack/test/api_integration/apis/cloud_security_posture/status.ts

diff --git a/x-pack/plugins/cloud_security_posture/README.md b/x-pack/plugins/cloud_security_posture/README.md
index 7a4646d08ba07..a655d292c39ee 100755
--- a/x-pack/plugins/cloud_security_posture/README.md
+++ b/x-pack/plugins/cloud_security_posture/README.md
@@ -49,3 +49,8 @@ yarn test:ftr --config x-pack/test/cloud_security_posture_functional/config.ts
 
 > **Note**
 > in development, run them separately with `ftr:runner` and `ftr:server`
+
+```bash
+yarn test:ftr:server --config x-pack/test/api_integration/config.ts
+yarn test:ftr:runner --include-tag=cloud_security_posture --config x-pack/test/api_integration/config.ts
+```
\ No newline at end of file
diff --git a/x-pack/test/api_integration/apis/cloud_security_posture/index.ts b/x-pack/test/api_integration/apis/cloud_security_posture/index.ts
index 8b80e0d0eab0c..60dc074044ba1 100644
--- a/x-pack/test/api_integration/apis/cloud_security_posture/index.ts
+++ b/x-pack/test/api_integration/apis/cloud_security_posture/index.ts
@@ -10,6 +10,7 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function ({ loadTestFile }: FtrProviderContext) {
   describe('cloud_security_posture', function () {
     this.tags(['cloud_security_posture']);
+    loadTestFile(require.resolve('./status'));
 
     // Place your tests files under this directory and add the following here:
     // loadTestFile(require.resolve('./your test name'));
diff --git a/x-pack/test/api_integration/apis/cloud_security_posture/status.ts b/x-pack/test/api_integration/apis/cloud_security_posture/status.ts
new file mode 100644
index 0000000000000..6d10aa2f60f4a
--- /dev/null
+++ b/x-pack/test/api_integration/apis/cloud_security_posture/status.ts
@@ -0,0 +1,125 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import expect from '@kbn/expect';
+import type { CspSetupStatus } from '@kbn/cloud-security-posture-plugin/common/types';
+import type { SuperTest, Test } from 'supertest';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+  const kibanaServer = getService('kibanaServer');
+
+  describe('GET /internal/cloud_security_posture/status', () => {
+    let agentPolicyId: string;
+
+    beforeEach(async () => {
+      await kibanaServer.savedObjects.cleanStandardList();
+      await esArchiver.load('x-pack/test/functional/es_archives/fleet/empty_fleet_server');
+
+      const { body: agentPolicyResponse } = await supertest
+        .post(`/api/fleet/agent_policies`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({
+          name: 'Test policy',
+          namespace: 'default',
+        });
+      agentPolicyId = agentPolicyResponse.item.id;
+    });
+
+    afterEach(async () => {
+      await kibanaServer.savedObjects.cleanStandardList();
+      await esArchiver.unload('x-pack/test/functional/es_archives/fleet/empty_fleet_server');
+    });
+
+    it(`Should return not-deployed when installed kspm`, async () => {
+      await createPackagePolicy(
+        supertest,
+        agentPolicyId,
+        'kspm',
+        'cloudbeat/cis_k8s',
+        'vanilla',
+        'kspm'
+      );
+
+      const { body: res }: { body: CspSetupStatus } = await supertest
+        .get(`/internal/cloud_security_posture/status`)
+        .set('kbn-xsrf', 'xxxx')
+        .expect(200);
+
+      expect(res.status).to.be('not-deployed');
+      expect(res.installedPolicyTemplates).length(1).contain('kspm');
+      expect(res.healthyAgents).to.be(0);
+    });
+
+    it(`Should return not-deployed when installed cspm`, async () => {
+      await createPackagePolicy(
+        supertest,
+        agentPolicyId,
+        'cspm',
+        'cloudbeat/cis_aws',
+        'aws',
+        'cspm'
+      );
+
+      const { body: res }: { body: CspSetupStatus } = await supertest
+        .get(`/internal/cloud_security_posture/status`)
+        .set('kbn-xsrf', 'xxxx')
+        .expect(200);
+
+      expect(res.status).to.be('not-deployed');
+      expect(res.installedPolicyTemplates).length(1).contain('cspm');
+      expect(res.healthyAgents).to.be(0);
+    });
+  });
+}
+
+async function createPackagePolicy(
+  supertest: SuperTest<Test>,
+  agentPolicyId: string,
+  policyTemplate: string,
+  input: string,
+  deployment: string,
+  posture: string
+) {
+  const { body: postPackageResponse } = await supertest
+    .post(`/api/fleet/package_policies`)
+    .set('kbn-xsrf', 'xxxx')
+    .send({
+      force: true,
+      name: 'cloud_security_posture-1',
+      description: '',
+      namespace: 'default',
+      policy_id: agentPolicyId,
+      enabled: true,
+      inputs: [
+        {
+          enabled: true,
+          type: input,
+          policy_template: policyTemplate,
+        },
+      ],
+      package: {
+        name: 'cloud_security_posture',
+        title: 'Kubernetes Security Posture Management',
+        version: '1.2.8',
+      },
+      vars: {
+        deployment: {
+          value: deployment,
+          type: 'text',
+        },
+        posture: {
+          value: posture,
+          type: 'text',
+        },
+      },
+    })
+    .expect(200);
+
+  return postPackageResponse.item;
+}
diff --git a/x-pack/test/tsconfig.json b/x-pack/test/tsconfig.json
index 43f96bcd0c429..ef8c79b7b03ca 100644
--- a/x-pack/test/tsconfig.json
+++ b/x-pack/test/tsconfig.json
@@ -112,5 +112,6 @@
     "@kbn/stdio-dev-helpers",
     "@kbn/alerting-api-integration-helpers",
     "@kbn/securitysolution-ecs",
+    "@kbn/cloud-security-posture-plugin",
   ]
 }

From 78947c4c6f0638d25f38904d967b922aa1f99726 Mon Sep 17 00:00:00 2001
From: Jon <jon@elastic.co>
Date: Mon, 6 Feb 2023 13:52:01 -0600
Subject: [PATCH 010/134] Upgrade terser to 5.16.1 (#149702)

Also updates our renovate config to track this. Plan on adding a few
more build related dependencies.
---
 package.json  |  2 +-
 renovate.json | 11 +++++++++++
 yarn.lock     |  8 ++++----
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 049163e6dfd7c..c2613ebda6e76 100644
--- a/package.json
+++ b/package.json
@@ -1176,7 +1176,7 @@
     "svgo": "^2.8.0",
     "tape": "^5.0.1",
     "tempy": "^0.3.0",
-    "terser": "^5.15.1",
+    "terser": "^5.16.1",
     "terser-webpack-plugin": "^4.2.3",
     "tough-cookie": "^4.1.2",
     "tree-kill": "^1.2.2",
diff --git a/renovate.json b/renovate.json
index 932f0a6558864..ce12b9dd5a248 100644
--- a/renovate.json
+++ b/renovate.json
@@ -153,6 +153,17 @@
       "labels": ["Team:Operations", "release_note:skip", "backport:all-open"],
       "enabled": true
     },
+    {
+      "groupName": "minify",
+      "packageNames": [
+        "gulp-terser",
+        "terser"
+      ],
+      "reviewers": ["team:kibana-operations"],
+      "matchBaseBranches": ["main"],
+      "labels": ["Team:Operations", "release_note:skip"],
+      "enabled": true
+    },
     {
       "groupName": "@testing-library",
       "packageNames": [
diff --git a/yarn.lock b/yarn.lock
index fd2cb119a8198..77b529bdd0bcb 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -26175,10 +26175,10 @@ terser@^4.1.2, terser@^4.6.3:
     source-map "~0.6.1"
     source-map-support "~0.5.12"
 
-terser@^5.14.1, terser@^5.15.1, terser@^5.3.4, terser@^5.9.0:
-  version "5.15.1"
-  resolved "https://registry.yarnpkg.com/terser/-/terser-5.15.1.tgz#8561af6e0fd6d839669c73b92bdd5777d870ed6c"
-  integrity sha512-K1faMUvpm/FBxjBXud0LWVAGxmvoPbZbfTCYbSgaaYQaIXI3/TdI7a7ZGA73Zrou6Q8Zmz3oeUTsp/dj+ag2Xw==
+terser@^5.14.1, terser@^5.16.1, terser@^5.3.4, terser@^5.9.0:
+  version "5.16.1"
+  resolved "https://registry.yarnpkg.com/terser/-/terser-5.16.1.tgz#5af3bc3d0f24241c7fb2024199d5c461a1075880"
+  integrity sha512-xvQfyfA1ayT0qdK47zskQgRZeWLoOQ8JQ6mIgRGVNwZKdQMU+5FkCBjmv4QjcrTzyZquRw2FVtlJSRUmMKQslw==
   dependencies:
     "@jridgewell/source-map" "^0.3.2"
     acorn "^8.5.0"

From ebc1bc5242a317ad1b3fa92a80373590580ee3b2 Mon Sep 17 00:00:00 2001
From: Drew Tate <drew.tate@elastic.co>
Date: Mon, 6 Feb 2023 13:53:56 -0600
Subject: [PATCH 011/134] [Lens] suppress missing index toasts (#150345)

---
 x-pack/plugins/lens/public/data_views_service/loader.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/lens/public/data_views_service/loader.ts b/x-pack/plugins/lens/public/data_views_service/loader.ts
index abd8a48815122..bb27eec2076e3 100644
--- a/x-pack/plugins/lens/public/data_views_service/loader.ts
+++ b/x-pack/plugins/lens/public/data_views_service/loader.ts
@@ -176,7 +176,9 @@ export async function loadIndexPatterns({
   }
   indexPatterns.push(
     ...(await Promise.all(
-      Object.values(adHocDataViews || {}).map((spec) => dataViews.create(spec))
+      Object.values(adHocDataViews || {}).map((spec) =>
+        dataViews.create({ ...spec, allowNoIndex: true })
+      )
     ))
   );
 

From 148a49adb8378afc03f3b8d35fad4393a41def87 Mon Sep 17 00:00:00 2001
From: Dima Arnautov <dmitrii.arnautov@elastic.co>
Date: Mon, 6 Feb 2023 21:14:51 +0100
Subject: [PATCH 012/134] [Console] Replace global `GET /_mapping` request with
 `GET <index>/_mapping` (#147770)

## Summary

### Notes for reviewers

- Currently, autocomplete suggestions for fields don't work with
wildcards and data streams due to the
[bug](https://github.com/elastic/kibana/issues/149496) in the `main`. It
should be addressed separately.

### How to test

In order to spot the loading behaviour, ideally you should create an
index with a heavy mappings definition.
Afterwards, write a query that requires a field from this index, e.g.:

```
GET <my-index>/_search
{
  "aggs": {
    "my_agg": {
      "terms": {
        "field": "",
        "size": 10
      }
    }
  }
}
```

Place a cursor next to the `field` property, it should trigger mappings
fetch. After that, the mappings definition for this index will be cached
and accessed synchronously.

You can also open the browser's dev tools and enable Network throttling.
It allows noticing loading behaviour for any index.

--------------------

Resolves https://github.com/elastic/kibana/issues/146855

Instead of fetching all mappings upfront, requests mapping definition on
demand per index according to the cursor position.

Considering there is a maximum response size limit of 10MB in the
`/autocomplete_entities` endpoint, field autocompletion wasn't working
at all if the overall mappings definition exceeded this size. Retrieving
mappings per index tackles this and improves the init time.

![Jan-25-2023
17-16-31](https://user-images.githubusercontent.com/5236598/214616790-4954d005-e56f-49f9-be6d-435c076270a8.gif)

### Checklist

- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

---------

Co-authored-by: Jean-Louis Leysens <jloleysens@gmail.com>
---
 .../application/containers/editor/editor.tsx  |  15 +-
 .../console/public/application/index.tsx      |   2 +
 .../legacy_core_editor/legacy_core_editor.ts  |  30 +-
 .../models/sense_editor/integration.test.js   |  15 +-
 .../public/lib/autocomplete/autocomplete.ts   | 175 ++++++----
 .../console/public/lib/autocomplete/types.ts  |   9 +
 .../autocomplete_entities.test.js             | 318 +++++++++++-------
 .../lib/autocomplete_entities/mapping.ts      | 121 ++++++-
 .../console/public/services/autocomplete.ts   |   7 +-
 .../console/public/services/settings.ts       |   7 +-
 .../console/public/types/core_editor.ts       |   7 +-
 .../console/autocomplete_entities/index.ts    |  36 +-
 .../validation_config.ts                      |  33 ++
 src/plugins/console/tsconfig.json             |   1 +
 .../apis/console/autocomplete_entities.ts     |  12 +-
 15 files changed, 554 insertions(+), 234 deletions(-)
 create mode 100644 src/plugins/console/server/routes/api/console/autocomplete_entities/validation_config.ts

diff --git a/src/plugins/console/public/application/containers/editor/editor.tsx b/src/plugins/console/public/application/containers/editor/editor.tsx
index 93c11aa53c602..788039a2dc606 100644
--- a/src/plugins/console/public/application/containers/editor/editor.tsx
+++ b/src/plugins/console/public/application/containers/editor/editor.tsx
@@ -6,14 +6,14 @@
  * Side Public License, v 1.
  */
 
-import React, { useCallback, memo } from 'react';
+import React, { useCallback, memo, useEffect, useState } from 'react';
 import { debounce } from 'lodash';
 import { EuiProgress } from '@elastic/eui';
 
 import { EditorContentSpinner } from '../../components';
 import { Panel, PanelsContainer } from '..';
 import { Editor as EditorUI, EditorOutput } from './legacy/console_editor';
-import { StorageKeys } from '../../../services';
+import { getAutocompleteInfo, StorageKeys } from '../../../services';
 import { useEditorReadContext, useServicesContext, useRequestReadContext } from '../../contexts';
 import type { SenseEditor } from '../../models';
 
@@ -33,6 +33,15 @@ export const Editor = memo(({ loading, setEditorInstance }: Props) => {
   const { currentTextObject } = useEditorReadContext();
   const { requestInFlight } = useRequestReadContext();
 
+  const [fetchingMappings, setFetchingMappings] = useState(false);
+
+  useEffect(() => {
+    const subscription = getAutocompleteInfo().mapping.isLoading$.subscribe(setFetchingMappings);
+    return () => {
+      subscription.unsubscribe();
+    };
+  }, []);
+
   const [firstPanelWidth, secondPanelWidth] = storage.get(StorageKeys.WIDTH, [
     INITIAL_PANEL_WIDTH,
     INITIAL_PANEL_WIDTH,
@@ -50,7 +59,7 @@ export const Editor = memo(({ loading, setEditorInstance }: Props) => {
 
   return (
     <>
-      {requestInFlight ? (
+      {requestInFlight || fetchingMappings ? (
         <div className="conApp__requestProgressBarContainer">
           <EuiProgress size="xs" color="accent" position="absolute" />
         </div>
diff --git a/src/plugins/console/public/application/index.tsx b/src/plugins/console/public/application/index.tsx
index 1cf9a54210973..92d875b9db2a9 100644
--- a/src/plugins/console/public/application/index.tsx
+++ b/src/plugins/console/public/application/index.tsx
@@ -69,6 +69,8 @@ export function renderApp({
   const api = createApi({ http });
   const esHostService = createEsHostService({ api });
 
+  autocompleteInfo.mapping.setup(http, settings);
+
   render(
     <I18nContext>
       <KibanaThemeProvider theme$={theme$}>
diff --git a/src/plugins/console/public/application/models/legacy_core_editor/legacy_core_editor.ts b/src/plugins/console/public/application/models/legacy_core_editor/legacy_core_editor.ts
index 5def8a696df2f..5c041a95e216f 100644
--- a/src/plugins/console/public/application/models/legacy_core_editor/legacy_core_editor.ts
+++ b/src/plugins/console/public/application/models/legacy_core_editor/legacy_core_editor.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import ace from 'brace';
+import ace, { type Annotation } from 'brace';
 import { Editor as IAceEditor, IEditSession as IAceEditSession } from 'brace';
 import $ from 'jquery';
 import {
@@ -402,8 +402,7 @@ export class LegacyCoreEditor implements CoreEditor {
         getCompletions: (
           // eslint-disable-next-line @typescript-eslint/naming-convention
           DO_NOT_USE_1: IAceEditor,
-          // eslint-disable-next-line @typescript-eslint/naming-convention
-          DO_NOT_USE_2: IAceEditSession,
+          aceEditSession: IAceEditSession,
           pos: { row: number; column: number },
           prefix: string,
           callback: (...args: unknown[]) => void
@@ -412,7 +411,30 @@ export class LegacyCoreEditor implements CoreEditor {
             lineNumber: pos.row + 1,
             column: pos.column + 1,
           };
-          autocompleter(position, prefix, callback);
+
+          const getAnnotationControls = () => {
+            let customAnnotation: Annotation;
+            return {
+              setAnnotation(text: string) {
+                const annotations = aceEditSession.getAnnotations();
+                customAnnotation = {
+                  text,
+                  row: pos.row,
+                  column: pos.column,
+                  type: 'warning',
+                };
+
+                aceEditSession.setAnnotations([...annotations, customAnnotation]);
+              },
+              removeAnnotation() {
+                aceEditSession.setAnnotations(
+                  aceEditSession.getAnnotations().filter((a: Annotation) => a !== customAnnotation)
+                );
+              },
+            };
+          };
+
+          autocompleter(position, prefix, callback, getAnnotationControls());
         },
       },
     ]);
diff --git a/src/plugins/console/public/application/models/sense_editor/integration.test.js b/src/plugins/console/public/application/models/sense_editor/integration.test.js
index 434deb5456caf..08912871052ba 100644
--- a/src/plugins/console/public/application/models/sense_editor/integration.test.js
+++ b/src/plugins/console/public/application/models/sense_editor/integration.test.js
@@ -13,6 +13,9 @@ import $ from 'jquery';
 
 import * as kb from '../../../lib/kb/kb';
 import { AutocompleteInfo, setAutocompleteInfo } from '../../../services';
+import { httpServiceMock } from '@kbn/core-http-browser-mocks';
+import { StorageMock } from '../../../services/storage.mock';
+import { SettingsMock } from '../../../services/settings.mock';
 
 describe('Integration', () => {
   let senseEditor;
@@ -27,6 +30,15 @@ describe('Integration', () => {
     $(senseEditor.getCoreEditor().getContainer()).show();
     senseEditor.autocomplete._test.removeChangeListener();
     autocompleteInfo = new AutocompleteInfo();
+
+    const httpMock = httpServiceMock.createSetupContract();
+    const storage = new StorageMock({}, 'test');
+    const settingsMock = new SettingsMock(storage);
+
+    settingsMock.getAutocomplete.mockReturnValue({ fields: true });
+
+    autocompleteInfo.mapping.setup(httpMock, settingsMock);
+
     setAutocompleteInfo(autocompleteInfo);
   });
   afterEach(() => {
@@ -164,7 +176,8 @@ describe('Integration', () => {
             ac('textBoxPosition', posCompare);
             ac('rangeToReplace', rangeCompare);
             done();
-          }
+          },
+          { setAnnotation: () => {}, removeAnnotation: () => {} }
         );
       });
     });
diff --git a/src/plugins/console/public/lib/autocomplete/autocomplete.ts b/src/plugins/console/public/lib/autocomplete/autocomplete.ts
index 4e3770779f580..b24767b361d7e 100644
--- a/src/plugins/console/public/lib/autocomplete/autocomplete.ts
+++ b/src/plugins/console/public/lib/autocomplete/autocomplete.ts
@@ -593,7 +593,10 @@ export default function ({
         return null;
     }
 
-    if (!context.autoCompleteSet) {
+    const isMappingsFetchingInProgress =
+      context.autoCompleteType === 'body' && !!context.asyncResultsState?.isLoading;
+
+    if (!context.autoCompleteSet && !isMappingsFetchingInProgress) {
       return null; // nothing to do..
     }
 
@@ -1123,80 +1126,112 @@ export default function ({
     }
   }
 
+  /**
+   * Extracts terms from the autocomplete set.
+   * @param context
+   */
+  function getTerms(context: AutoCompleteContext, autoCompleteSet: ResultTerm[]) {
+    const terms = _.map(
+      autoCompleteSet.filter((term) => Boolean(term) && term.name != null),
+      function (term) {
+        if (typeof term !== 'object') {
+          term = {
+            name: term,
+          };
+        } else {
+          term = _.clone(term);
+        }
+        const defaults: {
+          value?: string;
+          meta: string;
+          score: number;
+          context: AutoCompleteContext;
+          completer?: { insertMatch: (v: unknown) => void };
+        } = {
+          value: term.name,
+          meta: 'API',
+          score: 0,
+          context,
+        };
+        // we only need our custom insertMatch behavior for the body
+        if (context.autoCompleteType === 'body') {
+          defaults.completer = {
+            insertMatch() {
+              return applyTerm(term);
+            },
+          };
+        }
+        return _.defaults(term, defaults);
+      }
+    );
+
+    terms.sort(function (
+      t1: { score: number; name?: string },
+      t2: { score: number; name?: string }
+    ) {
+      /* score sorts from high to low */
+      if (t1.score > t2.score) {
+        return -1;
+      }
+      if (t1.score < t2.score) {
+        return 1;
+      }
+      /* names sort from low to high */
+      if (t1.name! < t2.name!) {
+        return -1;
+      }
+      if (t1.name === t2.name) {
+        return 0;
+      }
+      return 1;
+    });
+
+    return terms;
+  }
+
+  function getSuggestions(terms: ResultTerm[]) {
+    return _.map(terms, function (t, i) {
+      t.insertValue = t.insertValue || t.value;
+      t.value = '' + t.value; // normalize to strings
+      t.score = -i;
+      return t;
+    });
+  }
+
   function getCompletions(
     position: Position,
     prefix: string,
-    callback: (e: Error | null, result: ResultTerm[] | null) => void
+    callback: (e: Error | null, result: ResultTerm[] | null) => void,
+    annotationControls: {
+      setAnnotation: (text: string) => void;
+      removeAnnotation: () => void;
+    }
   ) {
     try {
       const context = getAutoCompleteContext(editor, position);
+
       if (!context) {
         callback(null, []);
       } else {
-        const terms = _.map(
-          context.autoCompleteSet!.filter((term) => Boolean(term) && term.name != null),
-          function (term) {
-            if (typeof term !== 'object') {
-              term = {
-                name: term,
-              };
-            } else {
-              term = _.clone(term);
-            }
-            const defaults: {
-              value?: string;
-              meta: string;
-              score: number;
-              context: AutoCompleteContext;
-              completer?: { insertMatch: (v: unknown) => void };
-            } = {
-              value: term.name,
-              meta: 'API',
-              score: 0,
-              context,
-            };
-            // we only need our custom insertMatch behavior for the body
-            if (context.autoCompleteType === 'body') {
-              defaults.completer = {
-                insertMatch() {
-                  return applyTerm(term);
-                },
-              };
-            }
-            return _.defaults(term, defaults);
-          }
-        );
-
-        terms.sort(function (
-          t1: { score: number; name?: string },
-          t2: { score: number; name?: string }
-        ) {
-          /* score sorts from high to low */
-          if (t1.score > t2.score) {
-            return -1;
-          }
-          if (t1.score < t2.score) {
-            return 1;
-          }
-          /* names sort from low to high */
-          if (t1.name! < t2.name!) {
-            return -1;
-          }
-          if (t1.name === t2.name) {
-            return 0;
-          }
-          return 1;
-        });
-
-        callback(
-          null,
-          _.map(terms, function (t, i) {
-            t.insertValue = t.insertValue || t.value;
-            t.value = '' + t.value; // normalize to strings
-            t.score = -i;
-            return t;
-          })
-        );
+        if (!context.asyncResultsState?.isLoading) {
+          const terms = getTerms(context, context.autoCompleteSet!);
+          const suggestions = getSuggestions(terms);
+          callback(null, suggestions);
+        }
+
+        if (context.asyncResultsState) {
+          annotationControls.setAnnotation(
+            i18n.translate('console.autocomplete.fieldsFetchingAnnotation', {
+              defaultMessage: 'Fields fetching is in progress',
+            })
+          );
+
+          context.asyncResultsState.results.then((r) => {
+            const asyncSuggestions = getSuggestions(getTerms(context, r));
+            callback(null, asyncSuggestions);
+            annotationControls.removeAnnotation();
+          });
+        }
       }
     } catch (e) {
       // eslint-disable-next-line no-console
@@ -1216,8 +1251,12 @@ export default function ({
         _editSession: unknown,
         pos: Position,
         prefix: string,
-        callback: (e: Error | null, result: ResultTerm[] | null) => void
-      ) => getCompletions(pos, prefix, callback),
+        callback: (e: Error | null, result: ResultTerm[] | null) => void,
+        annotationControls: {
+          setAnnotation: (text: string) => void;
+          removeAnnotation: () => void;
+        }
+      ) => getCompletions(pos, prefix, callback, annotationControls),
       addReplacementInfoToContext,
       addChangeListener: () => editor.on('changeSelection', editorChangeListener),
       removeChangeListener: () => editor.off('changeSelection', editorChangeListener),
diff --git a/src/plugins/console/public/lib/autocomplete/types.ts b/src/plugins/console/public/lib/autocomplete/types.ts
index 15d32e6426a6c..a151c13f46c20 100644
--- a/src/plugins/console/public/lib/autocomplete/types.ts
+++ b/src/plugins/console/public/lib/autocomplete/types.ts
@@ -13,6 +13,7 @@ export interface ResultTerm {
   insertValue?: string;
   name?: string;
   value?: string;
+  score?: number;
 }
 
 export interface DataAutoCompleteRulesOneOf {
@@ -25,6 +26,14 @@ export interface DataAutoCompleteRulesOneOf {
 
 export interface AutoCompleteContext {
   autoCompleteSet?: null | ResultTerm[];
+  /**
+   * Stores a state for async results, e.g. fields suggestions based on the mappings definition.
+   */
+  asyncResultsState?: {
+    isLoading: boolean;
+    lastFetched: number | null;
+    results: Promise<ResultTerm[]>;
+  };
   endpoint?: null | {
     paramsAutocomplete: {
       getTopLevelComponents: (method?: string | null) => unknown;
diff --git a/src/plugins/console/public/lib/autocomplete_entities/autocomplete_entities.test.js b/src/plugins/console/public/lib/autocomplete_entities/autocomplete_entities.test.js
index 5349538799d9b..f856ef5750a17 100644
--- a/src/plugins/console/public/lib/autocomplete_entities/autocomplete_entities.test.js
+++ b/src/plugins/console/public/lib/autocomplete_entities/autocomplete_entities.test.js
@@ -9,6 +9,9 @@
 import '../../application/models/sense_editor/sense_editor.test.mocks';
 import { setAutocompleteInfo, AutocompleteInfo } from '../../services';
 import { expandAliases } from './expand_aliases';
+import { httpServiceMock } from '@kbn/core-http-browser-mocks';
+import { SettingsMock } from '../../services/settings.mock';
+import { StorageMock } from '../../services/storage.mock';
 
 function fc(f1, f2) {
   if (f1.name < f2.name) {
@@ -32,10 +35,20 @@ describe('Autocomplete entities', () => {
   let componentTemplate;
   let dataStream;
   let autocompleteInfo;
+  let settingsMock;
+  let httpMock;
+
   beforeEach(() => {
     autocompleteInfo = new AutocompleteInfo();
     setAutocompleteInfo(autocompleteInfo);
     mapping = autocompleteInfo.mapping;
+
+    httpMock = httpServiceMock.createSetupContract();
+    const storage = new StorageMock({}, 'test');
+    settingsMock = new SettingsMock(storage);
+
+    mapping.setup(httpMock, settingsMock);
+
     alias = autocompleteInfo.alias;
     legacyTemplate = autocompleteInfo.legacyTemplate;
     indexTemplate = autocompleteInfo.indexTemplate;
@@ -48,61 +61,98 @@ describe('Autocomplete entities', () => {
   });
 
   describe('Mappings', function () {
-    test('Multi fields 1.0 style', function () {
-      mapping.loadMappings({
-        index: {
-          properties: {
-            first_name: {
-              type: 'string',
-              index: 'analyzed',
-              path: 'just_name',
-              fields: {
-                any_name: { type: 'string', index: 'analyzed' },
-              },
-            },
-            last_name: {
-              type: 'string',
-              index: 'no',
-              fields: {
-                raw: { type: 'string', index: 'analyzed' },
+    describe('When fields autocomplete is disabled', () => {
+      beforeEach(() => {
+        settingsMock.getAutocomplete.mockReturnValue({ fields: false });
+      });
+
+      test('does not return any suggestions', function () {
+        mapping.loadMappings({
+          index: {
+            properties: {
+              first_name: {
+                type: 'string',
+                index: 'analyzed',
+                path: 'just_name',
+                fields: {
+                  any_name: { type: 'string', index: 'analyzed' },
+                },
               },
             },
           },
-        },
-      });
+        });
 
-      expect(mapping.getMappings('index').sort(fc)).toEqual([
-        f('any_name', 'string'),
-        f('first_name', 'string'),
-        f('last_name', 'string'),
-        f('last_name.raw', 'string'),
-      ]);
+        expect(mapping.getMappings('index').sort(fc)).toEqual([]);
+      });
     });
 
-    test('Simple fields', function () {
-      mapping.loadMappings({
-        index: {
-          properties: {
-            str: {
-              type: 'string',
-            },
-            number: {
-              type: 'int',
+    describe('When fields autocomplete is enabled', () => {
+      beforeEach(() => {
+        settingsMock.getAutocomplete.mockReturnValue({ fields: true });
+        httpMock.get.mockReturnValue(
+          Promise.resolve({
+            mappings: { index: { mappings: { properties: { '@timestamp': { type: 'date' } } } } },
+          })
+        );
+      });
+
+      test('attempts to fetch mappings if not loaded', async () => {
+        const autoCompleteContext = {};
+        let loadingIndicator;
+
+        mapping.isLoading$.subscribe((v) => {
+          loadingIndicator = v;
+        });
+
+        // act
+        mapping.getMappings('index', [], autoCompleteContext);
+
+        expect(autoCompleteContext.asyncResultsState.isLoading).toBe(true);
+        expect(loadingIndicator).toBe(true);
+
+        expect(httpMock.get).toHaveBeenCalled();
+
+        const fields = await autoCompleteContext.asyncResultsState.results;
+
+        expect(loadingIndicator).toBe(false);
+        expect(autoCompleteContext.asyncResultsState.isLoading).toBe(false);
+        expect(fields).toEqual([{ name: '@timestamp', type: 'date' }]);
+      });
+
+      test('Multi fields 1.0 style', function () {
+        mapping.loadMappings({
+          index: {
+            properties: {
+              first_name: {
+                type: 'string',
+                index: 'analyzed',
+                path: 'just_name',
+                fields: {
+                  any_name: { type: 'string', index: 'analyzed' },
+                },
+              },
+              last_name: {
+                type: 'string',
+                index: 'no',
+                fields: {
+                  raw: { type: 'string', index: 'analyzed' },
+                },
+              },
             },
           },
-        },
-      });
+        });
 
-      expect(mapping.getMappings('index').sort(fc)).toEqual([
-        f('number', 'int'),
-        f('str', 'string'),
-      ]);
-    });
+        expect(mapping.getMappings('index').sort(fc)).toEqual([
+          f('any_name', 'string'),
+          f('first_name', 'string'),
+          f('last_name', 'string'),
+          f('last_name.raw', 'string'),
+        ]);
+      });
 
-    test('Simple fields - 1.0 style', function () {
-      mapping.loadMappings({
-        index: {
-          mappings: {
+      test('Simple fields', function () {
+        mapping.loadMappings({
+          index: {
             properties: {
               str: {
                 type: 'string',
@@ -112,108 +162,130 @@ describe('Autocomplete entities', () => {
               },
             },
           },
-        },
-      });
+        });
 
-      expect(mapping.getMappings('index').sort(fc)).toEqual([
-        f('number', 'int'),
-        f('str', 'string'),
-      ]);
-    });
+        expect(mapping.getMappings('index').sort(fc)).toEqual([
+          f('number', 'int'),
+          f('str', 'string'),
+        ]);
+      });
 
-    test('Nested fields', function () {
-      mapping.loadMappings({
-        index: {
-          properties: {
-            person: {
-              type: 'object',
+      test('Simple fields - 1.0 style', function () {
+        mapping.loadMappings({
+          index: {
+            mappings: {
               properties: {
-                name: {
-                  properties: {
-                    first_name: { type: 'string' },
-                    last_name: { type: 'string' },
-                  },
+                str: {
+                  type: 'string',
+                },
+                number: {
+                  type: 'int',
                 },
-                sid: { type: 'string', index: 'not_analyzed' },
               },
             },
-            message: { type: 'string' },
           },
-        },
-      });
+        });
 
-      expect(mapping.getMappings('index', []).sort(fc)).toEqual([
-        f('message'),
-        f('person.name.first_name'),
-        f('person.name.last_name'),
-        f('person.sid'),
-      ]);
-    });
+        expect(mapping.getMappings('index').sort(fc)).toEqual([
+          f('number', 'int'),
+          f('str', 'string'),
+        ]);
+      });
 
-    test('Enabled fields', function () {
-      mapping.loadMappings({
-        index: {
-          properties: {
-            person: {
-              type: 'object',
-              properties: {
-                name: {
-                  type: 'object',
-                  enabled: false,
+      test('Nested fields', function () {
+        mapping.loadMappings({
+          index: {
+            properties: {
+              person: {
+                type: 'object',
+                properties: {
+                  name: {
+                    properties: {
+                      first_name: { type: 'string' },
+                      last_name: { type: 'string' },
+                    },
+                  },
+                  sid: { type: 'string', index: 'not_analyzed' },
                 },
-                sid: { type: 'string', index: 'not_analyzed' },
               },
+              message: { type: 'string' },
             },
-            message: { type: 'string' },
           },
-        },
-      });
+        });
 
-      expect(mapping.getMappings('index', []).sort(fc)).toEqual([f('message'), f('person.sid')]);
-    });
+        expect(mapping.getMappings('index', []).sort(fc)).toEqual([
+          f('message'),
+          f('person.name.first_name'),
+          f('person.name.last_name'),
+          f('person.sid'),
+        ]);
+      });
 
-    test('Path tests', function () {
-      mapping.loadMappings({
-        index: {
-          properties: {
-            name1: {
-              type: 'object',
-              path: 'just_name',
-              properties: {
-                first1: { type: 'string' },
-                last1: { type: 'string', index_name: 'i_last_1' },
+      test('Enabled fields', function () {
+        mapping.loadMappings({
+          index: {
+            properties: {
+              person: {
+                type: 'object',
+                properties: {
+                  name: {
+                    type: 'object',
+                    enabled: false,
+                  },
+                  sid: { type: 'string', index: 'not_analyzed' },
+                },
               },
+              message: { type: 'string' },
             },
-            name2: {
-              type: 'object',
-              path: 'full',
-              properties: {
-                first2: { type: 'string' },
-                last2: { type: 'string', index_name: 'i_last_2' },
+          },
+        });
+
+        expect(mapping.getMappings('index', []).sort(fc)).toEqual([f('message'), f('person.sid')]);
+      });
+
+      test('Path tests', function () {
+        mapping.loadMappings({
+          index: {
+            properties: {
+              name1: {
+                type: 'object',
+                path: 'just_name',
+                properties: {
+                  first1: { type: 'string' },
+                  last1: { type: 'string', index_name: 'i_last_1' },
+                },
+              },
+              name2: {
+                type: 'object',
+                path: 'full',
+                properties: {
+                  first2: { type: 'string' },
+                  last2: { type: 'string', index_name: 'i_last_2' },
+                },
               },
             },
           },
-        },
-      });
+        });
 
-      expect(mapping.getMappings().sort(fc)).toEqual([
-        f('first1'),
-        f('i_last_1'),
-        f('name2.first2'),
-        f('name2.i_last_2'),
-      ]);
-    });
+        expect(mapping.getMappings().sort(fc)).toEqual([
+          f('first1'),
+          f('i_last_1'),
+          f('name2.first2'),
+          f('name2.i_last_2'),
+        ]);
+      });
 
-    test('Use index_name tests', function () {
-      mapping.loadMappings({
-        index: {
-          properties: {
-            last1: { type: 'string', index_name: 'i_last_1' },
+      test('Use index_name tests', function () {
+        mapping.loadMappings({
+          index: {
+            properties: {
+              last1: { type: 'string', index_name: 'i_last_1' },
+            },
           },
-        },
-      });
+        });
 
-      expect(mapping.getMappings().sort(fc)).toEqual([f('i_last_1')]);
+        expect(mapping.getMappings().sort(fc)).toEqual([f('i_last_1')]);
+      });
     });
   });
 
diff --git a/src/plugins/console/public/lib/autocomplete_entities/mapping.ts b/src/plugins/console/public/lib/autocomplete_entities/mapping.ts
index 71e72dac0a280..3c383ca124167 100644
--- a/src/plugins/console/public/lib/autocomplete_entities/mapping.ts
+++ b/src/plugins/console/public/lib/autocomplete_entities/mapping.ts
@@ -7,9 +7,15 @@
  */
 
 import _ from 'lodash';
+import { BehaviorSubject } from 'rxjs';
 import type { IndicesGetMappingResponse } from '@elastic/elasticsearch/lib/api/types';
+import { HttpSetup } from '@kbn/core-http-browser';
+import { type Settings } from '../../services';
+import { API_BASE_PATH } from '../../../common/constants';
+import type { ResultTerm, AutoCompleteContext } from '../autocomplete/types';
 import { expandAliases } from './expand_aliases';
 import type { Field, FieldMapping } from './types';
+import { type AutoCompleteEntitiesApiResponse } from './types';
 
 function getFieldNamesFromProperties(properties: Record<string, FieldMapping> = {}) {
   const fieldList = Object.entries(properties).flatMap(([fieldName, fieldMapping]) => {
@@ -70,22 +76,127 @@ function getFieldNamesFromFieldMapping(
 
 export interface BaseMapping {
   perIndexTypes: Record<string, object>;
-  getMappings(indices: string | string[], types?: string | string[]): Field[];
+  /**
+   * Fetches mappings definition
+   */
+  fetchMappings(index: string): Promise<IndicesGetMappingResponse>;
+
+  /**
+   * Retrieves mappings definition from cache, fetches if necessary.
+   */
+  getMappings(
+    indices: string | string[],
+    types?: string | string[],
+    autoCompleteContext?: AutoCompleteContext
+  ): Field[];
+
+  /**
+   * Stores mappings definition
+   * @param mappings
+   */
   loadMappings(mappings: IndicesGetMappingResponse): void;
   clearMappings(): void;
 }
 
 export class Mapping implements BaseMapping {
+  private http!: HttpSetup;
+
+  private settings!: Settings;
+
+  /**
+   * Map of the mappings of actual ES indices.
+   */
   public perIndexTypes: Record<string, object> = {};
 
-  getMappings = (indices: string | string[], types?: string | string[]) => {
+  private readonly _isLoading$ = new BehaviorSubject<boolean>(false);
+
+  /**
+   * Indicates if mapping fetching is in progress.
+   */
+  public readonly isLoading$ = this._isLoading$.asObservable();
+
+  /**
+   * Map of the currently loading mappings for index patterns specified by a user.
+   * @private
+   */
+  private loadingState: Record<string, boolean> = {};
+
+  public setup(http: HttpSetup, settings: Settings) {
+    this.http = http;
+    this.settings = settings;
+  }
+
+  /**
+   * Fetches mappings of the requested indices.
+   * @param index
+   */
+  async fetchMappings(index: string): Promise<IndicesGetMappingResponse> {
+    const response = await this.http.get<AutoCompleteEntitiesApiResponse>(
+      `${API_BASE_PATH}/autocomplete_entities`,
+      {
+        query: { fields: true, fieldsIndices: index },
+      }
+    );
+
+    return response.mappings;
+  }
+
+  getMappings = (
+    indices: string | string[],
+    types?: string | string[],
+    autoCompleteContext?: AutoCompleteContext
+  ) => {
     // get fields for indices and types. Both can be a list, a string or null (meaning all).
     let ret: Field[] = [];
+
+    if (!this.settings.getAutocomplete().fields) return ret;
+
     indices = expandAliases(indices);
 
     if (typeof indices === 'string') {
       const typeDict = this.perIndexTypes[indices] as Record<string, unknown>;
-      if (!typeDict) {
+
+      if (!typeDict || Object.keys(typeDict).length === 0) {
+        if (!autoCompleteContext) return ret;
+
+        // Mappings fetching for the index is already in progress
+        if (this.loadingState[indices]) return ret;
+
+        this.loadingState[indices] = true;
+
+        if (!autoCompleteContext.asyncResultsState) {
+          autoCompleteContext.asyncResultsState = {} as AutoCompleteContext['asyncResultsState'];
+        }
+
+        autoCompleteContext.asyncResultsState!.isLoading = true;
+
+        autoCompleteContext.asyncResultsState!.results = new Promise<ResultTerm[]>(
+          (resolve, reject) => {
+            this._isLoading$.next(true);
+
+            this.fetchMappings(indices as string)
+              .then((mapping) => {
+                this._isLoading$.next(false);
+
+                autoCompleteContext.asyncResultsState!.isLoading = false;
+                autoCompleteContext.asyncResultsState!.lastFetched = Date.now();
+
+                // cache mappings
+                this.loadMappings(mapping);
+
+                const mappings = this.getMappings(indices, types, autoCompleteContext);
+                delete this.loadingState[indices as string];
+                resolve(mappings);
+              })
+              .catch((error) => {
+                // eslint-disable-next-line no-console
+                console.error(error);
+                this._isLoading$.next(false);
+                delete this.loadingState[indices as string];
+              });
+          }
+        );
+
         return [];
       }
 
@@ -108,7 +219,7 @@ export class Mapping implements BaseMapping {
       // multi index mode.
       Object.keys(this.perIndexTypes).forEach((index) => {
         if (!indices || indices.length === 0 || indices.includes(index)) {
-          ret.push(this.getMappings(index, types) as unknown as Field);
+          ret.push(this.getMappings(index, types, autoCompleteContext) as unknown as Field);
         }
       });
 
@@ -121,8 +232,6 @@ export class Mapping implements BaseMapping {
   };
 
   loadMappings = (mappings: IndicesGetMappingResponse) => {
-    this.perIndexTypes = {};
-
     Object.entries(mappings).forEach(([index, indexMapping]) => {
       const normalizedIndexMappings: Record<string, object[]> = {};
       let transformedMapping: Record<string, any> = indexMapping;
diff --git a/src/plugins/console/public/services/autocomplete.ts b/src/plugins/console/public/services/autocomplete.ts
index 3e1a38a514607..57324049bab94 100644
--- a/src/plugins/console/public/services/autocomplete.ts
+++ b/src/plugins/console/public/services/autocomplete.ts
@@ -53,7 +53,11 @@ export class AutocompleteInfo {
         const collaborator = this.mapping;
         return () => this.alias.getIndices(includeAliases, collaborator);
       case ENTITIES.FIELDS:
-        return this.mapping.getMappings(context.indices, context.types);
+        return this.mapping.getMappings(
+          context.indices,
+          context.types,
+          Object.getPrototypeOf(context)
+        );
       case ENTITIES.INDEX_TEMPLATES:
         return () => this.indexTemplate.getTemplates();
       case ENTITIES.COMPONENT_TEMPLATES:
@@ -93,7 +97,6 @@ export class AutocompleteInfo {
   }
 
   private load(data: AutoCompleteEntitiesApiResponse) {
-    this.mapping.loadMappings(data.mappings);
     const collaborator = this.mapping;
     this.alias.loadAliases(data.aliases, collaborator);
     this.indexTemplate.loadTemplates(data.indexTemplates);
diff --git a/src/plugins/console/public/services/settings.ts b/src/plugins/console/public/services/settings.ts
index e4731dd3f3a31..4056d20063a3e 100644
--- a/src/plugins/console/public/services/settings.ts
+++ b/src/plugins/console/public/services/settings.ts
@@ -14,7 +14,12 @@ export const DEFAULT_SETTINGS = Object.freeze({
   pollInterval: 60000,
   tripleQuotes: true,
   wrapMode: true,
-  autocomplete: Object.freeze({ fields: true, indices: true, templates: true, dataStreams: true }),
+  autocomplete: Object.freeze({
+    fields: true,
+    indices: true,
+    templates: true,
+    dataStreams: true,
+  }),
   isHistoryEnabled: true,
   isKeyboardShortcutsEnabled: true,
 });
diff --git a/src/plugins/console/public/types/core_editor.ts b/src/plugins/console/public/types/core_editor.ts
index 1c9d6352914a2..34f44578a0bce 100644
--- a/src/plugins/console/public/types/core_editor.ts
+++ b/src/plugins/console/public/types/core_editor.ts
@@ -7,6 +7,7 @@
  */
 
 import type { Editor } from 'brace';
+import { ResultTerm } from '../lib/autocomplete/types';
 import { TokensProvider } from './tokens_provider';
 import { Token } from './token';
 
@@ -23,7 +24,11 @@ export type EditorEvent =
 export type AutoCompleterFunction = (
   pos: Position,
   prefix: string,
-  callback: (...args: unknown[]) => void
+  callback: (e: Error | null, result: ResultTerm[] | null) => void,
+  annotationControls: {
+    setAnnotation: (text: string) => void;
+    removeAnnotation: () => void;
+  }
 ) => void;
 
 export interface Position {
diff --git a/src/plugins/console/server/routes/api/console/autocomplete_entities/index.ts b/src/plugins/console/server/routes/api/console/autocomplete_entities/index.ts
index 8bd5f8ee50b48..2d19de0a56e74 100644
--- a/src/plugins/console/server/routes/api/console/autocomplete_entities/index.ts
+++ b/src/plugins/console/server/routes/api/console/autocomplete_entities/index.ts
@@ -6,26 +6,25 @@
  * Side Public License, v 1.
  */
 
-import { parse } from 'query-string';
 import type { IScopedClusterClient } from '@kbn/core-elasticsearch-server';
 import type { RouteDependencies } from '../../..';
-interface SettingsToRetrieve {
-  indices: boolean;
-  fields: boolean;
-  templates: boolean;
-  dataStreams: boolean;
-}
+import { autoCompleteEntitiesValidationConfig, type SettingsToRetrieve } from './validation_config';
 
 const MAX_RESPONSE_SIZE = 10 * 1024 * 1024; // 10MB
 // Limit the response size to 10MB, because the response can be very large and sending it to the client
 // can cause the browser to hang.
 
 const getMappings = async (settings: SettingsToRetrieve, esClient: IScopedClusterClient) => {
-  if (settings.fields) {
-    const mappings = await esClient.asInternalUser.indices.getMapping(undefined, {
-      maxResponseSize: MAX_RESPONSE_SIZE,
-      maxCompressedResponseSize: MAX_RESPONSE_SIZE,
-    });
+  if (settings.fields && settings.fieldsIndices) {
+    const mappings = await esClient.asInternalUser.indices.getMapping(
+      {
+        index: settings.fieldsIndices,
+      },
+      {
+        maxResponseSize: MAX_RESPONSE_SIZE,
+        maxCompressedResponseSize: MAX_RESPONSE_SIZE,
+      }
+    );
     return mappings;
   }
   // If the user doesn't want autocomplete suggestions, then clear any that exist.
@@ -87,20 +86,11 @@ export const registerAutocompleteEntitiesRoute = (deps: RouteDependencies) => {
       options: {
         tags: ['access:console'],
       },
-      validate: false,
+      validate: autoCompleteEntitiesValidationConfig,
     },
     async (context, request, response) => {
       const esClient = (await context.core).elasticsearch.client;
-      const settings = parse(request.url.search, {
-        parseBooleans: true,
-      }) as unknown as SettingsToRetrieve;
-
-      // If no settings are specified, then return 400.
-      if (Object.keys(settings).length === 0) {
-        return response.badRequest({
-          body: 'Request must contain at least one of the following parameters: indices, fields, templates, dataStreams',
-        });
-      }
+      const settings = request.query;
 
       // Wait for all requests to complete, in case one of them fails return the successfull ones
       const results = await Promise.allSettled([
diff --git a/src/plugins/console/server/routes/api/console/autocomplete_entities/validation_config.ts b/src/plugins/console/server/routes/api/console/autocomplete_entities/validation_config.ts
new file mode 100644
index 0000000000000..48bab100d0b61
--- /dev/null
+++ b/src/plugins/console/server/routes/api/console/autocomplete_entities/validation_config.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { schema, TypeOf } from '@kbn/config-schema';
+
+export const autoCompleteEntitiesValidationConfig = {
+  query: schema.object(
+    {
+      indices: schema.maybe(schema.boolean()),
+      fields: schema.maybe(schema.boolean()),
+      templates: schema.maybe(schema.boolean()),
+      dataStreams: schema.maybe(schema.boolean()),
+      /**
+       * Comma separated list of indices for mappings retrieval.
+       */
+      fieldsIndices: schema.maybe(schema.string()),
+    },
+    {
+      validate: (payload) => {
+        if (Object.keys(payload).length === 0) {
+          return 'The request must contain at least one of the following parameters: indices, fields, templates, dataStreams.';
+        }
+      },
+    }
+  ),
+};
+
+export type SettingsToRetrieve = TypeOf<typeof autoCompleteEntitiesValidationConfig.query>;
diff --git a/src/plugins/console/tsconfig.json b/src/plugins/console/tsconfig.json
index 0dcc23b1c060c..43b94e47eedd4 100644
--- a/src/plugins/console/tsconfig.json
+++ b/src/plugins/console/tsconfig.json
@@ -30,6 +30,7 @@
     "@kbn/core-http-router-server-internal",
     "@kbn/web-worker-stub",
     "@kbn/core-elasticsearch-server",
+    "@kbn/core-http-browser-mocks",
   ],
   "exclude": [
     "target/**/*",
diff --git a/test/api_integration/apis/console/autocomplete_entities.ts b/test/api_integration/apis/console/autocomplete_entities.ts
index 6bd899c979a2b..6e13b2fb2856b 100644
--- a/test/api_integration/apis/console/autocomplete_entities.ts
+++ b/test/api_integration/apis/console/autocomplete_entities.ts
@@ -128,7 +128,7 @@ export default ({ getService }: FtrProviderContext) => {
     return await supertest.get('/api/console/autocomplete_entities').query(query);
   };
 
-  describe('/api/console/autocomplete_entities', () => {
+  describe('/api/console/autocomplete_entities', function () {
     const indexName = 'test-index-1';
     const aliasName = 'test-alias-1';
     const indexTemplateName = 'test-index-template-1';
@@ -238,9 +238,17 @@ export default ({ getService }: FtrProviderContext) => {
       expect(body.mappings).to.eql({});
     });
 
-    it('should return mappings with fields setting is set to true', async () => {
+    it('should not return mappings with fields setting is set to true without the list of indices is provided', async () => {
       const response = await sendRequest({ fields: true });
 
+      const { body, status } = response;
+      expect(status).to.be(200);
+      expect(Object.keys(body.mappings)).to.not.contain(indexName);
+    });
+
+    it('should return mappings with fields setting is set to true and the list of indices is provided', async () => {
+      const response = await sendRequest({ fields: true, fieldsIndices: indexName });
+
       const { body, status } = response;
       expect(status).to.be(200);
       expect(Object.keys(body.mappings)).to.contain(indexName);

From 9a3e3197481c37db6209f0f0fd00f570d1013cc4 Mon Sep 17 00:00:00 2001
From: Rodney Norris <rodney.norris@elastic.co>
Date: Mon, 6 Feb 2023 14:31:49 -0600
Subject: [PATCH 013/134] [Enterprise Search][Engines] Clean-up work (#150232)

## Summary

Clean-up work for engines prior to 8.7 feature freeze. Note engines will
be feature flagged in this release. The UI will only be reachable when
the feature flag is turned on by enabling a flag in the enterprise
search yaml config.

- Adds telemetry tracking to all user actions
- Removes the Documents side nav item, this page has been removed from
the scope of MVP
- Added an engines doc link, this is still TBD path may still be updated
to a landing page for 8.7
---
 packages/kbn-doc-links/src/get_doc_links.ts   |  1 +
 packages/kbn-doc-links/src/types.ts           |  1 +
 .../components/engine/add_indices_flyout.tsx  | 13 ++++-
 .../components/engine/engine_indices.tsx      | 15 +++++-
 .../engine/engine_view_header_actions.tsx     |  7 +++
 .../components/engine/header_docs_action.tsx  |  3 +-
 .../components/tables/engines_table.tsx       |  9 +++-
 .../engines/create_engine_flyout.tsx          |  4 +-
 .../engines/delete_engine_modal.tsx           |  6 +++
 .../components/engines/engines_list.tsx       |  5 +-
 .../enterprise_search_content/routes.ts       |  1 -
 .../shared/doc_links/doc_links.ts             |  3 ++
 .../applications/shared/layout/nav.test.tsx   | 25 ++++-----
 .../public/applications/shared/layout/nav.tsx | 52 ++++++++-----------
 14 files changed, 88 insertions(+), 57 deletions(-)

diff --git a/packages/kbn-doc-links/src/get_doc_links.ts b/packages/kbn-doc-links/src/get_doc_links.ts
index 0b253cedbc672..6b30af3f39097 100644
--- a/packages/kbn-doc-links/src/get_doc_links.ts
+++ b/packages/kbn-doc-links/src/get_doc_links.ts
@@ -135,6 +135,7 @@ export const getDocLinks = ({ kibanaBranch }: GetDocLinkOptions): DocLinks => {
       crawlerOverview: `${ENTERPRISE_SEARCH_DOCS}crawler.html`,
       deployTrainedModels: `${MACHINE_LEARNING_DOCS}ml-nlp-deploy-models.html`,
       documentLevelSecurity: `${ELASTICSEARCH_DOCS}document-level-security.html`,
+      engines: `${ENTERPRISE_SEARCH_DOCS}engines.html`,
       ingestPipelines: `${ENTERPRISE_SEARCH_DOCS}ingest-pipelines.html`,
       languageAnalyzers: `${ELASTICSEARCH_DOCS}analysis-lang-analyzer.html`,
       languageClients: `${ENTERPRISE_SEARCH_DOCS}programming-language-clients.html`,
diff --git a/packages/kbn-doc-links/src/types.ts b/packages/kbn-doc-links/src/types.ts
index dbfb37905172f..a6284078d3d8d 100644
--- a/packages/kbn-doc-links/src/types.ts
+++ b/packages/kbn-doc-links/src/types.ts
@@ -120,6 +120,7 @@ export interface DocLinks {
     readonly crawlerOverview: string;
     readonly deployTrainedModels: string;
     readonly documentLevelSecurity: string;
+    readonly engines: string;
     readonly ingestPipelines: string;
     readonly languageAnalyzers: string;
     readonly languageClients: string;
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/add_indices_flyout.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/add_indices_flyout.tsx
index 852e3698b968c..22ab72ba3a405 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/add_indices_flyout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/add_indices_flyout.tsx
@@ -99,7 +99,12 @@ export const AddIndicesFlyout: React.FC<AddIndicesFlyoutProps> = ({ onClose }) =
       <EuiFlyoutFooter>
         <EuiFlexGroup justifyContent="spaceBetween" direction="rowReverse">
           <EuiFlexItem grow={false}>
-            <EuiButton fill iconType="plusInCircle" onClick={submitSelectedIndices}>
+            <EuiButton
+              fill
+              data-telemetry-id="entSearchContent-engines-indices-addNewIndices-submit"
+              iconType="plusInCircle"
+              onClick={submitSelectedIndices}
+            >
               {i18n.translate(
                 'xpack.enterpriseSearch.content.engine.indices.addIndicesFlyout.submitButton',
                 { defaultMessage: 'Add selected' }
@@ -107,7 +112,11 @@ export const AddIndicesFlyout: React.FC<AddIndicesFlyoutProps> = ({ onClose }) =
             </EuiButton>
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
-            <EuiButtonEmpty flush="left" onClick={onClose}>
+            <EuiButtonEmpty
+              data-telemetry-id="entSearchContent-engines-indices-addNewIndices-cancel"
+              flush="left"
+              onClick={onClose}
+            >
               {i18n.translate(
                 'xpack.enterpriseSearch.content.engine.indices.addIndicesFlyout.cancelButton',
                 { defaultMessage: 'Cancel' }
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
index 0bcdde5e47647..da664b3d97490 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
@@ -28,6 +28,7 @@ import { indexHealthToHealthColor } from '../../../shared/constants/health_color
 import { generateEncodedPath } from '../../../shared/encode_path_params';
 import { KibanaLogic } from '../../../shared/kibana';
 import { EuiLinkTo } from '../../../shared/react_router_helpers';
+import { TelemetryLogic } from '../../../shared/telemetry/telemetry_logic';
 
 import { SEARCH_INDEX_PATH, EngineViewTabs } from '../../routes';
 import { IngestionMethod } from '../../types';
@@ -40,6 +41,7 @@ import { EngineIndicesLogic } from './engine_indices_logic';
 import { EngineViewHeaderActions } from './engine_view_header_actions';
 
 export const EngineIndices: React.FC = () => {
+  const { sendEnterpriseSearchTelemetry } = useActions(TelemetryLogic);
   const { engineData, engineName, isLoadingEngine, addIndicesFlyoutOpen } =
     useValues(EngineIndicesLogic);
   const { removeIndexFromEngine, openAddIndicesFlyout, closeAddIndicesFlyout } =
@@ -157,7 +159,13 @@ export const EngineIndices: React.FC = () => {
                 },
               }
             ),
-          onClick: (index) => setConfirmRemoveIndex(index.name),
+          onClick: (index) => {
+            setConfirmRemoveIndex(index.name);
+            sendEnterpriseSearchTelemetry({
+              action: 'clicked',
+              metric: 'entSearchContent-engines-indices-removeIndex',
+            });
+          },
           type: 'icon',
         },
       ],
@@ -180,6 +188,7 @@ export const EngineIndices: React.FC = () => {
           <EuiFlexGroup gutterSize="xs" alignItems="center">
             <EuiFlexItem>
               <EuiButton
+                data-telemetry-id="entSearchContent-engines-indices-addNewIndices"
                 data-test-subj="engine-add-new-indices-btn"
                 iconType="plusInCircle"
                 fill
@@ -224,6 +233,10 @@ export const EngineIndices: React.FC = () => {
             onConfirm={() => {
               removeIndexFromEngine(removeIndexConfirm);
               setConfirmRemoveIndex(null);
+              sendEnterpriseSearchTelemetry({
+                action: 'clicked',
+                metric: 'entSearchContent-engines-indices-removeIndexConfirm',
+              });
             }}
             title={i18n.translate(
               'xpack.enterpriseSearch.content.engine.indices.removeIndexConfirm.title',
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view_header_actions.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view_header_actions.tsx
index ba563a9c23dbc..bd48ee8d6d294 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view_header_actions.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view_header_actions.tsx
@@ -13,12 +13,15 @@ import { EuiPopover, EuiButtonIcon, EuiText, EuiContextMenu, EuiIcon } from '@el
 
 import { i18n } from '@kbn/i18n';
 
+import { TelemetryLogic } from '../../../shared/telemetry/telemetry_logic';
+
 import { EngineViewLogic } from './engine_view_logic';
 
 export const EngineViewHeaderActions: React.FC = () => {
   const { engineData } = useValues(EngineViewLogic);
 
   const { openDeleteEngineModal } = useActions(EngineViewLogic);
+  const { sendEnterpriseSearchTelemetry } = useActions(TelemetryLogic);
 
   const [isActionsPopoverOpen, setIsActionsPopoverOpen] = useState(false);
   const toggleActionsPopover = () => setIsActionsPopoverOpen((isPopoverOpen) => !isPopoverOpen);
@@ -66,6 +69,10 @@ export const EngineViewHeaderActions: React.FC = () => {
                   onClick: () => {
                     if (engineData) {
                       openDeleteEngineModal();
+                      sendEnterpriseSearchTelemetry({
+                        action: 'clicked',
+                        metric: 'entSearchContent-engines-engineView-deleteEngine',
+                      });
                     }
                   },
                   size: 's',
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/header_docs_action.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/header_docs_action.tsx
index 93544cc2e9bbd..e20fbc81689a4 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/header_docs_action.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/header_docs_action.tsx
@@ -15,8 +15,9 @@ export const EngineHeaderDocsAction: React.FC = () => (
   <EuiFlexGroup gutterSize="s">
     <EuiFlexItem>
       <EuiButtonEmpty
+        data-telemetry-id="entSearchContent-engines-engineHeader-documentationLink"
         data-test-subj="engine-documentation-link"
-        href={docLinks.appSearchElasticsearchIndexedEngines} // TODO: replace with real docLinks when it's created
+        href={docLinks.enterpriseSearchEngines}
         target="_blank"
         iconType="documents"
       >
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/tables/engines_table.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/tables/engines_table.tsx
index b3c5c46b38128..017564343f11e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/tables/engines_table.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/tables/engines_table.tsx
@@ -7,7 +7,7 @@
 
 import React from 'react';
 
-import { useValues } from 'kea';
+import { useValues, useActions } from 'kea';
 
 import {
   CriteriaWithPagination,
@@ -29,6 +29,7 @@ import { FormattedDateTime } from '../../../../../shared/formatted_date_time';
 import { KibanaLogic } from '../../../../../shared/kibana';
 import { pageToPagination } from '../../../../../shared/pagination/page_to_pagination';
 import { EuiLinkTo } from '../../../../../shared/react_router_helpers';
+import { TelemetryLogic } from '../../../../../shared/telemetry/telemetry_logic';
 
 import { ENGINE_PATH } from '../../../../routes';
 
@@ -50,6 +51,7 @@ export const EnginesListTable: React.FC<EnginesListTableProps> = ({
   viewEngineIndices,
 }) => {
   const { navigateToUrl } = useValues(KibanaLogic);
+  const { sendEnterpriseSearchTelemetry } = useActions(TelemetryLogic);
   const columns: Array<EuiBasicTableColumn<EnterpriseSearchEngine>> = [
     {
       field: 'name',
@@ -93,6 +95,7 @@ export const EnginesListTable: React.FC<EnginesListTableProps> = ({
           size="s"
           className="engineListTableFlyoutButton"
           data-test-subj="engineListTableIndicesFlyoutButton"
+          data-telemetry-id="entSearchContent-engines-table-viewEngineIndices"
           onClick={() => viewEngineIndices(engine.name)}
         >
           <FormattedMessage
@@ -148,6 +151,10 @@ export const EnginesListTable: React.FC<EnginesListTableProps> = ({
             ),
           onClick: (engine) => {
             onDelete(engine);
+            sendEnterpriseSearchTelemetry({
+              action: 'clicked',
+              metric: 'entSearchContent-engines-table-deleteEngine',
+            });
           },
         },
       ],
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/create_engine_flyout.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/create_engine_flyout.tsx
index 06a2509edad53..ae7f7423be7ce 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/create_engine_flyout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/create_engine_flyout.tsx
@@ -36,7 +36,7 @@ import { ElasticsearchIndexWithIngestion } from '../../../../../common/types/ind
 import { isNotNullish } from '../../../../../common/utils/is_not_nullish';
 
 import { CANCEL_BUTTON_LABEL } from '../../../shared/constants';
-
+import { docLinks } from '../../../shared/doc_links';
 import { getErrorsFromHttpResponse } from '../../../shared/flash_messages/handle_api_errors';
 
 import { indexToOption, IndicesSelectComboBox } from './components/indices_select_combobox';
@@ -85,7 +85,7 @@ export const CreateEngineFlyout = ({ onClose }: CreateEngineFlyoutProps) => {
               values={{
                 enginesDocsLink: (
                   <EuiLink
-                    href="#" // TODO: replace with docs link
+                    href={docLinks.enterpriseSearchEngines}
                     target="_blank"
                     data-telemetry-id="entSearchContent-engines-createEngine-docsLink"
                     external
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/delete_engine_modal.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/delete_engine_modal.tsx
index a8cde672107c2..4203969bb74a2 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/delete_engine_modal.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/delete_engine_modal.tsx
@@ -12,6 +12,7 @@ import { EuiConfirmModal } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 import { CANCEL_BUTTON_LABEL } from '../../../shared/constants';
+import { TelemetryLogic } from '../../../shared/telemetry/telemetry_logic';
 
 import { EnginesListLogic } from './engines_list_logic';
 
@@ -22,6 +23,7 @@ export interface DeleteEngineModalProps {
 
 export const DeleteEngineModal: React.FC<DeleteEngineModalProps> = ({ engineName, onClose }) => {
   const { deleteEngine } = useActions(EnginesListLogic);
+  const { sendEnterpriseSearchTelemetry } = useActions(TelemetryLogic);
   const { isDeleteLoading } = useValues(EnginesListLogic);
   return (
     <EuiConfirmModal
@@ -31,6 +33,10 @@ export const DeleteEngineModal: React.FC<DeleteEngineModalProps> = ({ engineName
       onCancel={onClose}
       onConfirm={() => {
         deleteEngine({ engineName });
+        sendEnterpriseSearchTelemetry({
+          action: 'clicked',
+          metric: 'entSearchContent-engines-engineView-deleteEngineConfirm',
+        });
       }}
       cancelButtonText={CANCEL_BUTTON_LABEL}
       confirmButtonText={i18n.translate(
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx
index 76e343e234ff3..b927e499ff06c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx
@@ -16,6 +16,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage, FormattedNumber } from '@kbn/i18n-react';
 
 import { INPUT_THROTTLE_DELAY_MS } from '../../../shared/constants/timers';
+import { docLinks } from '../../../shared/doc_links';
 
 import { EnterpriseSearchEnginesPageTemplate } from '../layout/engines_page_template';
 
@@ -102,12 +103,10 @@ export const EnginesList: React.FC = () => {
                 documentationUrl: (
                   <EuiLink
                     data-test-subj="engines-documentation-link"
-                    href="TODO"
+                    href={docLinks.enterpriseSearchEngines}
                     target="_blank"
                     data-telemetry-id="entSearchContent-engines-documentation-viewDocumentaion"
                   >
-                    {' '}
-                    {/* TODO: navigate to documentation url */}{' '}
                     {i18n.translate('xpack.enterpriseSearch.content.engines.documentation', {
                       defaultMessage: 'explore our Engines documentation',
                     })}
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/routes.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/routes.ts
index 4185addb31445..57ff05050ebae 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/routes.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/routes.ts
@@ -32,7 +32,6 @@ export const ENGINE_TAB_PATH = `${ENGINE_PATH}/:tabId`;
 export enum EngineViewTabs {
   OVERVIEW = 'overview',
   INDICES = 'indices',
-  DOCUMENTS = 'documents',
   SCHEMA = 'schema',
   PREVIEW = 'preview',
   API = 'api',
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/doc_links/doc_links.ts b/x-pack/plugins/enterprise_search/public/applications/shared/doc_links/doc_links.ts
index cc1356fc0c140..073ffe6abca3f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/doc_links/doc_links.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/doc_links/doc_links.ts
@@ -71,6 +71,7 @@ class DocLinks {
   public elasticsearchMapping: string;
   public elasticsearchSecureCluster: string;
   public enterpriseSearchConfig: string;
+  public enterpriseSearchEngines: string;
   public enterpriseSearchMailService: string;
   public enterpriseSearchTroubleshootSetup: string;
   public enterpriseSearchUsersAccess: string;
@@ -186,6 +187,7 @@ class DocLinks {
     this.elasticsearchMapping = '';
     this.elasticsearchSecureCluster = '';
     this.enterpriseSearchConfig = '';
+    this.enterpriseSearchEngines = '';
     this.enterpriseSearchMailService = '';
     this.enterpriseSearchTroubleshootSetup = '';
     this.enterpriseSearchUsersAccess = '';
@@ -302,6 +304,7 @@ class DocLinks {
     this.elasticsearchMapping = docLinks.links.elasticsearch.mapping;
     this.elasticsearchSecureCluster = docLinks.links.elasticsearch.secureCluster;
     this.enterpriseSearchConfig = docLinks.links.enterpriseSearch.configuration;
+    this.enterpriseSearchEngines = docLinks.links.enterpriseSearch.engines;
     this.enterpriseSearchMailService = docLinks.links.enterpriseSearch.mailService;
     this.enterpriseSearchTroubleshootSetup = docLinks.links.enterpriseSearch.troubleshootSetup;
     this.enterpriseSearchUsersAccess = docLinks.links.enterpriseSearch.usersAccess;
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/nav.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/layout/nav.test.tsx
index 17ce1fce0512f..fac9d911be6c8 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/nav.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/nav.test.tsx
@@ -468,21 +468,16 @@ describe('useEnterpriseSearchEngineNav', () => {
           id: 'enterpriseSearchEngineIndices',
           name: 'Indices',
         },
-        {
-          href: `/app/enterprise_search/content/engines/${engineName}/documents`,
-          id: 'enterpriseSearchEngineDocuments',
-          name: 'Documents',
-        },
-        {
-          href: `/app/enterprise_search/content/engines/${engineName}/schema`,
-          id: 'enterpriseSearchEngineSchema',
-          name: 'Schema',
-        },
-        {
-          href: `/app/enterprise_search/content/engines/${engineName}/preview`,
-          id: 'enterpriseSearchEnginePreview',
-          name: 'Preview',
-        },
+        // {
+        //   href: `/app/enterprise_search/content/engines/${engineName}/schema`,
+        //   id: 'enterpriseSearchEngineSchema',
+        //   name: 'Schema',
+        // },
+        // {
+        //   href: `/app/enterprise_search/content/engines/${engineName}/preview`,
+        //   id: 'enterpriseSearchEnginePreview',
+        //   name: 'Preview',
+        // },
         {
           href: `/app/enterprise_search/content/engines/${engineName}/api`,
           id: 'enterpriseSearchEngineAPI',
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/nav.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/layout/nav.tsx
index a6e550e7c58b2..3d81f5d9d7c34 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/nav.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/nav.tsx
@@ -271,37 +271,27 @@ export const useEnterpriseSearchEngineNav = (engineName?: string, isEmptyState?:
                 to: `${enginePath}/${EngineViewTabs.INDICES}`,
               }),
             },
-
-            {
-              id: 'enterpriseSearchEngineDocuments',
-              name: i18n.translate('xpack.enterpriseSearch.nav.engine.documentsTitle', {
-                defaultMessage: 'Documents',
-              }),
-              ...generateNavLink({
-                shouldNotCreateHref: true,
-                to: `${enginePath}/${EngineViewTabs.DOCUMENTS}`,
-              }),
-            },
-            {
-              id: 'enterpriseSearchEngineSchema',
-              name: i18n.translate('xpack.enterpriseSearch.nav.engine.schemaTitle', {
-                defaultMessage: 'Schema',
-              }),
-              ...generateNavLink({
-                shouldNotCreateHref: true,
-                to: `${enginePath}/${EngineViewTabs.SCHEMA}`,
-              }),
-            },
-            {
-              id: 'enterpriseSearchEnginePreview',
-              name: i18n.translate('xpack.enterpriseSearch.nav.engine.previewTitle', {
-                defaultMessage: 'Preview',
-              }),
-              ...generateNavLink({
-                shouldNotCreateHref: true,
-                to: `${enginePath}/${EngineViewTabs.PREVIEW}`,
-              }),
-            },
+            // {
+            //   id: 'enterpriseSearchEngineSchema',
+            //   name: i18n.translate('xpack.enterpriseSearch.nav.engine.schemaTitle', {
+            //     defaultMessage: 'Schema',
+            //   }),
+            //   ...generateNavLink({
+            //     shouldNotCreateHref: true,
+            //     to: `${enginePath}/${EngineViewTabs.SCHEMA}`,
+            //   }),
+            // },
+            // Hidden until Preview page is available
+            // {
+            //   id: 'enterpriseSearchEnginePreview',
+            //   name: i18n.translate('xpack.enterpriseSearch.nav.engine.previewTitle', {
+            //     defaultMessage: 'Preview',
+            //   }),
+            //   ...generateNavLink({
+            //     shouldNotCreateHref: true,
+            //     to: `${enginePath}/${EngineViewTabs.PREVIEW}`,
+            //   }),
+            // },
             {
               id: 'enterpriseSearchEngineAPI',
               name: i18n.translate('xpack.enterpriseSearch.nav.engine.apiTitle', {

From c3ea5e5b3a2f0e13e743eea059404c81a07576c1 Mon Sep 17 00:00:00 2001
From: Jonathan Buttner <56361221+jonathan-buttner@users.noreply.github.com>
Date: Mon, 6 Feb 2023 15:38:36 -0500
Subject: [PATCH 014/134] [Cases] Improve functional tests (#150117)

This PR tries to improve how often our functional tests succeeds. I also
tried cleaning up a few things that seemed to be slowing the tests down
and also causing errors when the tests were run individually.

Fixes: https://github.com/elastic/kibana/issues/145271

Notable changes:
- I added a value to the `property-actions*` in most places so that the
functional tests can distinguish between a description, comment, or the
case ellipses this seems to work consistently where other methods have
not

Flaky test run:
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/1871
---
 .../case_action_bar/actions.test.tsx          |  39 +++--
 .../components/case_action_bar/actions.tsx    |   2 +-
 .../components/case_action_bar/index.test.tsx |  16 +-
 .../components/property_actions/index.tsx     | 143 ++++++++++--------
 .../user_actions/comment/comment.test.tsx     |  24 +--
 .../user_actions/description.test.tsx         |  16 +-
 .../components/user_actions/index.test.tsx    |  36 +++--
 .../alert_property_actions.test.tsx           |  36 ++---
 .../description_property_actions.test.tsx     |  28 ++--
 .../description_property_actions.tsx          |   8 +-
 .../property_actions.test.tsx                 |  12 +-
 .../property_actions/property_actions.tsx     |  12 +-
 ...ered_attachments_property_actions.test.tsx |  28 ++--
 .../user_comment_property_actions.test.tsx    |  40 ++---
 x-pack/test/functional/services/cases/list.ts |   3 -
 .../services/cases/single_case_view.ts        |  12 +-
 .../apps/cases/deletion.ts                    |   6 +-
 .../apps/cases/view_case.ts                   |  28 +---
 18 files changed, 263 insertions(+), 226 deletions(-)

diff --git a/x-pack/plugins/cases/public/components/case_action_bar/actions.test.tsx b/x-pack/plugins/cases/public/components/case_action_bar/actions.test.tsx
index 195d02f7931cf..e04070fecf9ff 100644
--- a/x-pack/plugins/cases/public/components/case_action_bar/actions.test.tsx
+++ b/x-pack/plugins/cases/public/components/case_action_bar/actions.test.tsx
@@ -46,8 +46,11 @@ describe('CaseView actions', () => {
     );
 
     expect(wrapper.find('[data-test-subj="confirm-delete-case-modal"]').exists()).toBeFalsy();
-    wrapper.find('button[data-test-subj="property-actions-ellipses"]').first().simulate('click');
-    wrapper.find('button[data-test-subj="property-actions-trash"]').simulate('click');
+    wrapper
+      .find('button[data-test-subj="property-actions-case-ellipses"]')
+      .first()
+      .simulate('click');
+    wrapper.find('button[data-test-subj="property-actions-case-trash"]').simulate('click');
     expect(wrapper.find('[data-test-subj="confirm-delete-case-modal"]').exists()).toBeTruthy();
   });
 
@@ -67,8 +70,11 @@ describe('CaseView actions', () => {
       </TestProviders>
     );
 
-    wrapper.find('button[data-test-subj="property-actions-ellipses"]').first().simulate('click');
-    wrapper.find('button[data-test-subj="property-actions-copyClipboard"]').simulate('click');
+    wrapper
+      .find('button[data-test-subj="property-actions-case-ellipses"]')
+      .first()
+      .simulate('click');
+    wrapper.find('button[data-test-subj="property-actions-case-copyClipboard"]').simulate('click');
 
     expect(navigator.clipboard.writeText).toHaveBeenCalledWith(basicCase.id);
 
@@ -85,9 +91,14 @@ describe('CaseView actions', () => {
     );
 
     expect(wrapper.find('[data-test-subj="confirm-delete-case-modal"]').exists()).toBeFalsy();
-    wrapper.find('button[data-test-subj="property-actions-ellipses"]').first().simulate('click');
-    expect(wrapper.find('[data-test-subj="property-actions-trash"]').exists()).toBeFalsy();
-    expect(wrapper.find('[data-test-subj="property-actions-copyClipboard"]').exists()).toBeTruthy();
+    wrapper
+      .find('button[data-test-subj="property-actions-case-ellipses"]')
+      .first()
+      .simulate('click');
+    expect(wrapper.find('[data-test-subj="property-actions-case-trash"]').exists()).toBeFalsy();
+    expect(
+      wrapper.find('[data-test-subj="property-actions-case-copyClipboard"]').exists()
+    ).toBeTruthy();
   });
 
   it('toggle delete modal and confirm', async () => {
@@ -101,8 +112,11 @@ describe('CaseView actions', () => {
       </TestProviders>
     );
 
-    wrapper.find('button[data-test-subj="property-actions-ellipses"]').first().simulate('click');
-    wrapper.find('button[data-test-subj="property-actions-trash"]').simulate('click');
+    wrapper
+      .find('button[data-test-subj="property-actions-case-ellipses"]')
+      .first()
+      .simulate('click');
+    wrapper.find('button[data-test-subj="property-actions-case-trash"]').simulate('click');
 
     expect(wrapper.find('[data-test-subj="confirm-delete-case-modal"]').exists()).toBeTruthy();
     wrapper.find('button[data-test-subj="confirmModalConfirmButton"]').simulate('click');
@@ -126,9 +140,12 @@ describe('CaseView actions', () => {
 
     expect(wrapper.find('[data-test-subj="confirm-delete-case-modal"]').exists()).toBeFalsy();
 
-    wrapper.find('button[data-test-subj="property-actions-ellipses"]').first().simulate('click');
+    wrapper
+      .find('button[data-test-subj="property-actions-case-ellipses"]')
+      .first()
+      .simulate('click');
     expect(
-      wrapper.find('[data-test-subj="property-actions-popout"]').first().prop('aria-label')
+      wrapper.find('[data-test-subj="property-actions-case-popout"]').first().prop('aria-label')
     ).toEqual(i18n.VIEW_INCIDENT(basicPush.externalTitle));
   });
 });
diff --git a/x-pack/plugins/cases/public/components/case_action_bar/actions.tsx b/x-pack/plugins/cases/public/components/case_action_bar/actions.tsx
index d464946b60f82..87cd1fc732a30 100644
--- a/x-pack/plugins/cases/public/components/case_action_bar/actions.tsx
+++ b/x-pack/plugins/cases/public/components/case_action_bar/actions.tsx
@@ -84,7 +84,7 @@ const ActionsComponent: React.FC<CaseViewActions> = ({ caseData, currentExternal
 
   return (
     <EuiFlexItem grow={false} data-test-subj="case-view-actions">
-      <PropertyActions propertyActions={propertyActions} />
+      <PropertyActions propertyActions={propertyActions} customDataTestSubj={'case'} />
       {isModalVisible ? (
         <ConfirmDeleteCaseModal
           totalCasesToBeDeleted={1}
diff --git a/x-pack/plugins/cases/public/components/case_action_bar/index.test.tsx b/x-pack/plugins/cases/public/components/case_action_bar/index.test.tsx
index 7263514fb6baa..909bcc317b505 100644
--- a/x-pack/plugins/cases/public/components/case_action_bar/index.test.tsx
+++ b/x-pack/plugins/cases/public/components/case_action_bar/index.test.tsx
@@ -207,10 +207,10 @@ describe('CaseActionBar', () => {
       </TestProviders>
     );
 
-    userEvent.click(screen.getByTestId('property-actions-ellipses'));
+    userEvent.click(screen.getByTestId('property-actions-case-ellipses'));
     expect(queryByText('Delete case')).not.toBeInTheDocument();
-    expect(queryByTestId('property-actions-trash')).not.toBeInTheDocument();
-    expect(queryByTestId('property-actions-copyClipboard')).toBeInTheDocument();
+    expect(queryByTestId('property-actions-case-trash')).not.toBeInTheDocument();
+    expect(queryByTestId('property-actions-case-copyClipboard')).toBeInTheDocument();
   });
 
   it('should show the the delete item in the menu when the user does have delete privileges', () => {
@@ -220,7 +220,7 @@ describe('CaseActionBar', () => {
       </TestProviders>
     );
 
-    userEvent.click(screen.getByTestId('property-actions-ellipses'));
+    userEvent.click(screen.getByTestId('property-actions-case-ellipses'));
     expect(queryByText('Delete case')).toBeInTheDocument();
   });
 
@@ -239,10 +239,10 @@ describe('CaseActionBar', () => {
       </TestProviders>
     );
 
-    userEvent.click(screen.getByTestId('property-actions-ellipses'));
+    userEvent.click(screen.getByTestId('property-actions-case-ellipses'));
 
     await waitFor(() => {
-      expect(screen.getByTestId('property-actions-popout')).toBeInTheDocument();
+      expect(screen.getByTestId('property-actions-case-popout')).toBeInTheDocument();
     });
   });
 
@@ -253,8 +253,8 @@ describe('CaseActionBar', () => {
       </TestProviders>
     );
 
-    userEvent.click(screen.getByTestId('property-actions-ellipses'));
+    userEvent.click(screen.getByTestId('property-actions-case-ellipses'));
 
-    expect(screen.queryByTestId('property-actions-popout')).not.toBeInTheDocument();
+    expect(screen.queryByTestId('property-actions-case-popout')).not.toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/cases/public/components/property_actions/index.tsx b/x-pack/plugins/cases/public/components/property_actions/index.tsx
index 61f4c4b6f2cfe..4de52d551bf2f 100644
--- a/x-pack/plugins/cases/public/components/property_actions/index.tsx
+++ b/x-pack/plugins/cases/public/components/property_actions/index.tsx
@@ -17,86 +17,101 @@ export interface PropertyActionButtonProps {
   iconType: string;
   label: string;
   color?: EuiButtonProps['color'];
+  customDataTestSubj?: string;
 }
 
 const ComponentId = 'property-actions';
 
 const PropertyActionButton = React.memo<PropertyActionButtonProps>(
-  ({ disabled = false, onClick, iconType, label, color }) => (
-    <EuiButtonEmpty
-      aria-label={label}
-      color={color ? color : 'text'}
-      data-test-subj={`${ComponentId}-${iconType}`}
-      iconSide="left"
-      iconType={iconType}
-      isDisabled={disabled}
-      onClick={onClick}
-    >
-      {label}
-    </EuiButtonEmpty>
-  )
+  ({ disabled = false, onClick, iconType, label, color, customDataTestSubj }) => {
+    const dataTestSubjPrepend = makeDataTestSubjPrepend(customDataTestSubj);
+
+    return (
+      <EuiButtonEmpty
+        aria-label={label}
+        color={color ? color : 'text'}
+        data-test-subj={`${dataTestSubjPrepend}-${iconType}`}
+        iconSide="left"
+        iconType={iconType}
+        isDisabled={disabled}
+        onClick={onClick}
+      >
+        {label}
+      </EuiButtonEmpty>
+    );
+  }
 );
 
 PropertyActionButton.displayName = 'PropertyActionButton';
 
 export interface PropertyActionsProps {
   propertyActions: PropertyActionButtonProps[];
+  customDataTestSubj?: string;
 }
 
-export const PropertyActions = React.memo<PropertyActionsProps>(({ propertyActions }) => {
-  const [showActions, setShowActions] = useState(false);
+export const PropertyActions = React.memo<PropertyActionsProps>(
+  ({ propertyActions, customDataTestSubj }) => {
+    const [showActions, setShowActions] = useState(false);
 
-  const onButtonClick = useCallback(() => {
-    setShowActions((prevShowActions) => !prevShowActions);
-  }, []);
+    const onButtonClick = useCallback(() => {
+      setShowActions((prevShowActions) => !prevShowActions);
+    }, []);
 
-  const onClosePopover = useCallback((cb?: () => void) => {
-    setShowActions(false);
-    if (cb != null) {
-      cb();
-    }
-  }, []);
-
-  return (
-    <EuiPopover
-      anchorPosition="downRight"
-      data-test-subj={ComponentId}
-      ownFocus
-      button={
-        <EuiButtonIcon
-          data-test-subj={`${ComponentId}-ellipses`}
-          aria-label={i18n.ACTIONS_ARIA}
-          iconType="boxesHorizontal"
-          onClick={onButtonClick}
-        />
+    const onClosePopover = useCallback((cb?: () => void) => {
+      setShowActions(false);
+      if (cb != null) {
+        cb();
       }
-      id="settingsPopover"
-      isOpen={showActions}
-      closePopover={onClosePopover}
-      repositionOnScroll
-    >
-      <EuiFlexGroup
-        alignItems="flexStart"
-        data-test-subj={`${ComponentId}-group`}
-        direction="column"
-        gutterSize="none"
+    }, []);
+
+    const dataTestSubjPrepend = makeDataTestSubjPrepend(customDataTestSubj);
+
+    return (
+      <EuiPopover
+        anchorPosition="downRight"
+        data-test-subj={dataTestSubjPrepend}
+        ownFocus
+        button={
+          <EuiButtonIcon
+            data-test-subj={`${dataTestSubjPrepend}-ellipses`}
+            aria-label={i18n.ACTIONS_ARIA}
+            iconType="boxesHorizontal"
+            onClick={onButtonClick}
+          />
+        }
+        id="settingsPopover"
+        isOpen={showActions}
+        closePopover={onClosePopover}
+        repositionOnScroll
       >
-        {propertyActions.map((action, key) => (
-          <EuiFlexItem grow={false} key={`${action.label}${key}`}>
-            <span>
-              <PropertyActionButton
-                disabled={action.disabled}
-                iconType={action.iconType}
-                label={action.label}
-                color={action.color}
-                onClick={() => onClosePopover(action.onClick)}
-              />
-            </span>
-          </EuiFlexItem>
-        ))}
-      </EuiFlexGroup>
-    </EuiPopover>
-  );
-});
+        <EuiFlexGroup
+          alignItems="flexStart"
+          data-test-subj={`${dataTestSubjPrepend}-group`}
+          direction="column"
+          gutterSize="none"
+        >
+          {propertyActions.map((action, key) => (
+            <EuiFlexItem grow={false} key={`${action.label}${key}`}>
+              <span>
+                <PropertyActionButton
+                  disabled={action.disabled}
+                  iconType={action.iconType}
+                  label={action.label}
+                  color={action.color}
+                  onClick={() => onClosePopover(action.onClick)}
+                  customDataTestSubj={customDataTestSubj}
+                />
+              </span>
+            </EuiFlexItem>
+          ))}
+        </EuiFlexGroup>
+      </EuiPopover>
+    );
+  }
+);
 
 PropertyActions.displayName = 'PropertyActions';
+
+const makeDataTestSubjPrepend = (customDataTestSubj?: string) => {
+  return customDataTestSubj == null ? ComponentId : `${ComponentId}-${customDataTestSubj}`;
+};
diff --git a/x-pack/plugins/cases/public/components/user_actions/comment/comment.test.tsx b/x-pack/plugins/cases/public/components/user_actions/comment/comment.test.tsx
index 77f1af32529e4..2ecc4b32d0837 100644
--- a/x-pack/plugins/cases/public/components/user_actions/comment/comment.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/comment/comment.test.tsx
@@ -223,13 +223,13 @@ describe('createCommentUserActionBuilder', () => {
       );
 
       expect(result.getByText('Solve this fast!')).toBeInTheDocument();
-      expect(result.getByTestId('property-actions')).toBeInTheDocument();
+      expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-      userEvent.click(result.getByTestId('property-actions-ellipses'));
+      userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
       await waitForEuiPopoverOpen();
 
-      expect(result.queryByTestId('property-actions-pencil')).toBeInTheDocument();
-      userEvent.click(result.getByTestId('property-actions-pencil'));
+      expect(result.queryByTestId('property-actions-user-action-pencil')).toBeInTheDocument();
+      userEvent.click(result.getByTestId('property-actions-user-action-pencil'));
 
       await waitFor(() => {
         expect(builderArgs.handleManageMarkdownEditId).toHaveBeenCalledWith('basic-comment-id');
@@ -254,13 +254,13 @@ describe('createCommentUserActionBuilder', () => {
       );
 
       expect(result.getByText('Solve this fast!')).toBeInTheDocument();
-      expect(result.getByTestId('property-actions')).toBeInTheDocument();
+      expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-      userEvent.click(result.getByTestId('property-actions-ellipses'));
+      userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
       await waitForEuiPopoverOpen();
 
-      expect(result.queryByTestId('property-actions-quote')).toBeInTheDocument();
-      userEvent.click(result.getByTestId('property-actions-quote'));
+      expect(result.queryByTestId('property-actions-user-action-quote')).toBeInTheDocument();
+      userEvent.click(result.getByTestId('property-actions-user-action-quote'));
 
       await waitFor(() => {
         expect(builderArgs.handleManageQuote).toHaveBeenCalledWith('Solve this fast!');
@@ -769,14 +769,14 @@ describe('createCommentUserActionBuilder', () => {
 });
 
 const deleteAttachment = async (result: RenderResult, deleteIcon: string, buttonLabel: string) => {
-  expect(result.getByTestId('property-actions')).toBeInTheDocument();
+  expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-  userEvent.click(result.getByTestId('property-actions-ellipses'));
+  userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
   await waitForEuiPopoverOpen();
 
-  expect(result.queryByTestId(`property-actions-${deleteIcon}`)).toBeInTheDocument();
+  expect(result.queryByTestId(`property-actions-user-action-${deleteIcon}`)).toBeInTheDocument();
 
-  userEvent.click(result.getByTestId(`property-actions-${deleteIcon}`));
+  userEvent.click(result.getByTestId(`property-actions-user-action-${deleteIcon}`));
 
   await waitFor(() => {
     expect(result.queryByTestId('property-actions-confirm-modal')).toBeInTheDocument();
diff --git a/x-pack/plugins/cases/public/components/user_actions/description.test.tsx b/x-pack/plugins/cases/public/components/user_actions/description.test.tsx
index 9fddcbb3cce6a..5b519b6739bdd 100644
--- a/x-pack/plugins/cases/public/components/user_actions/description.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/description.test.tsx
@@ -58,13 +58,13 @@ describe('createDescriptionUserActionBuilder ', () => {
       </TestProviders>
     );
 
-    expect(res.getByTestId('property-actions')).toBeInTheDocument();
+    expect(res.getByTestId('property-actions-description')).toBeInTheDocument();
 
-    userEvent.click(res.getByTestId('property-actions-ellipses'));
+    userEvent.click(res.getByTestId('property-actions-description-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(res.queryByTestId('property-actions-pencil')).toBeInTheDocument();
-    userEvent.click(res.getByTestId('property-actions-pencil'));
+    expect(res.queryByTestId('property-actions-description-pencil')).toBeInTheDocument();
+    userEvent.click(res.getByTestId('property-actions-description-pencil'));
 
     await waitFor(() => {
       expect(builderArgs.handleManageMarkdownEditId).toHaveBeenCalledWith('description');
@@ -84,13 +84,13 @@ describe('createDescriptionUserActionBuilder ', () => {
       </TestProviders>
     );
 
-    expect(res.getByTestId('property-actions')).toBeInTheDocument();
+    expect(res.getByTestId('property-actions-description')).toBeInTheDocument();
 
-    userEvent.click(res.getByTestId('property-actions-ellipses'));
+    userEvent.click(res.getByTestId('property-actions-description-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(res.queryByTestId('property-actions-quote')).toBeInTheDocument();
-    userEvent.click(res.getByTestId('property-actions-quote'));
+    expect(res.queryByTestId('property-actions-description-quote')).toBeInTheDocument();
+    userEvent.click(res.getByTestId('property-actions-description-quote'));
 
     await waitFor(() => {
       expect(builderArgs.handleManageQuote).toHaveBeenCalledWith('Security banana Issue');
diff --git a/x-pack/plugins/cases/public/components/user_actions/index.test.tsx b/x-pack/plugins/cases/public/components/user_actions/index.test.tsx
index 2cfc535940f45..8923a45c48c2a 100644
--- a/x-pack/plugins/cases/public/components/user_actions/index.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/index.test.tsx
@@ -197,13 +197,13 @@ describe(`UserActions`, () => {
 
     wrapper
       .find(
-        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-ellipses"]`
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-user-action-ellipses"]`
       )
       .first()
       .simulate('click');
     wrapper
       .find(
-        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-pencil"]`
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-user-action-pencil"]`
       )
       .first()
       .simulate('click');
@@ -241,14 +241,14 @@ describe(`UserActions`, () => {
 
     wrapper
       .find(
-        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-ellipses"]`
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-user-action-ellipses"]`
       )
       .first()
       .simulate('click');
 
     wrapper
       .find(
-        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-pencil"]`
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-user-action-pencil"]`
       )
       .first()
       .simulate('click');
@@ -293,12 +293,16 @@ describe(`UserActions`, () => {
     );
 
     wrapper
-      .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-ellipses"]`)
+      .find(
+        `[data-test-subj="description-action"] [data-test-subj="property-actions-description-ellipses"]`
+      )
       .first()
       .simulate('click');
 
     wrapper
-      .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-pencil"]`)
+      .find(
+        `[data-test-subj="description-action"] [data-test-subj="property-actions-description-pencil"]`
+      )
       .first()
       .simulate('click');
 
@@ -341,12 +345,16 @@ describe(`UserActions`, () => {
     expect(wrapper.find(`.euiMarkdownEditorTextArea`).text()).not.toContain(quoteableText);
 
     wrapper
-      .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-ellipses"]`)
+      .find(
+        `[data-test-subj="description-action"] [data-test-subj="property-actions-description-ellipses"]`
+      )
       .first()
       .simulate('click');
 
     wrapper
-      .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-quote"]`)
+      .find(
+        `[data-test-subj="description-action"] [data-test-subj="property-actions-description-quote"]`
+      )
       .first()
       .simulate('click');
 
@@ -402,14 +410,14 @@ describe(`UserActions`, () => {
 
     wrapper
       .find(
-        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-ellipses"]`
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-user-action-ellipses"]`
       )
       .first()
       .simulate('click');
 
     wrapper
       .find(
-        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-pencil"]`
+        `[data-test-subj="comment-create-action-${props.data.comments[0].id}"] [data-test-subj="property-actions-user-action-pencil"]`
       )
       .first()
       .simulate('click');
@@ -463,12 +471,16 @@ describe(`UserActions`, () => {
       .simulate('change', { target: { value: newComment } });
 
     wrapper
-      .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-ellipses"]`)
+      .find(
+        `[data-test-subj="description-action"] [data-test-subj="property-actions-description-ellipses"]`
+      )
       .first()
       .simulate('click');
 
     wrapper
-      .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-pencil"]`)
+      .find(
+        `[data-test-subj="description-action"] [data-test-subj="property-actions-description-pencil"]`
+      )
       .first()
       .simulate('click');
 
diff --git a/x-pack/plugins/cases/public/components/user_actions/property_actions/alert_property_actions.test.tsx b/x-pack/plugins/cases/public/components/user_actions/property_actions/alert_property_actions.test.tsx
index dc8a57b8477f6..79636d52572ba 100644
--- a/x-pack/plugins/cases/public/components/user_actions/property_actions/alert_property_actions.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/property_actions/alert_property_actions.test.tsx
@@ -34,26 +34,26 @@ describe('AlertPropertyActions', () => {
   it('renders the correct number of actions', async () => {
     const result = appMock.render(<AlertPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.getByTestId('property-actions-group').children.length).toBe(1);
-    expect(result.queryByTestId('property-actions-minusInCircle')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action-group').children.length).toBe(1);
+    expect(result.queryByTestId('property-actions-user-action-minusInCircle')).toBeInTheDocument();
   });
 
   it('renders the modal info correctly for one alert', async () => {
     const result = appMock.render(<AlertPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-minusInCircle')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-minusInCircle')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-minusInCircle'));
+    userEvent.click(result.getByTestId('property-actions-user-action-minusInCircle'));
 
     await waitFor(() => {
       expect(result.queryByTestId('property-actions-confirm-modal')).toBeInTheDocument();
@@ -66,14 +66,14 @@ describe('AlertPropertyActions', () => {
   it('renders the modal info correctly for multiple alert', async () => {
     const result = appMock.render(<AlertPropertyActions {...props} totalAlerts={2} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-minusInCircle')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-minusInCircle')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-minusInCircle'));
+    userEvent.click(result.getByTestId('property-actions-user-action-minusInCircle'));
 
     await waitFor(() => {
       expect(result.queryByTestId('property-actions-confirm-modal')).toBeInTheDocument();
@@ -86,14 +86,14 @@ describe('AlertPropertyActions', () => {
   it('remove alerts correctly', async () => {
     const result = appMock.render(<AlertPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-minusInCircle')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-minusInCircle')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-minusInCircle'));
+    userEvent.click(result.getByTestId('property-actions-user-action-minusInCircle'));
 
     await waitFor(() => {
       expect(result.queryByTestId('property-actions-confirm-modal')).toBeInTheDocument();
@@ -107,13 +107,13 @@ describe('AlertPropertyActions', () => {
     appMock = createAppMockRenderer({ permissions: noCasesPermissions() });
     const result = appMock.render(<AlertPropertyActions {...props} />);
 
-    expect(result.queryByTestId('property-actions')).not.toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action')).not.toBeInTheDocument();
   });
 
   it('does show the property actions with only delete permissions', async () => {
     appMock = createAppMockRenderer({ permissions: onlyDeleteCasesPermission() });
     const result = appMock.render(<AlertPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/cases/public/components/user_actions/property_actions/description_property_actions.test.tsx b/x-pack/plugins/cases/public/components/user_actions/property_actions/description_property_actions.test.tsx
index bfaa349caf46f..4a164c5e1fbda 100644
--- a/x-pack/plugins/cases/public/components/user_actions/property_actions/description_property_actions.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/property_actions/description_property_actions.test.tsx
@@ -29,27 +29,27 @@ describe('DescriptionPropertyActions', () => {
   it('renders the correct number of actions', async () => {
     const result = appMock.render(<DescriptionPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-description')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-description-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.getByTestId('property-actions-group').children.length).toBe(2);
-    expect(result.queryByTestId('property-actions-pencil')).toBeInTheDocument();
-    expect(result.queryByTestId('property-actions-quote')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-description-group').children.length).toBe(2);
+    expect(result.queryByTestId('property-actions-description-pencil')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-description-quote')).toBeInTheDocument();
   });
 
   it('edits the description correctly', async () => {
     const result = appMock.render(<DescriptionPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-description')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-description-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-pencil')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-description-pencil')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-pencil'));
+    userEvent.click(result.getByTestId('property-actions-description-pencil'));
 
     expect(props.onEdit).toHaveBeenCalled();
   });
@@ -57,14 +57,14 @@ describe('DescriptionPropertyActions', () => {
   it('quotes the description correctly', async () => {
     const result = appMock.render(<DescriptionPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-description')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-description-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-quote')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-description-quote')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-quote'));
+    userEvent.click(result.getByTestId('property-actions-description-quote'));
 
     expect(props.onQuote).toHaveBeenCalled();
   });
@@ -73,6 +73,6 @@ describe('DescriptionPropertyActions', () => {
     appMock = createAppMockRenderer({ permissions: noCasesPermissions() });
     const result = appMock.render(<DescriptionPropertyActions {...props} />);
 
-    expect(result.queryByTestId('property-actions')).not.toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-description')).not.toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/cases/public/components/user_actions/property_actions/description_property_actions.tsx b/x-pack/plugins/cases/public/components/user_actions/property_actions/description_property_actions.tsx
index 5ef72a5590140..1b948f57e6448 100644
--- a/x-pack/plugins/cases/public/components/user_actions/property_actions/description_property_actions.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/property_actions/description_property_actions.tsx
@@ -45,7 +45,13 @@ const DescriptionPropertyActionsComponent: React.FC<Props> = ({ isLoading, onEdi
     ];
   }, [permissions.update, permissions.create, onEdit, onQuote]);
 
-  return <UserActionPropertyActions isLoading={isLoading} propertyActions={propertyActions} />;
+  return (
+    <UserActionPropertyActions
+      isLoading={isLoading}
+      propertyActions={propertyActions}
+      customDataTestSubj={'description'}
+    />
+  );
 };
 
 DescriptionPropertyActionsComponent.displayName = 'DescriptionPropertyActions';
diff --git a/x-pack/plugins/cases/public/components/user_actions/property_actions/property_actions.test.tsx b/x-pack/plugins/cases/public/components/user_actions/property_actions/property_actions.test.tsx
index c7cfdb25bb359..ca310ab5121aa 100644
--- a/x-pack/plugins/cases/public/components/user_actions/property_actions/property_actions.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/property_actions/property_actions.test.tsx
@@ -36,19 +36,19 @@ describe('UserActionPropertyActions', () => {
     const result = appMock.render(<UserActionPropertyActions {...props} isLoading={true} />);
 
     expect(result.getByTestId('user-action-title-loading')).toBeInTheDocument();
-    expect(result.queryByTestId('property-actions')).not.toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action')).not.toBeInTheDocument();
   });
 
   it('renders the property actions', async () => {
     const result = appMock.render(<UserActionPropertyActions {...props} isLoading={false} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.getByTestId('property-actions-group').children.length).toBe(1);
-    expect(result.queryByTestId('property-actions-pencil')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action-group').children.length).toBe(1);
+    expect(result.queryByTestId('property-actions-user-action-pencil')).toBeInTheDocument();
   });
 
   it('does not render if properties are empty', async () => {
@@ -56,7 +56,7 @@ describe('UserActionPropertyActions', () => {
       <UserActionPropertyActions {...props} isLoading={false} propertyActions={[]} />
     );
 
-    expect(result.queryByTestId('property-actions')).not.toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action')).not.toBeInTheDocument();
     expect(result.queryByTestId('user-action-title-loading')).not.toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/cases/public/components/user_actions/property_actions/property_actions.tsx b/x-pack/plugins/cases/public/components/user_actions/property_actions/property_actions.tsx
index abf897404711a..975a8670ab096 100644
--- a/x-pack/plugins/cases/public/components/user_actions/property_actions/property_actions.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/property_actions/property_actions.tsx
@@ -13,9 +13,14 @@ import { PropertyActions } from '../../property_actions';
 interface Props {
   isLoading: boolean;
   propertyActions: PropertyActionButtonProps[];
+  customDataTestSubj?: string;
 }
 
-const UserActionPropertyActionsComponent: React.FC<Props> = ({ isLoading, propertyActions }) => {
+const UserActionPropertyActionsComponent: React.FC<Props> = ({
+  isLoading,
+  propertyActions,
+  customDataTestSubj = 'user-action',
+}) => {
   if (propertyActions.length === 0) {
     return null;
   }
@@ -25,7 +30,10 @@ const UserActionPropertyActionsComponent: React.FC<Props> = ({ isLoading, proper
       {isLoading ? (
         <EuiLoadingSpinner data-test-subj="user-action-title-loading" />
       ) : (
-        <PropertyActions propertyActions={propertyActions} />
+        <PropertyActions
+          propertyActions={propertyActions}
+          customDataTestSubj={customDataTestSubj}
+        />
       )}
     </EuiFlexItem>
   );
diff --git a/x-pack/plugins/cases/public/components/user_actions/property_actions/registered_attachments_property_actions.test.tsx b/x-pack/plugins/cases/public/components/user_actions/property_actions/registered_attachments_property_actions.test.tsx
index a756f43893e03..9e391fa6e7042 100644
--- a/x-pack/plugins/cases/public/components/user_actions/property_actions/registered_attachments_property_actions.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/property_actions/registered_attachments_property_actions.test.tsx
@@ -33,26 +33,26 @@ describe('RegisteredAttachmentsPropertyActions', () => {
   it('renders the correct number of actions', async () => {
     const result = appMock.render(<RegisteredAttachmentsPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.getByTestId('property-actions-group').children.length).toBe(1);
-    expect(result.queryByTestId('property-actions-trash')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action-group').children.length).toBe(1);
+    expect(result.queryByTestId('property-actions-user-action-trash')).toBeInTheDocument();
   });
 
   it('renders the modal info correctly', async () => {
     const result = appMock.render(<RegisteredAttachmentsPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-trash')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-trash')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-trash'));
+    userEvent.click(result.getByTestId('property-actions-user-action-trash'));
 
     await waitFor(() => {
       expect(result.queryByTestId('property-actions-confirm-modal')).toBeInTheDocument();
@@ -65,14 +65,14 @@ describe('RegisteredAttachmentsPropertyActions', () => {
   it('remove attachments correctly', async () => {
     const result = appMock.render(<RegisteredAttachmentsPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-trash')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-trash')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-trash'));
+    userEvent.click(result.getByTestId('property-actions-user-action-trash'));
 
     await waitFor(() => {
       expect(result.queryByTestId('property-actions-confirm-modal')).toBeInTheDocument();
@@ -86,13 +86,13 @@ describe('RegisteredAttachmentsPropertyActions', () => {
     appMock = createAppMockRenderer({ permissions: noCasesPermissions() });
     const result = appMock.render(<RegisteredAttachmentsPropertyActions {...props} />);
 
-    expect(result.queryByTestId('property-actions')).not.toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action')).not.toBeInTheDocument();
   });
 
   it('does show the property actions with only delete permissions', async () => {
     appMock = createAppMockRenderer({ permissions: onlyDeleteCasesPermission() });
     const result = appMock.render(<RegisteredAttachmentsPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/cases/public/components/user_actions/property_actions/user_comment_property_actions.test.tsx b/x-pack/plugins/cases/public/components/user_actions/property_actions/user_comment_property_actions.test.tsx
index 557dae707c20f..643662dfbc3f7 100644
--- a/x-pack/plugins/cases/public/components/user_actions/property_actions/user_comment_property_actions.test.tsx
+++ b/x-pack/plugins/cases/public/components/user_actions/property_actions/user_comment_property_actions.test.tsx
@@ -35,28 +35,28 @@ describe('UserCommentPropertyActions', () => {
   it('renders the correct number of actions', async () => {
     const result = appMock.render(<UserCommentPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.getByTestId('property-actions-group').children.length).toBe(3);
-    expect(result.queryByTestId('property-actions-pencil')).toBeInTheDocument();
-    expect(result.queryByTestId('property-actions-trash')).toBeInTheDocument();
-    expect(result.queryByTestId('property-actions-quote')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action-group').children.length).toBe(3);
+    expect(result.queryByTestId('property-actions-user-action-pencil')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-trash')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-quote')).toBeInTheDocument();
   });
 
   it('edits the comment correctly', async () => {
     const result = appMock.render(<UserCommentPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-pencil')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-pencil')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-pencil'));
+    userEvent.click(result.getByTestId('property-actions-user-action-pencil'));
 
     expect(props.onEdit).toHaveBeenCalled();
   });
@@ -64,14 +64,14 @@ describe('UserCommentPropertyActions', () => {
   it('quotes the comment correctly', async () => {
     const result = appMock.render(<UserCommentPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-quote')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-quote')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-quote'));
+    userEvent.click(result.getByTestId('property-actions-user-action-quote'));
 
     expect(props.onQuote).toHaveBeenCalled();
   });
@@ -79,14 +79,14 @@ describe('UserCommentPropertyActions', () => {
   it('deletes the comment correctly', async () => {
     const result = appMock.render(<UserCommentPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-ellipses'));
+    userEvent.click(result.getByTestId('property-actions-user-action-ellipses'));
     await waitForEuiPopoverOpen();
 
-    expect(result.queryByTestId('property-actions-trash')).toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action-trash')).toBeInTheDocument();
 
-    userEvent.click(result.getByTestId('property-actions-trash'));
+    userEvent.click(result.getByTestId('property-actions-user-action-trash'));
 
     await waitFor(() => {
       expect(result.queryByTestId('property-actions-confirm-modal')).toBeInTheDocument();
@@ -100,13 +100,13 @@ describe('UserCommentPropertyActions', () => {
     appMock = createAppMockRenderer({ permissions: noCasesPermissions() });
     const result = appMock.render(<UserCommentPropertyActions {...props} />);
 
-    expect(result.queryByTestId('property-actions')).not.toBeInTheDocument();
+    expect(result.queryByTestId('property-actions-user-action')).not.toBeInTheDocument();
   });
 
   it('does show the property actions with only delete permissions', async () => {
     appMock = createAppMockRenderer({ permissions: onlyDeleteCasesPermission() });
     const result = appMock.render(<UserCommentPropertyActions {...props} />);
 
-    expect(result.getByTestId('property-actions')).toBeInTheDocument();
+    expect(result.getByTestId('property-actions-user-action')).toBeInTheDocument();
   });
 });
diff --git a/x-pack/test/functional/services/cases/list.ts b/x-pack/test/functional/services/cases/list.ts
index 1e420cd37368c..ced5c5acedca2 100644
--- a/x-pack/test/functional/services/cases/list.ts
+++ b/x-pack/test/functional/services/cases/list.ts
@@ -81,9 +81,6 @@ export function CasesTableServiceProvider(
         rows = await find.allByCssSelector('[data-test-subj*="cases-table-row-"', 100);
         if (rows.length > 0) {
           await this.bulkDeleteAllCases();
-          // wait for a second
-          await new Promise((r) => setTimeout(r, 1000));
-          await header.waitUntilLoadingHasFinished();
         }
       } while (rows.length > 0);
     },
diff --git a/x-pack/test/functional/services/cases/single_case_view.ts b/x-pack/test/functional/services/cases/single_case_view.ts
index bd9377ebd5abd..b8bea0841a605 100644
--- a/x-pack/test/functional/services/cases/single_case_view.ts
+++ b/x-pack/test/functional/services/cases/single_case_view.ts
@@ -20,14 +20,12 @@ export function CasesSingleViewServiceProvider({ getService, getPageObject }: Ft
 
   return {
     async deleteCase() {
-      const caseActions = await testSubjects.findDescendant(
-        'property-actions-ellipses',
-        await testSubjects.find('case-view-actions')
-      );
+      await retry.try(async () => {
+        await testSubjects.click('property-actions-case-ellipses');
+        await testSubjects.existOrFail('property-actions-case-trash', { timeout: 100 });
+      });
 
-      await caseActions.click();
-      await testSubjects.existOrFail('property-actions-trash');
-      await common.clickAndValidate('property-actions-trash', 'confirmModalConfirmButton');
+      await common.clickAndValidate('property-actions-case-trash', 'confirmModalConfirmButton');
       await testSubjects.click('confirmModalConfirmButton');
       await header.waitUntilLoadingHasFinished();
     },
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/deletion.ts b/x-pack/test/functional_with_es_ssl/apps/cases/deletion.ts
index 0f8d551ce86aa..4179c549484fb 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/deletion.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/deletion.ts
@@ -17,8 +17,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const testSubjects = getService('testSubjects');
   const cases = getService('cases');
 
-  // Failing: See https://github.com/elastic/kibana/issues/145271
-  describe.skip('cases deletion sub privilege', () => {
+  describe('cases deletion sub privilege', () => {
     before(async () => {
       await createUsersAndRoles(getService, users, roles);
       await PageObjects.security.forceLogout();
@@ -101,7 +100,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
             });
 
             it(`User ${user.username} cannot delete a case while on a specific case page`, async () => {
-              await testSubjects.missingOrFail('case-view-actions');
+              await testSubjects.click('property-actions-case-ellipses');
+              await testSubjects.missingOrFail('property-actions-case-trash');
             });
           });
 
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/view_case.ts b/x-pack/test/functional_with_es_ssl/apps/cases/view_case.ts
index 876857721966f..e808aaa8a4463 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/view_case.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/view_case.ts
@@ -14,7 +14,7 @@ import {
   createUsersAndRoles,
   deleteUsersAndRoles,
 } from '../../../cases_api_integration/common/lib/authentication';
-import { users, roles, casesAllUser } from './common';
+import { users, roles, casesAllUser, casesAllUser2 } from './common';
 
 export default ({ getPageObject, getService }: FtrProviderContext) => {
   const header = getPageObject('header');
@@ -282,22 +282,14 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
 
           await header.waitUntilLoadingHasFinished();
 
-          const propertyActions = await find.allByCssSelector(
-            '[data-test-subj*="property-actions-ellipses"]'
-          );
-
-          propertyActions[propertyActions.length - 1].click();
+          await testSubjects.click('property-actions-user-action-ellipses');
 
           await header.waitUntilLoadingHasFinished();
 
-          const editAction = await find.byCssSelector(
-            '[data-test-subj*="property-actions-pencil"]'
-          );
+          await testSubjects.click('property-actions-user-action-pencil');
 
           await header.waitUntilLoadingHasFinished();
 
-          await editAction.click();
-
           const editCommentTextArea = await find.byCssSelector(
             '[data-test-subj*="user-action-markdown-form"] textarea.euiMarkdownEditorTextArea'
           );
@@ -315,22 +307,14 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
         });
 
         it('shows unsaved description message when page is refreshed', async () => {
-          const propertyActions = await find.allByCssSelector(
-            '[data-test-subj*="property-actions-ellipses"]'
-          );
-
-          propertyActions[1].click();
+          await testSubjects.click('property-actions-description-ellipses');
 
           await header.waitUntilLoadingHasFinished();
 
-          const editAction = await find.byCssSelector(
-            '[data-test-subj*="property-actions-pencil"]'
-          );
+          await testSubjects.click('property-actions-description-pencil');
 
           await header.waitUntilLoadingHasFinished();
 
-          await editAction.click();
-
           const editCommentTextArea = await find.byCssSelector(
             '[data-test-subj*="user-action-markdown-form"] textarea.euiMarkdownEditorTextArea'
           );
@@ -379,7 +363,7 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
     describe('Assignees field', () => {
       before(async () => {
         await createUsersAndRoles(getService, users, roles);
-        await cases.api.activateUserProfiles([casesAllUser]);
+        await cases.api.activateUserProfiles([casesAllUser, casesAllUser2]);
       });
 
       after(async () => {

From 6de805636feef96fad6686ba37d58c9a3dd319e2 Mon Sep 17 00:00:00 2001
From: Sloane Perrault <sloane.perrault@elastic.co>
Date: Mon, 6 Feb 2023 15:44:41 -0500
Subject: [PATCH 015/134] [Enterprise Search] Engines Overview with indices and
 documents count stats (#149980)

## Summary

Adds Engine overview page. Includes panel with document and index counts
in stats components

<img width="1501" alt="image"
src="https://user-images.githubusercontent.com/1699281/216103567-84b8e4f6-d234-4ba1-b346-01e681505caa.png">




### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [x] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)



### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
---
 .../enterprise_search/common/types/engines.ts |   9 +-
 ...ngine_field_capabilities_api_logic.test.ts |  31 +++++
 ...tch_engine_field_capabilities_api_logic.ts |  34 ++++++
 .../components/engine/engine_overview.tsx     | 109 ++++++++++++++++++
 .../engine/engine_overview_logic.test.ts      |  39 +++++++
 .../engine/engine_overview_logic.ts           |  89 ++++++++++++++
 .../components/engine/engine_view.tsx         |   6 +
 .../components/engine/engine_view_logic.ts    |   8 +-
 .../routes/enterprise_search/engines.ts       |  10 ++
 9 files changed, 330 insertions(+), 5 deletions(-)
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/engines/fetch_engine_field_capabilities_api_logic.test.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/engines/fetch_engine_field_capabilities_api_logic.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview_logic.test.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview_logic.ts

diff --git a/x-pack/plugins/enterprise_search/common/types/engines.ts b/x-pack/plugins/enterprise_search/common/types/engines.ts
index 3926be635c5bd..8a0ef6d216a20 100644
--- a/x-pack/plugins/enterprise_search/common/types/engines.ts
+++ b/x-pack/plugins/enterprise_search/common/types/engines.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { HealthStatus } from '@elastic/elasticsearch/lib/api/types';
+import { HealthStatus, FieldCapsResponse } from '@elastic/elasticsearch/lib/api/types';
 
 export interface EnterpriseSearchEnginesResponse {
   meta: {
@@ -37,3 +37,10 @@ export interface EnterpriseSearchEngineIndex {
   name: string;
   source: 'api' | 'connector' | 'crawler';
 }
+
+export interface EnterpriseSearchEngineFieldCapabilities {
+  created: string;
+  field_capabilities: FieldCapsResponse;
+  name: string;
+  updated: string;
+}
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/engines/fetch_engine_field_capabilities_api_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/engines/fetch_engine_field_capabilities_api_logic.test.ts
new file mode 100644
index 0000000000000..5eb05fbed4c8f
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/engines/fetch_engine_field_capabilities_api_logic.test.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { mockHttpValues } from '../../../__mocks__/kea_logic';
+
+import { nextTick } from '@kbn/test-jest-helpers';
+
+import { fetchEngineFieldCapabilities } from './fetch_engine_field_capabilities_api_logic';
+
+describe('FetchEngineFieldCapabilitiesApiLogic', () => {
+  const { http } = mockHttpValues;
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+  describe('fetchEngineFieldCapabilities', () => {
+    it('requests the field_capabilities api', async () => {
+      const promise = Promise.resolve({ result: 'result' });
+      http.get.mockReturnValue(promise);
+      const result = fetchEngineFieldCapabilities({ engineName: 'foobar' });
+      await nextTick();
+      expect(http.get).toHaveBeenCalledWith(
+        '/internal/enterprise_search/engines/foobar/field_capabilities'
+      );
+      await expect(result).resolves.toEqual({ result: 'result' });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/engines/fetch_engine_field_capabilities_api_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/engines/fetch_engine_field_capabilities_api_logic.ts
new file mode 100644
index 0000000000000..7f5d196a5a02d
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/engines/fetch_engine_field_capabilities_api_logic.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EnterpriseSearchEngineFieldCapabilities } from '../../../../../common/types/engines';
+import { Actions, createApiLogic } from '../../../shared/api_logic/create_api_logic';
+import { HttpLogic } from '../../../shared/http';
+
+export interface FetchEngineFieldCapabilitiesApiParams {
+  engineName: string;
+}
+
+export type FetchEngineFieldCapabilitiesApiResponse = EnterpriseSearchEngineFieldCapabilities;
+
+export const fetchEngineFieldCapabilities = async ({
+  engineName,
+}: FetchEngineFieldCapabilitiesApiParams): Promise<FetchEngineFieldCapabilitiesApiResponse> => {
+  const route = `/internal/enterprise_search/engines/${engineName}/field_capabilities`;
+
+  return await HttpLogic.values.http.get<EnterpriseSearchEngineFieldCapabilities>(route);
+};
+
+export const FetchEngineFieldCapabilitiesApiLogic = createApiLogic(
+  ['fetch_engine_field_capabilities_api_logic'],
+  fetchEngineFieldCapabilities
+);
+
+export type FetchEngineFieldCapabilitiesApiLogicActions = Actions<
+  FetchEngineFieldCapabilitiesApiParams,
+  FetchEngineFieldCapabilitiesApiResponse
+>;
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview.tsx
new file mode 100644
index 0000000000000..83312c8290e21
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview.tsx
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { useValues } from 'kea';
+
+import { EuiFlexGroup, EuiFlexItem, EuiIcon, EuiPanel, EuiStat } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { generateEncodedPath } from '../../../shared/encode_path_params';
+import { EuiLinkTo } from '../../../shared/react_router_helpers';
+import { EngineViewTabs, ENGINE_TAB_PATH } from '../../routes';
+import { EnterpriseSearchEnginesPageTemplate } from '../layout/engines_page_template';
+
+import { EngineOverviewLogic } from './engine_overview_logic';
+import { EngineViewHeaderActions } from './engine_view_header_actions';
+
+export const EngineOverview: React.FC = () => {
+  const { engineName, indicesCount, documentsCount, fieldsCount, isLoadingEngine } =
+    useValues(EngineOverviewLogic);
+
+  return (
+    <EnterpriseSearchEnginesPageTemplate
+      pageChrome={[engineName]}
+      pageViewTelemetry={EngineViewTabs.OVERVIEW}
+      isLoading={isLoadingEngine}
+      pageHeader={{
+        pageTitle: i18n.translate('xpack.enterpriseSearch.content.engine.overview.pageTitle', {
+          defaultMessage: 'Overview',
+        }),
+        rightSideItems: [<EngineViewHeaderActions />],
+      }}
+      engineName={engineName}
+    >
+      <>
+        <EuiPanel hasShadow={false} hasBorder paddingSize="l">
+          <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
+            <EuiFlexItem>
+              <EuiLinkTo
+                to={generateEncodedPath(ENGINE_TAB_PATH, {
+                  engineName,
+                  tabId: EngineViewTabs.INDICES,
+                })}
+                color="text"
+              >
+                <EuiFlexGroup alignItems="center">
+                  <EuiIcon size="xxl" type="visTable" color="#98A2B3" />
+                  <EuiStat
+                    titleSize="l"
+                    isLoading={isLoadingEngine}
+                    title={indicesCount.toLocaleString()}
+                    description={i18n.translate(
+                      'xpack.enterpriseSearch.content.engine.overview.indicesDescription',
+                      { defaultMessage: 'Indices' }
+                    )}
+                    titleColor="primary"
+                  />
+                </EuiFlexGroup>
+              </EuiLinkTo>
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiFlexGroup alignItems="center">
+                <EuiIcon size="xxl" type="documents" color="#98A2B3" />
+                <EuiStat
+                  titleSize="l"
+                  isLoading={isLoadingEngine}
+                  title={documentsCount.toLocaleString()}
+                  description={i18n.translate(
+                    'xpack.enterpriseSearch.content.engine.overview.documentsDescription',
+                    { defaultMessage: 'Documents' }
+                  )}
+                  titleColor="primary"
+                />
+              </EuiFlexGroup>
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiLinkTo
+                to={generateEncodedPath(ENGINE_TAB_PATH, {
+                  engineName,
+                  tabId: EngineViewTabs.SCHEMA,
+                })}
+                color="text"
+              >
+                <EuiFlexGroup alignItems="center">
+                  <EuiIcon size="xxl" type="documents" color="#98A2B3" />
+                  <EuiStat
+                    titleSize="l"
+                    isLoading={false}
+                    title={fieldsCount.toLocaleString()}
+                    description={i18n.translate(
+                      'xpack.enterpriseSearch.content.engine.overview.fieldsDescription',
+                      { defaultMessage: 'Fields' }
+                    )}
+                    titleColor="primary"
+                  />
+                </EuiFlexGroup>
+              </EuiLinkTo>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiPanel>
+      </>
+    </EnterpriseSearchEnginesPageTemplate>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview_logic.test.ts
new file mode 100644
index 0000000000000..0a012a07fd9da
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview_logic.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { LogicMounter } from '../../../__mocks__/kea_logic';
+
+import { Status } from '../../../../../common/types/api';
+
+import { EngineOverviewLogic, EngineOverviewValues } from './engine_overview_logic';
+
+const DEFAULT_VALUES: EngineOverviewValues = {
+  documentsCount: 0,
+  engineData: undefined,
+  engineFieldCapabilitiesApiStatus: Status.IDLE,
+  engineFieldCapabilitiesData: undefined,
+  engineName: '',
+  fieldsCount: 0,
+  indices: [],
+  indicesCount: 0,
+  isLoadingEngine: true,
+};
+
+describe('EngineOverviewLogic', () => {
+  const { mount } = new LogicMounter(EngineOverviewLogic);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.useRealTimers();
+
+    mount();
+  });
+
+  it('has expected default values', () => {
+    expect(EngineOverviewLogic.values).toEqual(DEFAULT_VALUES);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview_logic.ts
new file mode 100644
index 0000000000000..f6a8508d131b1
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview_logic.ts
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { kea, MakeLogicType } from 'kea';
+
+import { Status } from '../../../../../common/types/api';
+import { EnterpriseSearchEngineIndex } from '../../../../../common/types/engines';
+
+import { FetchEngineFieldCapabilitiesApiLogic } from '../../api/engines/fetch_engine_field_capabilities_api_logic';
+
+import { EngineNameLogic } from './engine_name_logic';
+import { EngineViewLogic } from './engine_view_logic';
+
+export interface EngineOverviewActions {
+  fetchEngineFieldCapabilities: typeof FetchEngineFieldCapabilitiesApiLogic.actions.makeRequest;
+}
+export interface EngineOverviewValues {
+  documentsCount: number;
+  engineData: typeof EngineViewLogic.values.engineData;
+  engineFieldCapabilitiesApiStatus: typeof FetchEngineFieldCapabilitiesApiLogic.values.status;
+  engineFieldCapabilitiesData: typeof FetchEngineFieldCapabilitiesApiLogic.values.data;
+  engineName: typeof EngineNameLogic.values.engineName;
+  fieldsCount: number;
+  indices: EnterpriseSearchEngineIndex[];
+  indicesCount: number;
+  isLoadingEngine: typeof EngineViewLogic.values.isLoadingEngine;
+}
+
+export const EngineOverviewLogic = kea<MakeLogicType<EngineOverviewValues, EngineOverviewActions>>({
+  actions: {},
+  connect: {
+    actions: [
+      EngineNameLogic,
+      ['setEngineName'],
+      FetchEngineFieldCapabilitiesApiLogic,
+      ['makeRequest as fetchEngineFieldCapabilities'],
+    ],
+    values: [
+      EngineNameLogic,
+      ['engineName'],
+      EngineViewLogic,
+      ['engineData', 'isLoadingEngine'],
+      FetchEngineFieldCapabilitiesApiLogic,
+      ['data as engineFieldCapabilitiesData', 'status as engineFieldCapabilitiesApiStatus'],
+    ],
+  },
+  events: ({ actions, values }) => ({
+    afterMount: () => {
+      if (values.engineFieldCapabilitiesApiStatus !== Status.SUCCESS && !!values.engineName) {
+        actions.fetchEngineFieldCapabilities({
+          engineName: values.engineName,
+        });
+      }
+    },
+  }),
+  listeners: ({ actions }) => ({
+    setEngineName: ({ engineName }) => {
+      actions.fetchEngineFieldCapabilities({ engineName });
+    },
+  }),
+  path: ['enterprise_search', 'content', 'engine_overview_logic'],
+  reducers: {},
+  selectors: ({ selectors }) => ({
+    documentsCount: [
+      () => [selectors.indices],
+      (indices: EngineOverviewValues['indices']) =>
+        indices.reduce((sum, { count }) => sum + count, 0),
+    ],
+    fieldsCount: [
+      () => [selectors.engineFieldCapabilitiesData],
+      (engineFieldCapabilitiesData: EngineOverviewValues['engineFieldCapabilitiesData']) =>
+        Object.values(engineFieldCapabilitiesData?.field_capabilities?.fields ?? {}).filter(
+          (value) => !Object.values(value).some((field) => !!field.metadata_field)
+        ).length,
+    ],
+    indices: [
+      () => [selectors.engineData],
+      (engineData: EngineOverviewValues['engineData']) => engineData?.indices ?? [],
+    ],
+    indicesCount: [
+      () => [selectors.indices],
+      (indices: EngineOverviewValues['indices']) => indices.length,
+    ],
+  }),
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view.tsx
index e6057a2d1b2bd..0c65e8008f74e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view.tsx
@@ -21,6 +21,7 @@ import { EnterpriseSearchEnginesPageTemplate } from '../layout/engines_page_temp
 import { EngineAPI } from './engine_api/engine_api';
 import { EngineError } from './engine_error';
 import { EngineIndices } from './engine_indices';
+import { EngineOverview } from './engine_overview';
 import { EngineViewHeaderActions } from './engine_view_header_actions';
 import { EngineViewLogic } from './engine_view_logic';
 import { EngineHeaderDocsAction } from './header_docs_action';
@@ -66,6 +67,11 @@ export const EngineView: React.FC = () => {
         <DeleteEngineModal engineName={engineName} onClose={closeDeleteEngineModal} />
       ) : null}
       <Switch>
+        <Route
+          exact
+          path={`${ENGINE_PATH}/${EngineViewTabs.OVERVIEW}`}
+          component={EngineOverview}
+        />
         <Route exact path={`${ENGINE_PATH}/${EngineViewTabs.INDICES}`} component={EngineIndices} />
         <Route exact path={`${ENGINE_PATH}/${EngineViewTabs.API}`} component={EngineAPI} />
         <Route // TODO: remove this route when all engine view routes are implemented, replace with a 404 route
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view_logic.ts
index 1cc3bfc5f4e90..96d5387a85fc0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_view_logic.ts
@@ -39,6 +39,10 @@ export interface EngineViewValues {
 }
 
 export const EngineViewLogic = kea<MakeLogicType<EngineViewValues, EngineViewActions>>({
+  actions: {
+    closeDeleteEngineModal: true,
+    openDeleteEngineModal: true,
+  },
   connect: {
     actions: [
       FetchEngineApiLogic,
@@ -53,10 +57,6 @@ export const EngineViewLogic = kea<MakeLogicType<EngineViewValues, EngineViewAct
       ['data as engineData', 'status as fetchEngineApiStatus', 'error as fetchEngineApiError'],
     ],
   },
-  actions: {
-    closeDeleteEngineModal: true,
-    openDeleteEngineModal: true,
-  },
   listeners: ({ actions }) => ({
     deleteSuccess: () => {
       actions.closeDeleteEngineModal();
diff --git a/x-pack/plugins/enterprise_search/server/routes/enterprise_search/engines.ts b/x-pack/plugins/enterprise_search/server/routes/enterprise_search/engines.ts
index c64c86b35fadb..2a0469d77cd48 100644
--- a/x-pack/plugins/enterprise_search/server/routes/enterprise_search/engines.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/enterprise_search/engines.ts
@@ -128,4 +128,14 @@ export function registerEnginesRoutes({
       path: '/api/engines/:engine_name/_search',
     })
   );
+
+  router.get(
+    {
+      path: '/internal/enterprise_search/engines/{engine_name}/field_capabilities',
+      validate: { params: schema.object({ engine_name: schema.string() }) },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/api/engines/:engine_name/field_capabilities',
+    })
+  );
 }

From 6e5fe42aaa607e71a3c15824cdb8306e1255f955 Mon Sep 17 00:00:00 2001
From: Steph Milovic <stephanie.milovic@elastic.co>
Date: Mon, 6 Feb 2023 13:59:20 -0700
Subject: [PATCH 016/134] [Security solution] Network page maps, fix bad side
 effects (#149368)

---
 .../explore/containers/fields/index.test.ts   | 51 +++++++++----------
 .../public/explore/containers/fields/index.ts | 30 +++++++----
 .../embeddables/embedded_map.test.tsx         | 19 ++++---
 .../components/embeddables/embedded_map.tsx   | 31 +++++------
 4 files changed, 73 insertions(+), 58 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/explore/containers/fields/index.test.ts b/x-pack/plugins/security_solution/public/explore/containers/fields/index.test.ts
index b10801ed41364..03084ef42dd8d 100644
--- a/x-pack/plugins/security_solution/public/explore/containers/fields/index.test.ts
+++ b/x-pack/plugins/security_solution/public/explore/containers/fields/index.test.ts
@@ -6,30 +6,15 @@
  */
 import { useKibana } from '../../../common/lib/kibana';
 import { useIsFieldInIndexPattern } from '.';
+import { renderHook } from '@testing-library/react-hooks';
+import { getRequiredMapsFields } from '../../network/components/embeddables/map_config';
 
 jest.mock('../../../common/lib/kibana');
+jest.mock('../../network/components/embeddables/map_config');
 const mockUseKibana = useKibana as jest.Mock;
 describe('useIsFieldInIndexPattern', () => {
-  beforeAll(() => {
-    mockUseKibana.mockReturnValue({
-      services: {
-        data: {
-          dataViews: {
-            getFieldsForWildcard: () => [],
-          },
-        },
-      },
-    });
-  });
   beforeEach(() => {
     jest.clearAllMocks();
-  });
-  it('returns false when no fields in field list exist in the index pattern', async () => {
-    const isFieldInIndexPattern = useIsFieldInIndexPattern();
-    const res = await isFieldInIndexPattern('index-pattern-*', ['fields.list']);
-    expect(res).toEqual(false);
-  });
-  it('returns false when some but not all fields in field list exist in the index pattern', async () => {
     mockUseKibana.mockReturnValue({
       services: {
         http: {},
@@ -40,23 +25,37 @@ describe('useIsFieldInIndexPattern', () => {
         },
       },
     });
-    const isFieldInIndexPattern = useIsFieldInIndexPattern();
-    const res = await isFieldInIndexPattern('index-pattern-*', ['fields.list', 'another']);
-    expect(res).toEqual(false);
+    (getRequiredMapsFields as jest.Mock).mockReturnValue(['fields.list']);
   });
-  it('returns true when all fields in field list exist in the index pattern', async () => {
+  it('returns false when no fields in field list exist in the index pattern', async () => {
     mockUseKibana.mockReturnValue({
       services: {
-        http: {},
         data: {
           dataViews: {
-            getFieldsForWildcard: () => [{ name: 'fields.list' }],
+            getFieldsForWildcard: () => [],
           },
         },
       },
     });
-    const isFieldInIndexPattern = useIsFieldInIndexPattern();
-    const res = await isFieldInIndexPattern('index-pattern-*', ['fields.list']);
+    const {
+      result: { current: isFieldInIndexPattern },
+    } = renderHook(useIsFieldInIndexPattern);
+    const res = await isFieldInIndexPattern('index-pattern-*');
+    expect(res).toEqual(false);
+  });
+  it('returns false when some but not all fields in field list exist in the index pattern', async () => {
+    (getRequiredMapsFields as jest.Mock).mockReturnValue(['fields.list', 'another']);
+    const {
+      result: { current: isFieldInIndexPattern },
+    } = renderHook(useIsFieldInIndexPattern);
+    const res = await isFieldInIndexPattern('index-pattern-*');
+    expect(res).toEqual(false);
+  });
+  it('returns true when all fields in field list exist in the index pattern', async () => {
+    const {
+      result: { current: isFieldInIndexPattern },
+    } = renderHook(useIsFieldInIndexPattern);
+    const res = await isFieldInIndexPattern('index-pattern-*');
     expect(res).toEqual(true);
   });
 });
diff --git a/x-pack/plugins/security_solution/public/explore/containers/fields/index.ts b/x-pack/plugins/security_solution/public/explore/containers/fields/index.ts
index 81c6765e409c6..b120956ab24c4 100644
--- a/x-pack/plugins/security_solution/public/explore/containers/fields/index.ts
+++ b/x-pack/plugins/security_solution/public/explore/containers/fields/index.ts
@@ -5,18 +5,30 @@
  * 2.0.
  */
 
+import { useMemo } from 'react';
+import memoizeOne from 'memoize-one';
+import { getRequiredMapsFields } from '../../network/components/embeddables/map_config';
 import { useKibana } from '../../../common/lib/kibana';
 
-type FieldValidationCheck = (pattern: string, fieldsList: string[]) => Promise<boolean>;
+type FieldValidationCheck = (pattern: string) => Promise<boolean>;
 
 export const useIsFieldInIndexPattern = (): FieldValidationCheck => {
   const { dataViews } = useKibana().services.data;
-  return async (pattern: string, fieldsList: string[]) => {
-    const fields = await dataViews.getFieldsForWildcard({
-      pattern,
-      fields: fieldsList,
-    });
-    const fieldNames = fields.map((f) => f.name);
-    return fieldsList.every((field) => fieldNames.includes(field));
-  };
+
+  return useMemo(
+    () =>
+      memoizeOne(
+        async (pattern: string) => {
+          const fieldsList = getRequiredMapsFields(pattern);
+          const fields = await dataViews.getFieldsForWildcard({
+            pattern,
+            fields: fieldsList,
+          });
+          const fieldNames = fields.map((f) => f.name);
+          return fieldsList.every((field) => fieldNames.includes(field));
+        },
+        (newArgs, lastArgs) => newArgs[0] === lastArgs[0]
+      ),
+    [dataViews]
+  );
 };
diff --git a/x-pack/plugins/security_solution/public/explore/network/components/embeddables/embedded_map.test.tsx b/x-pack/plugins/security_solution/public/explore/network/components/embeddables/embedded_map.test.tsx
index 4c938d5e92d78..4a78cd8939921 100644
--- a/x-pack/plugins/security_solution/public/explore/network/components/embeddables/embedded_map.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/network/components/embeddables/embedded_map.test.tsx
@@ -58,9 +58,9 @@ const mockGetStorage = jest.fn();
 const mockSetStorage = jest.fn();
 const setQuery: jest.Mock = jest.fn();
 const filebeatDataView = { id: '6f1eeb50-023d-11eb-bcb6-6ba0578012a9', title: 'filebeat-*' };
-const auditbeatDataView = { id: '28995490-023d-11eb-bcb6-6ba0578012a9', title: 'auditbeat-*' };
+const packetbeatDataView = { id: '28995490-023d-11eb-bcb6-6ba0578012a9', title: 'packetbeat-*' };
 const mockSelector = {
-  kibanaDataViews: [filebeatDataView, auditbeatDataView],
+  kibanaDataViews: [filebeatDataView, packetbeatDataView],
 };
 const embeddableValue = {
   destroyed: false,
@@ -102,9 +102,9 @@ describe('EmbeddedMapComponent', () => {
     setQuery.mockClear();
     mockGetStorage.mockReturnValue(true);
     jest.spyOn(redux, 'useSelector').mockReturnValue(mockSelector);
-    mockUseSourcererDataView.mockReturnValue({ selectedPatterns: ['filebeat-*', 'packetbeat-*'] });
+    mockUseSourcererDataView.mockReturnValue({ selectedPatterns: ['filebeat-*', 'auditbeat-*'] });
     mockCreateEmbeddable.mockResolvedValue(embeddableValue);
-    mockUseIsFieldInIndexPattern.mockReturnValue(() => [true, true]);
+    mockUseIsFieldInIndexPattern.mockReturnValue(() => true);
   });
 
   afterEach(() => {
@@ -215,9 +215,9 @@ describe('EmbeddedMapComponent', () => {
   });
 
   test('On rerender with new selected patterns, selects existing Kibana data views that match any selected index pattern', async () => {
-    mockUseSourcererDataView
-      .mockReturnValueOnce({ selectedPatterns: ['filebeat-*', 'packetbeat-*'] })
-      .mockReturnValue({ selectedPatterns: ['filebeat-*', 'auditbeat-*'] });
+    mockUseSourcererDataView.mockReturnValue({
+      selectedPatterns: ['filebeat-*', 'auditbeat-*'],
+    });
     const { rerender } = render(
       <TestProviders>
         <EmbeddedMapComponent {...testProps} />
@@ -227,6 +227,9 @@ describe('EmbeddedMapComponent', () => {
       const dataViewArg = (getLayerList as jest.Mock).mock.calls[0][0];
       expect(dataViewArg).toEqual([filebeatDataView]);
     });
+    mockUseSourcererDataView.mockReturnValue({
+      selectedPatterns: ['filebeat-*', 'packetbeat-*'],
+    });
     rerender(
       <TestProviders>
         <EmbeddedMapComponent {...testProps} />
@@ -235,7 +238,7 @@ describe('EmbeddedMapComponent', () => {
     await waitFor(() => {
       // data view is updated with the returned embeddable.setLayerList callback, which is passesd getLayerList(dataViews)
       const dataViewArg = (getLayerList as jest.Mock).mock.calls[1][0];
-      expect(dataViewArg).toEqual([filebeatDataView, auditbeatDataView]);
+      expect(dataViewArg).toEqual([filebeatDataView, packetbeatDataView]);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/explore/network/components/embeddables/embedded_map.tsx b/x-pack/plugins/security_solution/public/explore/network/components/embeddables/embedded_map.tsx
index 14215000c5611..8e94720398d70 100644
--- a/x-pack/plugins/security_solution/public/explore/network/components/embeddables/embedded_map.tsx
+++ b/x-pack/plugins/security_solution/public/explore/network/components/embeddables/embedded_map.tsx
@@ -5,15 +5,17 @@
  * 2.0.
  */
 
+// embedded map v2
+
 import { EuiAccordion, EuiLink, EuiText } from '@elastic/eui';
 import React, { useCallback, useEffect, useState, useMemo } from 'react';
 import { createHtmlPortalNode, InPortal } from 'react-reverse-portal';
 import styled, { css } from 'styled-components';
-
 import type { Filter, Query } from '@kbn/es-query';
 import type { ErrorEmbeddable } from '@kbn/embeddable-plugin/public';
 import { isErrorEmbeddable } from '@kbn/embeddable-plugin/public';
 import type { MapEmbeddable } from '@kbn/maps-plugin/public/embeddable';
+import { isEqual } from 'lodash/fp';
 import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
 import { useIsFieldInIndexPattern } from '../../../containers/fields';
 import { Loader } from '../../../../common/components/loader';
@@ -24,7 +26,7 @@ import { IndexPatternsMissingPrompt } from './index_patterns_missing_prompt';
 import { MapToolTip } from './map_tool_tip/map_tool_tip';
 import * as i18n from './translations';
 import { useKibana } from '../../../../common/lib/kibana';
-import { getLayerList, getRequiredMapsFields } from './map_config';
+import { getLayerList } from './map_config';
 import { sourcererSelectors } from '../../../../common/store/sourcerer';
 import type { SourcererDataView } from '../../../../common/store/sourcerer/model';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
@@ -123,16 +125,7 @@ export const EmbeddedMapComponent = ({
   const isFieldInIndexPattern = useIsFieldInIndexPattern();
 
   const [mapDataViews, setMapDataViews] = useState<SourcererDataView[]>([]);
-
-  const availableDataViews = useMemo(() => {
-    const dataViews = kibanaDataViews.filter((dataView) =>
-      selectedPatterns.includes(dataView.title)
-    );
-    if (selectedPatterns.length > 0 && dataViews.length === 0) {
-      setIsIndexError(true);
-    }
-    return dataViews;
-  }, [kibanaDataViews, selectedPatterns]);
+  const [availableDataViews, setAvailableDataViews] = useState<SourcererDataView[]>([]);
 
   useEffect(() => {
     let canceled = false;
@@ -140,9 +133,7 @@ export const EmbeddedMapComponent = ({
     const fetchData = async () => {
       try {
         const apiResponse = await Promise.all(
-          availableDataViews.map(async ({ title }) =>
-            isFieldInIndexPattern(title, getRequiredMapsFields(title))
-          )
+          availableDataViews.map(async ({ title }) => isFieldInIndexPattern(title))
         );
         // ensures only index patterns with maps fields are passed
         const goodDataViews = availableDataViews.filter((_, i) => apiResponse[i] ?? false);
@@ -165,6 +156,16 @@ export const EmbeddedMapComponent = ({
     };
   }, [addError, availableDataViews, isFieldInIndexPattern]);
 
+  useEffect(() => {
+    const dataViews = kibanaDataViews.filter((dataView) =>
+      selectedPatterns.includes(dataView.title)
+    );
+    if (selectedPatterns.length > 0 && dataViews.length === 0) {
+      setIsIndexError(true);
+    }
+    setAvailableDataViews((prevViews) => (isEqual(prevViews, dataViews) ? prevViews : dataViews));
+  }, [kibanaDataViews, selectedPatterns]);
+
   // This portalNode provided by react-reverse-portal allows us re-parent the MapToolTip within our
   // own component tree instead of the embeddables (default). This is necessary to have access to
   // the Redux store, theme provider, etc, which is required to register and un-register the draggable

From 0188a895aa7f0021588d2da98f9d1b63bb0daa25 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Mon, 6 Feb 2023 16:06:27 -0500
Subject: [PATCH 017/134] skip failing test suite (#134517)

---
 .../reporting_and_security/usage/api_counters.ts               | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/usage/api_counters.ts b/x-pack/test/reporting_api_integration/reporting_and_security/usage/api_counters.ts
index 93b7d4d71fafb..6995436c47c50 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/usage/api_counters.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/usage/api_counters.ts
@@ -17,7 +17,8 @@ export default function ({ getService }: FtrProviderContext) {
   const usageAPI = getService('usageAPI');
   const reportingAPI = getService('reportingAPI');
 
-  describe(`Usage Counters`, () => {
+  // Failing: See https://github.com/elastic/kibana/issues/134517
+  describe.skip(`Usage Counters`, () => {
     before(async () => {
       await esArchiver.emptyKibanaIndex();
       await reportingAPI.initEcommerce();

From c37e2542cf2cd2f2b4d1258b7d78f762e9176230 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Mon, 6 Feb 2023 16:12:19 -0500
Subject: [PATCH 018/134] skip failing test suite (#149942)

---
 .../reporting_and_security/usage/api_counters.ts                 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/usage/api_counters.ts b/x-pack/test/reporting_api_integration/reporting_and_security/usage/api_counters.ts
index 6995436c47c50..e490d88820756 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/usage/api_counters.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/usage/api_counters.ts
@@ -18,6 +18,7 @@ export default function ({ getService }: FtrProviderContext) {
   const reportingAPI = getService('reportingAPI');
 
   // Failing: See https://github.com/elastic/kibana/issues/134517
+  // Failing: See https://github.com/elastic/kibana/issues/149942
   describe.skip(`Usage Counters`, () => {
     before(async () => {
       await esArchiver.emptyKibanaIndex();

From b37eefce2d1988015f309de29e2d3971d23defa1 Mon Sep 17 00:00:00 2001
From: Ersin Erdal <92688503+ersin-erdal@users.noreply.github.com>
Date: Mon, 6 Feb 2023 22:12:33 +0100
Subject: [PATCH 019/134] Make "for each alert" option default for all the rule
 types (#150344)

As some of the users are using a template to fill out the message input
with `for each alert` params, having `summary of alerts` option default
causes some problems.

Therefore, this PR intends to make "for each alert" option default for
all the rule types.
---
 .../action_connector_form/action_form.tsx     | 10 ++--
 .../action_notify_when.test.tsx               | 19 +++----
 .../action_notify_when.tsx                    | 51 ++-----------------
 .../action_type_form.test.tsx                 | 14 ++---
 .../sections/rule_form/rule_reducer.ts        |  4 +-
 .../constants/action_frequency_types.ts       |  8 +--
 6 files changed, 26 insertions(+), 80 deletions(-)

diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
index 900d2339ec87e..cc2810897bb08 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
@@ -35,11 +35,7 @@ import { ActionTypeForm } from './action_type_form';
 import { AddConnectorInline } from './connector_add_inline';
 import { actionTypeCompare } from '../../lib/action_type_compare';
 import { checkActionFormActionTypeEnabled } from '../../lib/check_action_type_enabled';
-import {
-  DEFAULT_FREQUENCY_WITH_SUMMARY,
-  DEFAULT_FREQUENCY_WITHOUT_SUMMARY,
-  VIEW_LICENSE_OPTIONS_LINK,
-} from '../../../common/constants';
+import { DEFAULT_FREQUENCY, VIEW_LICENSE_OPTIONS_LINK } from '../../../common/constants';
 import { useKibana } from '../../../common/lib/kibana';
 import { ConnectorAddModal } from '.';
 import { suspendedComponentWithProps } from '../../lib/suspended_component_with_props';
@@ -224,7 +220,7 @@ export const ActionForm = ({
         actionTypeId: actionTypeModel.id,
         group: defaultActionGroupId,
         params: {},
-        frequency: hasSummary ? DEFAULT_FREQUENCY_WITH_SUMMARY : DEFAULT_FREQUENCY_WITHOUT_SUMMARY,
+        frequency: DEFAULT_FREQUENCY,
       });
       setActionIdByIndex(actionTypeConnectors[0].id, actions.length - 1);
     }
@@ -236,7 +232,7 @@ export const ActionForm = ({
         actionTypeId: actionTypeModel.id,
         group: defaultActionGroupId,
         params: {},
-        frequency: hasSummary ? DEFAULT_FREQUENCY_WITH_SUMMARY : DEFAULT_FREQUENCY_WITHOUT_SUMMARY,
+        frequency: DEFAULT_FREQUENCY,
       });
       setActionIdByIndex(actions.length.toString(), actions.length - 1);
       setEmptyActionsIds([...emptyActionsIds, actions.length.toString()]);
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_notify_when.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_notify_when.test.tsx
index 8fd286784824c..8186a7edbf09d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_notify_when.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_notify_when.test.tsx
@@ -12,14 +12,11 @@ import { act } from 'react-dom/test-utils';
 import { RuleAction } from '../../../types';
 import { ActionNotifyWhen } from './action_notify_when';
 import { RuleNotifyWhen } from '@kbn/alerting-plugin/common';
-import {
-  DEFAULT_FREQUENCY_WITHOUT_SUMMARY,
-  DEFAULT_FREQUENCY_WITH_SUMMARY,
-} from '../../../common/constants';
+import { DEFAULT_FREQUENCY } from '../../../common/constants';
 
 describe('action_notify_when', () => {
   async function setup(
-    frequency: RuleAction['frequency'] = DEFAULT_FREQUENCY_WITH_SUMMARY,
+    frequency: RuleAction['frequency'] = DEFAULT_FREQUENCY,
     hasSummary: boolean = true
   ) {
     const wrapper = mountWithIntl(
@@ -50,15 +47,15 @@ describe('action_notify_when', () => {
         '[data-test-subj="summaryOrPerRuleSelect"]'
       );
       expect(summaryOrPerRuleSelect.exists()).toBeTruthy();
-      expect(summaryOrPerRuleSelect.first().props()['aria-label']).toEqual('Summary of alerts');
+      expect(summaryOrPerRuleSelect.first().props()['aria-label']).toEqual('For each alert');
 
       const notifyWhenSelect = wrapperDefault.find('[data-test-subj="notifyWhenSelect"]');
       expect(notifyWhenSelect.exists()).toBeTruthy();
       expect((notifyWhenSelect.first().props() as EuiSuperSelectProps<''>).valueOfSelected).toEqual(
-        RuleNotifyWhen.ACTIVE
+        RuleNotifyWhen.CHANGE
       );
     }
-    const wrapperForEach = await setup(DEFAULT_FREQUENCY_WITHOUT_SUMMARY);
+    const wrapperForEach = await setup(DEFAULT_FREQUENCY);
     {
       const summaryOrPerRuleSelect = wrapperForEach.find(
         '[data-test-subj="summaryOrPerRuleSelect"]'
@@ -73,7 +70,7 @@ describe('action_notify_when', () => {
       );
     }
     const wrapperSummaryThrottle = await setup({
-      ...DEFAULT_FREQUENCY_WITH_SUMMARY,
+      ...DEFAULT_FREQUENCY,
       throttle: '5h',
       notifyWhen: RuleNotifyWhen.THROTTLE,
     });
@@ -82,7 +79,7 @@ describe('action_notify_when', () => {
         '[data-test-subj="summaryOrPerRuleSelect"]'
       );
       expect(summaryOrPerRuleSelect.exists()).toBeTruthy();
-      expect(summaryOrPerRuleSelect.first().props()['aria-label']).toEqual('Summary of alerts');
+      expect(summaryOrPerRuleSelect.first().props()['aria-label']).toEqual('For each alert');
 
       const notifyWhenSelect = wrapperSummaryThrottle.find('[data-test-subj="notifyWhenSelect"]');
       expect(notifyWhenSelect.exists()).toBeTruthy();
@@ -99,7 +96,7 @@ describe('action_notify_when', () => {
   });
 
   it('hides the summary selector when hasSummary is false', async () => {
-    const wrapper = await setup(DEFAULT_FREQUENCY_WITHOUT_SUMMARY, false);
+    const wrapper = await setup(DEFAULT_FREQUENCY, false);
     const summaryOrPerRuleSelect = wrapper.find('[data-test-subj="summaryOrPerRuleSelect"]');
     expect(summaryOrPerRuleSelect.exists()).toBeFalsy();
   });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_notify_when.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_notify_when.tsx
index 5735568df592d..5295fcc08131d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_notify_when.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_notify_when.tsx
@@ -29,10 +29,7 @@ import { some, filter, map } from 'fp-ts/lib/Option';
 import { pipe } from 'fp-ts/lib/pipeable';
 import { getTimeOptions } from '../../../common/lib/get_time_options';
 import { RuleNotifyWhenType, RuleAction } from '../../../types';
-import {
-  DEFAULT_FREQUENCY_WITH_SUMMARY,
-  DEFAULT_FREQUENCY_WITHOUT_SUMMARY,
-} from '../../../common/constants';
+import { DEFAULT_FREQUENCY } from '../../../common/constants';
 
 export const NOTIFY_WHEN_OPTIONS: Array<EuiSuperSelectOption<RuleNotifyWhenType>> = [
   {
@@ -135,7 +132,7 @@ interface ActionNotifyWhenProps {
 
 export const ActionNotifyWhen = ({
   hasSummary,
-  frequency = hasSummary ? DEFAULT_FREQUENCY_WITH_SUMMARY : DEFAULT_FREQUENCY_WITHOUT_SUMMARY,
+  frequency = DEFAULT_FREQUENCY,
   throttle,
   throttleUnit,
   onNotifyWhenChange,
@@ -146,32 +143,7 @@ export const ActionNotifyWhen = ({
 }: ActionNotifyWhenProps) => {
   const [showCustomThrottleOpts, setShowCustomThrottleOpts] = useState<boolean>(false);
   const [notifyWhenValue, setNotifyWhenValue] = useState<RuleNotifyWhenType>(
-    hasSummary
-      ? DEFAULT_FREQUENCY_WITH_SUMMARY.notifyWhen
-      : DEFAULT_FREQUENCY_WITHOUT_SUMMARY.notifyWhen
-  );
-
-  // Track whether the user has changed the notify when value from default. This is necessary because the
-  // "default" notifyWhen value for summary: true is the second menu item for summary: false. We want the UX to be:
-  // Case A
-  // - User opens the form with summary: false, notifyWhen: CHANGE
-  // - User switches to summary: true, necessitating a switch to notifyWhen: ACTIVE
-  // - User doesn't touch notifyWhen: ACTIVE, switches back to summary: false. notifyWhen should switch to CHANGE, the 1st menu option
-  // Case B
-  // - User opens the form with summary: false, notifyWhen: ACTIVE (not the "default")
-  // - User switches to summary: true
-  // - User switches back to summary: false. notifyWhen stays ACTIVE
-  // Case C
-  // - User opens the form with summary: true, notifyWhen: ACTIVE (the "default")
-  // - User doesn't change notifyWhen, just sets summary: false. notifyWhen should switch to CHANGE
-  // Case D
-  // - User opens the form with summary: true, notifyWhen: THROTTLE, or summary: false, notifyWhen: !CHANGE
-  // - When user changes summary, leave notifyWhen unchanged
-  const [notifyWhenValueChangedFromDefault, setNotifyWhenValueChangedFromDefault] = useState(
-    // Check if the initial notifyWhen value is different from the default value for its summary type
-    frequency.summary
-      ? frequency.notifyWhen !== DEFAULT_FREQUENCY_WITH_SUMMARY.notifyWhen
-      : frequency.notifyWhen !== DEFAULT_FREQUENCY_WITHOUT_SUMMARY.notifyWhen
+    DEFAULT_FREQUENCY.notifyWhen
   );
 
   const [summaryMenuOpen, setSummaryMenuOpen] = useState(false);
@@ -193,7 +165,6 @@ export const ActionNotifyWhen = ({
     (newValue: RuleNotifyWhenType) => {
       onNotifyWhenChange(newValue);
       setNotifyWhenValue(newValue);
-      setNotifyWhenValueChangedFromDefault(true);
       // Calling onNotifyWhenChange and onThrottleChange at the same time interferes with the React state lifecycle
       // so wait for onNotifyWhenChange to process before calling onThrottleChange
       setTimeout(
@@ -213,24 +184,10 @@ export const ActionNotifyWhen = ({
       onSummaryChange(summary);
       setSummaryMenuOpen(false);
       if (summary && frequency.notifyWhen === RuleNotifyWhen.CHANGE) {
-        // Call onNotifyWhenChange DIRECTLY to bypass setNotifyWhenValueChangedFromDefault
         onNotifyWhenChange(RuleNotifyWhen.ACTIVE);
-        // In cases like this:
-        // 1. User opens form with notifyWhen: THROTTLE
-        // 2. User sets notifyWhen: CHANGE, notifyWhenValueChangedFromDefault is now true
-        // 3. User sets summary: true, notifyWhen gets set to CHANGE
-        // 4. User sets summary: false, notifyWhen should probably get set back to CHANGE
-        // To make step 4 possible, we have to reset notifyWhenValueChangedFromDefault:
-        setNotifyWhenValueChangedFromDefault(false);
-      } else if (
-        !summary &&
-        frequency.notifyWhen === RuleNotifyWhen.ACTIVE &&
-        !notifyWhenValueChangedFromDefault
-      ) {
-        onNotifyWhenChange(RuleNotifyWhen.CHANGE);
       }
     },
-    [onSummaryChange, frequency.notifyWhen, onNotifyWhenChange, notifyWhenValueChangedFromDefault]
+    [onSummaryChange, frequency.notifyWhen, onNotifyWhenChange]
   );
 
   const summaryOptions = useMemo(
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.test.tsx
index 445e983d7fb02..73f0810d4f98d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.test.tsx
@@ -20,11 +20,9 @@ import { act } from 'react-dom/test-utils';
 import { EuiFieldText } from '@elastic/eui';
 import { I18nProvider, __IntlProvider as IntlProvider } from '@kbn/i18n-react';
 import { render, waitFor, screen } from '@testing-library/react';
-import {
-  DEFAULT_FREQUENCY_WITHOUT_SUMMARY,
-  DEFAULT_FREQUENCY_WITH_SUMMARY,
-} from '../../../common/constants';
+import { DEFAULT_FREQUENCY } from '../../../common/constants';
 import { transformActionVariables } from '../../lib/action_variables';
+import { RuleNotifyWhen } from '@kbn/alerting-plugin/common';
 
 jest.mock('../../../common/lib/kibana');
 const actionTypeRegistry = actionTypeRegistryMock.create();
@@ -312,7 +310,7 @@ describe('action_type_form', () => {
       actionTypeId: '.pagerduty',
       group: 'default',
       params: {},
-      frequency: DEFAULT_FREQUENCY_WITHOUT_SUMMARY,
+      frequency: DEFAULT_FREQUENCY,
     };
     const wrapper = render(
       <IntlProvider locale="en">
@@ -320,7 +318,11 @@ describe('action_type_form', () => {
           index: 1,
           actionItem,
           setActionFrequencyProperty: () => {
-            actionItem.frequency = DEFAULT_FREQUENCY_WITH_SUMMARY;
+            actionItem.frequency = {
+              notifyWhen: RuleNotifyWhen.ACTIVE,
+              throttle: null,
+              summary: true,
+            };
           },
         })}
       </IntlProvider>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_reducer.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_reducer.ts
index 01f14ba6ff789..55ce45d592d00 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_reducer.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_reducer.ts
@@ -10,7 +10,7 @@ import { isEqual } from 'lodash';
 import { Reducer } from 'react';
 import { RuleActionParam, IntervalSchedule } from '@kbn/alerting-plugin/common';
 import { Rule, RuleAction } from '../../../types';
-import { DEFAULT_FREQUENCY_WITHOUT_SUMMARY } from '../../../common/constants';
+import { DEFAULT_FREQUENCY } from '../../../common/constants';
 
 export type InitialRule = Partial<Rule> &
   Pick<Rule, 'params' | 'consumer' | 'schedule' | 'actions' | 'tags'>;
@@ -201,7 +201,7 @@ export const ruleReducer = <RulePhase extends InitialRule | Rule>(
         const updatedAction = {
           ...oldAction,
           frequency: {
-            ...(oldAction.frequency ?? DEFAULT_FREQUENCY_WITHOUT_SUMMARY),
+            ...(oldAction.frequency ?? DEFAULT_FREQUENCY),
             [key]: value,
           },
         };
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/constants/action_frequency_types.ts b/x-pack/plugins/triggers_actions_ui/public/common/constants/action_frequency_types.ts
index 2aad24fe63846..7ebfc502ed07d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/common/constants/action_frequency_types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/common/constants/action_frequency_types.ts
@@ -7,13 +7,7 @@
 
 import { RuleNotifyWhen } from '@kbn/alerting-plugin/common';
 
-export const DEFAULT_FREQUENCY_WITH_SUMMARY = {
-  notifyWhen: RuleNotifyWhen.ACTIVE,
-  throttle: null,
-  summary: true,
-};
-
-export const DEFAULT_FREQUENCY_WITHOUT_SUMMARY = {
+export const DEFAULT_FREQUENCY = {
   notifyWhen: RuleNotifyWhen.CHANGE,
   throttle: null,
   summary: false,

From 01a18df4365d412f5d05f98beafd72c0f3feabe9 Mon Sep 17 00:00:00 2001
From: Jeramy Soucy <jeramy.soucy@elastic.co>
Date: Mon, 6 Feb 2023 16:31:35 -0500
Subject: [PATCH 020/134] [Docs] Documents constraints of space id in create
 space API (#150379)

closes #150311

Adds wording to clarify that the space ID must be lowercase
alphanumeric, but can include underscores and hyphens. Previously this
restriction was not documented, but if these requirements are not met
the API will respond with a 400.
---
 docs/api/spaces-management/post.asciidoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/api/spaces-management/post.asciidoc b/docs/api/spaces-management/post.asciidoc
index 28d60caa0d333..035fe897da251 100644
--- a/docs/api/spaces-management/post.asciidoc
+++ b/docs/api/spaces-management/post.asciidoc
@@ -15,7 +15,7 @@ experimental[] Create a {kib} space.
 ==== Request body
 
 `id`::
-  (Required, string) The space ID that is part of the Kibana URL when inside the space. You are unable to change the ID with the update operation.
+  (Required, string) The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, '_', and '-'). You are unable to change the ID with the update operation.
 
 `name`::
   (Required, string) The display name for the space.

From 2ff017ed77e474b5ee2c0114dc6e9315423d6134 Mon Sep 17 00:00:00 2001
From: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>
Date: Mon, 6 Feb 2023 21:41:11 +0000
Subject: [PATCH 021/134] [Security Solution][Alerts] improves IM rule memory
 usage and performance (#149208)

## Summary

- addresses https://github.com/elastic/kibana/issues/148821
- instead of loading all threats result in memory and also creating
object map from it(which doubles memory consumption)
it creates signals map right straight from threat results(in
`getSignalsMatchesFromThreatIndex`) and doesn't keep all threats in
memory anymore
- because threats are not kept in memory anymore, additional request
introduced that fetches threats before enrichments, based on signals map
created on the previous stage
- [performance
measurements](https://github.com/elastic/kibana/issues/148821#issuecomment-1410242932)
- additional issues opened while working on current PR:
   - https://github.com/elastic/kibana/issues/150041
   - https://github.com/elastic/kibana/issues/150038
- reduces further number of matched threats in alert to 200, to prevent
Kibana browser tab becoming unresponsive
### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../threat_mapping/build_threat_enrichment.ts |  29 +-
 .../threat_mapping/create_event_signal.ts     |  50 +-
 .../enrich_signal_threat_matches.test.ts      | 451 ++++--------------
 .../enrich_signal_threat_matches.ts           | 197 ++------
 .../get_signals_map_from_threat_index.mock.ts |  33 ++
 .../get_signals_map_from_threat_index.test.ts | 305 ++++++++++++
 .../get_signals_map_from_threat_index.ts      | 126 +++++
 .../signals/threat_mapping/get_threat_list.ts |  24 -
 .../threat_enrichment_factory.test.ts         | 108 +++++
 .../threat_enrichment_factory.ts              |  76 +++
 10 files changed, 823 insertions(+), 576 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.mock.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.test.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/threat_enrichment_factory.test.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/threat_enrichment_factory.ts

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/build_threat_enrichment.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/build_threat_enrichment.ts
index 32fe9b8dbe8ce..18cf4240d0b18 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/build_threat_enrichment.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/build_threat_enrichment.ts
@@ -6,13 +6,11 @@
  */
 
 import type { SignalsEnrichment } from '../types';
-import {
-  enrichSignalThreatMatches,
-  getSignalMatchesFromThreatList,
-} from './enrich_signal_threat_matches';
 import type { BuildThreatEnrichmentOptions } from './types';
 import { buildThreatMappingFilter } from './build_threat_mapping_filter';
-import { getAllThreatListHits } from './get_threat_list';
+import { getSignalsQueryMapFromThreatIndex } from './get_signals_map_from_threat_index';
+
+import { threatEnrichmentFactory } from './threat_enrichment_factory';
 
 // we do want to make extra requests to the threat index to get enrichments from all threats
 // previously we were enriched alerts only from `currentThreatList` but not all threats
@@ -42,7 +40,7 @@ export const buildThreatEnrichment = ({
       },
     });
 
-    const threatListHits = await getAllThreatListHits({
+    const threatSearchParams = {
       esClient: services.scopedClusterClient.asCurrentUser,
       threatFilters: [...threatFilters, threatFiltersFromEvents],
       query: threatQuery,
@@ -58,15 +56,20 @@ export const buildThreatEnrichment = ({
       runtimeMappings,
       listClient,
       exceptionFilter,
-    });
+    };
 
-    const signalMatches = getSignalMatchesFromThreatList(threatListHits);
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams,
+      eventsCount: signals.length,
+    });
 
-    return enrichSignalThreatMatches(
-      signals,
-      () => Promise.resolve(threatListHits),
+    const enrichment = threatEnrichmentFactory({
+      signalsQueryMap,
       threatIndicatorPath,
-      signalMatches
-    );
+      threatFilters,
+      threatSearchParams,
+    });
+
+    return enrichment(signals);
   };
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_event_signal.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_event_signal.ts
index 598730c627185..c006ab528b3c5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_event_signal.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_event_signal.ts
@@ -10,18 +10,14 @@ import { getFilter } from '../get_filter';
 import { searchAfterAndBulkCreate } from '../search_after_bulk_create';
 import { buildReasonMessageForThreatMatchAlert } from '../reason_formatters';
 import type { CreateEventSignalOptions } from './types';
-import type { SearchAfterAndBulkCreateReturnType, SignalSourceHit } from '../types';
-import { getAllThreatListHits } from './get_threat_list';
-import {
-  enrichSignalThreatMatches,
-  getSignalMatchesFromThreatList,
-} from './enrich_signal_threat_matches';
+import type { SearchAfterAndBulkCreateReturnType } from '../types';
+import { getSignalsQueryMapFromThreatIndex } from './get_signals_map_from_threat_index';
+
+import { threatEnrichmentFactory } from './threat_enrichment_factory';
 import { getSignalValueMap } from './utils';
 
 export const createEventSignal = async ({
-  alertId,
   bulkCreate,
-  completeRule,
   currentResult,
   currentEventList,
   eventsTelemetry,
@@ -29,7 +25,6 @@ export const createEventSignal = async ({
   inputIndex,
   language,
   listClient,
-  outputIndex,
   query,
   ruleExecutionLogger,
   savedId,
@@ -69,7 +64,7 @@ export const createEventSignal = async ({
     );
     return currentResult;
   } else {
-    const threatListHits = await getAllThreatListHits({
+    const threatSearchParams = {
       esClient: services.scopedClusterClient.asCurrentUser,
       threatFilters: [...threatFilters, threatFiltersFromEvents],
       query: threatQuery,
@@ -77,7 +72,7 @@ export const createEventSignal = async ({
       index: threatIndex,
       ruleExecutionLogger,
       threatListConfig: {
-        _source: [`${threatIndicatorPath}.*`, 'threat.feed.*', ...threatMatchedFields.threat],
+        _source: threatMatchedFields.threat,
         fields: undefined,
       },
       pitId: threatPitId,
@@ -85,15 +80,15 @@ export const createEventSignal = async ({
       runtimeMappings,
       listClient,
       exceptionFilter,
-    });
-
-    const signalMatches = getSignalMatchesFromThreatList(
-      threatListHits,
-      getSignalValueMap({ eventList: currentEventList, threatMatchedFields })
-    );
+    };
 
-    const ids = signalMatches.map((item) => item.signalId);
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams,
+      eventsCount: currentEventList.length,
+      signalValueMap: getSignalValueMap({ eventList: currentEventList, threatMatchedFields }),
+    });
 
+    const ids = Array.from(signalsQueryMap.keys());
     const indexFilter = {
       query: {
         bool: {
@@ -115,22 +110,19 @@ export const createEventSignal = async ({
       exceptionFilter,
     });
 
-    ruleExecutionLogger.debug(
-      `${ids?.length} matched signals found from ${threatListHits.length} indicators`
-    );
+    ruleExecutionLogger.debug(`${ids?.length} matched signals found`);
 
-    const threatEnrichment = (signals: SignalSourceHit[]): Promise<SignalSourceHit[]> =>
-      enrichSignalThreatMatches(
-        signals,
-        () => Promise.resolve(threatListHits),
-        threatIndicatorPath,
-        signalMatches
-      );
+    const enrichment = threatEnrichmentFactory({
+      signalsQueryMap,
+      threatIndicatorPath,
+      threatFilters,
+      threatSearchParams,
+    });
 
     const result = await searchAfterAndBulkCreate({
       buildReasonMessage: buildReasonMessageForThreatMatchAlert,
       bulkCreate,
-      enrichment: threatEnrichment,
+      enrichment,
       eventsTelemetry,
       exceptionsList: unprocessedExceptions,
       filter: esFilter,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.test.ts
index 974b0e00a7ce4..2658c90720adb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.test.ts
@@ -13,19 +13,11 @@ import type { SignalSourceHit } from '../types';
 import { getThreatListItemMock } from './build_threat_mapping_filter.mock';
 import {
   buildEnrichments,
-  enrichSignalThreatMatches,
   groupAndMergeSignalMatches,
-  getSignalMatchesFromThreatList,
-  MAX_NUMBER_OF_SIGNAL_MATCHES,
+  enrichSignalThreatMatchesFromSignalsMap,
 } from './enrich_signal_threat_matches';
 import { getNamedQueryMock, getSignalHitMock } from './enrich_signal_threat_matches.mock';
-import type {
-  GetMatchedThreats,
-  ThreatListItem,
-  ThreatMatchNamedQuery,
-  SignalMatch,
-} from './types';
-import { encodeThreatMatchNamedQuery } from './utils';
+import type { ThreatListItem, ThreatMatchNamedQuery } from './types';
 
 describe('groupAndMergeSignalMatches', () => {
   it('returns an empty array if there are no signals', () => {
@@ -481,11 +473,10 @@ describe('buildEnrichments', () => {
   });
 });
 
-describe('enrichSignalThreatMatches', () => {
-  let getMatchedThreats: GetMatchedThreats;
-  let matchedQuery: string;
+describe('enrichSignalThreatMatchesFromSignalsMap', () => {
+  let getMatchedThreats: () => Promise<ThreatListItem[]>;
   let indicatorPath: string;
-  let signalMatches: SignalMatch[];
+  let signalsMap = new Map();
 
   beforeEach(() => {
     indicatorPath = 'threat.indicator';
@@ -500,56 +491,67 @@ describe('enrichSignalThreatMatches', () => {
         },
       }),
     ];
-    matchedQuery = encodeThreatMatchNamedQuery(
-      getNamedQueryMock({
-        id: '123',
-        index: 'indicator_index',
-        field: 'event.domain',
-        value: 'threat.indicator.domain',
-      })
-    );
-    signalMatches = [
-      {
-        signalId: '_id',
-        queries: [
-          getNamedQueryMock({
+    signalsMap = new Map([
+      [
+        'source-id',
+        [
+          {
             id: '123',
             index: 'indicator_index',
             field: 'event.domain',
             value: 'threat.indicator.domain',
-          }),
+          },
         ],
-      },
-    ];
+      ],
+    ]);
   });
 
   it('performs no enrichment if there are no signals', async () => {
     const signals: SignalSourceHit[] = [];
-    const enrichedSignals = await enrichSignalThreatMatches(
+    const enrichedSignals = await enrichSignalThreatMatchesFromSignalsMap(
       signals,
       getMatchedThreats,
       indicatorPath,
-      []
+      new Map()
     );
 
     expect(enrichedSignals).toEqual([]);
   });
 
+  it('performs no enrichment if signalsMap empty', async () => {
+    const signalHit = getSignalHitMock({
+      _source: {
+        '@timestamp': 'mocked',
+        event: { category: 'malware', domain: 'domain_1' },
+        threat: { enrichments: [{ existing: 'indicator' }] },
+      },
+    });
+    const signals: SignalSourceHit[] = [signalHit];
+    const enrichedSignals = await enrichSignalThreatMatchesFromSignalsMap(
+      signals,
+      getMatchedThreats,
+      indicatorPath,
+      new Map()
+    );
+
+    expect(enrichedSignals).toEqual([signalHit]);
+  });
+
   it('preserves existing threat.enrichments objects on signals', async () => {
     const signalHit = getSignalHitMock({
+      _id: 'source-id',
       _source: {
         '@timestamp': 'mocked',
         event: { category: 'malware', domain: 'domain_1' },
         threat: { enrichments: [{ existing: 'indicator' }] },
       },
-      matched_queries: [matchedQuery],
     });
     const signals: SignalSourceHit[] = [signalHit];
-    const enrichedSignals = await enrichSignalThreatMatches(
+    const enrichedSignals = await enrichSignalThreatMatchesFromSignalsMap(
       signals,
       getMatchedThreats,
       indicatorPath,
-      signalMatches
+      signalsMap
     );
     const [enrichedHit] = enrichedSignals;
     const enrichments = get(enrichedHit._source, ENRICHMENT_DESTINATION_PATH);
@@ -577,14 +579,14 @@ describe('enrichSignalThreatMatches', () => {
   it('provides only match data if the matched threat cannot be found', async () => {
     getMatchedThreats = async () => [];
     const signalHit = getSignalHitMock({
-      matched_queries: [matchedQuery],
+      _id: 'source-id',
     });
     const signals: SignalSourceHit[] = [signalHit];
-    const enrichedSignals = await enrichSignalThreatMatches(
+    const enrichedSignals = await enrichSignalThreatMatchesFromSignalsMap(
       signals,
       getMatchedThreats,
       indicatorPath,
-      signalMatches
+      signalsMap
     );
     const [enrichedHit] = enrichedSignals;
     const enrichments = get(enrichedHit._source, ENRICHMENT_DESTINATION_PATH);
@@ -606,6 +608,7 @@ describe('enrichSignalThreatMatches', () => {
 
   it('preserves an existing threat.enrichments object on signals', async () => {
     const signalHit = getSignalHitMock({
+      _id: 'source-id',
       _source: {
         '@timestamp': 'mocked',
         event: { category: 'virus', domain: 'domain_1' },
@@ -616,14 +619,13 @@ describe('enrichSignalThreatMatches', () => {
           ],
         },
       },
-      matched_queries: [matchedQuery],
     });
     const signals: SignalSourceHit[] = [signalHit];
-    const enrichedSignals = await enrichSignalThreatMatches(
+    const enrichedSignals = await enrichSignalThreatMatchesFromSignalsMap(
       signals,
       getMatchedThreats,
       indicatorPath,
-      signalMatches
+      signalsMap
     );
     const [enrichedHit] = enrichedSignals;
     const enrichments = get(enrichedHit._source, ENRICHMENT_DESTINATION_PATH);
@@ -656,15 +658,28 @@ describe('enrichSignalThreatMatches', () => {
   it('throws an error if threat is neither an object nor undefined', async () => {
     const signalHit = getSignalHitMock({
       _source: { '@timestamp': 'mocked', threat: 'whoops' },
-      matched_queries: [matchedQuery],
     });
     const signals: SignalSourceHit[] = [signalHit];
     await expect(() =>
-      enrichSignalThreatMatches(signals, getMatchedThreats, indicatorPath, signalMatches)
+      enrichSignalThreatMatchesFromSignalsMap(signals, getMatchedThreats, indicatorPath, signalsMap)
     ).rejects.toThrowError('Expected threat field to be an object, but found: whoops');
   });
 
   it('enriches from a configured indicator path, if specified', async () => {
+    signalsMap = new Map([
+      [
+        'source-id',
+        [
+          {
+            id: '123',
+            index: 'custom_index',
+            field: 'event.domain',
+            value: 'threat.indicator.domain',
+          },
+        ],
+      ],
+    ]);
+
     getMatchedThreats = async () => [
       getThreatListItemMock({
         _id: '123',
@@ -679,27 +694,20 @@ describe('enrichSignalThreatMatches', () => {
         },
       }),
     ];
-    const namedQuery = getNamedQueryMock({
-      id: '123',
-      index: 'custom_index',
-      field: 'event.domain',
-      value: 'custom_threat.custom_indicator.domain',
-    });
-    matchedQuery = encodeThreatMatchNamedQuery(namedQuery);
     const signalHit = getSignalHitMock({
+      _id: 'source-id',
       _source: {
         event: {
           domain: 'domain_1',
         },
       },
-      matched_queries: [matchedQuery],
     });
     const signals: SignalSourceHit[] = [signalHit];
-    const enrichedSignals = await enrichSignalThreatMatches(
+    const enrichedSignals = await enrichSignalThreatMatchesFromSignalsMap(
       signals,
       getMatchedThreats,
       'custom_threat.custom_indicator',
-      [{ signalId: '_id', queries: [namedQuery] }]
+      signalsMap
     );
     const [enrichedHit] = enrichedSignals;
     const enrichments = get(enrichedHit._source, ENRICHMENT_DESTINATION_PATH);
@@ -724,6 +732,26 @@ describe('enrichSignalThreatMatches', () => {
   });
 
   it('merges duplicate matched signals into a single signal with multiple enrichments', async () => {
+    signalsMap = new Map([
+      [
+        'source-id',
+        [
+          {
+            id: '123',
+            index: 'indicator_index',
+            field: 'event.domain',
+            value: 'threat.indicator.domain',
+          },
+          {
+            id: '456',
+            index: 'other_custom_index',
+            field: 'event.other',
+            value: 'threat.indicator.domain',
+          },
+        ],
+      ],
+    ]);
+
     getMatchedThreats = async () => [
       getThreatListItemMock({
         _id: '123',
@@ -741,50 +769,29 @@ describe('enrichSignalThreatMatches', () => {
       }),
     ];
     const signalHit = getSignalHitMock({
-      _id: 'signal123',
+      _id: 'source-id',
       _source: {
         event: {
           domain: 'domain_1',
           other: 'test_val',
         },
       },
-      matched_queries: [matchedQuery],
-    });
-    const otherMatchQuery = getNamedQueryMock({
-      id: '456',
-      index: 'other_custom_index',
-      field: 'event.other',
-      value: 'threat.indicator.domain',
     });
     const otherSignalHit = getSignalHitMock({
-      _id: 'signal123',
+      _id: 'source-id',
       _source: {
         event: {
           domain: 'domain_1',
           other: 'test_val',
         },
       },
-      matched_queries: [encodeThreatMatchNamedQuery(otherMatchQuery)],
     });
     const signals: SignalSourceHit[] = [signalHit, otherSignalHit];
-    const enrichedSignals = await enrichSignalThreatMatches(
+    const enrichedSignals = await enrichSignalThreatMatchesFromSignalsMap(
       signals,
       getMatchedThreats,
       indicatorPath,
-      [
-        {
-          signalId: 'signal123',
-          queries: [
-            getNamedQueryMock({
-              id: '123',
-              index: 'indicator_index',
-              field: 'event.domain',
-              value: 'threat.indicator.domain',
-            }),
-            otherMatchQuery,
-          ],
-        },
-      ]
+      signalsMap
     );
     expect(enrichedSignals).toHaveLength(1);
 
@@ -825,291 +832,3 @@ describe('enrichSignalThreatMatches', () => {
     ]);
   });
 });
-
-describe('getSignalMatchesFromThreatList', () => {
-  it('return empty array if there no threat indicators', () => {
-    const signalMatches = getSignalMatchesFromThreatList();
-    expect(signalMatches).toEqual([]);
-  });
-
-  it("return empty array if threat indicators doesn't have matched query", () => {
-    const signalMatches = getSignalMatchesFromThreatList([getThreatListItemMock()]);
-    expect(signalMatches).toEqual([]);
-  });
-
-  it('return signal matches from threat indicators', () => {
-    const signalMatches = getSignalMatchesFromThreatList([
-      getThreatListItemMock({
-        _id: 'threatId',
-        matched_queries: [
-          encodeThreatMatchNamedQuery(
-            getNamedQueryMock({
-              id: 'signalId1',
-              index: 'source_index',
-              value: 'threat.indicator.domain',
-              field: 'event.domain',
-            })
-          ),
-          encodeThreatMatchNamedQuery(
-            getNamedQueryMock({
-              id: 'signalId2',
-              index: 'source_index',
-              value: 'threat.indicator.domain',
-              field: 'event.domain',
-            })
-          ),
-        ],
-      }),
-    ]);
-
-    const queries = [
-      {
-        field: 'event.domain',
-        value: 'threat.indicator.domain',
-        index: 'threat_index',
-        id: 'threatId',
-        queryType: 'mq',
-      },
-    ];
-
-    expect(signalMatches).toEqual([
-      {
-        signalId: 'signalId1',
-        queries,
-      },
-      {
-        signalId: 'signalId2',
-        queries,
-      },
-    ]);
-  });
-
-  it('return empty array for terms query if there no signalValueMap', () => {
-    const signalMatches = getSignalMatchesFromThreatList([
-      getThreatListItemMock({
-        _id: 'threatId',
-        matched_queries: [
-          encodeThreatMatchNamedQuery(
-            getNamedQueryMock({
-              value: 'threat.indicator.domain',
-              field: 'event.domain',
-              queryType: 'tq',
-            })
-          ),
-        ],
-      }),
-    ]);
-
-    expect(signalMatches).toEqual([]);
-  });
-
-  it('return empty array for terms query if there wrong value in threat indicator', () => {
-    const threat = getThreatListItemMock({
-      _id: 'threatId',
-      matched_queries: [
-        encodeThreatMatchNamedQuery(
-          getNamedQueryMock({
-            value: 'threat.indicator.domain',
-            field: 'event.domain',
-            queryType: 'tq',
-          })
-        ),
-      ],
-    });
-
-    threat._source = {
-      ...threat._source,
-      threat: {
-        indicator: {
-          domain: { a: 'b' },
-        },
-      },
-    };
-
-    const signalValueMap = {
-      'event.domain': {
-        domain_1: ['signalId1', 'signalId2'],
-      },
-    };
-
-    const signalMatches = getSignalMatchesFromThreatList([threat], signalValueMap);
-
-    expect(signalMatches).toEqual([]);
-  });
-
-  it('return signal matches from threat indicators for termsQuery', () => {
-    const threat = getThreatListItemMock({
-      _id: 'threatId',
-      matched_queries: [
-        encodeThreatMatchNamedQuery(
-          getNamedQueryMock({
-            value: 'threat.indicator.domain',
-            field: 'event.domain',
-            queryType: 'tq',
-          })
-        ),
-      ],
-    });
-
-    threat._source = {
-      ...threat._source,
-      threat: {
-        indicator: {
-          domain: 'domain_1',
-        },
-      },
-    };
-
-    const signalValueMap = {
-      'event.domain': {
-        domain_1: ['signalId1', 'signalId2'],
-      },
-    };
-
-    const signalMatches = getSignalMatchesFromThreatList([threat], signalValueMap);
-
-    const queries = [
-      {
-        field: 'event.domain',
-        value: 'threat.indicator.domain',
-        index: 'threat_index',
-        id: 'threatId',
-        queryType: 'tq',
-      },
-    ];
-
-    expect(signalMatches).toEqual([
-      {
-        signalId: 'signalId1',
-        queries,
-      },
-      {
-        signalId: 'signalId2',
-        queries,
-      },
-    ]);
-  });
-
-  it('return signal matches from threat indicators which has array values for termsQuery', () => {
-    const threat = getThreatListItemMock({
-      _id: 'threatId',
-      matched_queries: [
-        encodeThreatMatchNamedQuery(
-          getNamedQueryMock({
-            value: 'threat.indicator.domain',
-            field: 'event.domain',
-            queryType: 'tq',
-          })
-        ),
-      ],
-    });
-
-    threat._source = {
-      ...threat._source,
-      threat: {
-        indicator: {
-          domain: ['domain_3', 'domain_1', 'domain_2'],
-        },
-      },
-    };
-
-    const signalValueMap = {
-      'event.domain': {
-        domain_1: ['signalId1'],
-        domain_2: ['signalId2'],
-      },
-    };
-
-    const signalMatches = getSignalMatchesFromThreatList([threat], signalValueMap);
-
-    const queries = [
-      {
-        field: 'event.domain',
-        value: 'threat.indicator.domain',
-        index: 'threat_index',
-        id: 'threatId',
-        queryType: 'tq',
-      },
-    ];
-
-    expect(signalMatches).toEqual([
-      {
-        signalId: 'signalId1',
-        queries,
-      },
-      {
-        signalId: 'signalId2',
-        queries,
-      },
-    ]);
-  });
-
-  it('merge signal matches if different threat indicators matched the same signal', () => {
-    const matchedQuery = [
-      encodeThreatMatchNamedQuery(
-        getNamedQueryMock({
-          id: 'signalId',
-          index: 'source_index',
-          value: 'threat.indicator.domain',
-          field: 'event.domain',
-        })
-      ),
-    ];
-    const signalMatches = getSignalMatchesFromThreatList([
-      getThreatListItemMock({
-        _id: 'threatId1',
-        matched_queries: matchedQuery,
-      }),
-      getThreatListItemMock({
-        _id: 'threatId2',
-        matched_queries: matchedQuery,
-      }),
-    ]);
-
-    const query = {
-      field: 'event.domain',
-      value: 'threat.indicator.domain',
-      index: 'threat_index',
-      id: 'threatId',
-      queryType: 'mq',
-    };
-
-    expect(signalMatches).toEqual([
-      {
-        signalId: 'signalId',
-        queries: [
-          {
-            ...query,
-            id: 'threatId1',
-          },
-          {
-            ...query,
-            id: 'threatId2',
-          },
-        ],
-      },
-    ]);
-  });
-
-  it('limits number of signal matches to MAX_NUMBER_OF_SIGNAL_MATCHES', () => {
-    const threatList = Array.from(Array(2000), (index) =>
-      getThreatListItemMock({
-        _id: `threatId-${index}`,
-        matched_queries: [
-          encodeThreatMatchNamedQuery(
-            getNamedQueryMock({
-              id: 'signalId1',
-              index: 'source_index',
-              value: 'threat.indicator.domain',
-              field: 'event.domain',
-            })
-          ),
-        ],
-      })
-    );
-
-    const signalMatches = getSignalMatchesFromThreatList(threatList);
-
-    expect(signalMatches[0].queries).toHaveLength(MAX_NUMBER_OF_SIGNAL_MATCHES);
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.ts
index 3ce871283219d..28f43519f118f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.ts
@@ -9,102 +9,9 @@ import { get, isObject } from 'lodash';
 import { ENRICHMENT_TYPES, FEED_NAME_PATH } from '../../../../../common/cti/constants';
 
 import type { SignalSourceHit } from '../types';
-import type {
-  GetMatchedThreats,
-  ThreatEnrichment,
-  ThreatListItem,
-  ThreatMatchNamedQuery,
-  SignalMatch,
-  SignalValuesMap,
-  ThreatTermNamedQuery,
-} from './types';
-import { ThreatMatchQueryType } from './types';
-import { extractNamedQueries } from './utils';
-
-export const MAX_NUMBER_OF_SIGNAL_MATCHES = 1000;
-
-export const getSignalMatchesFromThreatList = (
-  threatList: ThreatListItem[] = [],
-  signalValueMap?: SignalValuesMap
-): SignalMatch[] => {
-  const signalMap: { [key: string]: ThreatMatchNamedQuery[] } = {};
-  const addSignalValueToMap = ({
-    id,
-    threatHit,
-    query,
-  }: {
-    id: string;
-    threatHit: ThreatListItem;
-    query: ThreatMatchNamedQuery | ThreatTermNamedQuery;
-  }) => {
-    if (!signalMap[id]) {
-      signalMap[id] = [];
-    }
-
-    // creating map of signal with large number of threats could lead to out of memory Kibana crash
-    // large number of threats also can cause signals bulk create failure due too large payload (413)
-    // large number of threats significantly slower alert details page render
-    // so, its number is limited to MAX_NUMBER_OF_SIGNAL_MATCHES
-    // more details https://github.com/elastic/kibana/issues/143595#issuecomment-1335433592
-    if (signalMap[id].length >= MAX_NUMBER_OF_SIGNAL_MATCHES) {
-      return;
-    }
-
-    signalMap[id].push({
-      id: threatHit._id,
-      index: threatHit._index,
-      field: query.field,
-      value: query.value,
-      queryType: query.queryType,
-    });
-  };
-  threatList.forEach((threatHit) =>
-    extractNamedQueries(threatHit).forEach((query) => {
-      const signalId = query.id;
-
-      if (query.queryType === ThreatMatchQueryType.term) {
-        const threatValue = get(threatHit?._source, query.value);
-        let values;
-        if (Array.isArray(threatValue)) {
-          values = threatValue;
-        } else {
-          values = [threatValue];
-        }
-
-        values.forEach((value) => {
-          if (value && signalValueMap) {
-            const ids = signalValueMap[query.field][value?.toString()];
-
-            ids?.forEach((id: string) => {
-              addSignalValueToMap({
-                id,
-                threatHit,
-                query,
-              });
-            });
-          }
-        });
-      } else {
-        if (!signalId) {
-          return;
-        }
-
-        addSignalValueToMap({
-          id: signalId,
-          threatHit,
-          query,
-        });
-      }
-    })
-  );
+import type { ThreatEnrichment, ThreatListItem, ThreatMatchNamedQuery } from './types';
 
-  const signalMatches = Object.entries(signalMap).map(([key, value]) => ({
-    signalId: key,
-    queries: value,
-  }));
-
-  return signalMatches;
-};
+export const MAX_NUMBER_OF_SIGNAL_MATCHES = 200;
 
 const getSignalId = (signal: SignalSourceHit): string => signal._id;
 
@@ -163,68 +70,70 @@ export const buildEnrichments = ({
     };
   });
 
-export const enrichSignalThreatMatches = async (
+const enrichSignalWithThreatMatches = (
+  signalHit: SignalSourceHit,
+  enrichmentsWithoutAtomic: { [key: string]: ThreatEnrichment[] }
+) => {
+  const threat = get(signalHit._source, 'threat') ?? {};
+  if (!isObject(threat)) {
+    throw new Error(`Expected threat field to be an object, but found: ${threat}`);
+  }
+  // We are not using ENRICHMENT_DESTINATION_PATH here because the code above
+  // and below make assumptions about its current value, 'threat.enrichments',
+  // and making this code dynamic on an arbitrary path would introduce several
+  // new issues.
+  const existingEnrichmentValue = get(signalHit._source, 'threat.enrichments') ?? [];
+  const existingEnrichments = [existingEnrichmentValue].flat(); // ensure enrichments is an array
+  const newEnrichmentsWithoutAtomic = enrichmentsWithoutAtomic[signalHit._id] ?? [];
+  const newEnrichments = newEnrichmentsWithoutAtomic.map((enrichment) => ({
+    ...enrichment,
+    matched: {
+      ...enrichment.matched,
+      atomic: get(signalHit._source, enrichment.matched.field),
+    },
+  }));
+
+  return {
+    ...signalHit,
+    _source: {
+      ...signalHit._source,
+      threat: {
+        ...threat,
+        enrichments: [...existingEnrichments, ...newEnrichments],
+      },
+    },
+  };
+};
+
+/**
+ * enrich signals threat matches using signalsMap(Map<string, ThreatMatchNamedQuery[]>) that has match named query results
+ */
+export const enrichSignalThreatMatchesFromSignalsMap = async (
   signals: SignalSourceHit[],
-  getMatchedThreats: GetMatchedThreats,
+  getMatchedThreats: () => Promise<ThreatListItem[]>,
   indicatorPath: string,
-  signalMatches: SignalMatch[]
+  signalsMap: Map<string, ThreatMatchNamedQuery[]>
 ): Promise<SignalSourceHit[]> => {
   if (signals.length === 0) {
-    return signals;
+    return [];
   }
 
   const uniqueHits = groupAndMergeSignalMatches(signals);
+  const matchedThreats = await getMatchedThreats();
 
-  const matchedThreatIds = [
-    ...new Set(
-      signalMatches
-        .map((signalMatch) => signalMatch.queries)
-        .flat()
-        .map(({ id }) => id)
-    ),
-  ];
-  const matchedThreats = await getMatchedThreats(matchedThreatIds);
-
-  const enrichmentsWithoutAtomic: { [key: string]: ThreatEnrichment[] } = {};
-  signalMatches.forEach((signalMatch) => {
-    enrichmentsWithoutAtomic[signalMatch.signalId] = buildEnrichments({
+  const enrichmentsWithoutAtomic: Record<string, ThreatEnrichment[]> = {};
+
+  uniqueHits.forEach((hit) => {
+    enrichmentsWithoutAtomic[hit._id] = buildEnrichments({
       indicatorPath,
-      queries: signalMatch.queries,
+      queries: signalsMap.get(hit._id) ?? [],
       threats: matchedThreats,
     });
   });
 
-  const enrichedSignals: SignalSourceHit[] = uniqueHits.map((signalHit, i) => {
-    const threat = get(signalHit._source, 'threat') ?? {};
-    if (!isObject(threat)) {
-      throw new Error(`Expected threat field to be an object, but found: ${threat}`);
-    }
-    // We are not using ENRICHMENT_DESTINATION_PATH here because the code above
-    // and below make assumptions about its current value, 'threat.enrichments',
-    // and making this code dynamic on an arbitrary path would introduce several
-    // new issues.
-    const existingEnrichmentValue = get(signalHit._source, 'threat.enrichments') ?? [];
-    const existingEnrichments = [existingEnrichmentValue].flat(); // ensure enrichments is an array
-    const newEnrichmentsWithoutAtomic = enrichmentsWithoutAtomic[signalHit._id] ?? [];
-    const newEnrichments = newEnrichmentsWithoutAtomic.map((enrichment) => ({
-      ...enrichment,
-      matched: {
-        ...enrichment.matched,
-        atomic: get(signalHit._source, enrichment.matched.field),
-      },
-    }));
-
-    return {
-      ...signalHit,
-      _source: {
-        ...signalHit._source,
-        threat: {
-          ...threat,
-          enrichments: [...existingEnrichments, ...newEnrichments],
-        },
-      },
-    };
-  });
+  const enrichedSignals: SignalSourceHit[] = uniqueHits.map((signalHit) =>
+    enrichSignalWithThreatMatches(signalHit, enrichmentsWithoutAtomic)
+  );
 
   return enrichedSignals;
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.mock.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.mock.ts
new file mode 100644
index 0000000000000..9fa23d25f2899
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.mock.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { elasticsearchServiceMock } from '@kbn/core/server/mocks';
+import type { GetThreatListOptions } from './types';
+import { getListClientMock } from '@kbn/lists-plugin/server/services/lists/list_client.mock';
+import { ruleExecutionLogMock } from '../../rule_monitoring/mocks';
+
+const esClient = elasticsearchServiceMock.createElasticsearchClient();
+const ruleExecutionLogger = ruleExecutionLogMock.forExecutors.create();
+
+export const threatSearchParamsMock: GetThreatListOptions = {
+  esClient,
+  query: '*:*',
+  language: 'kuery',
+  threatFilters: [],
+  index: ['threats-*'],
+  ruleExecutionLogger,
+  threatListConfig: {
+    _source: false,
+    fields: undefined,
+  },
+  pitId: 'mock',
+  reassignPitId: jest.fn(),
+  listClient: getListClientMock(),
+  searchAfter: undefined,
+  runtimeMappings: undefined,
+  exceptionFilter: undefined,
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.test.ts
new file mode 100644
index 0000000000000..38a6947beebcb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.test.ts
@@ -0,0 +1,305 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ThreatMatchQueryType } from './types';
+
+import { getSignalsQueryMapFromThreatIndex } from './get_signals_map_from_threat_index';
+import { getThreatList } from './get_threat_list';
+import { encodeThreatMatchNamedQuery } from './utils';
+import { MAX_NUMBER_OF_SIGNAL_MATCHES } from './enrich_signal_threat_matches';
+
+import { threatSearchParamsMock } from './get_signals_map_from_threat_index.mock';
+
+jest.mock('./get_threat_list', () => ({ getThreatList: jest.fn() }));
+
+const getThreatListMock = getThreatList as jest.Mock;
+
+export const namedQuery = encodeThreatMatchNamedQuery({
+  id: 'source-1',
+  index: 'source-*',
+  field: 'host.name',
+  value: 'localhost-1',
+  queryType: ThreatMatchQueryType.match,
+});
+
+const termsNamedQuery = encodeThreatMatchNamedQuery({
+  value: 'threat.indicator.domain',
+  field: 'event.domain',
+  queryType: ThreatMatchQueryType.term,
+});
+
+export const threatMock = {
+  _id: 'threat-id-1',
+  _index: 'threats-01',
+  matched_queries: [namedQuery],
+};
+
+const termsThreatMock = {
+  _id: 'threat-id-1',
+  _index: 'threats-01',
+  matched_queries: [termsNamedQuery],
+};
+
+getThreatListMock.mockReturnValue({ hits: { hits: [] } });
+
+describe('getSignalsQueryMapFromThreatIndex', () => {
+  it('should call getThreatList to fetch threats from ES', async () => {
+    getThreatListMock.mockReturnValue({ hits: { hits: [] } });
+
+    await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams: threatSearchParamsMock,
+      eventsCount: 50,
+    });
+
+    expect(getThreatListMock).toHaveBeenCalledTimes(1);
+    expect(getThreatListMock).toHaveBeenCalledWith(threatSearchParamsMock);
+  });
+
+  it('should return empty signals map if getThreatList return empty results', async () => {
+    getThreatListMock.mockReturnValue({ hits: { hits: [] } });
+
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams: threatSearchParamsMock,
+      eventsCount: 50,
+    });
+
+    expect(signalsQueryMap).toEqual(new Map());
+  });
+
+  it('should return signalsQueryMap for signals if threats search results exhausted', async () => {
+    const namedQuery2 = encodeThreatMatchNamedQuery({
+      id: 'source-2',
+      index: 'source-*',
+      field: 'host.name',
+      value: 'localhost-1',
+      queryType: ThreatMatchQueryType.match,
+    });
+
+    // the third request return empty results
+    getThreatListMock.mockReturnValueOnce({
+      hits: {
+        hits: [threatMock],
+      },
+    });
+    getThreatListMock.mockReturnValueOnce({
+      hits: {
+        hits: [
+          { ...threatMock, _id: 'threat-id-2', matched_queries: [namedQuery, namedQuery2] },
+          { ...threatMock, _id: 'threat-id-3' },
+        ],
+      },
+    });
+    getThreatListMock.mockReturnValueOnce({ hits: { hits: [] } });
+
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams: threatSearchParamsMock,
+      eventsCount: 50,
+    });
+
+    expect(signalsQueryMap).toEqual(
+      new Map([
+        [
+          'source-1',
+          [
+            {
+              id: 'threat-id-1',
+              index: 'threats-01',
+              field: 'host.name',
+              value: 'localhost-1',
+              queryType: ThreatMatchQueryType.match,
+            },
+            {
+              id: 'threat-id-2',
+              index: 'threats-01',
+              field: 'host.name',
+              value: 'localhost-1',
+              queryType: ThreatMatchQueryType.match,
+            },
+            {
+              id: 'threat-id-3',
+              index: 'threats-01',
+              field: 'host.name',
+              value: 'localhost-1',
+              queryType: ThreatMatchQueryType.match,
+            },
+          ],
+        ],
+        [
+          'source-2',
+          [
+            {
+              id: 'threat-id-2',
+              index: 'threats-01',
+              field: 'host.name',
+              value: 'localhost-1',
+              queryType: ThreatMatchQueryType.match,
+            },
+          ],
+        ],
+      ])
+    );
+  });
+  it('should return signalsQueryMap for signals if threats number reaches max of MAX_NUMBER_OF_SIGNAL_MATCHES', async () => {
+    getThreatListMock.mockReturnValueOnce({
+      hits: {
+        hits: Array.from(Array(MAX_NUMBER_OF_SIGNAL_MATCHES + 1)).map(() => threatMock),
+      },
+    });
+
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams: threatSearchParamsMock,
+      eventsCount: 50,
+    });
+
+    expect(signalsQueryMap.get('source-1')).toHaveLength(MAX_NUMBER_OF_SIGNAL_MATCHES);
+  });
+
+  it('should return empty signalsQueryMap for terms query if there no signalValueMap', async () => {
+    getThreatListMock.mockReturnValueOnce({
+      hits: {
+        hits: [termsThreatMock],
+      },
+    });
+
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams: threatSearchParamsMock,
+      eventsCount: 50,
+    });
+
+    expect(signalsQueryMap).toEqual(new Map());
+  });
+
+  it('should return empty signalsQueryMap for terms query if there wrong value in threat indicator', async () => {
+    getThreatListMock.mockReturnValueOnce({
+      hits: {
+        hits: [
+          {
+            ...termsThreatMock,
+            _source: {
+              threat: {
+                indicator: {
+                  domain: { a: 'b' },
+                },
+              },
+            },
+          },
+        ],
+      },
+    });
+
+    const signalValueMap = {
+      'event.domain': {
+        domain_1: ['signalId1', 'signalId2'],
+      },
+    };
+
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams: threatSearchParamsMock,
+      eventsCount: 50,
+      signalValueMap,
+    });
+
+    expect(signalsQueryMap).toEqual(new Map());
+  });
+
+  it('should return signalsQueryMap from threat indicators for termsQuery', async () => {
+    getThreatListMock.mockReturnValueOnce({
+      hits: {
+        hits: [
+          {
+            ...termsThreatMock,
+            _source: {
+              threat: {
+                indicator: {
+                  domain: 'domain_1',
+                },
+              },
+            },
+          },
+        ],
+      },
+    });
+
+    const signalValueMap = {
+      'event.domain': {
+        domain_1: ['signalId1', 'signalId2'],
+      },
+    };
+
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams: threatSearchParamsMock,
+      eventsCount: 50,
+      signalValueMap,
+    });
+
+    const queries = [
+      {
+        field: 'event.domain',
+        value: 'threat.indicator.domain',
+        id: 'threat-id-1',
+        index: 'threats-01',
+        queryType: ThreatMatchQueryType.term,
+      },
+    ];
+
+    expect(signalsQueryMap).toEqual(
+      new Map([
+        ['signalId1', queries],
+        ['signalId2', queries],
+      ])
+    );
+  });
+
+  it('should return signalsQueryMap from threat indicators which has array values for termsQuery', async () => {
+    getThreatListMock.mockReturnValueOnce({
+      hits: {
+        hits: [
+          {
+            ...termsThreatMock,
+            _source: {
+              threat: {
+                indicator: {
+                  domain: ['domain_3', 'domain_1', 'domain_2'],
+                },
+              },
+            },
+          },
+        ],
+      },
+    });
+
+    const signalValueMap = {
+      'event.domain': {
+        domain_1: ['signalId1'],
+        domain_2: ['signalId2'],
+      },
+    };
+
+    const signalsQueryMap = await getSignalsQueryMapFromThreatIndex({
+      threatSearchParams: threatSearchParamsMock,
+      eventsCount: 50,
+      signalValueMap,
+    });
+
+    const queries = [
+      {
+        field: 'event.domain',
+        value: 'threat.indicator.domain',
+        id: 'threat-id-1',
+        index: 'threats-01',
+        queryType: ThreatMatchQueryType.term,
+      },
+    ];
+
+    expect(signalsQueryMap).toEqual(
+      new Map([
+        ['signalId1', queries],
+        ['signalId2', queries],
+      ])
+    );
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.ts
new file mode 100644
index 0000000000000..0deb3beeee2e8
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_signals_map_from_threat_index.ts
@@ -0,0 +1,126 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { get } from 'lodash';
+
+import { ThreatMatchQueryType } from './types';
+import type {
+  GetThreatListOptions,
+  ThreatMatchNamedQuery,
+  ThreatTermNamedQuery,
+  ThreatListItem,
+  SignalValuesMap,
+} from './types';
+import { getThreatList } from './get_threat_list';
+import { decodeThreatMatchNamedQuery } from './utils';
+
+import { MAX_NUMBER_OF_SIGNAL_MATCHES } from './enrich_signal_threat_matches';
+
+export type SignalsQueryMap = Map<string, ThreatMatchNamedQuery[]>;
+
+interface GetSignalsMatchesFromThreatIndexOptions {
+  threatSearchParams: Omit<GetThreatListOptions, 'searchAfter'>;
+  eventsCount: number;
+  signalValueMap?: SignalValuesMap;
+}
+
+/**
+ * fetches threats and creates signals map from results, that matches signal is with list of threat queries
+ */
+export const getSignalsQueryMapFromThreatIndex = async ({
+  threatSearchParams,
+  eventsCount,
+  signalValueMap,
+}: GetSignalsMatchesFromThreatIndexOptions): Promise<SignalsQueryMap> => {
+  let threatList: Awaited<ReturnType<typeof getThreatList>> | undefined;
+  const signalsQueryMap = new Map<string, ThreatMatchNamedQuery[]>();
+  // number of threat matches per signal is limited by MAX_NUMBER_OF_SIGNAL_MATCHES. Once it hits this number, threats stop to be processed for a signal
+  const maxThreatsReachedMap = new Map<string, boolean>();
+
+  const addSignalValueToMap = ({
+    signalId,
+    threatHit,
+    decodedQuery,
+  }: {
+    signalId: string;
+    threatHit: ThreatListItem;
+    decodedQuery: ThreatMatchNamedQuery | ThreatTermNamedQuery;
+  }) => {
+    const signalMatch = signalsQueryMap.get(signalId);
+    if (!signalMatch) {
+      signalsQueryMap.set(signalId, []);
+    }
+
+    const threatQuery = {
+      id: threatHit._id,
+      index: threatHit._index,
+      field: decodedQuery.field,
+      value: decodedQuery.value,
+      queryType: decodedQuery.queryType,
+    };
+
+    if (!signalMatch) {
+      signalsQueryMap.set(signalId, [threatQuery]);
+      return;
+    }
+
+    if (signalMatch.length === MAX_NUMBER_OF_SIGNAL_MATCHES) {
+      maxThreatsReachedMap.set(signalId, true);
+    } else if (signalMatch.length < MAX_NUMBER_OF_SIGNAL_MATCHES) {
+      signalMatch.push(threatQuery);
+    }
+  };
+
+  while (
+    maxThreatsReachedMap.size < eventsCount &&
+    (threatList ? threatList?.hits.hits.length > 0 : true)
+  ) {
+    threatList = await getThreatList({
+      ...threatSearchParams,
+      searchAfter: threatList?.hits.hits[threatList.hits.hits.length - 1].sort || undefined,
+    });
+
+    threatList.hits.hits.forEach((threatHit) => {
+      const matchedQueries = threatHit?.matched_queries || [];
+
+      matchedQueries.forEach((matchedQuery) => {
+        const decodedQuery = decodeThreatMatchNamedQuery(matchedQuery);
+        const signalId = decodedQuery.id;
+
+        if (decodedQuery.queryType === ThreatMatchQueryType.term) {
+          const threatValue = get(threatHit?._source, decodedQuery.value);
+          const values = Array.isArray(threatValue) ? threatValue : [threatValue];
+
+          values.forEach((value) => {
+            if (value && signalValueMap) {
+              const ids = signalValueMap[decodedQuery.field][value?.toString()];
+
+              ids?.forEach((id: string) => {
+                addSignalValueToMap({
+                  signalId: id,
+                  threatHit,
+                  decodedQuery,
+                });
+              });
+            }
+          });
+        } else {
+          if (!signalId) {
+            return;
+          }
+
+          addSignalValueToMap({
+            signalId,
+            threatHit,
+            decodedQuery,
+          });
+        }
+      });
+    });
+  }
+
+  return signalsQueryMap;
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_threat_list.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_threat_list.ts
index c2ee1fee3c75a..160de278f47e3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_threat_list.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_threat_list.ts
@@ -11,7 +11,6 @@ import type {
   GetThreatListOptions,
   ThreatListCountOptions,
   ThreatListDoc,
-  ThreatListItem,
   GetSortForThreatList,
 } from './types';
 
@@ -20,8 +19,6 @@ import type {
  */
 export const INDICATOR_PER_PAGE = 1000;
 
-const MAX_NUMBER_OF_THREATS = 10 * 1000;
-
 export const getThreatList = async ({
   esClient,
   index,
@@ -116,24 +113,3 @@ export const getThreatListCount = async ({
   });
   return response.count;
 };
-
-export const getAllThreatListHits = async (
-  params: Omit<GetThreatListOptions, 'searchAfter'>
-): Promise<ThreatListItem[]> => {
-  let allThreatListHits: ThreatListItem[] = [];
-  let threatList = await getThreatList({ ...params, searchAfter: undefined });
-
-  allThreatListHits = allThreatListHits.concat(threatList.hits.hits);
-
-  // to prevent loading in memory large number of results, that could lead to out of memory Kibana crash,
-  // number of indicators is limited to MAX_NUMBER_OF_THREATS
-  while (threatList.hits.hits.length !== 0 && allThreatListHits.length < MAX_NUMBER_OF_THREATS) {
-    threatList = await getThreatList({
-      ...params,
-      searchAfter: threatList.hits.hits[threatList.hits.hits.length - 1].sort,
-    });
-
-    allThreatListHits = allThreatListHits.concat(threatList.hits.hits);
-  }
-  return allThreatListHits;
-};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/threat_enrichment_factory.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/threat_enrichment_factory.test.ts
new file mode 100644
index 0000000000000..3c6bb7d8ee169
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/threat_enrichment_factory.test.ts
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getThreatList } from './get_threat_list';
+import { getNamedQueryMock } from './enrich_signal_threat_matches.mock';
+import type { SignalSourceHit } from '../types';
+import { threatSearchParamsMock } from './get_signals_map_from_threat_index.mock';
+import { threatEnrichmentFactory } from './threat_enrichment_factory';
+import { enrichSignalThreatMatchesFromSignalsMap } from './enrich_signal_threat_matches';
+
+jest.mock('./get_threat_list', () => ({ getThreatList: jest.fn() }));
+jest.mock('./enrich_signal_threat_matches', () => ({
+  enrichSignalThreatMatchesFromSignalsMap: jest.fn(),
+}));
+
+const getThreatListMock = getThreatList as jest.Mock;
+const enrichSignalThreatMatchesFromSignalsMapMock =
+  enrichSignalThreatMatchesFromSignalsMap as jest.Mock;
+
+const signals = [
+  {
+    _id: 'source-id-1',
+  },
+  {
+    _id: 'source-id-2',
+  },
+];
+
+const signalsMapMock = new Map([
+  ['source-id-1', [getNamedQueryMock({ id: 'threat-1' }), getNamedQueryMock({ id: 'threat-2' })]],
+  // this signal's threats not present in signalsMap, so will be ignored in threatFilter
+  ['source-id-3', [getNamedQueryMock({ id: 'threat-x' }), getNamedQueryMock({ id: 'threat-y' })]],
+]);
+
+getThreatListMock.mockReturnValue({ hits: { hits: [] } });
+enrichSignalThreatMatchesFromSignalsMapMock.mockImplementation((_, getThreats) => getThreats());
+
+describe('threatEnrichmentFactory', () => {
+  it('enrichment should call enrichSignalThreatMatchesFromSignalsMap with correct params', async () => {
+    const enrichment = threatEnrichmentFactory({
+      signalsQueryMap: signalsMapMock,
+      threatIndicatorPath: 'indicator.mock',
+      threatFilters: ['mock-threat-filters'],
+      threatSearchParams: threatSearchParamsMock,
+    });
+
+    await enrichment(signals as SignalSourceHit[]);
+
+    expect(enrichSignalThreatMatchesFromSignalsMap).toHaveBeenCalledWith(
+      signals,
+      expect.any(Function),
+      'indicator.mock',
+      signalsMapMock
+    );
+  });
+
+  it('enrichment should call getThreatList with matched threat ids filters in signalsMap', async () => {
+    const enrichment = threatEnrichmentFactory({
+      signalsQueryMap: signalsMapMock,
+      threatIndicatorPath: 'indicator.mock',
+      threatFilters: ['mock-threat-filters'],
+      threatSearchParams: threatSearchParamsMock,
+    });
+
+    await enrichment(signals as SignalSourceHit[]);
+
+    expect(getThreatListMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threatFilters: [
+          'mock-threat-filters',
+          {
+            query: {
+              bool: {
+                filter: {
+                  ids: { values: ['threat-1', 'threat-2'] },
+                },
+              },
+            },
+          },
+        ],
+      })
+    );
+  });
+
+  it('enrichment should call getThreatList with correct threatListConfig', async () => {
+    const enrichment = threatEnrichmentFactory({
+      signalsQueryMap: new Map(),
+      threatIndicatorPath: 'indicator.mock',
+      threatFilters: ['mock-threat-filters'],
+      threatSearchParams: threatSearchParamsMock,
+    });
+
+    await enrichment(signals as SignalSourceHit[]);
+
+    expect(getThreatListMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threatListConfig: {
+          _source: ['indicator.mock.*', 'threat.feed.*'],
+          fields: undefined,
+        },
+      })
+    );
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/threat_enrichment_factory.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/threat_enrichment_factory.ts
new file mode 100644
index 0000000000000..9d8da19f613bb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/threat_enrichment_factory.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { CreateEventSignalOptions, GetThreatListOptions } from './types';
+import type { SignalSourceHit } from '../types';
+import { getThreatList } from './get_threat_list';
+import { enrichSignalThreatMatchesFromSignalsMap } from './enrich_signal_threat_matches';
+import { type SignalsQueryMap } from './get_signals_map_from_threat_index';
+
+interface ThreatEnrichmentFactoryOptions {
+  threatIndicatorPath: CreateEventSignalOptions['threatIndicatorPath'];
+  signalsQueryMap: SignalsQueryMap;
+  threatFilters: CreateEventSignalOptions['threatFilters'];
+  threatSearchParams: Omit<GetThreatListOptions, 'searchAfter'>;
+}
+
+/**
+ * returns threatEnrichment method used events-first search
+ */
+export const threatEnrichmentFactory = ({
+  signalsQueryMap,
+  threatIndicatorPath,
+  threatFilters,
+  threatSearchParams,
+}: ThreatEnrichmentFactoryOptions) => {
+  const threatEnrichment = (signals: SignalSourceHit[]): Promise<SignalSourceHit[]> => {
+    const getThreats = async () => {
+      const threatIds = signals
+        .map((s) => s._id)
+        .reduce<string[]>((acc, id) => {
+          return [
+            ...new Set([
+              ...acc,
+              ...(signalsQueryMap.get(id) ?? []).map((threatQueryMatched) => threatQueryMatched.id),
+            ]),
+          ];
+        }, [])
+        .flat();
+
+      const matchedThreatsFilter = {
+        query: {
+          bool: {
+            filter: {
+              ids: { values: threatIds },
+            },
+          },
+        },
+      };
+
+      const threatResponse = await getThreatList({
+        ...threatSearchParams,
+        threatListConfig: {
+          _source: [`${threatIndicatorPath}.*`, 'threat.feed.*'],
+          fields: undefined,
+        },
+        threatFilters: [...threatFilters, matchedThreatsFilter],
+        searchAfter: undefined,
+      });
+
+      return threatResponse.hits.hits;
+    };
+
+    return enrichSignalThreatMatchesFromSignalsMap(
+      signals,
+      getThreats,
+      threatIndicatorPath,
+      signalsQueryMap
+    );
+  };
+
+  return threatEnrichment;
+};

From 79a8c2db63ebb87a20b4442f6023b7a500cad16d Mon Sep 17 00:00:00 2001
From: Andrew Kroh <andrew.kroh@elastic.co>
Date: Mon, 6 Feb 2023 16:46:16 -0500
Subject: [PATCH 022/134] [Fleet] openapi spec - remove duplicated path
 parameters (#150260)

Several path parameter definitions were duplicated between the path's
`parameters` and the method's `parameters`. These two lists are joined
so there is no need to re-declare a parameter.

I observed these errors while using github.com/deepmap/oapi-codegen with
the Fleet openapi definition.

```
path '/package_policies/{packagePolicyId}' has 1 positional parameters, but spec has 2 declared

path '/epm/packages/{pkgName}/{pkgVersion}' has 2 positional parameters, but spec has 4 declared

path '/fleet_server_hosts/{itemId}' has 1 positional parameters, but spec has 2 declared

path '/proxies/{itemId}' has 1 positional parameters, but spec has 2 declared
```

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../plugins/fleet/common/openapi/bundled.json | 58 -------------------
 .../plugins/fleet/common/openapi/bundled.yaml | 36 ------------
 ...epm@packages@{pkg_name}@{pkg_version}.yaml | 11 ----
 .../paths/fleet_server_hosts@{item_id}.yaml   | 10 ----
 .../package_policies@{package_policy_id}.yaml |  5 --
 .../openapi/paths/proxies@{item_id}.yaml      | 10 ----
 6 files changed, 130 deletions(-)

diff --git a/x-pack/plugins/fleet/common/openapi/bundled.json b/x-pack/plugins/fleet/common/openapi/bundled.json
index 0a62474c89056..9b994df3afe33 100644
--- a/x-pack/plugins/fleet/common/openapi/bundled.json
+++ b/x-pack/plugins/fleet/common/openapi/bundled.json
@@ -880,24 +880,6 @@
         },
         "operationId": "update-package",
         "description": "",
-        "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "name": "pkgName",
-            "in": "path",
-            "required": true
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "name": "pkgVersion",
-            "in": "path",
-            "required": true
-          }
-        ],
         "requestBody": {
           "content": {
             "application/json": {
@@ -3625,14 +3607,6 @@
           }
         },
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "name": "packagePolicyId",
-            "in": "path",
-            "required": true
-          },
           {
             "schema": {
               "type": "boolean"
@@ -4273,14 +4247,6 @@
           }
         },
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "name": "itemId",
-            "in": "path",
-            "required": true
-          },
           {
             "$ref": "#/components/parameters/kbn_xsrf"
           }
@@ -4333,14 +4299,6 @@
           }
         },
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "name": "itemId",
-            "in": "path",
-            "required": true
-          },
           {
             "$ref": "#/components/parameters/kbn_xsrf"
           }
@@ -4503,14 +4461,6 @@
           }
         },
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "name": "itemId",
-            "in": "path",
-            "required": true
-          },
           {
             "$ref": "#/components/parameters/kbn_xsrf"
           }
@@ -4569,14 +4519,6 @@
           }
         },
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "name": "itemId",
-            "in": "path",
-            "required": true
-          },
           {
             "$ref": "#/components/parameters/kbn_xsrf"
           }
diff --git a/x-pack/plugins/fleet/common/openapi/bundled.yaml b/x-pack/plugins/fleet/common/openapi/bundled.yaml
index 7b93038b146bc..65bab73457170 100644
--- a/x-pack/plugins/fleet/common/openapi/bundled.yaml
+++ b/x-pack/plugins/fleet/common/openapi/bundled.yaml
@@ -556,17 +556,6 @@ paths:
                   - items
       operationId: update-package
       description: ''
-      parameters:
-        - schema:
-            type: string
-          name: pkgName
-          in: path
-          required: true
-        - schema:
-            type: string
-          name: pkgVersion
-          in: path
-          required: true
       requestBody:
         content:
           application/json:
@@ -2247,11 +2236,6 @@ paths:
                 required:
                   - id
       parameters:
-        - schema:
-            type: string
-          name: packagePolicyId
-          in: path
-          required: true
         - schema:
             type: boolean
           name: force
@@ -2652,11 +2636,6 @@ paths:
                 required:
                   - id
       parameters:
-        - schema:
-            type: string
-          name: itemId
-          in: path
-          required: true
         - $ref: '#/components/parameters/kbn_xsrf'
     put:
       summary: Fleet Server Hosts - Update
@@ -2688,11 +2667,6 @@ paths:
                 required:
                   - item
       parameters:
-        - schema:
-            type: string
-          name: itemId
-          in: path
-          required: true
         - $ref: '#/components/parameters/kbn_xsrf'
   /proxies:
     get:
@@ -2795,11 +2769,6 @@ paths:
                 required:
                   - id
       parameters:
-        - schema:
-            type: string
-          name: itemId
-          in: path
-          required: true
         - $ref: '#/components/parameters/kbn_xsrf'
     put:
       summary: Fleet Proxies - Update
@@ -2835,11 +2804,6 @@ paths:
                 required:
                   - item
       parameters:
-        - schema:
-            type: string
-          name: itemId
-          in: path
-          required: true
         - $ref: '#/components/parameters/kbn_xsrf'
   /kubernetes:
     get:
diff --git a/x-pack/plugins/fleet/common/openapi/paths/epm@packages@{pkg_name}@{pkg_version}.yaml b/x-pack/plugins/fleet/common/openapi/paths/epm@packages@{pkg_name}@{pkg_version}.yaml
index c6a5e55123591..8fe228f91bbd0 100644
--- a/x-pack/plugins/fleet/common/openapi/paths/epm@packages@{pkg_name}@{pkg_version}.yaml
+++ b/x-pack/plugins/fleet/common/openapi/paths/epm@packages@{pkg_name}@{pkg_version}.yaml
@@ -143,17 +143,6 @@ put:
               - items
   operationId: update-package
   description: ''
-  parameters:
-    - schema:
-        type: string
-      name: pkgName
-      in: path
-      required: true
-    - schema:
-        type: string
-      name: pkgVersion
-      in: path
-      required: true
   requestBody:
     content:
       application/json:
diff --git a/x-pack/plugins/fleet/common/openapi/paths/fleet_server_hosts@{item_id}.yaml b/x-pack/plugins/fleet/common/openapi/paths/fleet_server_hosts@{item_id}.yaml
index b2a50f8b52b8e..141274274b840 100644
--- a/x-pack/plugins/fleet/common/openapi/paths/fleet_server_hosts@{item_id}.yaml
+++ b/x-pack/plugins/fleet/common/openapi/paths/fleet_server_hosts@{item_id}.yaml
@@ -36,11 +36,6 @@ delete:
             required:
               - id
   parameters:
-    - schema:
-        type: string
-      name: itemId
-      in: path
-      required: true
     - $ref: ../components/headers/kbn_xsrf.yaml
 put:
   summary: Fleet Server Hosts - Update
@@ -72,9 +67,4 @@ put:
             required:
               - item
   parameters:
-    - schema:
-        type: string
-      name: itemId
-      in: path
-      required: true
     - $ref: ../components/headers/kbn_xsrf.yaml
diff --git a/x-pack/plugins/fleet/common/openapi/paths/package_policies@{package_policy_id}.yaml b/x-pack/plugins/fleet/common/openapi/paths/package_policies@{package_policy_id}.yaml
index bb4a76f1cd3df..72773f43483be 100644
--- a/x-pack/plugins/fleet/common/openapi/paths/package_policies@{package_policy_id}.yaml
+++ b/x-pack/plugins/fleet/common/openapi/paths/package_policies@{package_policy_id}.yaml
@@ -62,11 +62,6 @@ delete:
             required:
               - id
   parameters:
-    - schema:
-        type: string
-      name: packagePolicyId
-      in: path
-      required: true
     - schema:
         type: boolean
       name: force
diff --git a/x-pack/plugins/fleet/common/openapi/paths/proxies@{item_id}.yaml b/x-pack/plugins/fleet/common/openapi/paths/proxies@{item_id}.yaml
index 3c269de04b882..882ddd5bf3f07 100644
--- a/x-pack/plugins/fleet/common/openapi/paths/proxies@{item_id}.yaml
+++ b/x-pack/plugins/fleet/common/openapi/paths/proxies@{item_id}.yaml
@@ -36,11 +36,6 @@ delete:
             required:
               - id
   parameters:
-    - schema:
-        type: string
-      name: itemId
-      in: path
-      required: true
     - $ref: ../components/headers/kbn_xsrf.yaml
 put:
   summary: Fleet Proxies - Update
@@ -76,9 +71,4 @@ put:
             required:
               - item
   parameters:
-    - schema:
-        type: string
-      name: itemId
-      in: path
-      required: true
     - $ref: ../components/headers/kbn_xsrf.yaml

From 62d5a2a702268a7f807072740a9db30c620c92a2 Mon Sep 17 00:00:00 2001
From: Maxim Palenov <maxim.palenov@elastic.co>
Date: Mon, 6 Feb 2023 22:59:03 +0100
Subject: [PATCH 023/134] [Security Solution] Add clearing rules table state
 functionality (#150059)

**Addresses:** https://github.com/elastic/kibana/issues/145968

## Summary

This PR adds functionality to clear persisted rules table state implemented in https://github.com/elastic/kibana/issues/140263.

https://user-images.githubusercontent.com/3775283/216311325-e19e81e1-f232-4c16-b9df-a49fcc8c98d0.mov

### Checklist

- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [x] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [x] Any UI touched in this PR does not create any new axe failures (run axe in browser: [FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), [Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [x] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
---
 .../components/rules_table/index.tsx          |   2 -
 .../__mocks__/rules_table_context.tsx         |   2 +
 .../rules_table/rules_table_context.test.tsx  | 115 +++
 .../rules_table/rules_table_context.tsx       |  82 +-
 .../rules_table/rules_table_defaults.ts       |   1 +
 ...initialize_rules_table_saved_state.test.ts | 626 --------------
 .../use_rules_table_saved_state.test.ts       | 762 ++++++++++++++++++
 ...tate.ts => use_rules_table_saved_state.ts} |  99 ++-
 .../rules_table/rules_table_utility_bar.tsx   |  10 +
 .../detection_engine/rules/translations.ts    |   7 +
 10 files changed, 1019 insertions(+), 687 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.test.tsx
 delete mode 100644 x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_initialize_rules_table_saved_state.test.ts
 create mode 100644 x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_rules_table_saved_state.test.ts
 rename x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/{use_initialize_rules_table_saved_state.ts => use_rules_table_saved_state.ts} (56%)

diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/index.tsx
index 10d3a86b3ca5a..58ba3c2f96a5c 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/index.tsx
@@ -9,7 +9,6 @@ import { EuiSpacer } from '@elastic/eui';
 import React from 'react';
 import { useRouteSpy } from '../../../../common/utils/route/use_route_spy';
 import { RulesManagementTour } from './rules_table/guided_onboarding/rules_management_tour';
-import { useInitializeRulesTableSavedState } from './rules_table/use_initialize_rules_table_saved_state';
 import { useSyncRulesTableSavedState } from './rules_table/use_sync_rules_table_saved_state';
 import { RulesTables } from './rules_tables';
 import type { AllRulesTabs } from './rules_table_toolbar';
@@ -24,7 +23,6 @@ import { RulesTableToolbar } from './rules_table_toolbar';
  *   * Import/Export
  */
 export const AllRules = React.memo(() => {
-  useInitializeRulesTableSavedState();
   useSyncRulesTableSavedState();
   const [{ tabName }] = useRouteSpy();
 
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/__mocks__/rules_table_context.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/__mocks__/rules_table_context.tsx
index 3344b013398f3..1a03370ea5915 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/__mocks__/rules_table_context.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/__mocks__/rules_table_context.tsx
@@ -40,6 +40,7 @@ export const useRulesTableContextMock = {
       loadingRuleIds: [],
       loadingRulesAction: null,
       selectedRuleIds: [],
+      isDefault: true,
     },
     actions: {
       reFetchRules: jest.fn(),
@@ -54,6 +55,7 @@ export const useRulesTableContextMock = {
       setSelectedRuleIds: jest.fn(),
       setSortingOptions: jest.fn(),
       clearRulesSelection: jest.fn(),
+      clearFilters: jest.fn(),
     },
   }),
 };
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.test.tsx
new file mode 100644
index 0000000000000..552ca7b0cbd88
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.test.tsx
@@ -0,0 +1,115 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { renderHook } from '@testing-library/react-hooks';
+import type { PropsWithChildren } from 'react';
+import React from 'react';
+import { useUiSetting$ } from '../../../../../common/lib/kibana';
+import type { RulesTableState } from './rules_table_context';
+import { RulesTableContextProvider, useRulesTableContext } from './rules_table_context';
+import {
+  DEFAULT_FILTER_OPTIONS,
+  DEFAULT_PAGE,
+  DEFAULT_RULES_PER_PAGE,
+  DEFAULT_SORTING_OPTIONS,
+} from './rules_table_defaults';
+import { RuleSource } from './rules_table_saved_state';
+import { useFindRulesInMemory } from './use_find_rules_in_memory';
+import { useRulesTableSavedState } from './use_rules_table_saved_state';
+
+jest.mock('../../../../../common/lib/kibana');
+jest.mock('./use_find_rules_in_memory');
+jest.mock('./use_rules_table_saved_state');
+
+function renderUseRulesTableContext(
+  savedState: ReturnType<typeof useRulesTableSavedState>
+): RulesTableState {
+  (useFindRulesInMemory as jest.Mock).mockReturnValue({
+    data: { rules: [], total: 0 },
+    refetch: jest.fn(),
+    dataUpdatedAt: 0,
+    isFetched: false,
+    isFetching: false,
+    isLoading: false,
+    isRefetching: false,
+  });
+  (useUiSetting$ as jest.Mock).mockReturnValue([{ on: false, value: 0, idleTimeout: 0 }]);
+  (useRulesTableSavedState as jest.Mock).mockReturnValue(savedState);
+
+  const wrapper = ({ children }: PropsWithChildren<{}>) => (
+    <RulesTableContextProvider>{children}</RulesTableContextProvider>
+  );
+  const {
+    result: {
+      current: { state },
+    },
+  } = renderHook(() => useRulesTableContext(), { wrapper });
+
+  return state;
+}
+
+describe('RulesTableContextProvider', () => {
+  describe('persisted state', () => {
+    it('restores persisted rules table state', () => {
+      const state = renderUseRulesTableContext({
+        filter: {
+          searchTerm: 'test',
+          source: RuleSource.Custom,
+          tags: ['test'],
+          enabled: true,
+        },
+        sorting: {
+          field: 'name',
+          order: 'asc',
+        },
+        pagination: {
+          page: 2,
+          perPage: 10,
+        },
+      });
+
+      expect(state.filterOptions).toEqual({
+        filter: 'test',
+        tags: ['test'],
+        showCustomRules: true,
+        showElasticRules: false,
+        enabled: true,
+      });
+      expect(state.sortingOptions).toEqual({
+        field: 'name',
+        order: 'asc',
+      });
+      expect(state.pagination).toEqual({
+        page: 2,
+        perPage: 10,
+        total: 0,
+      });
+      expect(state.isDefault).toBeFalsy();
+    });
+
+    it('restores default rules table state', () => {
+      const state = renderUseRulesTableContext({});
+
+      expect(state.filterOptions).toEqual({
+        filter: DEFAULT_FILTER_OPTIONS.filter,
+        tags: DEFAULT_FILTER_OPTIONS.tags,
+        showCustomRules: DEFAULT_FILTER_OPTIONS.showCustomRules,
+        showElasticRules: DEFAULT_FILTER_OPTIONS.showElasticRules,
+      });
+      expect(state.sortingOptions).toEqual({
+        field: DEFAULT_SORTING_OPTIONS.field,
+        order: DEFAULT_SORTING_OPTIONS.order,
+      });
+      expect(state.pagination).toEqual({
+        page: DEFAULT_PAGE,
+        perPage: DEFAULT_RULES_PER_PAGE,
+        total: 0,
+      });
+      expect(state.isDefault).toBeTruthy();
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.tsx
index a66361271427a..5667b544b7b72 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.tsx
@@ -14,9 +14,12 @@ import React, {
   useState,
   useRef,
 } from 'react';
+import { isEqual } from 'lodash';
 import { DEFAULT_RULES_TABLE_REFRESH_SETTING } from '../../../../../../common/constants';
 import { invariant } from '../../../../../../common/utils/invariant';
+import { useReplaceUrlParams } from '../../../../../common/utils/global_query_string/helpers';
 import { useKibana, useUiSetting$ } from '../../../../../common/lib/kibana';
+import { URL_PARAM_KEY } from '../../../../../common/hooks/use_url_state';
 import type {
   FilterOptions,
   PaginationOptions,
@@ -29,8 +32,11 @@ import {
   DEFAULT_FILTER_OPTIONS,
   DEFAULT_SORTING_OPTIONS,
 } from './rules_table_defaults';
+import { RuleSource } from './rules_table_saved_state';
 import { useFindRulesInMemory } from './use_find_rules_in_memory';
+import { useRulesTableSavedState } from './use_rules_table_saved_state';
 import { getRulesComparator } from './utils';
+import { RULES_TABLE_STATE_STORAGE_KEY } from '../constants';
 
 export interface RulesTableState {
   /**
@@ -101,6 +107,10 @@ export interface RulesTableState {
    * Currently selected table sorting
    */
   sortingOptions: SortingOptions;
+  /**
+   * Whether the state has its default value
+   */
+  isDefault: boolean;
 }
 
 export type LoadingRuleAction =
@@ -142,6 +152,10 @@ export interface RulesTableActions {
    * clears rules selection on a page
    */
   clearRulesSelection: () => void;
+  /**
+   * Clears rules table filters
+   */
+  clearFilters: () => void;
 }
 
 export interface RulesTableContextType {
@@ -163,13 +177,29 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
     value: number;
     idleTimeout: number;
   }>(DEFAULT_RULES_TABLE_REFRESH_SETTING);
-  const { storage } = useKibana().services;
+  const { storage, sessionStorage } = useKibana().services;
+  const {
+    filter: savedFilter,
+    sorting: savedSorting,
+    pagination: savedPagination,
+  } = useRulesTableSavedState();
 
   const [isInMemorySorting, setIsInMemorySorting] = useState<boolean>(
     storage.get(IN_MEMORY_STORAGE_KEY) ?? false
   );
-  const [filterOptions, setFilterOptions] = useState<FilterOptions>(DEFAULT_FILTER_OPTIONS);
-  const [sortingOptions, setSortingOptions] = useState<SortingOptions>(DEFAULT_SORTING_OPTIONS);
+  const [filterOptions, setFilterOptions] = useState<FilterOptions>({
+    filter: savedFilter?.searchTerm ?? DEFAULT_FILTER_OPTIONS.filter,
+    tags: savedFilter?.tags ?? DEFAULT_FILTER_OPTIONS.tags,
+    showCustomRules:
+      savedFilter?.source === RuleSource.Custom ?? DEFAULT_FILTER_OPTIONS.showCustomRules,
+    showElasticRules:
+      savedFilter?.source === RuleSource.Prebuilt ?? DEFAULT_FILTER_OPTIONS.showElasticRules,
+    enabled: savedFilter?.enabled,
+  });
+  const [sortingOptions, setSortingOptions] = useState<SortingOptions>({
+    field: savedSorting?.field ?? DEFAULT_SORTING_OPTIONS.field,
+    order: savedSorting?.order ?? DEFAULT_SORTING_OPTIONS.order,
+  });
   const [isAllSelected, setIsAllSelected] = useState(false);
   const [isRefreshOn, setIsRefreshOn] = useState(autoRefreshSettings.on);
   const [loadingRules, setLoadingRules] = useState<LoadingRules>({
@@ -177,8 +207,8 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
     action: null,
   });
   const [isPreflightInProgress, setIsPreflightInProgress] = useState(false);
-  const [page, setPage] = useState(DEFAULT_PAGE);
-  const [perPage, setPerPage] = useState(DEFAULT_RULES_PER_PAGE);
+  const [page, setPage] = useState(savedPagination?.page ?? DEFAULT_PAGE);
+  const [perPage, setPerPage] = useState(savedPagination?.perPage ?? DEFAULT_RULES_PER_PAGE);
   const [selectedRuleIds, setSelectedRuleIds] = useState<string[]>([]);
   const autoRefreshBeforePause = useRef<boolean | null>(null);
 
@@ -211,6 +241,26 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
     setIsAllSelected(false);
   }, []);
 
+  const replaceUrlParams = useReplaceUrlParams();
+  const clearFilters = useCallback(() => {
+    setFilterOptions({
+      filter: DEFAULT_FILTER_OPTIONS.filter,
+      showElasticRules: DEFAULT_FILTER_OPTIONS.showElasticRules,
+      showCustomRules: DEFAULT_FILTER_OPTIONS.showCustomRules,
+      tags: DEFAULT_FILTER_OPTIONS.tags,
+      enabled: undefined,
+    });
+    setSortingOptions({
+      field: DEFAULT_SORTING_OPTIONS.field,
+      order: DEFAULT_SORTING_OPTIONS.order,
+    });
+    setPage(DEFAULT_PAGE);
+    setPerPage(DEFAULT_RULES_PER_PAGE);
+
+    replaceUrlParams({ [URL_PARAM_KEY.rulesTable]: null });
+    sessionStorage.remove(RULES_TABLE_STATE_STORAGE_KEY);
+  }, [setFilterOptions, setSortingOptions, setPage, setPerPage, replaceUrlParams, sessionStorage]);
+
   useEffect(() => {
     // pause table auto refresh when any of rule selected
     // store current auto refresh value, to use it later, when all rules selection will be cleared
@@ -262,6 +312,7 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
       setSortingOptions,
       clearRulesSelection,
       setIsPreflightInProgress,
+      clearFilters,
     }),
     [
       refetch,
@@ -276,6 +327,7 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
       setSortingOptions,
       clearRulesSelection,
       setIsPreflightInProgress,
+      clearFilters,
     ]
   );
 
@@ -286,7 +338,7 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
         pagination: {
           page,
           perPage,
-          total: isInMemorySorting ? rules.length : total,
+          total,
         },
         filterOptions,
         isPreflightInProgress,
@@ -303,6 +355,11 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
         loadingRulesAction: loadingRules.action,
         selectedRuleIds,
         sortingOptions,
+        isDefault: isDefaultState(filterOptions, sortingOptions, {
+          page,
+          perPage,
+          total: isInMemorySorting ? rules.length : total,
+        }),
       },
       actions,
     }),
@@ -346,3 +403,16 @@ export const useRulesTableContext = (): RulesTableContextType => {
 
 export const useRulesTableContextOptional = (): RulesTableContextType | null =>
   useContext(RulesTableContext);
+
+function isDefaultState(
+  filter: FilterOptions,
+  sorting: SortingOptions,
+  pagination: PaginationOptions
+): boolean {
+  return (
+    isEqual(filter, DEFAULT_FILTER_OPTIONS) &&
+    isEqual(sorting, DEFAULT_SORTING_OPTIONS) &&
+    pagination.page === DEFAULT_PAGE &&
+    pagination.perPage === DEFAULT_RULES_PER_PAGE
+  );
+}
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_defaults.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_defaults.ts
index 4cee292159691..6694b0a3a4ecd 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_defaults.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_defaults.ts
@@ -12,6 +12,7 @@ export const DEFAULT_FILTER_OPTIONS: FilterOptions = {
   tags: [],
   showCustomRules: false,
   showElasticRules: false,
+  enabled: undefined,
 };
 export const DEFAULT_SORTING_OPTIONS: SortingOptions = {
   field: 'enabled',
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_initialize_rules_table_saved_state.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_initialize_rules_table_saved_state.test.ts
deleted file mode 100644
index b7a594034f034..0000000000000
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_initialize_rules_table_saved_state.test.ts
+++ /dev/null
@@ -1,626 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { renderHook } from '@testing-library/react-hooks';
-import { RULES_TABLE_MAX_PAGE_SIZE } from '../../../../../../common/constants';
-import { useRulesTableContextMock } from './__mocks__/rules_table_context';
-import { useInitializeRulesTableSavedState } from './use_initialize_rules_table_saved_state';
-import type {
-  RulesTableStorageSavedState,
-  RulesTableUrlSavedState,
-} from './rules_table_saved_state';
-import { RuleSource } from './rules_table_saved_state';
-import { DEFAULT_FILTER_OPTIONS, DEFAULT_SORTING_OPTIONS } from './rules_table_defaults';
-import { useRulesTableContext } from './rules_table_context';
-import { mockRulesTablePersistedState } from './__mocks__/mock_rules_table_persistent_state';
-
-jest.mock('../../../../../common/lib/kibana');
-jest.mock('../../../../../common/utils/global_query_string/helpers');
-jest.mock('./rules_table_context');
-
-describe('useInitializeRulesTableSavedState', () => {
-  const urlSavedState: RulesTableUrlSavedState = {
-    searchTerm: 'test',
-    source: RuleSource.Custom,
-    tags: ['test'],
-    field: 'name',
-    order: 'asc',
-    page: 2,
-    perPage: 10,
-    enabled: true,
-  };
-  const storageSavedState: RulesTableStorageSavedState = {
-    searchTerm: 'test',
-    source: RuleSource.Custom,
-    tags: ['test'],
-    field: 'name',
-    order: 'asc',
-    perPage: 20,
-    enabled: false,
-  };
-  const rulesTableContext = useRulesTableContextMock.create();
-  const actions = rulesTableContext.actions;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (useRulesTableContext as jest.Mock).mockReturnValue(rulesTableContext);
-  });
-
-  describe('when state is not saved', () => {
-    beforeEach(() => {
-      mockRulesTablePersistedState({ urlState: null, storageState: null });
-    });
-
-    it('does not restore the state', () => {
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).not.toHaveBeenCalled();
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('when state is saved in the url', () => {
-    beforeEach(() => {
-      mockRulesTablePersistedState({ urlState: urlSavedState, storageState: null });
-    });
-
-    it('restores the state', () => {
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: urlSavedState.searchTerm,
-        showCustomRules: urlSavedState.source === RuleSource.Custom,
-        showElasticRules: urlSavedState.source === RuleSource.Prebuilt,
-        tags: urlSavedState.tags,
-        enabled: urlSavedState.enabled,
-      });
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({
-        field: urlSavedState.field,
-        order: urlSavedState.order,
-      });
-      expect(actions.setPage).toHaveBeenCalledWith(urlSavedState.page);
-      expect(actions.setPerPage).toHaveBeenCalledWith(urlSavedState.perPage);
-    });
-
-    it('restores the state ignoring negative page size', () => {
-      mockRulesTablePersistedState({
-        urlState: { ...urlSavedState, perPage: -1 },
-        storageState: null,
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores the state ignoring the page size larger than max allowed', () => {
-      mockRulesTablePersistedState({
-        urlState: { ...urlSavedState, perPage: RULES_TABLE_MAX_PAGE_SIZE + 1 },
-        storageState: null,
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('when partial state is saved in the url', () => {
-    it('restores only the search term', () => {
-      mockRulesTablePersistedState({ urlState: { searchTerm: 'test' }, storageState: null });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        filter: 'test',
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only show prebuilt rules filter', () => {
-      mockRulesTablePersistedState({
-        urlState: { source: RuleSource.Prebuilt },
-        storageState: null,
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        showElasticRules: true,
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only show custom rules filter', () => {
-      mockRulesTablePersistedState({ urlState: { source: RuleSource.Custom }, storageState: null });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        showCustomRules: true,
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only tags', () => {
-      mockRulesTablePersistedState({ urlState: { tags: ['test'] }, storageState: null });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        tags: ['test'],
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only enabled state filter', () => {
-      mockRulesTablePersistedState({ urlState: { enabled: true }, storageState: null });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        enabled: true,
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only sorting field', () => {
-      mockRulesTablePersistedState({ urlState: { field: 'name' }, storageState: null });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith(DEFAULT_FILTER_OPTIONS);
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({
-        field: 'name',
-        order: DEFAULT_SORTING_OPTIONS.order,
-      });
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only sorting order', () => {
-      mockRulesTablePersistedState({ urlState: { order: 'asc' }, storageState: null });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith(DEFAULT_FILTER_OPTIONS);
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({
-        field: DEFAULT_SORTING_OPTIONS.field,
-        order: 'asc',
-      });
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only page number', () => {
-      mockRulesTablePersistedState({ urlState: { page: 10 }, storageState: null });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith(DEFAULT_FILTER_OPTIONS);
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).toHaveBeenCalledWith(10);
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only page size', () => {
-      mockRulesTablePersistedState({ urlState: { perPage: 10 }, storageState: null });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith(DEFAULT_FILTER_OPTIONS);
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).toHaveBeenCalledWith(10);
-    });
-  });
-
-  describe('when state is saved in the storage', () => {
-    beforeEach(() => {
-      mockRulesTablePersistedState({ urlState: null, storageState: storageSavedState });
-    });
-
-    it('restores the state', () => {
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: storageSavedState.searchTerm,
-        showCustomRules: storageSavedState.source === RuleSource.Custom,
-        showElasticRules: storageSavedState.source === RuleSource.Prebuilt,
-        tags: storageSavedState.tags,
-        enabled: storageSavedState.enabled,
-      });
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({
-        field: storageSavedState.field,
-        order: storageSavedState.order,
-      });
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).toHaveBeenCalledWith(storageSavedState.perPage);
-    });
-
-    it('restores the state ignoring negative page size', () => {
-      mockRulesTablePersistedState({
-        urlState: null,
-        storageState: { ...storageSavedState, perPage: -1 },
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores the state ignoring the page size larger than max allowed', () => {
-      mockRulesTablePersistedState({
-        urlState: null,
-        storageState: { ...storageSavedState, perPage: RULES_TABLE_MAX_PAGE_SIZE + 1 },
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('when partial state is saved in the storage', () => {
-    it('restores only the search term', () => {
-      mockRulesTablePersistedState({ urlState: null, storageState: { searchTerm: 'test' } });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        filter: 'test',
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only show prebuilt rules filter', () => {
-      mockRulesTablePersistedState({
-        urlState: null,
-        storageState: { source: RuleSource.Prebuilt },
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        showElasticRules: true,
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only show custom rules filter', () => {
-      mockRulesTablePersistedState({ urlState: null, storageState: { source: RuleSource.Custom } });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        showCustomRules: true,
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only tags', () => {
-      mockRulesTablePersistedState({ urlState: null, storageState: { tags: ['test'] } });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        tags: ['test'],
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only enabled state filter', () => {
-      mockRulesTablePersistedState({ urlState: null, storageState: { enabled: true } });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        enabled: true,
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only sorting field', () => {
-      mockRulesTablePersistedState({ urlState: null, storageState: { field: 'name' } });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith(DEFAULT_FILTER_OPTIONS);
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({
-        field: 'name',
-        order: DEFAULT_SORTING_OPTIONS.order,
-      });
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only sorting order', () => {
-      mockRulesTablePersistedState({ urlState: null, storageState: { order: 'asc' } });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith(DEFAULT_FILTER_OPTIONS);
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({
-        field: DEFAULT_SORTING_OPTIONS.field,
-        order: 'asc',
-      });
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('does not restore the page number', () => {
-      mockRulesTablePersistedState({
-        urlState: null,
-        // @ts-expect-error Passing an invalid value for the test
-        storageState: { page: 10 },
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith(DEFAULT_FILTER_OPTIONS);
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-
-    it('restores only page size', () => {
-      mockRulesTablePersistedState({ urlState: null, storageState: { perPage: 10 } });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith(DEFAULT_FILTER_OPTIONS);
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).toHaveBeenCalledWith(10);
-    });
-  });
-
-  describe('when state is saved in the url and the storage', () => {
-    beforeEach(() => {
-      mockRulesTablePersistedState({ urlState: urlSavedState, storageState: storageSavedState });
-    });
-
-    it('restores the state from the url', () => {
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: urlSavedState.searchTerm,
-        showCustomRules: urlSavedState.source === RuleSource.Custom,
-        showElasticRules: urlSavedState.source === RuleSource.Prebuilt,
-        tags: urlSavedState.tags,
-        enabled: urlSavedState.enabled,
-      });
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({
-        field: urlSavedState.field,
-        order: urlSavedState.order,
-      });
-      expect(actions.setPage).toHaveBeenCalledWith(urlSavedState.page);
-      expect(actions.setPerPage).toHaveBeenCalledWith(urlSavedState.perPage);
-    });
-  });
-
-  describe('when partial state is saved in the url and in the storage', () => {
-    it('restores only the search term', () => {
-      mockRulesTablePersistedState({
-        urlState: { searchTerm: 'test' },
-        storageState: { field: 'name' },
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        ...DEFAULT_FILTER_OPTIONS,
-        filter: 'test',
-      });
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({
-        ...DEFAULT_SORTING_OPTIONS,
-        field: 'name',
-      });
-    });
-  });
-
-  describe('when there is invalid state in the url', () => {
-    it('does not restore the filter', () => {
-      mockRulesTablePersistedState({
-        urlState: {
-          searchTerm: 'test',
-          source: RuleSource.Custom,
-          // @ts-expect-error Passing an invalid value for the test
-          tags: [1, 2, 3],
-          field: 'name',
-          order: 'asc',
-          page: 2,
-          perPage: 10,
-        },
-        storageState: null,
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: '',
-        showCustomRules: false,
-        showElasticRules: false,
-        tags: [],
-      });
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({ field: 'name', order: 'asc' });
-      expect(actions.setPage).toHaveBeenCalledWith(2);
-      expect(actions.setPerPage).toHaveBeenCalledWith(10);
-    });
-
-    it('does not restore the sorting', () => {
-      mockRulesTablePersistedState({
-        urlState: {
-          searchTerm: 'test',
-          source: RuleSource.Custom,
-          tags: ['test'],
-          field: 'name',
-          // @ts-expect-error Passing an invalid value for the test
-          order: 'abc',
-          page: 2,
-          perPage: 10,
-        },
-        storageState: null,
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: 'test',
-        showCustomRules: true,
-        showElasticRules: false,
-        tags: ['test'],
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).toHaveBeenCalledWith(2);
-      expect(actions.setPerPage).toHaveBeenCalledWith(10);
-    });
-
-    it('does not restore the pagination', () => {
-      mockRulesTablePersistedState({
-        urlState: {
-          searchTerm: 'test',
-          source: RuleSource.Custom,
-          tags: ['test'],
-          field: 'name',
-          order: 'asc',
-          // @ts-expect-error Passing an invalid value for the test
-          page: 'aaa',
-          perPage: 10,
-        },
-        storageState: null,
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: 'test',
-        showCustomRules: true,
-        showElasticRules: false,
-        tags: ['test'],
-      });
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({ field: 'name', order: 'asc' });
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('when there is invalid state in the storage', () => {
-    it('does not restore the filter', () => {
-      mockRulesTablePersistedState({
-        urlState: null,
-        storageState: {
-          searchTerm: 'test',
-          source: RuleSource.Custom,
-          // @ts-expect-error Passing an invalid value for the test
-          tags: [1, 2, 3],
-          field: 'name',
-          order: 'asc',
-          perPage: 10,
-        },
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: '',
-        showCustomRules: false,
-        showElasticRules: false,
-        tags: [],
-      });
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({ field: 'name', order: 'asc' });
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).toHaveBeenCalledWith(10);
-    });
-
-    it('does not restore the sorting', () => {
-      mockRulesTablePersistedState({
-        urlState: null,
-        storageState: {
-          searchTerm: 'test',
-          source: RuleSource.Custom,
-          tags: ['test'],
-          field: 'name',
-          // @ts-expect-error Passing an invalid value for the test
-          order: 'abc',
-          perPage: 10,
-        },
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: 'test',
-        showCustomRules: true,
-        showElasticRules: false,
-        tags: ['test'],
-      });
-      expect(actions.setSortingOptions).not.toHaveBeenCalled();
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).toHaveBeenCalledWith(10);
-    });
-
-    it('does not restore the pagination', () => {
-      mockRulesTablePersistedState({
-        urlState: null,
-        storageState: {
-          searchTerm: 'test',
-          source: RuleSource.Custom,
-          tags: ['test'],
-          field: 'name',
-          order: 'asc',
-          // @ts-expect-error Passing an invalid value for the test
-          perPage: 'aaa',
-        },
-      });
-
-      renderHook(() => useInitializeRulesTableSavedState());
-
-      expect(actions.setFilterOptions).toHaveBeenCalledWith({
-        filter: 'test',
-        showCustomRules: true,
-        showElasticRules: false,
-        tags: ['test'],
-      });
-      expect(actions.setSortingOptions).toHaveBeenCalledWith({ field: 'name', order: 'asc' });
-      expect(actions.setPage).not.toHaveBeenCalled();
-      expect(actions.setPerPage).not.toHaveBeenCalled();
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_rules_table_saved_state.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_rules_table_saved_state.test.ts
new file mode 100644
index 0000000000000..de9bf77e13236
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_rules_table_saved_state.test.ts
@@ -0,0 +1,762 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { renderHook } from '@testing-library/react-hooks';
+import { RULES_TABLE_MAX_PAGE_SIZE } from '../../../../../../common/constants';
+import type {
+  RulesTableStorageSavedState,
+  RulesTableUrlSavedState,
+} from './rules_table_saved_state';
+import { RuleSource } from './rules_table_saved_state';
+import { mockRulesTablePersistedState } from './__mocks__/mock_rules_table_persistent_state';
+import { useRulesTableSavedState } from './use_rules_table_saved_state';
+
+jest.mock('../../../../../common/lib/kibana');
+jest.mock('../../../../../common/utils/global_query_string/helpers');
+jest.mock('./rules_table_context');
+
+describe('useRulesTableSavedState', () => {
+  const urlSavedState: RulesTableUrlSavedState = {
+    searchTerm: 'test',
+    source: RuleSource.Custom,
+    tags: ['test'],
+    enabled: true,
+    field: 'name',
+    order: 'asc',
+    page: 2,
+    perPage: 10,
+  };
+  const storageSavedState: RulesTableStorageSavedState = {
+    searchTerm: 'test',
+    source: RuleSource.Custom,
+    tags: ['test'],
+    enabled: false,
+    field: 'name',
+    order: 'asc',
+    perPage: 20,
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('when the state is not saved', () => {
+    beforeEach(() => {
+      mockRulesTablePersistedState({ urlState: null, storageState: null });
+    });
+
+    it('does not return the state', () => {
+      const {
+        result: { current: currentResult },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(currentResult).toEqual({});
+    });
+  });
+
+  describe('when the state is saved in the url', () => {
+    beforeEach(() => {
+      mockRulesTablePersistedState({ urlState: urlSavedState, storageState: null });
+    });
+
+    it('returns the state', () => {
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: urlSavedState.searchTerm,
+        source: urlSavedState.source,
+        tags: urlSavedState.tags,
+        enabled: urlSavedState.enabled,
+      });
+      expect(sorting).toEqual({
+        field: urlSavedState.field,
+        order: urlSavedState.order,
+      });
+      expect(pagination).toEqual({
+        page: urlSavedState.page,
+        perPage: urlSavedState.perPage,
+      });
+    });
+
+    it('returns the state ignoring negative page size', () => {
+      mockRulesTablePersistedState({
+        urlState: { ...urlSavedState, perPage: -1 },
+        storageState: null,
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: urlSavedState.searchTerm,
+        source: urlSavedState.source,
+        tags: urlSavedState.tags,
+        enabled: urlSavedState.enabled,
+      });
+      expect(sorting).toEqual({
+        field: urlSavedState.field,
+        order: urlSavedState.order,
+      });
+      expect(pagination).toEqual({});
+    });
+
+    it('returns the state ignoring the page size larger than max allowed', () => {
+      mockRulesTablePersistedState({
+        urlState: { ...urlSavedState, perPage: RULES_TABLE_MAX_PAGE_SIZE + 1 },
+        storageState: null,
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: urlSavedState.searchTerm,
+        source: urlSavedState.source,
+        tags: urlSavedState.tags,
+        enabled: urlSavedState.enabled,
+      });
+      expect(sorting).toEqual({
+        field: urlSavedState.field,
+        order: urlSavedState.order,
+      });
+      expect(pagination).toEqual({
+        page: urlSavedState.page,
+      });
+    });
+  });
+
+  describe('when the partial state is saved in the url', () => {
+    it('returns only the search term', () => {
+      mockRulesTablePersistedState({ urlState: { searchTerm: 'test' }, storageState: null });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: 'test',
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only show prebuilt rules filter', () => {
+      mockRulesTablePersistedState({
+        urlState: { source: RuleSource.Prebuilt },
+        storageState: null,
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        source: RuleSource.Prebuilt,
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only show custom rules filter', () => {
+      mockRulesTablePersistedState({ urlState: { source: RuleSource.Custom }, storageState: null });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        source: RuleSource.Custom,
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only tags', () => {
+      mockRulesTablePersistedState({ urlState: { tags: ['test'] }, storageState: null });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        tags: ['test'],
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only enabled state', () => {
+      mockRulesTablePersistedState({ urlState: { enabled: true }, storageState: null });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        enabled: true,
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only sorting field', () => {
+      mockRulesTablePersistedState({ urlState: { field: 'name' }, storageState: null });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({ field: 'name' });
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only sorting order', () => {
+      mockRulesTablePersistedState({ urlState: { order: 'asc' }, storageState: null });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({ order: 'asc' });
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only page number', () => {
+      mockRulesTablePersistedState({ urlState: { page: 10 }, storageState: null });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({ page: 10 });
+    });
+
+    it('returns only page size', () => {
+      mockRulesTablePersistedState({ urlState: { perPage: 10 }, storageState: null });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({ perPage: 10 });
+    });
+  });
+
+  describe('when state is saved in the storage', () => {
+    beforeEach(() => {
+      mockRulesTablePersistedState({ urlState: null, storageState: storageSavedState });
+    });
+
+    it('returns the state', () => {
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: storageSavedState.searchTerm,
+        source: storageSavedState.source,
+        tags: storageSavedState.tags,
+        enabled: storageSavedState.enabled,
+      });
+      expect(sorting).toEqual({
+        field: storageSavedState.field,
+        order: storageSavedState.order,
+      });
+      expect(pagination).toEqual({
+        perPage: storageSavedState.perPage,
+      });
+    });
+
+    it('returns the state ignoring negative page size', () => {
+      mockRulesTablePersistedState({
+        urlState: null,
+        storageState: { ...storageSavedState, perPage: -1 },
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: storageSavedState.searchTerm,
+        source: storageSavedState.source,
+        tags: storageSavedState.tags,
+        enabled: storageSavedState.enabled,
+      });
+      expect(sorting).toEqual({
+        field: storageSavedState.field,
+        order: storageSavedState.order,
+      });
+      expect(pagination).toEqual({});
+    });
+
+    it('returns the state ignoring the page size larger than max allowed', () => {
+      mockRulesTablePersistedState({
+        urlState: null,
+        storageState: { ...storageSavedState, perPage: RULES_TABLE_MAX_PAGE_SIZE + 1 },
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: storageSavedState.searchTerm,
+        source: storageSavedState.source,
+        tags: storageSavedState.tags,
+        enabled: storageSavedState.enabled,
+      });
+      expect(sorting).toEqual({
+        field: storageSavedState.field,
+        order: storageSavedState.order,
+      });
+      expect(pagination).toEqual({});
+    });
+  });
+
+  describe('when partial state is saved in the storage', () => {
+    it('returns only the search term', () => {
+      mockRulesTablePersistedState({ urlState: null, storageState: { searchTerm: 'test' } });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: 'test',
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only show prebuilt rules filter', () => {
+      mockRulesTablePersistedState({
+        urlState: null,
+        storageState: { source: RuleSource.Prebuilt },
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        source: RuleSource.Prebuilt,
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only show custom rules filter', () => {
+      mockRulesTablePersistedState({ urlState: null, storageState: { source: RuleSource.Custom } });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        source: RuleSource.Custom,
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only tags', () => {
+      mockRulesTablePersistedState({ urlState: null, storageState: { tags: ['test'] } });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        tags: ['test'],
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only enabled state', () => {
+      mockRulesTablePersistedState({ urlState: null, storageState: { enabled: true } });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        enabled: true,
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only sorting field', () => {
+      mockRulesTablePersistedState({ urlState: null, storageState: { field: 'name' } });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({ field: 'name' });
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only sorting order', () => {
+      mockRulesTablePersistedState({ urlState: null, storageState: { order: 'asc' } });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({ order: 'asc' });
+      expect(pagination).toEqual({});
+    });
+
+    it('does not return the page number', () => {
+      mockRulesTablePersistedState({
+        urlState: null,
+        // @ts-expect-error Passing an invalid value for the test
+        storageState: { page: 10 },
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({});
+    });
+
+    it('returns only page size', () => {
+      mockRulesTablePersistedState({ urlState: null, storageState: { perPage: 10 } });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({ perPage: 10 });
+    });
+  });
+
+  describe('when state is saved in the url and the storage', () => {
+    beforeEach(() => {
+      mockRulesTablePersistedState({ urlState: urlSavedState, storageState: storageSavedState });
+    });
+
+    it('returns the state from the url', () => {
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: urlSavedState.searchTerm,
+        source: urlSavedState.source,
+        tags: urlSavedState.tags,
+        enabled: urlSavedState.enabled,
+      });
+      expect(sorting).toEqual({
+        field: urlSavedState.field,
+        order: urlSavedState.order,
+      });
+      expect(pagination).toEqual({
+        page: urlSavedState.page,
+        perPage: urlSavedState.perPage,
+      });
+    });
+  });
+
+  describe('when partial state is saved in the url and in the storage', () => {
+    it('returns only the search term', () => {
+      mockRulesTablePersistedState({
+        urlState: { searchTerm: 'test' },
+        storageState: { field: 'name' },
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: 'test',
+      });
+      expect(sorting).toEqual({
+        field: 'name',
+      });
+      expect(pagination).toEqual({});
+    });
+  });
+
+  describe('when there is invalid state in the url', () => {
+    it('does not return the filter', () => {
+      mockRulesTablePersistedState({
+        urlState: {
+          searchTerm: 'test',
+          source: RuleSource.Custom,
+          // @ts-expect-error Passing an invalid value for the test
+          tags: [1, 2, 3],
+          enabled: true,
+          field: 'name',
+          order: 'asc',
+          page: 2,
+          perPage: 10,
+        },
+        storageState: null,
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({
+        field: 'name',
+        order: 'asc',
+      });
+      expect(pagination).toEqual({
+        page: 2,
+        perPage: 10,
+      });
+    });
+
+    it('does not return the sorting', () => {
+      mockRulesTablePersistedState({
+        urlState: {
+          searchTerm: 'test',
+          source: RuleSource.Custom,
+          tags: ['test'],
+          enabled: true,
+          field: 'name',
+          // @ts-expect-error Passing an invalid value for the test
+          order: 'abc',
+          page: 2,
+          perPage: 10,
+        },
+        storageState: null,
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: 'test',
+        source: RuleSource.Custom,
+        tags: ['test'],
+        enabled: true,
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({
+        page: 2,
+        perPage: 10,
+      });
+    });
+
+    it('does not return the pagination', () => {
+      mockRulesTablePersistedState({
+        urlState: {
+          searchTerm: 'test',
+          source: RuleSource.Custom,
+          tags: ['test'],
+          enabled: true,
+          field: 'name',
+          order: 'asc',
+          // @ts-expect-error Passing an invalid value for the test
+          page: 'aaa',
+          perPage: 10,
+        },
+        storageState: null,
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: 'test',
+        source: RuleSource.Custom,
+        tags: ['test'],
+        enabled: true,
+      });
+      expect(sorting).toEqual({
+        field: 'name',
+        order: 'asc',
+      });
+      expect(pagination).toEqual({});
+    });
+  });
+
+  describe('when there is invalid state in the storage', () => {
+    it('does not return the filter', () => {
+      mockRulesTablePersistedState({
+        urlState: null,
+        storageState: {
+          searchTerm: 'test',
+          source: RuleSource.Custom,
+          // @ts-expect-error Passing an invalid value for the test
+          tags: [1, 2, 3],
+          enabled: true,
+          field: 'name',
+          order: 'asc',
+          perPage: 10,
+        },
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({});
+      expect(sorting).toEqual({
+        field: 'name',
+        order: 'asc',
+      });
+      expect(pagination).toEqual({
+        perPage: 10,
+      });
+    });
+
+    it('does not return the sorting', () => {
+      mockRulesTablePersistedState({
+        urlState: null,
+        storageState: {
+          searchTerm: 'test',
+          source: RuleSource.Custom,
+          tags: ['test'],
+          enabled: true,
+          field: 'name',
+          // @ts-expect-error Passing an invalid value for the test
+          order: 'abc',
+          perPage: 10,
+        },
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: 'test',
+        source: RuleSource.Custom,
+        tags: ['test'],
+        enabled: true,
+      });
+      expect(sorting).toEqual({});
+      expect(pagination).toEqual({
+        perPage: 10,
+      });
+    });
+
+    it('does not return the pagination', () => {
+      mockRulesTablePersistedState({
+        urlState: null,
+        storageState: {
+          searchTerm: 'test',
+          source: RuleSource.Custom,
+          tags: ['test'],
+          enabled: true,
+          field: 'name',
+          order: 'asc',
+          // @ts-expect-error Passing an invalid value for the test
+          perPage: 'aaa',
+        },
+      });
+
+      const {
+        result: {
+          current: { filter, sorting, pagination },
+        },
+      } = renderHook(() => useRulesTableSavedState());
+
+      expect(filter).toEqual({
+        searchTerm: 'test',
+        source: RuleSource.Custom,
+        tags: ['test'],
+        enabled: true,
+      });
+      expect(sorting).toEqual({
+        field: 'name',
+        order: 'asc',
+      });
+      expect(pagination).toEqual({});
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_initialize_rules_table_saved_state.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_rules_table_saved_state.ts
similarity index 56%
rename from x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_initialize_rules_table_saved_state.ts
rename to x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_rules_table_saved_state.ts
index d70547dc74548..5cc9fe604ce7f 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_initialize_rules_table_saved_state.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_rules_table_saved_state.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { useEffect } from 'react';
 import type { Storage } from '@kbn/kibana-utils-plugin/public';
 import { validateNonExact } from '@kbn/securitysolution-io-ts-utils';
 import { useGetInitialUrlParamValue } from '../../../../../common/utils/global_query_string/helpers';
@@ -13,19 +12,16 @@ import { RULES_TABLE_MAX_PAGE_SIZE } from '../../../../../../common/constants';
 import { useKibana } from '../../../../../common/lib/kibana';
 import { URL_PARAM_KEY } from '../../../../../common/hooks/use_url_state';
 import { RULES_TABLE_STATE_STORAGE_KEY } from '../constants';
-import { useRulesTableContext } from './rules_table_context';
 import type {
   RulesTableStorageSavedState,
   RulesTableUrlSavedState,
 } from './rules_table_saved_state';
 import {
-  RuleSource,
   RulesTableSavedFilter,
   RulesTableStorageSavedPagination,
   RulesTableUrlSavedPagination,
   RulesTableSavedSorting,
 } from './rules_table_saved_state';
-import { DEFAULT_FILTER_OPTIONS, DEFAULT_SORTING_OPTIONS } from './rules_table_defaults';
 
 function readStorageState(storage: Storage): RulesTableStorageSavedState | null {
   try {
@@ -35,67 +31,64 @@ function readStorageState(storage: Storage): RulesTableStorageSavedState | null
   }
 }
 
+export function useRulesTableSavedState(): {
+  filter?: RulesTableSavedFilter;
+  sorting?: RulesTableSavedSorting;
+  pagination?: RulesTableUrlSavedPagination;
+} {
+  const getUrlParam = useGetInitialUrlParamValue<RulesTableUrlSavedState>(URL_PARAM_KEY.rulesTable);
+  const {
+    services: { sessionStorage },
+  } = useKibana();
+
+  const urlState = getUrlParam();
+  const storageState = readStorageState(sessionStorage);
+
+  if (!urlState && !storageState) {
+    return {};
+  }
+
+  const [filter, sorting, pagination] = validateState(urlState, storageState);
+
+  return { filter, sorting, pagination };
+}
+
 function validateState(
   urlState: RulesTableUrlSavedState | null,
   storageState: RulesTableStorageSavedState | null
 ): [RulesTableSavedFilter, RulesTableSavedSorting, RulesTableUrlSavedPagination] {
   const [filterFromUrl] = validateNonExact(urlState, RulesTableSavedFilter);
   const [filterFromStorage] = validateNonExact(storageState, RulesTableSavedFilter);
-  const filter = { ...filterFromStorage, ...filterFromUrl };
+  // We have to expose filter, sorting and pagination objects by explicitly specifying each field
+  // since urlState and/or storageState may contain unnecessary fields (e.g. outdated or explicitly added by user)
+  // and validateNonExact doesn't truncate fields not included in the type RulesTableSavedFilter and etc.
+  const filter: RulesTableSavedFilter = {
+    searchTerm: filterFromUrl?.searchTerm ?? filterFromStorage?.searchTerm,
+    source: filterFromUrl?.source ?? filterFromStorage?.source,
+    tags: filterFromUrl?.tags ?? filterFromStorage?.tags,
+    enabled: filterFromUrl?.enabled ?? filterFromStorage?.enabled,
+  };
 
   const [sortingFromUrl] = validateNonExact(urlState, RulesTableSavedSorting);
   const [sortingFromStorage] = validateNonExact(storageState, RulesTableSavedSorting);
-  const sorting = { ...sortingFromStorage, ...sortingFromUrl };
+  const sorting = {
+    field: sortingFromUrl?.field ?? sortingFromStorage?.field,
+    order: sortingFromUrl?.order ?? sortingFromStorage?.order,
+  };
 
   const [paginationFromUrl] = validateNonExact(urlState, RulesTableUrlSavedPagination);
   const [paginationFromStorage] = validateNonExact(storageState, RulesTableStorageSavedPagination);
-  const pagination = { perPage: paginationFromStorage?.perPage, ...paginationFromUrl };
-
-  return [filter, sorting, pagination];
-}
-
-export function useInitializeRulesTableSavedState(): void {
-  const getUrlParam = useGetInitialUrlParamValue<RulesTableUrlSavedState>(URL_PARAM_KEY.rulesTable);
-  const { actions } = useRulesTableContext();
-  const {
-    services: { sessionStorage },
-  } = useKibana();
-
-  useEffect(() => {
-    const urlState = getUrlParam();
-    const storageState = readStorageState(sessionStorage);
+  const pagination = {
+    page: paginationFromUrl?.page, // We don't persist page number in the session storage since it may be outdated when restored
+    perPage: paginationFromUrl?.perPage ?? paginationFromStorage?.perPage,
+  };
 
-    if (!urlState && !storageState) {
-      return;
-    }
-
-    const [filter, sorting, pagination] = validateState(urlState, storageState);
-
-    actions.setFilterOptions({
-      filter: filter.searchTerm ?? DEFAULT_FILTER_OPTIONS.filter,
-      showElasticRules: filter.source === RuleSource.Prebuilt,
-      showCustomRules: filter.source === RuleSource.Custom,
-      tags: Array.isArray(filter.tags) ? filter.tags : DEFAULT_FILTER_OPTIONS.tags,
-      enabled: filter.enabled,
-    });
-
-    if (sorting.field || sorting.order) {
-      actions.setSortingOptions({
-        field: sorting.field ?? DEFAULT_SORTING_OPTIONS.field,
-        order: sorting.order ?? DEFAULT_SORTING_OPTIONS.order,
-      });
-    }
-
-    if (pagination.page) {
-      actions.setPage(pagination.page);
-    }
+  if (
+    pagination.perPage &&
+    (pagination.perPage < 0 || pagination.perPage > RULES_TABLE_MAX_PAGE_SIZE)
+  ) {
+    delete pagination.perPage;
+  }
 
-    if (
-      pagination.perPage &&
-      pagination.perPage > 0 &&
-      pagination.perPage <= RULES_TABLE_MAX_PAGE_SIZE
-    ) {
-      actions.setPerPage(pagination.perPage);
-    }
-  }, [getUrlParam, actions, sessionStorage]);
+  return [filter, sorting, pagination];
 }
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table_utility_bar.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table_utility_bar.tsx
index 7c91e27423697..9c681d95ae520 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table_utility_bar.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table_utility_bar.tsx
@@ -179,6 +179,16 @@ export const RulesTableUtilityBar = React.memo<RulesTableUtilityBarProps>(
               >
                 {i18n.REFRESH_RULE_POPOVER_LABEL}
               </UtilityBarAction>
+              {!rulesTableContext.state.isDefault && (
+                <UtilityBarAction
+                  dataTestSubj="clearTableFilters"
+                  iconSide="left"
+                  iconType="cross"
+                  onClick={rulesTableContext.actions.clearFilters}
+                >
+                  {i18n.CLEAR_RULES_TABLE_FILTERS}
+                </UtilityBarAction>
+              )}
             </UtilityBarGroup>
           </>
         </UtilityBarSection>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
index 0e1c1b1c0b43e..c71cc4cf267a4 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
@@ -889,6 +889,13 @@ export const REFRESH_RULE_POPOVER_LABEL = i18n.translate(
   }
 );
 
+export const CLEAR_RULES_TABLE_FILTERS = i18n.translate(
+  'xpack.securitySolution.detectionEngine.rules.clearRulesTableFilters',
+  {
+    defaultMessage: 'Clear filters',
+  }
+);
+
 /**
  * Bulk Export
  */

From 78b16cbe12cbb3f34004b8260502dea155076dbc Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 6 Feb 2023 16:41:29 -0600
Subject: [PATCH 024/134] Update dependency @babel/generator to ^7.20.14 (main)
 (#150262)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [@babel/generator](https://babel.dev/docs/en/next/babel-generator)
([source](https://togithub.com/babel/babel)) | [`^7.20.7` ->
`^7.20.14`](https://renovatebot.com/diffs/npm/@babel%2fgenerator/7.20.7/7.20.14)
|
[![age](https://badges.renovateapi.com/packages/npm/@babel%2fgenerator/7.20.14/age-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://badges.renovateapi.com/packages/npm/@babel%2fgenerator/7.20.14/adoption-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://badges.renovateapi.com/packages/npm/@babel%2fgenerator/7.20.14/compatibility-slim/7.20.7)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://badges.renovateapi.com/packages/npm/@babel%2fgenerator/7.20.14/confidence-slim/7.20.7)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>babel/babel</summary>

###
[`v7.20.14`](https://togithub.com/babel/babel/blob/HEAD/CHANGELOG.md#v72014-2023-01-27)

[Compare
Source](https://togithub.com/babel/babel/compare/v7.20.7...v7.20.14)

##### :bug: Bug Fix

-   `babel-plugin-transform-block-scoping`
- [#&#8203;15361](https://togithub.com/babel/babel/pull/15361) fix:
Identifiers in the loop are not renamed
([@&#8203;liuxingbaoyu](https://togithub.com/liuxingbaoyu))
- `babel-cli`, `babel-core`, `babel-generator`,
`babel-helper-transform-fixture-test-runner`,
`babel-plugin-transform-destructuring`,
`babel-plugin-transform-modules-commonjs`,
`babel-plugin-transform-react-jsx`, `babel-traverse`
- [#&#8203;15365](https://togithub.com/babel/babel/pull/15365) fix:
Properly generate source maps for manually added multi-line content
([@&#8203;liuxingbaoyu](https://togithub.com/liuxingbaoyu))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/elastic/kibana).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC4xMTkuNSIsInVwZGF0ZWRJblZlciI6IjM0LjExOS41In0=-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Jonathan Budzenski <jon@elastic.co>
---
 package.json |  2 +-
 yarn.lock    | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/package.json b/package.json
index c2613ebda6e76..d26b6bd79b0c2 100644
--- a/package.json
+++ b/package.json
@@ -669,7 +669,7 @@
     "@babel/core": "^7.20.12",
     "@babel/eslint-parser": "^7.19.1",
     "@babel/eslint-plugin": "^7.19.1",
-    "@babel/generator": "^7.20.7",
+    "@babel/generator": "^7.20.14",
     "@babel/helper-plugin-utils": "^7.20.2",
     "@babel/parser": "^7.20.13",
     "@babel/plugin-proposal-class-properties": "^7.18.6",
diff --git a/yarn.lock b/yarn.lock
index 77b529bdd0bcb..fa46dea2940e9 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -150,10 +150,10 @@
   dependencies:
     eslint-rule-composer "^0.3.0"
 
-"@babel/generator@^7.12.11", "@babel/generator@^7.12.5", "@babel/generator@^7.20.7", "@babel/generator@^7.7.2":
-  version "7.20.7"
-  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.20.7.tgz#f8ef57c8242665c5929fe2e8d82ba75460187b4a"
-  integrity sha512-7wqMOJq8doJMZmP4ApXTzLxSr7+oO2jroJURrVEp6XShrQUObV8Tq/D0NCcoYg2uHqUrjzO0zwBjoYzelxK+sw==
+"@babel/generator@^7.12.11", "@babel/generator@^7.12.5", "@babel/generator@^7.20.14", "@babel/generator@^7.20.7", "@babel/generator@^7.7.2":
+  version "7.20.14"
+  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.20.14.tgz#9fa772c9f86a46c6ac9b321039400712b96f64ce"
+  integrity sha512-AEmuXHdcD3A52HHXxaTmYlb8q/xMEhoRP67B3T4Oq7lbmSoqroMZzjnGj3+i1io3pdnF8iBYVu4Ilj+c4hBxYg==
   dependencies:
     "@babel/types" "^7.20.7"
     "@jridgewell/gen-mapping" "^0.3.2"
@@ -28475,12 +28475,12 @@ write-file-atomic@^4.0.1:
     imurmurhash "^0.1.4"
     signal-exit "^3.0.7"
 
-ws@8.9.0, ws@^8.2.3, ws@^8.4.2, ws@^8.9.0:
+ws@8.9.0:
   version "8.9.0"
   resolved "https://registry.yarnpkg.com/ws/-/ws-8.9.0.tgz#2a994bb67144be1b53fe2d23c53c028adeb7f45e"
   integrity sha512-Ja7nszREasGaYUYCI2k4lCKIRTt+y7XuqVoHR44YpI49TtryyqbqvDMn5eqfW7e6HzTukDRIsXqzVHScqRcafg==
 
-ws@>=8.11.0:
+ws@>=8.11.0, ws@^8.2.3, ws@^8.4.2, ws@^8.9.0:
   version "8.12.0"
   resolved "https://registry.yarnpkg.com/ws/-/ws-8.12.0.tgz#485074cc392689da78e1828a9ff23585e06cddd8"
   integrity sha512-kU62emKIdKVeEIOIKVegvqpXMSTAMLJozpHZaJNDYqBjzlSYXQGviYwN1osDLJ9av68qHd4a2oSjd7yD4pacig==

From 55b66e20fecb39ff0026c53c3ae6b3f8242be734 Mon Sep 17 00:00:00 2001
From: Hannah Mudge <Heenawter@users.noreply.github.com>
Date: Mon, 6 Feb 2023 16:13:28 -0700
Subject: [PATCH 025/134] [Dashboard] [Controls] Load more options list
 suggestions on scroll (#148331)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes https://github.com/elastic/kibana/issues/140175
Closes https://github.com/elastic/kibana/issues/143580

## Summary

Oh, boy! Get ready for a doozy of a PR, folks! Let's talk about the
three major things that were accomplished here:

### 1) Pagination
Originally, this PR was meant to add traditional pagination to the
options list control. However, after implementing a version of this, it
became apparent that, not only was UI becoming uncomfortably messy, it
also had some UX concerns because we were deviating from the usual
pagination pattern by showing the cardinality rather than the number of
pages:

<p align="center"><img
src="https://user-images.githubusercontent.com/8698078/214687041-f8950d3a-2b29-41d5-b656-c79d9575d744.gif"/></p>

So, instead of traditional pagination, we decided to take a different
approach (which was made possible by
https://github.com/elastic/kibana/pull/148420) - **load more options
when the user scrolls to the bottom!** Here it is in action:

<p align="center"><img
src="https://user-images.githubusercontent.com/8698078/214688854-06c7e8a9-7b8c-4dc0-9846-00ccf5e5f771.gif"/></p>

It is important that the first query remains **fast** - that is why we
still only request the top 10 options when the control first loads. So,
having a "load more" is the best approach that allows users to see more
suggestions while also ensuring that the performance of options lists
(especially with respect to chaining) is not impacted.

Note that it is **not possible** to grab every single value of a field -
the limit is `10,000`. However, since it is impractical that a user
would want to scroll through `10,000` suggestions (and potentially very
slow to fetch), we have instead made the limit of this "show more"
functionality `1,000`. To make this clear, if the field has more than
`1,000` values and the user scrolls all the way to the bottom, they will
get the following message:


<p align="center"><img
src="https://user-images.githubusercontent.com/8698078/214920302-1e3574dc-f2b6-4845-be69-f9ba04177e7f.png"/></p>


### 2) Cardinality
Previously, the cardinality of the options list control was **only**
shown as part of the control placeholder text - this meant that, once
the user entered their search term, they could no longer see the
cardinality of the returned options. This PR changes this functionality
by placing the cardinality in a badge **beside** the search bar - this
value now changes as the user types, so they can very clearly see how
many options match their search:

<p align="center"><img
src="https://user-images.githubusercontent.com/8698078/214689739-9670719c-5878-4e8b-806c-0b5a6f6f907f.gif"/></p>

> **Note**
> After some initial feedback, we have removed both the cardinality and
invalid selections badges in favour of displaying the cardinality below
the search bar, like so:
>
> <p align="center"><img
src="https://user-images.githubusercontent.com/8698078/216473930-e99366a3-86df-4777-a3d8-cf2d41e550fb.gif"/></p>
>
> So,  please be aware that the screenshots above are outdated.


### 3) Changes to Queries
This is where things get.... messy! Essentially, our previous queries
were all built with the expectation that the Elasticsearch setting
`search.allow_expensive_queries` was **off** - this meant that they
worked regardless of the value of this setting. However, when trying to
get the cardinality to update based on a search term, it became apparent
that this was not possible if we kept the same assumptions -
specifically, if `search.allow_expensive_queries` is off, there is
absolutely no way for the cardinality of **keyword only fields** to
respond to a search term.

After a whole lot of discussion, we decided that the updating
cardinality was a feature important enough to justify having **two
separate versions** of the queries:
1. **Queries for when `search.allow_expensive_queries` is off**:
These are essentially the same as our old queries - however, since we
can safely assume that this setting is **usually** on (it defaults on,
and there is no UI to easily change it), we opted to simplify them a
bit.

First of all, we used to create a special object for tracking the
parent/child relationship of fields that are mapped as keyword+text -
this was so that, if a user created a control on these fields, we could
support case-insensitive search. We no longer do this - if
`search.allow_expensive_queries` is off and you create a control on a
text+keyword field, the search will be case sensitive. This helps clean
up our code quite a bit.

Second, we are no longer returning **any** cardinality. Since the
cardinality is now displayed as a badge beside the search bar, users
would expect that this value would change as they type - however, since
it's impossible to make this happen for keyword-only fields and to keep
behaviour consistent, we have opted to simply remove this badge when
`search.allow_expensive_queries` is off **regardless** of the field
type. So, there is no longer a need to include the `cardinality` query
when grabbing the suggestions.

Finally, we do not support "load more" when
`search.allow_expensive_queries` is off. While this would theoretically
be possible, because we are no longer grabbing the cardinality, we would
have to always fetch `1,000` results when the user loads more, even if
the true cardinality is much smaller. Again, we are pretty confident
that **more often than not**, the `search.allow_expensive_queries` is
on; therefore, we are choosing to favour developer experience in this
instance because the impact should be quite small.

2. **Queries for when `search.allow_expensive_queries` is on**:
When this setting is on, we now have access to the prefix query, which
greatly simplifies how our queries are handled - now, rather than having
separate queries for keyword-only, keyword+text, and nested fields,
these have all been combined into a single query! And even better -
:star: now **all** string-based fields support case-insensitive search!
:star: Yup, that's right - even keyword-only fields 💃

There has been [discussion on the Elasticsearch side
](https://github.com/elastic/elasticsearch/issues/90898) about whether
or not this setting is even **practical**, and so it is possible that,
in the near future, this distinction will no longer be necessary. With
this in mind, I have made these two versions of our queries **completely
separate** from each other - while this introduces some code
duplication, it makes the cleanup that may follow much, much easier.

Well, that was sure fun, hey?

<p align="center"><img
src="https://user-images.githubusercontent.com/8698078/214921985-49058ff0-42f2-4b01-8ae3-0a4d259d1075.gif"/></p>


## How to Test
I've created a quick little Python program to ingest some good testing
data for this PR:

```python
import random
import time
import pandas as pd
from faker import Faker
from elasticsearch import Elasticsearch

SIZE = 10000
ELASTIC_PASSWORD = "changeme"
INDEX_NAME = 'test_large_index'

Faker.seed(time.time())
faker = Faker()
hundredRandomSentences = [faker.sentence(random.randint(5, 35)) for _ in range(100)]
thousandRandomIps = [faker.ipv4() if random.randint(0, 99) < 50 else faker.ipv6() for _ in range(1000)]

client = Elasticsearch(
    "http://localhost:9200",
    basic_auth=("elastic", ELASTIC_PASSWORD),
)

if(client.indices.exists(index=INDEX_NAME)):
    client.indices.delete(index=INDEX_NAME)
client.indices.create(index=INDEX_NAME, mappings={"properties":{"keyword_field":{"type":"keyword"},"id":{"type":"long"},"ip_field":{"type":"ip"},"boolean_field":{"type":"boolean"},"keyword_text_field":{"type":"text","fields":{"keyword":{"type":"keyword"}}},"nested_field":{"type":"nested","properties":{"first":{"type":"text","fields":{"keyword":{"type":"keyword"}}},"last":{"type":"text","fields":{"keyword":{"type":"keyword"}}}}},"long_keyword_text_field":{"type":"text","fields":{"keyword":{"type":"keyword"}}}}})

print('Generating data', end='')
for i in range(SIZE):
    name1 = faker.name();
    [first_name1, last_name1] = name1.split(' ', 1)
    name2 = faker.name();
    [first_name2, last_name2] = name2.split(' ', 1)
    response = client.create(index=INDEX_NAME, id=i, document={
        'keyword_field': faker.country(),
        'id': i,
        'boolean_field': faker.boolean(),
        'ip_field': thousandRandomIps[random.randint(0, 999)],
        'keyword_text_field': faker.name(),
        'nested_field': [
            { 'first': first_name1, 'last': last_name1},
            { 'first': first_name2, 'last': last_name2}
        ],
        'long_keyword_text_field': hundredRandomSentences[random.randint(0, 99)]
    })
    print('.', end='')
print(' Done!')
```
However, if you don't have Python up and running, here's a CSV with a
smaller version of this data:
[testNewQueriesData.csv](https://github.com/elastic/kibana/files/10538537/testNewQueriesData.csv)

> **Warning**
> When uploading, make sure to update the mappings of the CSV data to
the mappings included as part of the Python script above (which you can
find as part of the `client.indices.create` call). You'll notice,
however, that **none of the CSV documents have a nested field**.
Unfortunately, there doesn't seem to be a way to able to ingest nested
data through uploading a CSV, so the above data does not include one -
in order to test the nested data type, you'd have to add some of your
own documents
>
> Here's a sample nested field document, for your convenience:
> ```json
> {
>     "keyword_field": "Russian Federation",
>     "id": 0,
>     "boolean_field": true,
>     "ip_field": "121.149.70.251",
>     "keyword_text_field": "Michael Foster",
>     "nested_field": [
>       {
>         "first": "Rachel",
>         "last": "Wright"
>       },
>       {
>         "first": "Gary",
>         "last": "Reyes"
>       }
>     ],
> "long_keyword_text_field": "Color hotel indicate appear since well
sure right yet individual easy often test enough left a usually
attention."
> }
> ```
>

### Testing Notes
Because there are now two versions of the queries, thorough testing
should be done for both when `search.allow_expensive_queries` is `true`
and when it is `false` for every single field type that is currently
supported. Use the following call to the cluster settings API to toggle
this value back and forth:

```php
PUT _cluster/settings
{
  "transient": {
	"search.allow_expensive_queries": <value> // true or false
  }
}
```

You should pay super special attention to the behaviour that happens
when toggling this value from `true` to `false` - for example, consider
the following:
1. Ensure `search.allow_expensive_queries` is either `true` or
`undefined`
2. Create and save a dashboard with at least one options list control
3. Navigate to the console and set `search.allow_expensive_queries` to
`false` - **DO NOT REFRESH**
4. Go back to the dashboard
5. Open up the options list control you created in step 2
6. Fetch a new, uncached request, either by scrolling to the bottom and
fetching more (assuming these values aren't already in the cache) or by
performing a search with a string you haven't tried before
7. ⚠️ **The options list control _should_ have a fatal error** ⚠️<br>The
Elasticsearch server knows that `search.allow_expensive_queries` is now
`false` but, because we only fetch this value on the first load on the
client side, it has not yet been updated - this means the options list
service still tries to fetch the suggestions using the expensive version
of the queries despite the fact that Elasticsearch will now reject this
request. The most graceful way to handle this is to simply throw a fatal
error.
8. Refreshing the browser will make things sync up again and you should
now get the expected results when opening the options list control.

### Flaky Test Runner

<a
href="https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/1845"><img
src="https://user-images.githubusercontent.com/8698078/215894267-97f07e59-6660-4117-bda7-18f63cb19af6.png"/></a>

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [x] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
     > **Note**
> Technically, it actually does - however, it is due to an [EUI
bug](https://github.com/elastic/eui/issues/6565) from adding the group
label to the bottom of the list.
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../controls/common/options_list/types.ts     |  39 +-
 src/plugins/controls/common/types.ts          |   2 -
 .../public/__stories__/controls.stories.tsx   |   1 -
 .../component/control_frame_component.tsx     |  31 +-
 .../control_group/editor/control_editor.tsx   |   3 -
 .../editor/data_control_editor_tools.ts       |  53 +-
 .../options_list/components/options_list.scss |  31 +-
 .../components/options_list_control.test.tsx  |   1 +
 .../components/options_list_control.tsx       |  33 +-
 .../components/options_list_popover.test.tsx  |  30 +-
 .../components/options_list_popover.tsx       |  56 +-
 .../options_list_popover_action_bar.tsx       | 152 ++--
 .../options_list_popover_footer.tsx           |  41 +-
 .../options_list_popover_sorting_button.tsx   |  43 +-
 .../options_list_popover_suggestions.tsx      | 140 ++--
 .../components/options_list_popover_title.tsx |  46 ++
 .../components/options_list_strings.ts        |  32 +-
 .../embeddable/options_list_embeddable.tsx    | 113 +--
 .../options_list/options_list_reducers.ts     |  20 +-
 .../controls/public/options_list/types.ts     |  14 +-
 .../public/services/http/http.stub.ts         |   1 +
 .../public/services/http/http_service.ts      |   3 +-
 .../controls/public/services/http/types.ts    |   1 +
 .../options_list/options_list.story.ts        |  11 +-
 .../options_list/options_list_service.ts      |  31 +-
 .../public/services/options_list/types.ts     |  11 +-
 src/plugins/controls/public/types.ts          |   2 -
 ...ons_list_cheap_suggestion_queries.test.ts} | 507 ++++++-------
 .../options_list_cheap_suggestion_queries.ts  | 201 ++++++
 .../options_list_cluster_settings_route.ts    |  47 ++
 ..._list_expensive_suggestion_queries.test.ts | 676 ++++++++++++++++++
 ...tions_list_expensive_suggestion_queries.ts | 217 ++++++
 .../options_list/options_list_queries.ts      | 289 --------
 .../options_list_suggestion_query_helpers.ts  |  38 +
 .../options_list_suggestions_route.ts         |  41 +-
 .../options_list_validation_queries.test.ts   | 104 +++
 .../options_list_validation_queries.ts        |  43 ++
 .../controls/server/options_list/types.ts     |  28 +
 src/plugins/controls/server/plugin.ts         |   3 +-
 src/plugins/controls/tsconfig.json            |   1 +
 .../embeddable/dashboard_container.tsx        |   2 +-
 .../dashboard_control_group_integration.ts    |  11 +-
 .../lib/embeddables/error_embedabble.scss     |  10 -
 .../lib/embeddables/error_embeddable.scss     |  20 +
 .../lib/embeddables/error_embeddable.tsx      |   1 +
 .../controls/options_list/index.ts            |  22 +-
 ...ptions_list_allow_expensive_queries_off.ts |  96 +++
 .../page_objects/dashboard_page_controls.ts   |  13 +
 .../translations/translations/fr-FR.json      |   2 -
 .../translations/translations/ja-JP.json      |   2 -
 .../translations/translations/zh-CN.json      |   2 -
 51 files changed, 2374 insertions(+), 943 deletions(-)
 create mode 100644 src/plugins/controls/public/options_list/components/options_list_popover_title.tsx
 rename src/plugins/controls/server/options_list/{options_list_queries.test.ts => options_list_cheap_suggestion_queries.test.ts} (57%)
 create mode 100644 src/plugins/controls/server/options_list/options_list_cheap_suggestion_queries.ts
 create mode 100644 src/plugins/controls/server/options_list/options_list_cluster_settings_route.ts
 create mode 100644 src/plugins/controls/server/options_list/options_list_expensive_suggestion_queries.test.ts
 create mode 100644 src/plugins/controls/server/options_list/options_list_expensive_suggestion_queries.ts
 delete mode 100644 src/plugins/controls/server/options_list/options_list_queries.ts
 create mode 100644 src/plugins/controls/server/options_list/options_list_suggestion_query_helpers.ts
 create mode 100644 src/plugins/controls/server/options_list/options_list_validation_queries.test.ts
 create mode 100644 src/plugins/controls/server/options_list/options_list_validation_queries.ts
 create mode 100644 src/plugins/controls/server/options_list/types.ts
 delete mode 100644 src/plugins/embeddable/public/lib/embeddables/error_embedabble.scss
 create mode 100644 src/plugins/embeddable/public/lib/embeddables/error_embeddable.scss
 create mode 100644 test/functional/apps/dashboard_elements/controls/options_list/options_list_allow_expensive_queries_off.ts

diff --git a/src/plugins/controls/common/options_list/types.ts b/src/plugins/controls/common/options_list/types.ts
index 1c9555bdc8d90..510dac280fe76 100644
--- a/src/plugins/controls/common/options_list/types.ts
+++ b/src/plugins/controls/common/options_list/types.ts
@@ -9,8 +9,8 @@
 import { FieldSpec, DataView, RuntimeFieldSpec } from '@kbn/data-views-plugin/common';
 import type { Filter, Query, BoolQuery, TimeRange } from '@kbn/es-query';
 
-import { OptionsListSortingType } from './suggestions_sorting';
-import { DataControlInput } from '../types';
+import type { OptionsListSortingType } from './suggestions_sorting';
+import type { DataControlInput } from '../types';
 
 export const OPTIONS_LIST_CONTROL = 'optionsListControl';
 
@@ -20,20 +20,14 @@ export interface OptionsListEmbeddableInput extends DataControlInput {
   existsSelected?: boolean;
   runPastTimeout?: boolean;
   singleSelect?: boolean;
+  hideActionBar?: boolean;
   hideExclude?: boolean;
   hideExists?: boolean;
   hideSort?: boolean;
-  hideActionBar?: boolean;
   exclude?: boolean;
   placeholder?: string;
 }
 
-export type OptionsListField = FieldSpec & {
-  textFieldName?: string;
-  parentFieldName?: string;
-  childFieldName?: string;
-};
-
 export interface OptionsListSuggestions {
   [key: string]: { doc_count: number };
 }
@@ -41,13 +35,27 @@ export interface OptionsListSuggestions {
 /**
  * The Options list response is returned from the serverside Options List route.
  */
-export interface OptionsListResponse {
-  rejected: boolean;
+export interface OptionsListSuccessResponse {
   suggestions: OptionsListSuggestions;
-  totalCardinality: number;
+  totalCardinality?: number; // total cardinality will be undefined when `useExpensiveQueries` is `false`
   invalidSelections?: string[];
 }
 
+/**
+ * The invalid selections are parsed **after** the server returns with the result from the ES client; so, the
+ * suggestion aggregation parser only returns the suggestions list + the cardinality of the result
+ */
+export type OptionsListParsedSuggestions = Pick<
+  OptionsListSuccessResponse,
+  'suggestions' | 'totalCardinality'
+>;
+
+export interface OptionsListFailureResponse {
+  error: 'aborted' | Error;
+}
+
+export type OptionsListResponse = OptionsListSuccessResponse | OptionsListFailureResponse;
+
 /**
  * The Options list request type taken in by the public Options List service.
  */
@@ -55,11 +63,12 @@ export type OptionsListRequest = Omit<
   OptionsListRequestBody,
   'filters' | 'fieldName' | 'fieldSpec' | 'textFieldName'
 > & {
+  allowExpensiveQueries: boolean;
   timeRange?: TimeRange;
-  field: OptionsListField;
   runPastTimeout?: boolean;
   dataView: DataView;
   filters?: Filter[];
+  field: FieldSpec;
   query?: Query;
 };
 
@@ -68,13 +77,13 @@ export type OptionsListRequest = Omit<
  */
 export interface OptionsListRequestBody {
   runtimeFieldMap?: Record<string, RuntimeFieldSpec>;
+  allowExpensiveQueries: boolean;
   sort?: OptionsListSortingType;
   filters?: Array<{ bool: BoolQuery }>;
   selectedOptions?: string[];
   runPastTimeout?: boolean;
-  parentFieldName?: string;
-  textFieldName?: string;
   searchString?: string;
   fieldSpec?: FieldSpec;
   fieldName: string;
+  size: number;
 }
diff --git a/src/plugins/controls/common/types.ts b/src/plugins/controls/common/types.ts
index 8f03b82bfaa93..5f37ef2c72871 100644
--- a/src/plugins/controls/common/types.ts
+++ b/src/plugins/controls/common/types.ts
@@ -30,7 +30,5 @@ export type ControlInput = EmbeddableInput & {
 
 export type DataControlInput = ControlInput & {
   fieldName: string;
-  parentFieldName?: string;
-  childFieldName?: string;
   dataViewId: string;
 };
diff --git a/src/plugins/controls/public/__stories__/controls.stories.tsx b/src/plugins/controls/public/__stories__/controls.stories.tsx
index 6b1f97e39ed7e..4326ce056d118 100644
--- a/src/plugins/controls/public/__stories__/controls.stories.tsx
+++ b/src/plugins/controls/public/__stories__/controls.stories.tsx
@@ -61,7 +61,6 @@ const storybookStubOptionsListRequest = async (
             {}
           ),
           totalCardinality: 100,
-          rejected: false,
         }),
       120
     )
diff --git a/src/plugins/controls/public/control_group/component/control_frame_component.tsx b/src/plugins/controls/public/control_group/component/control_frame_component.tsx
index 31a63f2fd4eff..eb5cda421381d 100644
--- a/src/plugins/controls/public/control_group/component/control_frame_component.tsx
+++ b/src/plugins/controls/public/control_group/component/control_frame_component.tsx
@@ -9,15 +9,13 @@
 import React, { useEffect, useMemo, useState } from 'react';
 import classNames from 'classnames';
 import {
+  EuiButtonEmpty,
   EuiButtonIcon,
   EuiFormControlLayout,
   EuiFormLabel,
   EuiFormRow,
-  EuiIcon,
-  EuiLink,
   EuiLoadingChart,
   EuiPopover,
-  EuiText,
   EuiToolTip,
 } from '@elastic/eui';
 
@@ -40,25 +38,26 @@ interface ControlFrameErrorProps {
 const ControlFrameError = ({ error }: ControlFrameErrorProps) => {
   const [isPopoverOpen, setPopoverOpen] = useState(false);
   const popoverButton = (
-    <EuiText className="errorEmbeddableCompact__button" size="xs">
-      <EuiLink
-        className="eui-textTruncate"
-        color="subdued"
-        onClick={() => setPopoverOpen((open) => !open)}
-      >
-        <EuiIcon type="alert" color="danger" />
-        <FormattedMessage
-          id="controls.frame.error.message"
-          defaultMessage="An error has occurred. Read more"
-        />
-      </EuiLink>
-    </EuiText>
+    <EuiButtonEmpty
+      color="danger"
+      iconSize="m"
+      iconType={'alert'}
+      onClick={() => setPopoverOpen((open) => !open)}
+      className={'errorEmbeddableCompact__button'}
+      textProps={{ className: 'errorEmbeddableCompact__text' }}
+    >
+      <FormattedMessage
+        id="controls.frame.error.message"
+        defaultMessage="An error occurred. View more"
+      />
+    </EuiButtonEmpty>
   );
 
   return (
     <EuiPopover
       button={popoverButton}
       isOpen={isPopoverOpen}
+      className="errorEmbeddableCompact__popover"
       anchorClassName="errorEmbeddableCompact__popoverAnchor"
       closePopover={() => setPopoverOpen(false)}
     >
diff --git a/src/plugins/controls/public/control_group/editor/control_editor.tsx b/src/plugins/controls/public/control_group/editor/control_editor.tsx
index bff1506280653..785e0e50bd78a 100644
--- a/src/plugins/controls/public/control_group/editor/control_editor.tsx
+++ b/src/plugins/controls/public/control_group/editor/control_editor.tsx
@@ -199,11 +199,8 @@ export const ControlEditor = ({
               selectedFieldName={selectedField}
               dataView={dataView}
               onSelectField={(field) => {
-                const { parentFieldName, childFieldName } = fieldRegistry?.[field.name] ?? {};
                 onTypeEditorChange({
                   fieldName: field.name,
-                  ...(parentFieldName && { parentFieldName }),
-                  ...(childFieldName && { childFieldName }),
                 });
                 const newDefaultTitle = field.displayName ?? field.name;
                 setDefaultTitle(newDefaultTitle);
diff --git a/src/plugins/controls/public/control_group/editor/data_control_editor_tools.ts b/src/plugins/controls/public/control_group/editor/data_control_editor_tools.ts
index 4344891280ce6..8cfd3cebe5dac 100644
--- a/src/plugins/controls/public/control_group/editor/data_control_editor_tools.ts
+++ b/src/plugins/controls/public/control_group/editor/data_control_editor_tools.ts
@@ -8,11 +8,10 @@
 
 import { memoize } from 'lodash';
 
-import { IFieldSubTypeMulti } from '@kbn/es-query';
 import { DataView } from '@kbn/data-views-plugin/common';
 
 import { pluginServices } from '../../services';
-import { DataControlFieldRegistry, IEditableControlFactory } from '../../types';
+import { DataControlField, DataControlFieldRegistry, IEditableControlFactory } from '../../types';
 
 export const getDataControlFieldRegistry = memoize(
   async (dataView: DataView) => {
@@ -21,50 +20,30 @@ export const getDataControlFieldRegistry = memoize(
   (dataView: DataView) => [dataView.id, JSON.stringify(dataView.fields.getAll())].join('|')
 );
 
-const doubleLinkFields = (dataView: DataView) => {
-  // double link the parent-child relationship specifically for case-sensitivity support for options lists
-  const fieldRegistry: DataControlFieldRegistry = {};
-
-  for (const field of dataView.fields.getAll()) {
-    if (!fieldRegistry[field.name]) {
-      fieldRegistry[field.name] = { field, compatibleControlTypes: [] };
-    }
-
-    const parentFieldName = (field.subType as IFieldSubTypeMulti)?.multi?.parent;
-    if (parentFieldName) {
-      fieldRegistry[field.name].parentFieldName = parentFieldName;
-
-      const parentField = dataView.getFieldByName(parentFieldName);
-      if (!fieldRegistry[parentFieldName] && parentField) {
-        fieldRegistry[parentFieldName] = { field: parentField, compatibleControlTypes: [] };
-      }
-      fieldRegistry[parentFieldName].childFieldName = field.name;
-    }
-  }
-  return fieldRegistry;
-};
-
 const loadFieldRegistryFromDataView = async (
   dataView: DataView
 ): Promise<DataControlFieldRegistry> => {
   const {
     controls: { getControlTypes, getControlFactory },
   } = pluginServices.getServices();
-  const newFieldRegistry: DataControlFieldRegistry = doubleLinkFields(dataView);
+
   const controlFactories = getControlTypes().map(
     (controlType) => getControlFactory(controlType) as IEditableControlFactory
   );
-  dataView.fields.map((dataViewField) => {
-    for (const factory of controlFactories) {
-      if (factory.isFieldCompatible) {
-        factory.isFieldCompatible(newFieldRegistry[dataViewField.name]);
+  const fieldRegistry: DataControlFieldRegistry = dataView.fields
+    .getAll()
+    .reduce((registry, field) => {
+      const test: DataControlField = { field, compatibleControlTypes: [] };
+      for (const factory of controlFactories) {
+        if (factory.isFieldCompatible) {
+          factory.isFieldCompatible(test);
+        }
       }
-    }
-
-    if (newFieldRegistry[dataViewField.name]?.compatibleControlTypes.length === 0) {
-      delete newFieldRegistry[dataViewField.name];
-    }
-  });
+      if (test.compatibleControlTypes.length === 0) {
+        return { ...registry };
+      }
+      return { ...registry, [field.name]: test };
+    }, {});
 
-  return newFieldRegistry;
+  return fieldRegistry;
 };
diff --git a/src/plugins/controls/public/options_list/components/options_list.scss b/src/plugins/controls/public/options_list/components/options_list.scss
index e88208ee4c623..ad042916fff6e 100644
--- a/src/plugins/controls/public/options_list/components/options_list.scss
+++ b/src/plugins/controls/public/options_list/components/options_list.scss
@@ -9,8 +9,18 @@
 
 .optionsList__actions {
   padding: $euiSizeS;
+  padding-bottom: 0;
   border-bottom: $euiBorderThin;
   border-color: darken($euiColorLightestShade, 2%);
+
+  .optionsList__actionsRow {
+    margin: ($euiSizeS / 2) 0 !important;
+
+    .optionsList__actionBarDivider {
+      height: $euiSize;
+      border-right: $euiBorderThin;
+    }
+  }
 }
 
 .optionsList__popoverTitle {
@@ -30,13 +40,17 @@
   font-style: italic;
 }
 
+.optionsList__loadMore {
+  font-style: italic;
+}
+
 .optionsList__negateLabel {
   font-weight: bold;
   font-size: $euiSizeM;
   color: $euiColorDanger;
 }
 
-.optionsList__ignoredBadge {
+.optionsList__actionBarFirstBadge {
   margin-left: $euiSizeS;
 }
 
@@ -86,3 +100,18 @@
 .optionsList--sortPopover {
   width: $euiSizeXL * 7;
 }
+
+.optionslist--loadingMoreGroupLabel {
+  text-align: center;
+  padding: $euiSizeM;
+  font-style: italic;
+  height:  $euiSizeXXL !important;
+}
+
+.optionslist--endOfOptionsGroupLabel {
+  text-align: center;
+  font-size: $euiSizeM;
+  height:  auto !important;
+  color: $euiTextSubduedColor;
+  padding: $euiSizeM;
+}
diff --git a/src/plugins/controls/public/options_list/components/options_list_control.test.tsx b/src/plugins/controls/public/options_list/components/options_list_control.test.tsx
index a4d5028f0f7be..7fe1cd2f7aa78 100644
--- a/src/plugins/controls/public/options_list/components/options_list_control.test.tsx
+++ b/src/plugins/controls/public/options_list/components/options_list_control.test.tsx
@@ -20,6 +20,7 @@ import { BehaviorSubject } from 'rxjs';
 describe('Options list control', () => {
   const defaultProps = {
     typeaheadSubject: new BehaviorSubject(''),
+    loadMoreSubject: new BehaviorSubject(10),
   };
 
   interface MountOptions {
diff --git a/src/plugins/controls/public/options_list/components/options_list_control.tsx b/src/plugins/controls/public/options_list/components/options_list_control.tsx
index 98f545718efc6..7906d77730f0d 100644
--- a/src/plugins/controls/public/options_list/components/options_list_control.tsx
+++ b/src/plugins/controls/public/options_list/components/options_list_control.tsx
@@ -17,20 +17,24 @@ import { useReduxEmbeddableContext } from '@kbn/presentation-util-plugin/public'
 import { OptionsListStrings } from './options_list_strings';
 import { OptionsListPopover } from './options_list_popover';
 import { optionsListReducers } from '../options_list_reducers';
-import { OptionsListReduxState } from '../types';
+import { MAX_OPTIONS_LIST_REQUEST_SIZE, OptionsListReduxState } from '../types';
 
 import './options_list.scss';
 
-export const OptionsListControl = ({ typeaheadSubject }: { typeaheadSubject: Subject<string> }) => {
-  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
-
+export const OptionsListControl = ({
+  typeaheadSubject,
+  loadMoreSubject,
+}: {
+  typeaheadSubject: Subject<string>;
+  loadMoreSubject: Subject<number>;
+}) => {
   const resizeRef = useRef(null);
   const dimensions = useResizeObserver(resizeRef.current);
 
   // Redux embeddable Context
   const {
     useEmbeddableDispatch,
-    actions: { replaceSelection, setSearchString },
+    actions: { replaceSelection, setSearchString, setPopoverOpen },
     useEmbeddableSelector: select,
   } = useReduxEmbeddableContext<OptionsListReduxState, typeof optionsListReducers>();
   const dispatch = useEmbeddableDispatch();
@@ -38,6 +42,7 @@ export const OptionsListControl = ({ typeaheadSubject }: { typeaheadSubject: Sub
   // Select current state from Redux using multiple selectors to avoid rerenders.
   const invalidSelections = select((state) => state.componentState.invalidSelections);
   const validSelections = select((state) => state.componentState.validSelections);
+  const isPopoverOpen = select((state) => state.componentState.popoverOpen);
 
   const selectedOptions = select((state) => state.explicitInput.selectedOptions);
   const existsSelected = select((state) => state.explicitInput.existsSelected);
@@ -51,6 +56,12 @@ export const OptionsListControl = ({ typeaheadSubject }: { typeaheadSubject: Sub
 
   const loading = select((state) => state.output.loading);
 
+  useEffect(() => {
+    return () => {
+      dispatch(setPopoverOpen(false)); // on unmount, close the popover
+    };
+  }, [dispatch, setPopoverOpen]);
+
   // debounce loading state so loading doesn't flash when user types
   const [debouncedLoading, setDebouncedLoading] = useState(true);
   const debounceSetLoading = useMemo(
@@ -77,6 +88,13 @@ export const OptionsListControl = ({ typeaheadSubject }: { typeaheadSubject: Sub
     [typeaheadSubject, dispatch, setSearchString]
   );
 
+  const loadMoreSuggestions = useCallback(
+    (cardinality: number) => {
+      loadMoreSubject.next(Math.min(cardinality, MAX_OPTIONS_LIST_REQUEST_SIZE));
+    },
+    [loadMoreSubject]
+  );
+
   const { hasSelections, selectionDisplayNode, validSelectionsCount } = useMemo(() => {
     return {
       hasSelections: !isEmpty(validSelections) || !isEmpty(invalidSelections),
@@ -123,7 +141,7 @@ export const OptionsListControl = ({ typeaheadSubject }: { typeaheadSubject: Sub
           'optionsList--filterBtnPlaceholder': !hasSelections,
         })}
         data-test-subj={`optionsList-control-${id}`}
-        onClick={() => setIsPopoverOpen((openState) => !openState)}
+        onClick={() => dispatch(setPopoverOpen(!isPopoverOpen))}
         isSelected={isPopoverOpen}
         numActiveFilters={validSelectionsCount}
         hasActiveFilters={Boolean(validSelectionsCount)}
@@ -149,7 +167,7 @@ export const OptionsListControl = ({ typeaheadSubject }: { typeaheadSubject: Sub
         panelPaddingSize="none"
         anchorPosition="downCenter"
         className="optionsList__popoverOverride"
-        closePopover={() => setIsPopoverOpen(false)}
+        closePopover={() => dispatch(setPopoverOpen(false))}
         anchorClassName="optionsList__anchorOverride"
         aria-label={OptionsListStrings.popover.getAriaLabel(fieldName)}
       >
@@ -157,6 +175,7 @@ export const OptionsListControl = ({ typeaheadSubject }: { typeaheadSubject: Sub
           width={dimensions.width}
           isLoading={debouncedLoading}
           updateSearchString={updateSearchString}
+          loadMoreSuggestions={loadMoreSuggestions}
         />
       </EuiPopover>
     </EuiFilterGroup>
diff --git a/src/plugins/controls/public/options_list/components/options_list_popover.test.tsx b/src/plugins/controls/public/options_list/components/options_list_popover.test.tsx
index a8504aba372c8..4b40414974b67 100644
--- a/src/plugins/controls/public/options_list/components/options_list_popover.test.tsx
+++ b/src/plugins/controls/public/options_list/components/options_list_popover.test.tsx
@@ -11,11 +11,11 @@ import { ReactWrapper } from 'enzyme';
 
 import { mountWithIntl } from '@kbn/test-jest-helpers';
 import { findTestSubject } from '@elastic/eui/lib/test';
+import { FieldSpec } from '@kbn/data-views-plugin/common';
 
 import { OptionsListPopover, OptionsListPopoverProps } from './options_list_popover';
 import { OptionsListComponentState, OptionsListReduxState } from '../types';
 import { mockOptionsListReduxEmbeddableTools } from '../../../common/mocks';
-import { OptionsListField } from '../../../common/options_list/types';
 import { ControlOutput, OptionsListEmbeddableInput } from '../..';
 
 describe('Options list popover', () => {
@@ -23,6 +23,7 @@ describe('Options list popover', () => {
     width: 500,
     isLoading: false,
     updateSearchString: jest.fn(),
+    loadMoreSuggestions: jest.fn(),
   };
 
   interface MountOptions {
@@ -63,7 +64,7 @@ describe('Options list popover', () => {
     // the div cannot be smaller than 301 pixels wide
     popover = await mountComponent({ popoverProps: { width: 300 } });
     popoverDiv = findTestSubject(popover, 'optionsList-control-available-options');
-    expect(popoverDiv.getDOMNode().getAttribute('style')).toBe(null);
+    expect(popoverDiv.getDOMNode().getAttribute('style')).toBe('width: 100%; height: 100%;');
   });
 
   test('no available options', async () => {
@@ -237,7 +238,7 @@ describe('Options list popover', () => {
   test('when sorting suggestions, show both sorting types for keyword field', async () => {
     const popover = await mountComponent({
       componentState: {
-        field: { name: 'Test keyword field', type: 'keyword' } as OptionsListField,
+        field: { name: 'Test keyword field', type: 'keyword' } as FieldSpec,
       },
     });
     const sortButton = findTestSubject(popover, 'optionsListControl__sortingOptionsButton');
@@ -252,7 +253,7 @@ describe('Options list popover', () => {
     const popover = await mountComponent({
       explicitInput: { sort: { by: '_key', direction: 'asc' } },
       componentState: {
-        field: { name: 'Test keyword field', type: 'keyword' } as OptionsListField,
+        field: { name: 'Test keyword field', type: 'keyword' } as FieldSpec,
       },
     });
     const sortButton = findTestSubject(popover, 'optionsListControl__sortingOptionsButton');
@@ -270,7 +271,7 @@ describe('Options list popover', () => {
 
   test('when sorting suggestions, only show document count sorting for IP fields', async () => {
     const popover = await mountComponent({
-      componentState: { field: { name: 'Test IP field', type: 'ip' } as OptionsListField },
+      componentState: { field: { name: 'Test IP field', type: 'ip' } as FieldSpec },
     });
     const sortButton = findTestSubject(popover, 'optionsListControl__sortingOptionsButton');
     sortButton.simulate('click');
@@ -280,6 +281,25 @@ describe('Options list popover', () => {
     expect(optionsText).toEqual(['By document count - Checked option.']);
   });
 
+  test('ensure warning icon does not show up when testAllowExpensiveQueries = true/undefined', async () => {
+    const popover = await mountComponent({
+      componentState: { field: { name: 'Test keyword field', type: 'keyword' } as FieldSpec },
+    });
+    const warning = findTestSubject(popover, 'optionsList-allow-expensive-queries-warning');
+    expect(warning).toEqual({});
+  });
+
+  test('ensure warning icon shows up when testAllowExpensiveQueries = false', async () => {
+    const popover = await mountComponent({
+      componentState: {
+        field: { name: 'Test keyword field', type: 'keyword' } as FieldSpec,
+        allowExpensiveQueries: false,
+      },
+    });
+    const warning = findTestSubject(popover, 'optionsList-allow-expensive-queries-warning');
+    expect(warning.getDOMNode()).toBeInstanceOf(HTMLDivElement);
+  });
+
   describe('Test advanced settings', () => {
     const ensureComponentIsHidden = async ({
       explicitInput,
diff --git a/src/plugins/controls/public/options_list/components/options_list_popover.tsx b/src/plugins/controls/public/options_list/components/options_list_popover.tsx
index b5562c43f3be2..df5f3d00730d0 100644
--- a/src/plugins/controls/public/options_list/components/options_list_popover.tsx
+++ b/src/plugins/controls/public/options_list/components/options_list_popover.tsx
@@ -9,12 +9,12 @@
 import React, { useState } from 'react';
 import { isEmpty } from 'lodash';
 
-import { EuiPopoverTitle } from '@elastic/eui';
 import { useReduxEmbeddableContext } from '@kbn/presentation-util-plugin/public';
 
 import { OptionsListReduxState } from '../types';
 import { OptionsListStrings } from './options_list_strings';
 import { optionsListReducers } from '../options_list_reducers';
+import { OptionsListPopoverTitle } from './options_list_popover_title';
 import { OptionsListPopoverFooter } from './options_list_popover_footer';
 import { OptionsListPopoverActionBar } from './options_list_popover_action_bar';
 import { OptionsListPopoverSuggestions } from './options_list_popover_suggestions';
@@ -23,6 +23,7 @@ import { OptionsListPopoverInvalidSelections } from './options_list_popover_inva
 export interface OptionsListPopoverProps {
   width: number;
   isLoading: boolean;
+  loadMoreSuggestions: (cardinality: number) => void;
   updateSearchString: (newSearchString: string) => void;
 }
 
@@ -30,6 +31,7 @@ export const OptionsListPopover = ({
   width,
   isLoading,
   updateSearchString,
+  loadMoreSuggestions,
 }: OptionsListPopoverProps) => {
   // Redux embeddable container Context
   const { useEmbeddableSelector: select } = useReduxEmbeddableContext<
@@ -42,39 +44,45 @@ export const OptionsListPopover = ({
   const availableOptions = select((state) => state.componentState.availableOptions);
   const field = select((state) => state.componentState.field);
 
-  const hideExclude = select((state) => state.explicitInput.hideExclude);
   const hideActionBar = select((state) => state.explicitInput.hideActionBar);
+  const hideExclude = select((state) => state.explicitInput.hideExclude);
   const fieldName = select((state) => state.explicitInput.fieldName);
-  const title = select((state) => state.explicitInput.title);
   const id = select((state) => state.explicitInput.id);
 
   const [showOnlySelected, setShowOnlySelected] = useState(false);
 
   return (
-    <div
-      id={`control-popover-${id}`}
-      style={{ width, minWidth: 300 }}
-      data-test-subj={`optionsList-control-popover`}
-      aria-label={OptionsListStrings.popover.getAriaLabel(fieldName)}
-    >
-      <EuiPopoverTitle paddingSize="s">{title}</EuiPopoverTitle>
-      {field?.type !== 'boolean' && !hideActionBar && (
-        <OptionsListPopoverActionBar
-          showOnlySelected={showOnlySelected}
-          setShowOnlySelected={setShowOnlySelected}
-          updateSearchString={updateSearchString}
-        />
-      )}
+    <>
       <div
-        data-test-subj={`optionsList-control-available-options`}
-        data-option-count={isLoading ? 0 : Object.keys(availableOptions ?? {}).length}
+        id={`control-popover-${id}`}
+        style={{ width, minWidth: 300 }}
+        data-test-subj={`optionsList-control-popover`}
+        aria-label={OptionsListStrings.popover.getAriaLabel(fieldName)}
       >
-        <OptionsListPopoverSuggestions showOnlySelected={showOnlySelected} isLoading={isLoading} />
-        {!showOnlySelected && invalidSelections && !isEmpty(invalidSelections) && (
-          <OptionsListPopoverInvalidSelections />
+        <OptionsListPopoverTitle />
+
+        {field?.type !== 'boolean' && !hideActionBar && (
+          <OptionsListPopoverActionBar
+            showOnlySelected={showOnlySelected}
+            updateSearchString={updateSearchString}
+            setShowOnlySelected={setShowOnlySelected}
+          />
         )}
+        <div
+          data-test-subj={`optionsList-control-available-options`}
+          data-option-count={isLoading ? 0 : Object.keys(availableOptions ?? {}).length}
+          style={{ width: '100%', height: '100%' }}
+        >
+          <OptionsListPopoverSuggestions
+            loadMoreSuggestions={loadMoreSuggestions}
+            showOnlySelected={showOnlySelected}
+          />
+          {!showOnlySelected && invalidSelections && !isEmpty(invalidSelections) && (
+            <OptionsListPopoverInvalidSelections />
+          )}
+        </div>
+        {!hideExclude && <OptionsListPopoverFooter isLoading={isLoading} />}
       </div>
-      {!hideExclude && <OptionsListPopoverFooter />}
-    </div>
+    </>
   );
 };
diff --git a/src/plugins/controls/public/options_list/components/options_list_popover_action_bar.tsx b/src/plugins/controls/public/options_list/components/options_list_popover_action_bar.tsx
index 375a2a2058692..fc3c1cfdfd993 100644
--- a/src/plugins/controls/public/options_list/components/options_list_popover_action_bar.tsx
+++ b/src/plugins/controls/public/options_list/components/options_list_popover_action_bar.tsx
@@ -15,7 +15,7 @@ import {
   EuiFlexItem,
   EuiFormRow,
   EuiToolTip,
-  EuiBadge,
+  EuiText,
 } from '@elastic/eui';
 import { useReduxEmbeddableContext } from '@kbn/presentation-util-plugin/public';
 
@@ -26,8 +26,8 @@ import { OptionsListPopoverSortingButton } from './options_list_popover_sorting_
 
 interface OptionsListPopoverProps {
   showOnlySelected: boolean;
-  setShowOnlySelected: (value: boolean) => void;
   updateSearchString: (newSearchString: string) => void;
+  setShowOnlySelected: (value: boolean) => void;
 }
 
 export const OptionsListPopoverActionBar = ({
@@ -44,23 +44,17 @@ export const OptionsListPopoverActionBar = ({
   const dispatch = useEmbeddableDispatch();
 
   // Select current state from Redux using multiple selectors to avoid rerenders.
+  const allowExpensiveQueries = select((state) => state.componentState.allowExpensiveQueries);
   const invalidSelections = select((state) => state.componentState.invalidSelections);
-  const totalCardinality = select((state) => state.componentState.totalCardinality);
+  const totalCardinality = select((state) => state.componentState.totalCardinality) ?? 0;
   const searchString = select((state) => state.componentState.searchString);
-
   const hideSort = select((state) => state.explicitInput.hideSort);
 
   return (
     <div className="optionsList__actions">
       <EuiFormRow fullWidth>
-        <EuiFlexGroup
-          gutterSize="xs"
-          direction="row"
-          justifyContent="spaceBetween"
-          alignItems="center"
-          responsive={false}
-        >
-          <EuiFlexItem>
+        <EuiFlexGroup gutterSize="xs" alignItems="center" responsive={false}>
+          <EuiFlexItem grow={true}>
             <EuiFieldSearch
               isInvalid={!searchString.valid}
               compressed
@@ -69,71 +63,93 @@ export const OptionsListPopoverActionBar = ({
               onChange={(event) => updateSearchString(event.target.value)}
               value={searchString.value}
               data-test-subj="optionsList-control-search-input"
-              placeholder={
-                totalCardinality
-                  ? OptionsListStrings.popover.getTotalCardinalityPlaceholder(totalCardinality)
-                  : undefined
-              }
+              placeholder={OptionsListStrings.popover.getSearchPlaceholder()}
               autoFocus={true}
             />
           </EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            {(invalidSelections?.length ?? 0) > 0 && (
-              <EuiToolTip
-                content={OptionsListStrings.popover.getInvalidSelectionsTooltip(
-                  invalidSelections?.length ?? 0
-                )}
-              >
-                <EuiBadge className="optionsList__ignoredBadge" color="warning">
-                  {invalidSelections?.length}
-                </EuiBadge>
-              </EuiToolTip>
-            )}
-          </EuiFlexItem>
           {!hideSort && (
             <EuiFlexItem grow={false}>
               <OptionsListPopoverSortingButton showOnlySelected={showOnlySelected} />
             </EuiFlexItem>
           )}
-          <EuiFlexItem grow={false}>
-            <EuiToolTip
-              position="top"
-              content={
-                showOnlySelected
-                  ? OptionsListStrings.popover.getAllOptionsButtonTitle()
-                  : OptionsListStrings.popover.getSelectedOptionsButtonTitle()
-              }
-            >
-              <EuiButtonIcon
-                size="s"
-                iconType="list"
-                aria-pressed={showOnlySelected}
-                color={showOnlySelected ? 'primary' : 'text'}
-                display={showOnlySelected ? 'base' : 'empty'}
-                onClick={() => setShowOnlySelected(!showOnlySelected)}
-                data-test-subj="optionsList-control-show-only-selected"
-                aria-label={
-                  showOnlySelected
-                    ? OptionsListStrings.popover.getAllOptionsButtonTitle()
-                    : OptionsListStrings.popover.getSelectedOptionsButtonTitle()
-                }
-              />
-            </EuiToolTip>
-          </EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            <EuiToolTip
-              position="top"
-              content={OptionsListStrings.popover.getClearAllSelectionsButtonTitle()}
+        </EuiFlexGroup>
+      </EuiFormRow>
+      <EuiFormRow className="optionsList__actionsRow" fullWidth>
+        <EuiFlexGroup
+          justifyContent="spaceBetween"
+          alignItems="center"
+          gutterSize="s"
+          responsive={false}
+        >
+          {allowExpensiveQueries && (
+            <EuiFlexItem grow={false}>
+              <EuiText size="xs" color="subdued" data-test-subj="optionsList-cardinality-label">
+                {OptionsListStrings.popover.getCardinalityLabel(totalCardinality)}
+              </EuiText>
+            </EuiFlexItem>
+          )}
+          {invalidSelections && invalidSelections.length > 0 && (
+            <>
+              {allowExpensiveQueries && (
+                <EuiFlexItem grow={false}>
+                  <div className="optionsList__actionBarDivider" />
+                </EuiFlexItem>
+              )}
+              <EuiFlexItem grow={false}>
+                <EuiText size="xs" color="subdued">
+                  {OptionsListStrings.popover.getInvalidSelectionsLabel(invalidSelections.length)}
+                </EuiText>
+              </EuiFlexItem>
+            </>
+          )}
+          <EuiFlexItem grow={true}>
+            <EuiFlexGroup
+              gutterSize="xs"
+              alignItems="center"
+              justifyContent="flexEnd"
+              responsive={false}
             >
-              <EuiButtonIcon
-                size="s"
-                color="danger"
-                iconType="eraser"
-                onClick={() => dispatch(clearSelections({}))}
-                data-test-subj="optionsList-control-clear-all-selections"
-                aria-label={OptionsListStrings.popover.getClearAllSelectionsButtonTitle()}
-              />
-            </EuiToolTip>
+              <EuiFlexItem grow={false}>
+                <EuiToolTip
+                  position="top"
+                  content={
+                    showOnlySelected
+                      ? OptionsListStrings.popover.getAllOptionsButtonTitle()
+                      : OptionsListStrings.popover.getSelectedOptionsButtonTitle()
+                  }
+                >
+                  <EuiButtonIcon
+                    size="xs"
+                    iconType="list"
+                    aria-pressed={showOnlySelected}
+                    color={showOnlySelected ? 'primary' : 'text'}
+                    display={showOnlySelected ? 'base' : 'empty'}
+                    onClick={() => setShowOnlySelected(!showOnlySelected)}
+                    data-test-subj="optionsList-control-show-only-selected"
+                    aria-label={
+                      showOnlySelected
+                        ? OptionsListStrings.popover.getAllOptionsButtonTitle()
+                        : OptionsListStrings.popover.getSelectedOptionsButtonTitle()
+                    }
+                  />
+                </EuiToolTip>
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiToolTip
+                  position="top"
+                  content={OptionsListStrings.popover.getClearAllSelectionsButtonTitle()}
+                >
+                  <EuiButtonIcon
+                    size="xs"
+                    color="danger"
+                    iconType="eraser"
+                    onClick={() => dispatch(clearSelections({}))}
+                    data-test-subj="optionsList-control-clear-all-selections"
+                    aria-label={OptionsListStrings.popover.getClearAllSelectionsButtonTitle()}
+                  />
+                </EuiToolTip>
+              </EuiFlexItem>
+            </EuiFlexGroup>
           </EuiFlexItem>
         </EuiFlexGroup>
       </EuiFormRow>
diff --git a/src/plugins/controls/public/options_list/components/options_list_popover_footer.tsx b/src/plugins/controls/public/options_list/components/options_list_popover_footer.tsx
index 8a51a33a31ba0..d04e389f8ec99 100644
--- a/src/plugins/controls/public/options_list/components/options_list_popover_footer.tsx
+++ b/src/plugins/controls/public/options_list/components/options_list_popover_footer.tsx
@@ -7,7 +7,13 @@
  */
 
 import React from 'react';
-import { EuiPopoverFooter, EuiButtonGroup, useEuiBackgroundColor } from '@elastic/eui';
+import {
+  useEuiBackgroundColor,
+  useEuiPaddingSize,
+  EuiPopoverFooter,
+  EuiButtonGroup,
+  EuiProgress,
+} from '@elastic/eui';
 import { css } from '@emotion/react';
 import { useReduxEmbeddableContext } from '@kbn/presentation-util-plugin/public';
 
@@ -26,7 +32,7 @@ const aggregationToggleButtons = [
   },
 ];
 
-export const OptionsListPopoverFooter = () => {
+export const OptionsListPopoverFooter = ({ isLoading }: { isLoading: boolean }) => {
   // Redux embeddable container Context
   const {
     useEmbeddableDispatch,
@@ -41,19 +47,32 @@ export const OptionsListPopoverFooter = () => {
   return (
     <>
       <EuiPopoverFooter
-        paddingSize="s"
+        paddingSize="none"
         css={css`
           background-color: ${useEuiBackgroundColor('subdued')};
         `}
       >
-        <EuiButtonGroup
-          legend={OptionsListStrings.popover.getIncludeExcludeLegend()}
-          options={aggregationToggleButtons}
-          idSelected={exclude ? 'optionsList__excludeResults' : 'optionsList__includeResults'}
-          onChange={(optionId) => dispatch(setExclude(optionId === 'optionsList__excludeResults'))}
-          buttonSize="compressed"
-          data-test-subj="optionsList__includeExcludeButtonGroup"
-        />
+        {isLoading && (
+          <div style={{ position: 'absolute', width: '100%' }}>
+            <EuiProgress size="xs" color="accent" />
+          </div>
+        )}
+        <div
+          css={css`
+            padding: ${useEuiPaddingSize('s')};
+          `}
+        >
+          <EuiButtonGroup
+            legend={OptionsListStrings.popover.getIncludeExcludeLegend()}
+            options={aggregationToggleButtons}
+            idSelected={exclude ? 'optionsList__excludeResults' : 'optionsList__includeResults'}
+            onChange={(optionId) =>
+              dispatch(setExclude(optionId === 'optionsList__excludeResults'))
+            }
+            buttonSize="compressed"
+            data-test-subj="optionsList__includeExcludeButtonGroup"
+          />
+        </div>
       </EuiPopoverFooter>
     </>
   );
diff --git a/src/plugins/controls/public/options_list/components/options_list_popover_sorting_button.tsx b/src/plugins/controls/public/options_list/components/options_list_popover_sorting_button.tsx
index 91482e6f54668..9132fee3dc5dc 100644
--- a/src/plugins/controls/public/options_list/components/options_list_popover_sorting_button.tsx
+++ b/src/plugins/controls/public/options_list/components/options_list_popover_sorting_button.tsx
@@ -12,14 +12,14 @@ import {
   EuiButtonGroupOptionProps,
   EuiSelectableOption,
   EuiPopoverTitle,
+  EuiButtonEmpty,
   EuiButtonGroup,
-  EuiButtonIcon,
   EuiSelectable,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiToolTip,
   EuiPopover,
   Direction,
+  EuiToolTip,
 } from '@elastic/eui';
 import { useReduxEmbeddableContext } from '@kbn/presentation-util-plugin/public';
 
@@ -91,25 +91,32 @@ export const OptionsListPopoverSortingButton = ({
     }
   };
 
+  const SortButton = () => (
+    <EuiButtonEmpty
+      size="s"
+      color="text"
+      iconSide="right"
+      iconType="arrowDown"
+      disabled={showOnlySelected}
+      data-test-subj="optionsListControl__sortingOptionsButton"
+      onClick={() => setIsSortingPopoverOpen(!isSortingPopoverOpen)}
+      className="euiFilterGroup" // this gives the button a nice border
+      aria-label={OptionsListStrings.popover.getSortPopoverDescription()}
+    >
+      {OptionsListStrings.popover.getSortPopoverTitle()}
+    </EuiButtonEmpty>
+  );
+
   return (
     <EuiPopover
       button={
-        <EuiToolTip
-          position="top"
-          content={
-            showOnlySelected
-              ? OptionsListStrings.popover.getSortDisabledTooltip()
-              : OptionsListStrings.popover.getSortPopoverDescription()
-          }
-        >
-          <EuiButtonIcon
-            iconType="sortable"
-            disabled={showOnlySelected}
-            data-test-subj="optionsListControl__sortingOptionsButton"
-            onClick={() => setIsSortingPopoverOpen(!isSortingPopoverOpen)}
-            aria-label={OptionsListStrings.popover.getSortPopoverDescription()}
-          />
-        </EuiToolTip>
+        showOnlySelected ? (
+          <EuiToolTip position="top" content={OptionsListStrings.popover.getSortDisabledTooltip()}>
+            <SortButton />
+          </EuiToolTip>
+        ) : (
+          <SortButton />
+        )
       }
       panelPaddingSize="none"
       isOpen={isSortingPopoverOpen}
diff --git a/src/plugins/controls/public/options_list/components/options_list_popover_suggestions.tsx b/src/plugins/controls/public/options_list/components/options_list_popover_suggestions.tsx
index 8bd8e361e7081..fd0e7668c82fa 100644
--- a/src/plugins/controls/public/options_list/components/options_list_popover_suggestions.tsx
+++ b/src/plugins/controls/public/options_list/components/options_list_popover_suggestions.tsx
@@ -6,26 +6,27 @@
  * Side Public License, v 1.
  */
 
-import React, { useEffect, useMemo, useState } from 'react';
+import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
-import { EuiLoadingSpinner, EuiSelectable, EuiSpacer } from '@elastic/eui';
+import { euiThemeVars } from '@kbn/ui-theme';
+import { EuiSelectable } from '@elastic/eui';
 import { useReduxEmbeddableContext } from '@kbn/presentation-util-plugin/public';
 import { EuiSelectableOption } from '@elastic/eui/src/components/selectable/selectable_option';
 
-import { OptionsListReduxState } from '../types';
 import { OptionsListStrings } from './options_list_strings';
 import { optionsListReducers } from '../options_list_reducers';
+import { MAX_OPTIONS_LIST_REQUEST_SIZE, OptionsListReduxState } from '../types';
 import { OptionsListPopoverEmptyMessage } from './options_list_popover_empty_message';
 import { OptionsListPopoverSuggestionBadge } from './options_list_popover_suggestion_badge';
 
 interface OptionsListPopoverSuggestionsProps {
-  isLoading: boolean;
   showOnlySelected: boolean;
+  loadMoreSuggestions: (cardinality: number) => void;
 }
 
 export const OptionsListPopoverSuggestions = ({
-  isLoading,
   showOnlySelected,
+  loadMoreSuggestions,
 }: OptionsListPopoverSuggestionsProps) => {
   // Redux embeddable container Context
   const {
@@ -38,12 +39,27 @@ export const OptionsListPopoverSuggestions = ({
   // Select current state from Redux using multiple selectors to avoid rerenders.
   const invalidSelections = select((state) => state.componentState.invalidSelections);
   const availableOptions = select((state) => state.componentState.availableOptions);
+  const totalCardinality = select((state) => state.componentState.totalCardinality);
+  const searchString = select((state) => state.componentState.searchString);
 
   const selectedOptions = select((state) => state.explicitInput.selectedOptions);
   const existsSelected = select((state) => state.explicitInput.existsSelected);
   const singleSelect = select((state) => state.explicitInput.singleSelect);
   const hideExists = select((state) => state.explicitInput.hideExists);
+  const isLoading = select((state) => state.output.loading) ?? false;
   const fieldName = select((state) => state.explicitInput.fieldName);
+  const sort = select((state) => state.explicitInput.sort);
+
+  const listRef = useRef<HTMLDivElement>(null);
+
+  const canLoadMoreSuggestions = useMemo(
+    () =>
+      totalCardinality
+        ? Object.keys(availableOptions ?? {}).length <
+          Math.min(totalCardinality, MAX_OPTIONS_LIST_REQUEST_SIZE)
+        : false,
+    [availableOptions, totalCardinality]
+  );
 
   // track selectedOptions and invalidSelections in sets for more efficient lookup
   const selectedOptionsSet = useMemo(() => new Set<string>(selectedOptions), [selectedOptions]);
@@ -51,7 +67,6 @@ export const OptionsListPopoverSuggestions = ({
     () => new Set<string>(invalidSelections),
     [invalidSelections]
   );
-
   const suggestions = useMemo(() => {
     return showOnlySelected ? selectedOptions : Object.keys(availableOptions ?? {});
   }, [availableOptions, selectedOptions, showOnlySelected]);
@@ -87,10 +102,23 @@ export const OptionsListPopoverSuggestions = ({
           ) : undefined,
       };
     });
-    const suggestionsSelectableOptions = existsSelectableOption
-      ? [existsSelectableOption, ...options]
-      : options;
-    setSelectableOptions(suggestionsSelectableOptions);
+
+    if (canLoadMoreSuggestions) {
+      options.push({
+        key: 'loading-option',
+        className: 'optionslist--loadingMoreGroupLabel',
+        label: OptionsListStrings.popover.getLoadingMoreMessage(),
+        isGroupLabel: true,
+      });
+    } else if (options.length === MAX_OPTIONS_LIST_REQUEST_SIZE) {
+      options.push({
+        key: 'no-more-option',
+        className: 'optionslist--endOfOptionsGroupLabel',
+        label: OptionsListStrings.popover.getAtEndOfOptionsMessage(),
+        isGroupLabel: true,
+      });
+    }
+    setSelectableOptions(existsSelectableOption ? [existsSelectableOption, ...options] : options);
   }, [
     suggestions,
     availableOptions,
@@ -98,42 +126,66 @@ export const OptionsListPopoverSuggestions = ({
     selectedOptionsSet,
     invalidSelectionsSet,
     existsSelectableOption,
+    canLoadMoreSuggestions,
   ]);
 
+  const loadMoreOptions = useCallback(() => {
+    const listbox = listRef.current?.querySelector('.euiSelectableList__list');
+    if (!listbox) return;
+
+    const { scrollTop, scrollHeight, clientHeight } = listbox;
+    if (scrollTop + clientHeight >= scrollHeight - parseInt(euiThemeVars.euiSizeXXL, 10)) {
+      // reached the "bottom" of the list, where euiSizeXXL acts as a "margin of error" so that the user doesn't
+      // have to scroll **all the way** to the bottom in order to load more options
+      loadMoreSuggestions(totalCardinality ?? MAX_OPTIONS_LIST_REQUEST_SIZE);
+    }
+  }, [loadMoreSuggestions, totalCardinality]);
+
+  useEffect(() => {
+    const container = listRef.current;
+    if (!isLoading && canLoadMoreSuggestions) {
+      container?.addEventListener('scroll', loadMoreOptions, true);
+      return () => {
+        container?.removeEventListener('scroll', loadMoreOptions, true);
+      };
+    }
+  }, [loadMoreOptions, isLoading, canLoadMoreSuggestions]);
+
+  useEffect(() => {
+    // scroll back to the top when changing the sorting or the search string
+    const listbox = listRef.current?.querySelector('.euiSelectableList__list');
+    listbox?.scrollTo({ top: 0 });
+  }, [sort, searchString]);
+
   return (
-    <EuiSelectable
-      isLoading={isLoading}
-      loadingMessage={
-        <span data-test-subj="optionsList-control-popover-loading">
-          <EuiLoadingSpinner size="m" />
-          <EuiSpacer size="xs" />
-          {OptionsListStrings.popover.getLoadingMessage()}
-        </span>
-      }
-      options={selectableOptions}
-      listProps={{ onFocusBadge: false }}
-      aria-label={OptionsListStrings.popover.getSuggestionsAriaLabel(
-        fieldName,
-        selectableOptions.length
-      )}
-      emptyMessage={<OptionsListPopoverEmptyMessage showOnlySelected={showOnlySelected} />}
-      onChange={(newSuggestions, _, changedOption) => {
-        setSelectableOptions(newSuggestions);
-
-        const key = changedOption.key ?? changedOption.label;
-        // the order of these checks matters, so be careful if rearranging them
-        if (key === 'exists-option') {
-          dispatch(selectExists(!Boolean(existsSelected)));
-        } else if (showOnlySelected || selectedOptionsSet.has(key)) {
-          dispatch(deselectOption(key));
-        } else if (singleSelect) {
-          dispatch(replaceSelection(key));
-        } else {
-          dispatch(selectOption(key));
-        }
-      }}
-    >
-      {(list) => list}
-    </EuiSelectable>
+    <>
+      <div ref={listRef}>
+        <EuiSelectable
+          options={selectableOptions}
+          listProps={{ onFocusBadge: false }}
+          aria-label={OptionsListStrings.popover.getSuggestionsAriaLabel(
+            fieldName,
+            selectableOptions.length
+          )}
+          emptyMessage={<OptionsListPopoverEmptyMessage showOnlySelected={showOnlySelected} />}
+          onChange={(newSuggestions, _, changedOption) => {
+            const key = changedOption.key ?? changedOption.label;
+            setSelectableOptions(newSuggestions);
+            // the order of these checks matters, so be careful if rearranging them
+            if (key === 'exists-option') {
+              dispatch(selectExists(!Boolean(existsSelected)));
+            } else if (showOnlySelected || selectedOptionsSet.has(key)) {
+              dispatch(deselectOption(key));
+            } else if (singleSelect) {
+              dispatch(replaceSelection(key));
+            } else {
+              dispatch(selectOption(key));
+            }
+          }}
+        >
+          {(list) => list}
+        </EuiSelectable>
+      </div>
+    </>
   );
 };
diff --git a/src/plugins/controls/public/options_list/components/options_list_popover_title.tsx b/src/plugins/controls/public/options_list/components/options_list_popover_title.tsx
new file mode 100644
index 0000000000000..40361260e56c0
--- /dev/null
+++ b/src/plugins/controls/public/options_list/components/options_list_popover_title.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+
+import { EuiFlexGroup, EuiFlexItem, EuiPopoverTitle, EuiIconTip } from '@elastic/eui';
+import { useReduxEmbeddableContext } from '@kbn/presentation-util-plugin/public';
+
+import { OptionsListReduxState } from '../types';
+import { OptionsListStrings } from './options_list_strings';
+import { optionsListReducers } from '../options_list_reducers';
+
+export const OptionsListPopoverTitle = () => {
+  // Redux embeddable container Context
+  const { useEmbeddableSelector: select } = useReduxEmbeddableContext<
+    OptionsListReduxState,
+    typeof optionsListReducers
+  >();
+
+  // Select current state from Redux using multiple selectors to avoid rerenders.
+  const allowExpensiveQueries = select((state) => state.componentState.allowExpensiveQueries);
+  const title = select((state) => state.explicitInput.title);
+
+  return (
+    <EuiPopoverTitle paddingSize="s">
+      <EuiFlexGroup gutterSize="xs" alignItems="center">
+        <EuiFlexItem grow={false}>{title}</EuiFlexItem>
+        {!allowExpensiveQueries && (
+          <EuiFlexItem data-test-subj="optionsList-allow-expensive-queries-warning" grow={false}>
+            <EuiIconTip
+              aria-label="Warning"
+              type="alert"
+              color="warning"
+              content={OptionsListStrings.popover.getAllowExpensiveQueriesWarning()}
+            />
+          </EuiFlexItem>
+        )}
+      </EuiFlexGroup>
+    </EuiPopoverTitle>
+  );
+};
diff --git a/src/plugins/controls/public/options_list/components/options_list_strings.ts b/src/plugins/controls/public/options_list/components/options_list_strings.ts
index bef8a2cbc26ff..f67676103a92d 100644
--- a/src/plugins/controls/public/options_list/components/options_list_strings.ts
+++ b/src/plugins/controls/public/options_list/components/options_list_strings.ts
@@ -54,9 +54,19 @@ export const OptionsListStrings = {
           'Available {optionCount, plural, one {option} other {options}} for {fieldName}',
         values: { fieldName, optionCount },
       }),
-    getLoadingMessage: () =>
-      i18n.translate('controls.optionsList.popover.loading', {
-        defaultMessage: 'Loading options',
+    getAllowExpensiveQueriesWarning: () =>
+      i18n.translate('controls.optionsList.popover.allowExpensiveQueriesWarning', {
+        defaultMessage:
+          'The cluster setting to allow expensive queries is off, so some features are disabled.',
+      }),
+    getLoadingMoreMessage: () =>
+      i18n.translate('controls.optionsList.popover.loadingMore', {
+        defaultMessage: 'Loading more options...',
+      }),
+    getAtEndOfOptionsMessage: () =>
+      i18n.translate('controls.optionsList.popover.endOfOptions', {
+        defaultMessage:
+          'The top 1,000 available options are displayed. View more options by searching for the name.',
       }),
     getEmptyMessage: () =>
       i18n.translate('controls.optionsList.popover.empty', {
@@ -78,10 +88,14 @@ export const OptionsListStrings = {
       i18n.translate('controls.optionsList.popover.clearAllSelectionsTitle', {
         defaultMessage: 'Clear selections',
       }),
-    getTotalCardinalityPlaceholder: (totalOptions: number) =>
-      i18n.translate('controls.optionsList.popover.cardinalityPlaceholder', {
+    getSearchPlaceholder: () =>
+      i18n.translate('controls.optionsList.popover.searchPlaceholder', {
+        defaultMessage: 'Search',
+      }),
+    getCardinalityLabel: (totalOptions: number) =>
+      i18n.translate('controls.optionsList.popover.cardinalityLabel', {
         defaultMessage:
-          'Search {totalOptions} available {totalOptions, plural, one {option} other {options}}',
+          '{totalOptions, number} {totalOptions, plural, one {option} other {options}}',
         values: { totalOptions },
       }),
     getInvalidSelectionsSectionAriaLabel: (fieldName: string, invalidSelectionCount: number) =>
@@ -96,10 +110,10 @@ export const OptionsListStrings = {
           'Ignored {invalidSelectionCount, plural, one {selection} other {selections}}',
         values: { invalidSelectionCount },
       }),
-    getInvalidSelectionsTooltip: (selectedOptions: number) =>
-      i18n.translate('controls.optionsList.popover.invalidSelectionsTooltip', {
+    getInvalidSelectionsLabel: (selectedOptions: number) =>
+      i18n.translate('controls.optionsList.popover.invalidSelectionsLabel', {
         defaultMessage:
-          '{selectedOptions} selected {selectedOptions, plural, one {option} other {options}} {selectedOptions, plural, one {is} other {are}} ignored because {selectedOptions, plural, one {it is} other {they are}} no longer in the data.',
+          '{selectedOptions} {selectedOptions, plural, one {selection} other {selections}} ignored',
         values: { selectedOptions },
       }),
     getInvalidSelectionScreenReaderText: () =>
diff --git a/src/plugins/controls/public/options_list/embeddable/options_list_embeddable.tsx b/src/plugins/controls/public/options_list/embeddable/options_list_embeddable.tsx
index 8d8fb505b5cdd..2a7f7e116c40f 100644
--- a/src/plugins/controls/public/options_list/embeddable/options_list_embeddable.tsx
+++ b/src/plugins/controls/public/options_list/embeddable/options_list_embeddable.tsx
@@ -24,11 +24,11 @@ import {
   buildExistsFilter,
 } from '@kbn/es-query';
 import { ReduxEmbeddableTools, ReduxEmbeddablePackage } from '@kbn/presentation-util-plugin/public';
-import { DataView } from '@kbn/data-views-plugin/public';
+import { DataView, FieldSpec } from '@kbn/data-views-plugin/public';
 import { Embeddable, IContainer } from '@kbn/embeddable-plugin/public';
 import { KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
 
-import { OptionsListReduxState } from '../types';
+import { MIN_OPTIONS_LIST_REQUEST_SIZE, OptionsListReduxState } from '../types';
 import { pluginServices } from '../../services';
 import {
   ControlInput,
@@ -40,7 +40,6 @@ import { getDefaultComponentState, optionsListReducers } from '../options_list_r
 import { OptionsListControl } from '../components/options_list_control';
 import { ControlsDataViewsService } from '../../services/data_views/types';
 import { ControlsOptionsListService } from '../../services/options_list/types';
-import { OptionsListField } from '../../../common/options_list/types';
 
 const diffDataFetchProps = (
   last?: OptionsListDataFetchProps,
@@ -76,9 +75,10 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
 
   // Internal data fetching state for this input control.
   private typeaheadSubject: Subject<string> = new Subject<string>();
+  private loadMoreSubject: Subject<number> = new Subject<number>();
   private abortController?: AbortController;
   private dataView?: DataView;
-  private field?: OptionsListField;
+  private field?: FieldSpec;
 
   private reduxEmbeddableTools: ReduxEmbeddableTools<
     OptionsListReduxState,
@@ -98,6 +98,7 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
       pluginServices.getServices());
 
     this.typeaheadSubject = new Subject<string>();
+    this.loadMoreSubject = new Subject<number>();
 
     // build redux embeddable tools
     this.reduxEmbeddableTools = reduxEmbeddablePackage.createTools<
@@ -115,6 +116,13 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
   private initialize = async () => {
     const { selectedOptions: initialSelectedOptions } = this.getInput();
     if (!initialSelectedOptions) this.setInitializationFinished();
+
+    const {
+      actions: { setAllowExpensiveQueries },
+      dispatch,
+    } = this.reduxEmbeddableTools;
+    dispatch(setAllowExpensiveQueries(await this.optionsListService.getAllowExpensiveQueries()));
+
     this.runOptionsListQuery().then(async () => {
       if (initialSelectedOptions) {
         await this.buildFilter();
@@ -144,12 +152,21 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
 
     // debounce typeahead pipe to slow down search string related queries
     const typeaheadPipe = this.typeaheadSubject.pipe(debounceTime(100));
+    const loadMorePipe = this.loadMoreSubject.pipe(debounceTime(100));
 
     // fetch available options when input changes or when search string has changed
     this.subscriptions.add(
       merge(dataFetchPipe, typeaheadPipe)
         .pipe(skip(1)) // Skip the first input update because options list query will be run by initialize.
-        .subscribe(this.runOptionsListQuery)
+        .subscribe(() => {
+          this.runOptionsListQuery();
+        })
+    );
+    // fetch more options when reaching the bottom of the available options
+    this.subscriptions.add(
+      loadMorePipe.subscribe((size) => {
+        this.runOptionsListQuery(size);
+      })
     );
 
     /**
@@ -203,7 +220,7 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
 
   private getCurrentDataViewAndField = async (): Promise<{
     dataView?: DataView;
-    field?: OptionsListField;
+    field?: FieldSpec;
   }> => {
     const {
       dispatch,
@@ -212,7 +229,7 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
     } = this.reduxEmbeddableTools;
 
     const {
-      explicitInput: { dataViewId, fieldName, parentFieldName, childFieldName },
+      explicitInput: { dataViewId, fieldName },
     } = getState();
 
     if (!this.dataView || this.dataView.id !== dataViewId) {
@@ -244,21 +261,7 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
           );
         }
 
-        // pair up keyword / text fields for case insensitive search
-        const childField =
-          (childFieldName && this.dataView.getFieldByName(childFieldName)) || undefined;
-        const parentField =
-          (parentFieldName && this.dataView.getFieldByName(parentFieldName)) || undefined;
-        const textFieldName = childField?.esTypes?.includes('text')
-          ? childField.name
-          : parentField?.esTypes?.includes('text')
-          ? parentField.name
-          : undefined;
-
-        const optionsListField: OptionsListField = originalField.toSpec();
-        optionsListField.textFieldName = textFieldName;
-
-        this.field = optionsListField;
+        this.field = originalField.toSpec();
       } catch (e) {
         this.onFatalError(e);
       }
@@ -268,13 +271,12 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
     return { dataView: this.dataView, field: this.field! };
   };
 
-  private runOptionsListQuery = async () => {
+  private runOptionsListQuery = async (size: number = MIN_OPTIONS_LIST_REQUEST_SIZE) => {
     const {
       dispatch,
       getState,
       actions: { setLoading, publishFilters, setSearchString, updateQueryResults },
     } = this.reduxEmbeddableTools;
-
     const previousFieldName = this.field?.name;
     const { dataView, field } = await this.getCurrentDataViewAndField();
     if (!dataView || !field) return;
@@ -284,7 +286,7 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
     }
 
     const {
-      componentState: { searchString },
+      componentState: { searchString, allowExpensiveQueries },
       explicitInput: { selectedOptions, runPastTimeout, existsSelected, sort },
     } = getState();
     dispatch(setLoading(true));
@@ -307,27 +309,34 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
               mode: 'absolute' as 'absolute',
             }
           : globalTimeRange;
-      const { suggestions, invalidSelections, totalCardinality, rejected } =
-        await this.optionsListService.runOptionsListRequest(
-          {
-            sort,
-            field,
-            query,
-            filters,
-            dataView,
-            timeRange,
-            searchString: searchString.value,
-            runPastTimeout,
-            selectedOptions,
-          },
-          this.abortController.signal
-        );
-      if (rejected) {
-        // This prevents a rejected request (which can happen, for example, when a user types a search string too quickly)
-        // from prematurely setting loading to `false` and updating the suggestions to show "No results"
+
+      const response = await this.optionsListService.runOptionsListRequest(
+        {
+          sort,
+          size,
+          field,
+          query,
+          filters,
+          dataView,
+          timeRange,
+          runPastTimeout,
+          selectedOptions,
+          allowExpensiveQueries,
+          searchString: searchString.value,
+        },
+        this.abortController.signal
+      );
+      if (this.optionsListService.optionsListResponseWasFailure(response)) {
+        if (response.error === 'aborted') {
+          // This prevents an aborted request (which can happen, for example, when a user types a search string too quickly)
+          // from prematurely setting loading to `false` and updating the suggestions to show "No results"
+          return;
+        }
+        this.onFatalError(response.error);
         return;
       }
 
+      const { suggestions, invalidSelections, totalCardinality } = response;
       if (
         (!selectedOptions && !existsSelected) ||
         isEmpty(invalidSelections) ||
@@ -411,11 +420,24 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
     this.runOptionsListQuery();
   };
 
+  public onFatalError = (e: Error) => {
+    const {
+      dispatch,
+      actions: { setPopoverOpen, setLoading },
+    } = this.reduxEmbeddableTools;
+    batch(() => {
+      dispatch(setLoading(false));
+      dispatch(setPopoverOpen(false));
+    });
+    super.onFatalError(e);
+  };
+
   public destroy = () => {
     super.destroy();
     this.abortController?.abort();
     this.subscriptions.unsubscribe();
     this.reduxEmbeddableTools.cleanup();
+    if (this.node) ReactDOM.unmountComponentAtNode(this.node);
   };
 
   public render = (node: HTMLElement) => {
@@ -427,7 +449,10 @@ export class OptionsListEmbeddable extends Embeddable<OptionsListEmbeddableInput
     ReactDOM.render(
       <KibanaThemeProvider theme$={pluginServices.getServices().theme.theme$}>
         <OptionsListReduxWrapper>
-          <OptionsListControl typeaheadSubject={this.typeaheadSubject} />
+          <OptionsListControl
+            typeaheadSubject={this.typeaheadSubject}
+            loadMoreSubject={this.loadMoreSubject}
+          />
         </OptionsListReduxWrapper>
       </KibanaThemeProvider>,
       node
diff --git a/src/plugins/controls/public/options_list/options_list_reducers.ts b/src/plugins/controls/public/options_list/options_list_reducers.ts
index e2d7388c7f81e..f50ab9bd6f7f7 100644
--- a/src/plugins/controls/public/options_list/options_list_reducers.ts
+++ b/src/plugins/controls/public/options_list/options_list_reducers.ts
@@ -9,9 +9,9 @@ import { PayloadAction } from '@reduxjs/toolkit';
 import { WritableDraft } from 'immer/dist/types/types-external';
 
 import { Filter } from '@kbn/es-query';
+import { FieldSpec } from '@kbn/data-views-plugin/common';
 
 import { OptionsListReduxState, OptionsListComponentState } from './types';
-import { OptionsListField } from '../../common/options_list/types';
 import { getIpRangeQuery } from '../../common/options_list/ip_search';
 import {
   OPTIONS_LIST_DEFAULT_SORT,
@@ -19,6 +19,8 @@ import {
 } from '../../common/options_list/suggestions_sorting';
 
 export const getDefaultComponentState = (): OptionsListReduxState['componentState'] => ({
+  popoverOpen: false,
+  allowExpensiveQueries: true,
   searchString: { value: '', valid: true },
 });
 
@@ -41,6 +43,15 @@ export const optionsListReducers = {
       state.componentState.searchString.valid = getIpRangeQuery(action.payload).validSearch;
     }
   },
+  setAllowExpensiveQueries: (
+    state: WritableDraft<OptionsListReduxState>,
+    action: PayloadAction<boolean>
+  ) => {
+    state.componentState.allowExpensiveQueries = action.payload;
+  },
+  setPopoverOpen: (state: WritableDraft<OptionsListReduxState>, action: PayloadAction<boolean>) => {
+    state.componentState.popoverOpen = action.payload;
+  },
   setSort: (
     state: WritableDraft<OptionsListReduxState>,
     action: PayloadAction<Partial<OptionsListSortingType>>
@@ -97,7 +108,7 @@ export const optionsListReducers = {
   },
   setField: (
     state: WritableDraft<OptionsListReduxState>,
-    action: PayloadAction<OptionsListField | undefined>
+    action: PayloadAction<FieldSpec | undefined>
   ) => {
     state.componentState.field = action.payload;
   },
@@ -110,7 +121,10 @@ export const optionsListReducers = {
       >
     >
   ) => {
-    state.componentState = { ...(state.componentState ?? {}), ...action.payload };
+    state.componentState = {
+      ...(state.componentState ?? {}),
+      ...action.payload,
+    };
   },
   publishFilters: (
     state: WritableDraft<OptionsListReduxState>,
diff --git a/src/plugins/controls/public/options_list/types.ts b/src/plugins/controls/public/options_list/types.ts
index ae825132b6f80..c0501b0b6f38b 100644
--- a/src/plugins/controls/public/options_list/types.ts
+++ b/src/plugins/controls/public/options_list/types.ts
@@ -7,13 +7,17 @@
  */
 
 import { ReduxEmbeddableState } from '@kbn/presentation-util-plugin/public';
+import { FieldSpec } from '@kbn/data-views-plugin/common';
+
 import { ControlOutput } from '../types';
 import {
-  OptionsListField,
   OptionsListSuggestions,
   OptionsListEmbeddableInput,
 } from '../../common/options_list/types';
 
+export const MIN_OPTIONS_LIST_REQUEST_SIZE = 10;
+export const MAX_OPTIONS_LIST_REQUEST_SIZE = 1000;
+
 interface SearchString {
   value: string;
   valid: boolean;
@@ -21,12 +25,14 @@ interface SearchString {
 
 // Component state is only used by public components.
 export interface OptionsListComponentState {
-  field?: OptionsListField;
-  totalCardinality?: number;
   availableOptions?: OptionsListSuggestions;
+  allowExpensiveQueries: boolean;
   invalidSelections?: string[];
-  validSelections?: string[];
   searchString: SearchString;
+  validSelections?: string[];
+  totalCardinality?: number;
+  popoverOpen: boolean;
+  field?: FieldSpec;
 }
 
 // public only - redux embeddable state type
diff --git a/src/plugins/controls/public/services/http/http.stub.ts b/src/plugins/controls/public/services/http/http.stub.ts
index d3362491ee71d..54fee10ce533e 100644
--- a/src/plugins/controls/public/services/http/http.stub.ts
+++ b/src/plugins/controls/public/services/http/http.stub.ts
@@ -13,5 +13,6 @@ import { ControlsHTTPService } from './types';
 type HttpServiceFactory = PluginServiceFactory<ControlsHTTPService>;
 
 export const httpServiceFactory: HttpServiceFactory = () => ({
+  get: async () => ({} as unknown as HttpResponse),
   fetch: async () => ({} as unknown as HttpResponse),
 });
diff --git a/src/plugins/controls/public/services/http/http_service.ts b/src/plugins/controls/public/services/http/http_service.ts
index 88eca23e3c1d6..c48aed61b1c12 100644
--- a/src/plugins/controls/public/services/http/http_service.ts
+++ b/src/plugins/controls/public/services/http/http_service.ts
@@ -16,10 +16,11 @@ export type HttpServiceFactory = KibanaPluginServiceFactory<
 >;
 export const httpServiceFactory: HttpServiceFactory = ({ coreStart }) => {
   const {
-    http: { fetch },
+    http: { get, fetch },
   } = coreStart;
 
   return {
+    get,
     fetch,
   };
 };
diff --git a/src/plugins/controls/public/services/http/types.ts b/src/plugins/controls/public/services/http/types.ts
index ce75c4b75a3d0..ea92ce6c4a74f 100644
--- a/src/plugins/controls/public/services/http/types.ts
+++ b/src/plugins/controls/public/services/http/types.ts
@@ -9,5 +9,6 @@
 import { CoreSetup } from '@kbn/core/public';
 
 export interface ControlsHTTPService {
+  get: CoreSetup['http']['get'];
   fetch: CoreSetup['http']['fetch'];
 }
diff --git a/src/plugins/controls/public/services/options_list/options_list.story.ts b/src/plugins/controls/public/services/options_list/options_list.story.ts
index c641e9ee8834a..6d3305f97b9aa 100644
--- a/src/plugins/controls/public/services/options_list/options_list.story.ts
+++ b/src/plugins/controls/public/services/options_list/options_list.story.ts
@@ -20,14 +20,11 @@ let optionsListRequestMethod = async (request: OptionsListRequest, abortSignal:
         r({
           suggestions: {},
           totalCardinality: 100,
-          rejected: false,
         }),
       120
     )
   );
 
-const clearOptionsListCacheMock = () => {};
-
 export const replaceOptionsListMethod = (
   newMethod: (request: OptionsListRequest, abortSignal: AbortSignal) => Promise<OptionsListResponse>
 ) => (optionsListRequestMethod = newMethod);
@@ -35,6 +32,12 @@ export const replaceOptionsListMethod = (
 export const optionsListServiceFactory: OptionsListServiceFactory = () => {
   return {
     runOptionsListRequest: optionsListRequestMethod,
-    clearOptionsListCache: clearOptionsListCacheMock,
+    clearOptionsListCache: jest.fn(),
+    getAllowExpensiveQueries: jest.fn().mockReturnValue(Promise.resolve(true)),
+    optionsListResponseWasFailure: jest
+      .fn()
+      .mockReturnValue(
+        false
+      ) as unknown as ControlsOptionsListService['optionsListResponseWasFailure'],
   };
 };
diff --git a/src/plugins/controls/public/services/options_list/options_list_service.ts b/src/plugins/controls/public/services/options_list/options_list_service.ts
index 888d2e2efb837..7152d190c997d 100644
--- a/src/plugins/controls/public/services/options_list/options_list_service.ts
+++ b/src/plugins/controls/public/services/options_list/options_list_service.ts
@@ -16,7 +16,7 @@ import {
   OptionsListRequest,
   OptionsListResponse,
   OptionsListRequestBody,
-  OptionsListField,
+  OptionsListFailureResponse,
 } from '../../../common/options_list/types';
 import { ControlsHTTPService } from '../http/types';
 import { ControlsDataService } from '../data/types';
@@ -38,6 +38,7 @@ class OptionsListService implements ControlsOptionsListService {
 
   private optionsListCacheResolver = (request: OptionsListRequest) => {
     const {
+      size,
       sort,
       query,
       filters,
@@ -59,6 +60,7 @@ class OptionsListService implements ControlsOptionsListService {
       dataViewTitle,
       searchString,
       fieldName,
+      size,
     ].join('|');
   };
 
@@ -90,18 +92,39 @@ class OptionsListService implements ControlsOptionsListService {
       filters: esFilters,
       fieldName: field.name,
       fieldSpec: field,
-      textFieldName: (field as OptionsListField).textFieldName,
       runtimeFieldMap: dataView.toSpec().runtimeFieldMap,
     };
   };
 
+  private cachedAllowExpensiveQueries = memoize(async () => {
+    const { allowExpensiveQueries } = await this.http.get<{
+      allowExpensiveQueries: boolean;
+    }>('/api/kibana/controls/optionsList/getClusterSettings');
+    return allowExpensiveQueries;
+  });
+
+  public getAllowExpensiveQueries = async (): Promise<boolean> => {
+    try {
+      return await this.cachedAllowExpensiveQueries();
+    } catch (error) {
+      return false;
+    }
+  };
+
+  public optionsListResponseWasFailure = (
+    response: OptionsListResponse
+  ): response is OptionsListFailureResponse => {
+    return (response as OptionsListFailureResponse).error !== undefined;
+  };
+
   public runOptionsListRequest = async (request: OptionsListRequest, abortSignal: AbortSignal) => {
     try {
       return await this.cachedOptionsListRequest(request, abortSignal);
-    } catch (error) {
+    } catch (error: any) {
       // Remove rejected results from memoize cache
       this.cachedOptionsListRequest.cache.delete(this.optionsListCacheResolver(request));
-      return { rejected: true } as OptionsListResponse;
+      if (error.name === 'AbortError') return { error: 'aborted' } as OptionsListFailureResponse;
+      return { error } as OptionsListFailureResponse;
     }
   };
 
diff --git a/src/plugins/controls/public/services/options_list/types.ts b/src/plugins/controls/public/services/options_list/types.ts
index 569042b136419..c78819c27c5d5 100644
--- a/src/plugins/controls/public/services/options_list/types.ts
+++ b/src/plugins/controls/public/services/options_list/types.ts
@@ -6,13 +6,20 @@
  * Side Public License, v 1.
  */
 
-import { OptionsListRequest, OptionsListResponse } from '../../../common/options_list/types';
+import {
+  OptionsListFailureResponse,
+  OptionsListRequest,
+  OptionsListResponse,
+} from '../../../common/options_list/types';
 
 export interface ControlsOptionsListService {
   runOptionsListRequest: (
     request: OptionsListRequest,
     abortSignal: AbortSignal
   ) => Promise<OptionsListResponse>;
-
   clearOptionsListCache: () => void;
+  optionsListResponseWasFailure: (
+    response: OptionsListResponse
+  ) => response is OptionsListFailureResponse;
+  getAllowExpensiveQueries: () => Promise<boolean>;
 }
diff --git a/src/plugins/controls/public/types.ts b/src/plugins/controls/public/types.ts
index 59686af51cca6..17608ee7bef8d 100644
--- a/src/plugins/controls/public/types.ts
+++ b/src/plugins/controls/public/types.ts
@@ -63,8 +63,6 @@ export interface ControlEditorProps<T extends ControlInput = ControlInput> {
 
 export interface DataControlField {
   field: DataViewField;
-  parentFieldName?: string;
-  childFieldName?: string;
   compatibleControlTypes: string[];
 }
 
diff --git a/src/plugins/controls/server/options_list/options_list_queries.test.ts b/src/plugins/controls/server/options_list/options_list_cheap_suggestion_queries.test.ts
similarity index 57%
rename from src/plugins/controls/server/options_list/options_list_queries.test.ts
rename to src/plugins/controls/server/options_list/options_list_cheap_suggestion_queries.test.ts
index d3e5525a36d06..31783a1267aca 100644
--- a/src/plugins/controls/server/options_list/options_list_queries.test.ts
+++ b/src/plugins/controls/server/options_list/options_list_cheap_suggestion_queries.test.ts
@@ -9,13 +9,10 @@
 import { FieldSpec } from '@kbn/data-views-plugin/common';
 import { SearchResponse } from '@elastic/elasticsearch/lib/api/types';
 
-import {
-  getSuggestionAggregationBuilder,
-  getValidationAggregationBuilder,
-} from './options_list_queries';
+import { getCheapSuggestionAggregationBuilder } from './options_list_cheap_suggestion_queries';
 import { OptionsListRequestBody } from '../../common/options_list/types';
 
-describe('options list queries', () => {
+describe('options list cheap queries', () => {
   let rawSearchResponseMock: SearchResponse = {} as SearchResponse;
 
   beforeEach(() => {
@@ -37,146 +34,85 @@ describe('options list queries', () => {
     };
   });
 
-  describe('validation aggregation and parsing', () => {
-    test('creates validation aggregation when given selections', () => {
-      const validationAggBuilder = getValidationAggregationBuilder();
-      const optionsListRequestBodyMock: OptionsListRequestBody = {
-        fieldName: 'coolTestField',
-        selectedOptions: ['coolOption1', 'coolOption2', 'coolOption3'],
-      };
-      expect(validationAggBuilder.buildAggregation(optionsListRequestBodyMock))
-        .toMatchInlineSnapshot(`
-        Object {
-          "filters": Object {
-            "filters": Object {
-              "coolOption1": Object {
-                "match": Object {
-                  "coolTestField": "coolOption1",
-                },
-              },
-              "coolOption2": Object {
-                "match": Object {
-                  "coolTestField": "coolOption2",
-                },
-              },
-              "coolOption3": Object {
-                "match": Object {
-                  "coolTestField": "coolOption3",
-                },
-              },
-            },
-          },
-        }
-      `);
-    });
-
-    test('returns undefined when not given selections', () => {
-      const validationAggBuilder = getValidationAggregationBuilder();
-      const optionsListRequestBodyMock: OptionsListRequestBody = {
-        fieldName: 'coolTestField',
-      };
-      expect(validationAggBuilder.buildAggregation(optionsListRequestBodyMock)).toBeUndefined();
-    });
-
-    test('parses validation result', () => {
-      const validationAggBuilder = getValidationAggregationBuilder();
-      rawSearchResponseMock.aggregations = {
-        validation: {
-          buckets: {
-            cool1: { doc_count: 0 },
-            cool2: { doc_count: 15 },
-            cool3: { doc_count: 0 },
-            cool4: { doc_count: 2 },
-            cool5: { doc_count: 112 },
-            cool6: { doc_count: 0 },
-          },
-        },
-      };
-      expect(validationAggBuilder.parse(rawSearchResponseMock)).toMatchInlineSnapshot(`
-        Array [
-          "cool1",
-          "cool3",
-          "cool6",
-        ]
-      `);
-    });
-  });
-
   describe('suggestion aggregation', () => {
-    describe('text / keyword field', () => {
-      test('with a search string, creates case insensitive aggregation', () => {
+    describe('keyword or text+keyword field', () => {
+      test('without a search string, creates keyword aggregation', () => {
         const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          allowExpensiveQueries: false,
           fieldName: 'coolTestField.keyword',
-          textFieldName: 'coolTestField',
-          searchString: 'cooool',
+          sort: { by: '_count', direction: 'asc' },
           fieldSpec: { aggregatable: true } as unknown as FieldSpec,
         };
-        const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+        const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
         expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
           .toMatchInlineSnapshot(`
           Object {
-            "aggs": Object {
-              "keywordSuggestions": Object {
-                "terms": Object {
-                  "field": "coolTestField.keyword",
-                  "order": Object {
-                    "_count": "desc",
-                  },
-                  "shard_size": 10,
+            "suggestions": Object {
+              "terms": Object {
+                "field": "coolTestField.keyword",
+                "include": ".*",
+                "order": Object {
+                  "_count": "asc",
                 },
-              },
-            },
-            "filter": Object {
-              "match_phrase_prefix": Object {
-                "coolTestField": "cooool",
+                "shard_size": 10,
               },
             },
           }
         `);
       });
 
-      test('without a search string, creates keyword aggregation', () => {
+      test('with a search string, creates case sensitive keyword aggregation', () => {
         const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          searchString: 'cooool',
+          allowExpensiveQueries: false,
           fieldName: 'coolTestField.keyword',
-          textFieldName: 'coolTestField',
           fieldSpec: { aggregatable: true } as unknown as FieldSpec,
-          sort: { by: '_count', direction: 'asc' },
         };
-        const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+        const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
         expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
           .toMatchInlineSnapshot(`
-          Object {
-            "terms": Object {
-              "execution_hint": "map",
-              "field": "coolTestField.keyword",
-              "include": ".*",
-              "order": Object {
-                "_count": "asc",
+            Object {
+              "suggestions": Object {
+                "terms": Object {
+                  "field": "coolTestField.keyword",
+                  "include": "cooool.*",
+                  "order": Object {
+                    "_count": "desc",
+                  },
+                  "shard_size": 10,
+                },
               },
-              "shard_size": 10,
-            },
-          }
-        `);
+            }
+          `);
       });
     });
 
     test('creates boolean aggregation for boolean field', () => {
       const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
         fieldName: 'coolean',
-        fieldSpec: { type: 'boolean' } as unknown as FieldSpec,
+        allowExpensiveQueries: false,
         sort: { by: '_key', direction: 'desc' },
+        fieldSpec: { type: 'boolean' } as unknown as FieldSpec,
       };
-      const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+      const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(optionsListRequestBodyMock);
       expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
         .toMatchInlineSnapshot(`
         Object {
-          "terms": Object {
-            "execution_hint": "map",
-            "field": "coolean",
-            "order": Object {
-              "_key": "desc",
+          "suggestions": Object {
+            "terms": Object {
+              "field": "coolean",
+              "order": Object {
+                "_key": "desc",
+              },
+              "shard_size": 10,
             },
-            "shard_size": 10,
           },
         }
       `);
@@ -184,53 +120,33 @@ describe('options list queries', () => {
 
     test('creates nested aggregation for nested field', () => {
       const optionsListRequestBodyMock: OptionsListRequestBody = {
-        fieldName: 'coolNestedField',
+        size: 10,
         searchString: 'cooool',
-        fieldSpec: { subType: { nested: { path: 'path.to.nested' } } } as unknown as FieldSpec,
+        allowExpensiveQueries: false,
+        fieldName: 'coolNestedField',
         sort: { by: '_key', direction: 'asc' },
+        fieldSpec: { subType: { nested: { path: 'path.to.nested' } } } as unknown as FieldSpec,
       };
-      const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+      const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(optionsListRequestBodyMock);
       expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
         .toMatchInlineSnapshot(`
         Object {
-          "aggs": Object {
-            "nestedSuggestions": Object {
-              "terms": Object {
-                "execution_hint": "map",
-                "field": "coolNestedField",
-                "include": "cooool.*",
-                "order": Object {
-                  "_key": "asc",
+          "nestedSuggestions": Object {
+            "aggs": Object {
+              "suggestions": Object {
+                "terms": Object {
+                  "field": "coolNestedField",
+                  "include": "cooool.*",
+                  "order": Object {
+                    "_key": "asc",
+                  },
+                  "shard_size": 10,
                 },
-                "shard_size": 10,
               },
             },
-          },
-          "nested": Object {
-            "path": "path.to.nested",
-          },
-        }
-      `);
-    });
-
-    test('creates keyword only aggregation', () => {
-      const optionsListRequestBodyMock: OptionsListRequestBody = {
-        fieldName: 'coolTestField.keyword',
-        searchString: 'cooool',
-        fieldSpec: { aggregatable: true } as unknown as FieldSpec,
-      };
-      const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
-      expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
-        .toMatchInlineSnapshot(`
-        Object {
-          "terms": Object {
-            "execution_hint": "map",
-            "field": "coolTestField.keyword",
-            "include": "cooool.*",
-            "order": Object {
-              "_count": "desc",
+            "nested": Object {
+              "path": "path.to.nested",
             },
-            "shard_size": 10,
           },
         }
       `);
@@ -239,36 +155,41 @@ describe('options list queries', () => {
     describe('IP field', () => {
       test('without a search string, creates IP range aggregation with default range', () => {
         const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
           fieldName: 'clientip',
-          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
+          allowExpensiveQueries: false,
           sort: { by: '_count', direction: 'asc' },
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
         };
-        const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+        const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
         expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
           .toMatchInlineSnapshot(`
           Object {
-            "aggs": Object {
-              "filteredSuggestions": Object {
-                "terms": Object {
-                  "execution_hint": "map",
-                  "field": "clientip",
-                  "order": Object {
-                    "_count": "asc",
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_count": "asc",
+                    },
+                    "shard_size": 10,
                   },
-                  "shard_size": 10,
                 },
               },
-            },
-            "ip_range": Object {
-              "field": "clientip",
-              "keyed": true,
-              "ranges": Array [
-                Object {
-                  "from": "::",
-                  "key": "ipv6",
-                  "to": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
-                },
-              ],
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "from": "::",
+                    "key": "ipv6",
+                    "to": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+                  },
+                ],
+              },
             },
           }
         `);
@@ -276,36 +197,41 @@ describe('options list queries', () => {
 
       test('full IPv4 in the search string, creates IP range aggregation with CIDR mask', () => {
         const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
           fieldName: 'clientip',
-          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
+          allowExpensiveQueries: false,
           searchString: '41.77.243.255',
           sort: { by: '_key', direction: 'desc' },
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
         };
-        const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+        const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
         expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
           .toMatchInlineSnapshot(`
           Object {
-            "aggs": Object {
-              "filteredSuggestions": Object {
-                "terms": Object {
-                  "execution_hint": "map",
-                  "field": "clientip",
-                  "order": Object {
-                    "_key": "desc",
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_key": "desc",
+                    },
+                    "shard_size": 10,
                   },
-                  "shard_size": 10,
                 },
               },
-            },
-            "ip_range": Object {
-              "field": "clientip",
-              "keyed": true,
-              "ranges": Array [
-                Object {
-                  "key": "ipv4",
-                  "mask": "41.77.243.255/32",
-                },
-              ],
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "key": "ipv4",
+                    "mask": "41.77.243.255/32",
+                  },
+                ],
+              },
             },
           }
         `);
@@ -313,36 +239,41 @@ describe('options list queries', () => {
 
       test('full IPv6 in the search string, creates IP range aggregation with CIDR mask', () => {
         const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
           fieldName: 'clientip',
+          allowExpensiveQueries: false,
+          sort: { by: '_key', direction: 'asc' },
           fieldSpec: { type: 'ip' } as unknown as FieldSpec,
           searchString: 'f688:fb50:6433:bba2:604:f2c:194a:d3c5',
-          sort: { by: '_key', direction: 'asc' },
         };
-        const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+        const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
         expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
           .toMatchInlineSnapshot(`
           Object {
-            "aggs": Object {
-              "filteredSuggestions": Object {
-                "terms": Object {
-                  "execution_hint": "map",
-                  "field": "clientip",
-                  "order": Object {
-                    "_key": "asc",
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_key": "asc",
+                    },
+                    "shard_size": 10,
                   },
-                  "shard_size": 10,
                 },
               },
-            },
-            "ip_range": Object {
-              "field": "clientip",
-              "keyed": true,
-              "ranges": Array [
-                Object {
-                  "key": "ipv6",
-                  "mask": "f688:fb50:6433:bba2:604:f2c:194a:d3c5/128",
-                },
-              ],
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "key": "ipv6",
+                    "mask": "f688:fb50:6433:bba2:604:f2c:194a:d3c5/128",
+                  },
+                ],
+              },
             },
           }
         `);
@@ -350,36 +281,41 @@ describe('options list queries', () => {
 
       test('partial IPv4 in the search string, creates IP range aggregation with min and max', () => {
         const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
           fieldName: 'clientip',
-          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
           searchString: '41.77',
+          allowExpensiveQueries: false,
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
         };
-        const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+        const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
         expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
           .toMatchInlineSnapshot(`
           Object {
-            "aggs": Object {
-              "filteredSuggestions": Object {
-                "terms": Object {
-                  "execution_hint": "map",
-                  "field": "clientip",
-                  "order": Object {
-                    "_count": "desc",
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_count": "desc",
+                    },
+                    "shard_size": 10,
                   },
-                  "shard_size": 10,
                 },
               },
-            },
-            "ip_range": Object {
-              "field": "clientip",
-              "keyed": true,
-              "ranges": Array [
-                Object {
-                  "from": "41.77.0.0",
-                  "key": "ipv4",
-                  "to": "41.77.255.255",
-                },
-              ],
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "from": "41.77.0.0",
+                    "key": "ipv4",
+                    "to": "41.77.255.255",
+                  },
+                ],
+              },
             },
           }
         `);
@@ -387,37 +323,42 @@ describe('options list queries', () => {
 
       test('partial IPv46 in the search string, creates IP range aggregation with min and max', () => {
         const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
           fieldName: 'clientip',
-          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
           searchString: 'cdb6:',
+          allowExpensiveQueries: false,
           sort: { by: '_count', direction: 'desc' },
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
         };
-        const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+        const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
         expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
           .toMatchInlineSnapshot(`
           Object {
-            "aggs": Object {
-              "filteredSuggestions": Object {
-                "terms": Object {
-                  "execution_hint": "map",
-                  "field": "clientip",
-                  "order": Object {
-                    "_count": "desc",
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_count": "desc",
+                    },
+                    "shard_size": 10,
                   },
-                  "shard_size": 10,
                 },
               },
-            },
-            "ip_range": Object {
-              "field": "clientip",
-              "keyed": true,
-              "ranges": Array [
-                Object {
-                  "from": "cdb6::",
-                  "key": "ipv6",
-                  "to": "cdb6:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
-                },
-              ],
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "from": "cdb6::",
+                    "key": "ipv6",
+                    "to": "cdb6:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+                  },
+                ],
+              },
             },
           }
         `);
@@ -428,24 +369,25 @@ describe('options list queries', () => {
   describe('suggestion parsing', () => {
     test('parses keyword / text result', () => {
       const optionsListRequestBodyMock: OptionsListRequestBody = {
-        fieldName: 'coolTestField.keyword',
-        textFieldName: 'coolTestField',
+        size: 10,
         searchString: 'cooool',
+        allowExpensiveQueries: false,
+        fieldName: 'coolTestField.keyword',
         fieldSpec: { aggregatable: true } as unknown as FieldSpec,
       };
-      const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+      const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(optionsListRequestBodyMock);
       rawSearchResponseMock.aggregations = {
         suggestions: {
-          keywordSuggestions: {
-            buckets: [
-              { doc_count: 5, key: 'cool1' },
-              { doc_count: 15, key: 'cool2' },
-              { doc_count: 10, key: 'cool3' },
-            ],
-          },
+          buckets: [
+            { doc_count: 5, key: 'cool1' },
+            { doc_count: 15, key: 'cool2' },
+            { doc_count: 10, key: 'cool3' },
+          ],
         },
       };
-      expect(suggestionAggBuilder.parse(rawSearchResponseMock)).toMatchInlineSnapshot(`
+      expect(
+        suggestionAggBuilder.parse(rawSearchResponseMock, optionsListRequestBodyMock).suggestions
+      ).toMatchInlineSnapshot(`
         Object {
           "cool1": Object {
             "doc_count": 5,
@@ -462,10 +404,12 @@ describe('options list queries', () => {
 
     test('parses boolean result', () => {
       const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
         fieldName: 'coolean',
+        allowExpensiveQueries: false,
         fieldSpec: { type: 'boolean' } as unknown as FieldSpec,
       };
-      const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+      const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(optionsListRequestBodyMock);
       rawSearchResponseMock.aggregations = {
         suggestions: {
           buckets: [
@@ -474,7 +418,9 @@ describe('options list queries', () => {
           ],
         },
       };
-      expect(suggestionAggBuilder.parse(rawSearchResponseMock)).toMatchInlineSnapshot(`
+      expect(
+        suggestionAggBuilder.parse(rawSearchResponseMock, optionsListRequestBodyMock).suggestions
+      ).toMatchInlineSnapshot(`
         Object {
           "false": Object {
             "doc_count": 55,
@@ -488,14 +434,16 @@ describe('options list queries', () => {
 
     test('parses nested result', () => {
       const optionsListRequestBodyMock: OptionsListRequestBody = {
-        fieldName: 'coolNestedField',
+        size: 10,
         searchString: 'cooool',
+        fieldName: 'coolNestedField',
+        allowExpensiveQueries: false,
         fieldSpec: { subType: { nested: { path: 'path.to.nested' } } } as unknown as FieldSpec,
       };
-      const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+      const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(optionsListRequestBodyMock);
       rawSearchResponseMock.aggregations = {
-        suggestions: {
-          nestedSuggestions: {
+        nestedSuggestions: {
+          suggestions: {
             buckets: [
               { doc_count: 5, key: 'cool1' },
               { doc_count: 15, key: 'cool2' },
@@ -504,7 +452,9 @@ describe('options list queries', () => {
           },
         },
       };
-      expect(suggestionAggBuilder.parse(rawSearchResponseMock)).toMatchInlineSnapshot(`
+      expect(
+        suggestionAggBuilder.parse(rawSearchResponseMock, optionsListRequestBodyMock).suggestions
+      ).toMatchInlineSnapshot(`
         Object {
           "cool1": Object {
             "doc_count": 5,
@@ -521,11 +471,13 @@ describe('options list queries', () => {
 
     test('parses keyword only result', () => {
       const optionsListRequestBodyMock: OptionsListRequestBody = {
-        fieldName: 'coolTestField.keyword',
+        size: 10,
         searchString: 'cooool',
+        allowExpensiveQueries: false,
+        fieldName: 'coolTestField.keyword',
         fieldSpec: { aggregatable: true } as unknown as FieldSpec,
       };
-      const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+      const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(optionsListRequestBodyMock);
       rawSearchResponseMock.aggregations = {
         suggestions: {
           buckets: [
@@ -535,7 +487,9 @@ describe('options list queries', () => {
           ],
         },
       };
-      expect(suggestionAggBuilder.parse(rawSearchResponseMock)).toMatchInlineSnapshot(`
+      expect(
+        suggestionAggBuilder.parse(rawSearchResponseMock, optionsListRequestBodyMock).suggestions
+      ).toMatchInlineSnapshot(`
         Object {
           "cool1": Object {
             "doc_count": 5,
@@ -553,10 +507,12 @@ describe('options list queries', () => {
 
   test('parses mixed IPv4 and IPv6 result', () => {
     const optionsListRequestBodyMock: OptionsListRequestBody = {
+      size: 10,
       fieldName: 'clientip',
+      allowExpensiveQueries: false,
       fieldSpec: { type: 'ip' } as unknown as FieldSpec,
     };
-    const suggestionAggBuilder = getSuggestionAggregationBuilder(optionsListRequestBodyMock);
+    const suggestionAggBuilder = getCheapSuggestionAggregationBuilder(optionsListRequestBodyMock);
     rawSearchResponseMock.aggregations = {
       suggestions: {
         buckets: {
@@ -592,7 +548,10 @@ describe('options list queries', () => {
       },
     };
 
-    const parsed = suggestionAggBuilder.parse(rawSearchResponseMock);
+    const parsed = suggestionAggBuilder.parse(
+      rawSearchResponseMock,
+      optionsListRequestBodyMock
+    ).suggestions;
     /** first, verify that the sorting worked as expected */
     expect(Object.keys(parsed)).toMatchInlineSnapshot(`
       Array [
diff --git a/src/plugins/controls/server/options_list/options_list_cheap_suggestion_queries.ts b/src/plugins/controls/server/options_list/options_list_cheap_suggestion_queries.ts
new file mode 100644
index 0000000000000..3a302cf62d04b
--- /dev/null
+++ b/src/plugins/controls/server/options_list/options_list_cheap_suggestion_queries.ts
@@ -0,0 +1,201 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { get } from 'lodash';
+import { getFieldSubtypeNested } from '@kbn/data-views-plugin/common';
+
+import { OptionsListRequestBody, OptionsListSuggestions } from '../../common/options_list/types';
+import { getIpRangeQuery, type IpRangeQuery } from '../../common/options_list/ip_search';
+import { EsBucket, OptionsListSuggestionAggregationBuilder } from './types';
+import {
+  getEscapedQuery,
+  getIpBuckets,
+  getSortType,
+} from './options_list_suggestion_query_helpers';
+
+/**
+ * Suggestion aggregations
+ */
+export const getCheapSuggestionAggregationBuilder = ({ fieldSpec }: OptionsListRequestBody) => {
+  if (fieldSpec?.type === 'boolean') {
+    return cheapSuggestionAggSubtypes.boolean;
+  }
+  if (fieldSpec?.type === 'ip') {
+    return cheapSuggestionAggSubtypes.ip;
+  }
+  if (fieldSpec && getFieldSubtypeNested(fieldSpec)) {
+    return cheapSuggestionAggSubtypes.subtypeNested;
+  }
+  return cheapSuggestionAggSubtypes.keywordOrText;
+};
+
+const cheapSuggestionAggSubtypes: { [key: string]: OptionsListSuggestionAggregationBuilder } = {
+  /**
+   * The "textOrKeyword" query / parser should be used whenever the field is built on some type non-nested string field
+   * (such as a keyword field or a keyword+text multi-field)
+   */
+  keywordOrText: {
+    buildAggregation: ({ fieldName, searchString, sort }: OptionsListRequestBody) => ({
+      suggestions: {
+        terms: {
+          field: fieldName,
+          include: `${getEscapedQuery(searchString)}.*`,
+          shard_size: 10,
+          order: getSortType(sort),
+        },
+      },
+    }),
+    parse: (rawEsResult) => ({
+      suggestions: get(rawEsResult, 'aggregations.suggestions.buckets').reduce(
+        (suggestions: OptionsListSuggestions, suggestion: EsBucket) => {
+          return { ...suggestions, [suggestion.key]: { doc_count: suggestion.doc_count } };
+        },
+        {}
+      ),
+    }),
+  },
+
+  /**
+   * the "Boolean" query / parser should be used when the options list is built on a field of type boolean. The query is slightly different than a keyword query.
+   */
+  boolean: {
+    buildAggregation: ({ fieldName, sort }: OptionsListRequestBody) => ({
+      suggestions: {
+        terms: {
+          field: fieldName,
+          shard_size: 10,
+          order: getSortType(sort),
+        },
+      },
+    }),
+    parse: (rawEsResult) => ({
+      suggestions: get(rawEsResult, 'aggregations.suggestions.buckets')?.reduce(
+        (suggestions: OptionsListSuggestions, suggestion: EsBucket & { key_as_string: string }) => {
+          return {
+            ...suggestions,
+            [suggestion.key_as_string]: { doc_count: suggestion.doc_count },
+          };
+        },
+        {}
+      ),
+    }),
+  },
+
+  /**
+   * the "IP" query / parser should be used when the options list is built on a field of type IP.
+   */
+  ip: {
+    buildAggregation: ({ fieldName, searchString, sort }: OptionsListRequestBody) => {
+      let ipRangeQuery: IpRangeQuery = {
+        validSearch: true,
+        rangeQuery: [
+          {
+            key: 'ipv6',
+            from: '::',
+            to: 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
+          },
+        ],
+      };
+
+      if (searchString) {
+        ipRangeQuery = getIpRangeQuery(searchString);
+        if (!ipRangeQuery.validSearch) {
+          // ideally should be prevented on the client side but, if somehow an invalid search gets through to the server,
+          // simply don't return an aggregation query for the ES search request
+          return undefined;
+        }
+      }
+
+      return {
+        suggestions: {
+          ip_range: {
+            field: fieldName,
+            ranges: ipRangeQuery.rangeQuery,
+            keyed: true,
+          },
+          aggs: {
+            filteredSuggestions: {
+              terms: {
+                field: fieldName,
+                shard_size: 10,
+                order: getSortType(sort),
+              },
+            },
+          },
+        },
+      };
+    },
+    parse: (rawEsResult, { sort }) => {
+      if (!Boolean(rawEsResult.aggregations?.suggestions)) {
+        // if this is happens, that means there is an invalid search that snuck through to the server side code;
+        // so, might as well early return with no suggestions
+        return { suggestions: {} };
+      }
+
+      const buckets: EsBucket[] = [];
+      getIpBuckets(rawEsResult, buckets, 'ipv4'); // modifies buckets array directly, i.e. "by reference"
+      getIpBuckets(rawEsResult, buckets, 'ipv6');
+
+      const sortedSuggestions =
+        sort?.direction === 'asc'
+          ? buckets.sort(
+              (bucketA: EsBucket, bucketB: EsBucket) => bucketA.doc_count - bucketB.doc_count
+            )
+          : buckets.sort(
+              (bucketA: EsBucket, bucketB: EsBucket) => bucketB.doc_count - bucketA.doc_count
+            );
+
+      return {
+        suggestions: sortedSuggestions
+          .slice(0, 10) // only return top 10 results
+          .reduce((suggestions, suggestion: EsBucket) => {
+            return { ...suggestions, [suggestion.key]: { doc_count: suggestion.doc_count } };
+          }, {}),
+      };
+    },
+  },
+
+  /**
+   * the "Subtype Nested" query / parser should be used when the options list is built on a field with subtype nested.
+   */
+  subtypeNested: {
+    buildAggregation: (req: OptionsListRequestBody) => {
+      const { fieldSpec, fieldName, searchString, sort } = req;
+      const subTypeNested = fieldSpec && getFieldSubtypeNested(fieldSpec);
+      if (!subTypeNested) {
+        // if this field is not subtype nested, fall back to keywordOnly
+        return cheapSuggestionAggSubtypes.keywordOnly.buildAggregation(req);
+      }
+      return {
+        nestedSuggestions: {
+          nested: {
+            path: subTypeNested.nested.path,
+          },
+          aggs: {
+            suggestions: {
+              terms: {
+                field: fieldName,
+                include: `${getEscapedQuery(searchString)}.*`,
+                shard_size: 10,
+                order: getSortType(sort),
+              },
+            },
+          },
+        },
+      };
+    },
+    parse: (rawEsResult) => ({
+      suggestions: get(rawEsResult, 'aggregations.nestedSuggestions.suggestions.buckets').reduce(
+        (suggestions: OptionsListSuggestions, suggestion: EsBucket) => {
+          return { ...suggestions, [suggestion.key]: { doc_count: suggestion.doc_count } };
+        },
+        {}
+      ),
+    }),
+  },
+};
diff --git a/src/plugins/controls/server/options_list/options_list_cluster_settings_route.ts b/src/plugins/controls/server/options_list/options_list_cluster_settings_route.ts
new file mode 100644
index 0000000000000..3da1585405305
--- /dev/null
+++ b/src/plugins/controls/server/options_list/options_list_cluster_settings_route.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { getKbnServerError, reportServerError } from '@kbn/kibana-utils-plugin/server';
+import { CoreSetup } from '@kbn/core/server';
+
+export const setupOptionsListClusterSettingsRoute = ({ http }: CoreSetup) => {
+  const router = http.createRouter();
+  router.get(
+    {
+      path: '/api/kibana/controls/optionsList/getClusterSettings',
+      validate: false,
+    },
+    async (context, _, response) => {
+      try {
+        const esClient = (await context.core).elasticsearch.client.asCurrentUser;
+        const settings = await esClient.cluster.getSettings({
+          include_defaults: true,
+          filter_path: '**.allow_expensive_queries',
+        });
+
+        // priority: transient -> persistent -> default
+        const allowExpensiveQueries: string =
+          settings.transient?.search?.allow_expensive_queries ??
+          settings.persistent?.search?.allow_expensive_queries ??
+          settings.defaults?.search?.allow_expensive_queries ??
+          // by default, the allowExpensiveQueries cluster setting is undefined; so, we need to treat this the same
+          // as `true` since that's the way other applications (such as the dashboard listing page) handle this.
+          'true';
+
+        return response.ok({
+          body: {
+            allowExpensiveQueries: allowExpensiveQueries === 'true',
+          },
+        });
+      } catch (e) {
+        const kbnErr = getKbnServerError(e);
+        return reportServerError(response, kbnErr);
+      }
+    }
+  );
+};
diff --git a/src/plugins/controls/server/options_list/options_list_expensive_suggestion_queries.test.ts b/src/plugins/controls/server/options_list/options_list_expensive_suggestion_queries.test.ts
new file mode 100644
index 0000000000000..7026359e10ee4
--- /dev/null
+++ b/src/plugins/controls/server/options_list/options_list_expensive_suggestion_queries.test.ts
@@ -0,0 +1,676 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { FieldSpec } from '@kbn/data-views-plugin/common';
+import { SearchResponse } from '@elastic/elasticsearch/lib/api/types';
+
+import { getExpensiveSuggestionAggregationBuilder } from './options_list_expensive_suggestion_queries';
+import { OptionsListRequestBody } from '../../common/options_list/types';
+
+describe('options list expensive queries', () => {
+  let rawSearchResponseMock: SearchResponse = {} as SearchResponse;
+
+  beforeEach(() => {
+    rawSearchResponseMock = {
+      hits: {
+        total: 10,
+        max_score: 10,
+        hits: [],
+      },
+      took: 10,
+      timed_out: false,
+      _shards: {
+        failed: 0,
+        successful: 1,
+        total: 1,
+        skipped: 0,
+      },
+      aggregations: {},
+    };
+  });
+
+  describe('suggestion aggregation', () => {
+    describe('string (keyword, text+keyword, or nested) field', () => {
+      test('test keyword field, without a search string', () => {
+        const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          allowExpensiveQueries: true,
+          fieldName: 'coolTestField.keyword',
+          sort: { by: '_key', direction: 'asc' },
+          fieldSpec: { aggregatable: true } as unknown as FieldSpec,
+        };
+        const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
+        expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+          .toMatchInlineSnapshot(`
+          Object {
+            "suggestions": Object {
+              "terms": Object {
+                "field": "coolTestField.keyword",
+                "order": Object {
+                  "_key": "asc",
+                },
+                "shard_size": 10,
+                "size": 10,
+              },
+            },
+            "unique_terms": Object {
+              "cardinality": Object {
+                "field": "coolTestField.keyword",
+              },
+            },
+          }
+        `);
+      });
+
+      test('test keyword field, with a search string', () => {
+        const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          searchString: 'cooool',
+          allowExpensiveQueries: true,
+          fieldName: 'coolTestField.keyword',
+          sort: { by: '_key', direction: 'desc' },
+          fieldSpec: { aggregatable: true } as unknown as FieldSpec,
+        };
+        const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
+        expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+          .toMatchInlineSnapshot(`
+          Object {
+            "filteredSuggestions": Object {
+              "aggs": Object {
+                "suggestions": Object {
+                  "terms": Object {
+                    "field": "coolTestField.keyword",
+                    "order": Object {
+                      "_key": "desc",
+                    },
+                    "shard_size": 10,
+                    "size": 10,
+                  },
+                },
+                "unique_terms": Object {
+                  "cardinality": Object {
+                    "field": "coolTestField.keyword",
+                  },
+                },
+              },
+              "filter": Object {
+                "prefix": Object {
+                  "coolTestField.keyword": Object {
+                    "case_insensitive": true,
+                    "value": "cooool",
+                  },
+                },
+              },
+            },
+          }
+        `);
+      });
+
+      test('test nested field, with a search string', () => {
+        const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          searchString: 'cooool',
+          allowExpensiveQueries: true,
+          fieldName: 'coolNestedField',
+          sort: { by: '_count', direction: 'asc' },
+          fieldSpec: { subType: { nested: { path: 'path.to.nested' } } } as unknown as FieldSpec,
+        };
+        const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
+        expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+          .toMatchInlineSnapshot(`
+          Object {
+            "nestedSuggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "aggs": Object {
+                    "suggestions": Object {
+                      "terms": Object {
+                        "field": "coolNestedField",
+                        "order": Object {
+                          "_count": "asc",
+                        },
+                        "shard_size": 10,
+                        "size": 10,
+                      },
+                    },
+                    "unique_terms": Object {
+                      "cardinality": Object {
+                        "field": "coolNestedField",
+                      },
+                    },
+                  },
+                  "filter": Object {
+                    "prefix": Object {
+                      "coolNestedField": Object {
+                        "case_insensitive": true,
+                        "value": "cooool",
+                      },
+                    },
+                  },
+                },
+              },
+              "nested": Object {
+                "path": "path.to.nested",
+              },
+            },
+          }
+          `);
+      });
+    });
+
+    test('boolean field', () => {
+      const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
+        fieldName: 'coolean',
+        allowExpensiveQueries: false,
+        sort: { by: '_key', direction: 'desc' },
+        fieldSpec: { type: 'boolean' } as unknown as FieldSpec,
+      };
+      const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+        optionsListRequestBodyMock
+      );
+      expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+        .toMatchInlineSnapshot(`
+        Object {
+          "suggestions": Object {
+            "terms": Object {
+              "field": "coolean",
+              "order": Object {
+                "_key": "desc",
+              },
+              "shard_size": 10,
+            },
+          },
+        }
+      `);
+    });
+
+    describe('IP field', () => {
+      test('without a search string, creates IP range aggregation with default range', () => {
+        const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          fieldName: 'clientip',
+          allowExpensiveQueries: true,
+          sort: { by: '_key', direction: 'asc' },
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
+        };
+        const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
+        expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+          .toMatchInlineSnapshot(`
+          Object {
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_key": "asc",
+                    },
+                    "shard_size": 10,
+                    "size": 10,
+                  },
+                },
+                "unique_terms": Object {
+                  "cardinality": Object {
+                    "field": "clientip",
+                  },
+                },
+              },
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "from": "::",
+                    "key": "ipv6",
+                    "to": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+                  },
+                ],
+              },
+            },
+          }
+        `);
+      });
+
+      test('full IPv4 in the search string, creates IP range aggregation with CIDR mask', () => {
+        const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          fieldName: 'clientip',
+          allowExpensiveQueries: true,
+          searchString: '41.77.243.255',
+          sort: { by: '_count', direction: 'asc' },
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
+        };
+        const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
+        expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+          .toMatchInlineSnapshot(`
+          Object {
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_count": "asc",
+                    },
+                    "shard_size": 10,
+                    "size": 10,
+                  },
+                },
+                "unique_terms": Object {
+                  "cardinality": Object {
+                    "field": "clientip",
+                  },
+                },
+              },
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "key": "ipv4",
+                    "mask": "41.77.243.255/32",
+                  },
+                ],
+              },
+            },
+          }
+        `);
+      });
+
+      test('full IPv6 in the search string, creates IP range aggregation with CIDR mask', () => {
+        const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          fieldName: 'clientip',
+          allowExpensiveQueries: true,
+          sort: { by: '_key', direction: 'asc' },
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
+          searchString: 'f688:fb50:6433:bba2:604:f2c:194a:d3c5',
+        };
+        const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
+        expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+          .toMatchInlineSnapshot(`
+          Object {
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_key": "asc",
+                    },
+                    "shard_size": 10,
+                    "size": 10,
+                  },
+                },
+                "unique_terms": Object {
+                  "cardinality": Object {
+                    "field": "clientip",
+                  },
+                },
+              },
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "key": "ipv6",
+                    "mask": "f688:fb50:6433:bba2:604:f2c:194a:d3c5/128",
+                  },
+                ],
+              },
+            },
+          }
+        `);
+      });
+
+      test('partial IPv4 in the search string, creates IP range aggregation with min and max', () => {
+        const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          fieldName: 'clientip',
+          searchString: '41.77',
+          allowExpensiveQueries: true,
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
+        };
+        const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
+        expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+          .toMatchInlineSnapshot(`
+          Object {
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_count": "desc",
+                    },
+                    "shard_size": 10,
+                    "size": 10,
+                  },
+                },
+                "unique_terms": Object {
+                  "cardinality": Object {
+                    "field": "clientip",
+                  },
+                },
+              },
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "from": "41.77.0.0",
+                    "key": "ipv4",
+                    "to": "41.77.255.255",
+                  },
+                ],
+              },
+            },
+          }
+        `);
+      });
+
+      test('partial IPv46 in the search string, creates IP range aggregation with min and max', () => {
+        const optionsListRequestBodyMock: OptionsListRequestBody = {
+          size: 10,
+          fieldName: 'clientip',
+          searchString: 'cdb6:',
+          allowExpensiveQueries: true,
+          sort: { by: '_count', direction: 'desc' },
+          fieldSpec: { type: 'ip' } as unknown as FieldSpec,
+        };
+        const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+          optionsListRequestBodyMock
+        );
+        expect(suggestionAggBuilder.buildAggregation(optionsListRequestBodyMock))
+          .toMatchInlineSnapshot(`
+          Object {
+            "suggestions": Object {
+              "aggs": Object {
+                "filteredSuggestions": Object {
+                  "terms": Object {
+                    "field": "clientip",
+                    "order": Object {
+                      "_count": "desc",
+                    },
+                    "shard_size": 10,
+                    "size": 10,
+                  },
+                },
+                "unique_terms": Object {
+                  "cardinality": Object {
+                    "field": "clientip",
+                  },
+                },
+              },
+              "ip_range": Object {
+                "field": "clientip",
+                "keyed": true,
+                "ranges": Array [
+                  Object {
+                    "from": "cdb6::",
+                    "key": "ipv6",
+                    "to": "cdb6:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+                  },
+                ],
+              },
+            },
+          }
+        `);
+      });
+    });
+  });
+
+  describe('suggestion parsing', () => {
+    test('parses string (keyword, text+keyword, or nested) result', () => {
+      const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
+        allowExpensiveQueries: true,
+        fieldName: 'coolTestField.keyword',
+        fieldSpec: { aggregatable: true } as unknown as FieldSpec,
+      };
+      const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+        optionsListRequestBodyMock
+      );
+      rawSearchResponseMock.aggregations = {
+        suggestions: {
+          buckets: [
+            { doc_count: 5, key: 'cool1' },
+            { doc_count: 15, key: 'cool2' },
+            { doc_count: 10, key: 'cool3' },
+          ],
+        },
+        unique_terms: {
+          value: 3,
+        },
+      };
+      expect(suggestionAggBuilder.parse(rawSearchResponseMock, optionsListRequestBodyMock))
+        .toMatchInlineSnapshot(`
+        Object {
+          "suggestions": Object {
+            "cool1": Object {
+              "doc_count": 5,
+            },
+            "cool2": Object {
+              "doc_count": 15,
+            },
+            "cool3": Object {
+              "doc_count": 10,
+            },
+          },
+          "totalCardinality": 3,
+        }
+      `);
+    });
+
+    test('parses boolean result', () => {
+      const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
+        fieldName: 'coolean',
+        allowExpensiveQueries: true,
+        fieldSpec: { type: 'boolean' } as unknown as FieldSpec,
+      };
+      const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+        optionsListRequestBodyMock
+      );
+      rawSearchResponseMock.aggregations = {
+        suggestions: {
+          buckets: [
+            { doc_count: 55, key_as_string: 'false' },
+            { doc_count: 155, key_as_string: 'true' },
+          ],
+        },
+      };
+      expect(suggestionAggBuilder.parse(rawSearchResponseMock, optionsListRequestBodyMock))
+        .toMatchInlineSnapshot(`
+        Object {
+          "suggestions": Object {
+            "false": Object {
+              "doc_count": 55,
+            },
+            "true": Object {
+              "doc_count": 155,
+            },
+          },
+          "totalCardinality": 2,
+        }
+      `);
+    });
+
+    test('parses nested result', () => {
+      const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
+        searchString: 'co',
+        fieldName: 'coolNestedField',
+        allowExpensiveQueries: true,
+        fieldSpec: { subType: { nested: { path: 'path.to.nested' } } } as unknown as FieldSpec,
+      };
+      const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+        optionsListRequestBodyMock
+      );
+      rawSearchResponseMock.aggregations = {
+        nestedSuggestions: {
+          filteredSuggestions: {
+            suggestions: {
+              buckets: [
+                { doc_count: 5, key: 'cool1' },
+                { doc_count: 15, key: 'cool2' },
+                { doc_count: 10, key: 'cool3' },
+              ],
+            },
+            unique_terms: {
+              value: 3,
+            },
+          },
+        },
+      };
+      expect(suggestionAggBuilder.parse(rawSearchResponseMock, optionsListRequestBodyMock))
+        .toMatchInlineSnapshot(`
+        Object {
+          "suggestions": Object {
+            "cool1": Object {
+              "doc_count": 5,
+            },
+            "cool2": Object {
+              "doc_count": 15,
+            },
+            "cool3": Object {
+              "doc_count": 10,
+            },
+          },
+          "totalCardinality": 3,
+        }
+      `);
+    });
+
+    test('parses mixed IPv4 and IPv6 result', () => {
+      const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
+        fieldName: 'clientip',
+        allowExpensiveQueries: true,
+        fieldSpec: { type: 'ip' } as unknown as FieldSpec,
+      };
+      const suggestionAggBuilder = getExpensiveSuggestionAggregationBuilder(
+        optionsListRequestBodyMock
+      );
+      rawSearchResponseMock.aggregations = {
+        suggestions: {
+          buckets: {
+            ipv4: {
+              from: '0.0.0.0',
+              to: '255.255.255.255',
+              filteredSuggestions: {
+                buckets: [
+                  { doc_count: 8, key: '21.35.91.62' },
+                  { doc_count: 8, key: '21.35.91.61' },
+                  { doc_count: 11, key: '111.52.174.2' },
+                  { doc_count: 1, key: '56.73.58.63' },
+                  { doc_count: 9, key: '23.216.241.120' },
+                  { doc_count: 10, key: '196.162.13.39' },
+                  { doc_count: 7, key: '203.88.33.151' },
+                ],
+              },
+            },
+            ipv6: {
+              from: '::',
+              to: 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
+              filteredSuggestions: {
+                buckets: [
+                  { doc_count: 12, key: '52:ae76:5947:5e2a:551:fe6a:712a:c72' },
+                  { doc_count: 1, key: 'fd:4aa0:c27c:b04:997f:2de1:51b4:8418' },
+                  { doc_count: 9, key: '28c7:c9a4:42fd:16b0:4de5:e41e:28d9:9172' },
+                  { doc_count: 6, key: '1ec:aa98:b0a6:d07c:590:18a0:8a33:2eb8' },
+                  { doc_count: 10, key: 'f7a9:640b:b5a0:1219:8d75:ed94:3c3e:2e63' },
+                ],
+              },
+            },
+          },
+        },
+        unique_terms: {
+          buckets: {
+            ipv4: {
+              value: 7,
+            },
+            ipv6: {
+              value: 5,
+            },
+          },
+        },
+      };
+
+      const parsed = suggestionAggBuilder.parse(
+        rawSearchResponseMock,
+        optionsListRequestBodyMock
+      ).suggestions;
+      /** first, verify that the sorting worked as expected */
+      expect(Object.keys(parsed)).toMatchInlineSnapshot(`
+        Array [
+          "52:ae76:5947:5e2a:551:fe6a:712a:c72",
+          "111.52.174.2",
+          "196.162.13.39",
+          "f7a9:640b:b5a0:1219:8d75:ed94:3c3e:2e63",
+          "23.216.241.120",
+          "28c7:c9a4:42fd:16b0:4de5:e41e:28d9:9172",
+          "21.35.91.62",
+          "21.35.91.61",
+          "203.88.33.151",
+          "1ec:aa98:b0a6:d07c:590:18a0:8a33:2eb8",
+        ]
+      `);
+      /** then, make sure the object is structured properly */
+      expect(parsed).toMatchInlineSnapshot(`
+        Object {
+          "111.52.174.2": Object {
+            "doc_count": 11,
+          },
+          "196.162.13.39": Object {
+            "doc_count": 10,
+          },
+          "1ec:aa98:b0a6:d07c:590:18a0:8a33:2eb8": Object {
+            "doc_count": 6,
+          },
+          "203.88.33.151": Object {
+            "doc_count": 7,
+          },
+          "21.35.91.61": Object {
+            "doc_count": 8,
+          },
+          "21.35.91.62": Object {
+            "doc_count": 8,
+          },
+          "23.216.241.120": Object {
+            "doc_count": 9,
+          },
+          "28c7:c9a4:42fd:16b0:4de5:e41e:28d9:9172": Object {
+            "doc_count": 9,
+          },
+          "52:ae76:5947:5e2a:551:fe6a:712a:c72": Object {
+            "doc_count": 12,
+          },
+          "f7a9:640b:b5a0:1219:8d75:ed94:3c3e:2e63": Object {
+            "doc_count": 10,
+          },
+        }
+      `);
+    });
+  });
+});
diff --git a/src/plugins/controls/server/options_list/options_list_expensive_suggestion_queries.ts b/src/plugins/controls/server/options_list/options_list_expensive_suggestion_queries.ts
new file mode 100644
index 0000000000000..63347f8d436d3
--- /dev/null
+++ b/src/plugins/controls/server/options_list/options_list_expensive_suggestion_queries.ts
@@ -0,0 +1,217 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { get } from 'lodash';
+import { getFieldSubtypeNested } from '@kbn/data-views-plugin/common';
+
+import { OptionsListRequestBody, OptionsListSuggestions } from '../../common/options_list/types';
+import { getIpRangeQuery, type IpRangeQuery } from '../../common/options_list/ip_search';
+import { EsBucket, OptionsListSuggestionAggregationBuilder } from './types';
+import { getIpBuckets, getSortType } from './options_list_suggestion_query_helpers';
+
+/**
+ * Suggestion aggregations
+ */
+export const getExpensiveSuggestionAggregationBuilder = ({ fieldSpec }: OptionsListRequestBody) => {
+  if (fieldSpec?.type === 'boolean') {
+    return expensiveSuggestionAggSubtypes.boolean;
+  }
+  if (fieldSpec?.type === 'ip') {
+    return expensiveSuggestionAggSubtypes.ip;
+  }
+  return expensiveSuggestionAggSubtypes.textOrKeywordOrNested;
+};
+
+const expensiveSuggestionAggSubtypes: { [key: string]: OptionsListSuggestionAggregationBuilder } = {
+  /**
+   * The "textOrKeywordOrNested" query / parser should be used whenever the field is built on some type of string field,
+   * regardless of if it is keyword only, keyword+text, or some nested keyword/keyword+text field.
+   */
+  textOrKeywordOrNested: {
+    buildAggregation: ({
+      searchString,
+      fieldName,
+      fieldSpec,
+      sort,
+      size,
+    }: OptionsListRequestBody) => {
+      const subTypeNested = fieldSpec && getFieldSubtypeNested(fieldSpec);
+      let textOrKeywordQuery: any = {
+        suggestions: {
+          terms: {
+            size,
+            field: fieldName,
+            shard_size: 10,
+            order: getSortType(sort),
+          },
+        },
+        unique_terms: {
+          cardinality: {
+            field: fieldName,
+          },
+        },
+      };
+      if (searchString) {
+        textOrKeywordQuery = {
+          filteredSuggestions: {
+            filter: {
+              prefix: {
+                [fieldName]: {
+                  value: searchString,
+                  case_insensitive: true,
+                },
+              },
+            },
+            aggs: { ...textOrKeywordQuery },
+          },
+        };
+      }
+      if (subTypeNested) {
+        textOrKeywordQuery = {
+          nestedSuggestions: {
+            nested: {
+              path: subTypeNested.nested.path,
+            },
+            aggs: {
+              ...textOrKeywordQuery,
+            },
+          },
+        };
+      }
+      return textOrKeywordQuery;
+    },
+    parse: (rawEsResult, request) => {
+      let basePath = 'aggregations';
+      const isNested = request.fieldSpec && getFieldSubtypeNested(request.fieldSpec);
+      basePath += isNested ? '.nestedSuggestions' : '';
+      basePath += request.searchString ? '.filteredSuggestions' : '';
+
+      const suggestions = get(rawEsResult, `${basePath}.suggestions.buckets`)?.reduce(
+        (acc: OptionsListSuggestions, suggestion: EsBucket) => {
+          return { ...acc, [suggestion.key]: { doc_count: suggestion.doc_count } };
+        },
+        {}
+      );
+      return {
+        suggestions,
+        totalCardinality: get(rawEsResult, `${basePath}.unique_terms.value`),
+      };
+    },
+  },
+
+  /**
+   * the "Boolean" query / parser should be used when the options list is built on a field of type boolean. The query is slightly different than a keyword query.
+   */
+  boolean: {
+    buildAggregation: ({ fieldName, sort }: OptionsListRequestBody) => ({
+      suggestions: {
+        terms: {
+          field: fieldName,
+          shard_size: 10,
+          order: getSortType(sort),
+        },
+      },
+    }),
+    parse: (rawEsResult) => {
+      const suggestions = get(rawEsResult, 'aggregations.suggestions.buckets')?.reduce(
+        (acc: OptionsListSuggestions, suggestion: EsBucket & { key_as_string: string }) => {
+          return {
+            ...acc,
+            [suggestion.key_as_string]: { doc_count: suggestion.doc_count },
+          };
+        },
+        {}
+      );
+      return { suggestions, totalCardinality: Object.keys(suggestions).length }; // cardinality is only ever 0, 1, or 2 so safe to use length here
+    },
+  },
+
+  /**
+   * the "IP" query / parser should be used when the options list is built on a field of type IP.
+   */
+  ip: {
+    buildAggregation: ({ fieldName, searchString, sort, size }: OptionsListRequestBody) => {
+      let ipRangeQuery: IpRangeQuery = {
+        validSearch: true,
+        rangeQuery: [
+          {
+            key: 'ipv6',
+            from: '::',
+            to: 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
+          },
+        ],
+      };
+
+      if (searchString) {
+        ipRangeQuery = getIpRangeQuery(searchString);
+        if (!ipRangeQuery.validSearch) {
+          // ideally should be prevented on the client side but, if somehow an invalid search gets through to the server,
+          // simply don't return an aggregation query for the ES search request
+          return undefined;
+        }
+      }
+
+      return {
+        suggestions: {
+          ip_range: {
+            field: fieldName,
+            ranges: ipRangeQuery.rangeQuery,
+            keyed: true,
+          },
+          aggs: {
+            filteredSuggestions: {
+              terms: {
+                size,
+                field: fieldName,
+                shard_size: 10,
+                order: getSortType(sort),
+              },
+            },
+            unique_terms: {
+              cardinality: {
+                field: fieldName,
+              },
+            },
+          },
+        },
+      };
+    },
+    parse: (rawEsResult, request) => {
+      if (!Boolean(rawEsResult.aggregations?.suggestions)) {
+        // if this is happens, that means there is an invalid search that snuck through to the server side code;
+        // so, might as well early return with no suggestions
+        return { suggestions: {}, totalCardinality: 0 };
+      }
+      const buckets: EsBucket[] = [];
+      getIpBuckets(rawEsResult, buckets, 'ipv4'); // modifies buckets array directly, i.e. "by reference"
+      getIpBuckets(rawEsResult, buckets, 'ipv6');
+
+      const sortedSuggestions =
+        request.sort?.direction === 'asc'
+          ? buckets.sort(
+              (bucketA: EsBucket, bucketB: EsBucket) => bucketA.doc_count - bucketB.doc_count
+            )
+          : buckets.sort(
+              (bucketA: EsBucket, bucketB: EsBucket) => bucketB.doc_count - bucketA.doc_count
+            );
+
+      const suggestions: OptionsListSuggestions = sortedSuggestions
+        .slice(0, request.size)
+        .reduce((acc: OptionsListSuggestions, suggestion: EsBucket) => {
+          return { ...acc, [suggestion.key]: { doc_count: suggestion.doc_count } };
+        }, {});
+      const totalCardinality =
+        (get(rawEsResult, `aggregations.suggestions.buckets.ipv4.unique_terms.value`) ?? 0) +
+        (get(rawEsResult, `aggregations.suggestions.buckets.ipv6.unique_terms.value`) ?? 0);
+      return {
+        suggestions,
+        totalCardinality,
+      };
+    },
+  },
+};
diff --git a/src/plugins/controls/server/options_list/options_list_queries.ts b/src/plugins/controls/server/options_list/options_list_queries.ts
deleted file mode 100644
index 4a7aceba910c0..0000000000000
--- a/src/plugins/controls/server/options_list/options_list_queries.ts
+++ /dev/null
@@ -1,289 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { get, isEmpty } from 'lodash';
-import { SearchResponse } from '@elastic/elasticsearch/lib/api/types';
-import { getFieldSubtypeNested } from '@kbn/data-views-plugin/common';
-
-import { OptionsListRequestBody, OptionsListSuggestions } from '../../common/options_list/types';
-import {
-  OPTIONS_LIST_DEFAULT_SORT,
-  OptionsListSortingType,
-} from '../../common/options_list/suggestions_sorting';
-import { getIpRangeQuery, type IpRangeQuery } from '../../common/options_list/ip_search';
-
-export interface OptionsListValidationAggregationBuilder {
-  buildAggregation: (req: OptionsListRequestBody) => unknown;
-  parse: (response: SearchResponse) => string[];
-}
-
-export interface OptionsListSuggestionAggregationBuilder {
-  buildAggregation: (req: OptionsListRequestBody) => unknown;
-  parse: (response: SearchResponse) => OptionsListSuggestions;
-}
-
-interface EsBucket {
-  key: string;
-  doc_count: number;
-}
-
-const getSortType = (sort?: OptionsListSortingType) => {
-  return sort
-    ? { [sort.by]: sort.direction }
-    : { [OPTIONS_LIST_DEFAULT_SORT.by]: OPTIONS_LIST_DEFAULT_SORT.direction };
-};
-
-/**
- * Validation aggregations
- */
-export const getValidationAggregationBuilder: () => OptionsListValidationAggregationBuilder =
-  () => ({
-    buildAggregation: ({ selectedOptions, fieldName }: OptionsListRequestBody) => {
-      let selectedOptionsFilters;
-      if (selectedOptions) {
-        selectedOptionsFilters = selectedOptions.reduce((acc, currentOption) => {
-          acc[currentOption] = { match: { [fieldName]: currentOption } };
-          return acc;
-        }, {} as { [key: string]: { match: { [key: string]: string } } });
-      }
-      return selectedOptionsFilters && !isEmpty(selectedOptionsFilters)
-        ? {
-            filters: {
-              filters: selectedOptionsFilters,
-            },
-          }
-        : undefined;
-    },
-    parse: (rawEsResult) => {
-      const rawInvalidSuggestions = get(rawEsResult, 'aggregations.validation.buckets');
-      return rawInvalidSuggestions && !isEmpty(rawInvalidSuggestions)
-        ? Object.keys(rawInvalidSuggestions).filter(
-            (key) => rawInvalidSuggestions[key].doc_count === 0
-          )
-        : [];
-    },
-  });
-
-/**
- * Suggestion aggregations
- */
-export const getSuggestionAggregationBuilder = ({
-  fieldSpec,
-  textFieldName,
-  searchString,
-}: OptionsListRequestBody) => {
-  if (textFieldName && fieldSpec?.aggregatable && searchString) {
-    return suggestionAggSubtypes.keywordAndText;
-  }
-  if (fieldSpec?.type === 'boolean') {
-    return suggestionAggSubtypes.boolean;
-  }
-  if (fieldSpec?.type === 'ip') {
-    return suggestionAggSubtypes.ip;
-  }
-  if (fieldSpec && getFieldSubtypeNested(fieldSpec)) {
-    return suggestionAggSubtypes.subtypeNested;
-  }
-  return suggestionAggSubtypes.keywordOnly;
-};
-
-const getEscapedQuery = (q: string = '') =>
-  q.replace(/[.?+*|{}[\]()"\\#@&<>~]/g, (match) => `\\${match}`);
-
-const getIpBuckets = (rawEsResult: any, combinedBuckets: EsBucket[], type: 'ipv4' | 'ipv6') => {
-  const results = get(
-    rawEsResult,
-    `aggregations.suggestions.buckets.${type}.filteredSuggestions.buckets`
-  );
-  if (results) {
-    results.forEach((suggestion: EsBucket) => combinedBuckets.push(suggestion));
-  }
-};
-
-const suggestionAggSubtypes: { [key: string]: OptionsListSuggestionAggregationBuilder } = {
-  /**
-   * the "Keyword only" query / parser should be used when the options list is built on a field which has only keyword mappings.
-   */
-  keywordOnly: {
-    buildAggregation: ({ fieldName, searchString, sort }: OptionsListRequestBody) => ({
-      terms: {
-        field: fieldName,
-        include: `${getEscapedQuery(searchString)}.*`,
-        execution_hint: 'map',
-        shard_size: 10,
-        order: getSortType(sort),
-      },
-    }),
-    parse: (rawEsResult) =>
-      get(rawEsResult, 'aggregations.suggestions.buckets').reduce(
-        (suggestions: OptionsListSuggestions, suggestion: EsBucket) => {
-          return { ...suggestions, [suggestion.key]: { doc_count: suggestion.doc_count } };
-        },
-        {}
-      ),
-  },
-
-  /**
-   * the "Keyword and text" query / parser should be used when the options list is built on a multi-field which has both keyword and text mappings. It supports case-insensitive searching
-   */
-  keywordAndText: {
-    buildAggregation: (req: OptionsListRequestBody) => {
-      if (!req.textFieldName) {
-        // if there is no textFieldName specified, or if there is no search string yet fall back to keywordOnly
-        return suggestionAggSubtypes.keywordOnly.buildAggregation(req);
-      }
-      const { fieldName, searchString, textFieldName, sort } = req;
-      return {
-        filter: {
-          match_phrase_prefix: {
-            [textFieldName]: searchString,
-          },
-        },
-        aggs: {
-          keywordSuggestions: {
-            terms: {
-              field: fieldName,
-              shard_size: 10,
-              order: getSortType(sort),
-            },
-          },
-        },
-      };
-    },
-    parse: (rawEsResult) =>
-      get(rawEsResult, 'aggregations.suggestions.keywordSuggestions.buckets').reduce(
-        (suggestions: OptionsListSuggestions, suggestion: EsBucket) => {
-          return { ...suggestions, [suggestion.key]: { doc_count: suggestion.doc_count } };
-        },
-        {}
-      ),
-  },
-
-  /**
-   * the "Boolean" query / parser should be used when the options list is built on a field of type boolean. The query is slightly different than a keyword query.
-   */
-  boolean: {
-    buildAggregation: ({ fieldName, sort }: OptionsListRequestBody) => ({
-      terms: {
-        field: fieldName,
-        execution_hint: 'map',
-        shard_size: 10,
-        order: getSortType(sort),
-      },
-    }),
-    parse: (rawEsResult) =>
-      get(rawEsResult, 'aggregations.suggestions.buckets')?.reduce(
-        (suggestions: OptionsListSuggestions, suggestion: EsBucket & { key_as_string: string }) => {
-          return {
-            ...suggestions,
-            [suggestion.key_as_string]: { doc_count: suggestion.doc_count },
-          };
-        },
-        {}
-      ),
-  },
-
-  /**
-   * the "IP" query / parser should be used when the options list is built on a field of type IP.
-   */
-  ip: {
-    buildAggregation: ({ fieldName, searchString, sort }: OptionsListRequestBody) => {
-      let ipRangeQuery: IpRangeQuery = {
-        validSearch: true,
-        rangeQuery: [
-          {
-            key: 'ipv6',
-            from: '::',
-            to: 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
-          },
-        ],
-      };
-
-      if (searchString) {
-        ipRangeQuery = getIpRangeQuery(searchString);
-        if (!ipRangeQuery.validSearch) {
-          // ideally should be prevented on the client side but, if somehow an invalid search gets through to the server,
-          // simply don't return an aggregation query for the ES search request
-          return undefined;
-        }
-      }
-
-      return {
-        ip_range: {
-          field: fieldName,
-          ranges: ipRangeQuery.rangeQuery,
-          keyed: true,
-        },
-        aggs: {
-          filteredSuggestions: {
-            terms: {
-              field: fieldName,
-              execution_hint: 'map',
-              shard_size: 10,
-              order: getSortType(sort),
-            },
-          },
-        },
-      };
-    },
-    parse: (rawEsResult) => {
-      if (!Boolean(rawEsResult.aggregations?.suggestions)) {
-        // if this is happens, that means there is an invalid search that snuck through to the server side code;
-        // so, might as well early return with no suggestions
-        return [];
-      }
-
-      const buckets: EsBucket[] = [];
-      getIpBuckets(rawEsResult, buckets, 'ipv4'); // modifies buckets array directly, i.e. "by reference"
-      getIpBuckets(rawEsResult, buckets, 'ipv6');
-      return buckets
-        .sort((bucketA: EsBucket, bucketB: EsBucket) => bucketB.doc_count - bucketA.doc_count)
-        .slice(0, 10) // only return top 10 results
-        .reduce((suggestions, suggestion: EsBucket) => {
-          return { ...suggestions, [suggestion.key]: { doc_count: suggestion.doc_count } };
-        }, {});
-    },
-  },
-
-  /**
-   * the "Subtype Nested" query / parser should be used when the options list is built on a field with subtype nested.
-   */
-  subtypeNested: {
-    buildAggregation: (req: OptionsListRequestBody) => {
-      const { fieldSpec, fieldName, searchString, sort } = req;
-      const subTypeNested = fieldSpec && getFieldSubtypeNested(fieldSpec);
-      if (!subTypeNested) {
-        // if this field is not subtype nested, fall back to keywordOnly
-        return suggestionAggSubtypes.keywordOnly.buildAggregation(req);
-      }
-      return {
-        nested: {
-          path: subTypeNested.nested.path,
-        },
-        aggs: {
-          nestedSuggestions: {
-            terms: {
-              field: fieldName,
-              include: `${getEscapedQuery(searchString)}.*`,
-              execution_hint: 'map',
-              shard_size: 10,
-              order: getSortType(sort),
-            },
-          },
-        },
-      };
-    },
-    parse: (rawEsResult) =>
-      get(rawEsResult, 'aggregations.suggestions.nestedSuggestions.buckets').reduce(
-        (suggestions: OptionsListSuggestions, suggestion: EsBucket) => {
-          return { ...suggestions, [suggestion.key]: { doc_count: suggestion.doc_count } };
-        },
-        {}
-      ),
-  },
-};
diff --git a/src/plugins/controls/server/options_list/options_list_suggestion_query_helpers.ts b/src/plugins/controls/server/options_list/options_list_suggestion_query_helpers.ts
new file mode 100644
index 0000000000000..54e83e0ac835b
--- /dev/null
+++ b/src/plugins/controls/server/options_list/options_list_suggestion_query_helpers.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { get } from 'lodash';
+
+import { EsBucket } from './types';
+import {
+  OPTIONS_LIST_DEFAULT_SORT,
+  OptionsListSortingType,
+} from '../../common/options_list/suggestions_sorting';
+
+export const getSortType = (sort?: OptionsListSortingType) => {
+  return sort
+    ? { [sort.by]: sort.direction }
+    : { [OPTIONS_LIST_DEFAULT_SORT.by]: OPTIONS_LIST_DEFAULT_SORT.direction };
+};
+
+export const getEscapedQuery = (q: string = '') =>
+  q.replace(/[.?+*|{}[\]()"\\#@&<>~]/g, (match) => `\\${match}`);
+
+export const getIpBuckets = (
+  rawEsResult: any,
+  combinedBuckets: EsBucket[],
+  type: 'ipv4' | 'ipv6'
+) => {
+  const results = get(
+    rawEsResult,
+    `aggregations.suggestions.buckets.${type}.filteredSuggestions.buckets`
+  );
+  if (results) {
+    results.forEach((suggestion: EsBucket) => combinedBuckets.push(suggestion));
+  }
+};
diff --git a/src/plugins/controls/server/options_list/options_list_suggestions_route.ts b/src/plugins/controls/server/options_list/options_list_suggestions_route.ts
index 0893d24ebacf0..61d50419d94a0 100644
--- a/src/plugins/controls/server/options_list/options_list_suggestions_route.ts
+++ b/src/plugins/controls/server/options_list/options_list_suggestions_route.ts
@@ -7,7 +7,6 @@
  */
 
 import { Observable } from 'rxjs';
-import { get } from 'lodash';
 
 import { PluginSetup as UnifiedSearchPluginSetup } from '@kbn/unified-search-plugin/server';
 import { getKbnServerError, reportServerError } from '@kbn/kibana-utils-plugin/server';
@@ -16,10 +15,10 @@ import { SearchRequest } from '@kbn/data-plugin/common';
 import { schema } from '@kbn/config-schema';
 
 import { OptionsListRequestBody, OptionsListResponse } from '../../common/options_list/types';
-import {
-  getSuggestionAggregationBuilder,
-  getValidationAggregationBuilder,
-} from './options_list_queries';
+import { getValidationAggregationBuilder } from './options_list_validation_queries';
+import { getExpensiveSuggestionAggregationBuilder } from './options_list_expensive_suggestion_queries';
+import { getCheapSuggestionAggregationBuilder } from './options_list_cheap_suggestion_queries';
+import { OptionsListSuggestionAggregationBuilder } from './types';
 
 export const setupOptionsListSuggestionsRoute = (
   { http }: CoreSetup,
@@ -39,10 +38,12 @@ export const setupOptionsListSuggestionsRoute = (
         ),
         body: schema.object(
           {
+            size: schema.number(),
             fieldName: schema.string(),
             sort: schema.maybe(schema.any()),
             filters: schema.maybe(schema.any()),
             fieldSpec: schema.maybe(schema.any()),
+            allowExpensiveQueries: schema.boolean(),
             searchString: schema.maybe(schema.string()),
             selectedOptions: schema.maybe(schema.arrayOf(schema.string())),
           },
@@ -55,6 +56,7 @@ export const setupOptionsListSuggestionsRoute = (
         const suggestionRequest: OptionsListRequestBody = request.body;
         const { index } = request.params;
         const esClient = (await context.core).elasticsearch.client.asCurrentUser;
+
         const suggestionsResponse = await getOptionsListSuggestions({
           abortedEvent$: request.events.aborted$,
           request: suggestionRequest,
@@ -86,21 +88,21 @@ export const setupOptionsListSuggestionsRoute = (
     /**
      * Build ES Query
      */
-    const { runPastTimeout, filters, fieldName, runtimeFieldMap } = request;
+    const { runPastTimeout, filters, runtimeFieldMap, allowExpensiveQueries } = request;
     const { terminateAfter, timeout } = getAutocompleteSettings();
     const timeoutSettings = runPastTimeout
       ? {}
       : { timeout: `${timeout}ms`, terminate_after: terminateAfter };
 
-    const suggestionBuilder = getSuggestionAggregationBuilder(request);
+    let suggestionBuilder: OptionsListSuggestionAggregationBuilder;
+    if (allowExpensiveQueries) {
+      suggestionBuilder = getExpensiveSuggestionAggregationBuilder(request);
+    } else {
+      suggestionBuilder = getCheapSuggestionAggregationBuilder(request);
+    }
     const validationBuilder = getValidationAggregationBuilder();
 
-    const builtSuggestionAggregation = suggestionBuilder.buildAggregation(request);
-    const suggestionAggregation = builtSuggestionAggregation
-      ? {
-          suggestions: builtSuggestionAggregation,
-        }
-      : {};
+    const suggestionAggregation: any = suggestionBuilder.buildAggregation(request) ?? {};
     const builtValidationAggregation = validationBuilder.buildAggregation(request);
     const validationAggregations = builtValidationAggregation
       ? {
@@ -118,17 +120,11 @@ export const setupOptionsListSuggestionsRoute = (
       aggs: {
         ...suggestionAggregation,
         ...validationAggregations,
-        unique_terms: {
-          cardinality: {
-            field: fieldName,
-          },
-        },
       },
       runtime_mappings: {
         ...runtimeFieldMap,
       },
     };
-
     /**
      * Run ES query
      */
@@ -137,14 +133,13 @@ export const setupOptionsListSuggestionsRoute = (
     /**
      * Parse ES response into Options List Response
      */
-    const totalCardinality = get(rawEsResult, 'aggregations.unique_terms.value');
-    const suggestions = suggestionBuilder.parse(rawEsResult);
+    const results = suggestionBuilder.parse(rawEsResult, request);
+    const totalCardinality = results.totalCardinality;
     const invalidSelections = validationBuilder.parse(rawEsResult);
     return {
-      suggestions,
+      suggestions: results.suggestions,
       totalCardinality,
       invalidSelections,
-      rejected: false,
     };
   };
 };
diff --git a/src/plugins/controls/server/options_list/options_list_validation_queries.test.ts b/src/plugins/controls/server/options_list/options_list_validation_queries.test.ts
new file mode 100644
index 0000000000000..f8a7344eb8860
--- /dev/null
+++ b/src/plugins/controls/server/options_list/options_list_validation_queries.test.ts
@@ -0,0 +1,104 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { SearchResponse } from '@elastic/elasticsearch/lib/api/types';
+
+import { OptionsListRequestBody } from '../../common/options_list/types';
+import { getValidationAggregationBuilder } from './options_list_validation_queries';
+
+describe('options list queries', () => {
+  let rawSearchResponseMock: SearchResponse = {} as SearchResponse;
+
+  beforeEach(() => {
+    rawSearchResponseMock = {
+      hits: {
+        total: 10,
+        max_score: 10,
+        hits: [],
+      },
+      took: 10,
+      timed_out: false,
+      _shards: {
+        failed: 0,
+        successful: 1,
+        total: 1,
+        skipped: 0,
+      },
+      aggregations: {},
+    };
+  });
+
+  describe('validation aggregation and parsing', () => {
+    test('creates validation aggregation when given selections', () => {
+      const validationAggBuilder = getValidationAggregationBuilder();
+      const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
+        fieldName: 'coolTestField',
+        allowExpensiveQueries: true,
+        selectedOptions: ['coolOption1', 'coolOption2', 'coolOption3'],
+      };
+      expect(validationAggBuilder.buildAggregation(optionsListRequestBodyMock))
+        .toMatchInlineSnapshot(`
+        Object {
+          "filters": Object {
+            "filters": Object {
+              "coolOption1": Object {
+                "match": Object {
+                  "coolTestField": "coolOption1",
+                },
+              },
+              "coolOption2": Object {
+                "match": Object {
+                  "coolTestField": "coolOption2",
+                },
+              },
+              "coolOption3": Object {
+                "match": Object {
+                  "coolTestField": "coolOption3",
+                },
+              },
+            },
+          },
+        }
+      `);
+    });
+
+    test('returns undefined when not given selections', () => {
+      const validationAggBuilder = getValidationAggregationBuilder();
+      const optionsListRequestBodyMock: OptionsListRequestBody = {
+        size: 10,
+        fieldName: 'coolTestField',
+        allowExpensiveQueries: true,
+      };
+      expect(validationAggBuilder.buildAggregation(optionsListRequestBodyMock)).toBeUndefined();
+    });
+
+    test('parses validation result', () => {
+      const validationAggBuilder = getValidationAggregationBuilder();
+      rawSearchResponseMock.aggregations = {
+        validation: {
+          buckets: {
+            cool1: { doc_count: 0 },
+            cool2: { doc_count: 15 },
+            cool3: { doc_count: 0 },
+            cool4: { doc_count: 2 },
+            cool5: { doc_count: 112 },
+            cool6: { doc_count: 0 },
+          },
+        },
+      };
+      expect(validationAggBuilder.parse(rawSearchResponseMock)).toMatchInlineSnapshot(`
+        Array [
+          "cool1",
+          "cool3",
+          "cool6",
+        ]
+      `);
+    });
+  });
+});
diff --git a/src/plugins/controls/server/options_list/options_list_validation_queries.ts b/src/plugins/controls/server/options_list/options_list_validation_queries.ts
new file mode 100644
index 0000000000000..a79c0971a5cb1
--- /dev/null
+++ b/src/plugins/controls/server/options_list/options_list_validation_queries.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { get, isEmpty } from 'lodash';
+
+import { OptionsListRequestBody } from '../../common/options_list/types';
+import { OptionsListValidationAggregationBuilder } from './types';
+
+/**
+ * Validation aggregations
+ */
+export const getValidationAggregationBuilder: () => OptionsListValidationAggregationBuilder =
+  () => ({
+    buildAggregation: ({ selectedOptions, fieldName }: OptionsListRequestBody) => {
+      let selectedOptionsFilters;
+      if (selectedOptions) {
+        selectedOptionsFilters = selectedOptions.reduce((acc, currentOption) => {
+          acc[currentOption] = { match: { [fieldName]: currentOption } };
+          return acc;
+        }, {} as { [key: string]: { match: { [key: string]: string } } });
+      }
+      return selectedOptionsFilters && !isEmpty(selectedOptionsFilters)
+        ? {
+            filters: {
+              filters: selectedOptionsFilters,
+            },
+          }
+        : undefined;
+    },
+    parse: (rawEsResult) => {
+      const rawInvalidSuggestions = get(rawEsResult, 'aggregations.validation.buckets');
+      return rawInvalidSuggestions && !isEmpty(rawInvalidSuggestions)
+        ? Object.keys(rawInvalidSuggestions).filter(
+            (key) => rawInvalidSuggestions[key].doc_count === 0
+          )
+        : [];
+    },
+  });
diff --git a/src/plugins/controls/server/options_list/types.ts b/src/plugins/controls/server/options_list/types.ts
new file mode 100644
index 0000000000000..1ea3475eddffb
--- /dev/null
+++ b/src/plugins/controls/server/options_list/types.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { SearchResponse } from '@elastic/elasticsearch/lib/api/types';
+import {
+  OptionsListRequestBody,
+  OptionsListParsedSuggestions,
+} from '../../common/options_list/types';
+
+export interface EsBucket {
+  key: string;
+  doc_count: number;
+}
+
+export interface OptionsListValidationAggregationBuilder {
+  buildAggregation: (req: OptionsListRequestBody) => unknown;
+  parse: (response: SearchResponse) => string[];
+}
+
+export interface OptionsListSuggestionAggregationBuilder {
+  buildAggregation: (req: OptionsListRequestBody) => unknown;
+  parse: (response: SearchResponse, req: OptionsListRequestBody) => OptionsListParsedSuggestions;
+}
diff --git a/src/plugins/controls/server/plugin.ts b/src/plugins/controls/server/plugin.ts
index 6d3838804e14a..7e394ca69a410 100644
--- a/src/plugins/controls/server/plugin.ts
+++ b/src/plugins/controls/server/plugin.ts
@@ -15,6 +15,7 @@ import { controlGroupContainerPersistableStateServiceFactory } from './control_g
 import { optionsListPersistableStateServiceFactory } from './options_list/options_list_embeddable_factory';
 import { rangeSliderPersistableStateServiceFactory } from './range_slider/range_slider_embeddable_factory';
 import { timeSliderPersistableStateServiceFactory } from './time_slider/time_slider_embeddable_factory';
+import { setupOptionsListClusterSettingsRoute } from './options_list/options_list_cluster_settings_route';
 
 interface SetupDeps {
   embeddable: EmbeddableSetup;
@@ -30,7 +31,7 @@ export class ControlsPlugin implements Plugin<object, object, SetupDeps> {
     embeddable.registerEmbeddableFactory(optionsListPersistableStateServiceFactory());
     embeddable.registerEmbeddableFactory(rangeSliderPersistableStateServiceFactory());
     embeddable.registerEmbeddableFactory(timeSliderPersistableStateServiceFactory());
-
+    setupOptionsListClusterSettingsRoute(core);
     setupOptionsListSuggestionsRoute(core, unifiedSearch.autocomplete.getAutocompleteSettings);
     return {};
   }
diff --git a/src/plugins/controls/tsconfig.json b/src/plugins/controls/tsconfig.json
index 6aedcaf236950..9acd44b5c2f7e 100644
--- a/src/plugins/controls/tsconfig.json
+++ b/src/plugins/controls/tsconfig.json
@@ -32,6 +32,7 @@
     "@kbn/test-jest-helpers",
     "@kbn/config-schema",
     "@kbn/storybook",
+    "@kbn/ui-theme",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx b/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx
index cdad643417538..c2205d68ba546 100644
--- a/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx
+++ b/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx
@@ -96,7 +96,7 @@ export class DashboardContainer extends Container<InheritedChildInput, Dashboard
   public controlGroup?: ControlGroupContainer;
 
   // Dashboard State
-  private onDestroyControlGroup?: () => void;
+  public onDestroyControlGroup?: () => void;
   private subscriptions: Subscription = new Subscription();
 
   private initialized$: BehaviorSubject<boolean> = new BehaviorSubject<boolean>(false);
diff --git a/src/plugins/dashboard/public/dashboard_container/embeddable/integrations/controls/dashboard_control_group_integration.ts b/src/plugins/dashboard/public/dashboard_container/embeddable/integrations/controls/dashboard_control_group_integration.ts
index 4e78d9185f7c4..7367f089bbaa8 100644
--- a/src/plugins/dashboard/public/dashboard_container/embeddable/integrations/controls/dashboard_control_group_integration.ts
+++ b/src/plugins/dashboard/public/dashboard_container/embeddable/integrations/controls/dashboard_control_group_integration.ts
@@ -65,12 +65,19 @@ export async function startControlGroupIntegration(
     return;
   }
 
-  this.untilInitialized().then(() => startSyncingDashboardControlGroup.bind(this)());
+  this.untilInitialized().then(() => {
+    const stopSyncingControlGroup =
+      startSyncingDashboardControlGroup.bind(this)()?.stopSyncingWithControlGroup;
+    this.onDestroyControlGroup = () => {
+      stopSyncingControlGroup?.();
+      this.controlGroup?.destroy();
+    };
+  });
   await controlGroup.untilInitialized();
   return controlGroup;
 }
 
-async function startSyncingDashboardControlGroup(this: DashboardContainer) {
+function startSyncingDashboardControlGroup(this: DashboardContainer) {
   if (!this.controlGroup) return;
   const subscriptions = new Subscription();
 
diff --git a/src/plugins/embeddable/public/lib/embeddables/error_embedabble.scss b/src/plugins/embeddable/public/lib/embeddables/error_embedabble.scss
deleted file mode 100644
index 51ee8cdf25f66..0000000000000
--- a/src/plugins/embeddable/public/lib/embeddables/error_embedabble.scss
+++ /dev/null
@@ -1,10 +0,0 @@
-.errorEmbeddableCompact__popoverAnchor {
-  max-width: 100%;
-}
-
-.errorEmbeddableCompact__button {
-  padding-left: 0 !important;
-  .euiIcon {
-    margin-right: $euiSizeXS * .5;
-  }
-}
\ No newline at end of file
diff --git a/src/plugins/embeddable/public/lib/embeddables/error_embeddable.scss b/src/plugins/embeddable/public/lib/embeddables/error_embeddable.scss
new file mode 100644
index 0000000000000..cc8d7f9698221
--- /dev/null
+++ b/src/plugins/embeddable/public/lib/embeddables/error_embeddable.scss
@@ -0,0 +1,20 @@
+
+.errorEmbeddableCompact__popover {
+  height: 100%;
+}
+
+.errorEmbeddableCompact__popoverAnchor {
+  max-width: 100%;
+}
+
+.errorEmbeddableCompact__button {
+  :hover {
+    text-decoration: underline;
+    text-decoration-color: $euiTextSubduedColor !important;
+  }
+}
+
+.errorEmbeddableCompact__text {
+  font-size: $euiSizeM;
+  color: $euiTextSubduedColor;
+}
diff --git a/src/plugins/embeddable/public/lib/embeddables/error_embeddable.tsx b/src/plugins/embeddable/public/lib/embeddables/error_embeddable.tsx
index 1ccaf61064a8a..244803c5e13f2 100644
--- a/src/plugins/embeddable/public/lib/embeddables/error_embeddable.tsx
+++ b/src/plugins/embeddable/public/lib/embeddables/error_embeddable.tsx
@@ -11,6 +11,7 @@ import { EmbeddablePanelError } from '../panel/embeddable_panel_error';
 import { Embeddable } from './embeddable';
 import { EmbeddableInput, EmbeddableOutput, IEmbeddable } from './i_embeddable';
 import { IContainer } from '../containers';
+import './error_embeddable.scss';
 
 export const ERROR_EMBEDDABLE_TYPE = 'error';
 
diff --git a/test/functional/apps/dashboard_elements/controls/options_list/index.ts b/test/functional/apps/dashboard_elements/controls/options_list/index.ts
index 9d4cb7d18d525..d2c80da466c53 100644
--- a/test/functional/apps/dashboard_elements/controls/options_list/index.ts
+++ b/test/functional/apps/dashboard_elements/controls/options_list/index.ts
@@ -14,16 +14,12 @@ export default function ({ loadTestFile, getService, getPageObjects }: FtrProvid
   const elasticChart = getService('elasticChart');
   const security = getService('security');
 
-  const { timePicker, dashboard } = getPageObjects([
-    'dashboardControls',
-    'timePicker',
-    'dashboard',
-    'common',
-  ]);
-
-  async function setup() {
+  const { timePicker, dashboard, common } = getPageObjects(['timePicker', 'dashboard', 'common']);
+
+  const setup = async () => {
     await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader', 'animals']);
 
+    await common.navigateToApp('dashboard');
     await dashboard.gotoDashboardLandingPage();
     await dashboard.clickNewDashboard();
     await timePicker.setDefaultDataRange();
@@ -32,13 +28,13 @@ export default function ({ loadTestFile, getService, getPageObjects }: FtrProvid
       exitFromEditMode: false,
       storeTimeWithDashboard: true,
     });
-  }
+  };
 
-  async function teardown() {
+  const teardown = async () => {
     await security.testUser.restoreDefaults();
-  }
+  };
 
-  describe('Options list control', function () {
+  describe('Options list control', async () => {
     before(setup);
     after(teardown);
 
@@ -46,5 +42,7 @@ export default function ({ loadTestFile, getService, getPageObjects }: FtrProvid
     loadTestFile(require.resolve('./options_list_dashboard_interaction'));
     loadTestFile(require.resolve('./options_list_suggestions'));
     loadTestFile(require.resolve('./options_list_validation'));
+
+    loadTestFile(require.resolve('./options_list_allow_expensive_queries_off.ts'));
   });
 }
diff --git a/test/functional/apps/dashboard_elements/controls/options_list/options_list_allow_expensive_queries_off.ts b/test/functional/apps/dashboard_elements/controls/options_list/options_list_allow_expensive_queries_off.ts
new file mode 100644
index 0000000000000..84af82f349713
--- /dev/null
+++ b/test/functional/apps/dashboard_elements/controls/options_list/options_list_allow_expensive_queries_off.ts
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { OPTIONS_LIST_CONTROL } from '@kbn/controls-plugin/common';
+import expect from '@kbn/expect';
+
+import { OPTIONS_LIST_ANIMAL_SOUND_SUGGESTIONS } from '../../../../page_objects/dashboard_page_controls';
+import { FtrProviderContext } from '../../../../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const browser = getService('browser');
+
+  const { dashboardControls, timePicker, console, common, dashboard, header } = getPageObjects([
+    'dashboardControls',
+    'timePicker',
+    'dashboard',
+    'console',
+    'common',
+    'header',
+  ]);
+
+  const setAllowExpensiveQueries = async (value: boolean) => {
+    await common.navigateToApp('console');
+    await console.closeHelpIfExists();
+    await console.clearTextArea();
+    await console.enterRequest(
+      '\nPUT _cluster/settings\n{"transient": {"search.allow_expensive_queries": ' + value + '}}'
+    );
+    await console.clickPlay();
+    await header.waitUntilLoadingHasFinished();
+    await browser.refresh();
+  };
+
+  describe('Allow expensive queries setting is off', () => {
+    let controlId: string;
+
+    before(async () => {
+      await setAllowExpensiveQueries(false);
+
+      await common.navigateToApp('dashboard');
+      await dashboard.clickNewDashboard();
+      await dashboard.ensureDashboardIsInEditMode();
+      await timePicker.setDefaultDataRange();
+      await header.waitUntilLoadingHasFinished();
+
+      await dashboardControls.createControl({
+        controlType: OPTIONS_LIST_CONTROL,
+        dataViewTitle: 'animals-*',
+        fieldName: 'sound.keyword',
+      });
+      controlId = (await dashboardControls.getAllControlIds())[0];
+    });
+
+    after(async () => {
+      await dashboard.gotoDashboardLandingPage();
+      await dashboard.clickUnsavedChangesDiscard(`discard-unsaved-New-Dashboard`);
+      await setAllowExpensiveQueries(true);
+    });
+
+    it('Shows available options in options list', async () => {
+      await dashboardControls.ensureAvailableOptionsEqual(controlId, {
+        suggestions: OPTIONS_LIST_ANIMAL_SOUND_SUGGESTIONS,
+        invalidSelections: [],
+      });
+    });
+
+    it('Can search options list for available options', async () => {
+      await dashboardControls.optionsListOpenPopover(controlId);
+      await dashboardControls.optionsListPopoverSearchForOption('meo');
+      await dashboardControls.ensureAvailableOptionsEqual(
+        controlId,
+        {
+          suggestions: { meow: OPTIONS_LIST_ANIMAL_SOUND_SUGGESTIONS.meow },
+          invalidSelections: [],
+        },
+        true
+      );
+      await dashboardControls.optionsListPopoverClearSearch();
+      await dashboardControls.optionsListEnsurePopoverIsClosed(controlId);
+    });
+
+    it('Can search options list for available options - case sensitive', async () => {
+      await dashboardControls.optionsListOpenPopover(controlId);
+      await dashboardControls.optionsListPopoverSearchForOption('MEO');
+      const cardinality = await dashboardControls.optionsListPopoverGetAvailableOptionsCount();
+      expect(cardinality).to.be(0);
+      await dashboardControls.optionsListPopoverClearSearch();
+      await dashboardControls.optionsListEnsurePopoverIsClosed(controlId);
+    });
+  });
+}
diff --git a/test/functional/page_objects/dashboard_page_controls.ts b/test/functional/page_objects/dashboard_page_controls.ts
index 85908bce3d35c..c3160e650c2a8 100644
--- a/test/functional/page_objects/dashboard_page_controls.ts
+++ b/test/functional/page_objects/dashboard_page_controls.ts
@@ -428,9 +428,22 @@ export class DashboardPageControls extends FtrService {
     await this.retry.try(async () => {
       expect(await this.optionsListPopoverGetAvailableOptions()).to.eql(expectation);
     });
+    if (await this.testSubjects.exists('optionsList-cardinality-label')) {
+      expect(await this.optionsListGetCardinalityValue()).to.be(
+        Object.keys(expectation.suggestions).length.toLocaleString()
+      );
+    }
     if (!skipOpen) await this.optionsListEnsurePopoverIsClosed(controlId);
   }
 
+  public async optionsListGetCardinalityValue() {
+    this.log.debug(`getting the value of the cardinality badge`);
+    const cardinalityLabel = await (
+      await this.testSubjects.find('optionsList-cardinality-label')
+    ).getVisibleText();
+    return cardinalityLabel.split(' ')[0];
+  }
+
   public async optionsListPopoverSearchForOption(search: string) {
     this.log.debug(`searching for ${search} in options list`);
     await this.optionsListPopoverAssertOpen();
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index 2a85faa2eb9e4..69a2dfeda1909 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -352,9 +352,7 @@
     "controls.optionsList.errors.dataViewNotFound": "Impossible de localiser la vue de données : {dataViewId}",
     "controls.optionsList.errors.fieldNotFound": "Impossible de localiser le champ : {fieldName}",
     "controls.optionsList.popover.ariaLabel": "Fenêtre contextuelle pour le contrôle {fieldName}",
-    "controls.optionsList.popover.cardinalityPlaceholder": "Rechercher {totalOptions} {totalOptions, plural, one {option disponible} other {options disponibles}}",
     "controls.optionsList.popover.invalidSelectionsSectionTitle": "{invalidSelectionCount, plural, one {Sélection ignorée} other {Sélections ignorées}}",
-    "controls.optionsList.popover.invalidSelectionsTooltip": "{selectedOptions} {selectedOptions, plural, one {option sélectionnée} other {options sélectionnées}} {selectedOptions, plural, one {est ignorée} other {sont ignorées}}, car {selectedOptions, plural, one {elle n'est plus présente} other {elles ne sont plus présentes}} dans les données.",
     "controls.rangeSlider.errors.dataViewNotFound": "Impossible de localiser la vue de données : {dataViewId}",
     "controls.rangeSlider.errors.fieldNotFound": "Impossible de localiser le champ : {fieldName}",
     "controls.controlGroup.emptyState.addControlButtonTitle": "Ajouter un contrôle",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 4e61b0224cc7b..aafb384cf9400 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -354,9 +354,7 @@
     "controls.optionsList.errors.dataViewNotFound": "データビュー{dataViewId}が見つかりませんでした",
     "controls.optionsList.errors.fieldNotFound": "フィールド{fieldName}が見つかりませんでした",
     "controls.optionsList.popover.ariaLabel": "{fieldName}コントロールのポップオーバー",
-    "controls.optionsList.popover.cardinalityPlaceholder": "{totalOptions}個の使用可能な{totalOptions, plural, other {オプション}}を検索",
     "controls.optionsList.popover.invalidSelectionsSectionTitle": "{invalidSelectionCount, plural, other {個の選択項目}}",
-    "controls.optionsList.popover.invalidSelectionsTooltip": "{selectedOptions}個の選択した{selectedOptions, plural, other {オプション}} {selectedOptions, plural, other {が}}無視されます。{selectedOptions, plural, other {オプションが}}データに存在しません。",
     "controls.rangeSlider.errors.dataViewNotFound": "データビュー{dataViewId}が見つかりませんでした",
     "controls.rangeSlider.errors.fieldNotFound": "フィールド{fieldName}が見つかりませんでした",
     "controls.controlGroup.emptyState.addControlButtonTitle": "コントロールを追加",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index d581efbba60fe..ea907ebb37ab9 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -354,9 +354,7 @@
     "controls.optionsList.errors.dataViewNotFound": "找不到数据视图：{dataViewId}",
     "controls.optionsList.errors.fieldNotFound": "找不到字段：{fieldName}",
     "controls.optionsList.popover.ariaLabel": "{fieldName} 控件的弹出框",
-    "controls.optionsList.popover.cardinalityPlaceholder": "搜索 {totalOptions} 个可用{totalOptions, plural, other {选项}}",
     "controls.optionsList.popover.invalidSelectionsSectionTitle": "已忽略{invalidSelectionCount, plural, other {个选择}}",
-    "controls.optionsList.popover.invalidSelectionsTooltip": "{selectedOptions} 个选定{selectedOptions, plural, other {选项}} {selectedOptions, plural, other {已}}忽略，因为{selectedOptions, plural, one {其} other {它们}}已不再在数据中。",
     "controls.rangeSlider.errors.dataViewNotFound": "找不到数据视图：{dataViewId}",
     "controls.rangeSlider.errors.fieldNotFound": "找不到字段：{fieldName}",
     "controls.controlGroup.emptyState.addControlButtonTitle": "添加控件",

From 1ee97e1657e657f92d77581b09631ab936321717 Mon Sep 17 00:00:00 2001
From: Spencer <spencer@elastic.co>
Date: Mon, 6 Feb 2023 19:50:42 -0700
Subject: [PATCH 026/134] [kbn/babel-register] improve cache performance
 (#150261)

After https://github.com/elastic/kibana/pull/146212 it feels like the
babel-register cache is getting invalidated more frequently for some
reason. The current version of the cache only stores a single cache
entry for each file path, which shouldn't be too big of a problem but
with these changes several versions of a file will be cached. The
performance seems about equal, but because the cache contains multiple
versions of a single file we should spend less time transpiling files
when switching branches often.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 package.json                                  |   1 +
 packages/kbn-babel-register/BUILD.bazel       |   1 +
 packages/kbn-babel-register/cache/index.js    |   5 +-
 .../kbn-babel-register/cache/lmdb_cache.js    | 212 ++++++------------
 .../cache/lmdb_cache.test.ts                  |  43 ++--
 .../cache/no_cache_cache.js                   |   4 +
 packages/kbn-babel-register/cache/types.ts    |  12 +-
 packages/kbn-babel-register/index.js          |  14 +-
 .../kbn-babel-register/transforms/babel.js    |  17 +-
 .../kbn-babel-register/transforms/peggy.js    |  20 +-
 packages/kbn-babel-register/tsconfig.json     |   1 -
 packages/kbn-cli-dev-mode/src/watcher.ts      |   2 +-
 yarn.lock                                     |   5 +
 13 files changed, 127 insertions(+), 210 deletions(-)

diff --git a/package.json b/package.json
index d26b6bd79b0c2..78fa43cc621e1 100644
--- a/package.json
+++ b/package.json
@@ -1051,6 +1051,7 @@
     "cypress-react-selector": "^3.0.0",
     "cypress-real-events": "^1.7.6",
     "cypress-recurse": "^1.26.0",
+    "date-fns": "^2.29.3",
     "debug": "^2.6.9",
     "delete-empty": "^2.0.0",
     "dependency-check": "^4.1.0",
diff --git a/packages/kbn-babel-register/BUILD.bazel b/packages/kbn-babel-register/BUILD.bazel
index a151c4e54c613..f97499a481baa 100644
--- a/packages/kbn-babel-register/BUILD.bazel
+++ b/packages/kbn-babel-register/BUILD.bazel
@@ -35,6 +35,7 @@ BUNDLER_DEPS = [
   "@npm//chalk",
   "@npm//pirates",
   "@npm//lmdb",
+  "@npm//date-fns",
   "@npm//source-map-support",
   "//packages/kbn-repo-packages",
   "//packages/kbn-repo-info",
diff --git a/packages/kbn-babel-register/cache/index.js b/packages/kbn-babel-register/cache/index.js
index 7838a6c89028b..ea03e1396361e 100644
--- a/packages/kbn-babel-register/cache/index.js
+++ b/packages/kbn-babel-register/cache/index.js
@@ -10,7 +10,6 @@ const Fs = require('fs');
 const Path = require('path');
 const Crypto = require('crypto');
 
-const { readHashOfPackageMap } = require('@kbn/repo-packages');
 const babel = require('@babel/core');
 const peggy = require('@kbn/peggy');
 const { REPO_ROOT, UPSTREAM_BRANCH } = require('@kbn/repo-info');
@@ -25,7 +24,6 @@ const { getBabelOptions } = require('@kbn/babel-transform');
  */
 function determineCachePrefix() {
   const json = JSON.stringify({
-    synthPkgMapHash: readHashOfPackageMap(),
     babelVersion: babel.version,
     peggyVersion: peggy.version,
     // get a config for a fake js, ts, and tsx file to make sure we
@@ -63,8 +61,7 @@ function getCache() {
   if (lmdbAvailable()) {
     log?.write('lmdb is available, using lmdb cache\n');
     return new (require('./lmdb_cache').LmdbCache)({
-      pathRoot: REPO_ROOT,
-      dir: Path.resolve(REPO_ROOT, 'data/babel_register_cache_v1', UPSTREAM_BRANCH),
+      dir: Path.resolve(REPO_ROOT, 'data/babel_register_cache', UPSTREAM_BRANCH),
       prefix: determineCachePrefix(),
       log,
     });
diff --git a/packages/kbn-babel-register/cache/lmdb_cache.js b/packages/kbn-babel-register/cache/lmdb_cache.js
index 1c69ba1ed12a9..fe2179a591378 100644
--- a/packages/kbn-babel-register/cache/lmdb_cache.js
+++ b/packages/kbn-babel-register/cache/lmdb_cache.js
@@ -7,17 +7,21 @@
  */
 
 const Path = require('path');
+const Crypto = require('crypto');
+const startOfDay = /** @type {import('date-fns/startOfDay').default} */ (
+  /** @type {unknown} */ (require('date-fns/startOfDay'))
+);
 
 const chalk = require('chalk');
 const LmdbStore = require('lmdb');
 
-const GLOBAL_ATIME = `${Date.now()}`;
+const GLOBAL_ATIME = startOfDay(new Date()).valueOf();
 const MINUTE = 1000 * 60;
 const HOUR = MINUTE * 60;
 const DAY = HOUR * 24;
 
 /** @typedef {import('./types').Cache} CacheInterface */
-/** @typedef {import('lmdb').Database<string, string>} Db */
+/** @typedef {import('lmdb').Database<import('./types').CacheEntry, string>} Db */
 
 /**
  * @param {Db} db
@@ -31,63 +35,29 @@ const dbName = (db) =>
  * @implements {CacheInterface}
  */
 class LmdbCache {
-  /** @type {import('lmdb').RootDatabase<string, string>} */
-  #codes;
-  /** @type {Db} */
-  #atimes;
-  /** @type {Db} */
-  #mtimes;
-  /** @type {Db} */
-  #sourceMaps;
-  /** @type {string} */
-  #pathRoot;
-  /** @type {string} */
-  #prefix;
+  /** @type {import('lmdb').RootDatabase<import('./types').CacheEntry, string>} */
+  #db;
   /** @type {import('stream').Writable | undefined} */
   #log;
-  /** @type {ReturnType<typeof setTimeout>} */
-  #timer;
+  /** @type {string} */
+  #prefix;
 
   /**
    * @param {import('./types').CacheConfig} config
    */
   constructor(config) {
-    if (!Path.isAbsolute(config.pathRoot)) {
-      throw new Error('cache requires an absolute path to resolve paths relative to');
-    }
-
-    this.#pathRoot = config.pathRoot;
-    this.#prefix = config.prefix;
     this.#log = config.log;
-
-    this.#codes = LmdbStore.open(config.dir, {
-      name: 'codes',
-      encoding: 'string',
-      maxReaders: 500,
-    });
-
-    // TODO: redundant 'name' syntax is necessary because of a bug that I have yet to fix
-    this.#atimes = this.#codes.openDB('atimes', {
-      name: 'atimes',
-      encoding: 'string',
-    });
-
-    this.#mtimes = this.#codes.openDB('mtimes', {
-      name: 'mtimes',
-      encoding: 'string',
-    });
-
-    this.#sourceMaps = this.#codes.openDB('sourceMaps', {
-      name: 'sourceMaps',
-      encoding: 'string',
+    this.#prefix = config.prefix;
+    this.#db = LmdbStore.open(Path.resolve(config.dir, 'v5'), {
+      name: 'db',
+      encoding: 'json',
     });
 
-    // after the process has been running for 30 minutes prune the
-    // keys which haven't been used in 30 days. We use `unref()` to
-    // make sure this timer doesn't hold other processes open
-    // unexpectedly
-    this.#timer = setTimeout(() => {
-      this.#pruneOldKeys().catch((error) => {
+    const lastClean = this.#db.get('@last clean');
+    if (!lastClean || lastClean[0] < GLOBAL_ATIME - 7 * DAY) {
+      try {
+        this.#pruneOldKeys();
+      } catch (error) {
         process.stderr.write(`
 Failed to cleanup @kbn/babel-register cache:
 
@@ -95,83 +65,60 @@ Failed to cleanup @kbn/babel-register cache:
 
 To eliminate this problem you may want to delete the "${Path.relative(process.cwd(), config.dir)}"
 directory and report this error to the Operations team.\n`);
-      });
-    }, 30 * MINUTE);
-
-    // timer.unref is not defined in jest which emulates the dom by default
-    if (typeof this.#timer.unref === 'function') {
-      this.#timer.unref();
+      } finally {
+        this.#db.putSync('@last clean', [GLOBAL_ATIME, '', {}]);
+      }
     }
   }
 
   /**
+   * Get the cache key of the path and source from disk of a file
    * @param {string} path
+   * @param {string} source
+   * @returns {string}
    */
-  getMtime(path) {
-    return this.#safeGet(this.#mtimes, this.#getKey(path));
+  getKey(path, source) {
+    return `${this.#prefix}:${Crypto.createHash('sha1').update(path).update(source).digest('hex')}`;
   }
 
   /**
-   * @param {string} path
+   * @param {string} key
+   * @returns {string|undefined}
    */
-  getCode(path) {
-    const key = this.#getKey(path);
-    const code = this.#safeGet(this.#codes, key);
+  getCode(key) {
+    const entry = this.#safeGet(this.#db, key);
 
-    if (code !== undefined) {
+    if (entry !== undefined && entry[0] !== GLOBAL_ATIME) {
       // when we use a file from the cache set the "atime" of that cache entry
       // so that we know which cache items we use and which haven't been
-      // touched in a long time (currently 30 days)
-      this.#safePut(this.#atimes, key, GLOBAL_ATIME);
+      // used in a long time (currently 30 days)
+      this.#safePut(this.#db, key, [GLOBAL_ATIME, entry[1], entry[2]]);
     }
 
-    return code;
+    return entry?.[1];
   }
 
   /**
-   * @param {string} path
-   */
-  getSourceMap(path) {
-    const map = this.#safeGet(this.#sourceMaps, this.#getKey(path));
-    if (typeof map === 'string') {
-      return JSON.parse(map);
-    }
-  }
-
-  close() {
-    clearTimeout(this.#timer);
-  }
-
-  /**
-   * @param {string} path
-   * @param {{ mtime: string; code: string; map?: any }} file
+   * @param {string} key
+   * @returns {object|undefined}
    */
-  async update(path, file) {
-    const key = this.#getKey(path);
-
-    this.#safePut(this.#atimes, key, GLOBAL_ATIME);
-    this.#safePut(this.#mtimes, key, file.mtime);
-    this.#safePut(this.#codes, key, file.code);
-
-    if (file.map) {
-      this.#safePut(this.#sourceMaps, key, JSON.stringify(file.map));
+  getSourceMap(key) {
+    const entry = this.#safeGet(this.#db, key);
+    if (entry) {
+      return entry[2];
     }
   }
 
   /**
-   * @param {string} path
+   * @param {string} key
+   * @param {{ code: string, map: object }} entry
    */
-  #getKey(path) {
-    const normalizedPath =
-      Path.sep !== '/'
-        ? Path.relative(this.#pathRoot, path).split(Path.sep).join('/')
-        : Path.relative(this.#pathRoot, path);
-
-    return `${this.#prefix}:${normalizedPath}`;
+  async update(key, entry) {
+    this.#safePut(this.#db, key, [GLOBAL_ATIME, entry.code, entry.map]);
   }
 
   /**
-   * @param {LmdbStore.Database<string, string>} db
+   * @param {Db} db
    * @param {string} key
    */
   #safeGet(db, key) {
@@ -190,9 +137,9 @@ directory and report this error to the Operations team.\n`);
   }
 
   /**
-   * @param {LmdbStore.Database<string, string>} db
+   * @param {Db} db
    * @param {string} key
-   * @param {string} value
+   * @param {import('./types').CacheEntry} value
    */
   #safePut(db, key, value) {
     try {
@@ -205,7 +152,7 @@ directory and report this error to the Operations team.\n`);
 
   /**
    * @param {string} type
-   * @param {LmdbStore.Database<string, string>} db
+   * @param {Db} db
    * @param {string} key
    */
   #debug(type, db, key) {
@@ -214,7 +161,7 @@ directory and report this error to the Operations team.\n`);
 
   /**
    * @param {'GET' | 'PUT'} type
-   * @param {LmdbStore.Database<string, string>} db
+   * @param {Db} db
    * @param {string} key
    * @param {Error} error
    */
@@ -227,51 +174,36 @@ directory and report this error to the Operations team.\n`);
     );
   }
 
-  async #pruneOldKeys() {
-    try {
-      const ATIME_LIMIT = Date.now() - 30 * DAY;
-      const BATCH_SIZE = 1000;
+  #pruneOldKeys() {
+    const ATIME_LIMIT = Date.now() - 30 * DAY;
 
-      /** @type {string[]} */
-      const validKeys = [];
-      /** @type {string[]} */
-      const invalidKeys = [];
+    /** @type {string[]} */
+    const toDelete = [];
+    const flushDeletes = () => {
+      if (!toDelete.length) {
+        return;
+      }
 
-      for (const { key, value } of this.#atimes.getRange()) {
-        const atime = parseInt(`${value}`, 10);
-        if (Number.isNaN(atime) || atime < ATIME_LIMIT) {
-          invalidKeys.push(key);
-        } else {
-          validKeys.push(key);
+      this.#db.transactionSync(() => {
+        for (const key of toDelete) {
+          this.#db.removeSync(key);
         }
+      });
+    };
 
-        if (validKeys.length + invalidKeys.length >= BATCH_SIZE) {
-          const promises = new Set();
-
-          if (invalidKeys.length) {
-            for (const k of invalidKeys) {
-              // all these promises are the same currently, so Set() will
-              // optimise this to a single promise, but I wouldn't be shocked
-              // if a future version starts returning independent promises so
-              // this is just for some future-proofing
-              promises.add(this.#atimes.remove(k));
-              promises.add(this.#mtimes.remove(k));
-              promises.add(this.#codes.remove(k));
-              promises.add(this.#sourceMaps.remove(k));
-            }
-          } else {
-            // delay a smidge to allow other things to happen before the next batch of checks
-            promises.add(new Promise((resolve) => setTimeout(resolve, 1)));
-          }
+    for (const { key, value } of this.#db.getRange()) {
+      if (Number.isNaN(value[0]) || value[0] < ATIME_LIMIT) {
+        toDelete.push(key);
 
-          invalidKeys.length = 0;
-          validKeys.length = 0;
-          await Promise.all(Array.from(promises));
+        // flush deletes early if there are many deleted
+        if (toDelete.length > 10_000) {
+          flushDeletes();
         }
       }
-    } catch {
-      // ignore errors, the cache is totally disposable and will rebuild if there is some sort of corruption
     }
+
+    // delete all the old keys
+    flushDeletes();
   }
 }
 
diff --git a/packages/kbn-babel-register/cache/lmdb_cache.test.ts b/packages/kbn-babel-register/cache/lmdb_cache.test.ts
index d752e45879aec..e1a8401ea9460 100644
--- a/packages/kbn-babel-register/cache/lmdb_cache.test.ts
+++ b/packages/kbn-babel-register/cache/lmdb_cache.test.ts
@@ -18,7 +18,7 @@ const DIR = Path.resolve(__dirname, '../__tmp__/cache');
 const makeTestLog = () => {
   const log = Object.assign(
     new Writable({
-      write(chunk, enc, cb) {
+      write(chunk, _, cb) {
         log.output += chunk;
         cb();
       },
@@ -39,50 +39,35 @@ const makeCache = (...options: ConstructorParameters<typeof LmdbCache>) => {
 };
 
 beforeEach(async () => await del(DIR));
-afterEach(async () => {
-  await del(DIR);
-  for (const instance of instances) {
-    instance.close();
-  }
-  instances.length = 0;
-});
+afterEach(async () => await del(DIR));
 
 it('returns undefined until values are set', async () => {
   const path = '/foo/bar.js';
-  const mtime = new Date().toJSON();
+  const source = `console.log("hi, hello")`;
   const log = makeTestLog();
   const cache = makeCache({
     dir: DIR,
     prefix: 'prefix',
     log,
-    pathRoot: '/foo/',
   });
 
-  expect(cache.getMtime(path)).toBe(undefined);
-  expect(cache.getCode(path)).toBe(undefined);
-  expect(cache.getSourceMap(path)).toBe(undefined);
+  const key = cache.getKey(path, source);
+  expect(cache.getCode(key)).toBe(undefined);
+  expect(cache.getSourceMap(key)).toBe(undefined);
 
-  await cache.update(path, {
-    mtime,
+  await cache.update(key, {
     code: 'var x = 1',
     map: { foo: 'bar' },
   });
 
-  expect(cache.getMtime(path)).toBe(mtime);
-  expect(cache.getCode(path)).toBe('var x = 1');
-  expect(cache.getSourceMap(path)).toEqual({ foo: 'bar' });
+  expect(cache.getCode(key)).toBe('var x = 1');
+  expect(cache.getSourceMap(key)).toEqual({ foo: 'bar' });
   expect(log.output).toMatchInlineSnapshot(`
-    "MISS   [mtimes]   prefix:bar.js
-    MISS   [codes]   prefix:bar.js
-    MISS   [sourceMaps]   prefix:bar.js
-    PUT   [atimes]   prefix:bar.js
-    PUT   [mtimes]   prefix:bar.js
-    PUT   [codes]   prefix:bar.js
-    PUT   [sourceMaps]   prefix:bar.js
-    HIT   [mtimes]   prefix:bar.js
-    HIT   [codes]   prefix:bar.js
-    PUT   [atimes]   prefix:bar.js
-    HIT   [sourceMaps]   prefix:bar.js
+    "MISS   [db]   prefix:05a4b8198c4ec215d54d94681ef00ca9ecb45931
+    MISS   [db]   prefix:05a4b8198c4ec215d54d94681ef00ca9ecb45931
+    PUT   [db]   prefix:05a4b8198c4ec215d54d94681ef00ca9ecb45931
+    HIT   [db]   prefix:05a4b8198c4ec215d54d94681ef00ca9ecb45931
+    HIT   [db]   prefix:05a4b8198c4ec215d54d94681ef00ca9ecb45931
     "
   `);
 });
diff --git a/packages/kbn-babel-register/cache/no_cache_cache.js b/packages/kbn-babel-register/cache/no_cache_cache.js
index b4608e866d3b6..5d5aac93af0f2 100644
--- a/packages/kbn-babel-register/cache/no_cache_cache.js
+++ b/packages/kbn-babel-register/cache/no_cache_cache.js
@@ -12,6 +12,10 @@
  * @implements {CacheInterface}
  */
 class NoCacheCache {
+  getKey() {
+    return '';
+  }
+
   getCode() {
     return undefined;
   }
diff --git a/packages/kbn-babel-register/cache/types.ts b/packages/kbn-babel-register/cache/types.ts
index 6438662ae2d65..5189d3e7f3918 100644
--- a/packages/kbn-babel-register/cache/types.ts
+++ b/packages/kbn-babel-register/cache/types.ts
@@ -9,16 +9,16 @@
 import { Writable } from 'stream';
 
 export interface CacheConfig {
-  pathRoot: string;
   dir: string;
   prefix: string;
   log?: Writable;
 }
 
 export interface Cache {
-  getMtime(path: string): string | undefined;
-  getCode(path: string): string | undefined;
-  getSourceMap(path: string): object | undefined;
-  update(path: string, opts: { mtime: string; code: string; map?: any }): Promise<void>;
-  close(): void;
+  getKey(path: string, source: string): string;
+  getCode(key: string): string | undefined;
+  getSourceMap(key: string): object | undefined;
+  update(key: string, entry: { code: string; map?: object | null }): Promise<void>;
 }
+
+export type CacheEntry = [atime: number, code: string, sourceMap: object];
diff --git a/packages/kbn-babel-register/index.js b/packages/kbn-babel-register/index.js
index ba20e1f1b18f0..457b0895919a4 100644
--- a/packages/kbn-babel-register/index.js
+++ b/packages/kbn-babel-register/index.js
@@ -41,6 +41,7 @@
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 
+const Fs = require('fs');
 const Path = require('path');
 
 const { addHook } = require('pirates');
@@ -105,7 +106,18 @@ function install(options = undefined) {
     environment: 'node',
     // @ts-expect-error bad source-map-support types
     retrieveSourceMap(path) {
-      const map = cache.getSourceMap(path);
+      if (!Path.isAbsolute(path)) {
+        return null;
+      }
+
+      let source;
+      try {
+        source = Fs.readFileSync(path, 'utf8');
+      } catch {
+        return null;
+      }
+
+      const map = cache.getSourceMap(cache.getKey(path, source));
       return map ? { map, url: null } : null;
     },
   });
diff --git a/packages/kbn-babel-register/transforms/babel.js b/packages/kbn-babel-register/transforms/babel.js
index a1557bd528896..8328a60d477bb 100644
--- a/packages/kbn-babel-register/transforms/babel.js
+++ b/packages/kbn-babel-register/transforms/babel.js
@@ -6,25 +6,18 @@
  * Side Public License, v 1.
  */
 
-const Fs = require('fs');
-
 const { transformCode } = require('@kbn/babel-transform');
 
 /** @type {import('./types').Transform} */
 const babelTransform = (path, source, cache) => {
-  const mtime = `${Fs.statSync(path).mtimeMs}`;
-
-  if (cache.getMtime(path) === mtime) {
-    const code = cache.getCode(path);
-    if (code) {
-      return code;
-    }
+  const key = cache.getKey(path, source);
+  const cached = cache.getCode(key);
+  if (cached) {
+    return cached;
   }
 
   const result = transformCode(path, source);
-
-  cache.update(path, {
-    mtime,
+  cache.update(key, {
     code: result.code,
     map: result.map,
   });
diff --git a/packages/kbn-babel-register/transforms/peggy.js b/packages/kbn-babel-register/transforms/peggy.js
index b87676ca03bc3..6df30526d36fb 100644
--- a/packages/kbn-babel-register/transforms/peggy.js
+++ b/packages/kbn-babel-register/transforms/peggy.js
@@ -6,27 +6,16 @@
  * Side Public License, v 1.
  */
 
-const Fs = require('fs');
-const Crypto = require('crypto');
-
 const Peggy = require('@kbn/peggy');
 
 /** @type {import('./types').Transform} */
 const peggyTransform = (path, source, cache) => {
   const config = Peggy.findConfigFile(path);
-  const mtime = `${Fs.statSync(path).mtimeMs}`;
-  const key = !config
-    ? path
-    : `${path}.config.${Crypto.createHash('sha256')
-        .update(config.source)
-        .digest('hex')
-        .slice(0, 8)}`;
+  const key = cache.getKey(path, source);
 
-  if (cache.getMtime(key) === mtime) {
-    const code = cache.getCode(key);
-    if (code) {
-      return code;
-    }
+  const cached = cache.getCode(key);
+  if (cached) {
+    return cached;
   }
 
   const code = Peggy.getJsSourceSync({
@@ -40,7 +29,6 @@ const peggyTransform = (path, source, cache) => {
 
   cache.update(key, {
     code,
-    mtime,
   });
 
   return code;
diff --git a/packages/kbn-babel-register/tsconfig.json b/packages/kbn-babel-register/tsconfig.json
index 09576d2904a81..96e50650eee66 100644
--- a/packages/kbn-babel-register/tsconfig.json
+++ b/packages/kbn-babel-register/tsconfig.json
@@ -16,7 +16,6 @@
     "@kbn/repo-info",
     "@kbn/babel-transform",
     "@kbn/peggy",
-    "@kbn/repo-packages",
   ],
   "exclude": [
     "target/**/*",
diff --git a/packages/kbn-cli-dev-mode/src/watcher.ts b/packages/kbn-cli-dev-mode/src/watcher.ts
index 660022b6fc571..e4ade054b473d 100644
--- a/packages/kbn-cli-dev-mode/src/watcher.ts
+++ b/packages/kbn-cli-dev-mode/src/watcher.ts
@@ -77,7 +77,7 @@ export class Watcher {
 
           // ignore changes in any devOnly package, these can't power the server so we can ignore them
           if (pkg?.devOnly) {
-            return;
+            return pkg.id === '@kbn/babel-register';
           }
 
           const result = this.classifier.classify(event.path);
diff --git a/yarn.lock b/yarn.lock
index fa46dea2940e9..8b1d994f4f695 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -12314,6 +12314,11 @@ date-fns@^1.27.2, date-fns@^1.30.1:
   resolved "https://registry.yarnpkg.com/date-fns/-/date-fns-1.30.1.tgz#2e71bf0b119153dbb4cc4e88d9ea5acfb50dc05c"
   integrity sha512-hBSVCvSmWC+QypYObzwGOd9wqdDpOt+0wl0KbU+R+uuZBS1jN8VsD1ss3irQDknRj5NvxiTF6oj/nDRnN/UQNw==
 
+date-fns@^2.29.3:
+  version "2.29.3"
+  resolved "https://registry.yarnpkg.com/date-fns/-/date-fns-2.29.3.tgz#27402d2fc67eb442b511b70bbdf98e6411cd68a8"
+  integrity sha512-dDCnyH2WnnKusqvZZ6+jA1O51Ibt8ZMRNkDZdyAyK4YfbDwa/cEmuztzG5pk6hqlp9aSBPYcjOlktquahGwGeA==
+
 date-now@^0.1.4:
   version "0.1.4"
   resolved "https://registry.yarnpkg.com/date-now/-/date-now-0.1.4.tgz#eaf439fd4d4848ad74e5cc7dbef200672b9e345b"

From 1d0b90bd1257f57cbd8981bd5d2b0de32b4603c9 Mon Sep 17 00:00:00 2001
From: Andrew Macri <andrew.macri@elastic.co>
Date: Mon, 6 Feb 2023 21:10:43 -0700
Subject: [PATCH 027/134] [Security Solution] Data Quality dashboard (#150063)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# [Security Solution] Data Quality dashboard

## Check ECS compatibility with just one click

With just one click, the _Data Quality dashboard_ checks all the indices used by the Security Solution, (or anything else), for compatibility with the [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html)

![checking_data_quality](https://user-images.githubusercontent.com/4459398/215989195-2f5e2126-9ece-4df6-9742-284c73442962.gif)

## Create cases from results

Create a single case containing all the results, or create cases for specific indices

![create_case_from_take_action](https://user-images.githubusercontent.com/4459398/215989342-4489cf68-69d1-4ac4-859c-d849c4778d68.gif)

## Interactive tabs put results in context

Expand any index to reveal interactive tabs

- Summary
- Incompatible fields
- Custom fields
- ECS complaint fields
- All fields

![tabs](https://user-images.githubusercontent.com/4459398/215989435-a363a9e5-8635-42d1-a0f7-5e0ddc6f9515.gif)

## Share comprehensive markdown reports

Share markdown reports containing the same content as the dashboard

![markdown_report](https://user-images.githubusercontent.com/4459398/215989555-72c53ed8-99f9-4be7-9181-6b9f365a8f6e.gif)

### On page load

When the Data Quality dashboard page loads, the alerts index, and any indices matching the selected `Data view` are displayed

![page_load](https://user-images.githubusercontent.com/4459398/215989957-3b4d52f1-eaa4-4d42-9e40-d556602b006b.png)

Only `hot`, `warm`, or `unmanaged` indices are displayed by default

Indices are not checked automatically when the dashboard loads

Click either :

- `Check all` to check all the indices on the page
- The expand button to automatically check (just) one index, and instantly view results

### Check all

When the `Check all` button is clicked

- The `Check all` button changes to a `Cancel` button
- The `Last checked: n <time unit> ago` text is replaced with a progress bar indicating how many Indices are left to check
- The `Checking <index name>` text will update as each index is checked. Text will wrap if necessary
- The results tables begin updating with results
- Pattern stats update to summarize each table
- Rolled up results for the entire page update after every index is checked

![running_before_errors](https://user-images.githubusercontent.com/4459398/215990059-43efd573-217f-47e8-8ed2-1b1de4766834.png)

<https://user-images.githubusercontent.com/4459398/216007795-2ebbc0c6-8c7a-49c7-a22c-b97d2a58dddd.mov>

When Check all, is running, the Data Quality dashboard adds a three second delay after every check completes, before beginning the next check.

Check all will keep checking indexes until the user cancels, or all indexes have (attempted to be) checked.

While Check all is running, users may simultaneously click on any index to check it on demand. The results are instantly rolled up when this happens.

When all checks complete, the page looks like this:

![all_results_no_errors](https://user-images.githubusercontent.com/4459398/215990208-b28e1ad4-d8fd-453b-a037-1123c4352469.png)

### Take action

Click the `Take action` popover to share the entire page of results via one of the following actions:

- Add to new case
- Copy to clipboard

![take_action_popover](https://user-images.githubusercontent.com/4459398/215990971-fff06bf3-cac5-418f-83fc-556caa4b9413.png)

![create_case_from_take_action](https://user-images.githubusercontent.com/4459398/216012412-812f7b84-94a7-462a-8574-2e05afa35efd.gif)

![copy_toast](https://user-images.githubusercontent.com/4459398/215992498-c83b9191-8226-4ab1-8170-1bc953083f5c.png)

### Expanding results

The `Incompatible fields` tab is always displayed by default when a result is expanded

The `Incompatible fields` tab shows a success message when a successful result is expanded

![incompatible_fields_zero](https://user-images.githubusercontent.com/4459398/215991201-2ff7158e-1787-4221-b2de-d7e5ee49c412.png)

The `Incompatible fields` tab shows, side by side, expected ECS mapping types vs the actual mapping types when they are different

![mapping_differences](https://user-images.githubusercontent.com/4459398/215990436-82bb969e-fab7-4f2b-97f1-f21fd5bc3641.png)

The `Incompatible fields` tab also compares field values expected by ECS vs the actual values in an index, when they are different

![expect_vs_actual_value](https://user-images.githubusercontent.com/4459398/215990341-2c5ce75b-03cc-4b72-9431-282dfd032844.png)

The `Incompatible fields` tab displays a callout that explains the consequences of having incompatible fields. The content is based on the following illustration, created by @MikePaquette

<img width="1264" alt="ecs_meter" src="https://user-images.githubusercontent.com/4459398/216016124-6fe89ab4-c364-40ec-8a6f-99349e6d583c.png">

The calllout has a call to action to create a case or copy a markdown report for just the expanded result

- Add to new case
- Copy to clipboard

![create_case_from_incompatable_fields_tab](https://user-images.githubusercontent.com/4459398/215990827-57506e26-06e3-4704-afb4-4bd8308b217a.png)

### Tabs

The Summary tab displays a call to action when incompatible fields are found

Click on any part of the Summary tab chart or legend to navigate to the corresponding tab

![summary_tab](https://user-images.githubusercontent.com/4459398/215990517-41e96cab-558a-4461-a34a-e149873841a4.png)

Clicking on the `Copy to clipboard` call to action in the Custom fields tab copies a markdown version of the table to the clipboard

![custom_fields_tab](https://user-images.githubusercontent.com/4459398/215990623-8c787d11-cf93-4321-a803-2133c81fcd1b.png)

The search feature of the ECS complaint fields tab may, for example, be used to verify a specific ECS complaint mapping exists

![ecs_complaint_fields_tab](https://user-images.githubusercontent.com/4459398/215990703-dc0b93b3-a3ed-447b-96c5-714d71f4177d.png)

The All fields tab displays the union of all other tabs

![all_fields_tab](https://user-images.githubusercontent.com/4459398/215990746-88eb8812-7a00-47f4-94fc-5105aad024c1.png)

### Data view selection

The `Data view` dropdown defaults to the `Security Default Data View`

![data_view_selection](https://user-images.githubusercontent.com/4459398/216020987-d710aa85-5ddc-4fa1-9a3f-c131e656da56.png)

The alerts index is always checked and included in the results, even when another Data View is selected

![alerts_index_always_included](https://user-images.githubusercontent.com/4459398/216022004-4a6adb46-5bc1-4619-ad46-7364d7565e3a.png)

### ILM phase options

![ilm_selection](https://user-images.githubusercontent.com/4459398/216023010-c3bb9e3e-9aec-487b-8757-e4736c06de7e.png)

Only `hot`, `warm`, or `unmanaged` indices may be selected for checking.

The `cold` and `frozen` options are disabled.

When all options in the `ILM phase` box are cleared, an informative empty prompt is displayed

![ilm_empty_prompt](https://user-images.githubusercontent.com/4459398/216029584-659fafda-92fb-4607-b61e-87aa3f0b45e8.png)

### Errors

Errors may occur for some (or all) indices. The `View errors` button appears when the first error occurs

![running_with_errors](https://user-images.githubusercontent.com/4459398/216024230-609ec815-e2e4-408f-b9a5-d12aad9f83c5.png)

Users may click the `View errors` button to view them, even while a check is in progress

![error_popover](https://user-images.githubusercontent.com/4459398/216755446-210996d8-605b-4d6b-8c90-cf94dc83a76b.png)

The Copy to clipboard button  in the errors popover copies a markdown version of the errors table to the clipboard

When errors occur, the same content shown in the Errors popover is automatically included in the markdown report created by the `Take action` menu

### Markdown reports

The content of markdown reports (created by the Take action menu) includes most of the content from the Data Quality dashboard that created it

In the screenshot below, the Data Quality dashboard is on the left, and a markdown report (pasted into Github) is on the right

![side_by_side_compare_1](https://user-images.githubusercontent.com/4459398/216026602-7cf7aaaa-b461-44e0-a03e-6690e3d87d3c.png)

Stats rollups and tables are included in markdown reports

![side_by_side_2](https://user-images.githubusercontent.com/4459398/216026872-d5319279-e4b2-4ac0-b291-06dc61ba108c.png)

Markdown reports use the same "expected vs actual" format to display the details of incompatible field mappings

### Navigation

The Data Quality dashboard is grouped with the existing Security Solution dashboards

![dashboards_page](https://user-images.githubusercontent.com/4459398/216057432-0ae99d57-4857-4270-bd7d-07bc96e27cb0.png)

It may also be launched via the side navigation

![side_nav](https://user-images.githubusercontent.com/4459398/216057528-2370b82a-dc92-4ea6-8519-7e8abc61acd0.png)

## Privileges

The privileges in the table below are required to check any pattern of indices, or any specific index:

| Privilege                                         | Required to                                                                                                                       | Required for API |
|-------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|------------------|
| `monitor` or `manage`  (`manage` builds on `monitor`) | List indices that match a pattern, and get document counts for an index  example: `GET logs-*/_stats`                             | `_stats`         |
| `view_index_metadata` or `manage_ilm`                 | List index ILM configs (e.g. hot) that match a pattern  example: `GET logs-*/_ilm/explain`                                        | `_ilm/explain`   |
| `view_index_metadata` or `manage`                     | Get index mappings for a specific index  example:  `GET .ds-logs-endpoint.events.process-default-2023.01.17-000001/_mapping`      | `_mapping`       |
| `read` or `read_cross_cluster`                        | Run aggregations to test for unallowed values  example:  `GET .ds-logs-endpoint.events.process-default-2023.01.17-000001/_search` | `_search`        |

Users may have some of the privileges required to check an index, but not all of them.

The built-in `viewer` role does not have the `monitor` (or `manage`) role. The following screenshot illustrates what a user will see if they login as a user with the `viewer` role:

![login_with_viewer_role](https://user-images.githubusercontent.com/4459398/216755590-b6c01a7b-73b1-4680-8db1-b9d1c0035f06.png)

# An actual markdown report (all content below)

The rest of the content below is pasted from an actual report, created via the `Take action` menu:

# Data quality

| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 17 | 15 | 17 | 1,404,514 |

## .alerts-security.alerts-default

`hot(1)`

| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 1 | 1 | 1 | 1,837 |

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .internal.alerts-security.alerts-default-000001 | 1,837 (100.0%) | 1 | `hot` |

### .internal.alerts-security.alerts-default-000001

The `.internal.alerts-security.alerts-default-000001` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .internal.alerts-security.alerts-default-000001 | 1,837 (100.0%) | 1 | `hot` |

### **Incompatible fields** `1` **Custom fields** `188` **ECS compliant fields** `1219` **All fields** `1408`

#### 1 incompatible field

Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.

❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported

#### Incompatible field values - .internal.alerts-security.alerts-default-000001

| Field | ECS values (expected) | Document values (actual) |
|-------|-----------------------|--------------------------|
| event.category | `authentication`, `configuration`, `database`, `driver`, `email`, `file`, `host`, `iam`, `intrusion_detection`, `malware`, `network`, `package`, `process`, `registry`, `session`, `threat`, `vulnerability`, `web` | `behavior` (62) |

## auditbeat-*

`hot(11)`  `unmanaged(1)`

| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 13 | 10 | 12 | 29,182 |

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.6.0-2023.01.17-000001 | 14,409 (49.4%) | 0 | `hot` |
| -- | .ds-auditbeat-8.5.3-2023.01.24-000001 | 2,857 (9.8%) | -- | `hot` |
| ✅ | .ds-auditbeat-8.2.3-2023.01.24-000001 | 2,246 (7.7%) | 0 | `hot` |
| ✅ | .ds-auditbeat-8.4.1-2023.01.24-000001 | 2,179 (7.5%) | 0 | `hot` |
| -- | .ds-auditbeat-8.3.3-2023.01.24-000001 | 1,921 (6.6%) | -- | `hot` |
| ✅ | auditbeat-7.16.0-2023.01.17-000001 | 1,880 (6.4%) | 0 | `hot` |
| ✅ | .ds-auditbeat-8.1.1-2023.01.24-000001 | 1,676 (5.7%) | 0 | `hot` |
| ✅ | .ds-auditbeat-8.2.2-2023.01.24-000001 | 1,578 (5.4%) | 0 | `hot` |
| ✅ | .ds-auditbeat-8.0.0-2023.01.24-000001 | 251 (0.9%) | 0 | `hot` |
| ❌ | auditbeat-7.10.2-2023.01.24-000001 | 111 (0.4%) | 12 | `hot` |
| ✅ | .ds-auditbeat-8.5.0-2023.01.24-000001 | 74 (0.3%) | 0 | `hot` |
| ❌ | auditbeat-custom-empty-index-1 | 0 (0.0%) | 1 | `unmanaged` |

### .ds-auditbeat-8.6.0-2023.01.17-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.6.0-2023.01.17-000001 | 14,409 (49.4%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `549` **ECS compliant fields** `1210` **All fields** `1759`

### .ds-auditbeat-8.2.3-2023.01.24-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.2.3-2023.01.24-000001 | 2,246 (7.7%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `510` **ECS compliant fields** `1210` **All fields** `1720`

### .ds-auditbeat-8.4.1-2023.01.24-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.4.1-2023.01.24-000001 | 2,179 (7.5%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `509` **ECS compliant fields** `1210` **All fields** `1719`

### auditbeat-7.16.0-2023.01.17-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | auditbeat-7.16.0-2023.01.17-000001 | 1,880 (6.4%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `523` **ECS compliant fields** `1111` **All fields** `1634`

### .ds-auditbeat-8.1.1-2023.01.24-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.1.1-2023.01.24-000001 | 1,676 (5.7%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `510` **ECS compliant fields** `1204` **All fields** `1714`

### .ds-auditbeat-8.2.2-2023.01.24-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.2.2-2023.01.24-000001 | 1,578 (5.4%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `510` **ECS compliant fields** `1210` **All fields** `1720`

### .ds-auditbeat-8.0.0-2023.01.24-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.0.0-2023.01.24-000001 | 251 (0.9%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `510` **ECS compliant fields** `1204` **All fields** `1714`

### auditbeat-7.10.2-2023.01.24-000001

The `auditbeat-7.10.2-2023.01.24-000001` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | auditbeat-7.10.2-2023.01.24-000001 | 111 (0.4%) | 12 | `hot` |

### **Incompatible fields** `12` **Custom fields** `467` **ECS compliant fields** `602` **All fields** `1081`

#### 12 incompatible fields

Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.

❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported

#### Incompatible field mappings - auditbeat-7.10.2-2023.01.24-000001

| Field | ECS mapping type (expected) | Index mapping type (actual) |
|-------|-----------------------------|-----------------------------|
| error.message | `match_only_text` | `text` |
| error.stack_trace | `wildcard` | `keyword` |
| http.request.body.content | `wildcard` | `keyword` |
| http.response.body.content | `wildcard` | `keyword` |
| message | `match_only_text` | `text` |
| process.command_line | `wildcard` | `keyword` |
| process.parent.command_line | `wildcard` | `keyword` |
| registry.data.strings | `wildcard` | `keyword` |
| url.full | `wildcard` | `keyword` |
| url.original | `wildcard` | `keyword` |
| url.path | `wildcard` | `keyword` |

#### Incompatible field values - auditbeat-7.10.2-2023.01.24-000001

| Field | ECS values (expected) | Document values (actual) |
|-------|-----------------------|--------------------------|
| event.kind | `alert`, `enrichment`, `event`, `metric`, `state`, `pipeline_error`, `signal` | `error` (1) |

### .ds-auditbeat-8.5.0-2023.01.24-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.5.0-2023.01.24-000001 | 74 (0.3%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `509` **ECS compliant fields** `1210` **All fields** `1719`

### auditbeat-custom-empty-index-1

The `auditbeat-custom-empty-index-1` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | auditbeat-custom-empty-index-1 | 0 (0.0%) | 1 | `unmanaged` |

### **Incompatible fields** `1` **Custom fields** `0` **ECS compliant fields** `0` **All fields** `0`

#### 1 incompatible field

Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.

❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported

#### Incompatible field mappings - auditbeat-custom-empty-index-1

| Field | ECS mapping type (expected) | Index mapping type (actual) |
|-------|-----------------------------|-----------------------------|
| @timestamp | `date` | `-` |

## logs-*

`hot(2)`

| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 3 | 2 | 2 | 602 |

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .ds-logs-endpoint.alerts-default-2023.01.17-000001 | 342 (56.8%) | 2 | `hot` |
| ❌ | .ds-logs-endpoint.events.process-default-2023.01.17-000001 | 260 (43.2%) | 1 | `hot` |

### .ds-logs-endpoint.alerts-default-2023.01.17-000001

The `.ds-logs-endpoint.alerts-default-2023.01.17-000001` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .ds-logs-endpoint.alerts-default-2023.01.17-000001 | 342 (56.8%) | 2 | `hot` |

### **Incompatible fields** `2` **Custom fields** `857` **ECS compliant fields** `675` **All fields** `1534`

#### 2 incompatible fields

Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.

❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported

#### Incompatible field mappings - .ds-logs-endpoint.alerts-default-2023.01.17-000001

| Field | ECS mapping type (expected) | Index mapping type (actual) |
|-------|-----------------------------|-----------------------------|
| process.env_vars | `keyword` | `object` |

#### Incompatible field values - .ds-logs-endpoint.alerts-default-2023.01.17-000001

| Field | ECS values (expected) | Document values (actual) |
|-------|-----------------------|--------------------------|
| event.category | `authentication`, `configuration`, `database`, `driver`, `email`, `file`, `host`, `iam`, `intrusion_detection`, `malware`, `network`, `package`, `process`, `registry`, `session`, `threat`, `vulnerability`, `web` | `behavior` (45) |

### .ds-logs-endpoint.events.process-default-2023.01.17-000001

The `.ds-logs-endpoint.events.process-default-2023.01.17-000001` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .ds-logs-endpoint.events.process-default-2023.01.17-000001 | 260 (43.2%) | 1 | `hot` |

### **Incompatible fields** `1` **Custom fields** `130` **ECS compliant fields** `304` **All fields** `435`

#### 1 incompatible field

Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.

❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported

#### Incompatible field mappings - .ds-logs-endpoint.events.process-default-2023.01.17-000001

| Field | ECS mapping type (expected) | Index mapping type (actual) |
|-------|-----------------------------|-----------------------------|
| process.env_vars | `keyword` | `object` |

## packetbeat-*

`hot(2)`

| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 0 | 2 | 2 | 1,372,893 |

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-packetbeat-8.6.0-2023.01.17-000001 | 704,062 (51.3%) | 0 | `hot` |
| ✅ | .ds-packetbeat-8.4.1-2023.01.24-000001 | 668,831 (48.7%) | 0 | `hot` |

### .ds-packetbeat-8.6.0-2023.01.17-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-packetbeat-8.6.0-2023.01.17-000001 | 704,062 (51.3%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `604` **ECS compliant fields** `1209` **All fields** `1813`

### .ds-packetbeat-8.4.1-2023.01.24-000001

| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-packetbeat-8.4.1-2023.01.24-000001 | 668,831 (48.7%) | 0 | `hot` |

### **Incompatible fields** `0` **Custom fields** `604` **ECS compliant fields** `1209` **All fields** `1813`

## Errors

Some indices were not checked for Data Quality

Errors may occur when pattern or index metadata is temporarily unavailable, or because you don't have the privileges required for access

The following privileges are required to check an index:
- `monitor` or `manage`
- `view_index_metadata`
- `read` or `read_cross_cluster`


| Pattern | Index | Error |
|---------|-------|-------|
| .alerts-security.alerts-default | -- | `Error loading stats: Error: Forbidden` |
| auditbeat-* | -- | `Error loading stats: Error: Forbidden` |
| logs-* | -- | `Error loading stats: Error: Forbidden` |
| packetbeat-* | -- | `Error loading stats: Error: Forbidden` |

See also: https://github.com/elastic/security-team/issues/4559
---
 .eslintrc.js                                  |   10 +
 .github/CODEOWNERS                            |    3 +
 .i18nrc.json                                  |    1 +
 docs/developer/plugin-list.asciidoc           |    4 +
 package.json                                  |    1 +
 .../styled_components_files.js                |    2 +-
 packages/kbn-eslint-config/.eslintrc.js       |    2 +-
 src/dev/precommit_hook/casing_check_config.js |    2 +-
 tsconfig.base.json                            |    4 +
 .../kbn-ecs-data-quality-dashboard/README.md  |   12 +
 .../ecs_allowed_values/index.tsx              |   39 +
 .../compare_fields_table/helpers.tsx          |  214 +
 .../compare_fields_table/index.tsx            |   55 +
 .../index_invalid_values/index.tsx            |   46 +
 .../compare_fields_table/translations.ts      |   75 +
 .../allowed_values/helpers.tsx                |   44 +
 .../data_quality_panel/body/index.tsx         |  125 +
 .../check_status/index.tsx                    |  105 +
 .../errors_popover/index.tsx                  |  113 +
 .../errors_popover/translations.ts            |   85 +
 .../errors_viewer/helpers.tsx                 |   44 +
 .../errors_viewer/index.tsx                   |   46 +
 .../errors_viewer/translations.ts             |   20 +
 .../data_quality_summary/index.tsx            |  131 +
 .../summary_actions/check_all/check_index.ts  |   99 +
 .../summary_actions/check_all/helpers.ts      |   63 +
 .../summary_actions/check_all/index.tsx       |  155 +
 .../summary_actions/check_all/translations.ts |   14 +
 .../summary_actions/index.tsx                 |  240 +
 .../take_action_menu/index.tsx                |  125 +
 .../take_action_menu/translations.ts          |   15 +
 .../error_empty_prompt/index.tsx              |   36 +
 .../ilm_phase_counts/index.tsx                |   49 +
 .../index_properties/empty_prompt_body.tsx    |   18 +
 .../index_properties/empty_prompt_title.tsx   |   18 +
 .../index_properties/helpers.ts               |   91 +
 .../index_properties/index.tsx                |  276 +
 .../index_properties/markdown/helpers.ts      |  379 +
 .../index_properties/translations.ts          |  383 +
 .../loading_empty_prompt/index.tsx            |   23 +
 .../panel_subtitle/index.tsx                  |   34 +
 .../data_quality_panel/pattern/helpers.ts     |  235 +
 .../data_quality_panel/pattern/index.tsx      |  252 +
 .../pattern/pattern_summary/index.tsx         |   58 +
 .../pattern_summary/pattern_label/helpers.ts  |   29 +
 .../pattern_summary/pattern_label/index.tsx   |   72 +
 .../pattern_label/translations.ts             |   26 +
 .../pattern_summary/stats_rollup/index.tsx    |  143 +
 .../pattern/pattern_summary/translations.ts   |   29 +
 .../pattern/translations.ts                   |   34 +
 .../data_quality_panel/stat_label/index.tsx   |   32 +
 .../stat_label/translations.ts                |  114 +
 .../summary_table/helpers.tsx                 |  195 +
 .../summary_table/index.tsx                   |  114 +
 .../summary_table/translations.ts             |   82 +
 .../data_quality_panel/tabs/all_tab/index.tsx |   57 +
 .../tabs/callouts/custom_callout/index.tsx    |   42 +
 .../callouts/incompatible_callout/index.tsx   |   45 +
 .../missing_timestamp_callout/index.tsx       |   31 +
 .../tabs/custom_tab/helpers.ts                |   93 +
 .../tabs/custom_tab/index.tsx                 |  109 +
 .../tabs/ecs_compliant_tab/index.tsx          |   85 +
 .../data_quality_panel/tabs/helpers.tsx       |  188 +
 .../tabs/incompatible_tab/helpers.ts          |  149 +
 .../tabs/incompatible_tab/index.tsx           |  172 +
 .../tabs/incompatible_tab/translations.ts     |   20 +
 .../data_quality_panel/tabs/styles.tsx        |   17 +
 .../summary_tab/callout_summary/index.tsx     |  135 +
 .../tabs/summary_tab/helpers.ts               |  114 +
 .../tabs/summary_tab/index.tsx                |   93 +
 .../chart_legend/chart_legend_item.tsx        |   39 +
 .../chart_legend/index.tsx                    |   86 +
 .../ecs_summary_donut_chart/helpers.ts        |   11 +
 .../ecs_summary_donut_chart/index.tsx         |  190 +
 .../ecs_summary_donut_chart/translations.ts   |   19 +
 .../data_quality/example/mappings/alerts.ts   | 5318 ++++++++++
 .../data_quality/example/mappings/logs.ts     | 9229 +++++++++++++++++
 .../impl/data_quality/helpers.test.ts         |   28 +
 .../impl/data_quality/helpers.ts              |  335 +
 .../ilm_phases_empty_prompt/index.tsx         |   92 +
 .../ilm_phases_empty_prompt/translations.ts   |   62 +
 .../impl/data_quality/index.tsx               |   89 +
 .../impl/data_quality/styles.tsx              |   18 +
 .../impl/data_quality/translations.ts         |  257 +
 .../impl/data_quality/types.ts                |  155 +
 .../use_add_to_new_case/index.tsx             |   60 +
 .../use_add_to_new_case/translations.ts       |   25 +
 .../data_quality/use_ilm_explain/index.tsx    |   69 +
 .../impl/data_quality/use_mappings/helpers.ts |   35 +
 .../impl/data_quality/use_mappings/index.tsx  |   54 +
 .../use_results_rollup/helpers.ts             |  135 +
 .../data_quality/use_results_rollup/index.tsx |  117 +
 .../impl/data_quality/use_stats/index.tsx     |   66 +
 .../use_unallowed_values/helpers.ts           |   91 +
 .../use_unallowed_values/index.ts             |   81 +
 .../kbn-ecs-data-quality-dashboard/index.ts   |   19 +
 .../jest.config.js                            |   12 +
 .../kibana.jsonc                              |    5 +
 .../package.json                              |    6 +
 .../tsconfig.json                             |   23 +
 .../ecs_data_quality_dashboard/README.md      |   10 +
 .../common/constants.ts                       |   15 +
 .../ecs_data_quality_dashboard/jest.config.js |   18 +
 .../ecs_data_quality_dashboard/kibana.json    |   14 +
 .../server/__mocks__/request.ts               |   11 +
 .../server/__mocks__/request_context.ts       |   56 +
 .../server/__mocks__/response.ts              |   12 +
 .../server/__mocks__/server.ts                |   95 +
 .../server/__mocks__/test_adapters.ts         |   64 +
 .../get_unallowed_field_requests.test.ts      |  112 +
 .../helpers/get_unallowed_field_requests.ts   |   68 +
 .../server/index.ts                           |   21 +
 .../server/lib/build_response/index.ts        |   68 +
 .../server/lib/fetch_ilm_explain.ts           |   17 +
 .../server/lib/fetch_mappings.ts              |   18 +
 .../server/lib/fetch_stats.ts                 |   18 +
 .../server/lib/get_unallowed_field_values.ts  |   32 +
 .../server/lib/index.ts                       |   11 +
 .../server/plugin.ts                          |   45 +
 .../server/routes/get_ilm_explain.test.ts     |  113 +
 .../server/routes/get_ilm_explain.ts          |   45 +
 .../server/routes/get_index_mappings.test.ts  |   80 +
 .../server/routes/get_index_mappings.ts       |   45 +
 .../server/routes/get_index_stats.test.ts     |   82 +
 .../server/routes/get_index_stats.ts          |   45 +
 .../routes/get_unallowed_field_values.test.ts |  132 +
 .../routes/get_unallowed_field_values.ts      |   44 +
 .../server/routes/index.ts                    |   10 +
 .../server/schemas/common.ts                  |   38 +
 .../server/schemas/get_ilm_explain.ts         |   12 +
 .../server/schemas/get_index_mappings.ts      |   11 +
 .../server/schemas/get_index_stats.ts         |   12 +
 .../schemas/get_unallowed_field_values.ts     |   22 +
 .../server/types.ts                           |   12 +
 .../ecs_data_quality_dashboard/tsconfig.json  |   25 +
 .../security_solution/common/constants.ts     |    4 +
 x-pack/plugins/security_solution/kibana.json  |    1 +
 .../public/app/deep_links/index.ts            |   13 +
 .../public/app/home/home_navigations.ts       |    8 +
 .../public/app/translations.ts                |    7 +
 .../common/components/navigation/types.ts     |    4 +-
 .../__snapshots__/index.test.tsx.snap         |   10 +
 .../index.test.tsx                            |    7 +-
 .../use_navigation_items.tsx                  |    1 +
 .../common/containers/sourcerer/index.tsx     |    2 +
 .../images/data_quality_dashboard_page.png    |  Bin 0 -> 84409 bytes
 .../public/landing_pages/links.ts             |    8 +-
 .../public/overview/links.ts                  |   24 +
 .../public/overview/pages/data_quality.tsx    |  262 +
 .../public/overview/pages/translations.ts     |   54 +
 .../public/overview/routes.tsx                |   14 +
 .../plugins/security_solution/tsconfig.json   |    1 +
 yarn.lock                                     |    4 +
 153 files changed, 24543 insertions(+), 6 deletions(-)
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/README.md
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/ecs_allowed_values/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/helpers.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/index_invalid_values/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/allowed_values/helpers.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/body/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/check_status/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_popover/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_popover/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/helpers.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/check_index.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/take_action_menu/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/take_action_menu/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/error_empty_prompt/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/ilm_phase_counts/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/empty_prompt_body.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/empty_prompt_title.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/markdown/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/loading_empty_prompt/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/panel_subtitle/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/stats_rollup/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/stat_label/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/stat_label/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/helpers.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/all_tab/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/custom_callout/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/incompatible_callout/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/missing_timestamp_callout/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/custom_tab/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/custom_tab/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/ecs_compliant_tab/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/helpers.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/styles.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/callout_summary/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/chart_legend/chart_legend_item.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/chart_legend/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/example/mappings/alerts.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/example/mappings/logs.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.test.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ilm_phases_empty_prompt/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ilm_phases_empty_prompt/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/styles.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/types.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_add_to_new_case/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_add_to_new_case/translations.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_ilm_explain/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_mappings/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_mappings/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_results_rollup/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_results_rollup/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_stats/index.tsx
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_unallowed_values/helpers.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_unallowed_values/index.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/index.ts
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/jest.config.js
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/kibana.jsonc
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/package.json
 create mode 100644 x-pack/packages/kbn-ecs-data-quality-dashboard/tsconfig.json
 create mode 100755 x-pack/plugins/ecs_data_quality_dashboard/README.md
 create mode 100755 x-pack/plugins/ecs_data_quality_dashboard/common/constants.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/jest.config.js
 create mode 100755 x-pack/plugins/ecs_data_quality_dashboard/kibana.json
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/request.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/request_context.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/response.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/test_adapters.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/helpers/get_unallowed_field_requests.test.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/helpers/get_unallowed_field_requests.ts
 create mode 100755 x-pack/plugins/ecs_data_quality_dashboard/server/index.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/lib/build_response/index.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_ilm_explain.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_mappings.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_stats.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/lib/get_unallowed_field_values.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/lib/index.ts
 create mode 100755 x-pack/plugins/ecs_data_quality_dashboard/server/plugin.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.test.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.test.ts
 create mode 100755 x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.test.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.test.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/routes/index.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/schemas/common.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_ilm_explain.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_index_mappings.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_index_stats.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_unallowed_field_values.ts
 create mode 100755 x-pack/plugins/ecs_data_quality_dashboard/server/types.ts
 create mode 100644 x-pack/plugins/ecs_data_quality_dashboard/tsconfig.json
 create mode 100644 x-pack/plugins/security_solution/public/common/images/data_quality_dashboard_page.png
 create mode 100644 x-pack/plugins/security_solution/public/overview/pages/data_quality.tsx

diff --git a/.eslintrc.js b/.eslintrc.js
index d79b0400368ab..2ce780c297a7d 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -946,6 +946,8 @@ module.exports = {
     {
       // front end and common typescript and javascript files only
       files: [
+        'x-pack/plugins/ecs_data_quality_dashboard/common/**/*.{js,mjs,ts,tsx}',
+        'x-pack/packages/kbn-ecs-data-quality-dashboard/common/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/security_solution/public/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/security_solution/common/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/timelines/public/**/*.{js,mjs,ts,tsx}',
@@ -971,11 +973,15 @@ module.exports = {
       // We use this section to add rules in which we do not want to apply to test files.
       // This should be a very small set as most linter rules are useful for tests as well.
       files: [
+        'x-pack/plugins/ecs_data_quality_dashboard/**/*.{ts,tsx}',
+        'x-pack/packages/kbn-ecs-data-quality-dashboard/**/*.{ts,tsx}',
         'x-pack/plugins/security_solution/**/*.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{ts,tsx}',
         'x-pack/plugins/cases/**/*.{ts,tsx}',
       ],
       excludedFiles: [
+        'x-pack/plugins/ecs_data_quality_dashboard/**/*.{test,mock,test_helper}.{ts,tsx}',
+        'x-pack/packages/kbn-ecs-data-quality-dashboard/**/*.{test,mock,test_helper}.{ts,tsx}',
         'x-pack/plugins/security_solution/**/*.{test,mock,test_helper}.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{test,mock,test_helper}.{ts,tsx}',
         'x-pack/plugins/cases/**/*.{test,mock,test_helper}.{ts,tsx}',
@@ -987,6 +993,8 @@ module.exports = {
     {
       // typescript only for front and back end
       files: [
+        'x-pack/plugins/ecs_data_quality_dashboard/**/*.{ts,tsx}',
+        'x-pack/packages/kbn-ecs-data-quality-dashboard/**/*.{ts,tsx}',
         'x-pack/plugins/security_solution/**/*.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{ts,tsx}',
         'x-pack/plugins/cases/**/*.{ts,tsx}',
@@ -1017,6 +1025,8 @@ module.exports = {
     {
       // typescript and javascript for front and back end
       files: [
+        'x-pack/plugins/ecs_data_quality_dashboard/**/*.{js,mjs,ts,tsx}',
+        'x-pack/packages/kbn-ecs-data-quality-dashboard/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/security_solution/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/timelines/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/cases/**/*.{js,mjs,ts,tsx}',
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 524d2abbc7f9e..c6e2a9202f804 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -442,6 +442,8 @@
 # Security Solution sub teams
 
 ## Security Solution sub teams - Threat Hunting Investigations
+/x-pack/packages/kbn-ecs-data-quality-dashboard @elastic/security-threat-hunting-investigations
+/x-pack/plugins/ecs_data_quality_dashboard @elastic/security-threat-hunting-investigations
 /x-pack/plugins/timelines @elastic/security-threat-hunting-investigations
 
 /x-pack/plugins/security_solution/common/search_strategy/timeline @elastic/security-threat-hunting-investigations
@@ -1083,6 +1085,7 @@ packages/shared-ux/router/types @elastic/appex-sharedux
 packages/shared-ux/storybook/config @elastic/appex-sharedux
 packages/shared-ux/storybook/mock @elastic/appex-sharedux
 src/plugins/chart_expressions/common @elastic/kibana-visualizations
+x-pack/packages/kbn-ecs-data-quality-dashboard @elastic/security-threat-hunting-investigations
 x-pack/packages/ml/agg_utils @elastic/ml-ui
 x-pack/packages/ml/aiops_components @elastic/ml-ui
 x-pack/packages/ml/aiops_utils @elastic/ml-ui
diff --git a/.i18nrc.json b/.i18nrc.json
index 319c3e45aca47..a4bb5c900fa57 100644
--- a/.i18nrc.json
+++ b/.i18nrc.json
@@ -15,6 +15,7 @@
     "dashboard": "src/plugins/dashboard",
     "controls": "src/plugins/controls",
     "data": "src/plugins/data",
+    "ecsDataQualityDashboard": "x-pack/packages/kbn-ecs-data-quality-dashboard",
     "dataViews": "src/plugins/data_views",
     "devTools": "src/plugins/dev_tools",
     "discover": "src/plugins/discover",
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index 2408866ced99a..5cb8398fb9adf 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -502,6 +502,10 @@ This plugin is currently under active development; do not use.
 |Contains the enhancements to the OSS discover app.
 
 
+|{kib-repo}blob/{branch}/x-pack/plugins/ecs_data_quality_dashboard/README.md[ecsDataQualityDashboard]
+|This plugin implements (server) APIs used to render the content of the Data Quality dashboard.
+
+
 |<<enhanced-embeddables-plugin>>
 |Enhances Embeddables by registering a custom factory provider. The enhanced factory provider
 adds dynamic actions to every embeddables state, in order to support drilldowns.
diff --git a/package.json b/package.json
index 78fa43cc621e1..23fd401733c3c 100644
--- a/package.json
+++ b/package.json
@@ -286,6 +286,7 @@
     "@kbn/doc-links": "link:packages/kbn-doc-links",
     "@kbn/ebt-tools": "link:packages/kbn-ebt-tools",
     "@kbn/ecs": "link:packages/kbn-ecs",
+    "@kbn/ecs-data-quality-dashboard": "link:x-pack/packages/kbn-ecs-data-quality-dashboard",
     "@kbn/es-errors": "link:packages/kbn-es-errors",
     "@kbn/es-query": "link:packages/kbn-es-query",
     "@kbn/es-types": "link:packages/kbn-es-types",
diff --git a/packages/kbn-babel-preset/styled_components_files.js b/packages/kbn-babel-preset/styled_components_files.js
index 1c5cf2af81f0f..3df97185c8dce 100644
--- a/packages/kbn-babel-preset/styled_components_files.js
+++ b/packages/kbn-babel-preset/styled_components_files.js
@@ -12,7 +12,7 @@ module.exports = {
    * Used by `kbn-babel-preset` and `kbn-eslint-config`.
    */
   USES_STYLED_COMPONENTS: [
-    /packages[\/\\]kbn-ui-shared-deps-(npm|src)[\/\\]/,
+    /packages[\/\\](kbn-ui-shared-deps-(npm|src)|kbn-ecs-data-quality-dashboard)[\/\\]/,
     /src[\/\\]plugins[\/\\](kibana_react)[\/\\]/,
     /x-pack[\/\\]plugins[\/\\](apm|beats_management|cases|fleet|infra|lists|observability|osquery|security_solution|timelines|synthetics|ux)[\/\\]/,
     /x-pack[\/\\]test[\/\\]plugin_functional[\/\\]plugins[\/\\]resolver_test[\/\\]/,
diff --git a/packages/kbn-eslint-config/.eslintrc.js b/packages/kbn-eslint-config/.eslintrc.js
index 3b60aeb0303dc..79369e3ed2cae 100644
--- a/packages/kbn-eslint-config/.eslintrc.js
+++ b/packages/kbn-eslint-config/.eslintrc.js
@@ -88,7 +88,7 @@ module.exports = {
           from: 'styled-components',
           to: false,
           exclude: USES_STYLED_COMPONENTS,
-          disallowedMessage: `Prefer using @emotion/react instead. To use styled-components, ensure you plugin is enabled in @kbn/dev-utils/src/babel.ts.`
+          disallowedMessage: `Prefer using @emotion/react instead. To use styled-components, ensure you plugin is enabled in packages/kbn-babel-preset/styled_components_files.js.`
         },
         ...[
           '@elastic/eui/dist/eui_theme_light.json',
diff --git a/src/dev/precommit_hook/casing_check_config.js b/src/dev/precommit_hook/casing_check_config.js
index 8b8f49e59d5d7..8adbd0a3d672e 100644
--- a/src/dev/precommit_hook/casing_check_config.js
+++ b/src/dev/precommit_hook/casing_check_config.js
@@ -82,7 +82,7 @@ export const IGNORE_FILE_GLOBS = [
  *
  * @type {Array}
  */
-export const KEBAB_CASE_DIRECTORY_GLOBS = ['packages/*', 'x-pack'];
+export const KEBAB_CASE_DIRECTORY_GLOBS = ['packages/*', 'x-pack', 'x-pack/packages/*'];
 
 /**
  * These patterns are matched against directories and indicate
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 4d408e4cfdd2a..98d79a813b6c8 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -602,6 +602,10 @@
       "@kbn/ebt-tools/*": ["packages/kbn-ebt-tools/*"],
       "@kbn/ecs": ["packages/kbn-ecs"],
       "@kbn/ecs/*": ["packages/kbn-ecs/*"],
+      "@kbn/ecs-data-quality-dashboard": ["x-pack/packages/kbn-ecs-data-quality-dashboard"],
+      "@kbn/ecs-data-quality-dashboard/*": ["x-pack/packages/kbn-ecs-data-quality-dashboard/*"],
+      "@kbn/ecs-data-quality-dashboard-plugin": ["x-pack/plugins/ecs_data_quality_dashboard"],
+      "@kbn/ecs-data-quality-dashboard-plugin/*": ["x-pack/plugins/ecs_data_quality_dashboard/*"],
       "@kbn/elasticsearch-client-plugin": ["test/plugin_functional/plugins/elasticsearch_client_plugin"],
       "@kbn/elasticsearch-client-plugin/*": ["test/plugin_functional/plugins/elasticsearch_client_plugin/*"],
       "@kbn/elasticsearch-client-xpack-plugin": ["x-pack/test/plugin_api_integration/plugins/elasticsearch_client"],
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/README.md b/x-pack/packages/kbn-ecs-data-quality-dashboard/README.md
new file mode 100644
index 0000000000000..9f62c82051f72
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/README.md
@@ -0,0 +1,12 @@
+# @kbn/ecs-data-quality-dashboard
+
+This package exports the `DataQualityPanel` React component.
+
+The `DataQualityPanel` renders the content of the _Data Quality_ dashboard.
+
+- The Data Quality dashboard checks the mappings and values in indices for [ECS](https://github.com/elastic/ecs) compliance
+- Results are added to a new case, or exported as markdown
+
+## Maintainers
+
+Maintained by the Security Solution _Threat Hunting Investigations_ team
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/ecs_allowed_values/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/ecs_allowed_values/index.tsx
new file mode 100644
index 0000000000000..aab085fe7fda4
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/ecs_allowed_values/index.tsx
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCode, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import React from 'react';
+import styled from 'styled-components';
+
+import { EMPTY_PLACEHOLDER } from '../helpers';
+import { CodeSuccess } from '../../styles';
+import type { AllowedValue } from '../../types';
+
+const EcsAllowedValueFlexItem = styled(EuiFlexItem)`
+  margin-bottom: ${({ theme }) => theme.eui.euiSizeXS};
+`;
+
+interface Props {
+  allowedValues: AllowedValue[] | undefined;
+}
+
+const EcsAllowedValuesComponent: React.FC<Props> = ({ allowedValues }) =>
+  allowedValues == null ? (
+    <EuiCode>{EMPTY_PLACEHOLDER}</EuiCode>
+  ) : (
+    <EuiFlexGroup direction="column" gutterSize="none">
+      {allowedValues.map((x, i) => (
+        <EcsAllowedValueFlexItem grow={false} key={`${x.name}_${i}`}>
+          <CodeSuccess>{x.name}</CodeSuccess>
+        </EcsAllowedValueFlexItem>
+      ))}
+    </EuiFlexGroup>
+  );
+
+EcsAllowedValuesComponent.displayName = 'EcsAllowedValuesComponent';
+
+export const EcsAllowedValues = React.memo(EcsAllowedValuesComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/helpers.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/helpers.tsx
new file mode 100644
index 0000000000000..0de9a8d83c61e
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/helpers.tsx
@@ -0,0 +1,214 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EuiTableFieldDataColumnType } from '@elastic/eui';
+import { EuiCode } from '@elastic/eui';
+import React from 'react';
+
+import { EcsAllowedValues } from './ecs_allowed_values';
+import { IndexInvalidValues } from './index_invalid_values';
+import { CodeDanger, CodeSuccess } from '../styles';
+import * as i18n from './translations';
+import type { AllowedValue, EnrichedFieldMetadata, UnallowedValueCount } from '../types';
+
+export const EMPTY_PLACEHOLDER = '--';
+
+export const getCommonTableColumns = (): Array<
+  EuiTableFieldDataColumnType<EnrichedFieldMetadata>
+> => [
+  {
+    field: 'indexFieldName',
+    name: i18n.FIELD,
+    sortable: true,
+    truncateText: false,
+    width: '20%',
+  },
+  {
+    field: 'type',
+    name: i18n.ECS_MAPPING_TYPE_EXPECTED,
+    render: (type: string) => <CodeSuccess>{type != null ? type : EMPTY_PLACEHOLDER}</CodeSuccess>,
+    sortable: true,
+    truncateText: false,
+    width: '15%',
+  },
+  {
+    field: 'indexFieldType',
+    name: i18n.INDEX_MAPPING_TYPE_ACTUAL,
+    render: (_, x) =>
+      x.type != null && x.indexFieldType !== x.type ? (
+        <CodeDanger>{x.indexFieldType}</CodeDanger>
+      ) : (
+        <CodeSuccess>{x.indexFieldType}</CodeSuccess>
+      ),
+    sortable: true,
+    truncateText: false,
+    width: '15%',
+  },
+  {
+    field: 'allowed_values',
+    name: i18n.ECS_VALUES_EXPECTED,
+    render: (allowedValues: AllowedValue[] | undefined) => (
+      <EcsAllowedValues allowedValues={allowedValues} />
+    ),
+    sortable: false,
+    truncateText: false,
+    width: '15%',
+  },
+  {
+    field: 'indexInvalidValues',
+    name: i18n.DOCUMENT_VALUES_ACTUAL,
+    render: (indexInvalidValues: UnallowedValueCount[]) => (
+      <IndexInvalidValues indexInvalidValues={indexInvalidValues} />
+    ),
+    sortable: false,
+    truncateText: false,
+    width: '15%',
+  },
+  {
+    field: 'description',
+    name: i18n.ECS_DESCRIPTION,
+    render: (description: string) =>
+      description != null ? description : <EuiCode>{EMPTY_PLACEHOLDER}</EuiCode>,
+    sortable: false,
+    truncateText: false,
+    width: '20%',
+  },
+];
+
+export const getCustomTableColumns = (): Array<
+  EuiTableFieldDataColumnType<EnrichedFieldMetadata>
+> => [
+  {
+    field: 'indexFieldName',
+    name: i18n.FIELD,
+    sortable: true,
+    truncateText: false,
+    width: '50%',
+  },
+  {
+    field: 'indexFieldType',
+    name: i18n.INDEX_MAPPING_TYPE,
+    render: (indexFieldType: string) => <EuiCode>{indexFieldType}</EuiCode>,
+    sortable: true,
+    truncateText: false,
+    width: '50%',
+  },
+];
+
+export const getEcsCompliantTableColumns = (): Array<
+  EuiTableFieldDataColumnType<EnrichedFieldMetadata>
+> => [
+  {
+    field: 'indexFieldName',
+    name: i18n.FIELD,
+    sortable: true,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'type',
+    name: i18n.ECS_MAPPING_TYPE,
+    render: (type: string) =>
+      type != null ? <CodeSuccess>{type}</CodeSuccess> : <EuiCode>{EMPTY_PLACEHOLDER}</EuiCode>,
+    sortable: true,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'allowed_values',
+    name: i18n.ECS_VALUES,
+    render: (allowedValues: AllowedValue[] | undefined) => (
+      <EcsAllowedValues allowedValues={allowedValues} />
+    ),
+    sortable: false,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'description',
+    name: i18n.ECS_DESCRIPTION,
+    render: (description: string) =>
+      description != null ? description : <EuiCode>{EMPTY_PLACEHOLDER}</EuiCode>,
+    sortable: false,
+    truncateText: false,
+    width: '25%',
+  },
+];
+
+export const getIncompatibleMappingsTableColumns = (): Array<
+  EuiTableFieldDataColumnType<EnrichedFieldMetadata>
+> => [
+  {
+    field: 'indexFieldName',
+    name: i18n.FIELD,
+    sortable: true,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'type',
+    name: i18n.ECS_MAPPING_TYPE_EXPECTED,
+    render: (type: string) => <CodeSuccess>{type != null ? type : EMPTY_PLACEHOLDER}</CodeSuccess>,
+    sortable: true,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'indexFieldType',
+    name: i18n.INDEX_MAPPING_TYPE_ACTUAL,
+    render: (indexFieldType: string) => <CodeDanger>{indexFieldType}</CodeDanger>,
+    sortable: true,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'description',
+    name: i18n.ECS_DESCRIPTION,
+    sortable: false,
+    truncateText: false,
+    width: '25%',
+  },
+];
+
+export const getIncompatibleValuesTableColumns = (): Array<
+  EuiTableFieldDataColumnType<EnrichedFieldMetadata>
+> => [
+  {
+    field: 'indexFieldName',
+    name: i18n.FIELD,
+    sortable: true,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'allowed_values',
+    name: i18n.ECS_VALUES_EXPECTED,
+    render: (allowedValues: AllowedValue[] | undefined) => (
+      <EcsAllowedValues allowedValues={allowedValues} />
+    ),
+    sortable: false,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'indexInvalidValues',
+    name: i18n.DOCUMENT_VALUES_ACTUAL,
+    render: (indexInvalidValues: UnallowedValueCount[]) => (
+      <IndexInvalidValues indexInvalidValues={indexInvalidValues} />
+    ),
+    sortable: false,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'description',
+    name: i18n.ECS_DESCRIPTION,
+    sortable: false,
+    truncateText: false,
+    width: '25%',
+  },
+];
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/index.tsx
new file mode 100644
index 0000000000000..2efc9355c710f
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/index.tsx
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EuiTableFieldDataColumnType, Search } from '@elastic/eui';
+import { EuiInMemoryTable, EuiTitle, EuiSpacer } from '@elastic/eui';
+import React, { useMemo } from 'react';
+
+import * as i18n from './translations';
+import type { EnrichedFieldMetadata } from '../types';
+
+const search: Search = {
+  box: {
+    incremental: true,
+    placeholder: i18n.SEARCH_FIELDS,
+    schema: true,
+  },
+};
+
+interface Props {
+  enrichedFieldMetadata: EnrichedFieldMetadata[];
+  getTableColumns: () => Array<EuiTableFieldDataColumnType<EnrichedFieldMetadata>>;
+  title: string;
+}
+
+const CompareFieldsTableComponent: React.FC<Props> = ({
+  enrichedFieldMetadata,
+  getTableColumns,
+  title,
+}) => {
+  const columns = useMemo(() => getTableColumns(), [getTableColumns]);
+
+  return (
+    <>
+      <EuiTitle size="xs">
+        <>{title}</>
+      </EuiTitle>
+      <EuiSpacer size="s" />
+      <EuiInMemoryTable
+        columns={columns}
+        items={enrichedFieldMetadata}
+        search={search}
+        sorting={true}
+        pagination={true}
+      />
+    </>
+  );
+};
+
+CompareFieldsTableComponent.displayName = 'CompareFieldsTableComponent';
+
+export const CompareFieldsTable = React.memo(CompareFieldsTableComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/index_invalid_values/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/index_invalid_values/index.tsx
new file mode 100644
index 0000000000000..4987528b96831
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/index_invalid_values/index.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCode, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import React from 'react';
+import styled from 'styled-components';
+
+import { EMPTY_PLACEHOLDER } from '../helpers';
+import { CodeDanger } from '../../styles';
+import type { UnallowedValueCount } from '../../types';
+
+const IndexInvalidValueFlexItem = styled(EuiFlexItem)`
+  margin-bottom: ${({ theme }) => theme.eui.euiSizeXS};
+`;
+
+interface Props {
+  indexInvalidValues: UnallowedValueCount[];
+}
+
+const IndexInvalidValuesComponent: React.FC<Props> = ({ indexInvalidValues }) =>
+  indexInvalidValues.length === 0 ? (
+    <EuiCode>{EMPTY_PLACEHOLDER}</EuiCode>
+  ) : (
+    <EuiFlexGroup direction="column" gutterSize="none">
+      {indexInvalidValues.map(({ fieldName, count }, i) => (
+        <IndexInvalidValueFlexItem grow={false} key={`${fieldName}_${i}`}>
+          <div>
+            <CodeDanger>{fieldName}</CodeDanger>{' '}
+            <span>
+              {'('}
+              {count}
+              {')'}
+            </span>
+          </div>
+        </IndexInvalidValueFlexItem>
+      ))}
+    </EuiFlexGroup>
+  );
+
+IndexInvalidValuesComponent.displayName = 'IndexInvalidValuesComponent';
+
+export const IndexInvalidValues = React.memo(IndexInvalidValuesComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/translations.ts
new file mode 100644
index 0000000000000..98d3e72676cdf
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/compare_fields_table/translations.ts
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ECS_VALUES = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.ecsValuesColumn',
+  {
+    defaultMessage: 'ECS values',
+  }
+);
+
+export const ECS_VALUES_EXPECTED = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.ecsValuesExpectedColumn',
+  {
+    defaultMessage: 'ECS values (expected)',
+  }
+);
+
+export const ECS_DESCRIPTION = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.ecsDescriptionColumn',
+  {
+    defaultMessage: 'ECS description',
+  }
+);
+
+export const ECS_MAPPING_TYPE = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.ecsMappingTypeColumn',
+  {
+    defaultMessage: 'ECS mapping type',
+  }
+);
+
+export const ECS_MAPPING_TYPE_EXPECTED = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.ecsMappingTypeExpectedColumn',
+  {
+    defaultMessage: 'ECS mapping type (expected)',
+  }
+);
+
+export const DOCUMENT_VALUES_ACTUAL = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.documentValuesActualColumn',
+  {
+    defaultMessage: 'Document values (actual)',
+  }
+);
+
+export const INDEX_MAPPING_TYPE = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.indexMappingTypeColumn',
+  {
+    defaultMessage: 'Index mapping type',
+  }
+);
+
+export const INDEX_MAPPING_TYPE_ACTUAL = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.indexMappingTypeActualColumn',
+  {
+    defaultMessage: 'Index mapping type (actual)',
+  }
+);
+
+export const FIELD = i18n.translate('ecsDataQualityDashboard.compareFieldsTable.fieldColumn', {
+  defaultMessage: 'Field',
+});
+
+export const SEARCH_FIELDS = i18n.translate(
+  'ecsDataQualityDashboard.compareFieldsTable.searchFieldsPlaceholder',
+  {
+    defaultMessage: 'Search fields',
+  }
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/allowed_values/helpers.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/allowed_values/helpers.tsx
new file mode 100644
index 0000000000000..707e83fd0df52
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/allowed_values/helpers.tsx
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EcsMetadata, UnallowedValueRequestItem } from '../../types';
+
+export const hasAllowedValues = ({
+  ecsMetadata,
+  fieldName,
+}: {
+  ecsMetadata: Record<string, EcsMetadata> | null;
+  fieldName: string;
+}): boolean =>
+  ecsMetadata != null ? (ecsMetadata[fieldName]?.allowed_values?.length ?? 0) > 0 : false;
+
+export const getValidValues = (field: EcsMetadata | undefined): string[] =>
+  field?.allowed_values?.flatMap(({ name }) => (name != null ? name : [])) ?? [];
+
+export const getUnallowedValueRequestItems = ({
+  ecsMetadata,
+  indexName,
+}: {
+  ecsMetadata: Record<string, EcsMetadata> | null;
+  indexName: string;
+}): UnallowedValueRequestItem[] =>
+  ecsMetadata != null
+    ? Object.keys(ecsMetadata).reduce<UnallowedValueRequestItem[]>(
+        (acc, fieldName) =>
+          hasAllowedValues({ ecsMetadata, fieldName })
+            ? [
+                ...acc,
+                {
+                  indexName,
+                  indexFieldName: fieldName,
+                  allowedValues: getValidValues(ecsMetadata[fieldName]),
+                },
+              ]
+            : acc,
+        []
+      )
+    : [];
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/body/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/body/index.tsx
new file mode 100644
index 0000000000000..c01b37a3c090c
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/body/index.tsx
@@ -0,0 +1,125 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  FlameElementEvent,
+  HeatmapElementEvent,
+  MetricElementEvent,
+  PartitionElementEvent,
+  Theme,
+  WordCloudElementEvent,
+  XYChartElementEvent,
+} from '@elastic/charts';
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
+import React from 'react';
+
+import { DataQualitySummary } from '../data_quality_summary';
+import { Pattern } from '../pattern';
+import { useResultsRollup } from '../../use_results_rollup';
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  canUserCreateAndReadCases: () => boolean;
+  defaultNumberFormat: string;
+  getGroupByFieldsOnClick: (
+    elements: Array<
+      | FlameElementEvent
+      | HeatmapElementEvent
+      | MetricElementEvent
+      | PartitionElementEvent
+      | WordCloudElementEvent
+      | XYChartElementEvent
+    >
+  ) => {
+    groupByField0: string;
+    groupByField1: string;
+  };
+  ilmPhases: string[];
+  lastChecked: string;
+  openCreateCaseFlyout: ({
+    comments,
+    headerContent,
+  }: {
+    comments: string[];
+    headerContent?: React.ReactNode;
+  }) => void;
+  patterns: string[];
+  setLastChecked: (lastChecked: string) => void;
+  theme: Theme;
+}
+
+const BodyComponent: React.FC<Props> = ({
+  addSuccessToast,
+  canUserCreateAndReadCases,
+  defaultNumberFormat,
+  getGroupByFieldsOnClick,
+  ilmPhases,
+  lastChecked,
+  openCreateCaseFlyout,
+  patterns,
+  setLastChecked,
+  theme,
+}) => {
+  const {
+    onCheckCompleted,
+    patternIndexNames,
+    patternRollups,
+    totalDocsCount,
+    totalIncompatible,
+    totalIndices,
+    totalIndicesChecked,
+    updatePatternIndexNames,
+    updatePatternRollup,
+  } = useResultsRollup({ ilmPhases, patterns });
+
+  return (
+    <EuiFlexGroup direction="column" gutterSize="none">
+      <EuiFlexItem grow={false}>
+        <DataQualitySummary
+          addSuccessToast={addSuccessToast}
+          canUserCreateAndReadCases={canUserCreateAndReadCases}
+          defaultNumberFormat={defaultNumberFormat}
+          ilmPhases={ilmPhases}
+          lastChecked={lastChecked}
+          openCreateCaseFlyout={openCreateCaseFlyout}
+          patternIndexNames={patternIndexNames}
+          patternRollups={patternRollups}
+          patterns={patterns}
+          setLastChecked={setLastChecked}
+          totalDocsCount={totalDocsCount}
+          totalIncompatible={totalIncompatible}
+          totalIndices={totalIndices}
+          totalIndicesChecked={totalIndicesChecked}
+          onCheckCompleted={onCheckCompleted}
+        />
+        <EuiSpacer size="l" />
+      </EuiFlexItem>
+
+      {patterns.map((pattern, i) => (
+        <EuiFlexItem grow={false} key={pattern}>
+          <Pattern
+            addSuccessToast={addSuccessToast}
+            canUserCreateAndReadCases={canUserCreateAndReadCases}
+            defaultNumberFormat={defaultNumberFormat}
+            getGroupByFieldsOnClick={getGroupByFieldsOnClick}
+            ilmPhases={ilmPhases}
+            indexNames={patternIndexNames[pattern]}
+            openCreateCaseFlyout={openCreateCaseFlyout}
+            pattern={pattern}
+            patternRollup={patternRollups[pattern]}
+            theme={theme}
+            updatePatternIndexNames={updatePatternIndexNames}
+            updatePatternRollup={updatePatternRollup}
+          />
+          {i !== patterns.length - 1 ? <EuiSpacer size="s" /> : null}
+        </EuiFlexItem>
+      ))}
+    </EuiFlexGroup>
+  );
+};
+
+export const Body = React.memo(BodyComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/check_status/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/check_status/index.tsx
new file mode 100644
index 0000000000000..3ff69274ba06e
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/check_status/index.tsx
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiProgress, EuiSpacer, EuiText } from '@elastic/eui';
+import React, { useEffect, useState } from 'react';
+import moment from 'moment';
+
+import { ErrorsPopover } from '../errors_popover';
+import * as i18n from '../../../translations';
+import type { ErrorSummary, IndexToCheck } from '../../../types';
+
+export const EMPTY_LAST_CHECKED_DATE = '--';
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  checkAllIndiciesChecked: number;
+  checkAllTotalIndiciesToCheck: number;
+  errorSummary: ErrorSummary[];
+  indexToCheck: IndexToCheck | null;
+  lastChecked: string;
+  setLastChecked: (lastChecked: string) => void;
+}
+
+const CheckStatusComponent: React.FC<Props> = ({
+  addSuccessToast,
+  checkAllIndiciesChecked,
+  checkAllTotalIndiciesToCheck,
+  errorSummary,
+  indexToCheck,
+  lastChecked,
+  setLastChecked,
+}) => {
+  const [formattedDate, setFormattedDate] = useState<string>(EMPTY_LAST_CHECKED_DATE);
+
+  useEffect(() => {
+    // update the lastCheckedDate whenever the next to check is updated
+    if (indexToCheck != null) {
+      setLastChecked(new Date().toISOString());
+    }
+  }, [indexToCheck, setLastChecked]);
+
+  useEffect(() => {
+    // immediately update the formatted date when lastCheckedDate is updated
+    if (moment(lastChecked).isValid()) {
+      setFormattedDate(moment(lastChecked).fromNow());
+    }
+
+    // periodically update the formatted date as time passes
+    const intervalId = setInterval(() => {
+      if (moment(lastChecked).isValid()) {
+        setFormattedDate(moment(lastChecked).fromNow());
+      }
+    }, 10000);
+
+    return () => clearInterval(intervalId);
+  }, [lastChecked]);
+
+  return (
+    <EuiFlexGroup direction="column" gutterSize="none">
+      {indexToCheck != null && (
+        <>
+          <EuiFlexItem grow={true}>
+            <EuiProgress
+              max={checkAllTotalIndiciesToCheck}
+              size="xs"
+              value={checkAllIndiciesChecked}
+            />
+          </EuiFlexItem>
+
+          <EuiSpacer size="xs" />
+
+          <EuiFlexItem grow={true}>
+            <EuiText size="s">
+              <span>{i18n.CHECKING(indexToCheck.indexName)}</span>
+            </EuiText>
+          </EuiFlexItem>
+        </>
+      )}
+
+      <EuiFlexItem grow={true}>
+        {indexToCheck == null && (
+          <EuiText color="subdued" size="s">
+            {i18n.LAST_CHECKED}
+            {': '}
+            {formattedDate}
+          </EuiText>
+        )}
+
+        {errorSummary.length > 0 && (
+          <div>
+            <ErrorsPopover addSuccessToast={addSuccessToast} errorSummary={errorSummary} />
+          </div>
+        )}
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+CheckStatusComponent.displayName = 'CheckStatusComponent';
+
+export const CheckStatus = React.memo(CheckStatusComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_popover/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_popover/index.tsx
new file mode 100644
index 0000000000000..b24c7e6cd598c
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_popover/index.tsx
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  copyToClipboard,
+  EuiButtonEmpty,
+  EuiCallOut,
+  EuiCode,
+  EuiPopover,
+  EuiSpacer,
+} from '@elastic/eui';
+import React, { useCallback, useMemo, useState } from 'react';
+import styled from 'styled-components';
+
+import { ErrorsViewer } from '../errors_viewer';
+import { ERRORS_CONTAINER_MAX_WIDTH } from '../errors_viewer/helpers';
+import {
+  getErrorsMarkdownTable,
+  getErrorsMarkdownTableRows,
+} from '../../index_properties/markdown/helpers';
+import * as i18n from './translations';
+import type { ErrorSummary } from '../../../types';
+import { ERROR, INDEX, PATTERN } from '../errors_viewer/translations';
+
+const CallOut = styled(EuiCallOut)`
+  max-width: ${ERRORS_CONTAINER_MAX_WIDTH}px;
+`;
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  errorSummary: ErrorSummary[];
+}
+
+const ErrorsPopoverComponent: React.FC<Props> = ({ addSuccessToast, errorSummary }) => {
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+  const onClick = useCallback(() => setIsPopoverOpen((isOpen) => !isOpen), []);
+  const closePopover = useCallback(() => setIsPopoverOpen(false), []);
+
+  const onCopy = useCallback(() => {
+    const markdown = getErrorsMarkdownTable({
+      errorSummary,
+      getMarkdownTableRows: getErrorsMarkdownTableRows,
+      headerNames: [PATTERN, INDEX, ERROR],
+      title: i18n.ERRORS,
+    });
+    copyToClipboard(markdown);
+
+    closePopover();
+
+    addSuccessToast({
+      title: i18n.COPIED_ERRORS_TOAST_TITLE,
+    });
+  }, [addSuccessToast, closePopover, errorSummary]);
+
+  const button = useMemo(
+    () => (
+      <EuiButtonEmpty
+        aria-label={i18n.VIEW_ERRORS}
+        disabled={errorSummary.length === 0}
+        flush="both"
+        onClick={onClick}
+        size="xs"
+      >
+        {i18n.VIEW_ERRORS}
+      </EuiButtonEmpty>
+    ),
+    [errorSummary.length, onClick]
+  );
+
+  return (
+    <EuiPopover
+      button={button}
+      closePopover={closePopover}
+      isOpen={isPopoverOpen}
+      panelPaddingSize="s"
+    >
+      <CallOut color="danger" size="s" title={i18n.ERRORS}>
+        <p>{i18n.ERRORS_CALLOUT_SUMMARY}</p>
+
+        <p>{i18n.ERRORS_MAY_OCCUR}</p>
+
+        <span>{i18n.THE_FOLLOWING_PRIVILEGES_ARE_REQUIRED}</span>
+        <ul>
+          <li>
+            <EuiCode>{i18n.MONITOR}</EuiCode> {i18n.OR} <EuiCode>{i18n.MANAGE}</EuiCode>
+          </li>
+          <li>
+            <EuiCode>{i18n.VIEW_INDEX_METADATA}</EuiCode>
+          </li>
+          <li>
+            <EuiCode>{i18n.READ}</EuiCode> {i18n.OR} <EuiCode>{i18n.READ_CROSS_CLUSTER}</EuiCode>
+          </li>
+        </ul>
+
+        <EuiButtonEmpty aria-label={i18n.COPY_TO_CLIPBOARD} flush="both" onClick={onCopy} size="xs">
+          {i18n.COPY_TO_CLIPBOARD}
+        </EuiButtonEmpty>
+      </CallOut>
+
+      <EuiSpacer />
+
+      <ErrorsViewer errorSummary={errorSummary} />
+    </EuiPopover>
+  );
+};
+
+ErrorsPopoverComponent.displayName = 'ErrorsPopoverComponent';
+
+export const ErrorsPopover = React.memo(ErrorsPopoverComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_popover/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_popover/translations.ts
new file mode 100644
index 0000000000000..e6c9459d308e9
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_popover/translations.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const COPIED_ERRORS_TOAST_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.toasts.copiedErrorsToastTitle',
+  {
+    defaultMessage: 'Copied errors to the clipboard',
+  }
+);
+
+export const COPY_TO_CLIPBOARD = i18n.translate(
+  'ecsDataQualityDashboard.errorsPopover.copyToClipboardButton',
+  {
+    defaultMessage: 'Copy to clipboard',
+  }
+);
+
+export const ERRORS = i18n.translate('ecsDataQualityDashboard.errorsPopover.errorsTitle', {
+  defaultMessage: 'Errors',
+});
+
+export const ERRORS_CALLOUT_SUMMARY = i18n.translate(
+  'ecsDataQualityDashboard.errorsPopover.errorsCalloutSummary',
+  {
+    defaultMessage: 'Some indices were not checked for Data Quality',
+  }
+);
+
+export const ERRORS_MAY_OCCUR = i18n.translate(
+  'ecsDataQualityDashboard.errors.errorMayOccurLabel',
+  {
+    defaultMessage:
+      "Errors may occur when pattern or index metadata is temporarily unavailable, or because you don't have the privileges required for access",
+  }
+);
+
+export const MANAGE = i18n.translate('ecsDataQualityDashboard.errors.manage', {
+  defaultMessage: 'manage',
+});
+
+export const MONITOR = i18n.translate('ecsDataQualityDashboard.errors.monitor', {
+  defaultMessage: 'monitor',
+});
+
+export const OR = i18n.translate('ecsDataQualityDashboard.errors.or', {
+  defaultMessage: 'or',
+});
+
+export const READ = i18n.translate('ecsDataQualityDashboard.errors.read', {
+  defaultMessage: 'read',
+});
+
+export const READ_CROSS_CLUSTER = i18n.translate(
+  'ecsDataQualityDashboard.errors.readCrossCluster',
+  {
+    defaultMessage: 'read_cross_cluster',
+  }
+);
+
+export const THE_FOLLOWING_PRIVILEGES_ARE_REQUIRED = i18n.translate(
+  'ecsDataQualityDashboard.errors.theFollowingPrivilegesLabel',
+  {
+    defaultMessage: 'The following privileges are required to check an index:',
+  }
+);
+
+export const VIEW_ERRORS = i18n.translate(
+  'ecsDataQualityDashboard.errorsPopover.viewErrorsButton',
+  {
+    defaultMessage: 'View errors',
+  }
+);
+
+export const VIEW_INDEX_METADATA = i18n.translate(
+  'ecsDataQualityDashboard.errors.viewIndexMetadata',
+  {
+    defaultMessage: 'view_index_metadata',
+  }
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/helpers.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/helpers.tsx
new file mode 100644
index 0000000000000..caac710cf8d13
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/helpers.tsx
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EuiTableFieldDataColumnType } from '@elastic/eui';
+import { EuiCode } from '@elastic/eui';
+import React from 'react';
+
+import * as i18n from './translations';
+import type { ErrorSummary } from '../../../types';
+
+export const EMPTY_PLACEHOLDER = '--';
+
+export const ERRORS_CONTAINER_MAX_WIDTH = 600; // px
+export const ERRORS_CONTAINER_MIN_WIDTH = 450; // px
+
+export const getErrorsViewerTableColumns = (): Array<EuiTableFieldDataColumnType<ErrorSummary>> => [
+  {
+    field: 'pattern',
+    name: i18n.PATTERN,
+    sortable: true,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'indexName',
+    name: i18n.INDEX,
+    render: (indexName) => (indexName != null && indexName !== '' ? indexName : EMPTY_PLACEHOLDER),
+    sortable: false,
+    truncateText: false,
+    width: '25%',
+  },
+  {
+    field: 'error',
+    name: i18n.ERROR,
+    render: (errorText) => <EuiCode>{errorText}</EuiCode>,
+    sortable: false,
+    truncateText: false,
+    width: '50%',
+  },
+];
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/index.tsx
new file mode 100644
index 0000000000000..a40094c96b399
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/index.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiInMemoryTable } from '@elastic/eui';
+import React, { useMemo } from 'react';
+import styled from 'styled-components';
+
+import {
+  ERRORS_CONTAINER_MAX_WIDTH,
+  ERRORS_CONTAINER_MIN_WIDTH,
+  getErrorsViewerTableColumns,
+} from './helpers';
+import type { ErrorSummary } from '../../../types';
+
+const ErrorsViewerContainer = styled.div`
+  max-width: ${ERRORS_CONTAINER_MAX_WIDTH}px;
+  min-width: ${ERRORS_CONTAINER_MIN_WIDTH}px;
+`;
+
+interface Props {
+  errorSummary: ErrorSummary[];
+}
+
+const ErrorsViewerComponent: React.FC<Props> = ({ errorSummary }) => {
+  const columns = useMemo(() => getErrorsViewerTableColumns(), []);
+
+  return (
+    <ErrorsViewerContainer>
+      <EuiInMemoryTable
+        columns={columns}
+        compressed={true}
+        items={errorSummary}
+        sorting={false}
+        pagination={true}
+      />
+    </ErrorsViewerContainer>
+  );
+};
+
+ErrorsViewerComponent.displayName = 'ErrorsViewerComponent';
+
+export const ErrorsViewer = React.memo(ErrorsViewerComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/translations.ts
new file mode 100644
index 0000000000000..b8c9bff644803
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/errors_viewer/translations.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR = i18n.translate('ecsDataQualityDashboard.errorsViewerTable.errorColumn', {
+  defaultMessage: 'Error',
+});
+
+export const INDEX = i18n.translate('ecsDataQualityDashboard.errorsViewerTable.indexColumn', {
+  defaultMessage: 'Index',
+});
+
+export const PATTERN = i18n.translate('ecsDataQualityDashboard.errorsViewerTable.patternColumn', {
+  defaultMessage: 'Pattern',
+});
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/index.tsx
new file mode 100644
index 0000000000000..c6874d861ddb8
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/index.tsx
@@ -0,0 +1,131 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiPanel, EuiSpacer } from '@elastic/eui';
+import React, { useCallback, useMemo, useState } from 'react';
+import styled from 'styled-components';
+
+import { CheckStatus } from './check_status';
+import { StatsRollup } from '../pattern/pattern_summary/stats_rollup';
+import { SummaryActions } from './summary_actions';
+import type { IndexToCheck, OnCheckCompleted, PatternRollup } from '../../types';
+import { getErrorSummaries } from '../../helpers';
+
+const MAX_SUMMARY_ACTIONS_CONTAINER_WIDTH = 400;
+const MIN_SUMMARY_ACTIONS_CONTAINER_WIDTH = 235;
+
+const SummaryActionsContainerFlexItem = styled(EuiFlexItem)`
+  max-width: ${MAX_SUMMARY_ACTIONS_CONTAINER_WIDTH}px;
+  min-width: ${MIN_SUMMARY_ACTIONS_CONTAINER_WIDTH}px;
+  padding-right: ${({ theme }) => theme.eui.euiSizeXL};
+`;
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  canUserCreateAndReadCases: () => boolean;
+  defaultNumberFormat: string;
+  ilmPhases: string[];
+  lastChecked: string;
+  openCreateCaseFlyout: ({
+    comments,
+    headerContent,
+  }: {
+    comments: string[];
+    headerContent?: React.ReactNode;
+  }) => void;
+  patternIndexNames: Record<string, string[]>;
+  patternRollups: Record<string, PatternRollup>;
+  patterns: string[];
+  setLastChecked: (lastChecked: string) => void;
+  totalDocsCount: number | undefined;
+  totalIncompatible: number | undefined;
+  totalIndices: number | undefined;
+  totalIndicesChecked: number | undefined;
+  onCheckCompleted: OnCheckCompleted;
+}
+
+const DataQualitySummaryComponent: React.FC<Props> = ({
+  addSuccessToast,
+  canUserCreateAndReadCases,
+  defaultNumberFormat,
+  ilmPhases,
+  lastChecked,
+  openCreateCaseFlyout,
+  patternIndexNames,
+  patternRollups,
+  patterns,
+  setLastChecked,
+  totalDocsCount,
+  totalIncompatible,
+  totalIndices,
+  totalIndicesChecked,
+  onCheckCompleted,
+}) => {
+  const [indexToCheck, setIndexToCheck] = useState<IndexToCheck | null>(null);
+
+  const [checkAllIndiciesChecked, setCheckAllIndiciesChecked] = useState<number>(0);
+  const [checkAllTotalIndiciesToCheck, setCheckAllTotalIndiciesToCheck] = useState<number>(0);
+
+  const incrementCheckAllIndiciesChecked = useCallback(() => {
+    setCheckAllIndiciesChecked((current) => current + 1);
+  }, []);
+
+  const errorSummary = useMemo(() => getErrorSummaries(patternRollups), [patternRollups]);
+
+  return (
+    <EuiPanel hasShadow={true}>
+      <EuiFlexGroup alignItems="flexStart" gutterSize="none" justifyContent="spaceBetween">
+        <SummaryActionsContainerFlexItem grow={false}>
+          <SummaryActions
+            addSuccessToast={addSuccessToast}
+            canUserCreateAndReadCases={canUserCreateAndReadCases}
+            defaultNumberFormat={defaultNumberFormat}
+            errorSummary={errorSummary}
+            ilmPhases={ilmPhases}
+            incrementCheckAllIndiciesChecked={incrementCheckAllIndiciesChecked}
+            onCheckCompleted={onCheckCompleted}
+            openCreateCaseFlyout={openCreateCaseFlyout}
+            patternIndexNames={patternIndexNames}
+            patterns={patterns}
+            patternRollups={patternRollups}
+            setCheckAllIndiciesChecked={setCheckAllIndiciesChecked}
+            setCheckAllTotalIndiciesToCheck={setCheckAllTotalIndiciesToCheck}
+            setIndexToCheck={setIndexToCheck}
+            totalDocsCount={totalDocsCount}
+            totalIncompatible={totalIncompatible}
+            totalIndices={totalIndices}
+            totalIndicesChecked={totalIndicesChecked}
+          />
+
+          <EuiSpacer size="s" />
+
+          <CheckStatus
+            addSuccessToast={addSuccessToast}
+            checkAllIndiciesChecked={checkAllIndiciesChecked}
+            checkAllTotalIndiciesToCheck={checkAllTotalIndiciesToCheck}
+            errorSummary={errorSummary}
+            indexToCheck={indexToCheck}
+            lastChecked={lastChecked}
+            setLastChecked={setLastChecked}
+          />
+        </SummaryActionsContainerFlexItem>
+
+        <EuiFlexItem grow={false}>
+          <StatsRollup
+            defaultNumberFormat={defaultNumberFormat}
+            docsCount={totalDocsCount}
+            incompatible={totalIncompatible}
+            indices={totalIndices}
+            indicesChecked={totalIndicesChecked}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiPanel>
+  );
+};
+
+export const DataQualitySummary = React.memo(DataQualitySummaryComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/check_index.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/check_index.ts
new file mode 100644
index 0000000000000..cd1ce0940b391
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/check_index.ts
@@ -0,0 +1,99 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getUnallowedValueRequestItems } from '../../../allowed_values/helpers';
+import {
+  getMappingsProperties,
+  getSortedPartitionedFieldMetadata,
+} from '../../../index_properties/helpers';
+import * as i18n from './translations';
+import type { EcsMetadata, OnCheckCompleted, PartitionedFieldMetadata } from '../../../../types';
+import { fetchMappings } from '../../../../use_mappings/helpers';
+import { fetchUnallowedValues, getUnallowedValues } from '../../../../use_unallowed_values/helpers';
+
+const EMPTY_PARTITIONED_FIELD_METADATA: PartitionedFieldMetadata = {
+  all: [],
+  custom: [],
+  ecsCompliant: [],
+  incompatible: [],
+};
+
+export async function checkIndex({
+  abortController,
+  ecsMetadata,
+  formatNumber,
+  indexName,
+  onCheckCompleted,
+  pattern,
+  version,
+}: {
+  abortController: AbortController;
+  ecsMetadata: Record<string, EcsMetadata> | null;
+  formatNumber: (value: number | undefined) => string;
+  indexName: string;
+  onCheckCompleted: OnCheckCompleted;
+  pattern: string;
+  version: string;
+}) {
+  try {
+    const indexes = await fetchMappings({ abortController, patternOrIndexName: indexName });
+
+    const requestItems = getUnallowedValueRequestItems({
+      ecsMetadata,
+      indexName,
+    });
+
+    const searchResults = await fetchUnallowedValues({
+      abortController,
+      indexName,
+      requestItems,
+    });
+
+    const unallowedValues = getUnallowedValues({
+      requestItems,
+      searchResults,
+    });
+
+    const mappingsProperties = getMappingsProperties({
+      indexes,
+      indexName,
+    });
+
+    const partitionedFieldMetadata =
+      getSortedPartitionedFieldMetadata({
+        ecsMetadata,
+        loadingMappings: false,
+        mappingsProperties,
+        unallowedValues,
+      }) ?? EMPTY_PARTITIONED_FIELD_METADATA;
+
+    if (!abortController.signal.aborted) {
+      onCheckCompleted({
+        error: null,
+        formatNumber,
+        indexName,
+        partitionedFieldMetadata,
+        pattern,
+        version,
+      });
+    }
+  } catch (error) {
+    if (!abortController.signal.aborted) {
+      onCheckCompleted({
+        error:
+          error.toString() != null
+            ? error.toString()
+            : i18n.AN_ERROR_OCCURRED_CHECKING_INDEX(indexName),
+        formatNumber,
+        indexName,
+        partitionedFieldMetadata: null,
+        pattern,
+        version,
+      });
+    }
+  }
+}
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/helpers.ts
new file mode 100644
index 0000000000000..4d07d4826f521
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/helpers.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IndicesStatsIndicesStats } from '@elastic/elasticsearch/lib/api/types';
+import { sortBy } from 'lodash/fp';
+
+import { getDocsCount } from '../../../../helpers';
+import type { IndexToCheck, PatternRollup } from '../../../../types';
+
+export const getIndexToCheck = ({
+  indexName,
+  pattern,
+}: {
+  indexName: string;
+  pattern: string;
+}): IndexToCheck => {
+  return {
+    pattern,
+    indexName,
+  };
+};
+
+export const getAllIndicesToCheck = (
+  patternIndexNames: Record<string, string[]>
+): IndexToCheck[] => {
+  const allPatterns: string[] = Object.keys(patternIndexNames);
+
+  // sort the patterns A-Z:
+  const sortedPatterns = [...allPatterns].sort((a, b) => {
+    return a.localeCompare(b);
+  });
+
+  // return all `IndexToCheck` sorted first by pattern A-Z, and then by `docsCount` within the pattern
+  return sortedPatterns.reduce<IndexToCheck[]>((acc, pattern) => {
+    const indexNames = patternIndexNames[pattern] ?? [];
+    const indicesToCheck = indexNames.map<IndexToCheck>((indexName) =>
+      getIndexToCheck({ indexName, pattern })
+    );
+
+    const sortedIndicesToCheck = sortBy('indexName', indicesToCheck).reverse();
+
+    return [...acc, ...sortedIndicesToCheck];
+  }, []);
+};
+
+export const getIndexDocsCountFromRollup = ({
+  indexName,
+  patternRollup,
+}: {
+  indexName: string;
+  patternRollup: PatternRollup;
+}): number => {
+  const stats: Record<string, IndicesStatsIndicesStats> | null = patternRollup?.stats ?? null;
+
+  return getDocsCount({
+    indexName,
+    stats,
+  });
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/index.tsx
new file mode 100644
index 0000000000000..ab5de8d7ccdcb
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/index.tsx
@@ -0,0 +1,155 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EcsFlat, EcsVersion } from '@kbn/ecs';
+
+import { EuiButton } from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
+
+import { checkIndex } from './check_index';
+import { EMPTY_STAT } from '../../../../helpers';
+import { getAllIndicesToCheck } from './helpers';
+import * as i18n from '../../../../translations';
+import type { EcsMetadata, IndexToCheck, OnCheckCompleted } from '../../../../types';
+
+async function wait(ms: number) {
+  const delay = () =>
+    new Promise((resolve) =>
+      setTimeout(() => {
+        resolve('');
+      }, ms)
+    );
+
+  return delay();
+}
+
+interface Props {
+  defaultNumberFormat: string;
+  ilmPhases: string[];
+  incrementCheckAllIndiciesChecked: () => void;
+  onCheckCompleted: OnCheckCompleted;
+  patternIndexNames: Record<string, string[]>;
+  patterns: string[];
+  setCheckAllIndiciesChecked: (checkAllIndiciesChecked: number) => void;
+  setCheckAllTotalIndiciesToCheck: (checkAllTotalIndiciesToCheck: number) => void;
+  setIndexToCheck: (indexToCheck: IndexToCheck | null) => void;
+}
+
+const DELAY_AFTER_EVERY_CHECK_COMPLETES = 3000; // ms
+
+const CheckAllComponent: React.FC<Props> = ({
+  defaultNumberFormat,
+  ilmPhases,
+  incrementCheckAllIndiciesChecked,
+  onCheckCompleted,
+  patternIndexNames,
+  patterns,
+  setCheckAllIndiciesChecked,
+  setCheckAllTotalIndiciesToCheck,
+  setIndexToCheck,
+}) => {
+  const abortController = useRef(new AbortController());
+  const [isRunning, setIsRunning] = useState<boolean>(false);
+  const formatNumber = useCallback(
+    (value: number | undefined): string =>
+      value != null ? numeral(value).format(defaultNumberFormat) : EMPTY_STAT,
+    [defaultNumberFormat]
+  );
+
+  const cancelIfRunning = useCallback(() => {
+    if (isRunning) {
+      if (!abortController.current.signal.aborted) {
+        setIndexToCheck(null);
+        setIsRunning(false);
+        setCheckAllIndiciesChecked(0);
+        setCheckAllTotalIndiciesToCheck(0);
+        abortController.current.abort();
+      }
+    }
+  }, [isRunning, setCheckAllIndiciesChecked, setCheckAllTotalIndiciesToCheck, setIndexToCheck]);
+
+  const onClick = useCallback(() => {
+    async function beginCheck() {
+      const allIndicesToCheck = getAllIndicesToCheck(patternIndexNames);
+      setCheckAllIndiciesChecked(0);
+      setCheckAllTotalIndiciesToCheck(allIndicesToCheck.length);
+
+      for (const { indexName, pattern } of allIndicesToCheck) {
+        if (!abortController.current.signal.aborted) {
+          setIndexToCheck({
+            indexName,
+            pattern,
+          });
+
+          await checkIndex({
+            abortController: abortController.current,
+            ecsMetadata: EcsFlat as unknown as Record<string, EcsMetadata>,
+            formatNumber,
+            indexName,
+            onCheckCompleted,
+            pattern,
+            version: EcsVersion,
+          });
+
+          if (!abortController.current.signal.aborted) {
+            await wait(DELAY_AFTER_EVERY_CHECK_COMPLETES);
+            incrementCheckAllIndiciesChecked();
+          }
+        }
+      }
+
+      if (!abortController.current.signal.aborted) {
+        setIndexToCheck(null);
+        setIsRunning(false);
+      }
+    }
+
+    if (isRunning) {
+      cancelIfRunning();
+    } else {
+      abortController.current = new AbortController();
+      setIsRunning(true);
+      beginCheck();
+    }
+  }, [
+    cancelIfRunning,
+    formatNumber,
+    incrementCheckAllIndiciesChecked,
+    isRunning,
+    onCheckCompleted,
+    patternIndexNames,
+    setCheckAllIndiciesChecked,
+    setCheckAllTotalIndiciesToCheck,
+    setIndexToCheck,
+  ]);
+
+  useEffect(() => {
+    return () => {
+      // cancel any checks in progress when the patterns or ilm phases change
+      cancelIfRunning();
+    };
+  }, [cancelIfRunning, ilmPhases, patterns]);
+
+  useEffect(() => {
+    return () => {
+      abortController.current.abort();
+    };
+  }, [abortController]);
+
+  return (
+    <EuiButton
+      aria-label={isRunning ? i18n.CANCEL : i18n.CHECK_ALL}
+      fill={!isRunning}
+      onClick={onClick}
+    >
+      {isRunning ? i18n.CANCEL : i18n.CHECK_ALL}
+    </EuiButton>
+  );
+};
+
+export const CheckAll = React.memo(CheckAllComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/translations.ts
new file mode 100644
index 0000000000000..d63acdb418a17
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/check_all/translations.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const AN_ERROR_OCCURRED_CHECKING_INDEX = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.checkAllErrorCheckingIndexMessage', {
+    values: { indexName },
+    defaultMessage: 'An error occurred checking index {indexName}',
+  });
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/index.tsx
new file mode 100644
index 0000000000000..d659d81d93199
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/index.tsx
@@ -0,0 +1,240 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import { sortBy } from 'lodash/fp';
+import React, { useCallback } from 'react';
+import styled from 'styled-components';
+
+import { CheckAll } from './check_all';
+import { ERROR, INDEX, PATTERN } from '../errors_viewer/translations';
+import { ERRORS } from '../errors_popover/translations';
+import { EMPTY_STAT } from '../../../helpers';
+import {
+  getDataQualitySummaryMarkdownComment,
+  getErrorsMarkdownTable,
+  getErrorsMarkdownTableRows,
+  getPatternSummaryMarkdownComment,
+  getSummaryTableMarkdownHeader,
+  getSummaryTableMarkdownRow,
+} from '../../index_properties/markdown/helpers';
+import { getSummaryTableItems } from '../../pattern/helpers';
+import { TakeActionMenu } from './take_action_menu';
+import type {
+  DataQualityCheckResult,
+  ErrorSummary,
+  IndexToCheck,
+  OnCheckCompleted,
+  PatternRollup,
+} from '../../../types';
+
+const SummaryActionsFlexGroup = styled(EuiFlexGroup)`
+  gap: ${({ theme }) => theme.eui.euiSizeS};
+`;
+
+export const getResultsSortedByDocsCount = (
+  results: Record<string, DataQualityCheckResult> | undefined
+): DataQualityCheckResult[] =>
+  results != null ? sortBy('docsCount', Object.values(results)).reverse() : [];
+
+export const getAllMarkdownCommentsFromResults = ({
+  formatNumber,
+  patternIndexNames,
+  patternRollup,
+}: {
+  formatNumber: (value: number | undefined) => string;
+  patternIndexNames: Record<string, string[]>;
+  patternRollup: PatternRollup;
+}): string[] => {
+  const results = patternRollup.results;
+  const sortedResults = getResultsSortedByDocsCount(results);
+
+  const summaryTableItems = getSummaryTableItems({
+    ilmExplain: patternRollup.ilmExplain,
+    indexNames: patternIndexNames[patternRollup.pattern] ?? [],
+    pattern: patternRollup.pattern,
+    patternDocsCount: patternRollup.docsCount ?? 0,
+    results: patternRollup.results,
+    stats: patternRollup.stats,
+  });
+
+  const summaryTableMarkdownRows: string[] = summaryTableItems.map((item) => {
+    const result: DataQualityCheckResult | undefined =
+      patternRollup.results != null ? patternRollup.results[item.indexName] : undefined;
+
+    return getSummaryTableMarkdownRow({
+      docsCount: item.docsCount,
+      formatNumber,
+      ilmPhase: item.ilmPhase,
+      indexName: item.indexName,
+      incompatible: result?.incompatible,
+      patternDocsCount: patternRollup.docsCount ?? 0,
+    }).trim();
+  });
+
+  const initialComments: string[] =
+    summaryTableMarkdownRows.length > 0
+      ? [getSummaryTableMarkdownHeader(), ...summaryTableMarkdownRows]
+      : [];
+
+  return sortedResults.reduce<string[]>(
+    (acc, result) => [...acc, ...result.markdownComments],
+    initialComments
+  );
+};
+
+export const getAllMarkdownComments = ({
+  formatNumber,
+  patternIndexNames,
+  patternRollups,
+}: {
+  formatNumber: (value: number | undefined) => string;
+  patternIndexNames: Record<string, string[]>;
+  patternRollups: Record<string, PatternRollup>;
+}): string[] => {
+  const allPatterns: string[] = Object.keys(patternRollups);
+
+  // sort the patterns A-Z:
+  const sortedPatterns = [...allPatterns].sort((a, b) => {
+    return a.localeCompare(b);
+  });
+
+  return sortedPatterns.reduce<string[]>(
+    (acc, pattern) => [
+      ...acc,
+      getPatternSummaryMarkdownComment({
+        formatNumber,
+        patternRollup: patternRollups[pattern],
+      }),
+      ...getAllMarkdownCommentsFromResults({
+        formatNumber,
+        patternRollup: patternRollups[pattern],
+        patternIndexNames,
+      }),
+    ],
+    []
+  );
+};
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  canUserCreateAndReadCases: () => boolean;
+  defaultNumberFormat: string;
+  errorSummary: ErrorSummary[];
+  ilmPhases: string[];
+  incrementCheckAllIndiciesChecked: () => void;
+  onCheckCompleted: OnCheckCompleted;
+  openCreateCaseFlyout: ({
+    comments,
+    headerContent,
+  }: {
+    comments: string[];
+    headerContent?: React.ReactNode;
+  }) => void;
+  patternIndexNames: Record<string, string[]>;
+  patternRollups: Record<string, PatternRollup>;
+  patterns: string[];
+  setCheckAllIndiciesChecked: (checkAllIndiciesChecked: number) => void;
+  setCheckAllTotalIndiciesToCheck: (checkAllTotalIndiciesToCheck: number) => void;
+  setIndexToCheck: (indexToCheck: IndexToCheck | null) => void;
+  totalDocsCount: number | undefined;
+  totalIncompatible: number | undefined;
+  totalIndices: number | undefined;
+  totalIndicesChecked: number | undefined;
+}
+
+const SummaryActionsComponent: React.FC<Props> = ({
+  addSuccessToast,
+  canUserCreateAndReadCases,
+  defaultNumberFormat,
+  errorSummary,
+  ilmPhases,
+  incrementCheckAllIndiciesChecked,
+  onCheckCompleted,
+  openCreateCaseFlyout,
+  patternIndexNames,
+  patternRollups,
+  patterns,
+  totalDocsCount,
+  setCheckAllIndiciesChecked,
+  setCheckAllTotalIndiciesToCheck,
+  setIndexToCheck,
+  totalIncompatible,
+  totalIndices,
+  totalIndicesChecked,
+}) => {
+  const formatNumber = useCallback(
+    (value: number | undefined): string =>
+      value != null ? numeral(value).format(defaultNumberFormat) : EMPTY_STAT,
+    [defaultNumberFormat]
+  );
+
+  const getMarkdownComments = useCallback(
+    (): string[] => [
+      getDataQualitySummaryMarkdownComment({
+        formatNumber,
+        totalDocsCount,
+        totalIncompatible,
+        totalIndices,
+        totalIndicesChecked,
+      }),
+      ...getAllMarkdownComments({
+        formatNumber,
+        patternIndexNames,
+        patternRollups,
+      }),
+      getErrorsMarkdownTable({
+        errorSummary,
+        getMarkdownTableRows: getErrorsMarkdownTableRows,
+        headerNames: [PATTERN, INDEX, ERROR],
+        title: ERRORS,
+      }),
+    ],
+    [
+      errorSummary,
+      formatNumber,
+      patternIndexNames,
+      patternRollups,
+      totalDocsCount,
+      totalIncompatible,
+      totalIndices,
+      totalIndicesChecked,
+    ]
+  );
+
+  return (
+    <SummaryActionsFlexGroup alignItems="center" gutterSize="none">
+      <EuiFlexItem grow={false}>
+        <CheckAll
+          defaultNumberFormat={defaultNumberFormat}
+          ilmPhases={ilmPhases}
+          incrementCheckAllIndiciesChecked={incrementCheckAllIndiciesChecked}
+          onCheckCompleted={onCheckCompleted}
+          patternIndexNames={patternIndexNames}
+          patterns={patterns}
+          setCheckAllIndiciesChecked={setCheckAllIndiciesChecked}
+          setCheckAllTotalIndiciesToCheck={setCheckAllTotalIndiciesToCheck}
+          setIndexToCheck={setIndexToCheck}
+        />
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>
+        <TakeActionMenu
+          addSuccessToast={addSuccessToast}
+          canUserCreateAndReadCases={canUserCreateAndReadCases}
+          getMarkdownComments={getMarkdownComments}
+          openCreateCaseFlyout={openCreateCaseFlyout}
+        />
+      </EuiFlexItem>
+    </SummaryActionsFlexGroup>
+  );
+};
+
+SummaryActionsComponent.displayName = 'SummaryActionsComponent';
+
+export const SummaryActions = React.memo(SummaryActionsComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/take_action_menu/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/take_action_menu/index.tsx
new file mode 100644
index 0000000000000..4683a96a76987
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/take_action_menu/index.tsx
@@ -0,0 +1,125 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  copyToClipboard,
+  EuiButtonEmpty,
+  EuiContextMenuItem,
+  EuiContextMenuPanel,
+  EuiPopover,
+} from '@elastic/eui';
+import React, { useCallback, useMemo, useState } from 'react';
+
+import {
+  ADD_TO_NEW_CASE,
+  COPIED_RESULTS_TOAST_TITLE,
+  COPY_TO_CLIPBOARD,
+} from '../../../../translations';
+import * as i18n from './translations';
+import { useAddToNewCase } from '../../../../use_add_to_new_case';
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  canUserCreateAndReadCases: () => boolean;
+  getMarkdownComments: () => string[];
+  openCreateCaseFlyout: ({
+    comments,
+    headerContent,
+  }: {
+    comments: string[];
+    headerContent?: React.ReactNode;
+  }) => void;
+}
+
+const TakeActionMenuComponent: React.FC<Props> = ({
+  addSuccessToast,
+  canUserCreateAndReadCases,
+  getMarkdownComments,
+  openCreateCaseFlyout,
+}) => {
+  const [isPopoverOpen, setIsPopoverOpen] = useState<boolean>(false);
+  const closePopover = useCallback(() => {
+    setIsPopoverOpen(false);
+  }, []);
+  const onButtonClick = useCallback(() => {
+    setIsPopoverOpen((current) => !current);
+  }, []);
+
+  const takeActionButton = useMemo(
+    () => (
+      <EuiButtonEmpty
+        aria-label={i18n.TAKE_ACTION}
+        iconSide="right"
+        iconType="arrowDown"
+        onClick={onButtonClick}
+      >
+        {i18n.TAKE_ACTION}
+      </EuiButtonEmpty>
+    ),
+    [onButtonClick]
+  );
+
+  const { disabled: addToNewCaseDisabled, onAddToNewCase } = useAddToNewCase({
+    canUserCreateAndReadCases,
+    openCreateCaseFlyout,
+  });
+
+  const onClickAddToCase = useCallback(
+    () => onAddToNewCase([getMarkdownComments().join('\n')]),
+    [getMarkdownComments, onAddToNewCase]
+  );
+
+  const onCopy = useCallback(() => {
+    const markdown = getMarkdownComments().join('\n');
+    copyToClipboard(markdown);
+
+    closePopover();
+
+    addSuccessToast({
+      title: COPIED_RESULTS_TOAST_TITLE,
+    });
+  }, [addSuccessToast, closePopover, getMarkdownComments]);
+
+  const addToNewCaseContextMenuOnClick = useCallback(() => {
+    closePopover();
+    onClickAddToCase();
+  }, [closePopover, onClickAddToCase]);
+
+  const items = useMemo(
+    () => [
+      <EuiContextMenuItem
+        disabled={addToNewCaseDisabled}
+        key="addToNewCase"
+        onClick={addToNewCaseContextMenuOnClick}
+      >
+        {ADD_TO_NEW_CASE}
+      </EuiContextMenuItem>,
+
+      <EuiContextMenuItem key="copyToClipboard" onClick={onCopy}>
+        {COPY_TO_CLIPBOARD}
+      </EuiContextMenuItem>,
+    ],
+    [addToNewCaseContextMenuOnClick, addToNewCaseDisabled, onCopy]
+  );
+
+  return (
+    <EuiPopover
+      anchorPosition="downLeft"
+      button={takeActionButton}
+      closePopover={closePopover}
+      isOpen={isPopoverOpen}
+      panelPaddingSize="none"
+      repositionOnScroll
+    >
+      <EuiContextMenuPanel items={items} size="s" />
+    </EuiPopover>
+  );
+};
+
+TakeActionMenuComponent.displayName = 'TakeActionMenuComponent';
+
+export const TakeActionMenu = React.memo(TakeActionMenuComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/take_action_menu/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/take_action_menu/translations.ts
new file mode 100644
index 0000000000000..b5f77c455c1a2
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/data_quality_summary/summary_actions/take_action_menu/translations.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const TAKE_ACTION = i18n.translate(
+  'ecsDataQualityDashboard.takeActionMenu.takeActionButton',
+  {
+    defaultMessage: 'Take action',
+  }
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/error_empty_prompt/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/error_empty_prompt/index.tsx
new file mode 100644
index 0000000000000..9a81fcd9ad7e6
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/error_empty_prompt/index.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCallOut, EuiCode } from '@elastic/eui';
+import React from 'react';
+
+import * as i18n from '../data_quality_summary/errors_popover/translations';
+
+interface Props {
+  title: string;
+}
+
+const ErrorEmptyPromptComponent: React.FC<Props> = ({ title }) => (
+  <EuiCallOut color="danger" size="s" title={title}>
+    <p>{i18n.ERRORS_MAY_OCCUR}</p>
+
+    <span>{i18n.THE_FOLLOWING_PRIVILEGES_ARE_REQUIRED}</span>
+    <ul>
+      <li>
+        <EuiCode>{i18n.MONITOR}</EuiCode> {i18n.OR} <EuiCode>{i18n.MANAGE}</EuiCode>
+      </li>
+      <li>
+        <EuiCode>{i18n.VIEW_INDEX_METADATA}</EuiCode>
+      </li>
+      <li>
+        <EuiCode>{i18n.READ}</EuiCode> {i18n.OR} <EuiCode>{i18n.READ_CROSS_CLUSTER}</EuiCode>
+      </li>
+    </ul>
+  </EuiCallOut>
+);
+
+export const ErrorEmptyPrompt = React.memo(ErrorEmptyPromptComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/ilm_phase_counts/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/ilm_phase_counts/index.tsx
new file mode 100644
index 0000000000000..3aa738d4cb788
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/ilm_phase_counts/index.tsx
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiBadge, EuiFlexGroup, EuiFlexItem, EuiToolTip } from '@elastic/eui';
+import React from 'react';
+import styled from 'styled-components';
+
+import { getPatternIlmPhaseDescription } from '../../helpers';
+import type { IlmExplainPhaseCounts, IlmPhase } from '../../types';
+
+const PhaseCountsFlexGroup = styled(EuiFlexGroup)`
+  display: inline-flex;
+  gap: ${({ theme }) => theme.eui.euiSizeS};
+`;
+
+export const phases: IlmPhase[] = ['hot', 'unmanaged', 'warm', 'cold', 'frozen'];
+
+interface Props {
+  ilmExplainPhaseCounts: IlmExplainPhaseCounts;
+  pattern: string;
+}
+
+const IlmPhaseCountsComponent: React.FC<Props> = ({ ilmExplainPhaseCounts, pattern }) => (
+  <PhaseCountsFlexGroup gutterSize="none">
+    {phases.map((phase) =>
+      ilmExplainPhaseCounts[phase] != null && ilmExplainPhaseCounts[phase] > 0 ? (
+        <EuiFlexItem key={phase} grow={false}>
+          <EuiToolTip
+            content={getPatternIlmPhaseDescription({
+              indices: ilmExplainPhaseCounts[phase],
+              pattern,
+              phase,
+            })}
+          >
+            <EuiBadge color="hollow">{`${phase} (${ilmExplainPhaseCounts[phase]})`}</EuiBadge>
+          </EuiToolTip>
+        </EuiFlexItem>
+      ) : null
+    )}
+  </PhaseCountsFlexGroup>
+);
+
+IlmPhaseCountsComponent.displayName = 'IlmPhaseCountsComponent';
+
+export const IlmPhaseCounts = React.memo(IlmPhaseCountsComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/empty_prompt_body.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/empty_prompt_body.tsx
new file mode 100644
index 0000000000000..80c9151eaa050
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/empty_prompt_body.tsx
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+interface Props {
+  body: string;
+}
+
+const EmptyPromptBodyComponent: React.FC<Props> = ({ body }) => <p>{body}</p>;
+
+EmptyPromptBodyComponent.displayName = 'EmptyPromptBodyComponent';
+
+export const EmptyPromptBody = React.memo(EmptyPromptBodyComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/empty_prompt_title.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/empty_prompt_title.tsx
new file mode 100644
index 0000000000000..a9d2e1f6a74d9
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/empty_prompt_title.tsx
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+interface Props {
+  title: string;
+}
+
+const EmptyPromptTitleComponent: React.FC<Props> = ({ title }) => <h2>{title}</h2>;
+
+EmptyPromptTitleComponent.displayName = 'EmptyPromptTitleComponent';
+
+export const EmptyPromptTitle = React.memo(EmptyPromptTitleComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/helpers.ts
new file mode 100644
index 0000000000000..e38a87ee30a65
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/helpers.ts
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  IndicesGetMappingIndexMappingRecord,
+  MappingProperty,
+} from '@elastic/elasticsearch/lib/api/types';
+import { sortBy } from 'lodash/fp';
+
+import {
+  getEnrichedFieldMetadata,
+  getFieldTypes,
+  getMissingTimestampFieldMetadata,
+  getPartitionedFieldMetadata,
+} from '../../helpers';
+import type { EcsMetadata, PartitionedFieldMetadata, UnallowedValueCount } from '../../types';
+
+export const ALL_TAB_ID = 'allTab';
+export const ECS_COMPLIANT_TAB_ID = 'ecsCompliantTab';
+export const CUSTOM_TAB_ID = 'customTab';
+export const INCOMPATIBLE_TAB_ID = 'incompatibleTab';
+export const SUMMARY_TAB_ID = 'summaryTab';
+
+export const EMPTY_METADATA: PartitionedFieldMetadata = {
+  all: [],
+  ecsCompliant: [],
+  custom: [],
+  incompatible: [],
+};
+
+export const getSortedPartitionedFieldMetadata = ({
+  ecsMetadata,
+  loadingMappings,
+  mappingsProperties,
+  unallowedValues,
+}: {
+  ecsMetadata: Record<string, EcsMetadata> | null;
+  loadingMappings: boolean;
+  mappingsProperties: Record<string, MappingProperty> | null | undefined;
+  unallowedValues: Record<string, UnallowedValueCount[]> | null;
+}): PartitionedFieldMetadata | null => {
+  if (loadingMappings || ecsMetadata == null || unallowedValues == null) {
+    return null;
+  }
+
+  if (mappingsProperties == null) {
+    return {
+      ...EMPTY_METADATA,
+      incompatible: [getMissingTimestampFieldMetadata()],
+    };
+  }
+
+  const fieldTypes = getFieldTypes(mappingsProperties);
+
+  const enrichedFieldMetadata = sortBy(
+    'indexFieldName',
+    fieldTypes.map((fieldMetadata) =>
+      getEnrichedFieldMetadata({ ecsMetadata, fieldMetadata, unallowedValues })
+    )
+  );
+
+  const partitionedFieldMetadata = getPartitionedFieldMetadata(enrichedFieldMetadata);
+
+  return partitionedFieldMetadata;
+};
+
+export const getMappingsProperties = ({
+  indexes,
+  indexName,
+}: {
+  indexes: Record<string, IndicesGetMappingIndexMappingRecord> | null;
+  indexName: string;
+}): Record<string, MappingProperty> | null => {
+  if (indexes != null && indexes[indexName] != null) {
+    return indexes[indexName].mappings.properties ?? null;
+  }
+
+  return null;
+};
+
+export const hasAllDataFetchingCompleted = ({
+  loadingMappings,
+  loadingUnallowedValues,
+}: {
+  loadingMappings: boolean;
+  loadingUnallowedValues: boolean;
+}): boolean => loadingMappings === false && loadingUnallowedValues === false;
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/index.tsx
new file mode 100644
index 0000000000000..34fac241a2d82
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/index.tsx
@@ -0,0 +1,276 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EcsFlat } from '@kbn/ecs';
+import type {
+  FlameElementEvent,
+  HeatmapElementEvent,
+  MetricElementEvent,
+  PartitionElementEvent,
+  Theme,
+  WordCloudElementEvent,
+  XYChartElementEvent,
+} from '@elastic/charts';
+import { EuiSpacer, EuiTab, EuiTabs } from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
+
+import { getUnallowedValueRequestItems } from '../allowed_values/helpers';
+import { ErrorEmptyPrompt } from '../error_empty_prompt';
+import {
+  EMPTY_METADATA,
+  getMappingsProperties,
+  getSortedPartitionedFieldMetadata,
+  hasAllDataFetchingCompleted,
+  INCOMPATIBLE_TAB_ID,
+} from './helpers';
+import { EMPTY_STAT } from '../../helpers';
+import { LoadingEmptyPrompt } from '../loading_empty_prompt';
+import { getTabs } from '../tabs/helpers';
+import { getAllIncompatibleMarkdownComments } from '../tabs/incompatible_tab/helpers';
+import * as i18n from './translations';
+import type { EcsMetadata, IlmPhase, PartitionedFieldMetadata, PatternRollup } from '../../types';
+import { useAddToNewCase } from '../../use_add_to_new_case';
+import { useMappings } from '../../use_mappings';
+import { useUnallowedValues } from '../../use_unallowed_values';
+
+const EMPTY_MARKDOWN_COMMENTS: string[] = [];
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  canUserCreateAndReadCases: () => boolean;
+  defaultNumberFormat: string;
+  docsCount: number;
+  getGroupByFieldsOnClick: (
+    elements: Array<
+      | FlameElementEvent
+      | HeatmapElementEvent
+      | MetricElementEvent
+      | PartitionElementEvent
+      | WordCloudElementEvent
+      | XYChartElementEvent
+    >
+  ) => {
+    groupByField0: string;
+    groupByField1: string;
+  };
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  openCreateCaseFlyout: ({
+    comments,
+    headerContent,
+  }: {
+    comments: string[];
+    headerContent?: React.ReactNode;
+  }) => void;
+  pattern: string;
+  patternRollup: PatternRollup | undefined;
+  theme: Theme;
+  updatePatternRollup: (patternRollup: PatternRollup) => void;
+}
+
+const IndexPropertiesComponent: React.FC<Props> = ({
+  addSuccessToast,
+  canUserCreateAndReadCases,
+  defaultNumberFormat,
+  docsCount,
+  getGroupByFieldsOnClick,
+  ilmPhase,
+  indexName,
+  openCreateCaseFlyout,
+  pattern,
+  patternRollup,
+  theme,
+  updatePatternRollup,
+}) => {
+  const formatNumber = useCallback(
+    (value: number | undefined): string =>
+      value != null ? numeral(value).format(defaultNumberFormat) : EMPTY_STAT,
+    [defaultNumberFormat]
+  );
+  const { error: mappingsError, indexes, loading: loadingMappings } = useMappings(indexName);
+
+  const requestItems = useMemo(
+    () =>
+      getUnallowedValueRequestItems({
+        ecsMetadata: EcsFlat as unknown as Record<string, EcsMetadata>,
+        indexName,
+      }),
+    [indexName]
+  );
+
+  const {
+    error: unallowedValuesError,
+    loading: loadingUnallowedValues,
+    unallowedValues,
+  } = useUnallowedValues({ indexName, requestItems });
+
+  const mappingsProperties = useMemo(
+    () =>
+      getMappingsProperties({
+        indexes,
+        indexName,
+      }),
+    [indexName, indexes]
+  );
+
+  const partitionedFieldMetadata: PartitionedFieldMetadata | null = useMemo(
+    () =>
+      getSortedPartitionedFieldMetadata({
+        ecsMetadata: EcsFlat as unknown as Record<string, EcsMetadata>,
+        loadingMappings,
+        mappingsProperties,
+        unallowedValues,
+      }),
+    [loadingMappings, mappingsProperties, unallowedValues]
+  );
+
+  const { disabled: addToNewCaseDisabled, onAddToNewCase } = useAddToNewCase({
+    canUserCreateAndReadCases,
+    indexName,
+    openCreateCaseFlyout,
+  });
+
+  const [selectedTabId, setSelectedTabId] = useState<string>(INCOMPATIBLE_TAB_ID);
+
+  const tabs = useMemo(
+    () =>
+      getTabs({
+        addSuccessToast,
+        addToNewCaseDisabled,
+        defaultNumberFormat,
+        docsCount,
+        getGroupByFieldsOnClick,
+        ilmPhase,
+        indexName,
+        onAddToNewCase,
+        partitionedFieldMetadata: partitionedFieldMetadata ?? EMPTY_METADATA,
+        pattern,
+        patternDocsCount: patternRollup?.docsCount ?? 0,
+        setSelectedTabId,
+        theme,
+      }),
+    [
+      addSuccessToast,
+      addToNewCaseDisabled,
+      defaultNumberFormat,
+      docsCount,
+      getGroupByFieldsOnClick,
+      ilmPhase,
+      indexName,
+      onAddToNewCase,
+      partitionedFieldMetadata,
+      pattern,
+      patternRollup?.docsCount,
+      theme,
+    ]
+  );
+
+  const onSelectedTabChanged = useCallback((id: string) => {
+    setSelectedTabId(id);
+  }, []);
+
+  const selectedTabContent = useMemo(
+    () => (
+      <>
+        <EuiSpacer />
+        {tabs.find((obj) => obj.id === selectedTabId)?.content}
+      </>
+    ),
+    [selectedTabId, tabs]
+  );
+
+  const renderTabs = useCallback(
+    () =>
+      tabs.map((tab, index) => (
+        <EuiTab
+          append={tab.append}
+          isSelected={tab.id === selectedTabId}
+          key={index}
+          onClick={() => onSelectedTabChanged(tab.id)}
+        >
+          {tab.name}
+        </EuiTab>
+      )),
+    [onSelectedTabChanged, selectedTabId, tabs]
+  );
+
+  useEffect(() => {
+    if (hasAllDataFetchingCompleted({ loadingMappings, loadingUnallowedValues })) {
+      const error: string | null = mappingsError ?? unallowedValuesError;
+      const indexIncompatible: number | undefined =
+        error == null && partitionedFieldMetadata != null
+          ? partitionedFieldMetadata.incompatible.length
+          : undefined;
+
+      if (patternRollup != null) {
+        const markdownComments =
+          partitionedFieldMetadata != null
+            ? getAllIncompatibleMarkdownComments({
+                docsCount,
+                formatNumber,
+                ilmPhase,
+                indexName,
+                partitionedFieldMetadata,
+                patternDocsCount: patternRollup.docsCount ?? 0,
+              })
+            : EMPTY_MARKDOWN_COMMENTS;
+
+        updatePatternRollup({
+          ...patternRollup,
+          results: {
+            ...patternRollup.results,
+            [indexName]: {
+              docsCount,
+              error,
+              ilmPhase,
+              incompatible: indexIncompatible,
+              indexName,
+              markdownComments,
+              pattern,
+            },
+          },
+        });
+      }
+    }
+  }, [
+    docsCount,
+    formatNumber,
+    ilmPhase,
+    indexName,
+    loadingMappings,
+    loadingUnallowedValues,
+    mappingsError,
+    partitionedFieldMetadata,
+    pattern,
+    patternRollup,
+    unallowedValuesError,
+    updatePatternRollup,
+  ]);
+
+  if (mappingsError != null) {
+    return <ErrorEmptyPrompt title={i18n.ERROR_LOADING_MAPPINGS_TITLE} />;
+  } else if (unallowedValuesError != null) {
+    return <ErrorEmptyPrompt title={i18n.ERROR_LOADING_UNALLOWED_VALUES_TITLE} />;
+  }
+
+  if (loadingMappings) {
+    return <LoadingEmptyPrompt loading={i18n.LOADING_MAPPINGS} />;
+  } else if (loadingUnallowedValues) {
+    return <LoadingEmptyPrompt loading={i18n.LOADING_UNALLOWED_VALUES} />;
+  }
+
+  return indexes != null ? (
+    <>
+      <EuiTabs>{renderTabs()}</EuiTabs>
+      {selectedTabContent}
+    </>
+  ) : null;
+};
+IndexPropertiesComponent.displayName = 'IndexPropertiesComponent';
+
+export const IndexProperties = React.memo(IndexPropertiesComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/markdown/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/markdown/helpers.ts
new file mode 100644
index 0000000000000..a4df52d02ca58
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/markdown/helpers.ts
@@ -0,0 +1,379 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { repeat } from 'lodash/fp';
+
+import {
+  ERRORS_MAY_OCCUR,
+  ERRORS_CALLOUT_SUMMARY,
+  MANAGE,
+  MONITOR,
+  OR,
+  READ,
+  READ_CROSS_CLUSTER,
+  THE_FOLLOWING_PRIVILEGES_ARE_REQUIRED,
+  VIEW_INDEX_METADATA,
+} from '../../data_quality_summary/errors_popover/translations';
+import {
+  EMPTY_STAT,
+  getTotalPatternIncompatible,
+  getTotalPatternIndicesChecked,
+} from '../../../helpers';
+import { HOT, WARM, COLD, FROZEN, UNMANAGED } from '../../../ilm_phases_empty_prompt/translations';
+import * as i18n from '../translations';
+import type {
+  AllowedValue,
+  EnrichedFieldMetadata,
+  ErrorSummary,
+  IlmExplainPhaseCounts,
+  IlmPhase,
+  PartitionedFieldMetadata,
+  PatternRollup,
+  UnallowedValueCount,
+} from '../../../types';
+import { getDocsCountPercent } from '../../summary_table/helpers';
+import {
+  DOCS,
+  ILM_PHASE,
+  INCOMPATIBLE_FIELDS,
+  INDEX,
+  INDICES,
+  INDICES_CHECKED,
+  RESULT,
+} from '../../summary_table/translations';
+import { DATA_QUALITY_TITLE } from '../../../translations';
+
+export const EMPTY_PLACEHOLDER = '--';
+
+export const TRIPLE_BACKTICKS = '```';
+
+export const ECS_FIELD_REFERENCE_URL =
+  'https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html';
+
+/** The documentation link shown in the `Data Quality` dashboard */
+export const ECS_REFERENCE_URL = 'https://www.elastic.co/guide/en/ecs/current/ecs-reference.html';
+export const MAPPING_URL =
+  'https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html';
+
+export const escape = (content: string | undefined): string | undefined =>
+  content != null ? content.replaceAll('\n', ' ').replaceAll('|', '\\|') : content;
+
+export const escapePreserveNewlines = (content: string | undefined): string | undefined =>
+  content != null ? content.replaceAll('|', '\\|') : content;
+
+export const getHeaderSeparator = (headerLength: number): string => repeat(headerLength + 2, '-');
+
+export const getMarkdownTableHeader = (headerNames: string[]) => `
+| ${headerNames.map((name) => `${escape(name)} | `).join('')}
+|${headerNames.map((name) => `${getHeaderSeparator(name.length)}|`).join('')}`;
+
+export const getCodeFormattedValue = (value: string | undefined) =>
+  `\`${escape(value ?? EMPTY_PLACEHOLDER)}\``;
+
+export const getAllowedValues = (allowedValues: AllowedValue[] | undefined): string =>
+  allowedValues == null
+    ? getCodeFormattedValue(undefined)
+    : allowedValues.map((x) => getCodeFormattedValue(x.name)).join(', ');
+
+export const getIndexInvalidValues = (indexInvalidValues: UnallowedValueCount[]): string =>
+  indexInvalidValues.length === 0
+    ? getCodeFormattedValue(undefined)
+    : indexInvalidValues
+        .map(({ fieldName, count }) => `${getCodeFormattedValue(escape(fieldName))} (${count})`)
+        .join(',\n');
+
+export const getCommonMarkdownTableRows = (
+  enrichedFieldMetadata: EnrichedFieldMetadata[]
+): string =>
+  enrichedFieldMetadata
+    .map(
+      (x) =>
+        `| ${escape(x.indexFieldName)} | ${getCodeFormattedValue(x.type)} | ${getCodeFormattedValue(
+          x.indexFieldType
+        )}  | ${getAllowedValues(x.allowed_values)} | ${getIndexInvalidValues(
+          x.indexInvalidValues
+        )} | ${escape(x.description ?? EMPTY_PLACEHOLDER)} |`
+    )
+    .join('\n');
+
+export const getCustomMarkdownTableRows = (
+  enrichedFieldMetadata: EnrichedFieldMetadata[]
+): string =>
+  enrichedFieldMetadata
+    .map(
+      (x) =>
+        `| ${escape(x.indexFieldName)} | ${getCodeFormattedValue(
+          x.indexFieldType
+        )} | ${getAllowedValues(x.allowed_values)} |`
+    )
+    .join('\n');
+
+export const getIncompatibleMappingsMarkdownTableRows = (
+  incompatibleMappings: EnrichedFieldMetadata[]
+): string =>
+  incompatibleMappings
+    .map(
+      (x) =>
+        `| ${escape(x.indexFieldName)} | ${getCodeFormattedValue(x.type)} | ${getCodeFormattedValue(
+          x.indexFieldType
+        )} |`
+    )
+    .join('\n');
+
+export const getIncompatibleValuesMarkdownTableRows = (
+  incompatibleValues: EnrichedFieldMetadata[]
+): string =>
+  incompatibleValues
+    .map(
+      (x) =>
+        `| ${escape(x.indexFieldName)} | ${getAllowedValues(
+          x.allowed_values
+        )} | ${getIndexInvalidValues(x.indexInvalidValues)} |`
+    )
+    .join('\n');
+
+export const getMarkdownComment = ({
+  suggestedAction,
+  title,
+}: {
+  suggestedAction: string;
+  title: string;
+}): string =>
+  `#### ${escape(title)}
+
+${escapePreserveNewlines(suggestedAction)}`;
+
+export const getErrorsMarkdownTableRows = (errorSummary: ErrorSummary[]): string =>
+  errorSummary
+    .map(
+      ({ pattern, indexName, error }) =>
+        `| ${escape(pattern)} | ${escape(indexName ?? EMPTY_PLACEHOLDER)} | ${getCodeFormattedValue(
+          error
+        )} |`
+    )
+    .join('\n');
+
+export const getErrorsMarkdownTable = ({
+  errorSummary,
+  getMarkdownTableRows,
+  headerNames,
+  title,
+}: {
+  errorSummary: ErrorSummary[];
+  getMarkdownTableRows: (errorSummary: ErrorSummary[]) => string;
+  headerNames: string[];
+  title: string;
+}): string =>
+  errorSummary.length > 0
+    ? `## ${escape(title)}
+
+${ERRORS_CALLOUT_SUMMARY}
+
+${ERRORS_MAY_OCCUR}
+
+${THE_FOLLOWING_PRIVILEGES_ARE_REQUIRED}
+- \`${MONITOR}\` ${OR} \`${MANAGE}\`
+- \`${VIEW_INDEX_METADATA}\`
+- \`${READ}\` ${OR} \`${READ_CROSS_CLUSTER}\`
+
+${getMarkdownTableHeader(headerNames)}
+${getMarkdownTableRows(errorSummary)}
+`
+    : '';
+
+export const getMarkdownTable = ({
+  enrichedFieldMetadata,
+  getMarkdownTableRows,
+  headerNames,
+  title,
+}: {
+  enrichedFieldMetadata: EnrichedFieldMetadata[];
+  getMarkdownTableRows: (enrichedFieldMetadata: EnrichedFieldMetadata[]) => string;
+  headerNames: string[];
+  title: string;
+}): string =>
+  enrichedFieldMetadata.length > 0
+    ? `#### ${escape(title)}
+
+${getMarkdownTableHeader(headerNames)}
+${getMarkdownTableRows(enrichedFieldMetadata)}
+`
+    : '';
+
+export const getSummaryMarkdownComment = ({
+  ecsFieldReferenceUrl,
+  ecsReferenceUrl,
+  incompatible,
+  indexName,
+  mappingUrl,
+}: {
+  ecsFieldReferenceUrl: string;
+  ecsReferenceUrl: string;
+  incompatible: number | undefined;
+  indexName: string;
+  mappingUrl: string;
+}): string =>
+  `### ${escape(indexName)}
+`;
+
+export const getTabCountsMarkdownComment = (
+  partitionedFieldMetadata: PartitionedFieldMetadata
+): string =>
+  `### **${i18n.INCOMPATIBLE_FIELDS}** ${getCodeFormattedValue(
+    `${partitionedFieldMetadata.incompatible.length}`
+  )} **${i18n.CUSTOM_FIELDS}** ${getCodeFormattedValue(
+    `${partitionedFieldMetadata.custom.length}`
+  )} **${i18n.ECS_COMPLIANT_FIELDS}** ${getCodeFormattedValue(
+    `${partitionedFieldMetadata.ecsCompliant.length}`
+  )} **${i18n.ALL_FIELDS}** ${getCodeFormattedValue(`${partitionedFieldMetadata.all.length}`)}
+`;
+
+export const getResultEmoji = (incompatible: number | undefined): string => {
+  if (incompatible == null) {
+    return EMPTY_PLACEHOLDER;
+  } else {
+    return incompatible === 0 ? '✅' : '❌';
+  }
+};
+
+export const getSummaryTableMarkdownHeader = (): string =>
+  `| ${RESULT} | ${INDEX} | ${DOCS} | ${INCOMPATIBLE_FIELDS} | ${ILM_PHASE} |
+|--------|-------|------|---------------------|-----------|`;
+
+export const getSummaryTableMarkdownRow = ({
+  docsCount,
+  formatNumber,
+  ilmPhase,
+  incompatible,
+  indexName,
+  patternDocsCount,
+}: {
+  docsCount: number;
+  formatNumber: (value: number | undefined) => string;
+  ilmPhase: IlmPhase | undefined;
+  incompatible: number | undefined;
+  indexName: string;
+  patternDocsCount: number;
+}): string =>
+  `| ${getResultEmoji(incompatible)} | ${escape(indexName)} | ${formatNumber(
+    docsCount
+  )} (${getDocsCountPercent({
+    docsCount,
+    patternDocsCount,
+  })}) | ${incompatible ?? EMPTY_PLACEHOLDER} | ${
+    ilmPhase != null ? getCodeFormattedValue(ilmPhase) : ''
+  } |
+`;
+
+export const getSummaryTableMarkdownComment = ({
+  docsCount,
+  formatNumber,
+  ilmPhase,
+  indexName,
+  partitionedFieldMetadata,
+  patternDocsCount,
+}: {
+  docsCount: number;
+  formatNumber: (value: number | undefined) => string;
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  patternDocsCount: number;
+}): string =>
+  `${getSummaryTableMarkdownHeader()}
+${getSummaryTableMarkdownRow({
+  docsCount,
+  formatNumber,
+  ilmPhase,
+  indexName,
+  incompatible: partitionedFieldMetadata.incompatible.length,
+  patternDocsCount,
+})}
+`;
+
+export const getStatsRollupMarkdownComment = ({
+  docsCount,
+  formatNumber,
+  incompatible,
+  indices,
+  indicesChecked,
+}: {
+  docsCount: number;
+  formatNumber: (value: number | undefined) => string;
+  incompatible: number | undefined;
+  indices: number | undefined;
+  indicesChecked: number | undefined;
+}): string =>
+  `| ${INCOMPATIBLE_FIELDS} | ${INDICES_CHECKED} | ${INDICES} | ${DOCS} |
+|---------------------|-----------------|---------|------|
+| ${incompatible ?? EMPTY_STAT} | ${indicesChecked ?? EMPTY_STAT} | ${
+    indices ?? EMPTY_STAT
+  } | ${formatNumber(docsCount)} |
+`;
+
+export const getDataQualitySummaryMarkdownComment = ({
+  formatNumber,
+  totalDocsCount,
+  totalIncompatible,
+  totalIndices,
+  totalIndicesChecked,
+}: {
+  formatNumber: (value: number | undefined) => string;
+  totalDocsCount: number | undefined;
+  totalIncompatible: number | undefined;
+  totalIndices: number | undefined;
+  totalIndicesChecked: number | undefined;
+}): string =>
+  `# ${DATA_QUALITY_TITLE}
+
+${getStatsRollupMarkdownComment({
+  docsCount: totalDocsCount ?? 0,
+  formatNumber,
+  incompatible: totalIncompatible,
+  indices: totalIndices,
+  indicesChecked: totalIndicesChecked,
+})}
+`;
+
+export const getIlmExplainPhaseCountsMarkdownComment = ({
+  hot,
+  warm,
+  unmanaged,
+  cold,
+  frozen,
+}: IlmExplainPhaseCounts): string =>
+  [
+    hot > 0 ? getCodeFormattedValue(`${HOT}(${hot})`) : '',
+    warm > 0 ? getCodeFormattedValue(`${WARM}(${warm})`) : '',
+    unmanaged > 0 ? getCodeFormattedValue(`${UNMANAGED}(${unmanaged})`) : '',
+    cold > 0 ? getCodeFormattedValue(`${COLD}(${cold})`) : '',
+    frozen > 0 ? getCodeFormattedValue(`${FROZEN}(${frozen})`) : '',
+  ].join(' ');
+
+export const getPatternSummaryMarkdownComment = ({
+  formatNumber,
+  patternRollup,
+  patternRollup: { docsCount, indices, ilmExplainPhaseCounts, pattern, results },
+}: {
+  formatNumber: (value: number | undefined) => string;
+  patternRollup: PatternRollup;
+}): string =>
+  `## ${escape(pattern)}
+${
+  ilmExplainPhaseCounts != null
+    ? getIlmExplainPhaseCountsMarkdownComment(ilmExplainPhaseCounts)
+    : ''
+}
+
+${getStatsRollupMarkdownComment({
+  docsCount: docsCount ?? 0,
+  formatNumber,
+  incompatible: getTotalPatternIncompatible(results),
+  indices,
+  indicesChecked: getTotalPatternIndicesChecked(patternRollup),
+})}
+`;
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/translations.ts
new file mode 100644
index 0000000000000..d7e90c9e480f9
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/translations.ts
@@ -0,0 +1,383 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ADD_TO_NEW_CASE = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.addToNewCaseButton',
+  {
+    defaultMessage: 'Add to new case',
+  }
+);
+
+export const ALL_FIELDS = i18n.translate('ecsDataQualityDashboard.indexProperties.allFieldsLabel', {
+  defaultMessage: 'All fields',
+});
+
+export const ALL_CALLOUT = (version: string) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.allCallout', {
+    values: { version },
+    defaultMessage:
+      "All mappings for the fields in this index, including fields that comply with the Elastic Common Schema (ECS), version {version}, and fields that don't",
+  });
+
+export const ALL_CALLOUT_TITLE = (fieldCount: number) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.allCalloutTitle', {
+    values: { fieldCount },
+    defaultMessage:
+      'All {fieldCount} {fieldCount, plural, =1 {field mapping} other {field mappings}}',
+  });
+
+export const ALL_EMPTY = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.allCalloutEmptyContent',
+  {
+    defaultMessage: 'This index does not contain any mappings',
+  }
+);
+
+export const ALL_EMPTY_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.allCalloutEmptyTitle',
+  {
+    defaultMessage: 'No mappings',
+  }
+);
+
+export const ALL_FIELDS_TABLE_TITLE = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.allTab.allFieldsTableTitle', {
+    values: { indexName },
+    defaultMessage: 'All fields - {indexName}',
+  });
+
+export const SUMMARY_MARKDOWN_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.summaryMarkdownTitle',
+  {
+    defaultMessage: 'Data quality',
+  }
+);
+
+export const SUMMARY_MARKDOWN_DESCRIPTION = ({
+  ecsFieldReferenceUrl,
+  ecsReferenceUrl,
+  indexName,
+  mappingUrl,
+  version,
+}: {
+  ecsFieldReferenceUrl: string;
+  ecsReferenceUrl: string;
+  indexName: string;
+  mappingUrl: string;
+  version: string;
+}) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.summaryMarkdownDescription', {
+    values: { ecsFieldReferenceUrl, ecsReferenceUrl, indexName, mappingUrl, version },
+    defaultMessage:
+      'The `{indexName}` index has [mappings]({mappingUrl}) or field values that are different than the [Elastic Common Schema]({ecsReferenceUrl}) (ECS), version `{version}` [definitions]({ecsFieldReferenceUrl}).',
+  });
+
+export const COPY_TO_CLIPBOARD = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.copyToClipboardButton',
+  {
+    defaultMessage: 'Copy to clipboard',
+  }
+);
+
+export const CUSTOM_FIELDS_TABLE_TITLE = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.customTab.customFieldsTableTitle', {
+    values: { indexName },
+    defaultMessage: 'Custom fields - {indexName}',
+  });
+
+export const CUSTOM_DETECTION_ENGINE_RULES_WORK = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.custonDetectionEngineRulesWorkMessage',
+  {
+    defaultMessage: '✅ Custom detection engine rules work',
+  }
+);
+
+export const DOCS = i18n.translate('ecsDataQualityDashboard.indexProperties.docsLabel', {
+  defaultMessage: 'Docs',
+});
+
+export const ECS_COMPLIANT_FIELDS = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.ecsCompliantFieldsLabel',
+  {
+    defaultMessage: 'ECS compliant fields',
+  }
+);
+
+export const ECS_COMPLIANT_CALLOUT = ({
+  fieldCount,
+  version,
+}: {
+  fieldCount: number;
+  version: string;
+}) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.ecsCompliantCallout', {
+    values: { fieldCount, version },
+    defaultMessage:
+      'The {fieldCount, plural, =1 {index mapping type and document values for this field comply} other {index mapping types and document values of these fields comply}} with the Elastic Common Schema (ECS), version {version}',
+  });
+
+export const ECS_COMPLIANT_CALLOUT_TITLE = (fieldCount: number) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.ecsCompliantCalloutTitle', {
+    values: { fieldCount },
+    defaultMessage: '{fieldCount} ECS compliant {fieldCount, plural, =1 {field} other {fields}}',
+  });
+
+export const ECS_COMPLIANT_EMPTY = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.ecsCompliantEmptyContent',
+  {
+    defaultMessage:
+      'None of the field mappings in this index comply with the Elastic Common Schema (ECS). The index must (at least) contain an @timestamp date field.',
+  }
+);
+
+export const ECS_VERSION_MARKDOWN_COMMENT = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.ecsVersionMarkdownComment',
+  {
+    defaultMessage: 'Elastic Common Schema (ECS) version',
+  }
+);
+
+export const INDEX = i18n.translate('ecsDataQualityDashboard.indexProperties.indexMarkdown', {
+  defaultMessage: 'Index',
+});
+
+export const ECS_COMPLIANT_EMPTY_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.ecsCompliantEmptyTitle',
+  {
+    defaultMessage: 'No ECS compliant Mappings',
+  }
+);
+
+export const ECS_COMPLIANT_MAPPINGS_ARE_FULLY_SUPPORTED = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.ecsCompliantMappingsAreFullySupportedMessage',
+  {
+    defaultMessage: '✅ ECS compliant mappings and field values are fully supported',
+  }
+);
+
+export const ERROR_LOADING_MAPPINGS_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.emptyErrorPrompt.errorLoadingMappingsTitle',
+  {
+    defaultMessage: 'Unable to load index mappings',
+  }
+);
+
+export const ERROR_LOADING_MAPPINGS_BODY = (error: string) =>
+  i18n.translate('ecsDataQualityDashboard.emptyErrorPrompt.errorLoadingMappingsBody', {
+    values: { error },
+    defaultMessage: 'There was a problem loading mappings: {error}',
+  });
+
+export const ERROR_LOADING_UNALLOWED_VALUES_BODY = (error: string) =>
+  i18n.translate('ecsDataQualityDashboard.emptyErrorPrompt.errorLoadingUnallowedValuesBody', {
+    values: { error },
+    defaultMessage: 'There was a problem loading unallowed values: {error}',
+  });
+
+export const ERROR_LOADING_UNALLOWED_VALUES_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.emptyErrorPrompt.errorLoadingUnallowedValuesTitle',
+  {
+    defaultMessage: 'Unable to load unallowed values',
+  }
+);
+
+export const ECS_COMPLIANT_FIELDS_TABLE_TITLE = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.customTab.ecsComplaintFieldsTableTitle', {
+    values: { indexName },
+    defaultMessage: 'ECS complaint fields - {indexName}',
+  });
+
+export const LOADING_MAPPINGS = i18n.translate(
+  'ecsDataQualityDashboard.emptyLoadingPrompt.loadingMappingsPrompt',
+  {
+    defaultMessage: 'Loading mappings',
+  }
+);
+
+export const LOADING_UNALLOWED_VALUES = i18n.translate(
+  'ecsDataQualityDashboard.emptyLoadingPrompt.loadingUnallowedValuesPrompt',
+  {
+    defaultMessage: 'Loading unallowed values',
+  }
+);
+
+export const SUMMARY = i18n.translate('ecsDataQualityDashboard.indexProperties.summaryTab', {
+  defaultMessage: 'Summary',
+});
+
+export const MISSING_TIMESTAMP_CALLOUT = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.missingTimestampCallout',
+  {
+    defaultMessage:
+      'Consider adding an @timestamp (date) field mapping to this index, as required by the Elastic Common Schema (ECS), because:',
+  }
+);
+
+export const MISSING_TIMESTAMP_CALLOUT_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.missingTimestampCalloutTitle',
+  {
+    defaultMessage: 'Missing an @timestamp (date) field mapping for this index',
+  }
+);
+
+export const CUSTOM_FIELDS = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.customFieldsLabel',
+  {
+    defaultMessage: 'Custom fields',
+  }
+);
+
+export const CUSTOM_CALLOUT = ({ fieldCount, version }: { fieldCount: number; version: string }) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.customCallout', {
+    values: { fieldCount, version },
+    defaultMessage:
+      '{fieldCount, plural, =1 {This field is not} other {These fields are not}} defined by the Elastic Common Schema (ECS), version {version}. An index may contain custom fields, however:',
+  });
+
+export const CUSTOM_CALLOUT_TITLE = (fieldCount: number) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.customCalloutTitle', {
+    values: { fieldCount },
+    defaultMessage:
+      '{fieldCount} Custom {fieldCount, plural, =1 {field mapping} other {field mappings}}',
+  });
+
+export const CUSTOM_EMPTY = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.customEmptyContent',
+  {
+    defaultMessage: 'All the field mappings in this index are defined by the Elastic Common Schema',
+  }
+);
+
+export const CUSTOM_EMPTY_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.customEmptyTitle',
+  {
+    defaultMessage: 'All field mappings defined by ECS',
+  }
+);
+
+export const INCOMPATIBLE_FIELDS = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.incompatibleFieldsTab',
+  {
+    defaultMessage: 'Incompatible fields',
+  }
+);
+
+export const INCOMPATIBLE_CALLOUT = ({
+  fieldCount,
+  version,
+}: {
+  fieldCount: number;
+  version: string;
+}) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.incompatibleCallout', {
+    values: { version },
+    defaultMessage:
+      "Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version {version}.",
+  });
+
+export const INCOMPATIBLE_CALLOUT_TITLE = (fieldCount: number) =>
+  i18n.translate('ecsDataQualityDashboard.indexProperties.incompatibleCalloutTitle', {
+    values: { fieldCount },
+    defaultMessage: '{fieldCount} incompatible {fieldCount, plural, =1 {field} other {fields}}',
+  });
+
+export const INCOMPATIBLE_EMPTY = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.incompatibleEmptyContent',
+  {
+    defaultMessage:
+      'All of the field mappings and document values in this index are compliant with the Elastic Common Schema (ECS).',
+  }
+);
+
+export const INCOMPATIBLE_EMPTY_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.incompatibleEmptyTitle',
+  {
+    defaultMessage: 'All field mappings and values are ECS compliant',
+  }
+);
+
+export const DETECTION_ENGINE_RULES_WILL_WORK = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.detectionEngineRulesWillWorkMessage',
+  {
+    defaultMessage: '✅ Detection engine rules will work for these fields',
+  }
+);
+
+export const DETECTION_ENGINE_RULES_WONT_WORK = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.detectionEngineRulesWontWorkMessage',
+  {
+    defaultMessage:
+      '❌ Detection engine rules referencing these fields may not match them correctly',
+  }
+);
+
+export const OTHER_APP_CAPABILITIES_WORK_PROPERLY = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.otherAppCapabilitiesWorkProperlyMessage',
+  {
+    defaultMessage: '✅ Other app capabilities work properly',
+  }
+);
+
+export const PAGES_DISPLAY_EVENTS = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.pagesDisplayEventsMessage',
+  {
+    defaultMessage: '✅ Pages display events and fields correctly',
+  }
+);
+
+export const PAGES_MAY_NOT_DISPLAY_FIELDS = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.pagesMayNotDisplayFieldsMessage',
+  {
+    defaultMessage: '🌕 Some pages and features may not display these fields',
+  }
+);
+
+export const PAGES_WONT_DISPLAY_EVENTS = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.pagesWontDisplayEventsMessage',
+  {
+    defaultMessage:
+      '❌ Pages may not display some events or fields due to unexpected field mappings or values',
+  }
+);
+
+export const PRE_BUILT_DETECTION_ENGINE_RULES_WORK = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.preBuiltDetectionEngineRulesWorkMessage',
+  {
+    defaultMessage: '✅ Pre-built detection engine rules work',
+  }
+);
+
+export const PRE_BUILT_DETECTION_ENGINE_RULES_WONT_WORK = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.preBuiltDetectionEngineRulesWontWorkMessage',
+  {
+    defaultMessage: "🌕 Pre-built detection engine rules won't match these fields",
+  }
+);
+
+export const SOMETIMES_INDICES_CREATED_BY_OLDER = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.sometimesIndicesCreatedByOlderDescription',
+  {
+    defaultMessage:
+      'Sometimes, indices created by older integrations will have mappings or values that were, but are no longer compliant.',
+  }
+);
+
+export const MAPPINGS_THAT_CONFLICT_WITH_ECS = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.mappingThatConflictWithEcsMessage',
+  {
+    defaultMessage: "❌ Mappings or field values that don't comply with ECS are not supported",
+  }
+);
+
+export const UNKNOWN = i18n.translate(
+  'ecsDataQualityDashboard.indexProperties.unknownCategoryLabel',
+  {
+    defaultMessage: 'Unknown',
+  }
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/loading_empty_prompt/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/loading_empty_prompt/index.tsx
new file mode 100644
index 0000000000000..84e701c0aa244
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/loading_empty_prompt/index.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiEmptyPrompt, EuiLoadingSpinner } from '@elastic/eui';
+import React, { useMemo } from 'react';
+
+interface Props {
+  loading: string;
+}
+
+const LoadingEmptyPromptComponent: React.FC<Props> = ({ loading }) => {
+  const icon = useMemo(() => <EuiLoadingSpinner size="xxl" />, []);
+
+  return <EuiEmptyPrompt icon={icon} title={<h2>{loading}</h2>} />;
+};
+
+LoadingEmptyPromptComponent.displayName = 'LoadingEmptyPromptComponent';
+
+export const LoadingEmptyPrompt = React.memo(LoadingEmptyPromptComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/panel_subtitle/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/panel_subtitle/index.tsx
new file mode 100644
index 0000000000000..10e460d9c24f5
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/panel_subtitle/index.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCode, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
+import React from 'react';
+
+import * as i18n from '../../translations';
+
+interface Props {
+  error: string | null;
+  loading: boolean;
+  version: string | null;
+  versionLoading: boolean;
+}
+
+const PanelSubtitleComponent: React.FC<Props> = ({ error, loading, version, versionLoading }) => {
+  const allDataLoaded = !loading && !versionLoading && error == null && version != null;
+
+  return allDataLoaded ? (
+    <EuiFlexGroup gutterSize="none">
+      <EuiFlexItem grow={false}>
+        <EuiText color="subdued" size="s">
+          <span>{i18n.SELECT_AN_INDEX}</span> <EuiCode>{version}</EuiCode>
+        </EuiText>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  ) : null;
+};
+
+export const PanelSubtitle = React.memo(PanelSubtitleComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/helpers.ts
new file mode 100644
index 0000000000000..efa9dbfa69d5e
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/helpers.ts
@@ -0,0 +1,235 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  IlmExplainLifecycleLifecycleExplain,
+  IndicesStatsIndicesStats,
+} from '@elastic/elasticsearch/lib/api/types';
+import { sortBy } from 'lodash/fp';
+
+import type { IndexSummaryTableItem } from '../summary_table/helpers';
+import type {
+  IlmPhase,
+  IlmExplainPhaseCounts,
+  DataQualityCheckResult,
+  PatternRollup,
+} from '../../types';
+import { getDocsCount } from '../../helpers';
+
+export const isManaged = (
+  ilmExplainRecord: IlmExplainLifecycleLifecycleExplain | undefined
+): boolean => ilmExplainRecord?.managed === true;
+
+export const getPhaseCount = ({
+  ilmExplain,
+  ilmPhase,
+  indexName,
+}: {
+  ilmExplain: Record<string, IlmExplainLifecycleLifecycleExplain> | null;
+  ilmPhase: IlmPhase;
+  indexName: string;
+}): number => {
+  const ilmExplainRecord = ilmExplain != null ? ilmExplain[indexName] : undefined;
+
+  if (ilmPhase === 'unmanaged') {
+    return isManaged(ilmExplainRecord) ? 0 : 1;
+  } else if (ilmExplainRecord != null && 'phase' in ilmExplainRecord) {
+    return ilmExplainRecord.phase === ilmPhase ? 1 : 0;
+  }
+
+  return 0;
+};
+
+export const getIlmPhase = (
+  ilmExplainRecord: IlmExplainLifecycleLifecycleExplain | undefined
+): IlmPhase | undefined => {
+  if (ilmExplainRecord == null) {
+    return undefined;
+  }
+
+  if ('phase' in ilmExplainRecord) {
+    const phase = ilmExplainRecord.phase;
+
+    switch (phase) {
+      case 'hot':
+        return 'hot';
+      case 'warm':
+        return 'warm';
+      case 'cold':
+        return 'cold';
+      case 'frozen':
+        return 'frozen';
+      default:
+        return undefined;
+    }
+  } else {
+    return 'unmanaged';
+  }
+};
+
+export const getIlmExplainPhaseCounts = (
+  ilmExplain: Record<string, IlmExplainLifecycleLifecycleExplain> | null
+): IlmExplainPhaseCounts => {
+  const indexNames = ilmExplain != null ? Object.keys(ilmExplain) : [];
+
+  return indexNames.reduce<IlmExplainPhaseCounts>(
+    (acc, indexName) => ({
+      hot:
+        acc.hot +
+        getPhaseCount({
+          ilmExplain,
+          ilmPhase: 'hot',
+          indexName,
+        }),
+      warm:
+        acc.warm +
+        getPhaseCount({
+          ilmExplain,
+          ilmPhase: 'warm',
+          indexName,
+        }),
+      cold:
+        acc.cold +
+        getPhaseCount({
+          ilmExplain,
+          ilmPhase: 'cold',
+          indexName,
+        }),
+      frozen:
+        acc.frozen +
+        getPhaseCount({
+          ilmExplain,
+          ilmPhase: 'frozen',
+          indexName,
+        }),
+      unmanaged:
+        acc.unmanaged +
+        getPhaseCount({
+          ilmExplain,
+          ilmPhase: 'unmanaged',
+          indexName,
+        }),
+    }),
+    {
+      hot: 0,
+      warm: 0,
+      cold: 0,
+      frozen: 0,
+      unmanaged: 0,
+    }
+  );
+};
+
+export const getIndexIncompatible = ({
+  indexName,
+  results,
+}: {
+  indexName: string;
+  results: Record<string, DataQualityCheckResult> | undefined;
+}): number | undefined => {
+  if (results == null || results[indexName] == null) {
+    return undefined;
+  }
+
+  return results[indexName].incompatible;
+};
+
+export const getSummaryTableItems = ({
+  ilmExplain,
+  indexNames,
+  pattern,
+  patternDocsCount,
+  results,
+  stats,
+}: {
+  ilmExplain: Record<string, IlmExplainLifecycleLifecycleExplain> | null;
+  indexNames: string[];
+  pattern: string;
+  patternDocsCount: number;
+  results: Record<string, DataQualityCheckResult> | undefined;
+  stats: Record<string, IndicesStatsIndicesStats> | null;
+}): IndexSummaryTableItem[] => {
+  const summaryTableItems = indexNames.map((indexName) => ({
+    docsCount: getDocsCount({ stats, indexName }),
+    incompatible: getIndexIncompatible({ indexName, results }),
+    indexName,
+    ilmPhase: ilmExplain != null ? getIlmPhase(ilmExplain[indexName]) : undefined,
+    pattern,
+    patternDocsCount,
+  }));
+
+  return sortBy('docsCount', summaryTableItems).reverse();
+};
+
+export const getDefaultIndexIncompatibleCounts = (
+  indexNames: string[]
+): Record<string, number | undefined> =>
+  indexNames.reduce<Record<string, number | undefined>>(
+    (acc, indexName) => ({
+      ...acc,
+      [indexName]: undefined,
+    }),
+    {}
+  );
+
+export const createPatternIncompatibleEntries = ({
+  indexNames,
+  patternIncompatible,
+}: {
+  indexNames: string[];
+  patternIncompatible: Record<string, number | undefined>;
+}): Record<string, number | undefined> =>
+  indexNames.reduce<Record<string, number | undefined>>(
+    (acc, indexName) =>
+      indexName in patternIncompatible
+        ? { ...acc, [indexName]: patternIncompatible[indexName] }
+        : { ...acc, [indexName]: undefined },
+    {}
+  );
+
+export const getIncompatible = (
+  patternIncompatible: Record<string, number | undefined>
+): number | undefined => {
+  const allIndexes = Object.values(patternIncompatible);
+  const allIndexesHaveValues = allIndexes.every((incompatible) => Number.isInteger(incompatible));
+
+  // only return a number when all indexes have an `incompatible` count:
+  return allIndexesHaveValues
+    ? allIndexes.reduce<number>((acc, incompatible) => acc + Number(incompatible), 0)
+    : undefined;
+};
+
+export const shouldCreateIndexNames = ({
+  ilmExplain,
+  indexNames,
+  stats,
+}: {
+  ilmExplain: Record<string, IlmExplainLifecycleLifecycleExplain> | null;
+  indexNames: string[] | undefined;
+  stats: Record<string, IndicesStatsIndicesStats> | null;
+}): boolean => indexNames == null && stats != null && ilmExplain != null;
+
+export const shouldCreatePatternRollup = ({
+  error,
+  ilmExplain,
+  patternRollup,
+  stats,
+}: {
+  error: string | null;
+  ilmExplain: Record<string, IlmExplainLifecycleLifecycleExplain> | null;
+  patternRollup: PatternRollup | undefined;
+  stats: Record<string, IndicesStatsIndicesStats> | null;
+}): boolean => {
+  if (patternRollup != null) {
+    return false; // the rollup already exists
+  }
+
+  const allDataLoaded: boolean = stats != null && ilmExplain != null;
+  const errorOccurred: boolean = error != null;
+
+  return allDataLoaded || errorOccurred;
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/index.tsx
new file mode 100644
index 0000000000000..d6a73f1fd2cfb
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/index.tsx
@@ -0,0 +1,252 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  FlameElementEvent,
+  HeatmapElementEvent,
+  MetricElementEvent,
+  PartitionElementEvent,
+  Theme,
+  WordCloudElementEvent,
+  XYChartElementEvent,
+} from '@elastic/charts';
+import { EuiFlexGroup, EuiFlexItem, EuiPanel, EuiSpacer } from '@elastic/eui';
+import { euiThemeVars } from '@kbn/ui-theme';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import styled from 'styled-components';
+
+import { ErrorEmptyPrompt } from '../error_empty_prompt';
+import {
+  getIlmExplainPhaseCounts,
+  getIlmPhase,
+  getSummaryTableItems,
+  shouldCreateIndexNames,
+  shouldCreatePatternRollup,
+} from './helpers';
+import {
+  getDocsCount,
+  getIndexNames,
+  getTotalDocsCount,
+  getTotalPatternIncompatible,
+  getTotalPatternIndicesChecked,
+} from '../../helpers';
+import { IndexProperties } from '../index_properties';
+import { LoadingEmptyPrompt } from '../loading_empty_prompt';
+import { PatternSummary } from './pattern_summary';
+import { SummaryTable } from '../summary_table';
+import { getSummaryTableColumns } from '../summary_table/helpers';
+import * as i18n from './translations';
+import type { PatternRollup } from '../../types';
+import { useIlmExplain } from '../../use_ilm_explain';
+import { useStats } from '../../use_stats';
+
+const IndexPropertiesContainer = styled.div`
+  margin-bottom: ${euiThemeVars.euiSizeS};
+  width: 100%;
+`;
+
+const EMPTY_INDEX_NAMES: string[] = [];
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  canUserCreateAndReadCases: () => boolean;
+  defaultNumberFormat: string;
+  getGroupByFieldsOnClick: (
+    elements: Array<
+      | FlameElementEvent
+      | HeatmapElementEvent
+      | MetricElementEvent
+      | PartitionElementEvent
+      | WordCloudElementEvent
+      | XYChartElementEvent
+    >
+  ) => {
+    groupByField0: string;
+    groupByField1: string;
+  };
+  ilmPhases: string[];
+  indexNames: string[] | undefined;
+  openCreateCaseFlyout: ({
+    comments,
+    headerContent,
+  }: {
+    comments: string[];
+    headerContent?: React.ReactNode;
+  }) => void;
+  pattern: string;
+  patternRollup: PatternRollup | undefined;
+  theme: Theme;
+  updatePatternIndexNames: ({
+    indexNames,
+    pattern,
+  }: {
+    indexNames: string[];
+    pattern: string;
+  }) => void;
+  updatePatternRollup: (patternRollup: PatternRollup) => void;
+}
+
+const PatternComponent: React.FC<Props> = ({
+  addSuccessToast,
+  canUserCreateAndReadCases,
+  defaultNumberFormat,
+  getGroupByFieldsOnClick,
+  indexNames,
+  ilmPhases,
+  openCreateCaseFlyout,
+  pattern,
+  patternRollup,
+  theme,
+  updatePatternIndexNames,
+  updatePatternRollup,
+}) => {
+  const { error: statsError, loading: loadingStats, stats } = useStats(pattern);
+  const { error: ilmExplainError, loading: loadingIlmExplain, ilmExplain } = useIlmExplain(pattern);
+
+  const loading = useMemo(
+    () => loadingStats || loadingIlmExplain,
+    [loadingIlmExplain, loadingStats]
+  );
+  const error = useMemo(() => statsError ?? ilmExplainError, [ilmExplainError, statsError]);
+
+  const [itemIdToExpandedRowMap, setItemIdToExpandedRowMap] = useState<
+    Record<string, React.ReactNode>
+  >({});
+
+  const toggleExpanded = useCallback(
+    (indexName: string) => {
+      if (itemIdToExpandedRowMap[indexName]) {
+        setItemIdToExpandedRowMap({});
+      } else {
+        setItemIdToExpandedRowMap({
+          [indexName]: (
+            <IndexPropertiesContainer>
+              <IndexProperties
+                addSuccessToast={addSuccessToast}
+                canUserCreateAndReadCases={canUserCreateAndReadCases}
+                defaultNumberFormat={defaultNumberFormat}
+                docsCount={getDocsCount({ stats, indexName })}
+                getGroupByFieldsOnClick={getGroupByFieldsOnClick}
+                ilmPhase={ilmExplain != null ? getIlmPhase(ilmExplain[indexName]) : undefined}
+                indexName={indexName}
+                openCreateCaseFlyout={openCreateCaseFlyout}
+                pattern={pattern}
+                patternRollup={patternRollup}
+                theme={theme}
+                updatePatternRollup={updatePatternRollup}
+              />
+            </IndexPropertiesContainer>
+          ),
+        });
+      }
+    },
+    [
+      addSuccessToast,
+      canUserCreateAndReadCases,
+      defaultNumberFormat,
+      getGroupByFieldsOnClick,
+      ilmExplain,
+      itemIdToExpandedRowMap,
+      openCreateCaseFlyout,
+      pattern,
+      patternRollup,
+      stats,
+      theme,
+      updatePatternRollup,
+    ]
+  );
+
+  const ilmExplainPhaseCounts = useMemo(() => getIlmExplainPhaseCounts(ilmExplain), [ilmExplain]);
+
+  const items = useMemo(
+    () =>
+      getSummaryTableItems({
+        ilmExplain,
+        indexNames: indexNames ?? EMPTY_INDEX_NAMES,
+        pattern,
+        patternDocsCount: patternRollup?.docsCount ?? 0,
+        results: patternRollup?.results,
+        stats,
+      }),
+    [ilmExplain, indexNames, pattern, patternRollup, stats]
+  );
+
+  useEffect(() => {
+    if (shouldCreateIndexNames({ indexNames, stats, ilmExplain })) {
+      updatePatternIndexNames({
+        indexNames: getIndexNames({ stats, ilmExplain, ilmPhases }),
+        pattern,
+      });
+    }
+
+    if (shouldCreatePatternRollup({ error, patternRollup, stats, ilmExplain })) {
+      updatePatternRollup({
+        docsCount: getTotalDocsCount({
+          indexNames: getIndexNames({ stats, ilmExplain, ilmPhases }),
+          stats,
+        }),
+        error,
+        ilmExplain,
+        ilmExplainPhaseCounts,
+        indices: getIndexNames({ stats, ilmExplain, ilmPhases }).length,
+        pattern,
+        results: undefined,
+        stats,
+      });
+    }
+  }, [
+    error,
+    ilmExplain,
+    ilmExplainPhaseCounts,
+    ilmPhases,
+    indexNames,
+    pattern,
+    patternRollup,
+    stats,
+    updatePatternIndexNames,
+    updatePatternRollup,
+  ]);
+
+  return (
+    <EuiPanel hasBorder={false} hasShadow={false}>
+      <EuiFlexGroup direction="column" gutterSize="none">
+        <EuiFlexItem grow={false}>
+          <PatternSummary
+            defaultNumberFormat={defaultNumberFormat}
+            incompatible={getTotalPatternIncompatible(patternRollup?.results)}
+            indices={indexNames?.length}
+            indicesChecked={getTotalPatternIndicesChecked(patternRollup)}
+            ilmExplainPhaseCounts={ilmExplainPhaseCounts}
+            pattern={pattern}
+            patternDocsCount={patternRollup?.docsCount ?? 0}
+          />
+          <EuiSpacer />
+        </EuiFlexItem>
+
+        {!loading && error != null && (
+          <ErrorEmptyPrompt title={i18n.ERROR_LOADING_METADATA_TITLE(pattern)} />
+        )}
+
+        {loading && <LoadingEmptyPrompt loading={i18n.LOADING_STATS} />}
+
+        {!loading && error == null && (
+          <SummaryTable
+            defaultNumberFormat={defaultNumberFormat}
+            getTableColumns={getSummaryTableColumns}
+            itemIdToExpandedRowMap={itemIdToExpandedRowMap}
+            items={items}
+            toggleExpanded={toggleExpanded}
+          />
+        )}
+      </EuiFlexGroup>
+    </EuiPanel>
+  );
+};
+
+PatternComponent.displayName = 'PatternComponent';
+
+export const Pattern = React.memo(PatternComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/index.tsx
new file mode 100644
index 0000000000000..a8ae7a673b92e
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/index.tsx
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import React from 'react';
+
+import type { IlmExplainPhaseCounts } from '../../../types';
+import { PatternLabel } from './pattern_label';
+import { StatsRollup } from './stats_rollup';
+
+interface Props {
+  defaultNumberFormat: string;
+  ilmExplainPhaseCounts: IlmExplainPhaseCounts;
+  incompatible: number | undefined;
+  indices: number | undefined;
+  indicesChecked: number | undefined;
+  pattern: string;
+  patternDocsCount: number;
+}
+
+const PatternSummaryComponent: React.FC<Props> = ({
+  defaultNumberFormat,
+  ilmExplainPhaseCounts,
+  incompatible,
+  indices,
+  indicesChecked,
+  pattern,
+  patternDocsCount,
+}) => (
+  <EuiFlexGroup alignItems="center" gutterSize="none" justifyContent="spaceBetween">
+    <EuiFlexItem grow={false}>
+      <PatternLabel
+        incompatible={incompatible}
+        indices={indices}
+        indicesChecked={indicesChecked}
+        ilmExplainPhaseCounts={ilmExplainPhaseCounts}
+        pattern={pattern}
+      />
+    </EuiFlexItem>
+
+    <EuiFlexItem grow={false}>
+      <StatsRollup
+        defaultNumberFormat={defaultNumberFormat}
+        docsCount={patternDocsCount}
+        incompatible={incompatible}
+        indices={indices}
+        indicesChecked={indicesChecked}
+        pattern={pattern}
+      />
+    </EuiFlexItem>
+  </EuiFlexGroup>
+);
+
+export const PatternSummary = React.memo(PatternSummaryComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/helpers.ts
new file mode 100644
index 0000000000000..8b3ad21adcbfd
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/helpers.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as i18n from './translations';
+
+export const getResultToolTip = (incompatible: number | undefined): string => {
+  if (incompatible == null) {
+    return i18n.SOME_UNCHECKED;
+  } else if (incompatible === 0) {
+    return i18n.ALL_PASSED;
+  } else {
+    return i18n.SOME_FAILED;
+  }
+};
+
+export const showResult = ({
+  incompatible,
+  indices,
+  indicesChecked,
+}: {
+  incompatible: number | undefined;
+  indices: number | undefined;
+  indicesChecked: number | undefined;
+}): boolean =>
+  incompatible != null && indices != null && indicesChecked != null && indices === indicesChecked;
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/index.tsx
new file mode 100644
index 0000000000000..f421da8d2bf35
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/index.tsx
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle, EuiToolTip, EuiIcon } from '@elastic/eui';
+import React from 'react';
+import styled from 'styled-components';
+
+import { getResultToolTip, showResult } from './helpers';
+import { IlmPhaseCounts } from '../../../ilm_phase_counts';
+import { getResultIcon, getResultIconColor } from '../../../summary_table/helpers';
+import * as i18n from '../translations';
+import type { IlmExplainPhaseCounts } from '../../../../types';
+
+const ResultContainer = styled.div`
+  margin-right: ${({ theme }) => theme.eui.euiSizeS};
+`;
+
+interface Props {
+  incompatible: number | undefined;
+  indices: number | undefined;
+  indicesChecked: number | undefined;
+  ilmExplainPhaseCounts: IlmExplainPhaseCounts;
+  pattern: string;
+}
+
+const PatternLabelComponent: React.FC<Props> = ({
+  ilmExplainPhaseCounts,
+  incompatible,
+  indices,
+  indicesChecked,
+  pattern,
+}) => (
+  <>
+    <EuiFlexGroup alignItems="center" gutterSize="none">
+      <EuiFlexItem grow={false}>
+        <ResultContainer>
+          {showResult({
+            incompatible,
+            indices,
+            indicesChecked,
+          }) && (
+            <EuiToolTip content={getResultToolTip(incompatible)}>
+              <EuiIcon
+                color={getResultIconColor(incompatible)}
+                type={getResultIcon(incompatible)}
+              />
+            </EuiToolTip>
+          )}
+        </ResultContainer>
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>
+        <EuiToolTip content={i18n.PATTERN_OR_INDEX_TOOLTIP}>
+          <EuiTitle size="s">
+            <h4>{pattern}</h4>
+          </EuiTitle>
+        </EuiToolTip>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+
+    <EuiSpacer size="xs" />
+    <IlmPhaseCounts ilmExplainPhaseCounts={ilmExplainPhaseCounts} pattern={pattern} />
+  </>
+);
+
+PatternLabelComponent.displayName = 'PatternLabelComponent';
+
+export const PatternLabel = React.memo(PatternLabelComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/translations.ts
new file mode 100644
index 0000000000000..cdd9c897ed326
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/pattern_label/translations.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ALL_PASSED = i18n.translate('ecsDataQualityDashboard.patternLabel.allPassedTooltip', {
+  defaultMessage: 'All indices matching this pattern passed the data quality checks',
+});
+
+export const SOME_FAILED = i18n.translate(
+  'ecsDataQualityDashboard.patternLabel.someFailedTooltip',
+  {
+    defaultMessage: 'Some indices matching this pattern failed the data quality checks',
+  }
+);
+
+export const SOME_UNCHECKED = i18n.translate(
+  'ecsDataQualityDashboard.patternLabel.someUncheckedTooltip',
+  {
+    defaultMessage: 'Some indices matching this pattern have not been checked for data quality',
+  }
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/stats_rollup/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/stats_rollup/index.tsx
new file mode 100644
index 0000000000000..dcf28487a091c
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/stats_rollup/index.tsx
@@ -0,0 +1,143 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiStat, EuiToolTip } from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import React, { useMemo } from 'react';
+import styled from 'styled-components';
+
+import { EMPTY_STAT, getIncompatibleStatColor } from '../../../../helpers';
+import { StatLabel } from '../../../stat_label';
+import * as i18n from '../../../stat_label/translations';
+
+const StatsFlexGroup = styled(EuiFlexGroup)`
+  gap: ${({ theme }) => theme.eui.euiSizeS};
+`;
+
+const IndicesStatContainer = styled.div`
+  min-width: 100px;
+`;
+
+const DocsContainer = styled.div`
+  min-width: 155px;
+`;
+
+const STAT_TITLE_SIZE = 's';
+
+interface Props {
+  defaultNumberFormat: string;
+  docsCount: number | undefined;
+  incompatible: number | undefined;
+  indices: number | undefined;
+  indicesChecked: number | undefined;
+  pattern?: string;
+}
+
+const StatsRollupComponent: React.FC<Props> = ({
+  defaultNumberFormat,
+  docsCount,
+  incompatible,
+  indices,
+  indicesChecked,
+  pattern,
+}) => {
+  const incompatibleDescription = useMemo(
+    () => <StatLabel line1={i18n.INCOMPATIBLE} line2={i18n.FIELDS} />,
+    []
+  );
+  const indicesCheckedDescription = useMemo(
+    () => <StatLabel line1={i18n.INDICES} line2={i18n.CHECKED} />,
+    []
+  );
+  const docsDescription = useMemo(() => <StatLabel line2={i18n.DOCS} />, []);
+  const indicesDescription = useMemo(() => <StatLabel line2={i18n.INDICES} />, []);
+
+  return (
+    <StatsFlexGroup alignItems="flexEnd" gutterSize="none" justifyContent="flexEnd">
+      <EuiFlexItem grow={false}>
+        <EuiToolTip
+          content={
+            pattern != null
+              ? i18n.INCOMPATIBLE_PATTERN_TOOL_TIP(pattern)
+              : i18n.TOTAL_INCOMPATIBLE_TOOL_TIP
+          }
+        >
+          <EuiStat
+            description={incompatibleDescription}
+            title={
+              incompatible != null ? numeral(incompatible).format(defaultNumberFormat) : EMPTY_STAT
+            }
+            titleColor={getIncompatibleStatColor(incompatible)}
+            titleSize={STAT_TITLE_SIZE}
+          />
+        </EuiToolTip>
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>
+        <IndicesStatContainer>
+          <EuiToolTip
+            content={
+              pattern != null
+                ? i18n.TOTAL_COUNT_OF_INDICES_CHECKED_MATCHING_PATTERN_TOOL_TIP(pattern)
+                : i18n.TOTAL_INDICES_CHECKED_TOOL_TIP
+            }
+          >
+            <EuiStat
+              description={indicesCheckedDescription}
+              title={
+                indicesChecked != null
+                  ? numeral(indicesChecked).format(defaultNumberFormat)
+                  : EMPTY_STAT
+              }
+              titleSize={STAT_TITLE_SIZE}
+            />
+          </EuiToolTip>
+        </IndicesStatContainer>
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>
+        <IndicesStatContainer>
+          <EuiToolTip
+            content={
+              pattern != null
+                ? i18n.TOTAL_COUNT_OF_INDICES_MATCHING_PATTERN_TOOL_TIP(pattern)
+                : i18n.TOTAL_INDICES_TOOL_TIP
+            }
+          >
+            <EuiStat
+              description={indicesDescription}
+              title={indices != null ? numeral(indices).format(defaultNumberFormat) : 0}
+              titleSize={STAT_TITLE_SIZE}
+            />
+          </EuiToolTip>
+        </IndicesStatContainer>
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>
+        <DocsContainer>
+          <EuiToolTip
+            content={
+              pattern != null ? i18n.INDEX_DOCS_PATTERN_TOOL_TIP(pattern) : i18n.TOTAL_DOCS_TOOL_TIP
+            }
+          >
+            <EuiStat
+              description={docsDescription}
+              title={
+                docsCount != null ? numeral(docsCount).format(defaultNumberFormat) : EMPTY_STAT
+              }
+              titleSize={STAT_TITLE_SIZE}
+            />
+          </EuiToolTip>
+        </DocsContainer>
+      </EuiFlexItem>
+    </StatsFlexGroup>
+  );
+};
+
+StatsRollupComponent.displayName = 'StatsRollupComponent';
+
+export const StatsRollup = React.memo(StatsRollupComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/translations.ts
new file mode 100644
index 0000000000000..54098d624e0f9
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/pattern_summary/translations.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const DOCS = i18n.translate('ecsDataQualityDashboard.patternSummary.docsLabel', {
+  defaultMessage: 'Docs',
+});
+
+export const INDICES = i18n.translate('ecsDataQualityDashboard.patternSummary.indicesLabel', {
+  defaultMessage: 'Indices',
+});
+
+export const PATTERN_OR_INDEX_TOOLTIP = i18n.translate(
+  'ecsDataQualityDashboard.patternSummary.patternOrIndexTooltip',
+  {
+    defaultMessage: 'A pattern or specific index',
+  }
+);
+
+export const PATTERN_DOCS_COUNT_TOOLTIP = (pattern: string) =>
+  i18n.translate('ecsDataQualityDashboard.patternDocsCountTooltip', {
+    values: { pattern },
+    defaultMessage: 'The total count from all indices matching: {pattern}',
+  });
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/translations.ts
new file mode 100644
index 0000000000000..776ceef776172
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/pattern/translations.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_LOADING_METADATA_TITLE = (pattern: string) =>
+  i18n.translate('ecsDataQualityDashboard.emptyErrorPrompt.errorLoadingMetadataTitle', {
+    values: { pattern },
+    defaultMessage: "Indices matching the {pattern} pattern won't checked",
+  });
+
+export const ERROR_LOADING_METADATA_BODY = ({
+  error,
+  pattern,
+}: {
+  error: string;
+  pattern: string;
+}) =>
+  i18n.translate('ecsDataQualityDashboard.emptyErrorPrompt.errorLoadingMetadataBody', {
+    values: { error, pattern },
+    defaultMessage:
+      "Indices matching the {pattern} pattern won't be checked, because an error occurred: {error}",
+  });
+
+export const LOADING_STATS = i18n.translate(
+  'ecsDataQualityDashboard.emptyLoadingPrompt.loadingStatsPrompt',
+  {
+    defaultMessage: 'Loading stats',
+  }
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/stat_label/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/stat_label/index.tsx
new file mode 100644
index 0000000000000..31b4620fbb5f0
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/stat_label/index.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+const Line1 = styled.span`
+  display: block;
+`;
+
+const Line2 = styled.span`
+  display: inline-block;
+`;
+
+const EMPTY = ' ';
+
+interface Props {
+  color?: string;
+  line1?: string;
+  line2?: string;
+}
+
+export const StatLabel: React.FC<Props> = ({ color, line1 = EMPTY, line2 = EMPTY }) => (
+  <>
+    <Line1 data-test-subj="line1">{line1}</Line1>
+    <Line2 data-test-subj="line2">{line2}</Line2>
+  </>
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/stat_label/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/stat_label/translations.ts
new file mode 100644
index 0000000000000..afaad5d08ed6e
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/stat_label/translations.ts
@@ -0,0 +1,114 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const CHECKED = i18n.translate('ecsDataQualityDashboard.statLabels.checkedLabel', {
+  defaultMessage: 'checked',
+});
+
+export const CUSTOM = i18n.translate('ecsDataQualityDashboard.statLabels.customLabel', {
+  defaultMessage: 'Custom',
+});
+
+export const CUSTOM_INDEX_TOOL_TIP = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.statLabels.customIndexToolTip', {
+    values: { indexName },
+    defaultMessage: 'A count of the custom field mappings in the {indexName} index',
+  });
+
+export const CUSTOM_PATTERN_TOOL_TIP = (pattern: string) =>
+  i18n.translate('ecsDataQualityDashboard.statLabels.customPatternToolTip', {
+    values: { pattern },
+    defaultMessage:
+      'The total count of custom field mappings, in indices matching the {pattern} pattern',
+  });
+
+export const DOCS = i18n.translate('ecsDataQualityDashboard.statLabels.docsLabel', {
+  defaultMessage: 'Docs',
+});
+
+export const FIELDS = i18n.translate('ecsDataQualityDashboard.statLabels.fieldsLabel', {
+  defaultMessage: 'fields',
+});
+
+export const INCOMPATIBLE = i18n.translate('ecsDataQualityDashboard.statLabels.incompatibleLabel', {
+  defaultMessage: 'Incompatible',
+});
+
+export const INCOMPATIBLE_INDEX_TOOL_TIP = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.statLabels.incompatibleIndexToolTip', {
+    values: { indexName },
+    defaultMessage: 'Mappings and values incompatible with ECS, in the {indexName} index',
+  });
+
+export const INCOMPATIBLE_PATTERN_TOOL_TIP = (pattern: string) =>
+  i18n.translate('ecsDataQualityDashboard.statLabels.incompatiblePatternToolTip', {
+    values: { pattern },
+    defaultMessage:
+      'The total count of fields incompatible with ECS, in indices matching the {pattern} pattern',
+  });
+
+export const INDEX_DOCS_COUNT_TOOL_TIP = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.statLabels.indexDocsCountToolTip', {
+    values: { indexName },
+    defaultMessage: 'A count of the docs in the {indexName} index',
+  });
+
+export const INDEX_DOCS_PATTERN_TOOL_TIP = (pattern: string) =>
+  i18n.translate('ecsDataQualityDashboard.statLabels.indexDocsPatternToolTip', {
+    values: { pattern },
+    defaultMessage: 'The total count of docs, in indices matching the {pattern} pattern',
+  });
+
+export const INDICES = i18n.translate('ecsDataQualityDashboard.statLabels.indicesLabel', {
+  defaultMessage: 'Indices',
+});
+
+export const TOTAL_COUNT_OF_INDICES_CHECKED_MATCHING_PATTERN_TOOL_TIP = (pattern: string) =>
+  i18n.translate(
+    'ecsDataQualityDashboard.statLabels.totalCountOfIndicesCheckedMatchingPatternToolTip',
+    {
+      values: { pattern },
+      defaultMessage: 'The total count of indices checked that match the {pattern} pattern',
+    }
+  );
+
+export const TOTAL_COUNT_OF_INDICES_MATCHING_PATTERN_TOOL_TIP = (pattern: string) =>
+  i18n.translate('ecsDataQualityDashboard.statLabels.totalCountOfIndicesMatchingPatternToolTip', {
+    values: { pattern },
+    defaultMessage: 'The total count of indices matching the {pattern} pattern',
+  });
+
+export const TOTAL_DOCS_TOOL_TIP = i18n.translate(
+  'ecsDataQualityDashboard.statLabels.totalDocsToolTip',
+  {
+    defaultMessage: 'The total count of docs, in all indices',
+  }
+);
+
+export const TOTAL_INCOMPATIBLE_TOOL_TIP = i18n.translate(
+  'ecsDataQualityDashboard.statLabels.totalIncompatibleToolTip',
+  {
+    defaultMessage:
+      'The total count of fields incompatible with ECS, in all indices that were checked',
+  }
+);
+
+export const TOTAL_INDICES_CHECKED_TOOL_TIP = i18n.translate(
+  'ecsDataQualityDashboard.statLabels.totalIndicesCheckedToolTip',
+  {
+    defaultMessage: 'The total count of all indices checked',
+  }
+);
+
+export const TOTAL_INDICES_TOOL_TIP = i18n.translate(
+  'ecsDataQualityDashboard.statLabels.totalIndicesToolTip',
+  {
+    defaultMessage: 'The total count of all indices',
+  }
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/helpers.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/helpers.tsx
new file mode 100644
index 0000000000000..e3789fce0bb5b
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/helpers.tsx
@@ -0,0 +1,195 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EuiBasicTableColumn } from '@elastic/eui';
+import {
+  EuiBadge,
+  EuiButtonIcon,
+  EuiIcon,
+  EuiProgress,
+  EuiScreenReaderOnly,
+  EuiStat,
+  EuiToolTip,
+  RIGHT_ALIGNMENT,
+} from '@elastic/eui';
+import React from 'react';
+import styled from 'styled-components';
+
+import { EMPTY_STAT, getIlmPhaseDescription, getIncompatibleStatColor } from '../../helpers';
+import { INCOMPATIBLE_INDEX_TOOL_TIP } from '../stat_label/translations';
+import * as i18n from './translations';
+import type { IlmPhase } from '../../types';
+
+const STAT_TITLE_SIZE = 'xxs';
+
+const EMPTY_DESCRIPTION = ' ';
+
+const ProgressContainer = styled.div`
+  width: 150px;
+`;
+
+export interface IndexSummaryTableItem {
+  docsCount: number;
+  incompatible: number | undefined;
+  indexName: string;
+  ilmPhase: IlmPhase | undefined;
+  pattern: string;
+  patternDocsCount: number;
+}
+
+export const getResultToolTip = (incompatible: number | undefined): string => {
+  if (incompatible == null) {
+    return i18n.THIS_INDEX_HAS_NOT_BEEN_CHECKED;
+  } else if (incompatible === 0) {
+    return i18n.PASSED;
+  } else {
+    return i18n.FAILED;
+  }
+};
+
+export const getResultIconColor = (
+  incompatible: number | undefined
+): 'success' | 'danger' | 'ghost' => {
+  if (incompatible == null) {
+    return 'ghost';
+  } else if (incompatible === 0) {
+    return 'success';
+  } else {
+    return 'danger';
+  }
+};
+
+export const getResultIcon = (incompatible: number | undefined): 'check' | 'cross' =>
+  incompatible === 0 ? 'check' : 'cross';
+
+export const getDocsCountPercent = ({
+  docsCount,
+  locales,
+  patternDocsCount,
+}: {
+  docsCount: number;
+  locales?: string | string[];
+  patternDocsCount: number;
+}): string =>
+  patternDocsCount !== 0
+    ? Number(docsCount / patternDocsCount).toLocaleString(locales, {
+        style: 'percent',
+        maximumFractionDigits: 1,
+        minimumFractionDigits: 1,
+      })
+    : '';
+
+export const getSummaryTableColumns = ({
+  formatNumber,
+  itemIdToExpandedRowMap,
+  toggleExpanded,
+}: {
+  formatNumber: (value: number | undefined) => string;
+  itemIdToExpandedRowMap: Record<string, React.ReactNode>;
+  toggleExpanded: (indexName: string) => void;
+}): Array<EuiBasicTableColumn<IndexSummaryTableItem>> => [
+  {
+    align: RIGHT_ALIGNMENT,
+    isExpander: true,
+    name: (
+      <EuiScreenReaderOnly>
+        <span>{i18n.EXPAND_ROWS}</span>
+      </EuiScreenReaderOnly>
+    ),
+    render: ({ indexName }: IndexSummaryTableItem) => (
+      <EuiButtonIcon
+        aria-label={itemIdToExpandedRowMap[indexName] ? i18n.COLLAPSE : i18n.EXPAND}
+        onClick={() => toggleExpanded(indexName)}
+        iconType={itemIdToExpandedRowMap[indexName] ? 'arrowDown' : 'arrowRight'}
+      />
+    ),
+    width: '40px',
+  },
+  {
+    field: 'incompatible',
+    name: i18n.RESULT,
+    render: (_, { incompatible }) =>
+      incompatible != null ? (
+        <EuiToolTip content={getResultToolTip(incompatible)}>
+          <EuiIcon color={getResultIconColor(incompatible)} type={getResultIcon(incompatible)} />
+        </EuiToolTip>
+      ) : (
+        <EuiToolTip content={getResultToolTip(incompatible)}>
+          <span>{EMPTY_STAT}</span>
+        </EuiToolTip>
+      ),
+    sortable: true,
+    truncateText: false,
+    width: '50px',
+  },
+  {
+    field: 'indexName',
+    name: i18n.INDEX,
+    render: (_, { indexName, pattern }) => (
+      <EuiToolTip content={i18n.INDEX_TOOL_TIP(pattern)}>
+        <span aria-roledescription={i18n.INDEX_NAME_LABEL}>{indexName}</span>
+      </EuiToolTip>
+    ),
+    sortable: true,
+    truncateText: false,
+    width: '300px',
+  },
+  {
+    field: 'docsCount',
+    name: i18n.DOCS,
+    render: (_, { docsCount, patternDocsCount }) => (
+      <ProgressContainer>
+        <EuiProgress
+          label={formatNumber(docsCount)}
+          max={patternDocsCount}
+          size="m"
+          value={docsCount}
+          valueText={getDocsCountPercent({ docsCount, patternDocsCount })}
+        />
+      </ProgressContainer>
+    ),
+    sortable: true,
+    truncateText: false,
+  },
+  {
+    field: 'incompatible',
+    name: i18n.INCOMPATIBLE_FIELDS,
+    render: (_, { incompatible, indexName }) => (
+      <EuiToolTip content={INCOMPATIBLE_INDEX_TOOL_TIP(indexName)}>
+        <EuiStat
+          description={EMPTY_DESCRIPTION}
+          reverse
+          title={incompatible ?? EMPTY_STAT}
+          titleColor={getIncompatibleStatColor(incompatible)}
+          titleSize={STAT_TITLE_SIZE}
+        />
+      </EuiToolTip>
+    ),
+    sortable: false,
+    truncateText: false,
+  },
+  {
+    field: 'ilmPhase',
+    name: i18n.ILM_PHASE,
+    render: (_, { ilmPhase }) =>
+      ilmPhase != null ? (
+        <EuiToolTip content={getIlmPhaseDescription(ilmPhase)}>
+          <EuiBadge color="hollow">{ilmPhase}</EuiBadge>
+        </EuiToolTip>
+      ) : null,
+    sortable: false,
+    truncateText: false,
+  },
+];
+
+export const getShowPagination = ({
+  minPageSize,
+  totalItemCount,
+}: {
+  minPageSize: number;
+  totalItemCount: number;
+}): boolean => totalItemCount > minPageSize;
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/index.tsx
new file mode 100644
index 0000000000000..7b02add151803
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/index.tsx
@@ -0,0 +1,114 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  CriteriaWithPagination,
+  Direction,
+  EuiBasicTableColumn,
+  Pagination,
+} from '@elastic/eui';
+import { EuiInMemoryTable } from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import React, { useCallback, useMemo, useState } from 'react';
+
+import { EMPTY_STAT } from '../../helpers';
+import type { IndexSummaryTableItem } from './helpers';
+import { getShowPagination } from './helpers';
+
+const MIN_PAGE_SIZE = 10;
+
+interface SortConfig {
+  sort: {
+    direction: Direction;
+    field: string;
+  };
+}
+
+const defaultSort: SortConfig = {
+  sort: {
+    direction: 'desc',
+    field: 'docsCount',
+  },
+};
+
+interface Props {
+  defaultNumberFormat: string;
+  getTableColumns: ({
+    formatNumber,
+    itemIdToExpandedRowMap,
+    toggleExpanded,
+  }: {
+    formatNumber: (value: number | undefined) => string;
+    itemIdToExpandedRowMap: Record<string, React.ReactNode>;
+    toggleExpanded: (indexName: string) => void;
+  }) => Array<EuiBasicTableColumn<IndexSummaryTableItem>>;
+  itemIdToExpandedRowMap: Record<string, React.ReactNode>;
+  items: IndexSummaryTableItem[];
+  toggleExpanded: (indexName: string) => void;
+}
+
+const SummaryTableComponent: React.FC<Props> = ({
+  defaultNumberFormat,
+  getTableColumns,
+  itemIdToExpandedRowMap,
+  items,
+  toggleExpanded,
+}) => {
+  const [sorting, setSorting] = useState<SortConfig>(defaultSort);
+  const formatNumber = useCallback(
+    (value: number | undefined): string =>
+      value != null ? numeral(value).format(defaultNumberFormat) : EMPTY_STAT,
+    [defaultNumberFormat]
+  );
+  const [pageIndex, setPageIndex] = useState<number>(0);
+  const [pageSize, setPageSize] = useState<number>(MIN_PAGE_SIZE);
+  const columns = useMemo(
+    () => getTableColumns({ formatNumber, itemIdToExpandedRowMap, toggleExpanded }),
+    [formatNumber, getTableColumns, itemIdToExpandedRowMap, toggleExpanded]
+  );
+  const getItemId = useCallback((item: IndexSummaryTableItem) => item.indexName, []);
+
+  const onChange = useCallback(({ page, sort }: CriteriaWithPagination<IndexSummaryTableItem>) => {
+    setSorting({ sort: sort ?? defaultSort.sort });
+
+    setPageIndex(page.index);
+    setPageSize(page.size);
+  }, []);
+
+  const pagination: Pagination = useMemo(
+    () => ({
+      pageIndex,
+      pageSize,
+      showPerPageOptions: true,
+      totalItemCount: items.length,
+    }),
+    [items, pageIndex, pageSize]
+  );
+
+  return (
+    <EuiInMemoryTable
+      allowNeutralSort={false}
+      compressed={true}
+      columns={columns}
+      isExpandable={true}
+      itemId={getItemId}
+      itemIdToExpandedRowMap={itemIdToExpandedRowMap}
+      items={items}
+      onChange={onChange}
+      pagination={
+        getShowPagination({ minPageSize: MIN_PAGE_SIZE, totalItemCount: items.length })
+          ? pagination
+          : undefined
+      }
+      sorting={sorting}
+    />
+  );
+};
+
+SummaryTableComponent.displayName = 'SummaryTableComponent';
+
+export const SummaryTable = React.memo(SummaryTableComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/translations.ts
new file mode 100644
index 0000000000000..d9334a24e5ea8
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/summary_table/translations.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const COLLAPSE = i18n.translate('ecsDataQualityDashboard.summaryTable.collapseLabel', {
+  defaultMessage: 'Collapse',
+});
+
+export const DOCS = i18n.translate('ecsDataQualityDashboard.summaryTable.docsColumn', {
+  defaultMessage: 'Docs',
+});
+
+export const EXPAND = i18n.translate('ecsDataQualityDashboard.summaryTable.expandLabel', {
+  defaultMessage: 'Expand',
+});
+
+export const EXPAND_ROWS = i18n.translate('ecsDataQualityDashboard.summaryTable.expandRowsColumn', {
+  defaultMessage: 'Expand rows',
+});
+
+export const FAILED = i18n.translate('ecsDataQualityDashboard.summaryTable.failedTooltip', {
+  defaultMessage: 'Failed',
+});
+
+export const ILM_PHASE = i18n.translate('ecsDataQualityDashboard.summaryTable.ilmPhaseColumn', {
+  defaultMessage: 'ILM Phase',
+});
+
+export const INCOMPATIBLE_FIELDS = i18n.translate(
+  'ecsDataQualityDashboard.summaryTable.incompatibleFieldsColumn',
+  {
+    defaultMessage: 'Incompatible fields',
+  }
+);
+
+export const INDICES = i18n.translate('ecsDataQualityDashboard.summaryTable.indicesColumn', {
+  defaultMessage: 'Indices',
+});
+
+export const INDICES_CHECKED = i18n.translate(
+  'ecsDataQualityDashboard.summaryTable.indicesCheckedColumn',
+  {
+    defaultMessage: 'Indices checked',
+  }
+);
+
+export const INDEX = i18n.translate('ecsDataQualityDashboard.summaryTable.indexColumn', {
+  defaultMessage: 'Index',
+});
+
+export const INDEX_NAME_LABEL = i18n.translate(
+  'ecsDataQualityDashboard.summaryTable.indexesNameLabel',
+  {
+    defaultMessage: 'Index name',
+  }
+);
+
+export const INDEX_TOOL_TIP = (pattern: string) =>
+  i18n.translate('ecsDataQualityDashboard.summaryTable.indexToolTip', {
+    values: { pattern },
+    defaultMessage: 'This index matches the pattern or index name: {pattern}',
+  });
+
+export const PASSED = i18n.translate('ecsDataQualityDashboard.summaryTable.passedTooltip', {
+  defaultMessage: 'Passed',
+});
+
+export const RESULT = i18n.translate('ecsDataQualityDashboard.summaryTable.resultColumn', {
+  defaultMessage: 'Result',
+});
+
+export const THIS_INDEX_HAS_NOT_BEEN_CHECKED = i18n.translate(
+  'ecsDataQualityDashboard.summaryTable.thisIndexHasNotBeenCheckedTooltip',
+  {
+    defaultMessage: 'This index has not been checked',
+  }
+);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/all_tab/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/all_tab/index.tsx
new file mode 100644
index 0000000000000..46c1cec0d88e7
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/all_tab/index.tsx
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EcsVersion } from '@kbn/ecs';
+import { EuiCallOut, EuiEmptyPrompt, EuiSpacer } from '@elastic/eui';
+import React, { useMemo } from 'react';
+
+import { CompareFieldsTable } from '../../../compare_fields_table';
+import { getCommonTableColumns } from '../../../compare_fields_table/helpers';
+import { EmptyPromptBody } from '../../index_properties/empty_prompt_body';
+import { EmptyPromptTitle } from '../../index_properties/empty_prompt_title';
+import * as i18n from '../../index_properties/translations';
+import type { PartitionedFieldMetadata } from '../../../types';
+
+interface Props {
+  indexName: string;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+}
+
+const AllTabComponent: React.FC<Props> = ({ indexName, partitionedFieldMetadata }) => {
+  const body = useMemo(() => <EmptyPromptBody body={i18n.ALL_EMPTY} />, []);
+  const title = useMemo(() => <EmptyPromptTitle title={i18n.ALL_EMPTY_TITLE} />, []);
+
+  return (
+    <>
+      {partitionedFieldMetadata.all.length > 0 ? (
+        <>
+          <EuiCallOut size="s" title={i18n.ALL_CALLOUT_TITLE(partitionedFieldMetadata.all.length)}>
+            <p>{i18n.ALL_CALLOUT(EcsVersion)}</p>
+          </EuiCallOut>
+          <EuiSpacer />
+          <CompareFieldsTable
+            enrichedFieldMetadata={partitionedFieldMetadata.all}
+            getTableColumns={getCommonTableColumns}
+            title={i18n.ALL_FIELDS_TABLE_TITLE(indexName)}
+          />
+        </>
+      ) : (
+        <EuiEmptyPrompt
+          body={body}
+          iconType="cross"
+          iconColor="danger"
+          title={title}
+          titleSize="s"
+        />
+      )}
+    </>
+  );
+};
+
+AllTabComponent.displayName = 'AllTabComponent';
+
+export const AllTab = React.memo(AllTabComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/custom_callout/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/custom_callout/index.tsx
new file mode 100644
index 0000000000000..5294d3d77a23c
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/custom_callout/index.tsx
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EcsVersion } from '@kbn/ecs';
+
+import { EuiCallOut, EuiSpacer } from '@elastic/eui';
+import React from 'react';
+import type { EnrichedFieldMetadata } from '../../../../types';
+
+import * as i18n from '../../../index_properties/translations';
+import { CalloutItem } from '../../styles';
+
+interface Props {
+  children?: React.ReactNode;
+  enrichedFieldMetadata: EnrichedFieldMetadata[];
+}
+
+const CustomCalloutComponent: React.FC<Props> = ({ children, enrichedFieldMetadata }) => (
+  <EuiCallOut
+    color="primary"
+    size="s"
+    title={i18n.CUSTOM_CALLOUT_TITLE(enrichedFieldMetadata.length)}
+  >
+    <div>
+      {i18n.CUSTOM_CALLOUT({ fieldCount: enrichedFieldMetadata.length, version: EcsVersion })}
+    </div>
+    <EuiSpacer size="s" />
+    <CalloutItem>{i18n.PRE_BUILT_DETECTION_ENGINE_RULES_WONT_WORK}</CalloutItem>
+    <CalloutItem>{i18n.PAGES_MAY_NOT_DISPLAY_FIELDS}</CalloutItem>
+    <CalloutItem>{i18n.CUSTOM_DETECTION_ENGINE_RULES_WORK}</CalloutItem>
+    <EuiSpacer size="s" />
+    {children}
+  </EuiCallOut>
+);
+
+CustomCalloutComponent.displayName = 'CustomCalloutComponent';
+
+export const CustomCallout = React.memo(CustomCalloutComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/incompatible_callout/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/incompatible_callout/index.tsx
new file mode 100644
index 0000000000000..4ab38e0701369
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/incompatible_callout/index.tsx
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EcsVersion } from '@kbn/ecs';
+
+import { EuiCallOut, EuiSpacer } from '@elastic/eui';
+import React from 'react';
+import type { EnrichedFieldMetadata } from '../../../../types';
+
+import * as i18n from '../../../index_properties/translations';
+import { CalloutItem } from '../../styles';
+
+interface Props {
+  children?: React.ReactNode;
+  enrichedFieldMetadata: EnrichedFieldMetadata[];
+}
+
+const IncompatibleCalloutComponent: React.FC<Props> = ({ children, enrichedFieldMetadata }) => (
+  <EuiCallOut
+    color="danger"
+    size="s"
+    title={i18n.INCOMPATIBLE_CALLOUT_TITLE(enrichedFieldMetadata.length)}
+  >
+    <div>
+      {i18n.INCOMPATIBLE_CALLOUT({
+        fieldCount: enrichedFieldMetadata.length,
+        version: EcsVersion,
+      })}
+    </div>
+    <EuiSpacer size="s" />
+    <CalloutItem>{i18n.DETECTION_ENGINE_RULES_WONT_WORK}</CalloutItem>
+    <CalloutItem>{i18n.PAGES_WONT_DISPLAY_EVENTS}</CalloutItem>
+    <CalloutItem>{i18n.MAPPINGS_THAT_CONFLICT_WITH_ECS}</CalloutItem>
+    <EuiSpacer size="s" />
+    {children}
+  </EuiCallOut>
+);
+
+IncompatibleCalloutComponent.displayName = 'IncompatibleCalloutComponent';
+
+export const IncompatibleCallout = React.memo(IncompatibleCalloutComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/missing_timestamp_callout/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/missing_timestamp_callout/index.tsx
new file mode 100644
index 0000000000000..73a54e72499e3
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/callouts/missing_timestamp_callout/index.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCallOut, EuiSpacer } from '@elastic/eui';
+import React from 'react';
+
+import * as i18n from '../../../index_properties/translations';
+import { CalloutItem } from '../../styles';
+
+interface Props {
+  children?: React.ReactNode;
+}
+
+const MissingTimestampCalloutComponent: React.FC<Props> = ({ children }) => (
+  <EuiCallOut color="danger" size="s" title={i18n.MISSING_TIMESTAMP_CALLOUT_TITLE}>
+    <div>{i18n.MISSING_TIMESTAMP_CALLOUT}</div>
+    <EuiSpacer size="s" />
+    <CalloutItem>{i18n.DETECTION_ENGINE_RULES_WONT_WORK}</CalloutItem>
+    <CalloutItem>{i18n.PAGES_WONT_DISPLAY_EVENTS}</CalloutItem>
+    <EuiSpacer size="s" />
+    {children}
+  </EuiCallOut>
+);
+
+MissingTimestampCalloutComponent.displayName = 'MissingTimestampCalloutComponent';
+
+export const MissingTimestampCallout = React.memo(MissingTimestampCalloutComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/custom_tab/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/custom_tab/helpers.ts
new file mode 100644
index 0000000000000..52f8cb2d9ae85
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/custom_tab/helpers.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EcsVersion } from '@kbn/ecs';
+import { euiThemeVars } from '@kbn/ui-theme';
+
+import { FIELD, INDEX_MAPPING_TYPE } from '../../../compare_fields_table/translations';
+import {
+  ECS_FIELD_REFERENCE_URL,
+  ECS_REFERENCE_URL,
+  getSummaryMarkdownComment,
+  getCustomMarkdownTableRows,
+  getMarkdownComment,
+  getMarkdownTable,
+  getTabCountsMarkdownComment,
+  MAPPING_URL,
+  getSummaryTableMarkdownComment,
+} from '../../index_properties/markdown/helpers';
+import * as i18n from '../../index_properties/translations';
+import { getFillColor } from '../summary_tab/helpers';
+import type { EnrichedFieldMetadata, IlmPhase, PartitionedFieldMetadata } from '../../../types';
+
+export const getCustomMarkdownComment = ({
+  enrichedFieldMetadata,
+}: {
+  enrichedFieldMetadata: EnrichedFieldMetadata[];
+}): string =>
+  getMarkdownComment({
+    suggestedAction: `${i18n.CUSTOM_CALLOUT({
+      fieldCount: enrichedFieldMetadata.length,
+      version: EcsVersion,
+    })}
+
+${i18n.PRE_BUILT_DETECTION_ENGINE_RULES_WONT_WORK}
+${i18n.PAGES_MAY_NOT_DISPLAY_FIELDS}
+${i18n.CUSTOM_DETECTION_ENGINE_RULES_WORK}
+`,
+    title: i18n.CUSTOM_CALLOUT_TITLE(enrichedFieldMetadata.length),
+  });
+
+export const showCustomCallout = (enrichedFieldMetadata: EnrichedFieldMetadata[]): boolean =>
+  enrichedFieldMetadata.length > 0;
+
+export const getCustomColor = (partitionedFieldMetadata: PartitionedFieldMetadata): string =>
+  showCustomCallout(partitionedFieldMetadata.custom)
+    ? getFillColor('custom')
+    : euiThemeVars.euiTextColor;
+
+export const getAllCustomMarkdownComments = ({
+  docsCount,
+  formatNumber,
+  ilmPhase,
+  indexName,
+  partitionedFieldMetadata,
+  patternDocsCount,
+}: {
+  docsCount: number;
+  formatNumber: (value: number | undefined) => string;
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  patternDocsCount: number;
+}): string[] => [
+  getSummaryMarkdownComment({
+    ecsFieldReferenceUrl: ECS_FIELD_REFERENCE_URL,
+    ecsReferenceUrl: ECS_REFERENCE_URL,
+    incompatible: partitionedFieldMetadata.incompatible.length,
+    indexName,
+    mappingUrl: MAPPING_URL,
+  }),
+  getSummaryTableMarkdownComment({
+    docsCount,
+    formatNumber,
+    ilmPhase,
+    indexName,
+    partitionedFieldMetadata,
+    patternDocsCount,
+  }),
+  getTabCountsMarkdownComment(partitionedFieldMetadata),
+  getCustomMarkdownComment({
+    enrichedFieldMetadata: partitionedFieldMetadata.custom,
+  }),
+  getMarkdownTable({
+    enrichedFieldMetadata: partitionedFieldMetadata.custom,
+    getMarkdownTableRows: getCustomMarkdownTableRows,
+    headerNames: [FIELD, INDEX_MAPPING_TYPE],
+    title: i18n.CUSTOM_FIELDS_TABLE_TITLE(indexName),
+  }),
+];
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/custom_tab/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/custom_tab/index.tsx
new file mode 100644
index 0000000000000..26b4ac87a8db5
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/custom_tab/index.tsx
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  copyToClipboard,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiEmptyPrompt,
+  EuiSpacer,
+} from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import React, { useCallback, useMemo } from 'react';
+
+import { CustomCallout } from '../callouts/custom_callout';
+import { CompareFieldsTable } from '../../../compare_fields_table';
+import { getCustomTableColumns } from '../../../compare_fields_table/helpers';
+import { EMPTY_STAT } from '../../../helpers';
+import { EmptyPromptBody } from '../../index_properties/empty_prompt_body';
+import { EmptyPromptTitle } from '../../index_properties/empty_prompt_title';
+import { getAllCustomMarkdownComments, showCustomCallout } from './helpers';
+import { CopyToClipboardButton } from '../styles';
+import * as i18n from '../../index_properties/translations';
+import { COPIED_RESULTS_TOAST_TITLE } from '../../../translations';
+import type { IlmPhase, PartitionedFieldMetadata } from '../../../types';
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  defaultNumberFormat: string;
+  docsCount: number;
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  patternDocsCount: number;
+}
+
+const CustomTabComponent: React.FC<Props> = ({
+  addSuccessToast,
+  defaultNumberFormat,
+  docsCount,
+  ilmPhase,
+  indexName,
+  partitionedFieldMetadata,
+  patternDocsCount,
+}) => {
+  const formatNumber = useCallback(
+    (value: number | undefined): string =>
+      value != null ? numeral(value).format(defaultNumberFormat) : EMPTY_STAT,
+    [defaultNumberFormat]
+  );
+  const markdownComments: string[] = useMemo(
+    () =>
+      getAllCustomMarkdownComments({
+        docsCount,
+        formatNumber,
+        ilmPhase,
+        indexName,
+        partitionedFieldMetadata,
+        patternDocsCount,
+      }),
+    [docsCount, formatNumber, ilmPhase, indexName, partitionedFieldMetadata, patternDocsCount]
+  );
+
+  const body = useMemo(() => <EmptyPromptBody body={i18n.CUSTOM_EMPTY} />, []);
+  const title = useMemo(() => <EmptyPromptTitle title={i18n.CUSTOM_EMPTY_TITLE} />, []);
+
+  const onCopy = useCallback(() => {
+    copyToClipboard(markdownComments.join('\n'));
+
+    addSuccessToast({
+      title: COPIED_RESULTS_TOAST_TITLE,
+    });
+  }, [addSuccessToast, markdownComments]);
+
+  return (
+    <>
+      {showCustomCallout(partitionedFieldMetadata.custom) ? (
+        <>
+          <CustomCallout enrichedFieldMetadata={partitionedFieldMetadata.custom}>
+            <EuiFlexGroup alignItems="center" gutterSize="none">
+              <EuiFlexItem grow={false}>
+                <CopyToClipboardButton aria-label={i18n.COPY_TO_CLIPBOARD} onClick={onCopy}>
+                  {i18n.COPY_TO_CLIPBOARD}
+                </CopyToClipboardButton>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </CustomCallout>
+
+          <EuiSpacer />
+
+          <CompareFieldsTable
+            enrichedFieldMetadata={partitionedFieldMetadata.custom}
+            getTableColumns={getCustomTableColumns}
+            title={i18n.CUSTOM_FIELDS_TABLE_TITLE(indexName)}
+          />
+        </>
+      ) : (
+        <EuiEmptyPrompt body={body} title={title} titleSize="s" />
+      )}
+    </>
+  );
+};
+
+CustomTabComponent.displayName = 'CustomTabComponent';
+
+export const CustomTab = React.memo(CustomTabComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/ecs_compliant_tab/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/ecs_compliant_tab/index.tsx
new file mode 100644
index 0000000000000..d8d2bce25bc83
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/ecs_compliant_tab/index.tsx
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EcsVersion } from '@kbn/ecs';
+
+import { EuiCallOut, EuiEmptyPrompt, EuiSpacer } from '@elastic/eui';
+import React, { useMemo } from 'react';
+import styled from 'styled-components';
+
+import { CompareFieldsTable } from '../../../compare_fields_table';
+import { getEcsCompliantTableColumns } from '../../../compare_fields_table/helpers';
+import { EmptyPromptBody } from '../../index_properties/empty_prompt_body';
+import { EmptyPromptTitle } from '../../index_properties/empty_prompt_title';
+import { showMissingTimestampCallout } from '../helpers';
+import { CalloutItem } from '../styles';
+import * as i18n from '../../index_properties/translations';
+import type { PartitionedFieldMetadata } from '../../../types';
+
+const EmptyPromptContainer = styled.div`
+  width: 100%;
+`;
+
+interface Props {
+  indexName: string;
+  onAddToNewCase: (markdownComments: string[]) => void;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+}
+
+const EcsCompliantTabComponent: React.FC<Props> = ({
+  indexName,
+  onAddToNewCase,
+  partitionedFieldMetadata,
+}) => {
+  const emptyPromptBody = useMemo(() => <EmptyPromptBody body={i18n.ECS_COMPLIANT_EMPTY} />, []);
+  const title = useMemo(() => <EmptyPromptTitle title={i18n.ECS_COMPLIANT_EMPTY_TITLE} />, []);
+
+  return (
+    <>
+      {!showMissingTimestampCallout(partitionedFieldMetadata.ecsCompliant) ? (
+        <>
+          <EuiCallOut
+            size="s"
+            title={i18n.ECS_COMPLIANT_CALLOUT_TITLE(partitionedFieldMetadata.ecsCompliant.length)}
+          >
+            <p>
+              {i18n.ECS_COMPLIANT_CALLOUT({
+                fieldCount: partitionedFieldMetadata.ecsCompliant.length,
+                version: EcsVersion,
+              })}
+            </p>
+            <CalloutItem>{i18n.PRE_BUILT_DETECTION_ENGINE_RULES_WORK}</CalloutItem>
+            <CalloutItem>{i18n.CUSTOM_DETECTION_ENGINE_RULES_WORK}</CalloutItem>
+            <CalloutItem>{i18n.PAGES_DISPLAY_EVENTS}</CalloutItem>
+            <CalloutItem>{i18n.OTHER_APP_CAPABILITIES_WORK_PROPERLY}</CalloutItem>
+            <CalloutItem>{i18n.ECS_COMPLIANT_MAPPINGS_ARE_FULLY_SUPPORTED}</CalloutItem>
+          </EuiCallOut>
+          <EuiSpacer />
+          <CompareFieldsTable
+            enrichedFieldMetadata={partitionedFieldMetadata.ecsCompliant}
+            getTableColumns={getEcsCompliantTableColumns}
+            title={i18n.ECS_COMPLIANT_FIELDS_TABLE_TITLE(indexName)}
+          />
+        </>
+      ) : (
+        <EmptyPromptContainer>
+          <EuiEmptyPrompt
+            body={emptyPromptBody}
+            iconType="cross"
+            iconColor="danger"
+            title={title}
+            titleSize="s"
+          />
+        </EmptyPromptContainer>
+      )}
+    </>
+  );
+};
+
+EcsCompliantTabComponent.displayName = 'EcsCompliantTabComponent';
+
+export const EcsCompliantTab = React.memo(EcsCompliantTabComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/helpers.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/helpers.tsx
new file mode 100644
index 0000000000000..0697528b957ba
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/helpers.tsx
@@ -0,0 +1,188 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  FlameElementEvent,
+  HeatmapElementEvent,
+  MetricElementEvent,
+  PartitionElementEvent,
+  Theme,
+  WordCloudElementEvent,
+  XYChartElementEvent,
+} from '@elastic/charts';
+import { EuiBadge } from '@elastic/eui';
+import { euiThemeVars } from '@kbn/ui-theme';
+import React from 'react';
+
+import { AllTab } from './all_tab';
+import { CustomTab } from './custom_tab';
+import { getCustomColor } from './custom_tab/helpers';
+import { EcsCompliantTab } from './ecs_compliant_tab';
+import { IncompatibleTab } from './incompatible_tab';
+import { getIncompatibleColor } from './incompatible_tab/helpers';
+import {
+  ALL_TAB_ID,
+  ECS_COMPLIANT_TAB_ID,
+  INCOMPATIBLE_TAB_ID,
+  SUMMARY_TAB_ID,
+} from '../index_properties/helpers';
+import { getMarkdownComment } from '../index_properties/markdown/helpers';
+import { getFillColor } from './summary_tab/helpers';
+import * as i18n from '../index_properties/translations';
+import { SummaryTab } from './summary_tab';
+import type { EnrichedFieldMetadata, IlmPhase, PartitionedFieldMetadata } from '../../types';
+
+export const getMissingTimestampComment = (): string =>
+  getMarkdownComment({
+    suggestedAction: `${i18n.MISSING_TIMESTAMP_CALLOUT}
+
+${i18n.DETECTION_ENGINE_RULES_WONT_WORK}
+${i18n.PAGES_WONT_DISPLAY_EVENTS}
+`,
+    title: i18n.MISSING_TIMESTAMP_CALLOUT_TITLE,
+  });
+
+export const showMissingTimestampCallout = (
+  enrichedFieldMetadata: EnrichedFieldMetadata[]
+): boolean => enrichedFieldMetadata.length === 0;
+
+export const getEcsCompliantColor = (partitionedFieldMetadata: PartitionedFieldMetadata): string =>
+  showMissingTimestampCallout(partitionedFieldMetadata.ecsCompliant)
+    ? euiThemeVars.euiColorDanger
+    : getFillColor('ecs-compliant');
+
+export const getTabs = ({
+  addSuccessToast,
+  addToNewCaseDisabled,
+  defaultNumberFormat,
+  docsCount,
+  getGroupByFieldsOnClick,
+  ilmPhase,
+  indexName,
+  onAddToNewCase,
+  partitionedFieldMetadata,
+  pattern,
+  patternDocsCount,
+  setSelectedTabId,
+  theme,
+}: {
+  addSuccessToast: (toast: { title: string }) => void;
+  addToNewCaseDisabled: boolean;
+  defaultNumberFormat: string;
+  docsCount: number;
+  getGroupByFieldsOnClick: (
+    elements: Array<
+      | FlameElementEvent
+      | HeatmapElementEvent
+      | MetricElementEvent
+      | PartitionElementEvent
+      | WordCloudElementEvent
+      | XYChartElementEvent
+    >
+  ) => {
+    groupByField0: string;
+    groupByField1: string;
+  };
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  onAddToNewCase: (markdownComments: string[]) => void;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  pattern: string;
+  patternDocsCount: number;
+  setSelectedTabId: (tabId: string) => void;
+  theme: Theme;
+}) => [
+  {
+    content: (
+      <SummaryTab
+        addSuccessToast={addSuccessToast}
+        addToNewCaseDisabled={addToNewCaseDisabled}
+        defaultNumberFormat={defaultNumberFormat}
+        docsCount={docsCount}
+        getGroupByFieldsOnClick={getGroupByFieldsOnClick}
+        ilmPhase={ilmPhase}
+        indexName={indexName}
+        onAddToNewCase={onAddToNewCase}
+        partitionedFieldMetadata={partitionedFieldMetadata}
+        pattern={pattern}
+        patternDocsCount={patternDocsCount}
+        setSelectedTabId={setSelectedTabId}
+        theme={theme}
+      />
+    ),
+    id: SUMMARY_TAB_ID,
+    name: i18n.SUMMARY,
+  },
+  {
+    append: (
+      <EuiBadge color={getIncompatibleColor()}>
+        {partitionedFieldMetadata.incompatible.length}
+      </EuiBadge>
+    ),
+    content: (
+      <IncompatibleTab
+        addSuccessToast={addSuccessToast}
+        addToNewCaseDisabled={addToNewCaseDisabled}
+        defaultNumberFormat={defaultNumberFormat}
+        docsCount={docsCount}
+        ilmPhase={ilmPhase}
+        indexName={indexName}
+        onAddToNewCase={onAddToNewCase}
+        partitionedFieldMetadata={partitionedFieldMetadata}
+        patternDocsCount={patternDocsCount}
+      />
+    ),
+    id: INCOMPATIBLE_TAB_ID,
+    name: i18n.INCOMPATIBLE_FIELDS,
+  },
+  {
+    append: (
+      <EuiBadge color={getCustomColor(partitionedFieldMetadata)}>
+        {partitionedFieldMetadata.custom.length}
+      </EuiBadge>
+    ),
+    content: (
+      <CustomTab
+        addSuccessToast={addSuccessToast}
+        defaultNumberFormat={defaultNumberFormat}
+        docsCount={docsCount}
+        ilmPhase={ilmPhase}
+        indexName={indexName}
+        partitionedFieldMetadata={partitionedFieldMetadata}
+        patternDocsCount={patternDocsCount}
+      />
+    ),
+    id: 'customTab',
+    name: i18n.CUSTOM_FIELDS,
+  },
+  {
+    append: (
+      <EuiBadge color={getEcsCompliantColor(partitionedFieldMetadata)}>
+        {partitionedFieldMetadata.ecsCompliant.length}
+      </EuiBadge>
+    ),
+    content: (
+      <EcsCompliantTab
+        indexName={indexName}
+        onAddToNewCase={onAddToNewCase}
+        partitionedFieldMetadata={partitionedFieldMetadata}
+      />
+    ),
+    id: ECS_COMPLIANT_TAB_ID,
+    name: i18n.ECS_COMPLIANT_FIELDS,
+  },
+  {
+    append: (
+      <EuiBadge color={euiThemeVars.euiColorDarkShade}>
+        {partitionedFieldMetadata.all.length}
+      </EuiBadge>
+    ),
+    content: <AllTab indexName={indexName} partitionedFieldMetadata={partitionedFieldMetadata} />,
+    id: ALL_TAB_ID,
+    name: i18n.ALL_FIELDS,
+  },
+];
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/helpers.ts
new file mode 100644
index 0000000000000..cc8d2f317d26d
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/helpers.ts
@@ -0,0 +1,149 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EcsVersion } from '@kbn/ecs';
+
+import {
+  ECS_FIELD_REFERENCE_URL,
+  ECS_REFERENCE_URL,
+  getSummaryMarkdownComment,
+  getIncompatibleMappingsMarkdownTableRows,
+  getIncompatibleValuesMarkdownTableRows,
+  getMarkdownComment,
+  getMarkdownTable,
+  getSummaryTableMarkdownComment,
+  getTabCountsMarkdownComment,
+  MAPPING_URL,
+} from '../../index_properties/markdown/helpers';
+import { getFillColor } from '../summary_tab/helpers';
+import * as i18n from '../../index_properties/translations';
+import type { EnrichedFieldMetadata, IlmPhase, PartitionedFieldMetadata } from '../../../types';
+import {
+  INCOMPATIBLE_FIELD_MAPPINGS_TABLE_TITLE,
+  INCOMPATIBLE_FIELD_VALUES_TABLE_TITLE,
+} from './translations';
+import {
+  FIELD,
+  ECS_MAPPING_TYPE_EXPECTED,
+  INDEX_MAPPING_TYPE_ACTUAL,
+  DOCUMENT_VALUES_ACTUAL,
+  ECS_VALUES_EXPECTED,
+} from '../../../compare_fields_table/translations';
+
+export const getIncompatibleFieldsMarkdownComment = ({
+  incompatible,
+}: {
+  incompatible: number;
+}): string =>
+  getMarkdownComment({
+    suggestedAction: `${i18n.INCOMPATIBLE_CALLOUT({
+      fieldCount: incompatible,
+      version: EcsVersion,
+    })}
+
+${i18n.DETECTION_ENGINE_RULES_WONT_WORK}
+${i18n.PAGES_WONT_DISPLAY_EVENTS}
+${i18n.MAPPINGS_THAT_CONFLICT_WITH_ECS}
+`,
+    title: i18n.INCOMPATIBLE_CALLOUT_TITLE(incompatible),
+  });
+
+export const showInvalidCallout = (enrichedFieldMetadata: EnrichedFieldMetadata[]): boolean =>
+  enrichedFieldMetadata.length > 0;
+
+export const getIncompatibleColor = (): string => getFillColor('incompatible');
+
+export const getIncompatibleMappings = (
+  enrichedFieldMetadata: EnrichedFieldMetadata[]
+): EnrichedFieldMetadata[] =>
+  enrichedFieldMetadata.filter((x) => !x.isEcsCompliant && x.type !== x.indexFieldType);
+
+export const getIncompatibleValues = (
+  enrichedFieldMetadata: EnrichedFieldMetadata[]
+): EnrichedFieldMetadata[] =>
+  enrichedFieldMetadata.filter((x) => !x.isEcsCompliant && x.indexInvalidValues.length > 0);
+
+export const getIncompatibleFieldsMarkdownTablesComment = ({
+  incompatibleMappings,
+  incompatibleValues,
+  indexName,
+}: {
+  incompatibleMappings: EnrichedFieldMetadata[];
+  incompatibleValues: EnrichedFieldMetadata[];
+  indexName: string;
+}): string => `
+${
+  incompatibleMappings.length > 0
+    ? getMarkdownTable({
+        enrichedFieldMetadata: incompatibleMappings,
+        getMarkdownTableRows: getIncompatibleMappingsMarkdownTableRows,
+        headerNames: [FIELD, ECS_MAPPING_TYPE_EXPECTED, INDEX_MAPPING_TYPE_ACTUAL],
+        title: INCOMPATIBLE_FIELD_MAPPINGS_TABLE_TITLE(indexName),
+      })
+    : ''
+}
+${
+  incompatibleValues.length > 0
+    ? getMarkdownTable({
+        enrichedFieldMetadata: incompatibleValues,
+        getMarkdownTableRows: getIncompatibleValuesMarkdownTableRows,
+        headerNames: [FIELD, ECS_VALUES_EXPECTED, DOCUMENT_VALUES_ACTUAL],
+        title: INCOMPATIBLE_FIELD_VALUES_TABLE_TITLE(indexName),
+      })
+    : ''
+}
+`;
+
+export const getAllIncompatibleMarkdownComments = ({
+  docsCount,
+  formatNumber,
+  ilmPhase,
+  indexName,
+  partitionedFieldMetadata,
+  patternDocsCount,
+}: {
+  docsCount: number;
+  formatNumber: (value: number | undefined) => string;
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  patternDocsCount: number;
+}): string[] => {
+  const incompatibleMappings = getIncompatibleMappings(partitionedFieldMetadata.incompatible);
+  const incompatibleValues = getIncompatibleValues(partitionedFieldMetadata.incompatible);
+  const incompatibleFieldsMarkdownComment =
+    partitionedFieldMetadata.incompatible.length > 0
+      ? getIncompatibleFieldsMarkdownComment({
+          incompatible: partitionedFieldMetadata.incompatible.length,
+        })
+      : '';
+
+  return [
+    getSummaryMarkdownComment({
+      ecsFieldReferenceUrl: ECS_FIELD_REFERENCE_URL,
+      ecsReferenceUrl: ECS_REFERENCE_URL,
+      incompatible: partitionedFieldMetadata.incompatible.length,
+      indexName,
+      mappingUrl: MAPPING_URL,
+    }),
+    getSummaryTableMarkdownComment({
+      docsCount,
+      formatNumber,
+      ilmPhase,
+      indexName,
+      partitionedFieldMetadata,
+      patternDocsCount,
+    }),
+    getTabCountsMarkdownComment(partitionedFieldMetadata),
+    incompatibleFieldsMarkdownComment,
+    getIncompatibleFieldsMarkdownTablesComment({
+      incompatibleMappings,
+      incompatibleValues,
+      indexName,
+    }),
+  ].filter((x) => x !== '');
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/index.tsx
new file mode 100644
index 0000000000000..a285a397cdd7b
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/index.tsx
@@ -0,0 +1,172 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  copyToClipboard,
+  EuiButton,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiEmptyPrompt,
+  EuiSpacer,
+} from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import React, { useCallback, useMemo } from 'react';
+
+import { IncompatibleCallout } from '../callouts/incompatible_callout';
+import { CompareFieldsTable } from '../../../compare_fields_table';
+import {
+  getIncompatibleMappingsTableColumns,
+  getIncompatibleValuesTableColumns,
+} from '../../../compare_fields_table/helpers';
+import { EMPTY_STAT } from '../../../helpers';
+import { EmptyPromptBody } from '../../index_properties/empty_prompt_body';
+import { EmptyPromptTitle } from '../../index_properties/empty_prompt_title';
+import {
+  getAllIncompatibleMarkdownComments,
+  getIncompatibleMappings,
+  getIncompatibleValues,
+  showInvalidCallout,
+} from './helpers';
+import * as i18n from '../../index_properties/translations';
+import { CopyToClipboardButton } from '../styles';
+import {
+  INCOMPATIBLE_FIELD_MAPPINGS_TABLE_TITLE,
+  INCOMPATIBLE_FIELD_VALUES_TABLE_TITLE,
+} from './translations';
+import { COPIED_RESULTS_TOAST_TITLE } from '../../../translations';
+import type { IlmPhase, PartitionedFieldMetadata } from '../../../types';
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  addToNewCaseDisabled: boolean;
+  defaultNumberFormat: string;
+  docsCount: number;
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  onAddToNewCase: (markdownComments: string[]) => void;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  patternDocsCount: number;
+}
+
+const IncompatibleTabComponent: React.FC<Props> = ({
+  addSuccessToast,
+  addToNewCaseDisabled,
+  defaultNumberFormat,
+  docsCount,
+  ilmPhase,
+  indexName,
+  onAddToNewCase,
+  partitionedFieldMetadata,
+  patternDocsCount,
+}) => {
+  const formatNumber = useCallback(
+    (value: number | undefined): string =>
+      value != null ? numeral(value).format(defaultNumberFormat) : EMPTY_STAT,
+    [defaultNumberFormat]
+  );
+  const body = useMemo(() => <EmptyPromptBody body={i18n.INCOMPATIBLE_EMPTY} />, []);
+  const title = useMemo(() => <EmptyPromptTitle title={i18n.INCOMPATIBLE_EMPTY_TITLE} />, []);
+  const incompatibleMappings = useMemo(
+    () => getIncompatibleMappings(partitionedFieldMetadata.incompatible),
+    [partitionedFieldMetadata.incompatible]
+  );
+  const incompatibleValues = useMemo(
+    () => getIncompatibleValues(partitionedFieldMetadata.incompatible),
+    [partitionedFieldMetadata.incompatible]
+  );
+  const markdownComments: string[] = useMemo(
+    () =>
+      getAllIncompatibleMarkdownComments({
+        docsCount,
+        formatNumber,
+        ilmPhase,
+        indexName,
+        partitionedFieldMetadata,
+        patternDocsCount,
+      }),
+    [docsCount, formatNumber, ilmPhase, indexName, partitionedFieldMetadata, patternDocsCount]
+  );
+  const onClickAddToCase = useCallback(
+    () => onAddToNewCase([markdownComments.join('\n')]),
+    [markdownComments, onAddToNewCase]
+  );
+  const onCopy = useCallback(() => {
+    copyToClipboard(markdownComments.join('\n'));
+
+    addSuccessToast({
+      title: COPIED_RESULTS_TOAST_TITLE,
+    });
+  }, [addSuccessToast, markdownComments]);
+
+  return (
+    <>
+      {showInvalidCallout(partitionedFieldMetadata.incompatible) ? (
+        <>
+          <IncompatibleCallout enrichedFieldMetadata={partitionedFieldMetadata.incompatible}>
+            <EuiFlexGroup alignItems="center" gutterSize="none">
+              <EuiFlexItem grow={false}>
+                <EuiButton
+                  aria-label={i18n.ADD_TO_NEW_CASE}
+                  disabled={addToNewCaseDisabled}
+                  onClick={onClickAddToCase}
+                >
+                  {i18n.ADD_TO_NEW_CASE}
+                </EuiButton>
+              </EuiFlexItem>
+
+              <EuiFlexItem grow={false}>
+                <CopyToClipboardButton aria-label={i18n.COPY_TO_CLIPBOARD} onClick={onCopy}>
+                  {i18n.COPY_TO_CLIPBOARD}
+                </CopyToClipboardButton>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </IncompatibleCallout>
+
+          <>
+            {incompatibleMappings.length > 0 && (
+              <>
+                <EuiSpacer />
+
+                <CompareFieldsTable
+                  enrichedFieldMetadata={incompatibleMappings}
+                  getTableColumns={getIncompatibleMappingsTableColumns}
+                  title={INCOMPATIBLE_FIELD_MAPPINGS_TABLE_TITLE(indexName)}
+                />
+              </>
+            )}
+          </>
+
+          <>
+            {incompatibleValues.length > 0 && (
+              <>
+                <EuiSpacer />
+
+                <CompareFieldsTable
+                  enrichedFieldMetadata={incompatibleValues}
+                  getTableColumns={getIncompatibleValuesTableColumns}
+                  title={INCOMPATIBLE_FIELD_VALUES_TABLE_TITLE(indexName)}
+                />
+              </>
+            )}
+          </>
+        </>
+      ) : (
+        <EuiEmptyPrompt
+          body={body}
+          iconType="check"
+          iconColor="success"
+          title={title}
+          titleSize="s"
+        />
+      )}
+    </>
+  );
+};
+
+IncompatibleTabComponent.displayName = 'IncompatibleTabComponent';
+
+export const IncompatibleTab = React.memo(IncompatibleTabComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/translations.ts
new file mode 100644
index 0000000000000..829aa228e06b4
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/incompatible_tab/translations.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const INCOMPATIBLE_FIELD_MAPPINGS_TABLE_TITLE = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.incompatibleTab.incompatibleFieldMappingsTableTitle', {
+    values: { indexName },
+    defaultMessage: 'Incompatible field mappings - {indexName}',
+  });
+
+export const INCOMPATIBLE_FIELD_VALUES_TABLE_TITLE = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.incompatibleTab.incompatibleFieldValuesTableTitle', {
+    values: { indexName },
+    defaultMessage: 'Incompatible field values - {indexName}',
+  });
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/styles.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/styles.tsx
new file mode 100644
index 0000000000000..cf83cf96d2812
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/styles.tsx
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButtonEmpty } from '@elastic/eui';
+import styled from 'styled-components';
+
+export const CalloutItem = styled.div`
+  margin-left: ${({ theme }) => theme.eui.euiSizeS};
+`;
+
+export const CopyToClipboardButton = styled(EuiButtonEmpty)`
+  margin-left: ${({ theme }) => theme.eui.euiSizeXS};
+`;
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/callout_summary/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/callout_summary/index.tsx
new file mode 100644
index 0000000000000..054ac5e003326
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/callout_summary/index.tsx
@@ -0,0 +1,135 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { copyToClipboard, EuiButton, EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import React, { useCallback, useMemo } from 'react';
+
+import { MissingTimestampCallout } from '../../callouts/missing_timestamp_callout';
+import { IncompatibleCallout } from '../../callouts/incompatible_callout';
+import { showMissingTimestampCallout } from '../../helpers';
+import { getMarkdownComments } from '../helpers';
+import { EMPTY_STAT } from '../../../../helpers';
+import { showInvalidCallout } from '../../incompatible_tab/helpers';
+import { CopyToClipboardButton } from '../../styles';
+import * as i18n from '../../../index_properties/translations';
+import { COPIED_RESULTS_TOAST_TITLE } from '../../../../translations';
+import type { IlmPhase, PartitionedFieldMetadata } from '../../../../types';
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  addToNewCaseDisabled: boolean;
+  defaultNumberFormat: string;
+  docsCount: number;
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  onAddToNewCase: (markdownComment: string[]) => void;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  pattern: string;
+  patternDocsCount: number;
+}
+
+const CalloutSummaryComponent: React.FC<Props> = ({
+  addSuccessToast,
+  addToNewCaseDisabled,
+  defaultNumberFormat,
+  docsCount,
+  ilmPhase,
+  indexName,
+  onAddToNewCase,
+  partitionedFieldMetadata,
+  pattern,
+  patternDocsCount,
+}) => {
+  const formatNumber = useCallback(
+    (value: number | undefined): string =>
+      value != null ? numeral(value).format(defaultNumberFormat) : EMPTY_STAT,
+    [defaultNumberFormat]
+  );
+  const markdownComments: string[] = useMemo(
+    () =>
+      getMarkdownComments({
+        docsCount,
+        formatNumber,
+        ilmPhase,
+        indexName,
+        partitionedFieldMetadata,
+        pattern,
+        patternDocsCount,
+      }),
+    [
+      docsCount,
+      formatNumber,
+      ilmPhase,
+      indexName,
+      partitionedFieldMetadata,
+      pattern,
+      patternDocsCount,
+    ]
+  );
+
+  const onClickAddToCase = useCallback(
+    () => onAddToNewCase([markdownComments.join('\n')]),
+    [markdownComments, onAddToNewCase]
+  );
+
+  const onCopy = useCallback(() => {
+    copyToClipboard(markdownComments.join('\n'));
+
+    addSuccessToast({
+      title: COPIED_RESULTS_TOAST_TITLE,
+    });
+  }, [addSuccessToast, markdownComments]);
+
+  const showActions =
+    showInvalidCallout(partitionedFieldMetadata.incompatible) ||
+    showMissingTimestampCallout(partitionedFieldMetadata.ecsCompliant);
+
+  return (
+    <>
+      {showInvalidCallout(partitionedFieldMetadata.incompatible) && (
+        <>
+          <IncompatibleCallout enrichedFieldMetadata={partitionedFieldMetadata.incompatible} />
+          <EuiSpacer size="s" />
+        </>
+      )}
+      {showMissingTimestampCallout(partitionedFieldMetadata.ecsCompliant) && (
+        <>
+          <MissingTimestampCallout />
+          <EuiSpacer size="s" />
+        </>
+      )}
+      {showActions && (
+        <>
+          <EuiFlexGroup alignItems="center" gutterSize="none">
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                aria-label={i18n.ADD_TO_NEW_CASE}
+                disabled={addToNewCaseDisabled}
+                onClick={onClickAddToCase}
+              >
+                {i18n.ADD_TO_NEW_CASE}
+              </EuiButton>
+            </EuiFlexItem>
+
+            <EuiFlexItem grow={false}>
+              <CopyToClipboardButton aria-label={i18n.COPY_TO_CLIPBOARD} onClick={onCopy}>
+                {i18n.COPY_TO_CLIPBOARD}
+              </CopyToClipboardButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+
+          <EuiSpacer size="s" />
+        </>
+      )}
+    </>
+  );
+};
+
+CalloutSummaryComponent.displayName = 'CalloutSummaryComponent';
+
+export const CalloutSummary = React.memo(CalloutSummaryComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/helpers.ts
new file mode 100644
index 0000000000000..63d2106c8cbb0
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/helpers.ts
@@ -0,0 +1,114 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { euiThemeVars } from '@kbn/ui-theme';
+
+import { getMissingTimestampComment, showMissingTimestampCallout } from '../helpers';
+import {
+  ALL_TAB_ID,
+  ECS_COMPLIANT_TAB_ID,
+  CUSTOM_TAB_ID,
+  INCOMPATIBLE_TAB_ID,
+} from '../../index_properties/helpers';
+import {
+  getAllIncompatibleMarkdownComments,
+  showInvalidCallout,
+} from '../incompatible_tab/helpers';
+import * as i18n from '../../index_properties/translations';
+import type { IlmPhase, PartitionedFieldMetadata } from '../../../types';
+
+export type CategoryId = 'incompatible' | 'custom' | 'ecs-compliant';
+
+interface SummaryData {
+  categoryId: CategoryId;
+  mappings: number;
+}
+
+export const getSummaryData = (
+  partitionedFieldMetadata: PartitionedFieldMetadata
+): SummaryData[] => [
+  { categoryId: 'incompatible', mappings: partitionedFieldMetadata.incompatible.length },
+  { categoryId: 'custom', mappings: partitionedFieldMetadata.custom.length },
+  { categoryId: 'ecs-compliant', mappings: partitionedFieldMetadata.ecsCompliant.length },
+];
+
+export const getFillColor = (categoryId: CategoryId): string => {
+  switch (categoryId) {
+    case 'incompatible':
+      return euiThemeVars.euiColorDanger;
+    case 'custom':
+      return euiThemeVars.euiColorLightShade;
+    case 'ecs-compliant':
+      return euiThemeVars.euiColorSuccess;
+    default:
+      return euiThemeVars.euiColorGhost;
+  }
+};
+
+export const getNodeLabel = (categoryId: CategoryId): string => {
+  switch (categoryId) {
+    case 'incompatible':
+      return i18n.INCOMPATIBLE_FIELDS;
+    case 'custom':
+      return i18n.CUSTOM_FIELDS;
+    case 'ecs-compliant':
+      return i18n.ECS_COMPLIANT_FIELDS;
+    default:
+      return i18n.UNKNOWN;
+  }
+};
+
+export const getTabId = (groupByField: string): string => {
+  switch (groupByField) {
+    case 'incompatible':
+      return INCOMPATIBLE_TAB_ID;
+    case 'custom':
+      return CUSTOM_TAB_ID;
+    case 'ecs-compliant':
+      return ECS_COMPLIANT_TAB_ID;
+    default:
+      return ALL_TAB_ID;
+  }
+};
+
+const isString = (x: string | null): x is string => typeof x === 'string';
+
+export const getMarkdownComments = ({
+  docsCount,
+  formatNumber,
+  ilmPhase,
+  indexName,
+  partitionedFieldMetadata,
+  patternDocsCount,
+}: {
+  docsCount: number;
+  formatNumber: (value: number | undefined) => string;
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  pattern: string;
+  patternDocsCount: number;
+}): string[] => {
+  const invalidMarkdownComments = showInvalidCallout(partitionedFieldMetadata.incompatible)
+    ? getAllIncompatibleMarkdownComments({
+        docsCount,
+        formatNumber,
+        ilmPhase,
+        indexName,
+        partitionedFieldMetadata,
+        patternDocsCount,
+      })
+    : [];
+
+  const showMissingTimestampComment = showMissingTimestampCallout(
+    partitionedFieldMetadata.ecsCompliant
+  )
+    ? getMissingTimestampComment()
+    : null;
+
+  return [...invalidMarkdownComments, showMissingTimestampComment].filter(isString);
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/index.tsx
new file mode 100644
index 0000000000000..087470b7e86dc
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/tabs/summary_tab/index.tsx
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import type {
+  FlameElementEvent,
+  HeatmapElementEvent,
+  MetricElementEvent,
+  PartitionElementEvent,
+  Theme,
+  WordCloudElementEvent,
+  XYChartElementEvent,
+} from '@elastic/charts';
+import { CalloutSummary } from './callout_summary';
+import { EcsSummaryDonutChart } from '../../../ecs_summary_donut_chart';
+import { ALL_TAB_ID } from '../../index_properties/helpers';
+import type { IlmPhase, PartitionedFieldMetadata } from '../../../types';
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  addToNewCaseDisabled: boolean;
+  defaultNumberFormat: string;
+  docsCount: number;
+  getGroupByFieldsOnClick: (
+    elements: Array<
+      | FlameElementEvent
+      | HeatmapElementEvent
+      | MetricElementEvent
+      | PartitionElementEvent
+      | WordCloudElementEvent
+      | XYChartElementEvent
+    >
+  ) => {
+    groupByField0: string;
+    groupByField1: string;
+  };
+  ilmPhase: IlmPhase | undefined;
+  indexName: string;
+  onAddToNewCase: (markdownComments: string[]) => void;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  pattern: string;
+  patternDocsCount: number;
+  setSelectedTabId: (tabId: string) => void;
+  theme: Theme;
+}
+
+const SummaryTabComponent: React.FC<Props> = ({
+  addSuccessToast,
+  addToNewCaseDisabled,
+  defaultNumberFormat,
+  docsCount,
+  getGroupByFieldsOnClick,
+  ilmPhase,
+  indexName,
+  onAddToNewCase,
+  partitionedFieldMetadata,
+  pattern,
+  patternDocsCount,
+  setSelectedTabId,
+  theme,
+}) => (
+  <>
+    <CalloutSummary
+      addSuccessToast={addSuccessToast}
+      addToNewCaseDisabled={addToNewCaseDisabled}
+      defaultNumberFormat={defaultNumberFormat}
+      docsCount={docsCount}
+      ilmPhase={ilmPhase}
+      indexName={indexName}
+      onAddToNewCase={onAddToNewCase}
+      partitionedFieldMetadata={partitionedFieldMetadata}
+      pattern={pattern}
+      patternDocsCount={patternDocsCount}
+    />
+
+    <EcsSummaryDonutChart
+      defaultTabId={ALL_TAB_ID}
+      getGroupByFieldsOnClick={getGroupByFieldsOnClick}
+      partitionedFieldMetadata={partitionedFieldMetadata}
+      setSelectedTabId={setSelectedTabId}
+      theme={theme}
+    />
+  </>
+);
+
+SummaryTabComponent.displayName = 'SummaryTabComponent';
+
+export const SummaryTab = React.memo(SummaryTabComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/chart_legend/chart_legend_item.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/chart_legend/chart_legend_item.tsx
new file mode 100644
index 0000000000000..129a790b8b71c
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/chart_legend/chart_legend_item.tsx
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiHealth } from '@elastic/eui';
+import React from 'react';
+
+interface Props {
+  color: string;
+  count: number;
+  onClick: () => void;
+  text: string;
+}
+
+const ChartLegendItemComponent: React.FC<Props> = ({ color, count, onClick, text }) => {
+  return (
+    <EuiFlexGroup alignItems="center" gutterSize="none" justifyContent="spaceBetween">
+      <EuiFlexItem grow={false}>
+        <EuiHealth color={color}>
+          <EuiButtonEmpty aria-label={text} color="text" onClick={onClick}>
+            {text}
+          </EuiButtonEmpty>
+        </EuiHealth>
+      </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <EuiButtonEmpty aria-label={String(count)} color="text" onClick={onClick}>
+          <div>{count}</div>
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+ChartLegendItemComponent.displayName = 'ChartLegendItemComponent';
+
+export const ChartLegendItem = React.memo(ChartLegendItemComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/chart_legend/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/chart_legend/index.tsx
new file mode 100644
index 0000000000000..21dd3e0450f40
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/chart_legend/index.tsx
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import React, { useCallback } from 'react';
+import styled from 'styled-components';
+
+import { ChartLegendItem } from './chart_legend_item';
+import { getEcsCompliantColor } from '../../data_quality_panel/tabs/helpers';
+import {
+  ECS_COMPLIANT_TAB_ID,
+  CUSTOM_TAB_ID,
+  INCOMPATIBLE_TAB_ID,
+} from '../../data_quality_panel/index_properties/helpers';
+import { getCustomColor } from '../../data_quality_panel/tabs/custom_tab/helpers';
+import { getIncompatibleColor } from '../../data_quality_panel/tabs/incompatible_tab/helpers';
+import type { PartitionedFieldMetadata } from '../../types';
+import * as i18n from '../../data_quality_panel/index_properties/translations';
+
+const ChartLegendFlexGroup = styled(EuiFlexGroup)`
+  width: 210px;
+`;
+
+interface Props {
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  setSelectedTabId: (tabId: string) => void;
+}
+
+const ChartLegendComponent: React.FC<Props> = ({ partitionedFieldMetadata, setSelectedTabId }) => {
+  const showIncompatibleTab = useCallback(
+    () => setSelectedTabId(INCOMPATIBLE_TAB_ID),
+    [setSelectedTabId]
+  );
+
+  const showCustomTab = useCallback(() => setSelectedTabId(CUSTOM_TAB_ID), [setSelectedTabId]);
+
+  const showEcsCompliantTab = useCallback(
+    () => setSelectedTabId(ECS_COMPLIANT_TAB_ID),
+    [setSelectedTabId]
+  );
+
+  return (
+    <ChartLegendFlexGroup direction="column" gutterSize="none">
+      {partitionedFieldMetadata.incompatible.length > 0 && (
+        <EuiFlexItem grow={false}>
+          <ChartLegendItem
+            color={getIncompatibleColor()}
+            count={partitionedFieldMetadata.incompatible.length}
+            onClick={showIncompatibleTab}
+            text={i18n.INCOMPATIBLE_FIELDS}
+          />
+        </EuiFlexItem>
+      )}
+
+      {partitionedFieldMetadata.custom.length > 0 && (
+        <EuiFlexItem grow={false}>
+          <ChartLegendItem
+            color={getCustomColor(partitionedFieldMetadata)}
+            count={partitionedFieldMetadata.custom.length}
+            onClick={showCustomTab}
+            text={i18n.CUSTOM_FIELDS}
+          />
+        </EuiFlexItem>
+      )}
+
+      {partitionedFieldMetadata.ecsCompliant.length > 0 && (
+        <EuiFlexItem grow={false}>
+          <ChartLegendItem
+            color={getEcsCompliantColor(partitionedFieldMetadata)}
+            count={partitionedFieldMetadata.ecsCompliant.length}
+            onClick={showEcsCompliantTab}
+            text={i18n.ECS_COMPLIANT_FIELDS}
+          />
+        </EuiFlexItem>
+      )}
+    </ChartLegendFlexGroup>
+  );
+};
+
+ChartLegendComponent.displayName = 'ChartLegendComponent';
+
+export const ChartLegend = React.memo(ChartLegendComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/helpers.ts
new file mode 100644
index 0000000000000..3765bbe68ed16
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/helpers.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { PartitionedFieldMetadata } from '../types';
+
+export const allMetadataIsEmpty = (partitionedFieldMetadata: PartitionedFieldMetadata): boolean =>
+  partitionedFieldMetadata.all.length === 0;
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/index.tsx
new file mode 100644
index 0000000000000..dc25d12031b8f
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/index.tsx
@@ -0,0 +1,190 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  Datum,
+  ElementClickListener,
+  FlameElementEvent,
+  HeatmapElementEvent,
+  MetricElementEvent,
+  PartialTheme,
+  PartitionElementEvent,
+  Theme,
+  WordCloudElementEvent,
+  XYChartElementEvent,
+} from '@elastic/charts';
+import { Chart, Partition, PartitionLayout, Settings } from '@elastic/charts';
+import {
+  EuiButtonEmpty,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+  EuiText,
+  EuiTitle,
+} from '@elastic/eui';
+import React, { useCallback, useMemo } from 'react';
+import styled from 'styled-components';
+
+import { ChartLegend } from './chart_legend';
+import {
+  getFillColor,
+  getNodeLabel,
+  getSummaryData,
+  getTabId,
+} from '../data_quality_panel/tabs/summary_tab/helpers';
+import { allMetadataIsEmpty } from './helpers';
+import * as i18n from './translations';
+import type { PartitionedFieldMetadata } from '../types';
+
+export const DEFAULT_HEIGHT = 180; // px
+
+const DonutTextWrapper = styled(EuiFlexGroup)`
+  max-width: 77px;
+  position: absolute;
+  top: 40%;
+  width: 100%;
+  z-index: 1;
+`;
+
+const CenteredFlexItem = styled(EuiFlexItem)`
+  align-items: center;
+  position: relative;
+`;
+
+const donutTheme: PartialTheme = {
+  chartMargins: { top: 0, bottom: 0, left: 0, right: 0 },
+  partition: {
+    idealFontSizeJump: 1.1,
+    outerSizeRatio: 1,
+    emptySizeRatio: 0.8,
+    circlePadding: 4,
+  },
+};
+
+interface Props {
+  defaultTabId: string;
+  getGroupByFieldsOnClick: (
+    elements: Array<
+      | FlameElementEvent
+      | HeatmapElementEvent
+      | MetricElementEvent
+      | PartitionElementEvent
+      | WordCloudElementEvent
+      | XYChartElementEvent
+    >
+  ) => {
+    groupByField0: string;
+    groupByField1: string;
+  };
+  height?: number;
+  partitionedFieldMetadata: PartitionedFieldMetadata;
+  setSelectedTabId: (tabId: string) => void;
+  theme: Theme;
+}
+
+const EcsSummaryDonutChartComponent: React.FC<Props> = ({
+  defaultTabId,
+  getGroupByFieldsOnClick,
+  height = DEFAULT_HEIGHT,
+  partitionedFieldMetadata,
+  setSelectedTabId,
+  theme,
+}) => {
+  const summaryData = useMemo(
+    () => getSummaryData(partitionedFieldMetadata),
+    [partitionedFieldMetadata]
+  );
+  const valueAccessor = useCallback((d: Datum) => d.mappings as number, []);
+  const valueFormatter = useCallback((d: number) => `${d}`, []);
+  const layers = useMemo(
+    () => [
+      {
+        groupByRollup: (d: Datum) => d.categoryId,
+        nodeLabel: (d: Datum) => getNodeLabel(d),
+        shape: {
+          fillColor: (d: Datum) => getFillColor(d.dataName),
+        },
+      },
+    ],
+    []
+  );
+  const showDefaultTab = useCallback(
+    () => setSelectedTabId(defaultTabId),
+    [defaultTabId, setSelectedTabId]
+  );
+  const onElementClick: ElementClickListener = useCallback(
+    (event) => {
+      const { groupByField0 } = getGroupByFieldsOnClick(event);
+
+      setSelectedTabId(getTabId(groupByField0));
+    },
+    [getGroupByFieldsOnClick, setSelectedTabId]
+  );
+
+  if (allMetadataIsEmpty(partitionedFieldMetadata)) {
+    return null;
+  }
+
+  return (
+    <>
+      <EuiTitle size="xs">
+        <h4 className="eui-textCenter">{i18n.CHART_TITLE}</h4>
+      </EuiTitle>
+
+      <EuiSpacer />
+
+      <EuiFlexGroup
+        alignItems="center"
+        data-test-subj="donut-chart"
+        gutterSize="l"
+        justifyContent="center"
+        responsive={false}
+      >
+        <CenteredFlexItem grow={false}>
+          <DonutTextWrapper
+            alignItems="center"
+            direction="column"
+            gutterSize="none"
+            justifyContent="center"
+          >
+            <EuiFlexItem className="eui-textTruncate">
+              <EuiButtonEmpty aria-label={i18n.FIELDS} color="text" onClick={showDefaultTab}>
+                <EuiText size="m">{partitionedFieldMetadata.all.length}</EuiText>
+                <EuiText className="eui-textTruncate" size="s">
+                  {i18n.FIELDS}
+                </EuiText>
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+          </DonutTextWrapper>
+
+          <Chart size={height}>
+            <Settings baseTheme={theme} onElementClick={onElementClick} theme={donutTheme} />
+            <Partition
+              data={summaryData}
+              id="ecs-summary-donut-chart"
+              layers={layers}
+              layout={PartitionLayout.sunburst}
+              valueAccessor={valueAccessor}
+              valueFormatter={valueFormatter}
+            />
+          </Chart>
+        </CenteredFlexItem>
+
+        <EuiFlexItem grow={false}>
+          <ChartLegend
+            partitionedFieldMetadata={partitionedFieldMetadata}
+            setSelectedTabId={setSelectedTabId}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </>
+  );
+};
+
+EcsSummaryDonutChartComponent.displayName = 'EcsSummaryDonutChartComponent';
+
+export const EcsSummaryDonutChart = React.memo(EcsSummaryDonutChartComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/translations.ts
new file mode 100644
index 0000000000000..414a6f127eeda
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ecs_summary_donut_chart/translations.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const CHART_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.ecsSummaryDonutChart.chartTitle',
+  {
+    defaultMessage: 'Field mappings',
+  }
+);
+
+export const FIELDS = i18n.translate('ecsDataQualityDashboard.ecsSummaryDonutChart.fieldsLabel', {
+  defaultMessage: 'Fields',
+});
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/example/mappings/alerts.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/example/mappings/alerts.ts
new file mode 100644
index 0000000000000..3840d6990fbdb
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/example/mappings/alerts.ts
@@ -0,0 +1,5318 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IndicesGetMappingIndexMappingRecord } from '@elastic/elasticsearch/lib/api/types';
+
+export const alerts: Record<string, IndicesGetMappingIndexMappingRecord> = {
+  '.internal.alerts-security.alerts-default-000001': {
+    mappings: {
+      dynamic: 'false',
+      _meta: {
+        namespace: 'default',
+        kibana: {
+          version: '8.6.0',
+        },
+      },
+      properties: {
+        '@timestamp': {
+          type: 'date',
+        },
+        agent: {
+          properties: {
+            build: {
+              properties: {
+                original: {
+                  type: 'keyword',
+                },
+              },
+            },
+            ephemeral_id: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+            type: {
+              type: 'keyword',
+            },
+            version: {
+              type: 'keyword',
+            },
+          },
+        },
+        client: {
+          properties: {
+            address: {
+              type: 'keyword',
+            },
+            as: {
+              properties: {
+                number: {
+                  type: 'long',
+                },
+                organization: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            bytes: {
+              type: 'long',
+            },
+            domain: {
+              type: 'keyword',
+            },
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                },
+                continent_code: {
+                  type: 'keyword',
+                },
+                continent_name: {
+                  type: 'keyword',
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                },
+                country_name: {
+                  type: 'keyword',
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                postal_code: {
+                  type: 'keyword',
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                },
+                region_name: {
+                  type: 'keyword',
+                },
+                timezone: {
+                  type: 'keyword',
+                },
+              },
+            },
+            ip: {
+              type: 'ip',
+            },
+            mac: {
+              type: 'keyword',
+            },
+            nat: {
+              properties: {
+                ip: {
+                  type: 'ip',
+                },
+                port: {
+                  type: 'long',
+                },
+              },
+            },
+            packets: {
+              type: 'long',
+            },
+            port: {
+              type: 'long',
+            },
+            registered_domain: {
+              type: 'keyword',
+            },
+            subdomain: {
+              type: 'keyword',
+            },
+            top_level_domain: {
+              type: 'keyword',
+            },
+            user: {
+              properties: {
+                domain: {
+                  type: 'keyword',
+                },
+                email: {
+                  type: 'keyword',
+                },
+                full_name: {
+                  type: 'keyword',
+                },
+                group: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                hash: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                roles: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        cloud: {
+          properties: {
+            account: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+            availability_zone: {
+              type: 'keyword',
+            },
+            instance: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+            machine: {
+              properties: {
+                type: {
+                  type: 'keyword',
+                },
+              },
+            },
+            origin: {
+              properties: {
+                account: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                availability_zone: {
+                  type: 'keyword',
+                },
+                instance: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                machine: {
+                  properties: {
+                    type: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                project: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                provider: {
+                  type: 'keyword',
+                },
+                region: {
+                  type: 'keyword',
+                },
+                service: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            project: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+            provider: {
+              type: 'keyword',
+            },
+            region: {
+              type: 'keyword',
+            },
+            service: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+            target: {
+              properties: {
+                account: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                availability_zone: {
+                  type: 'keyword',
+                },
+                instance: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                machine: {
+                  properties: {
+                    type: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                project: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                provider: {
+                  type: 'keyword',
+                },
+                region: {
+                  type: 'keyword',
+                },
+                service: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+        container: {
+          properties: {
+            id: {
+              type: 'keyword',
+            },
+            image: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                },
+                tag: {
+                  type: 'keyword',
+                },
+              },
+            },
+            labels: {
+              type: 'object',
+            },
+            name: {
+              type: 'keyword',
+            },
+            runtime: {
+              type: 'keyword',
+            },
+          },
+        },
+        destination: {
+          properties: {
+            address: {
+              type: 'keyword',
+            },
+            as: {
+              properties: {
+                number: {
+                  type: 'long',
+                },
+                organization: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            bytes: {
+              type: 'long',
+            },
+            domain: {
+              type: 'keyword',
+            },
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                },
+                continent_code: {
+                  type: 'keyword',
+                },
+                continent_name: {
+                  type: 'keyword',
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                },
+                country_name: {
+                  type: 'keyword',
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                postal_code: {
+                  type: 'keyword',
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                },
+                region_name: {
+                  type: 'keyword',
+                },
+                timezone: {
+                  type: 'keyword',
+                },
+              },
+            },
+            ip: {
+              type: 'ip',
+            },
+            mac: {
+              type: 'keyword',
+            },
+            nat: {
+              properties: {
+                ip: {
+                  type: 'ip',
+                },
+                port: {
+                  type: 'long',
+                },
+              },
+            },
+            packets: {
+              type: 'long',
+            },
+            port: {
+              type: 'long',
+            },
+            registered_domain: {
+              type: 'keyword',
+            },
+            subdomain: {
+              type: 'keyword',
+            },
+            top_level_domain: {
+              type: 'keyword',
+            },
+            user: {
+              properties: {
+                domain: {
+                  type: 'keyword',
+                },
+                email: {
+                  type: 'keyword',
+                },
+                full_name: {
+                  type: 'keyword',
+                },
+                group: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                hash: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                roles: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        dll: {
+          properties: {
+            code_signature: {
+              properties: {
+                digest_algorithm: {
+                  type: 'keyword',
+                },
+                exists: {
+                  type: 'boolean',
+                },
+                signing_id: {
+                  type: 'keyword',
+                },
+                status: {
+                  type: 'keyword',
+                },
+                subject_name: {
+                  type: 'keyword',
+                },
+                team_id: {
+                  type: 'keyword',
+                },
+                timestamp: {
+                  type: 'date',
+                },
+                trusted: {
+                  type: 'boolean',
+                },
+                valid: {
+                  type: 'boolean',
+                },
+              },
+            },
+            hash: {
+              properties: {
+                md5: {
+                  type: 'keyword',
+                },
+                sha1: {
+                  type: 'keyword',
+                },
+                sha256: {
+                  type: 'keyword',
+                },
+                sha512: {
+                  type: 'keyword',
+                },
+                ssdeep: {
+                  type: 'keyword',
+                },
+              },
+            },
+            name: {
+              type: 'keyword',
+            },
+            path: {
+              type: 'keyword',
+            },
+            pe: {
+              properties: {
+                architecture: {
+                  type: 'keyword',
+                },
+                company: {
+                  type: 'keyword',
+                },
+                description: {
+                  type: 'keyword',
+                },
+                file_version: {
+                  type: 'keyword',
+                },
+                imphash: {
+                  type: 'keyword',
+                },
+                original_file_name: {
+                  type: 'keyword',
+                },
+                product: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        dns: {
+          properties: {
+            answers: {
+              properties: {
+                class: {
+                  type: 'keyword',
+                },
+                data: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                ttl: {
+                  type: 'long',
+                },
+                type: {
+                  type: 'keyword',
+                },
+              },
+            },
+            header_flags: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            op_code: {
+              type: 'keyword',
+            },
+            question: {
+              properties: {
+                class: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                registered_domain: {
+                  type: 'keyword',
+                },
+                subdomain: {
+                  type: 'keyword',
+                },
+                top_level_domain: {
+                  type: 'keyword',
+                },
+                type: {
+                  type: 'keyword',
+                },
+              },
+            },
+            resolved_ip: {
+              type: 'ip',
+            },
+            response_code: {
+              type: 'keyword',
+            },
+            type: {
+              type: 'keyword',
+            },
+          },
+        },
+        ecs: {
+          properties: {
+            version: {
+              type: 'keyword',
+            },
+          },
+        },
+        error: {
+          properties: {
+            code: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            message: {
+              type: 'match_only_text',
+            },
+            stack_trace: {
+              type: 'wildcard',
+            },
+            type: {
+              type: 'keyword',
+            },
+          },
+        },
+        event: {
+          properties: {
+            action: {
+              type: 'keyword',
+            },
+            agent_id_status: {
+              type: 'keyword',
+            },
+            category: {
+              type: 'keyword',
+            },
+            code: {
+              type: 'keyword',
+            },
+            created: {
+              type: 'date',
+            },
+            dataset: {
+              type: 'keyword',
+            },
+            duration: {
+              type: 'long',
+            },
+            end: {
+              type: 'date',
+            },
+            hash: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            ingested: {
+              type: 'date',
+            },
+            kind: {
+              type: 'keyword',
+            },
+            module: {
+              type: 'keyword',
+            },
+            original: {
+              type: 'keyword',
+            },
+            outcome: {
+              type: 'keyword',
+            },
+            provider: {
+              type: 'keyword',
+            },
+            reason: {
+              type: 'keyword',
+            },
+            reference: {
+              type: 'keyword',
+            },
+            risk_score: {
+              type: 'float',
+            },
+            risk_score_norm: {
+              type: 'float',
+            },
+            sequence: {
+              type: 'long',
+            },
+            severity: {
+              type: 'long',
+            },
+            start: {
+              type: 'date',
+            },
+            timezone: {
+              type: 'keyword',
+            },
+            type: {
+              type: 'keyword',
+            },
+            url: {
+              type: 'keyword',
+            },
+          },
+        },
+        faas: {
+          properties: {
+            coldstart: {
+              type: 'boolean',
+            },
+            execution: {
+              type: 'keyword',
+            },
+            trigger: {
+              type: 'nested',
+              properties: {
+                request_id: {
+                  type: 'keyword',
+                },
+                type: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        file: {
+          properties: {
+            accessed: {
+              type: 'date',
+            },
+            attributes: {
+              type: 'keyword',
+            },
+            code_signature: {
+              properties: {
+                digest_algorithm: {
+                  type: 'keyword',
+                },
+                exists: {
+                  type: 'boolean',
+                },
+                signing_id: {
+                  type: 'keyword',
+                },
+                status: {
+                  type: 'keyword',
+                },
+                subject_name: {
+                  type: 'keyword',
+                },
+                team_id: {
+                  type: 'keyword',
+                },
+                timestamp: {
+                  type: 'date',
+                },
+                trusted: {
+                  type: 'boolean',
+                },
+                valid: {
+                  type: 'boolean',
+                },
+              },
+            },
+            created: {
+              type: 'date',
+            },
+            ctime: {
+              type: 'date',
+            },
+            device: {
+              type: 'keyword',
+            },
+            directory: {
+              type: 'keyword',
+            },
+            drive_letter: {
+              type: 'keyword',
+            },
+            elf: {
+              properties: {
+                architecture: {
+                  type: 'keyword',
+                },
+                byte_order: {
+                  type: 'keyword',
+                },
+                cpu_type: {
+                  type: 'keyword',
+                },
+                creation_date: {
+                  type: 'date',
+                },
+                exports: {
+                  type: 'flattened',
+                },
+                header: {
+                  properties: {
+                    abi_version: {
+                      type: 'keyword',
+                    },
+                    class: {
+                      type: 'keyword',
+                    },
+                    data: {
+                      type: 'keyword',
+                    },
+                    entrypoint: {
+                      type: 'long',
+                    },
+                    object_version: {
+                      type: 'keyword',
+                    },
+                    os_abi: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                    version: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                imports: {
+                  type: 'flattened',
+                },
+                sections: {
+                  type: 'nested',
+                  properties: {
+                    chi2: {
+                      type: 'long',
+                    },
+                    entropy: {
+                      type: 'long',
+                    },
+                    flags: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                    physical_offset: {
+                      type: 'keyword',
+                    },
+                    physical_size: {
+                      type: 'long',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                    virtual_address: {
+                      type: 'long',
+                    },
+                    virtual_size: {
+                      type: 'long',
+                    },
+                  },
+                },
+                segments: {
+                  type: 'nested',
+                  properties: {
+                    sections: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                shared_libraries: {
+                  type: 'keyword',
+                },
+                telfhash: {
+                  type: 'keyword',
+                },
+              },
+            },
+            extension: {
+              type: 'keyword',
+            },
+            fork_name: {
+              type: 'keyword',
+            },
+            gid: {
+              type: 'keyword',
+            },
+            group: {
+              type: 'keyword',
+            },
+            hash: {
+              properties: {
+                md5: {
+                  type: 'keyword',
+                },
+                sha1: {
+                  type: 'keyword',
+                },
+                sha256: {
+                  type: 'keyword',
+                },
+                sha512: {
+                  type: 'keyword',
+                },
+                ssdeep: {
+                  type: 'keyword',
+                },
+              },
+            },
+            inode: {
+              type: 'keyword',
+            },
+            mime_type: {
+              type: 'keyword',
+            },
+            mode: {
+              type: 'keyword',
+            },
+            mtime: {
+              type: 'date',
+            },
+            name: {
+              type: 'keyword',
+            },
+            owner: {
+              type: 'keyword',
+            },
+            path: {
+              type: 'keyword',
+            },
+            pe: {
+              properties: {
+                architecture: {
+                  type: 'keyword',
+                },
+                company: {
+                  type: 'keyword',
+                },
+                description: {
+                  type: 'keyword',
+                },
+                file_version: {
+                  type: 'keyword',
+                },
+                imphash: {
+                  type: 'keyword',
+                },
+                original_file_name: {
+                  type: 'keyword',
+                },
+                product: {
+                  type: 'keyword',
+                },
+              },
+            },
+            size: {
+              type: 'long',
+            },
+            target_path: {
+              type: 'keyword',
+            },
+            type: {
+              type: 'keyword',
+            },
+            uid: {
+              type: 'keyword',
+            },
+            x509: {
+              properties: {
+                alternative_names: {
+                  type: 'keyword',
+                },
+                issuer: {
+                  properties: {
+                    common_name: {
+                      type: 'keyword',
+                    },
+                    country: {
+                      type: 'keyword',
+                    },
+                    distinguished_name: {
+                      type: 'keyword',
+                    },
+                    locality: {
+                      type: 'keyword',
+                    },
+                    organization: {
+                      type: 'keyword',
+                    },
+                    organizational_unit: {
+                      type: 'keyword',
+                    },
+                    state_or_province: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                not_after: {
+                  type: 'date',
+                },
+                not_before: {
+                  type: 'date',
+                },
+                public_key_algorithm: {
+                  type: 'keyword',
+                },
+                public_key_curve: {
+                  type: 'keyword',
+                },
+                public_key_exponent: {
+                  type: 'long',
+                },
+                public_key_size: {
+                  type: 'long',
+                },
+                serial_number: {
+                  type: 'keyword',
+                },
+                signature_algorithm: {
+                  type: 'keyword',
+                },
+                subject: {
+                  properties: {
+                    common_name: {
+                      type: 'keyword',
+                    },
+                    country: {
+                      type: 'keyword',
+                    },
+                    distinguished_name: {
+                      type: 'keyword',
+                    },
+                    locality: {
+                      type: 'keyword',
+                    },
+                    organization: {
+                      type: 'keyword',
+                    },
+                    organizational_unit: {
+                      type: 'keyword',
+                    },
+                    state_or_province: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                version_number: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        group: {
+          properties: {
+            domain: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+          },
+        },
+        host: {
+          properties: {
+            architecture: {
+              type: 'keyword',
+            },
+            boot: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+              },
+            },
+            cpu: {
+              properties: {
+                usage: {
+                  type: 'scaled_float',
+                  scaling_factor: 1000,
+                },
+              },
+            },
+            disk: {
+              properties: {
+                read: {
+                  properties: {
+                    bytes: {
+                      type: 'long',
+                    },
+                  },
+                },
+                write: {
+                  properties: {
+                    bytes: {
+                      type: 'long',
+                    },
+                  },
+                },
+              },
+            },
+            domain: {
+              type: 'keyword',
+            },
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                },
+                continent_code: {
+                  type: 'keyword',
+                },
+                continent_name: {
+                  type: 'keyword',
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                },
+                country_name: {
+                  type: 'keyword',
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                postal_code: {
+                  type: 'keyword',
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                },
+                region_name: {
+                  type: 'keyword',
+                },
+                timezone: {
+                  type: 'keyword',
+                },
+              },
+            },
+            hostname: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            ip: {
+              type: 'ip',
+            },
+            mac: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+            network: {
+              properties: {
+                egress: {
+                  properties: {
+                    bytes: {
+                      type: 'long',
+                    },
+                    packets: {
+                      type: 'long',
+                    },
+                  },
+                },
+                ingress: {
+                  properties: {
+                    bytes: {
+                      type: 'long',
+                    },
+                    packets: {
+                      type: 'long',
+                    },
+                  },
+                },
+              },
+            },
+            os: {
+              properties: {
+                family: {
+                  type: 'keyword',
+                },
+                full: {
+                  type: 'keyword',
+                },
+                kernel: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                platform: {
+                  type: 'keyword',
+                },
+                type: {
+                  type: 'keyword',
+                },
+                version: {
+                  type: 'keyword',
+                },
+              },
+            },
+            pid_ns_ino: {
+              type: 'keyword',
+            },
+            risk: {
+              properties: {
+                calculated_level: {
+                  type: 'keyword',
+                },
+                calculated_score: {
+                  type: 'float',
+                },
+                calculated_score_norm: {
+                  type: 'float',
+                },
+                static_level: {
+                  type: 'keyword',
+                },
+                static_score: {
+                  type: 'float',
+                },
+                static_score_norm: {
+                  type: 'float',
+                },
+              },
+            },
+            type: {
+              type: 'keyword',
+            },
+            uptime: {
+              type: 'long',
+            },
+          },
+        },
+        http: {
+          properties: {
+            request: {
+              properties: {
+                body: {
+                  properties: {
+                    bytes: {
+                      type: 'long',
+                    },
+                    content: {
+                      type: 'wildcard',
+                    },
+                  },
+                },
+                bytes: {
+                  type: 'long',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                method: {
+                  type: 'keyword',
+                },
+                mime_type: {
+                  type: 'keyword',
+                },
+                referrer: {
+                  type: 'keyword',
+                },
+              },
+            },
+            response: {
+              properties: {
+                body: {
+                  properties: {
+                    bytes: {
+                      type: 'long',
+                    },
+                    content: {
+                      type: 'wildcard',
+                    },
+                  },
+                },
+                bytes: {
+                  type: 'long',
+                },
+                mime_type: {
+                  type: 'keyword',
+                },
+                status_code: {
+                  type: 'long',
+                },
+              },
+            },
+            version: {
+              type: 'keyword',
+            },
+          },
+        },
+        kibana: {
+          properties: {
+            alert: {
+              properties: {
+                action_group: {
+                  type: 'keyword',
+                },
+                ancestors: {
+                  properties: {
+                    depth: {
+                      type: 'long',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    index: {
+                      type: 'keyword',
+                    },
+                    rule: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                building_block_type: {
+                  type: 'keyword',
+                },
+                depth: {
+                  type: 'long',
+                },
+                duration: {
+                  properties: {
+                    us: {
+                      type: 'long',
+                    },
+                  },
+                },
+                end: {
+                  type: 'date',
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    index: {
+                      type: 'integer',
+                    },
+                  },
+                },
+                instance: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                new_terms: {
+                  type: 'keyword',
+                },
+                original_event: {
+                  properties: {
+                    action: {
+                      type: 'keyword',
+                    },
+                    agent_id_status: {
+                      type: 'keyword',
+                    },
+                    category: {
+                      type: 'keyword',
+                    },
+                    code: {
+                      type: 'keyword',
+                    },
+                    created: {
+                      type: 'date',
+                    },
+                    dataset: {
+                      type: 'keyword',
+                    },
+                    duration: {
+                      type: 'keyword',
+                    },
+                    end: {
+                      type: 'date',
+                    },
+                    hash: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    ingested: {
+                      type: 'date',
+                    },
+                    kind: {
+                      type: 'keyword',
+                    },
+                    module: {
+                      type: 'keyword',
+                    },
+                    original: {
+                      type: 'keyword',
+                    },
+                    outcome: {
+                      type: 'keyword',
+                    },
+                    provider: {
+                      type: 'keyword',
+                    },
+                    reason: {
+                      type: 'keyword',
+                    },
+                    reference: {
+                      type: 'keyword',
+                    },
+                    risk_score: {
+                      type: 'float',
+                    },
+                    risk_score_norm: {
+                      type: 'float',
+                    },
+                    sequence: {
+                      type: 'long',
+                    },
+                    severity: {
+                      type: 'long',
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                    timezone: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                    url: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                original_time: {
+                  type: 'date',
+                },
+                reason: {
+                  type: 'keyword',
+                },
+                risk_score: {
+                  type: 'float',
+                },
+                rule: {
+                  properties: {
+                    author: {
+                      type: 'keyword',
+                    },
+                    building_block_type: {
+                      type: 'keyword',
+                    },
+                    category: {
+                      type: 'keyword',
+                    },
+                    consumer: {
+                      type: 'keyword',
+                    },
+                    created_at: {
+                      type: 'date',
+                    },
+                    created_by: {
+                      type: 'keyword',
+                    },
+                    description: {
+                      type: 'keyword',
+                    },
+                    enabled: {
+                      type: 'keyword',
+                    },
+                    exceptions_list: {
+                      type: 'object',
+                    },
+                    execution: {
+                      properties: {
+                        uuid: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    false_positives: {
+                      type: 'keyword',
+                    },
+                    from: {
+                      type: 'keyword',
+                    },
+                    immutable: {
+                      type: 'keyword',
+                    },
+                    interval: {
+                      type: 'keyword',
+                    },
+                    license: {
+                      type: 'keyword',
+                    },
+                    max_signals: {
+                      type: 'long',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                    note: {
+                      type: 'keyword',
+                    },
+                    parameters: {
+                      type: 'flattened',
+                      ignore_above: 4096,
+                    },
+                    producer: {
+                      type: 'keyword',
+                    },
+                    references: {
+                      type: 'keyword',
+                    },
+                    rule_id: {
+                      type: 'keyword',
+                    },
+                    rule_name_override: {
+                      type: 'keyword',
+                    },
+                    rule_type_id: {
+                      type: 'keyword',
+                    },
+                    tags: {
+                      type: 'keyword',
+                    },
+                    threat: {
+                      properties: {
+                        framework: {
+                          type: 'keyword',
+                        },
+                        tactic: {
+                          properties: {
+                            id: {
+                              type: 'keyword',
+                            },
+                            name: {
+                              type: 'keyword',
+                            },
+                            reference: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        technique: {
+                          properties: {
+                            id: {
+                              type: 'keyword',
+                            },
+                            name: {
+                              type: 'keyword',
+                            },
+                            reference: {
+                              type: 'keyword',
+                            },
+                            subtechnique: {
+                              properties: {
+                                id: {
+                                  type: 'keyword',
+                                },
+                                name: {
+                                  type: 'keyword',
+                                },
+                                reference: {
+                                  type: 'keyword',
+                                },
+                              },
+                            },
+                          },
+                        },
+                      },
+                    },
+                    timeline_id: {
+                      type: 'keyword',
+                    },
+                    timeline_title: {
+                      type: 'keyword',
+                    },
+                    timestamp_override: {
+                      type: 'keyword',
+                    },
+                    to: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                    updated_at: {
+                      type: 'date',
+                    },
+                    updated_by: {
+                      type: 'keyword',
+                    },
+                    uuid: {
+                      type: 'keyword',
+                    },
+                    version: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                severity: {
+                  type: 'keyword',
+                },
+                start: {
+                  type: 'date',
+                },
+                status: {
+                  type: 'keyword',
+                },
+                system_status: {
+                  type: 'keyword',
+                },
+                threshold_result: {
+                  properties: {
+                    cardinality: {
+                      properties: {
+                        field: {
+                          type: 'keyword',
+                        },
+                        value: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                    count: {
+                      type: 'long',
+                    },
+                    from: {
+                      type: 'date',
+                    },
+                    terms: {
+                      properties: {
+                        field: {
+                          type: 'keyword',
+                        },
+                        value: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                  },
+                },
+                time_range: {
+                  type: 'date_range',
+                  format: 'epoch_millis||strict_date_optional_time',
+                },
+                uuid: {
+                  type: 'keyword',
+                },
+                workflow_reason: {
+                  type: 'keyword',
+                },
+                workflow_status: {
+                  type: 'keyword',
+                },
+                workflow_user: {
+                  type: 'keyword',
+                },
+              },
+            },
+            space_ids: {
+              type: 'keyword',
+            },
+            version: {
+              type: 'version',
+            },
+          },
+        },
+        labels: {
+          type: 'object',
+        },
+        log: {
+          properties: {
+            file: {
+              properties: {
+                path: {
+                  type: 'keyword',
+                },
+              },
+            },
+            level: {
+              type: 'keyword',
+            },
+            logger: {
+              type: 'keyword',
+            },
+            origin: {
+              properties: {
+                file: {
+                  properties: {
+                    line: {
+                      type: 'long',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                function: {
+                  type: 'keyword',
+                },
+              },
+            },
+            syslog: {
+              properties: {
+                facility: {
+                  properties: {
+                    code: {
+                      type: 'long',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                priority: {
+                  type: 'long',
+                },
+                severity: {
+                  properties: {
+                    code: {
+                      type: 'long',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+        message: {
+          type: 'match_only_text',
+        },
+        network: {
+          properties: {
+            application: {
+              type: 'keyword',
+            },
+            bytes: {
+              type: 'long',
+            },
+            community_id: {
+              type: 'keyword',
+            },
+            direction: {
+              type: 'keyword',
+            },
+            forwarded_ip: {
+              type: 'ip',
+            },
+            iana_number: {
+              type: 'keyword',
+            },
+            inner: {
+              properties: {
+                vlan: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            name: {
+              type: 'keyword',
+            },
+            packets: {
+              type: 'long',
+            },
+            protocol: {
+              type: 'keyword',
+            },
+            transport: {
+              type: 'keyword',
+            },
+            type: {
+              type: 'keyword',
+            },
+            vlan: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        observer: {
+          properties: {
+            egress: {
+              properties: {
+                interface: {
+                  properties: {
+                    alias: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                vlan: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                zone: {
+                  type: 'keyword',
+                },
+              },
+            },
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                },
+                continent_code: {
+                  type: 'keyword',
+                },
+                continent_name: {
+                  type: 'keyword',
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                },
+                country_name: {
+                  type: 'keyword',
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                postal_code: {
+                  type: 'keyword',
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                },
+                region_name: {
+                  type: 'keyword',
+                },
+                timezone: {
+                  type: 'keyword',
+                },
+              },
+            },
+            hostname: {
+              type: 'keyword',
+            },
+            ingress: {
+              properties: {
+                interface: {
+                  properties: {
+                    alias: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                vlan: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                zone: {
+                  type: 'keyword',
+                },
+              },
+            },
+            ip: {
+              type: 'ip',
+            },
+            mac: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+            os: {
+              properties: {
+                family: {
+                  type: 'keyword',
+                },
+                full: {
+                  type: 'keyword',
+                },
+                kernel: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                platform: {
+                  type: 'keyword',
+                },
+                type: {
+                  type: 'keyword',
+                },
+                version: {
+                  type: 'keyword',
+                },
+              },
+            },
+            product: {
+              type: 'keyword',
+            },
+            serial_number: {
+              type: 'keyword',
+            },
+            type: {
+              type: 'keyword',
+            },
+            vendor: {
+              type: 'keyword',
+            },
+            version: {
+              type: 'keyword',
+            },
+          },
+        },
+        orchestrator: {
+          properties: {
+            api_version: {
+              type: 'keyword',
+            },
+            cluster: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                url: {
+                  type: 'keyword',
+                },
+                version: {
+                  type: 'keyword',
+                },
+              },
+            },
+            namespace: {
+              type: 'keyword',
+            },
+            organization: {
+              type: 'keyword',
+            },
+            resource: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+                ip: {
+                  type: 'ip',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                parent: {
+                  properties: {
+                    type: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                type: {
+                  type: 'keyword',
+                },
+              },
+            },
+            type: {
+              type: 'keyword',
+            },
+          },
+        },
+        organization: {
+          properties: {
+            id: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+          },
+        },
+        package: {
+          properties: {
+            architecture: {
+              type: 'keyword',
+            },
+            build_version: {
+              type: 'keyword',
+            },
+            checksum: {
+              type: 'keyword',
+            },
+            description: {
+              type: 'keyword',
+            },
+            install_scope: {
+              type: 'keyword',
+            },
+            installed: {
+              type: 'date',
+            },
+            license: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+            path: {
+              type: 'keyword',
+            },
+            reference: {
+              type: 'keyword',
+            },
+            size: {
+              type: 'long',
+            },
+            type: {
+              type: 'keyword',
+            },
+            version: {
+              type: 'keyword',
+            },
+          },
+        },
+        process: {
+          properties: {
+            args: {
+              type: 'keyword',
+            },
+            args_count: {
+              type: 'long',
+            },
+            code_signature: {
+              properties: {
+                digest_algorithm: {
+                  type: 'keyword',
+                },
+                exists: {
+                  type: 'boolean',
+                },
+                signing_id: {
+                  type: 'keyword',
+                },
+                status: {
+                  type: 'keyword',
+                },
+                subject_name: {
+                  type: 'keyword',
+                },
+                team_id: {
+                  type: 'keyword',
+                },
+                timestamp: {
+                  type: 'date',
+                },
+                trusted: {
+                  type: 'boolean',
+                },
+                valid: {
+                  type: 'boolean',
+                },
+              },
+            },
+            command_line: {
+              type: 'wildcard',
+            },
+            elf: {
+              properties: {
+                architecture: {
+                  type: 'keyword',
+                },
+                byte_order: {
+                  type: 'keyword',
+                },
+                cpu_type: {
+                  type: 'keyword',
+                },
+                creation_date: {
+                  type: 'date',
+                },
+                exports: {
+                  type: 'flattened',
+                },
+                header: {
+                  properties: {
+                    abi_version: {
+                      type: 'keyword',
+                    },
+                    class: {
+                      type: 'keyword',
+                    },
+                    data: {
+                      type: 'keyword',
+                    },
+                    entrypoint: {
+                      type: 'long',
+                    },
+                    object_version: {
+                      type: 'keyword',
+                    },
+                    os_abi: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                    version: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                imports: {
+                  type: 'flattened',
+                },
+                sections: {
+                  type: 'nested',
+                  properties: {
+                    chi2: {
+                      type: 'long',
+                    },
+                    entropy: {
+                      type: 'long',
+                    },
+                    flags: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                    physical_offset: {
+                      type: 'keyword',
+                    },
+                    physical_size: {
+                      type: 'long',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                    virtual_address: {
+                      type: 'long',
+                    },
+                    virtual_size: {
+                      type: 'long',
+                    },
+                  },
+                },
+                segments: {
+                  type: 'nested',
+                  properties: {
+                    sections: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                shared_libraries: {
+                  type: 'keyword',
+                },
+                telfhash: {
+                  type: 'keyword',
+                },
+              },
+            },
+            end: {
+              type: 'date',
+            },
+            entity_id: {
+              type: 'keyword',
+            },
+            entry_leader: {
+              properties: {
+                entity_id: {
+                  type: 'keyword',
+                },
+              },
+            },
+            executable: {
+              type: 'keyword',
+            },
+            exit_code: {
+              type: 'long',
+            },
+            hash: {
+              properties: {
+                md5: {
+                  type: 'keyword',
+                },
+                sha1: {
+                  type: 'keyword',
+                },
+                sha256: {
+                  type: 'keyword',
+                },
+                sha512: {
+                  type: 'keyword',
+                },
+                ssdeep: {
+                  type: 'keyword',
+                },
+              },
+            },
+            name: {
+              type: 'keyword',
+            },
+            parent: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                },
+                args_count: {
+                  type: 'long',
+                },
+                code_signature: {
+                  properties: {
+                    digest_algorithm: {
+                      type: 'keyword',
+                    },
+                    exists: {
+                      type: 'boolean',
+                    },
+                    signing_id: {
+                      type: 'keyword',
+                    },
+                    status: {
+                      type: 'keyword',
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                    },
+                    team_id: {
+                      type: 'keyword',
+                    },
+                    timestamp: {
+                      type: 'date',
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                command_line: {
+                  type: 'wildcard',
+                },
+                elf: {
+                  properties: {
+                    architecture: {
+                      type: 'keyword',
+                    },
+                    byte_order: {
+                      type: 'keyword',
+                    },
+                    cpu_type: {
+                      type: 'keyword',
+                    },
+                    creation_date: {
+                      type: 'date',
+                    },
+                    exports: {
+                      type: 'flattened',
+                    },
+                    header: {
+                      properties: {
+                        abi_version: {
+                          type: 'keyword',
+                        },
+                        class: {
+                          type: 'keyword',
+                        },
+                        data: {
+                          type: 'keyword',
+                        },
+                        entrypoint: {
+                          type: 'long',
+                        },
+                        object_version: {
+                          type: 'keyword',
+                        },
+                        os_abi: {
+                          type: 'keyword',
+                        },
+                        type: {
+                          type: 'keyword',
+                        },
+                        version: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    imports: {
+                      type: 'flattened',
+                    },
+                    sections: {
+                      type: 'nested',
+                      properties: {
+                        chi2: {
+                          type: 'long',
+                        },
+                        entropy: {
+                          type: 'long',
+                        },
+                        flags: {
+                          type: 'keyword',
+                        },
+                        name: {
+                          type: 'keyword',
+                        },
+                        physical_offset: {
+                          type: 'keyword',
+                        },
+                        physical_size: {
+                          type: 'long',
+                        },
+                        type: {
+                          type: 'keyword',
+                        },
+                        virtual_address: {
+                          type: 'long',
+                        },
+                        virtual_size: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                    segments: {
+                      type: 'nested',
+                      properties: {
+                        sections: {
+                          type: 'keyword',
+                        },
+                        type: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    shared_libraries: {
+                      type: 'keyword',
+                    },
+                    telfhash: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                end: {
+                  type: 'date',
+                },
+                entity_id: {
+                  type: 'keyword',
+                },
+                executable: {
+                  type: 'keyword',
+                },
+                exit_code: {
+                  type: 'long',
+                },
+                hash: {
+                  properties: {
+                    md5: {
+                      type: 'keyword',
+                    },
+                    sha1: {
+                      type: 'keyword',
+                    },
+                    sha256: {
+                      type: 'keyword',
+                    },
+                    sha512: {
+                      type: 'keyword',
+                    },
+                    ssdeep: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                name: {
+                  type: 'keyword',
+                },
+                pe: {
+                  properties: {
+                    architecture: {
+                      type: 'keyword',
+                    },
+                    company: {
+                      type: 'keyword',
+                    },
+                    description: {
+                      type: 'keyword',
+                    },
+                    file_version: {
+                      type: 'keyword',
+                    },
+                    imphash: {
+                      type: 'keyword',
+                    },
+                    original_file_name: {
+                      type: 'keyword',
+                    },
+                    product: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                pgid: {
+                  type: 'long',
+                },
+                pid: {
+                  type: 'long',
+                },
+                start: {
+                  type: 'date',
+                },
+                thread: {
+                  properties: {
+                    id: {
+                      type: 'long',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                title: {
+                  type: 'keyword',
+                },
+                uptime: {
+                  type: 'long',
+                },
+                working_directory: {
+                  type: 'keyword',
+                },
+              },
+            },
+            pe: {
+              properties: {
+                architecture: {
+                  type: 'keyword',
+                },
+                company: {
+                  type: 'keyword',
+                },
+                description: {
+                  type: 'keyword',
+                },
+                file_version: {
+                  type: 'keyword',
+                },
+                imphash: {
+                  type: 'keyword',
+                },
+                original_file_name: {
+                  type: 'keyword',
+                },
+                product: {
+                  type: 'keyword',
+                },
+              },
+            },
+            pgid: {
+              type: 'long',
+            },
+            pid: {
+              type: 'long',
+            },
+            session_leader: {
+              properties: {
+                entity_id: {
+                  type: 'keyword',
+                },
+              },
+            },
+            start: {
+              type: 'date',
+            },
+            thread: {
+              properties: {
+                id: {
+                  type: 'long',
+                },
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+            title: {
+              type: 'keyword',
+            },
+            uptime: {
+              type: 'long',
+            },
+            working_directory: {
+              type: 'keyword',
+            },
+          },
+        },
+        registry: {
+          properties: {
+            data: {
+              properties: {
+                bytes: {
+                  type: 'keyword',
+                },
+                strings: {
+                  type: 'wildcard',
+                },
+                type: {
+                  type: 'keyword',
+                },
+              },
+            },
+            hive: {
+              type: 'keyword',
+            },
+            key: {
+              type: 'keyword',
+            },
+            path: {
+              type: 'keyword',
+            },
+            value: {
+              type: 'keyword',
+            },
+          },
+        },
+        related: {
+          properties: {
+            hash: {
+              type: 'keyword',
+            },
+            hosts: {
+              type: 'keyword',
+            },
+            ip: {
+              type: 'ip',
+            },
+            user: {
+              type: 'keyword',
+            },
+          },
+        },
+        rule: {
+          properties: {
+            author: {
+              type: 'keyword',
+            },
+            category: {
+              type: 'keyword',
+            },
+            description: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            license: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+            reference: {
+              type: 'keyword',
+            },
+            ruleset: {
+              type: 'keyword',
+            },
+            uuid: {
+              type: 'keyword',
+            },
+            version: {
+              type: 'keyword',
+            },
+          },
+        },
+        server: {
+          properties: {
+            address: {
+              type: 'keyword',
+            },
+            as: {
+              properties: {
+                number: {
+                  type: 'long',
+                },
+                organization: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            bytes: {
+              type: 'long',
+            },
+            domain: {
+              type: 'keyword',
+            },
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                },
+                continent_code: {
+                  type: 'keyword',
+                },
+                continent_name: {
+                  type: 'keyword',
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                },
+                country_name: {
+                  type: 'keyword',
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                postal_code: {
+                  type: 'keyword',
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                },
+                region_name: {
+                  type: 'keyword',
+                },
+                timezone: {
+                  type: 'keyword',
+                },
+              },
+            },
+            ip: {
+              type: 'ip',
+            },
+            mac: {
+              type: 'keyword',
+            },
+            nat: {
+              properties: {
+                ip: {
+                  type: 'ip',
+                },
+                port: {
+                  type: 'long',
+                },
+              },
+            },
+            packets: {
+              type: 'long',
+            },
+            port: {
+              type: 'long',
+            },
+            registered_domain: {
+              type: 'keyword',
+            },
+            subdomain: {
+              type: 'keyword',
+            },
+            top_level_domain: {
+              type: 'keyword',
+            },
+            user: {
+              properties: {
+                domain: {
+                  type: 'keyword',
+                },
+                email: {
+                  type: 'keyword',
+                },
+                full_name: {
+                  type: 'keyword',
+                },
+                group: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                hash: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                roles: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        service: {
+          properties: {
+            address: {
+              type: 'keyword',
+            },
+            environment: {
+              type: 'keyword',
+            },
+            ephemeral_id: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+            node: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+            origin: {
+              properties: {
+                address: {
+                  type: 'keyword',
+                },
+                environment: {
+                  type: 'keyword',
+                },
+                ephemeral_id: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                node: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                state: {
+                  type: 'keyword',
+                },
+                type: {
+                  type: 'keyword',
+                },
+                version: {
+                  type: 'keyword',
+                },
+              },
+            },
+            state: {
+              type: 'keyword',
+            },
+            target: {
+              properties: {
+                address: {
+                  type: 'keyword',
+                },
+                environment: {
+                  type: 'keyword',
+                },
+                ephemeral_id: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                node: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                state: {
+                  type: 'keyword',
+                },
+                type: {
+                  type: 'keyword',
+                },
+                version: {
+                  type: 'keyword',
+                },
+              },
+            },
+            type: {
+              type: 'keyword',
+            },
+            version: {
+              type: 'keyword',
+            },
+          },
+        },
+        signal: {
+          properties: {
+            ancestors: {
+              properties: {
+                depth: {
+                  type: 'alias',
+                  path: 'kibana.alert.ancestors.depth',
+                },
+                id: {
+                  type: 'alias',
+                  path: 'kibana.alert.ancestors.id',
+                },
+                index: {
+                  type: 'alias',
+                  path: 'kibana.alert.ancestors.index',
+                },
+                type: {
+                  type: 'alias',
+                  path: 'kibana.alert.ancestors.type',
+                },
+              },
+            },
+            depth: {
+              type: 'alias',
+              path: 'kibana.alert.depth',
+            },
+            group: {
+              properties: {
+                id: {
+                  type: 'alias',
+                  path: 'kibana.alert.group.id',
+                },
+                index: {
+                  type: 'alias',
+                  path: 'kibana.alert.group.index',
+                },
+              },
+            },
+            original_event: {
+              properties: {
+                action: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.action',
+                },
+                category: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.category',
+                },
+                code: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.code',
+                },
+                created: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.created',
+                },
+                dataset: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.dataset',
+                },
+                duration: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.duration',
+                },
+                end: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.end',
+                },
+                hash: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.hash',
+                },
+                id: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.id',
+                },
+                kind: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.kind',
+                },
+                module: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.module',
+                },
+                outcome: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.outcome',
+                },
+                provider: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.provider',
+                },
+                reason: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.reason',
+                },
+                risk_score: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.risk_score',
+                },
+                risk_score_norm: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.risk_score_norm',
+                },
+                sequence: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.sequence',
+                },
+                severity: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.severity',
+                },
+                start: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.start',
+                },
+                timezone: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.timezone',
+                },
+                type: {
+                  type: 'alias',
+                  path: 'kibana.alert.original_event.type',
+                },
+              },
+            },
+            original_time: {
+              type: 'alias',
+              path: 'kibana.alert.original_time',
+            },
+            reason: {
+              type: 'alias',
+              path: 'kibana.alert.reason',
+            },
+            rule: {
+              properties: {
+                author: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.author',
+                },
+                building_block_type: {
+                  type: 'alias',
+                  path: 'kibana.alert.building_block_type',
+                },
+                created_at: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.created_at',
+                },
+                created_by: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.created_by',
+                },
+                description: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.description',
+                },
+                enabled: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.enabled',
+                },
+                false_positives: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.false_positives',
+                },
+                from: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.from',
+                },
+                id: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.uuid',
+                },
+                immutable: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.immutable',
+                },
+                interval: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.interval',
+                },
+                license: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.license',
+                },
+                max_signals: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.max_signals',
+                },
+                name: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.name',
+                },
+                note: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.note',
+                },
+                references: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.references',
+                },
+                risk_score: {
+                  type: 'alias',
+                  path: 'kibana.alert.risk_score',
+                },
+                rule_id: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.rule_id',
+                },
+                rule_name_override: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.rule_name_override',
+                },
+                severity: {
+                  type: 'alias',
+                  path: 'kibana.alert.severity',
+                },
+                tags: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.tags',
+                },
+                threat: {
+                  properties: {
+                    framework: {
+                      type: 'alias',
+                      path: 'kibana.alert.rule.threat.framework',
+                    },
+                    tactic: {
+                      properties: {
+                        id: {
+                          type: 'alias',
+                          path: 'kibana.alert.rule.threat.tactic.id',
+                        },
+                        name: {
+                          type: 'alias',
+                          path: 'kibana.alert.rule.threat.tactic.name',
+                        },
+                        reference: {
+                          type: 'alias',
+                          path: 'kibana.alert.rule.threat.tactic.reference',
+                        },
+                      },
+                    },
+                    technique: {
+                      properties: {
+                        id: {
+                          type: 'alias',
+                          path: 'kibana.alert.rule.threat.technique.id',
+                        },
+                        name: {
+                          type: 'alias',
+                          path: 'kibana.alert.rule.threat.technique.name',
+                        },
+                        reference: {
+                          type: 'alias',
+                          path: 'kibana.alert.rule.threat.technique.reference',
+                        },
+                        subtechnique: {
+                          properties: {
+                            id: {
+                              type: 'alias',
+                              path: 'kibana.alert.rule.threat.technique.subtechnique.id',
+                            },
+                            name: {
+                              type: 'alias',
+                              path: 'kibana.alert.rule.threat.technique.subtechnique.name',
+                            },
+                            reference: {
+                              type: 'alias',
+                              path: 'kibana.alert.rule.threat.technique.subtechnique.reference',
+                            },
+                          },
+                        },
+                      },
+                    },
+                  },
+                },
+                timeline_id: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.timeline_id',
+                },
+                timeline_title: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.timeline_title',
+                },
+                timestamp_override: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.timestamp_override',
+                },
+                to: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.to',
+                },
+                type: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.type',
+                },
+                updated_at: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.updated_at',
+                },
+                updated_by: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.updated_by',
+                },
+                version: {
+                  type: 'alias',
+                  path: 'kibana.alert.rule.version',
+                },
+              },
+            },
+            status: {
+              type: 'alias',
+              path: 'kibana.alert.workflow_status',
+            },
+            threshold_result: {
+              properties: {
+                cardinality: {
+                  properties: {
+                    field: {
+                      type: 'alias',
+                      path: 'kibana.alert.threshold_result.cardinality.field',
+                    },
+                    value: {
+                      type: 'alias',
+                      path: 'kibana.alert.threshold_result.cardinality.value',
+                    },
+                  },
+                },
+                count: {
+                  type: 'alias',
+                  path: 'kibana.alert.threshold_result.count',
+                },
+                from: {
+                  type: 'alias',
+                  path: 'kibana.alert.threshold_result.from',
+                },
+                terms: {
+                  properties: {
+                    field: {
+                      type: 'alias',
+                      path: 'kibana.alert.threshold_result.terms.field',
+                    },
+                    value: {
+                      type: 'alias',
+                      path: 'kibana.alert.threshold_result.terms.value',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+        source: {
+          properties: {
+            address: {
+              type: 'keyword',
+            },
+            as: {
+              properties: {
+                number: {
+                  type: 'long',
+                },
+                organization: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            bytes: {
+              type: 'long',
+            },
+            domain: {
+              type: 'keyword',
+            },
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                },
+                continent_code: {
+                  type: 'keyword',
+                },
+                continent_name: {
+                  type: 'keyword',
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                },
+                country_name: {
+                  type: 'keyword',
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                postal_code: {
+                  type: 'keyword',
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                },
+                region_name: {
+                  type: 'keyword',
+                },
+                timezone: {
+                  type: 'keyword',
+                },
+              },
+            },
+            ip: {
+              type: 'ip',
+            },
+            mac: {
+              type: 'keyword',
+            },
+            nat: {
+              properties: {
+                ip: {
+                  type: 'ip',
+                },
+                port: {
+                  type: 'long',
+                },
+              },
+            },
+            packets: {
+              type: 'long',
+            },
+            port: {
+              type: 'long',
+            },
+            registered_domain: {
+              type: 'keyword',
+            },
+            subdomain: {
+              type: 'keyword',
+            },
+            top_level_domain: {
+              type: 'keyword',
+            },
+            user: {
+              properties: {
+                domain: {
+                  type: 'keyword',
+                },
+                email: {
+                  type: 'keyword',
+                },
+                full_name: {
+                  type: 'keyword',
+                },
+                group: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                hash: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                roles: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        span: {
+          properties: {
+            id: {
+              type: 'keyword',
+            },
+          },
+        },
+        tags: {
+          type: 'keyword',
+        },
+        threat: {
+          properties: {
+            enrichments: {
+              type: 'nested',
+              properties: {
+                indicator: {
+                  properties: {
+                    as: {
+                      properties: {
+                        number: {
+                          type: 'long',
+                        },
+                        organization: {
+                          properties: {
+                            name: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                      },
+                    },
+                    confidence: {
+                      type: 'keyword',
+                    },
+                    description: {
+                      type: 'keyword',
+                    },
+                    email: {
+                      properties: {
+                        address: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    file: {
+                      properties: {
+                        accessed: {
+                          type: 'date',
+                        },
+                        attributes: {
+                          type: 'keyword',
+                        },
+                        code_signature: {
+                          properties: {
+                            digest_algorithm: {
+                              type: 'keyword',
+                            },
+                            exists: {
+                              type: 'boolean',
+                            },
+                            signing_id: {
+                              type: 'keyword',
+                            },
+                            status: {
+                              type: 'keyword',
+                            },
+                            subject_name: {
+                              type: 'keyword',
+                            },
+                            team_id: {
+                              type: 'keyword',
+                            },
+                            timestamp: {
+                              type: 'date',
+                            },
+                            trusted: {
+                              type: 'boolean',
+                            },
+                            valid: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                        created: {
+                          type: 'date',
+                        },
+                        ctime: {
+                          type: 'date',
+                        },
+                        device: {
+                          type: 'keyword',
+                        },
+                        directory: {
+                          type: 'keyword',
+                        },
+                        drive_letter: {
+                          type: 'keyword',
+                        },
+                        elf: {
+                          properties: {
+                            architecture: {
+                              type: 'keyword',
+                            },
+                            byte_order: {
+                              type: 'keyword',
+                            },
+                            cpu_type: {
+                              type: 'keyword',
+                            },
+                            creation_date: {
+                              type: 'date',
+                            },
+                            exports: {
+                              type: 'flattened',
+                            },
+                            header: {
+                              properties: {
+                                abi_version: {
+                                  type: 'keyword',
+                                },
+                                class: {
+                                  type: 'keyword',
+                                },
+                                data: {
+                                  type: 'keyword',
+                                },
+                                entrypoint: {
+                                  type: 'long',
+                                },
+                                object_version: {
+                                  type: 'keyword',
+                                },
+                                os_abi: {
+                                  type: 'keyword',
+                                },
+                                type: {
+                                  type: 'keyword',
+                                },
+                                version: {
+                                  type: 'keyword',
+                                },
+                              },
+                            },
+                            imports: {
+                              type: 'flattened',
+                            },
+                            sections: {
+                              type: 'nested',
+                              properties: {
+                                chi2: {
+                                  type: 'long',
+                                },
+                                entropy: {
+                                  type: 'long',
+                                },
+                                flags: {
+                                  type: 'keyword',
+                                },
+                                name: {
+                                  type: 'keyword',
+                                },
+                                physical_offset: {
+                                  type: 'keyword',
+                                },
+                                physical_size: {
+                                  type: 'long',
+                                },
+                                type: {
+                                  type: 'keyword',
+                                },
+                                virtual_address: {
+                                  type: 'long',
+                                },
+                                virtual_size: {
+                                  type: 'long',
+                                },
+                              },
+                            },
+                            segments: {
+                              type: 'nested',
+                              properties: {
+                                sections: {
+                                  type: 'keyword',
+                                },
+                                type: {
+                                  type: 'keyword',
+                                },
+                              },
+                            },
+                            shared_libraries: {
+                              type: 'keyword',
+                            },
+                            telfhash: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        extension: {
+                          type: 'keyword',
+                        },
+                        fork_name: {
+                          type: 'keyword',
+                        },
+                        gid: {
+                          type: 'keyword',
+                        },
+                        group: {
+                          type: 'keyword',
+                        },
+                        hash: {
+                          properties: {
+                            md5: {
+                              type: 'keyword',
+                            },
+                            sha1: {
+                              type: 'keyword',
+                            },
+                            sha256: {
+                              type: 'keyword',
+                            },
+                            sha512: {
+                              type: 'keyword',
+                            },
+                            ssdeep: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        inode: {
+                          type: 'keyword',
+                        },
+                        mime_type: {
+                          type: 'keyword',
+                        },
+                        mode: {
+                          type: 'keyword',
+                        },
+                        mtime: {
+                          type: 'date',
+                        },
+                        name: {
+                          type: 'keyword',
+                        },
+                        owner: {
+                          type: 'keyword',
+                        },
+                        path: {
+                          type: 'keyword',
+                        },
+                        pe: {
+                          properties: {
+                            architecture: {
+                              type: 'keyword',
+                            },
+                            company: {
+                              type: 'keyword',
+                            },
+                            description: {
+                              type: 'keyword',
+                            },
+                            file_version: {
+                              type: 'keyword',
+                            },
+                            imphash: {
+                              type: 'keyword',
+                            },
+                            original_file_name: {
+                              type: 'keyword',
+                            },
+                            product: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        size: {
+                          type: 'long',
+                        },
+                        target_path: {
+                          type: 'keyword',
+                        },
+                        type: {
+                          type: 'keyword',
+                        },
+                        uid: {
+                          type: 'keyword',
+                        },
+                        x509: {
+                          properties: {
+                            alternative_names: {
+                              type: 'keyword',
+                            },
+                            issuer: {
+                              properties: {
+                                common_name: {
+                                  type: 'keyword',
+                                },
+                                country: {
+                                  type: 'keyword',
+                                },
+                                distinguished_name: {
+                                  type: 'keyword',
+                                },
+                                locality: {
+                                  type: 'keyword',
+                                },
+                                organization: {
+                                  type: 'keyword',
+                                },
+                                organizational_unit: {
+                                  type: 'keyword',
+                                },
+                                state_or_province: {
+                                  type: 'keyword',
+                                },
+                              },
+                            },
+                            not_after: {
+                              type: 'date',
+                            },
+                            not_before: {
+                              type: 'date',
+                            },
+                            public_key_algorithm: {
+                              type: 'keyword',
+                            },
+                            public_key_curve: {
+                              type: 'keyword',
+                            },
+                            public_key_exponent: {
+                              type: 'long',
+                            },
+                            public_key_size: {
+                              type: 'long',
+                            },
+                            serial_number: {
+                              type: 'keyword',
+                            },
+                            signature_algorithm: {
+                              type: 'keyword',
+                            },
+                            subject: {
+                              properties: {
+                                common_name: {
+                                  type: 'keyword',
+                                },
+                                country: {
+                                  type: 'keyword',
+                                },
+                                distinguished_name: {
+                                  type: 'keyword',
+                                },
+                                locality: {
+                                  type: 'keyword',
+                                },
+                                organization: {
+                                  type: 'keyword',
+                                },
+                                organizational_unit: {
+                                  type: 'keyword',
+                                },
+                                state_or_province: {
+                                  type: 'keyword',
+                                },
+                              },
+                            },
+                            version_number: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                      },
+                    },
+                    first_seen: {
+                      type: 'date',
+                    },
+                    geo: {
+                      properties: {
+                        city_name: {
+                          type: 'keyword',
+                        },
+                        continent_code: {
+                          type: 'keyword',
+                        },
+                        continent_name: {
+                          type: 'keyword',
+                        },
+                        country_iso_code: {
+                          type: 'keyword',
+                        },
+                        country_name: {
+                          type: 'keyword',
+                        },
+                        location: {
+                          type: 'geo_point',
+                        },
+                        name: {
+                          type: 'keyword',
+                        },
+                        postal_code: {
+                          type: 'keyword',
+                        },
+                        region_iso_code: {
+                          type: 'keyword',
+                        },
+                        region_name: {
+                          type: 'keyword',
+                        },
+                        timezone: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    ip: {
+                      type: 'ip',
+                    },
+                    last_seen: {
+                      type: 'date',
+                    },
+                    marking: {
+                      properties: {
+                        tlp: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    modified_at: {
+                      type: 'date',
+                    },
+                    port: {
+                      type: 'long',
+                    },
+                    provider: {
+                      type: 'keyword',
+                    },
+                    reference: {
+                      type: 'keyword',
+                    },
+                    registry: {
+                      properties: {
+                        data: {
+                          properties: {
+                            bytes: {
+                              type: 'keyword',
+                            },
+                            strings: {
+                              type: 'wildcard',
+                            },
+                            type: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        hive: {
+                          type: 'keyword',
+                        },
+                        key: {
+                          type: 'keyword',
+                        },
+                        path: {
+                          type: 'keyword',
+                        },
+                        value: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    scanner_stats: {
+                      type: 'long',
+                    },
+                    sightings: {
+                      type: 'long',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                    url: {
+                      properties: {
+                        domain: {
+                          type: 'keyword',
+                        },
+                        extension: {
+                          type: 'keyword',
+                        },
+                        fragment: {
+                          type: 'keyword',
+                        },
+                        full: {
+                          type: 'wildcard',
+                        },
+                        original: {
+                          type: 'wildcard',
+                        },
+                        password: {
+                          type: 'keyword',
+                        },
+                        path: {
+                          type: 'wildcard',
+                        },
+                        port: {
+                          type: 'long',
+                        },
+                        query: {
+                          type: 'keyword',
+                        },
+                        registered_domain: {
+                          type: 'keyword',
+                        },
+                        scheme: {
+                          type: 'keyword',
+                        },
+                        subdomain: {
+                          type: 'keyword',
+                        },
+                        top_level_domain: {
+                          type: 'keyword',
+                        },
+                        username: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    x509: {
+                      properties: {
+                        alternative_names: {
+                          type: 'keyword',
+                        },
+                        issuer: {
+                          properties: {
+                            common_name: {
+                              type: 'keyword',
+                            },
+                            country: {
+                              type: 'keyword',
+                            },
+                            distinguished_name: {
+                              type: 'keyword',
+                            },
+                            locality: {
+                              type: 'keyword',
+                            },
+                            organization: {
+                              type: 'keyword',
+                            },
+                            organizational_unit: {
+                              type: 'keyword',
+                            },
+                            state_or_province: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        not_after: {
+                          type: 'date',
+                        },
+                        not_before: {
+                          type: 'date',
+                        },
+                        public_key_algorithm: {
+                          type: 'keyword',
+                        },
+                        public_key_curve: {
+                          type: 'keyword',
+                        },
+                        public_key_exponent: {
+                          type: 'long',
+                        },
+                        public_key_size: {
+                          type: 'long',
+                        },
+                        serial_number: {
+                          type: 'keyword',
+                        },
+                        signature_algorithm: {
+                          type: 'keyword',
+                        },
+                        subject: {
+                          properties: {
+                            common_name: {
+                              type: 'keyword',
+                            },
+                            country: {
+                              type: 'keyword',
+                            },
+                            distinguished_name: {
+                              type: 'keyword',
+                            },
+                            locality: {
+                              type: 'keyword',
+                            },
+                            organization: {
+                              type: 'keyword',
+                            },
+                            organizational_unit: {
+                              type: 'keyword',
+                            },
+                            state_or_province: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        version_number: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                  },
+                },
+                matched: {
+                  properties: {
+                    atomic: {
+                      type: 'keyword',
+                    },
+                    field: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    index: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            framework: {
+              type: 'keyword',
+            },
+            group: {
+              properties: {
+                alias: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                reference: {
+                  type: 'keyword',
+                },
+              },
+            },
+            indicator: {
+              properties: {
+                as: {
+                  properties: {
+                    number: {
+                      type: 'long',
+                    },
+                    organization: {
+                      properties: {
+                        name: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                  },
+                },
+                confidence: {
+                  type: 'keyword',
+                },
+                description: {
+                  type: 'keyword',
+                },
+                email: {
+                  properties: {
+                    address: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                file: {
+                  properties: {
+                    accessed: {
+                      type: 'date',
+                    },
+                    attributes: {
+                      type: 'keyword',
+                    },
+                    code_signature: {
+                      properties: {
+                        digest_algorithm: {
+                          type: 'keyword',
+                        },
+                        exists: {
+                          type: 'boolean',
+                        },
+                        signing_id: {
+                          type: 'keyword',
+                        },
+                        status: {
+                          type: 'keyword',
+                        },
+                        subject_name: {
+                          type: 'keyword',
+                        },
+                        team_id: {
+                          type: 'keyword',
+                        },
+                        timestamp: {
+                          type: 'date',
+                        },
+                        trusted: {
+                          type: 'boolean',
+                        },
+                        valid: {
+                          type: 'boolean',
+                        },
+                      },
+                    },
+                    created: {
+                      type: 'date',
+                    },
+                    ctime: {
+                      type: 'date',
+                    },
+                    device: {
+                      type: 'keyword',
+                    },
+                    directory: {
+                      type: 'keyword',
+                    },
+                    drive_letter: {
+                      type: 'keyword',
+                    },
+                    elf: {
+                      properties: {
+                        architecture: {
+                          type: 'keyword',
+                        },
+                        byte_order: {
+                          type: 'keyword',
+                        },
+                        cpu_type: {
+                          type: 'keyword',
+                        },
+                        creation_date: {
+                          type: 'date',
+                        },
+                        exports: {
+                          type: 'flattened',
+                        },
+                        header: {
+                          properties: {
+                            abi_version: {
+                              type: 'keyword',
+                            },
+                            class: {
+                              type: 'keyword',
+                            },
+                            data: {
+                              type: 'keyword',
+                            },
+                            entrypoint: {
+                              type: 'long',
+                            },
+                            object_version: {
+                              type: 'keyword',
+                            },
+                            os_abi: {
+                              type: 'keyword',
+                            },
+                            type: {
+                              type: 'keyword',
+                            },
+                            version: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        imports: {
+                          type: 'flattened',
+                        },
+                        sections: {
+                          type: 'nested',
+                          properties: {
+                            chi2: {
+                              type: 'long',
+                            },
+                            entropy: {
+                              type: 'long',
+                            },
+                            flags: {
+                              type: 'keyword',
+                            },
+                            name: {
+                              type: 'keyword',
+                            },
+                            physical_offset: {
+                              type: 'keyword',
+                            },
+                            physical_size: {
+                              type: 'long',
+                            },
+                            type: {
+                              type: 'keyword',
+                            },
+                            virtual_address: {
+                              type: 'long',
+                            },
+                            virtual_size: {
+                              type: 'long',
+                            },
+                          },
+                        },
+                        segments: {
+                          type: 'nested',
+                          properties: {
+                            sections: {
+                              type: 'keyword',
+                            },
+                            type: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        shared_libraries: {
+                          type: 'keyword',
+                        },
+                        telfhash: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    extension: {
+                      type: 'keyword',
+                    },
+                    fork_name: {
+                      type: 'keyword',
+                    },
+                    gid: {
+                      type: 'keyword',
+                    },
+                    group: {
+                      type: 'keyword',
+                    },
+                    hash: {
+                      properties: {
+                        md5: {
+                          type: 'keyword',
+                        },
+                        sha1: {
+                          type: 'keyword',
+                        },
+                        sha256: {
+                          type: 'keyword',
+                        },
+                        sha512: {
+                          type: 'keyword',
+                        },
+                        ssdeep: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    inode: {
+                      type: 'keyword',
+                    },
+                    mime_type: {
+                      type: 'keyword',
+                    },
+                    mode: {
+                      type: 'keyword',
+                    },
+                    mtime: {
+                      type: 'date',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                    owner: {
+                      type: 'keyword',
+                    },
+                    path: {
+                      type: 'keyword',
+                    },
+                    pe: {
+                      properties: {
+                        architecture: {
+                          type: 'keyword',
+                        },
+                        company: {
+                          type: 'keyword',
+                        },
+                        description: {
+                          type: 'keyword',
+                        },
+                        file_version: {
+                          type: 'keyword',
+                        },
+                        imphash: {
+                          type: 'keyword',
+                        },
+                        original_file_name: {
+                          type: 'keyword',
+                        },
+                        product: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    size: {
+                      type: 'long',
+                    },
+                    target_path: {
+                      type: 'keyword',
+                    },
+                    type: {
+                      type: 'keyword',
+                    },
+                    uid: {
+                      type: 'keyword',
+                    },
+                    x509: {
+                      properties: {
+                        alternative_names: {
+                          type: 'keyword',
+                        },
+                        issuer: {
+                          properties: {
+                            common_name: {
+                              type: 'keyword',
+                            },
+                            country: {
+                              type: 'keyword',
+                            },
+                            distinguished_name: {
+                              type: 'keyword',
+                            },
+                            locality: {
+                              type: 'keyword',
+                            },
+                            organization: {
+                              type: 'keyword',
+                            },
+                            organizational_unit: {
+                              type: 'keyword',
+                            },
+                            state_or_province: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        not_after: {
+                          type: 'date',
+                        },
+                        not_before: {
+                          type: 'date',
+                        },
+                        public_key_algorithm: {
+                          type: 'keyword',
+                        },
+                        public_key_curve: {
+                          type: 'keyword',
+                        },
+                        public_key_exponent: {
+                          type: 'long',
+                        },
+                        public_key_size: {
+                          type: 'long',
+                        },
+                        serial_number: {
+                          type: 'keyword',
+                        },
+                        signature_algorithm: {
+                          type: 'keyword',
+                        },
+                        subject: {
+                          properties: {
+                            common_name: {
+                              type: 'keyword',
+                            },
+                            country: {
+                              type: 'keyword',
+                            },
+                            distinguished_name: {
+                              type: 'keyword',
+                            },
+                            locality: {
+                              type: 'keyword',
+                            },
+                            organization: {
+                              type: 'keyword',
+                            },
+                            organizational_unit: {
+                              type: 'keyword',
+                            },
+                            state_or_province: {
+                              type: 'keyword',
+                            },
+                          },
+                        },
+                        version_number: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                  },
+                },
+                first_seen: {
+                  type: 'date',
+                },
+                geo: {
+                  properties: {
+                    city_name: {
+                      type: 'keyword',
+                    },
+                    continent_code: {
+                      type: 'keyword',
+                    },
+                    continent_name: {
+                      type: 'keyword',
+                    },
+                    country_iso_code: {
+                      type: 'keyword',
+                    },
+                    country_name: {
+                      type: 'keyword',
+                    },
+                    location: {
+                      type: 'geo_point',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                    postal_code: {
+                      type: 'keyword',
+                    },
+                    region_iso_code: {
+                      type: 'keyword',
+                    },
+                    region_name: {
+                      type: 'keyword',
+                    },
+                    timezone: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                ip: {
+                  type: 'ip',
+                },
+                last_seen: {
+                  type: 'date',
+                },
+                marking: {
+                  properties: {
+                    tlp: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                modified_at: {
+                  type: 'date',
+                },
+                port: {
+                  type: 'long',
+                },
+                provider: {
+                  type: 'keyword',
+                },
+                reference: {
+                  type: 'keyword',
+                },
+                registry: {
+                  properties: {
+                    data: {
+                      properties: {
+                        bytes: {
+                          type: 'keyword',
+                        },
+                        strings: {
+                          type: 'wildcard',
+                        },
+                        type: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    hive: {
+                      type: 'keyword',
+                    },
+                    key: {
+                      type: 'keyword',
+                    },
+                    path: {
+                      type: 'keyword',
+                    },
+                    value: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                scanner_stats: {
+                  type: 'long',
+                },
+                sightings: {
+                  type: 'long',
+                },
+                type: {
+                  type: 'keyword',
+                },
+                url: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                    },
+                    extension: {
+                      type: 'keyword',
+                    },
+                    fragment: {
+                      type: 'keyword',
+                    },
+                    full: {
+                      type: 'wildcard',
+                    },
+                    original: {
+                      type: 'wildcard',
+                    },
+                    password: {
+                      type: 'keyword',
+                    },
+                    path: {
+                      type: 'wildcard',
+                    },
+                    port: {
+                      type: 'long',
+                    },
+                    query: {
+                      type: 'keyword',
+                    },
+                    registered_domain: {
+                      type: 'keyword',
+                    },
+                    scheme: {
+                      type: 'keyword',
+                    },
+                    subdomain: {
+                      type: 'keyword',
+                    },
+                    top_level_domain: {
+                      type: 'keyword',
+                    },
+                    username: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                x509: {
+                  properties: {
+                    alternative_names: {
+                      type: 'keyword',
+                    },
+                    issuer: {
+                      properties: {
+                        common_name: {
+                          type: 'keyword',
+                        },
+                        country: {
+                          type: 'keyword',
+                        },
+                        distinguished_name: {
+                          type: 'keyword',
+                        },
+                        locality: {
+                          type: 'keyword',
+                        },
+                        organization: {
+                          type: 'keyword',
+                        },
+                        organizational_unit: {
+                          type: 'keyword',
+                        },
+                        state_or_province: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    not_after: {
+                      type: 'date',
+                    },
+                    not_before: {
+                      type: 'date',
+                    },
+                    public_key_algorithm: {
+                      type: 'keyword',
+                    },
+                    public_key_curve: {
+                      type: 'keyword',
+                    },
+                    public_key_exponent: {
+                      type: 'long',
+                    },
+                    public_key_size: {
+                      type: 'long',
+                    },
+                    serial_number: {
+                      type: 'keyword',
+                    },
+                    signature_algorithm: {
+                      type: 'keyword',
+                    },
+                    subject: {
+                      properties: {
+                        common_name: {
+                          type: 'keyword',
+                        },
+                        country: {
+                          type: 'keyword',
+                        },
+                        distinguished_name: {
+                          type: 'keyword',
+                        },
+                        locality: {
+                          type: 'keyword',
+                        },
+                        organization: {
+                          type: 'keyword',
+                        },
+                        organizational_unit: {
+                          type: 'keyword',
+                        },
+                        state_or_province: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    version_number: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            software: {
+              properties: {
+                alias: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                platforms: {
+                  type: 'keyword',
+                },
+                reference: {
+                  type: 'keyword',
+                },
+                type: {
+                  type: 'keyword',
+                },
+              },
+            },
+            tactic: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                reference: {
+                  type: 'keyword',
+                },
+              },
+            },
+            technique: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                reference: {
+                  type: 'keyword',
+                },
+                subtechnique: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                    reference: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+        tls: {
+          properties: {
+            cipher: {
+              type: 'keyword',
+            },
+            client: {
+              properties: {
+                certificate: {
+                  type: 'keyword',
+                },
+                certificate_chain: {
+                  type: 'keyword',
+                },
+                hash: {
+                  properties: {
+                    md5: {
+                      type: 'keyword',
+                    },
+                    sha1: {
+                      type: 'keyword',
+                    },
+                    sha256: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                issuer: {
+                  type: 'keyword',
+                },
+                ja3: {
+                  type: 'keyword',
+                },
+                not_after: {
+                  type: 'date',
+                },
+                not_before: {
+                  type: 'date',
+                },
+                server_name: {
+                  type: 'keyword',
+                },
+                subject: {
+                  type: 'keyword',
+                },
+                supported_ciphers: {
+                  type: 'keyword',
+                },
+                x509: {
+                  properties: {
+                    alternative_names: {
+                      type: 'keyword',
+                    },
+                    issuer: {
+                      properties: {
+                        common_name: {
+                          type: 'keyword',
+                        },
+                        country: {
+                          type: 'keyword',
+                        },
+                        distinguished_name: {
+                          type: 'keyword',
+                        },
+                        locality: {
+                          type: 'keyword',
+                        },
+                        organization: {
+                          type: 'keyword',
+                        },
+                        organizational_unit: {
+                          type: 'keyword',
+                        },
+                        state_or_province: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    not_after: {
+                      type: 'date',
+                    },
+                    not_before: {
+                      type: 'date',
+                    },
+                    public_key_algorithm: {
+                      type: 'keyword',
+                    },
+                    public_key_curve: {
+                      type: 'keyword',
+                    },
+                    public_key_exponent: {
+                      type: 'long',
+                    },
+                    public_key_size: {
+                      type: 'long',
+                    },
+                    serial_number: {
+                      type: 'keyword',
+                    },
+                    signature_algorithm: {
+                      type: 'keyword',
+                    },
+                    subject: {
+                      properties: {
+                        common_name: {
+                          type: 'keyword',
+                        },
+                        country: {
+                          type: 'keyword',
+                        },
+                        distinguished_name: {
+                          type: 'keyword',
+                        },
+                        locality: {
+                          type: 'keyword',
+                        },
+                        organization: {
+                          type: 'keyword',
+                        },
+                        organizational_unit: {
+                          type: 'keyword',
+                        },
+                        state_or_province: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    version_number: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            curve: {
+              type: 'keyword',
+            },
+            established: {
+              type: 'boolean',
+            },
+            next_protocol: {
+              type: 'keyword',
+            },
+            resumed: {
+              type: 'boolean',
+            },
+            server: {
+              properties: {
+                certificate: {
+                  type: 'keyword',
+                },
+                certificate_chain: {
+                  type: 'keyword',
+                },
+                hash: {
+                  properties: {
+                    md5: {
+                      type: 'keyword',
+                    },
+                    sha1: {
+                      type: 'keyword',
+                    },
+                    sha256: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                issuer: {
+                  type: 'keyword',
+                },
+                ja3s: {
+                  type: 'keyword',
+                },
+                not_after: {
+                  type: 'date',
+                },
+                not_before: {
+                  type: 'date',
+                },
+                subject: {
+                  type: 'keyword',
+                },
+                x509: {
+                  properties: {
+                    alternative_names: {
+                      type: 'keyword',
+                    },
+                    issuer: {
+                      properties: {
+                        common_name: {
+                          type: 'keyword',
+                        },
+                        country: {
+                          type: 'keyword',
+                        },
+                        distinguished_name: {
+                          type: 'keyword',
+                        },
+                        locality: {
+                          type: 'keyword',
+                        },
+                        organization: {
+                          type: 'keyword',
+                        },
+                        organizational_unit: {
+                          type: 'keyword',
+                        },
+                        state_or_province: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    not_after: {
+                      type: 'date',
+                    },
+                    not_before: {
+                      type: 'date',
+                    },
+                    public_key_algorithm: {
+                      type: 'keyword',
+                    },
+                    public_key_curve: {
+                      type: 'keyword',
+                    },
+                    public_key_exponent: {
+                      type: 'long',
+                    },
+                    public_key_size: {
+                      type: 'long',
+                    },
+                    serial_number: {
+                      type: 'keyword',
+                    },
+                    signature_algorithm: {
+                      type: 'keyword',
+                    },
+                    subject: {
+                      properties: {
+                        common_name: {
+                          type: 'keyword',
+                        },
+                        country: {
+                          type: 'keyword',
+                        },
+                        distinguished_name: {
+                          type: 'keyword',
+                        },
+                        locality: {
+                          type: 'keyword',
+                        },
+                        organization: {
+                          type: 'keyword',
+                        },
+                        organizational_unit: {
+                          type: 'keyword',
+                        },
+                        state_or_province: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    version_number: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+              },
+            },
+            version: {
+              type: 'keyword',
+            },
+            version_protocol: {
+              type: 'keyword',
+            },
+          },
+        },
+        trace: {
+          properties: {
+            id: {
+              type: 'keyword',
+            },
+          },
+        },
+        transaction: {
+          properties: {
+            id: {
+              type: 'keyword',
+            },
+          },
+        },
+        url: {
+          properties: {
+            domain: {
+              type: 'keyword',
+            },
+            extension: {
+              type: 'keyword',
+            },
+            fragment: {
+              type: 'keyword',
+            },
+            full: {
+              type: 'wildcard',
+            },
+            original: {
+              type: 'wildcard',
+            },
+            password: {
+              type: 'keyword',
+            },
+            path: {
+              type: 'wildcard',
+            },
+            port: {
+              type: 'long',
+            },
+            query: {
+              type: 'keyword',
+            },
+            registered_domain: {
+              type: 'keyword',
+            },
+            scheme: {
+              type: 'keyword',
+            },
+            subdomain: {
+              type: 'keyword',
+            },
+            top_level_domain: {
+              type: 'keyword',
+            },
+            username: {
+              type: 'keyword',
+            },
+          },
+        },
+        user: {
+          properties: {
+            changes: {
+              properties: {
+                domain: {
+                  type: 'keyword',
+                },
+                email: {
+                  type: 'keyword',
+                },
+                full_name: {
+                  type: 'keyword',
+                },
+                group: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                hash: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                roles: {
+                  type: 'keyword',
+                },
+              },
+            },
+            domain: {
+              type: 'keyword',
+            },
+            effective: {
+              properties: {
+                domain: {
+                  type: 'keyword',
+                },
+                email: {
+                  type: 'keyword',
+                },
+                full_name: {
+                  type: 'keyword',
+                },
+                group: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                hash: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                roles: {
+                  type: 'keyword',
+                },
+              },
+            },
+            email: {
+              type: 'keyword',
+            },
+            full_name: {
+              type: 'keyword',
+            },
+            group: {
+              properties: {
+                domain: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+            hash: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            name: {
+              type: 'keyword',
+            },
+            risk: {
+              properties: {
+                calculated_level: {
+                  type: 'keyword',
+                },
+                calculated_score: {
+                  type: 'float',
+                },
+                calculated_score_norm: {
+                  type: 'float',
+                },
+                static_level: {
+                  type: 'keyword',
+                },
+                static_score: {
+                  type: 'float',
+                },
+                static_score_norm: {
+                  type: 'float',
+                },
+              },
+            },
+            roles: {
+              type: 'keyword',
+            },
+            target: {
+              properties: {
+                domain: {
+                  type: 'keyword',
+                },
+                email: {
+                  type: 'keyword',
+                },
+                full_name: {
+                  type: 'keyword',
+                },
+                group: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                    },
+                    id: {
+                      type: 'keyword',
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                hash: {
+                  type: 'keyword',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                roles: {
+                  type: 'keyword',
+                },
+              },
+            },
+          },
+        },
+        user_agent: {
+          properties: {
+            device: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                },
+              },
+            },
+            name: {
+              type: 'keyword',
+            },
+            original: {
+              type: 'keyword',
+            },
+            os: {
+              properties: {
+                family: {
+                  type: 'keyword',
+                },
+                full: {
+                  type: 'keyword',
+                },
+                kernel: {
+                  type: 'keyword',
+                },
+                name: {
+                  type: 'keyword',
+                },
+                platform: {
+                  type: 'keyword',
+                },
+                type: {
+                  type: 'keyword',
+                },
+                version: {
+                  type: 'keyword',
+                },
+              },
+            },
+            version: {
+              type: 'keyword',
+            },
+          },
+        },
+        vulnerability: {
+          properties: {
+            category: {
+              type: 'keyword',
+            },
+            classification: {
+              type: 'keyword',
+            },
+            description: {
+              type: 'keyword',
+            },
+            enumeration: {
+              type: 'keyword',
+            },
+            id: {
+              type: 'keyword',
+            },
+            reference: {
+              type: 'keyword',
+            },
+            report_id: {
+              type: 'keyword',
+            },
+            scanner: {
+              properties: {
+                vendor: {
+                  type: 'keyword',
+                },
+              },
+            },
+            score: {
+              properties: {
+                base: {
+                  type: 'float',
+                },
+                environmental: {
+                  type: 'float',
+                },
+                temporal: {
+                  type: 'float',
+                },
+                version: {
+                  type: 'keyword',
+                },
+              },
+            },
+            severity: {
+              type: 'keyword',
+            },
+          },
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/example/mappings/logs.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/example/mappings/logs.ts
new file mode 100644
index 0000000000000..76e1770d50633
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/example/mappings/logs.ts
@@ -0,0 +1,9229 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IndicesGetMappingIndexMappingRecord } from '@elastic/elasticsearch/lib/api/types';
+
+export const logs: Record<string, IndicesGetMappingIndexMappingRecord> = {
+  '.ds-logs-endpoint.events.process-default-2022.09.27-000001': {
+    mappings: {
+      dynamic: 'false',
+      _meta: {
+        package: {
+          name: 'endpoint',
+        },
+        managed_by: 'fleet',
+        managed: true,
+      },
+      _data_stream_timestamp: {
+        enabled: true,
+      },
+      dynamic_templates: [
+        {
+          strings_as_keyword: {
+            match_mapping_type: 'string',
+            mapping: {
+              ignore_above: 1024,
+              type: 'keyword',
+            },
+          },
+        },
+      ],
+      date_detection: false,
+      properties: {
+        '@timestamp': {
+          type: 'date',
+        },
+        agent: {
+          properties: {
+            ephemeral_id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            type: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            version: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        cloud: {
+          properties: {
+            account: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            instance: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            project: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            provider: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            region: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        container: {
+          properties: {
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            image: {
+              properties: {
+                hash: {
+                  properties: {
+                    all: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                tag: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        data_stream: {
+          properties: {
+            dataset: {
+              type: 'constant_keyword',
+              value: 'endpoint.events.process',
+            },
+            namespace: {
+              type: 'constant_keyword',
+              value: 'default',
+            },
+            type: {
+              type: 'constant_keyword',
+              value: 'logs',
+            },
+          },
+        },
+        destination: {
+          properties: {
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                postal_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                timezone: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+          },
+        },
+        ecs: {
+          properties: {
+            version: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        event: {
+          properties: {
+            action: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            agent_id_status: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            category: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            code: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            created: {
+              type: 'date',
+            },
+            dataset: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            hash: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            ingested: {
+              type: 'date',
+              format: 'strict_date_time_no_millis||strict_date_optional_time||epoch_millis',
+            },
+            kind: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            module: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            outcome: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            provider: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            sequence: {
+              type: 'long',
+            },
+            severity: {
+              type: 'long',
+            },
+            type: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        group: {
+          properties: {
+            Ext: {
+              properties: {
+                real: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+            domain: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        host: {
+          properties: {
+            architecture: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            boot: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            domain: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            hostname: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            ip: {
+              type: 'ip',
+            },
+            mac: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            os: {
+              properties: {
+                Ext: {
+                  properties: {
+                    variant: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                family: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                full: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                kernel: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                platform: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                type: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                version: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            pid_ns_ino: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            type: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            uptime: {
+              type: 'long',
+            },
+          },
+        },
+        message: {
+          type: 'match_only_text',
+        },
+        orchestrator: {
+          properties: {
+            cluster: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            namespace: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            resource: {
+              properties: {
+                ip: {
+                  type: 'ip',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                parent: {
+                  properties: {
+                    type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                type: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+          },
+        },
+        package: {
+          properties: {
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        process: {
+          properties: {
+            Ext: {
+              properties: {
+                ancestry: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                architecture: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                authentication_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                code_signature: {
+                  type: 'nested',
+                  properties: {
+                    exists: {
+                      type: 'boolean',
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                defense_evasions: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                device: {
+                  properties: {
+                    bus_type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    dos_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    nt_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    product_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    serial_number: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    vendor_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    volume_device_type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                dll: {
+                  properties: {
+                    Ext: {
+                      properties: {
+                        mapped_address: {
+                          type: 'unsigned_long',
+                        },
+                        mapped_size: {
+                          type: 'unsigned_long',
+                        },
+                      },
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                effective_parent: {
+                  properties: {
+                    entity_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    executable: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    pid: {
+                      type: 'long',
+                    },
+                  },
+                },
+                protection: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                relative_file_creation_time: {
+                  type: 'double',
+                },
+                relative_file_name_modify_time: {
+                  type: 'double',
+                },
+                session: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                token: {
+                  properties: {
+                    elevation: {
+                      type: 'boolean',
+                    },
+                    elevation_level: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    elevation_type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    integrity_level_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    security_attributes: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                trusted: {
+                  type: 'boolean',
+                },
+                trusted_descendant: {
+                  type: 'boolean',
+                },
+              },
+            },
+            args: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            args_count: {
+              type: 'long',
+            },
+            code_signature: {
+              properties: {
+                exists: {
+                  type: 'boolean',
+                },
+                signing_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                status: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                subject_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                team_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                trusted: {
+                  type: 'boolean',
+                },
+                valid: {
+                  type: 'boolean',
+                },
+              },
+            },
+            command_line: {
+              type: 'wildcard',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            end: {
+              type: 'date',
+            },
+            entity_id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            entry_leader: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                attested_groups: {
+                  properties: {
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                attested_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                entry_meta: {
+                  properties: {
+                    source: {
+                      properties: {
+                        ip: {
+                          type: 'ip',
+                        },
+                      },
+                    },
+                    type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                interactive: {
+                  type: 'boolean',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                parent: {
+                  properties: {
+                    entity_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    pid: {
+                      type: 'long',
+                    },
+                    session_leader: {
+                      properties: {
+                        entity_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        pid: {
+                          type: 'long',
+                        },
+                        start: {
+                          type: 'date',
+                        },
+                      },
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                  },
+                },
+                pid: {
+                  type: 'long',
+                },
+                real_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                real_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                same_as_process: {
+                  type: 'boolean',
+                },
+                saved_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                saved_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                supplemental_groups: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                tty: {
+                  properties: {
+                    char_device: {
+                      properties: {
+                        major: {
+                          type: 'long',
+                        },
+                        minor: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                  },
+                },
+                user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            env_vars: {
+              type: 'object',
+            },
+            executable: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            exit_code: {
+              type: 'long',
+            },
+            group: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            group_leader: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                interactive: {
+                  type: 'boolean',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                pid: {
+                  type: 'long',
+                },
+                real_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                real_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                same_as_process: {
+                  type: 'boolean',
+                },
+                saved_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                saved_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                supplemental_groups: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                tty: {
+                  properties: {
+                    char_device: {
+                      properties: {
+                        major: {
+                          type: 'long',
+                        },
+                        minor: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                  },
+                },
+                user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            hash: {
+              properties: {
+                md5: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha1: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha256: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha512: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            interactive: {
+              type: 'boolean',
+            },
+            io: {
+              properties: {
+                max_bytes_per_process_exceeded: {
+                  type: 'boolean',
+                },
+                text: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                },
+                total_bytes_captured: {
+                  type: 'long',
+                },
+                total_bytes_skipped: {
+                  type: 'long',
+                },
+              },
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            parent: {
+              properties: {
+                Ext: {
+                  properties: {
+                    architecture: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    code_signature: {
+                      type: 'nested',
+                      properties: {
+                        exists: {
+                          type: 'boolean',
+                        },
+                        status: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subject_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        trusted: {
+                          type: 'boolean',
+                        },
+                        valid: {
+                          type: 'boolean',
+                        },
+                      },
+                    },
+                    protection: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    real: {
+                      properties: {
+                        pid: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                    user: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                code_signature: {
+                  properties: {
+                    exists: {
+                      type: 'boolean',
+                    },
+                    signing_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    team_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                exit_code: {
+                  type: 'long',
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                group_leader: {
+                  properties: {
+                    entity_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    pid: {
+                      type: 'long',
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                  },
+                },
+                hash: {
+                  properties: {
+                    md5: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha1: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha256: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha512: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                interactive: {
+                  type: 'boolean',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                pe: {
+                  properties: {
+                    company: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    description: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    file_version: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    imphash: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    original_file_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    product: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                pgid: {
+                  type: 'long',
+                },
+                pid: {
+                  type: 'long',
+                },
+                ppid: {
+                  type: 'long',
+                },
+                real_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                real_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                saved_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                saved_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                supplemental_groups: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                thread: {
+                  properties: {
+                    id: {
+                      type: 'long',
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                title: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+                tty: {
+                  properties: {
+                    char_device: {
+                      properties: {
+                        major: {
+                          type: 'long',
+                        },
+                        minor: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                  },
+                },
+                uptime: {
+                  type: 'long',
+                },
+                user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            pe: {
+              properties: {
+                company: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                description: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                file_version: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                imphash: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                original_file_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                product: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            pgid: {
+              type: 'long',
+            },
+            pid: {
+              type: 'long',
+            },
+            ppid: {
+              type: 'long',
+            },
+            previous: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            real_group: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            real_user: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+              },
+            },
+            saved_group: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            saved_user: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+              },
+            },
+            session_leader: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                interactive: {
+                  type: 'boolean',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                parent: {
+                  properties: {
+                    entity_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    pid: {
+                      type: 'long',
+                    },
+                    session_leader: {
+                      properties: {
+                        entity_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        pid: {
+                          type: 'long',
+                        },
+                        start: {
+                          type: 'date',
+                        },
+                      },
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                  },
+                },
+                pid: {
+                  type: 'long',
+                },
+                real_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                real_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                same_as_process: {
+                  type: 'boolean',
+                },
+                saved_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                saved_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                supplemental_groups: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                tty: {
+                  properties: {
+                    char_device: {
+                      properties: {
+                        major: {
+                          type: 'long',
+                        },
+                        minor: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                  },
+                },
+                user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            start: {
+              type: 'date',
+            },
+            supplemental_groups: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            thread: {
+              properties: {
+                id: {
+                  type: 'long',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            title: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                text: {
+                  type: 'match_only_text',
+                },
+              },
+            },
+            tty: {
+              properties: {
+                char_device: {
+                  properties: {
+                    major: {
+                      type: 'long',
+                    },
+                    minor: {
+                      type: 'long',
+                    },
+                  },
+                },
+                columns: {
+                  type: 'long',
+                },
+                rows: {
+                  type: 'long',
+                },
+              },
+            },
+            uptime: {
+              type: 'long',
+            },
+            user: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+              },
+            },
+            working_directory: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+          },
+        },
+        source: {
+          properties: {
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                postal_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                timezone: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+          },
+        },
+        user: {
+          properties: {
+            Ext: {
+              properties: {
+                real: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+            domain: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            email: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            full_name: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                text: {
+                  type: 'match_only_text',
+                },
+              },
+            },
+            group: {
+              properties: {
+                Ext: {
+                  properties: {
+                    real: {
+                      properties: {
+                        id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                  },
+                },
+                domain: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            hash: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                text: {
+                  type: 'match_only_text',
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+  '.ds-logs-endpoint.alerts-default-2022.09.27-000001': {
+    mappings: {
+      dynamic: 'false',
+      _meta: {
+        package: {
+          name: 'endpoint',
+        },
+        managed_by: 'fleet',
+        managed: true,
+      },
+      _data_stream_timestamp: {
+        enabled: true,
+      },
+      dynamic_templates: [
+        {
+          strings_as_keyword: {
+            match_mapping_type: 'string',
+            mapping: {
+              ignore_above: 1024,
+              type: 'keyword',
+            },
+          },
+        },
+      ],
+      date_detection: false,
+      properties: {
+        '@timestamp': {
+          type: 'date',
+        },
+        Endpoint: {
+          properties: {
+            policy: {
+              properties: {
+                applied: {
+                  properties: {
+                    artifacts: {
+                      enabled: false,
+                      properties: {
+                        global: {
+                          properties: {
+                            identifiers: {
+                              type: 'nested',
+                              properties: {
+                                name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                sha256: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        user: {
+                          properties: {
+                            identifiers: {
+                              type: 'nested',
+                              properties: {
+                                name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                sha256: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    version: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+        Events: {
+          type: 'object',
+        },
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        Memory_protection: {
+          properties: {
+            cross_session: {
+              type: 'boolean',
+            },
+            feature: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            parent_to_child: {
+              type: 'boolean',
+            },
+            self_injection: {
+              type: 'boolean',
+            },
+            thread_count: {
+              type: 'long',
+            },
+            unique_key_v1: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        Ransomware: {
+          properties: {
+            child_processes: {
+              properties: {
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                feature: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                files: {
+                  type: 'nested',
+                  properties: {
+                    data: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    entropy: {
+                      type: 'double',
+                    },
+                    extension: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    metrics: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    operation: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    original: {
+                      properties: {
+                        extension: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    score: {
+                      type: 'double',
+                    },
+                  },
+                },
+                pid: {
+                  type: 'long',
+                },
+                score: {
+                  type: 'double',
+                },
+                version: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            executable: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            feature: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            files: {
+              type: 'nested',
+              properties: {
+                data: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                entropy: {
+                  type: 'double',
+                },
+                extension: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                metrics: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                operation: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                original: {
+                  properties: {
+                    extension: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                path: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                score: {
+                  type: 'double',
+                },
+              },
+            },
+            pid: {
+              type: 'long',
+            },
+            score: {
+              type: 'double',
+            },
+            version: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        Responses: {
+          properties: {
+            '@timestamp': {
+              type: 'date',
+            },
+            action: {
+              type: 'nested',
+              properties: {
+                action: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                field: {
+                  type: 'text',
+                },
+                file: {
+                  properties: {
+                    attributes: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                source: {
+                  properties: {
+                    attributes: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                state: {
+                  type: 'long',
+                },
+                tree: {
+                  type: 'boolean',
+                },
+              },
+            },
+            message: {
+              type: 'text',
+            },
+            process: {
+              type: 'nested',
+              properties: {
+                entity_id: {
+                  type: 'text',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                pid: {
+                  type: 'long',
+                },
+              },
+            },
+            result: {
+              type: 'long',
+            },
+          },
+        },
+        Target: {
+          properties: {
+            dll: {
+              properties: {
+                Ext: {
+                  properties: {
+                    code_signature: {
+                      type: 'nested',
+                      properties: {
+                        exists: {
+                          type: 'boolean',
+                        },
+                        status: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subject_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        trusted: {
+                          type: 'boolean',
+                        },
+                        valid: {
+                          type: 'boolean',
+                        },
+                      },
+                    },
+                    compile_time: {
+                      type: 'date',
+                    },
+                    malware_classification: {
+                      properties: {
+                        features: {
+                          enabled: false,
+                          properties: {
+                            data: {
+                              properties: {
+                                buffer: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                decompressed_size: {
+                                  type: 'long',
+                                },
+                                encoding: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                          },
+                        },
+                        identifier: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        score: {
+                          type: 'double',
+                        },
+                        threshold: {
+                          type: 'double',
+                        },
+                        upx_packed: {
+                          type: 'boolean',
+                        },
+                        version: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    mapped_address: {
+                      type: 'unsigned_long',
+                    },
+                    mapped_size: {
+                      type: 'unsigned_long',
+                    },
+                  },
+                },
+                code_signature: {
+                  properties: {
+                    exists: {
+                      type: 'boolean',
+                    },
+                    signing_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    team_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                hash: {
+                  properties: {
+                    md5: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha1: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha256: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha512: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                path: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                pe: {
+                  properties: {
+                    company: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    description: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    file_version: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    imphash: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    original_file_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    product: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+            process: {
+              properties: {
+                Ext: {
+                  properties: {
+                    ancestry: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    architecture: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    authentication_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    code_signature: {
+                      type: 'nested',
+                      properties: {
+                        exists: {
+                          type: 'boolean',
+                        },
+                        status: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subject_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        trusted: {
+                          type: 'boolean',
+                        },
+                        valid: {
+                          type: 'boolean',
+                        },
+                      },
+                    },
+                    dll: {
+                      properties: {
+                        Ext: {
+                          properties: {
+                            code_signature: {
+                              type: 'nested',
+                              properties: {
+                                exists: {
+                                  type: 'boolean',
+                                },
+                                status: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                subject_name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                trusted: {
+                                  type: 'boolean',
+                                },
+                                valid: {
+                                  type: 'boolean',
+                                },
+                              },
+                            },
+                            compile_time: {
+                              type: 'date',
+                            },
+                            mapped_address: {
+                              type: 'unsigned_long',
+                            },
+                            mapped_size: {
+                              type: 'unsigned_long',
+                            },
+                          },
+                        },
+                        code_signature: {
+                          properties: {
+                            exists: {
+                              type: 'boolean',
+                            },
+                            signing_id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            status: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            subject_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            team_id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            trusted: {
+                              type: 'boolean',
+                            },
+                            valid: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                        hash: {
+                          properties: {
+                            md5: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha1: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha256: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha512: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        pe: {
+                          properties: {
+                            company: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            description: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            file_version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            imphash: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            original_file_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            product: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    malware_classification: {
+                      properties: {
+                        features: {
+                          enabled: false,
+                          properties: {
+                            data: {
+                              properties: {
+                                buffer: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                decompressed_size: {
+                                  type: 'long',
+                                },
+                                encoding: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                          },
+                        },
+                        identifier: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        score: {
+                          type: 'double',
+                        },
+                        threshold: {
+                          type: 'double',
+                        },
+                        upx_packed: {
+                          type: 'boolean',
+                        },
+                        version: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    memory_region: {
+                      properties: {
+                        allocation_base: {
+                          type: 'unsigned_long',
+                        },
+                        allocation_protection: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        allocation_size: {
+                          type: 'unsigned_long',
+                        },
+                        allocation_type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        bytes_address: {
+                          type: 'unsigned_long',
+                        },
+                        bytes_allocation_offset: {
+                          type: 'unsigned_long',
+                        },
+                        bytes_compressed: {
+                          type: 'keyword',
+                          index: false,
+                          doc_values: false,
+                        },
+                        bytes_compressed_present: {
+                          type: 'boolean',
+                        },
+                        malware_signature: {
+                          properties: {
+                            all_names: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            identifier: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            primary: {
+                              properties: {
+                                matches: {
+                                  type: 'keyword',
+                                  index: false,
+                                  doc_values: false,
+                                },
+                                signature: {
+                                  properties: {
+                                    hash: {
+                                      type: 'nested',
+                                      properties: {
+                                        sha256: {
+                                          type: 'keyword',
+                                          ignore_above: 1024,
+                                        },
+                                      },
+                                    },
+                                    id: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                    name: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                  },
+                                },
+                              },
+                            },
+                            version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        mapped_path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        mapped_pe: {
+                          properties: {
+                            company: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            description: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            file_version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            imphash: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            original_file_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            product: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        mapped_pe_detected: {
+                          type: 'boolean',
+                        },
+                        memory_pe: {
+                          properties: {
+                            company: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            description: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            file_version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            imphash: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            original_file_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            product: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        memory_pe_detected: {
+                          type: 'boolean',
+                        },
+                        region_base: {
+                          type: 'unsigned_long',
+                        },
+                        region_protection: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        region_size: {
+                          type: 'unsigned_long',
+                        },
+                        region_state: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        strings: {
+                          type: 'keyword',
+                          index: false,
+                          doc_values: false,
+                        },
+                      },
+                    },
+                    protection: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    services: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    session: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    token: {
+                      properties: {
+                        domain: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        elevation: {
+                          type: 'boolean',
+                        },
+                        elevation_type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        impersonation_level: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        integrity_level: {
+                          type: 'long',
+                        },
+                        integrity_level_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        is_appcontainer: {
+                          type: 'boolean',
+                        },
+                        privileges: {
+                          type: 'nested',
+                          properties: {
+                            description: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            enabled: {
+                              type: 'boolean',
+                            },
+                            name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        sid: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        user: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    user: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                code_signature: {
+                  properties: {
+                    exists: {
+                      type: 'boolean',
+                    },
+                    signing_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    team_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                exit_code: {
+                  type: 'long',
+                },
+                hash: {
+                  properties: {
+                    md5: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha1: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha256: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha512: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                parent: {
+                  properties: {
+                    Ext: {
+                      properties: {
+                        architecture: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        code_signature: {
+                          type: 'nested',
+                          properties: {
+                            exists: {
+                              type: 'boolean',
+                            },
+                            status: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            subject_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            trusted: {
+                              type: 'boolean',
+                            },
+                            valid: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                        dll: {
+                          properties: {
+                            Ext: {
+                              properties: {
+                                code_signature: {
+                                  type: 'nested',
+                                  properties: {
+                                    exists: {
+                                      type: 'boolean',
+                                    },
+                                    status: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                    subject_name: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                    trusted: {
+                                      type: 'boolean',
+                                    },
+                                    valid: {
+                                      type: 'boolean',
+                                    },
+                                  },
+                                },
+                                compile_time: {
+                                  type: 'date',
+                                },
+                                mapped_address: {
+                                  type: 'unsigned_long',
+                                },
+                                mapped_size: {
+                                  type: 'unsigned_long',
+                                },
+                              },
+                            },
+                            code_signature: {
+                              properties: {
+                                exists: {
+                                  type: 'boolean',
+                                },
+                                signing_id: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                status: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                subject_name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                team_id: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                trusted: {
+                                  type: 'boolean',
+                                },
+                                valid: {
+                                  type: 'boolean',
+                                },
+                              },
+                            },
+                            hash: {
+                              properties: {
+                                md5: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                sha1: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                sha256: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                sha512: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            path: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            pe: {
+                              properties: {
+                                company: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                description: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                file_version: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                imphash: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                original_file_name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                product: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                          },
+                        },
+                        protection: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        real: {
+                          properties: {
+                            pid: {
+                              type: 'long',
+                            },
+                          },
+                        },
+                        token: {
+                          properties: {
+                            domain: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            elevation: {
+                              type: 'boolean',
+                            },
+                            elevation_type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            impersonation_level: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            integrity_level: {
+                              type: 'long',
+                            },
+                            integrity_level_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            is_appcontainer: {
+                              type: 'boolean',
+                            },
+                            privileges: {
+                              type: 'nested',
+                              properties: {
+                                description: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                enabled: {
+                                  type: 'boolean',
+                                },
+                                name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            sid: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            user: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        user: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    args: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    args_count: {
+                      type: 'long',
+                    },
+                    code_signature: {
+                      properties: {
+                        exists: {
+                          type: 'boolean',
+                        },
+                        signing_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        status: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subject_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        team_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        trusted: {
+                          type: 'boolean',
+                        },
+                        valid: {
+                          type: 'boolean',
+                        },
+                      },
+                    },
+                    command_line: {
+                      type: 'wildcard',
+                      ignore_above: 1024,
+                      fields: {
+                        caseless: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          normalizer: 'lowercase',
+                        },
+                        text: {
+                          type: 'text',
+                        },
+                      },
+                    },
+                    entity_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    executable: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        caseless: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          normalizer: 'lowercase',
+                        },
+                        text: {
+                          type: 'text',
+                        },
+                      },
+                    },
+                    exit_code: {
+                      type: 'long',
+                    },
+                    hash: {
+                      properties: {
+                        md5: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha1: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha256: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha512: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        caseless: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          normalizer: 'lowercase',
+                        },
+                        text: {
+                          type: 'text',
+                        },
+                      },
+                    },
+                    pe: {
+                      properties: {
+                        company: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        description: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        file_version: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        imphash: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        original_file_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        product: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    pgid: {
+                      type: 'long',
+                    },
+                    pid: {
+                      type: 'long',
+                    },
+                    ppid: {
+                      type: 'long',
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                    thread: {
+                      properties: {
+                        id: {
+                          type: 'long',
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    title: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                    uptime: {
+                      type: 'long',
+                    },
+                    working_directory: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        caseless: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          normalizer: 'lowercase',
+                        },
+                        text: {
+                          type: 'text',
+                        },
+                      },
+                    },
+                  },
+                },
+                pe: {
+                  properties: {
+                    company: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    description: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    file_version: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    imphash: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    original_file_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    product: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                pgid: {
+                  type: 'long',
+                },
+                pid: {
+                  type: 'long',
+                },
+                ppid: {
+                  type: 'long',
+                },
+                start: {
+                  type: 'date',
+                },
+                thread: {
+                  properties: {
+                    Ext: {
+                      properties: {
+                        call_stack: {
+                          enabled: false,
+                          properties: {
+                            instruction_pointer: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            memory_section: {
+                              properties: {
+                                memory_address: {
+                                  type: 'keyword',
+                                  index: false,
+                                  doc_values: false,
+                                },
+                                memory_size: {
+                                  type: 'keyword',
+                                  index: false,
+                                  doc_values: false,
+                                },
+                                protection: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            module_name: {
+                              type: 'keyword',
+                              index: false,
+                              doc_values: false,
+                            },
+                            module_path: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            rva: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            symbol_info: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        call_stack_final_user_module: {
+                          type: 'nested',
+                          properties: {
+                            code_signature: {
+                              type: 'nested',
+                              properties: {
+                                exists: {
+                                  type: 'boolean',
+                                },
+                                status: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                subject_name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                trusted: {
+                                  type: 'boolean',
+                                },
+                                valid: {
+                                  type: 'boolean',
+                                },
+                              },
+                            },
+                            hash: {
+                              properties: {
+                                sha256: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            path: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        call_stack_summary: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        parameter: {
+                          type: 'unsigned_long',
+                        },
+                        parameter_bytes_compressed: {
+                          type: 'keyword',
+                          index: false,
+                          doc_values: false,
+                        },
+                        parameter_bytes_compressed_present: {
+                          type: 'boolean',
+                        },
+                        service: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        start: {
+                          type: 'date',
+                        },
+                        start_address: {
+                          type: 'unsigned_long',
+                        },
+                        start_address_allocation_offset: {
+                          type: 'unsigned_long',
+                        },
+                        start_address_bytes: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        start_address_bytes_disasm: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        start_address_bytes_disasm_hash: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        start_address_module: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        token: {
+                          properties: {
+                            domain: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            elevation: {
+                              type: 'boolean',
+                            },
+                            elevation_type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            impersonation_level: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            integrity_level: {
+                              type: 'long',
+                            },
+                            integrity_level_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            is_appcontainer: {
+                              type: 'boolean',
+                            },
+                            privileges: {
+                              type: 'nested',
+                              properties: {
+                                description: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                enabled: {
+                                  type: 'boolean',
+                                },
+                                name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            sid: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            user: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        uptime: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                    id: {
+                      type: 'long',
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                title: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+                uptime: {
+                  type: 'long',
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+        agent: {
+          properties: {
+            ephemeral_id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            type: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            version: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        cloud: {
+          properties: {
+            account: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            instance: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            project: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            provider: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            region: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        container: {
+          properties: {
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            image: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                tag: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        data_stream: {
+          properties: {
+            dataset: {
+              type: 'constant_keyword',
+              value: 'endpoint.alerts',
+            },
+            namespace: {
+              type: 'constant_keyword',
+              value: 'default',
+            },
+            type: {
+              type: 'constant_keyword',
+              value: 'logs',
+            },
+          },
+        },
+        destination: {
+          properties: {
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                postal_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                timezone: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            ip: {
+              type: 'ip',
+            },
+          },
+        },
+        dll: {
+          properties: {
+            Ext: {
+              properties: {
+                code_signature: {
+                  type: 'nested',
+                  properties: {
+                    exists: {
+                      type: 'boolean',
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                compile_time: {
+                  type: 'date',
+                },
+                malware_classification: {
+                  properties: {
+                    features: {
+                      enabled: false,
+                      properties: {
+                        data: {
+                          properties: {
+                            buffer: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            decompressed_size: {
+                              type: 'long',
+                            },
+                            encoding: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    identifier: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    score: {
+                      type: 'double',
+                    },
+                    threshold: {
+                      type: 'double',
+                    },
+                    upx_packed: {
+                      type: 'boolean',
+                    },
+                    version: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                mapped_address: {
+                  type: 'unsigned_long',
+                },
+                mapped_size: {
+                  type: 'unsigned_long',
+                },
+              },
+            },
+            code_signature: {
+              properties: {
+                exists: {
+                  type: 'boolean',
+                },
+                signing_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                status: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                subject_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                team_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                trusted: {
+                  type: 'boolean',
+                },
+                valid: {
+                  type: 'boolean',
+                },
+              },
+            },
+            hash: {
+              properties: {
+                md5: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha1: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha256: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha512: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            path: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            pe: {
+              properties: {
+                company: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                description: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                file_version: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                imphash: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                original_file_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                product: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+          },
+        },
+        dns: {
+          properties: {
+            question: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                type: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+          },
+        },
+        ecs: {
+          properties: {
+            version: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        elastic: {
+          properties: {
+            agent: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+          },
+        },
+        event: {
+          properties: {
+            action: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            agent_id_status: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            category: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            code: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            created: {
+              type: 'date',
+            },
+            dataset: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            hash: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            ingested: {
+              type: 'date',
+              format: 'strict_date_time_no_millis||strict_date_optional_time||epoch_millis',
+            },
+            kind: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            module: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            outcome: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            provider: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            risk_score: {
+              type: 'float',
+            },
+            sequence: {
+              type: 'long',
+            },
+            severity: {
+              type: 'long',
+            },
+            type: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        file: {
+          properties: {
+            Ext: {
+              properties: {
+                code_signature: {
+                  type: 'nested',
+                  properties: {
+                    exists: {
+                      type: 'boolean',
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                entry_modified: {
+                  type: 'double',
+                },
+                macro: {
+                  properties: {
+                    code_page: {
+                      type: 'long',
+                    },
+                    collection: {
+                      properties: {
+                        hash: {
+                          properties: {
+                            md5: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha1: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha256: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha512: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    errors: {
+                      type: 'nested',
+                      properties: {
+                        count: {
+                          type: 'long',
+                        },
+                        error_type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    file_extension: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    project_file: {
+                      properties: {
+                        hash: {
+                          properties: {
+                            md5: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha1: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha256: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha512: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    stream: {
+                      type: 'nested',
+                      properties: {
+                        hash: {
+                          properties: {
+                            md5: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha1: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha256: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha512: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        raw_code: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        raw_code_size: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                  },
+                },
+                malware_classification: {
+                  properties: {
+                    features: {
+                      enabled: false,
+                      properties: {
+                        data: {
+                          properties: {
+                            buffer: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            decompressed_size: {
+                              type: 'long',
+                            },
+                            encoding: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    identifier: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    score: {
+                      type: 'double',
+                    },
+                    threshold: {
+                      type: 'double',
+                    },
+                    upx_packed: {
+                      type: 'boolean',
+                    },
+                    version: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                original: {
+                  properties: {
+                    gid: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    group: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    mode: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    owner: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    uid: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                quarantine_message: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                quarantine_path: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                quarantine_result: {
+                  type: 'boolean',
+                },
+                temp_file_path: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                windows: {
+                  properties: {
+                    zone_identifier: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+            accessed: {
+              type: 'date',
+            },
+            attributes: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            code_signature: {
+              properties: {
+                exists: {
+                  type: 'boolean',
+                },
+                signing_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                status: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                subject_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                team_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                trusted: {
+                  type: 'boolean',
+                },
+                valid: {
+                  type: 'boolean',
+                },
+              },
+            },
+            created: {
+              type: 'date',
+            },
+            ctime: {
+              type: 'date',
+            },
+            device: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            directory: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            drive_letter: {
+              type: 'keyword',
+              ignore_above: 1,
+            },
+            extension: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            gid: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            group: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            hash: {
+              properties: {
+                md5: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha1: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha256: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha512: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            inode: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            mime_type: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            mode: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            mtime: {
+              type: 'date',
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            owner: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            path: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            pe: {
+              properties: {
+                company: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                description: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                file_version: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                imphash: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                original_file_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                product: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            size: {
+              type: 'long',
+            },
+            target_path: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            type: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            uid: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        group: {
+          properties: {
+            Ext: {
+              properties: {
+                real: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+            domain: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        host: {
+          properties: {
+            architecture: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            boot: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            domain: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                postal_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                timezone: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            hostname: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            ip: {
+              type: 'ip',
+            },
+            mac: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            os: {
+              properties: {
+                Ext: {
+                  properties: {
+                    variant: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                family: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                full: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                kernel: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                platform: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                type: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                version: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            pid_ns_ino: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            type: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            uptime: {
+              type: 'long',
+            },
+            user: {
+              properties: {
+                Ext: {
+                  properties: {
+                    real: {
+                      properties: {
+                        id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                  },
+                },
+                domain: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                email: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                full_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+                group: {
+                  properties: {
+                    Ext: {
+                      properties: {
+                        real: {
+                          properties: {
+                            id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    domain: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                hash: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+        message: {
+          type: 'match_only_text',
+        },
+        orchestrator: {
+          properties: {
+            cluster: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            namespace: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            resource: {
+              properties: {
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                type: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+          },
+        },
+        process: {
+          properties: {
+            Ext: {
+              properties: {
+                ancestry: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                architecture: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                authentication_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                code_signature: {
+                  type: 'nested',
+                  properties: {
+                    exists: {
+                      type: 'boolean',
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                dll: {
+                  properties: {
+                    Ext: {
+                      properties: {
+                        code_signature: {
+                          type: 'nested',
+                          properties: {
+                            exists: {
+                              type: 'boolean',
+                            },
+                            status: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            subject_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            trusted: {
+                              type: 'boolean',
+                            },
+                            valid: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                        compile_time: {
+                          type: 'date',
+                        },
+                        mapped_address: {
+                          type: 'unsigned_long',
+                        },
+                        mapped_size: {
+                          type: 'unsigned_long',
+                        },
+                      },
+                    },
+                    code_signature: {
+                      properties: {
+                        exists: {
+                          type: 'boolean',
+                        },
+                        signing_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        status: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subject_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        team_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        trusted: {
+                          type: 'boolean',
+                        },
+                        valid: {
+                          type: 'boolean',
+                        },
+                      },
+                    },
+                    hash: {
+                      properties: {
+                        md5: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha1: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha256: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha512: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    pe: {
+                      properties: {
+                        company: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        description: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        file_version: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        imphash: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        original_file_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        product: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                  },
+                },
+                malware_classification: {
+                  properties: {
+                    features: {
+                      enabled: false,
+                      properties: {
+                        data: {
+                          properties: {
+                            buffer: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            decompressed_size: {
+                              type: 'long',
+                            },
+                            encoding: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    identifier: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    score: {
+                      type: 'double',
+                    },
+                    threshold: {
+                      type: 'double',
+                    },
+                    upx_packed: {
+                      type: 'boolean',
+                    },
+                    version: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                memory_region: {
+                  properties: {
+                    allocation_base: {
+                      type: 'unsigned_long',
+                    },
+                    allocation_protection: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    allocation_size: {
+                      type: 'unsigned_long',
+                    },
+                    allocation_type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    bytes_address: {
+                      type: 'unsigned_long',
+                    },
+                    bytes_allocation_offset: {
+                      type: 'unsigned_long',
+                    },
+                    bytes_compressed: {
+                      type: 'keyword',
+                      index: false,
+                      doc_values: false,
+                    },
+                    bytes_compressed_present: {
+                      type: 'boolean',
+                    },
+                    malware_signature: {
+                      properties: {
+                        all_names: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        identifier: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        primary: {
+                          properties: {
+                            matches: {
+                              type: 'keyword',
+                              index: false,
+                              doc_values: false,
+                            },
+                            signature: {
+                              properties: {
+                                hash: {
+                                  type: 'nested',
+                                  properties: {
+                                    sha256: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                  },
+                                },
+                                id: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                          },
+                        },
+                        version: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    mapped_path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    mapped_pe: {
+                      properties: {
+                        company: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        description: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        file_version: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        imphash: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        original_file_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        product: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    mapped_pe_detected: {
+                      type: 'boolean',
+                    },
+                    memory_pe: {
+                      properties: {
+                        company: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        description: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        file_version: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        imphash: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        original_file_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        product: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    memory_pe_detected: {
+                      type: 'boolean',
+                    },
+                    region_base: {
+                      type: 'unsigned_long',
+                    },
+                    region_protection: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    region_size: {
+                      type: 'unsigned_long',
+                    },
+                    region_state: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    strings: {
+                      type: 'keyword',
+                      index: false,
+                      doc_values: false,
+                    },
+                  },
+                },
+                protection: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                services: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                session: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                token: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    elevation: {
+                      type: 'boolean',
+                    },
+                    elevation_type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    impersonation_level: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    integrity_level: {
+                      type: 'long',
+                    },
+                    integrity_level_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    is_appcontainer: {
+                      type: 'boolean',
+                    },
+                    privileges: {
+                      type: 'nested',
+                      properties: {
+                        description: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        enabled: {
+                          type: 'boolean',
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    sid: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    user: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                user: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            args: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            args_count: {
+              type: 'long',
+            },
+            code_signature: {
+              properties: {
+                exists: {
+                  type: 'boolean',
+                },
+                signing_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                status: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                subject_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                team_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                trusted: {
+                  type: 'boolean',
+                },
+                valid: {
+                  type: 'boolean',
+                },
+              },
+            },
+            command_line: {
+              type: 'wildcard',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            entity_id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            entry_leader: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                entry_meta: {
+                  properties: {
+                    source: {
+                      properties: {
+                        ip: {
+                          type: 'ip',
+                        },
+                      },
+                    },
+                    type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                interactive: {
+                  type: 'boolean',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                parent: {
+                  properties: {
+                    entity_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    pid: {
+                      type: 'long',
+                    },
+                    session_leader: {
+                      properties: {
+                        entity_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        pid: {
+                          type: 'long',
+                        },
+                        start: {
+                          type: 'date',
+                        },
+                      },
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                  },
+                },
+                pid: {
+                  type: 'long',
+                },
+                real_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                real_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                same_as_process: {
+                  type: 'boolean',
+                },
+                saved_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                saved_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                supplemental_groups: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                tty: {
+                  properties: {
+                    char_device: {
+                      properties: {
+                        major: {
+                          type: 'long',
+                        },
+                        minor: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                  },
+                },
+                user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            env_vars: {
+              type: 'object',
+            },
+            executable: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            exit_code: {
+              type: 'long',
+            },
+            group_leader: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                interactive: {
+                  type: 'boolean',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                pid: {
+                  type: 'long',
+                },
+                real_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                real_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                same_as_process: {
+                  type: 'boolean',
+                },
+                saved_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                saved_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                supplemental_groups: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                tty: {
+                  properties: {
+                    char_device: {
+                      properties: {
+                        major: {
+                          type: 'long',
+                        },
+                        minor: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                  },
+                },
+                user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            hash: {
+              properties: {
+                md5: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha1: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha256: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                sha512: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            interactive: {
+              type: 'boolean',
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+            parent: {
+              properties: {
+                Ext: {
+                  properties: {
+                    architecture: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    code_signature: {
+                      type: 'nested',
+                      properties: {
+                        exists: {
+                          type: 'boolean',
+                        },
+                        status: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subject_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        trusted: {
+                          type: 'boolean',
+                        },
+                        valid: {
+                          type: 'boolean',
+                        },
+                      },
+                    },
+                    dll: {
+                      properties: {
+                        Ext: {
+                          properties: {
+                            code_signature: {
+                              type: 'nested',
+                              properties: {
+                                exists: {
+                                  type: 'boolean',
+                                },
+                                status: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                subject_name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                trusted: {
+                                  type: 'boolean',
+                                },
+                                valid: {
+                                  type: 'boolean',
+                                },
+                              },
+                            },
+                            compile_time: {
+                              type: 'date',
+                            },
+                            mapped_address: {
+                              type: 'unsigned_long',
+                            },
+                            mapped_size: {
+                              type: 'unsigned_long',
+                            },
+                          },
+                        },
+                        code_signature: {
+                          properties: {
+                            exists: {
+                              type: 'boolean',
+                            },
+                            signing_id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            status: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            subject_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            team_id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            trusted: {
+                              type: 'boolean',
+                            },
+                            valid: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                        hash: {
+                          properties: {
+                            md5: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha1: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha256: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha512: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        pe: {
+                          properties: {
+                            company: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            description: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            file_version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            imphash: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            original_file_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            product: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    protection: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    real: {
+                      properties: {
+                        pid: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                    token: {
+                      properties: {
+                        domain: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        elevation: {
+                          type: 'boolean',
+                        },
+                        elevation_type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        impersonation_level: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        integrity_level: {
+                          type: 'long',
+                        },
+                        integrity_level_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        is_appcontainer: {
+                          type: 'boolean',
+                        },
+                        privileges: {
+                          type: 'nested',
+                          properties: {
+                            description: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            enabled: {
+                              type: 'boolean',
+                            },
+                            name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        sid: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        user: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    user: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                code_signature: {
+                  properties: {
+                    exists: {
+                      type: 'boolean',
+                    },
+                    signing_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    status: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    team_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    trusted: {
+                      type: 'boolean',
+                    },
+                    valid: {
+                      type: 'boolean',
+                    },
+                  },
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                exit_code: {
+                  type: 'long',
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                group_leader: {
+                  properties: {
+                    entity_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    pid: {
+                      type: 'long',
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                  },
+                },
+                hash: {
+                  properties: {
+                    md5: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha1: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha256: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    sha512: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                interactive: {
+                  type: 'boolean',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                pe: {
+                  properties: {
+                    company: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    description: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    file_version: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    imphash: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    original_file_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    product: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                pgid: {
+                  type: 'long',
+                },
+                pid: {
+                  type: 'long',
+                },
+                ppid: {
+                  type: 'long',
+                },
+                real_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                real_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                saved_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                saved_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                supplemental_groups: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                thread: {
+                  properties: {
+                    id: {
+                      type: 'long',
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                title: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+                tty: {
+                  properties: {
+                    char_device: {
+                      properties: {
+                        major: {
+                          type: 'long',
+                        },
+                        minor: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                  },
+                },
+                uptime: {
+                  type: 'long',
+                },
+                user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            pe: {
+              properties: {
+                company: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                description: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                file_version: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                imphash: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                original_file_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                product: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            pgid: {
+              type: 'long',
+            },
+            pid: {
+              type: 'long',
+            },
+            ppid: {
+              type: 'long',
+            },
+            previous: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            real_group: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            real_user: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+              },
+            },
+            saved_group: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            saved_user: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+              },
+            },
+            session_leader: {
+              properties: {
+                args: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                args_count: {
+                  type: 'long',
+                },
+                command_line: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                entity_id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                executable: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                interactive: {
+                  type: 'boolean',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+                parent: {
+                  properties: {
+                    entity_id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    pid: {
+                      type: 'long',
+                    },
+                    session_leader: {
+                      properties: {
+                        entity_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        pid: {
+                          type: 'long',
+                        },
+                        start: {
+                          type: 'date',
+                        },
+                      },
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                  },
+                },
+                pid: {
+                  type: 'long',
+                },
+                real_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                real_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                same_as_process: {
+                  type: 'boolean',
+                },
+                saved_group: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                saved_user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                supplemental_groups: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                tty: {
+                  properties: {
+                    char_device: {
+                      properties: {
+                        major: {
+                          type: 'long',
+                        },
+                        minor: {
+                          type: 'long',
+                        },
+                      },
+                    },
+                  },
+                },
+                user: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                  },
+                },
+                working_directory: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    caseless: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      normalizer: 'lowercase',
+                    },
+                    text: {
+                      type: 'text',
+                    },
+                  },
+                },
+              },
+            },
+            start: {
+              type: 'date',
+            },
+            supplemental_groups: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            thread: {
+              properties: {
+                Ext: {
+                  properties: {
+                    call_stack: {
+                      enabled: false,
+                      properties: {
+                        instruction_pointer: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        memory_section: {
+                          properties: {
+                            memory_address: {
+                              type: 'keyword',
+                              index: false,
+                              doc_values: false,
+                            },
+                            memory_size: {
+                              type: 'keyword',
+                              index: false,
+                              doc_values: false,
+                            },
+                            protection: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        module_name: {
+                          type: 'keyword',
+                          index: false,
+                          doc_values: false,
+                        },
+                        module_path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        rva: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        symbol_info: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    call_stack_final_user_module: {
+                      type: 'nested',
+                      properties: {
+                        code_signature: {
+                          type: 'nested',
+                          properties: {
+                            exists: {
+                              type: 'boolean',
+                            },
+                            status: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            subject_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            trusted: {
+                              type: 'boolean',
+                            },
+                            valid: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                        hash: {
+                          properties: {
+                            sha256: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    call_stack_summary: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    parameter: {
+                      type: 'unsigned_long',
+                    },
+                    parameter_bytes_compressed: {
+                      type: 'keyword',
+                      index: false,
+                      doc_values: false,
+                    },
+                    parameter_bytes_compressed_present: {
+                      type: 'boolean',
+                    },
+                    service: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    start: {
+                      type: 'date',
+                    },
+                    start_address: {
+                      type: 'unsigned_long',
+                    },
+                    start_address_allocation_offset: {
+                      type: 'unsigned_long',
+                    },
+                    start_address_bytes: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    start_address_bytes_disasm: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    start_address_bytes_disasm_hash: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    start_address_module: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    token: {
+                      properties: {
+                        domain: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        elevation: {
+                          type: 'boolean',
+                        },
+                        elevation_type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        impersonation_level: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        integrity_level: {
+                          type: 'long',
+                        },
+                        integrity_level_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        is_appcontainer: {
+                          type: 'boolean',
+                        },
+                        privileges: {
+                          type: 'nested',
+                          properties: {
+                            description: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            enabled: {
+                              type: 'boolean',
+                            },
+                            name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        sid: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        user: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    uptime: {
+                      type: 'long',
+                    },
+                  },
+                },
+                id: {
+                  type: 'long',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            title: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                text: {
+                  type: 'match_only_text',
+                },
+              },
+            },
+            tty: {
+              properties: {
+                char_device: {
+                  properties: {
+                    major: {
+                      type: 'long',
+                    },
+                    minor: {
+                      type: 'long',
+                    },
+                  },
+                },
+              },
+            },
+            uptime: {
+              type: 'long',
+            },
+            user: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+              },
+            },
+            working_directory: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                caseless: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  normalizer: 'lowercase',
+                },
+                text: {
+                  type: 'text',
+                },
+              },
+            },
+          },
+        },
+        registry: {
+          properties: {
+            data: {
+              properties: {
+                strings: {
+                  type: 'wildcard',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            path: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            value: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        rule: {
+          properties: {
+            author: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            category: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            description: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            license: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            reference: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            ruleset: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            uuid: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            version: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+          },
+        },
+        source: {
+          properties: {
+            geo: {
+              properties: {
+                city_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                continent_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                country_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                location: {
+                  type: 'geo_point',
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                postal_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_iso_code: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                region_name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                timezone: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            ip: {
+              type: 'ip',
+            },
+          },
+        },
+        threat: {
+          properties: {
+            enrichments: {
+              type: 'nested',
+              properties: {
+                indicator: {
+                  properties: {
+                    file: {
+                      properties: {
+                        Ext: {
+                          properties: {
+                            code_signature: {
+                              type: 'nested',
+                              properties: {
+                                exists: {
+                                  type: 'boolean',
+                                },
+                                status: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                subject_name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                trusted: {
+                                  type: 'boolean',
+                                },
+                                valid: {
+                                  type: 'boolean',
+                                },
+                              },
+                            },
+                            device: {
+                              properties: {
+                                bus_type: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                dos_name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                nt_name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                product_id: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                serial_number: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                vendor_id: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            entropy: {
+                              type: 'double',
+                            },
+                            entry_modified: {
+                              type: 'double',
+                            },
+                            header_bytes: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            header_data: {
+                              type: 'text',
+                            },
+                            malware_classification: {
+                              properties: {
+                                features: {
+                                  properties: {
+                                    data: {
+                                      properties: {
+                                        buffer: {
+                                          type: 'keyword',
+                                          ignore_above: 1024,
+                                        },
+                                        decompressed_size: {
+                                          type: 'long',
+                                        },
+                                        encoding: {
+                                          type: 'keyword',
+                                          ignore_above: 1024,
+                                        },
+                                      },
+                                    },
+                                  },
+                                },
+                                identifier: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                score: {
+                                  type: 'double',
+                                },
+                                threshold: {
+                                  type: 'double',
+                                },
+                                upx_packed: {
+                                  type: 'boolean',
+                                },
+                                version: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            malware_signature: {
+                              type: 'nested',
+                              properties: {
+                                all_names: {
+                                  type: 'text',
+                                },
+                                identifier: {
+                                  type: 'text',
+                                },
+                                primary: {
+                                  type: 'nested',
+                                  properties: {
+                                    matches: {
+                                      type: 'nested',
+                                    },
+                                    signature: {
+                                      type: 'nested',
+                                      properties: {
+                                        hash: {
+                                          type: 'nested',
+                                          properties: {
+                                            sha256: {
+                                              type: 'keyword',
+                                              ignore_above: 1024,
+                                            },
+                                          },
+                                        },
+                                        id: {
+                                          type: 'keyword',
+                                          ignore_above: 1024,
+                                        },
+                                        name: {
+                                          type: 'keyword',
+                                          ignore_above: 1024,
+                                        },
+                                      },
+                                    },
+                                  },
+                                },
+                                secondary: {
+                                  type: 'nested',
+                                },
+                                version: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            monotonic_id: {
+                              type: 'unsigned_long',
+                            },
+                            original: {
+                              properties: {
+                                gid: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                group: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                mode: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                owner: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                path: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                uid: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            quarantine_message: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            quarantine_path: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            quarantine_result: {
+                              type: 'boolean',
+                            },
+                            temp_file_path: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            windows: {
+                              properties: {
+                                zone_identifier: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                          },
+                        },
+                        accessed: {
+                          type: 'date',
+                        },
+                        attributes: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        code_signature: {
+                          properties: {
+                            exists: {
+                              type: 'boolean',
+                            },
+                            signing_id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            status: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            subject_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            team_id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            trusted: {
+                              type: 'boolean',
+                            },
+                            valid: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                        created: {
+                          type: 'date',
+                        },
+                        ctime: {
+                          type: 'date',
+                        },
+                        device: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        directory: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        drive_letter: {
+                          type: 'keyword',
+                          ignore_above: 1,
+                        },
+                        elf: {
+                          properties: {
+                            architecture: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            byte_order: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            cpu_type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            creation_date: {
+                              type: 'date',
+                            },
+                            exports: {
+                              type: 'flattened',
+                            },
+                            header: {
+                              properties: {
+                                abi_version: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                class: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                data: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                entrypoint: {
+                                  type: 'long',
+                                },
+                                object_version: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                os_abi: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                type: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                version: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            imports: {
+                              type: 'flattened',
+                            },
+                            sections: {
+                              type: 'nested',
+                              properties: {
+                                chi2: {
+                                  type: 'long',
+                                },
+                                entropy: {
+                                  type: 'long',
+                                },
+                                flags: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                name: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                physical_offset: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                physical_size: {
+                                  type: 'long',
+                                },
+                                type: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                virtual_address: {
+                                  type: 'long',
+                                },
+                                virtual_size: {
+                                  type: 'long',
+                                },
+                              },
+                            },
+                            segments: {
+                              type: 'nested',
+                              properties: {
+                                sections: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                                type: {
+                                  type: 'keyword',
+                                  ignore_above: 1024,
+                                },
+                              },
+                            },
+                            shared_libraries: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            telfhash: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        extension: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        gid: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        group: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        hash: {
+                          properties: {
+                            md5: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha1: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha256: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            sha512: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            ssdeep: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        inode: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        mime_type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        mode: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        mtime: {
+                          type: 'date',
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        owner: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          fields: {
+                            caseless: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                              normalizer: 'lowercase',
+                            },
+                            text: {
+                              type: 'text',
+                            },
+                          },
+                        },
+                        pe: {
+                          properties: {
+                            architecture: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            company: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            description: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            file_version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            imphash: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            original_file_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            product: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        size: {
+                          type: 'long',
+                        },
+                        target_path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          fields: {
+                            caseless: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                              normalizer: 'lowercase',
+                            },
+                            text: {
+                              type: 'text',
+                            },
+                          },
+                        },
+                        type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        uid: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    first_seen: {
+                      type: 'date',
+                    },
+                    geo: {
+                      properties: {
+                        city_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        continent_code: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        continent_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        country_iso_code: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        country_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        location: {
+                          type: 'geo_point',
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        postal_code: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        region_iso_code: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        region_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        timezone: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    ip: {
+                      type: 'ip',
+                    },
+                    last_seen: {
+                      type: 'date',
+                    },
+                    marking: {
+                      properties: {
+                        tlp: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    modified_at: {
+                      type: 'date',
+                    },
+                    port: {
+                      type: 'long',
+                    },
+                    provider: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    reference: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    registry: {
+                      properties: {
+                        data: {
+                          properties: {
+                            bytes: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            strings: {
+                              type: 'wildcard',
+                              ignore_above: 1024,
+                            },
+                            type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        hive: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        key: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        value: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    scanner_stats: {
+                      type: 'long',
+                    },
+                    sightings: {
+                      type: 'long',
+                    },
+                    type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    url: {
+                      properties: {
+                        domain: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        extension: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        fragment: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        full: {
+                          type: 'wildcard',
+                          ignore_above: 1024,
+                          fields: {
+                            text: {
+                              type: 'match_only_text',
+                            },
+                          },
+                        },
+                        original: {
+                          type: 'wildcard',
+                          ignore_above: 1024,
+                          fields: {
+                            text: {
+                              type: 'match_only_text',
+                            },
+                          },
+                        },
+                        password: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        path: {
+                          type: 'wildcard',
+                          ignore_above: 1024,
+                        },
+                        port: {
+                          type: 'long',
+                        },
+                        query: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        registered_domain: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        scheme: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subdomain: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        top_level_domain: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        username: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    x509: {
+                      properties: {
+                        alternative_names: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        issuer: {
+                          properties: {
+                            common_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            country: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            distinguished_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            locality: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            organization: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            organizational_unit: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            state_or_province: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        not_after: {
+                          type: 'date',
+                        },
+                        not_before: {
+                          type: 'date',
+                        },
+                        public_key_algorithm: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        public_key_curve: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        public_key_exponent: {
+                          type: 'long',
+                          index: false,
+                          doc_values: false,
+                        },
+                        public_key_size: {
+                          type: 'long',
+                        },
+                        serial_number: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        signature_algorithm: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subject: {
+                          properties: {
+                            common_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            country: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            distinguished_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            locality: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            organization: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            organizational_unit: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            state_or_province: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        version_number: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                  },
+                },
+                matched: {
+                  properties: {
+                    atomic: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    field: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    index: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+            framework: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            group: {
+              properties: {
+                alias: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                reference: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            indicator: {
+              properties: {
+                as: {
+                  properties: {
+                    number: {
+                      type: 'long',
+                    },
+                    organization: {
+                      properties: {
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          fields: {
+                            text: {
+                              type: 'match_only_text',
+                            },
+                          },
+                        },
+                      },
+                    },
+                  },
+                },
+                confidence: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                description: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                email: {
+                  properties: {
+                    address: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                file: {
+                  properties: {
+                    Ext: {
+                      properties: {
+                        code_signature: {
+                          type: 'nested',
+                          properties: {
+                            exists: {
+                              type: 'boolean',
+                            },
+                            status: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            subject_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            trusted: {
+                              type: 'boolean',
+                            },
+                            valid: {
+                              type: 'boolean',
+                            },
+                          },
+                        },
+                        device: {
+                          properties: {
+                            bus_type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            dos_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            nt_name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            product_id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            serial_number: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            vendor_id: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        entropy: {
+                          type: 'double',
+                        },
+                        entry_modified: {
+                          type: 'double',
+                        },
+                        header_bytes: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        header_data: {
+                          type: 'text',
+                        },
+                        malware_classification: {
+                          properties: {
+                            features: {
+                              properties: {
+                                data: {
+                                  properties: {
+                                    buffer: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                    decompressed_size: {
+                                      type: 'long',
+                                    },
+                                    encoding: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                  },
+                                },
+                              },
+                            },
+                            identifier: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            score: {
+                              type: 'double',
+                            },
+                            threshold: {
+                              type: 'double',
+                            },
+                            upx_packed: {
+                              type: 'boolean',
+                            },
+                            version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        malware_signature: {
+                          type: 'nested',
+                          properties: {
+                            all_names: {
+                              type: 'text',
+                            },
+                            identifier: {
+                              type: 'text',
+                            },
+                            primary: {
+                              type: 'nested',
+                              properties: {
+                                matches: {
+                                  type: 'nested',
+                                },
+                                signature: {
+                                  type: 'nested',
+                                  properties: {
+                                    hash: {
+                                      type: 'nested',
+                                      properties: {
+                                        sha256: {
+                                          type: 'keyword',
+                                          ignore_above: 1024,
+                                        },
+                                      },
+                                    },
+                                    id: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                    name: {
+                                      type: 'keyword',
+                                      ignore_above: 1024,
+                                    },
+                                  },
+                                },
+                              },
+                            },
+                            secondary: {
+                              type: 'nested',
+                            },
+                            version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        monotonic_id: {
+                          type: 'unsigned_long',
+                        },
+                        original: {
+                          properties: {
+                            gid: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            group: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            mode: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            owner: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            path: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            uid: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        quarantine_message: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        quarantine_path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        quarantine_result: {
+                          type: 'boolean',
+                        },
+                        temp_file_path: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        windows: {
+                          properties: {
+                            zone_identifier: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                      },
+                    },
+                    accessed: {
+                      type: 'date',
+                    },
+                    attributes: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    code_signature: {
+                      properties: {
+                        exists: {
+                          type: 'boolean',
+                        },
+                        signing_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        status: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        subject_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        team_id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        trusted: {
+                          type: 'boolean',
+                        },
+                        valid: {
+                          type: 'boolean',
+                        },
+                      },
+                    },
+                    created: {
+                      type: 'date',
+                    },
+                    ctime: {
+                      type: 'date',
+                    },
+                    device: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    directory: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    drive_letter: {
+                      type: 'keyword',
+                      ignore_above: 1,
+                    },
+                    elf: {
+                      properties: {
+                        architecture: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        byte_order: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        cpu_type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        creation_date: {
+                          type: 'date',
+                        },
+                        exports: {
+                          type: 'flattened',
+                        },
+                        header: {
+                          properties: {
+                            abi_version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            class: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            data: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            entrypoint: {
+                              type: 'long',
+                            },
+                            object_version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            os_abi: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            version: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        imports: {
+                          type: 'flattened',
+                        },
+                        sections: {
+                          type: 'nested',
+                          properties: {
+                            chi2: {
+                              type: 'long',
+                            },
+                            entropy: {
+                              type: 'long',
+                            },
+                            flags: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            name: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            physical_offset: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            physical_size: {
+                              type: 'long',
+                            },
+                            type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            virtual_address: {
+                              type: 'long',
+                            },
+                            virtual_size: {
+                              type: 'long',
+                            },
+                          },
+                        },
+                        segments: {
+                          type: 'nested',
+                          properties: {
+                            sections: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                            type: {
+                              type: 'keyword',
+                              ignore_above: 1024,
+                            },
+                          },
+                        },
+                        shared_libraries: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        telfhash: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    extension: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    gid: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    group: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    hash: {
+                      properties: {
+                        md5: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha1: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha256: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        sha512: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        ssdeep: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    inode: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    mime_type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    mode: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    mtime: {
+                      type: 'date',
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    owner: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        caseless: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          normalizer: 'lowercase',
+                        },
+                        text: {
+                          type: 'text',
+                        },
+                      },
+                    },
+                    pe: {
+                      properties: {
+                        architecture: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        company: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        description: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        file_version: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        imphash: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        original_file_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        product: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    size: {
+                      type: 'long',
+                    },
+                    target_path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        caseless: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                          normalizer: 'lowercase',
+                        },
+                        text: {
+                          type: 'text',
+                        },
+                      },
+                    },
+                    type: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    uid: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                first_seen: {
+                  type: 'date',
+                },
+                geo: {
+                  properties: {
+                    city_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    continent_code: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    continent_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    country_iso_code: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    country_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    location: {
+                      type: 'geo_point',
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    postal_code: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    region_iso_code: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    region_name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    timezone: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                ip: {
+                  type: 'ip',
+                },
+                last_seen: {
+                  type: 'date',
+                },
+                marking: {
+                  properties: {
+                    tlp: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                modified_at: {
+                  type: 'date',
+                },
+                port: {
+                  type: 'long',
+                },
+                provider: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                reference: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                registry: {
+                  properties: {
+                    data: {
+                      properties: {
+                        bytes: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        strings: {
+                          type: 'wildcard',
+                          ignore_above: 1024,
+                        },
+                        type: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    hive: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    key: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    value: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                scanner_stats: {
+                  type: 'long',
+                },
+                sightings: {
+                  type: 'long',
+                },
+                type: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                url: {
+                  properties: {
+                    domain: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    extension: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    fragment: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    full: {
+                      type: 'wildcard',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                    original: {
+                      type: 'wildcard',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                    password: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    path: {
+                      type: 'wildcard',
+                      ignore_above: 1024,
+                    },
+                    port: {
+                      type: 'long',
+                    },
+                    query: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    registered_domain: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    scheme: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subdomain: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    top_level_domain: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    username: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+                x509: {
+                  properties: {
+                    alternative_names: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    issuer: {
+                      properties: {
+                        common_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        country: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        distinguished_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        locality: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        organization: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        organizational_unit: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        state_or_province: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    not_after: {
+                      type: 'date',
+                    },
+                    not_before: {
+                      type: 'date',
+                    },
+                    public_key_algorithm: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    public_key_curve: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    public_key_exponent: {
+                      type: 'long',
+                      index: false,
+                      doc_values: false,
+                    },
+                    public_key_size: {
+                      type: 'long',
+                    },
+                    serial_number: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    signature_algorithm: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    subject: {
+                      properties: {
+                        common_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        country: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        distinguished_name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        locality: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        organization: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        organizational_unit: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        state_or_province: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                    version_number: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+            software: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                platforms: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                reference: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                type: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            tactic: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                reference: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            technique: {
+              properties: {
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                  fields: {
+                    text: {
+                      type: 'match_only_text',
+                    },
+                  },
+                },
+                reference: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                subtechnique: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                      fields: {
+                        text: {
+                          type: 'match_only_text',
+                        },
+                      },
+                    },
+                    reference: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+        user: {
+          properties: {
+            Ext: {
+              properties: {
+                real: {
+                  properties: {
+                    id: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                    name: {
+                      type: 'keyword',
+                      ignore_above: 1024,
+                    },
+                  },
+                },
+              },
+            },
+            domain: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            email: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            full_name: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                text: {
+                  type: 'match_only_text',
+                },
+              },
+            },
+            group: {
+              properties: {
+                Ext: {
+                  properties: {
+                    real: {
+                      properties: {
+                        id: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                        name: {
+                          type: 'keyword',
+                          ignore_above: 1024,
+                        },
+                      },
+                    },
+                  },
+                },
+                domain: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                id: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+                name: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+            hash: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            id: {
+              type: 'keyword',
+              ignore_above: 1024,
+            },
+            name: {
+              type: 'keyword',
+              ignore_above: 1024,
+              fields: {
+                text: {
+                  type: 'match_only_text',
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.test.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.test.ts
new file mode 100644
index 0000000000000..c44104451b1d8
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.test.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getIncompatibleStatColor } from './helpers';
+
+describe('getIncompatibleStatColor', () => {
+  test('it returns the expected color when incompatible is greater than zero', () => {
+    const incompatible = 123;
+
+    expect(getIncompatibleStatColor(incompatible)).toBe('#bd271e');
+  });
+
+  test('it returns undefined when incompatible is zero', () => {
+    const incompatible = 0;
+
+    expect(getIncompatibleStatColor(incompatible)).toBeUndefined();
+  });
+
+  test('it returns undefined when incompatible is undefined', () => {
+    const incompatible = undefined;
+
+    expect(getIncompatibleStatColor(incompatible)).toBeUndefined();
+  });
+});
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.ts
new file mode 100644
index 0000000000000..ac1fead3d187b
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.ts
@@ -0,0 +1,335 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  IlmExplainLifecycleLifecycleExplain,
+  IndicesStatsIndicesStats,
+} from '@elastic/elasticsearch/lib/api/types';
+import { has, sortBy } from 'lodash/fp';
+import { getIlmPhase } from './data_quality_panel/pattern/helpers';
+import { getFillColor } from './data_quality_panel/tabs/summary_tab/helpers';
+
+import * as i18n from './translations';
+
+import type {
+  DataQualityCheckResult,
+  EcsMetadata,
+  EnrichedFieldMetadata,
+  ErrorSummary,
+  PartitionedFieldMetadata,
+  PartitionedFieldMetadataStats,
+  PatternRollup,
+  UnallowedValueCount,
+} from './types';
+
+const EMPTY_INDEX_NAMES: string[] = [];
+
+export const getIndexNames = ({
+  ilmExplain,
+  ilmPhases,
+  stats,
+}: {
+  ilmExplain: Record<string, IlmExplainLifecycleLifecycleExplain> | null;
+  ilmPhases: string[];
+  stats: Record<string, IndicesStatsIndicesStats> | null;
+}): string[] => {
+  if (ilmExplain != null && stats != null) {
+    const allIndexNames = Object.keys(stats);
+    const filteredByIlmPhase = allIndexNames.filter((indexName) =>
+      ilmPhases.includes(getIlmPhase(ilmExplain[indexName]) ?? '')
+    );
+
+    return filteredByIlmPhase;
+  } else {
+    return EMPTY_INDEX_NAMES;
+  }
+};
+
+export interface FieldType {
+  field: string;
+  type: string;
+}
+
+function shouldReadKeys(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+const getNextPathWithoutProperties = ({
+  key,
+  pathWithoutProperties,
+  value,
+}: {
+  key: string;
+  pathWithoutProperties: string;
+  value: unknown;
+}): string => {
+  if (!pathWithoutProperties) {
+    return key;
+  }
+
+  if (shouldReadKeys(value) && key === 'properties') {
+    return `${pathWithoutProperties}`; // TODO: wrap required?
+  } else {
+    return `${pathWithoutProperties}.${key}`;
+  }
+};
+
+export function getFieldTypes(mappingsProperties: Record<string, unknown>): FieldType[] {
+  if (!shouldReadKeys(mappingsProperties)) {
+    throw new TypeError(`Root value is not flatten-able, received ${mappingsProperties}`);
+  }
+
+  const result: FieldType[] = [];
+  (function flatten(prefix, object, pathWithoutProperties) {
+    for (const [key, value] of Object.entries(object)) {
+      const path = prefix ? `${prefix}.${key}` : key;
+
+      const nextPathWithoutProperties = getNextPathWithoutProperties({
+        key,
+        pathWithoutProperties,
+        value,
+      });
+
+      if (shouldReadKeys(value)) {
+        flatten(path, value, nextPathWithoutProperties);
+      } else {
+        if (nextPathWithoutProperties.endsWith('.type')) {
+          const pathWithoutType = nextPathWithoutProperties.slice(
+            0,
+            nextPathWithoutProperties.lastIndexOf('.type')
+          );
+
+          result.push({
+            field: pathWithoutType,
+            type: `${value}`,
+          });
+        }
+      }
+    }
+  })('', mappingsProperties, '');
+
+  return result;
+}
+
+export const getEnrichedFieldMetadata = ({
+  ecsMetadata,
+  fieldMetadata,
+  unallowedValues,
+}: {
+  ecsMetadata: Record<string, EcsMetadata>;
+  fieldMetadata: FieldType;
+  unallowedValues: Record<string, UnallowedValueCount[]>;
+}): EnrichedFieldMetadata => {
+  const { field, type } = fieldMetadata;
+  const indexInvalidValues = unallowedValues[field] ?? [];
+
+  if (has(fieldMetadata.field, ecsMetadata)) {
+    return {
+      ...ecsMetadata[field],
+      indexFieldName: field,
+      indexFieldType: type,
+      indexInvalidValues,
+      hasEcsMetadata: true,
+      isEcsCompliant: type === ecsMetadata[field].type && indexInvalidValues.length === 0,
+    };
+  } else {
+    return {
+      indexFieldName: field,
+      indexFieldType: type,
+      indexInvalidValues,
+      hasEcsMetadata: false,
+      isEcsCompliant: false,
+    };
+  }
+};
+
+export const getMissingTimestampFieldMetadata = (): EnrichedFieldMetadata => ({
+  description: i18n.TIMESTAMP_DESCRIPTION,
+  hasEcsMetadata: true,
+  indexFieldName: '@timestamp',
+  indexFieldType: '-',
+  indexInvalidValues: [],
+  isEcsCompliant: false,
+  type: 'date',
+});
+
+export const getPartitionedFieldMetadata = (
+  enrichedFieldMetadata: EnrichedFieldMetadata[]
+): PartitionedFieldMetadata =>
+  enrichedFieldMetadata.reduce<PartitionedFieldMetadata>(
+    (acc, x) => ({
+      all: [...acc.all, x],
+      ecsCompliant: x.isEcsCompliant ? [...acc.ecsCompliant, x] : acc.ecsCompliant,
+      custom: !x.hasEcsMetadata ? [...acc.custom, x] : acc.custom,
+      incompatible:
+        x.hasEcsMetadata && !x.isEcsCompliant ? [...acc.incompatible, x] : acc.incompatible,
+    }),
+    {
+      all: [],
+      ecsCompliant: [],
+      custom: [],
+      incompatible: [],
+    }
+  );
+
+export const getPartitionedFieldMetadataStats = (
+  partitionedFieldMetadata: PartitionedFieldMetadata
+): PartitionedFieldMetadataStats => {
+  const { all, ecsCompliant, custom, incompatible } = partitionedFieldMetadata;
+
+  return {
+    all: all.length,
+    ecsCompliant: ecsCompliant.length,
+    custom: custom.length,
+    incompatible: incompatible.length,
+  };
+};
+
+export const hasValidTimestampMapping = (enrichedFieldMetadata: EnrichedFieldMetadata[]): boolean =>
+  enrichedFieldMetadata.some(
+    (x) => x.indexFieldName === '@timestamp' && x.indexFieldType === 'date'
+  );
+
+export const getDocsCount = ({
+  indexName,
+  stats,
+}: {
+  indexName: string;
+  stats: Record<string, IndicesStatsIndicesStats> | null;
+}): number => (stats && stats[indexName]?.total?.docs?.count) ?? 0;
+
+export const getTotalDocsCount = ({
+  indexNames,
+  stats,
+}: {
+  indexNames: string[];
+  stats: Record<string, IndicesStatsIndicesStats> | null;
+}): number =>
+  indexNames.reduce(
+    (acc: number, indexName: string) => acc + getDocsCount({ stats, indexName }),
+    0
+  );
+
+export const EMPTY_STAT = '--';
+
+/**
+ * Returns an i18n description of an an ILM phase
+ */
+export const getIlmPhaseDescription = (phase: string): string => {
+  switch (phase) {
+    case 'hot':
+      return i18n.HOT_DESCRIPTION;
+    case 'warm':
+      return i18n.WARM_DESCRIPTION;
+    case 'cold':
+      return i18n.COLD_DESCRIPTION;
+    case 'frozen':
+      return i18n.FROZEN_DESCRIPTION;
+    case 'unmanaged':
+      return i18n.UNMANAGED_DESCRIPTION;
+    default:
+      return ' ';
+  }
+};
+
+export const getPatternIlmPhaseDescription = ({
+  indices,
+  pattern,
+  phase,
+}: {
+  indices: number;
+  pattern: string;
+  phase: string;
+}): string => {
+  switch (phase) {
+    case 'hot':
+      return i18n.HOT_PATTERN_TOOLTIP({ indices, pattern });
+    case 'warm':
+      return i18n.WARM_PATTERN_TOOLTIP({ indices, pattern });
+    case 'cold':
+      return i18n.COLD_PATTERN_TOOLTIP({ indices, pattern });
+    case 'frozen':
+      return i18n.FROZEN_PATTERN_TOOLTIP({ indices, pattern });
+    case 'unmanaged':
+      return i18n.UNMANAGED_PATTERN_TOOLTIP({ indices, pattern });
+    default:
+      return '';
+  }
+};
+
+export const getTotalPatternIncompatible = (
+  results: Record<string, DataQualityCheckResult> | undefined
+): number | undefined => {
+  if (results == null) {
+    return undefined;
+  }
+
+  const allResults = Object.values(results);
+
+  return allResults.reduce<number>((acc, { incompatible }) => acc + (incompatible ?? 0), 0);
+};
+
+export const getTotalPatternIndicesChecked = (patternRollup: PatternRollup | undefined): number => {
+  if (patternRollup != null && patternRollup.results != null) {
+    const allResults = Object.values(patternRollup.results);
+    const nonErrorResults = allResults.filter(({ error }) => error == null);
+
+    return nonErrorResults.length;
+  } else {
+    return 0;
+  }
+};
+
+export const getIncompatibleStatColor = (incompatible: number | undefined): string | undefined =>
+  incompatible != null && incompatible > 0 ? getFillColor('incompatible') : undefined;
+
+export const getErrorSummary = ({
+  error,
+  indexName,
+  pattern,
+}: DataQualityCheckResult): ErrorSummary => ({
+  error: String(error),
+  indexName,
+  pattern,
+});
+
+export const getErrorSummariesForRollup = (
+  patternRollup: PatternRollup | undefined
+): ErrorSummary[] => {
+  const maybePatternErrorSummary: ErrorSummary[] =
+    patternRollup != null && patternRollup.error != null
+      ? [{ pattern: patternRollup.pattern, indexName: null, error: patternRollup.error }]
+      : [];
+
+  if (patternRollup != null && patternRollup.results != null) {
+    const unsortedResults: DataQualityCheckResult[] = Object.values(patternRollup.results);
+    const sortedResults = sortBy('indexName', unsortedResults);
+
+    return sortedResults.reduce<ErrorSummary[]>(
+      (acc, result) => [...acc, ...(result.error != null ? [getErrorSummary(result)] : [])],
+      maybePatternErrorSummary
+    );
+  } else {
+    return maybePatternErrorSummary;
+  }
+};
+
+export const getErrorSummaries = (
+  patternRollups: Record<string, PatternRollup>
+): ErrorSummary[] => {
+  const allPatterns: string[] = Object.keys(patternRollups);
+
+  // sort the patterns A-Z:
+  const sortedPatterns = [...allPatterns].sort((a, b) => {
+    return a.localeCompare(b);
+  });
+
+  return sortedPatterns.reduce<ErrorSummary[]>(
+    (acc, pattern) => [...acc, ...getErrorSummariesForRollup(patternRollups[pattern])],
+    []
+  );
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ilm_phases_empty_prompt/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ilm_phases_empty_prompt/index.tsx
new file mode 100644
index 0000000000000..1fbeec55deddb
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ilm_phases_empty_prompt/index.tsx
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiEmptyPrompt, EuiSpacer, EuiText, EuiTitle } from '@elastic/eui';
+import React, { useMemo } from 'react';
+import styled from 'styled-components';
+
+import {
+  COLD_DESCRIPTION,
+  FROZEN_DESCRIPTION,
+  HOT_DESCRIPTION,
+  UNMANAGED_DESCRIPTION,
+  WARM_DESCRIPTION,
+} from '../translations';
+import * as i18n from './translations';
+
+const Ul = styled.ul`
+  text-align: left;
+`;
+
+const Li = styled.ul`
+  margin-bottom: ${({ theme }) => theme.eui.euiSizeS};
+  text-align: left;
+`;
+
+const IlmPhasesEmptyPromptComponent: React.FC = () => {
+  const title = useMemo(() => <h2>{i18n.TITLE}</h2>, []);
+  const body = useMemo(() => <p>{i18n.BODY}</p>, []);
+  const footer = useMemo(
+    () => (
+      <>
+        <EuiTitle size="xxs">
+          <h3>{i18n.ILM_PHASES_THAT_CAN_BE_CHECKED}</h3>
+        </EuiTitle>
+
+        <EuiSpacer size="s" />
+
+        <Ul>
+          <Li>
+            <strong>{i18n.HOT}</strong>
+            {': '}
+            {HOT_DESCRIPTION}
+          </Li>
+          <Li>
+            <strong>{i18n.WARM}</strong>
+            {': '}
+            {WARM_DESCRIPTION}
+          </Li>
+          <Li>
+            <strong>{i18n.UNMANAGED}</strong>
+            {': '}
+            {UNMANAGED_DESCRIPTION}
+          </Li>
+        </Ul>
+
+        <EuiSpacer size="m" />
+
+        <EuiTitle size="xxs">
+          <h3>{i18n.ILM_PHASES_THAT_CANNOT_BE_CHECKED}</h3>
+        </EuiTitle>
+
+        <EuiText color="subdued" size="s">
+          {i18n.THE_FOLLOWING_ILM_PHASES}
+        </EuiText>
+
+        <EuiSpacer size="s" />
+
+        <Ul>
+          <Li>
+            <strong>{i18n.COLD}</strong>
+            {': '}
+            {COLD_DESCRIPTION}
+          </Li>
+          <Li>
+            <strong>{i18n.FROZEN}</strong>
+            {': '}
+            {FROZEN_DESCRIPTION}
+          </Li>
+        </Ul>
+      </>
+    ),
+    []
+  );
+
+  return <EuiEmptyPrompt body={body} footer={footer} title={title} />;
+};
+
+export const IlmPhasesEmptyPrompt = React.memo(IlmPhasesEmptyPromptComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ilm_phases_empty_prompt/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ilm_phases_empty_prompt/translations.ts
new file mode 100644
index 0000000000000..080669c92c39a
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/ilm_phases_empty_prompt/translations.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const BODY = i18n.translate('ecsDataQualityDashboard.ilmPhasesEmptyPromptBody', {
+  defaultMessage:
+    'Indices with these Index Lifecycle Management (ILM) phases will be checked for data quality',
+});
+
+export const COLD = i18n.translate('ecsDataQualityDashboard.ilmPhasesEmptyPromptColdLabel', {
+  defaultMessage: 'cold',
+});
+
+export const FROZEN = i18n.translate('ecsDataQualityDashboard.ilmPhasesEmptyPromptFrozenLabel', {
+  defaultMessage: 'frozen',
+});
+
+export const HOT = i18n.translate('ecsDataQualityDashboard.ilmPhasesEmptyPromptHotLabel', {
+  defaultMessage: 'hot',
+});
+
+export const ILM_PHASES_THAT_CAN_BE_CHECKED = i18n.translate(
+  'ecsDataQualityDashboard.ilmPhasesEmptyPromptIlmPhasesThatCanBeCheckedSubtitle',
+  {
+    defaultMessage: 'ILM phases that can be checked for data quality',
+  }
+);
+
+export const ILM_PHASES_THAT_CANNOT_BE_CHECKED = i18n.translate(
+  'ecsDataQualityDashboard.ilmPhasesEmptyPromptIlmPhasesThatCannotBeCheckedSubtitle',
+  {
+    defaultMessage: 'ILM phases that cannot be checked',
+  }
+);
+
+export const THE_FOLLOWING_ILM_PHASES = i18n.translate(
+  'ecsDataQualityDashboard.ilmPhasesEmptyPromptITheFollowingIlmPhasesLabel',
+  {
+    defaultMessage:
+      'The following ILM phases cannot be checked for data quality because they are slower to access',
+  }
+);
+
+export const UNMANAGED = i18n.translate(
+  'ecsDataQualityDashboard.ilmPhasesEmptyPromptUnmanagedLabel',
+  {
+    defaultMessage: 'unmanaged',
+  }
+);
+
+export const WARM = i18n.translate('ecsDataQualityDashboard.ilmPhasesEmptyPromptWarmLabel', {
+  defaultMessage: 'warm',
+});
+
+export const TITLE = i18n.translate('ecsDataQualityDashboard.ilmPhasesEmptyPromptTitle', {
+  defaultMessage: 'Select one or more ILM phases',
+});
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/index.tsx
new file mode 100644
index 0000000000000..05ccaf9c4fc5e
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/index.tsx
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  FlameElementEvent,
+  HeatmapElementEvent,
+  MetricElementEvent,
+  PartitionElementEvent,
+  Theme,
+  WordCloudElementEvent,
+  XYChartElementEvent,
+} from '@elastic/charts';
+import React from 'react';
+
+import { Body } from './data_quality_panel/body';
+import { IlmPhasesEmptyPrompt } from './ilm_phases_empty_prompt';
+
+interface Props {
+  addSuccessToast: (toast: { title: string }) => void;
+  canUserCreateAndReadCases: () => boolean;
+  defaultNumberFormat: string;
+  getGroupByFieldsOnClick: (
+    elements: Array<
+      | FlameElementEvent
+      | HeatmapElementEvent
+      | MetricElementEvent
+      | PartitionElementEvent
+      | WordCloudElementEvent
+      | XYChartElementEvent
+    >
+  ) => {
+    groupByField0: string;
+    groupByField1: string;
+  };
+  ilmPhases: string[];
+  lastChecked: string;
+  openCreateCaseFlyout: ({
+    comments,
+    headerContent,
+  }: {
+    comments: string[];
+    headerContent?: React.ReactNode;
+  }) => void;
+  patterns: string[];
+  setLastChecked: (lastChecked: string) => void;
+  theme: Theme;
+}
+
+/** Renders the `Data Quality` dashboard content */
+const DataQualityPanelComponent: React.FC<Props> = ({
+  addSuccessToast,
+  canUserCreateAndReadCases,
+  defaultNumberFormat,
+  getGroupByFieldsOnClick,
+  ilmPhases,
+  lastChecked,
+  openCreateCaseFlyout,
+  patterns,
+  setLastChecked,
+  theme,
+}) => {
+  if (ilmPhases.length === 0) {
+    return <IlmPhasesEmptyPrompt />;
+  }
+
+  return (
+    <Body
+      addSuccessToast={addSuccessToast}
+      canUserCreateAndReadCases={canUserCreateAndReadCases}
+      defaultNumberFormat={defaultNumberFormat}
+      getGroupByFieldsOnClick={getGroupByFieldsOnClick}
+      ilmPhases={ilmPhases}
+      lastChecked={lastChecked}
+      openCreateCaseFlyout={openCreateCaseFlyout}
+      patterns={patterns}
+      setLastChecked={setLastChecked}
+      theme={theme}
+    />
+  );
+};
+
+DataQualityPanelComponent.displayName = 'DataQualityPanelComponent';
+
+/** Renders the `Data Quality` dashboard content */
+export const DataQualityPanel = React.memo(DataQualityPanelComponent);
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/styles.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/styles.tsx
new file mode 100644
index 0000000000000..6b05356d5de59
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/styles.tsx
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCode } from '@elastic/eui';
+import { euiThemeVars } from '@kbn/ui-theme';
+import styled from 'styled-components';
+
+export const CodeDanger = styled(EuiCode)`
+  color: ${euiThemeVars.euiColorDanger};
+`;
+
+export const CodeSuccess = styled(EuiCode)`
+  color: ${euiThemeVars.euiColorSuccess};
+`;
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/translations.ts
new file mode 100644
index 0000000000000..771faa301cee3
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/translations.ts
@@ -0,0 +1,257 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ADD_TO_NEW_CASE = i18n.translate('ecsDataQualityDashboard.addToNewCaseButton', {
+  defaultMessage: 'Add to new case',
+});
+
+export const CANCEL = i18n.translate('ecsDataQualityDashboard.cancelButton', {
+  defaultMessage: 'Cancel',
+});
+
+export const CHECK_ALL = i18n.translate('ecsDataQualityDashboard.checkAllButton', {
+  defaultMessage: 'Check all',
+});
+
+export const CHECKING = (index: string) =>
+  i18n.translate('ecsDataQualityDashboard.checkingLabel', {
+    values: { index },
+    defaultMessage: 'Checking {index}',
+  });
+
+export const COLLAPSE_BUTTON_LABEL = (collapsed: boolean) =>
+  collapsed
+    ? i18n.translate('ecsDataQualityDashboard.collapseButtonLabelOpen', {
+        defaultMessage: 'Open',
+      })
+    : i18n.translate('ecsDataQualityDashboard.collapseButtonLabelClosed', {
+        defaultMessage: 'Closed',
+      });
+
+export const COLD_DESCRIPTION = i18n.translate('ecsDataQualityDashboard.coldDescription', {
+  defaultMessage:
+    'The index is no longer being updated and is queried infrequently. The information still needs to be searchable, but it’s okay if those queries are slower.',
+});
+
+export const COLD_PATTERN_TOOLTIP = ({ indices, pattern }: { indices: number; pattern: string }) =>
+  i18n.translate('ecsDataQualityDashboard.coldPatternTooltip', {
+    values: { indices, pattern },
+    defaultMessage:
+      '{indices} {indices, plural, =1 {index} other {indices}} matching the {pattern} pattern {indices, plural, =1 {is} other {are}} cold. Cold indices are no longer being updated and are queried infrequently. The information still needs to be searchable, but it’s okay if those queries are slower.',
+  });
+
+export const COPIED_RESULTS_TOAST_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.toasts.copiedResultsToastTitle',
+  {
+    defaultMessage: 'Copied results to the clipboard',
+  }
+);
+
+export const COPY_TO_CLIPBOARD = i18n.translate('ecsDataQualityDashboard.copyToClipboardButton', {
+  defaultMessage: 'Copy to clipboard',
+});
+
+/** The subtitle displayed on the Data Quality dashboard */
+export const DATA_QUALITY_SUBTITLE: string = i18n.translate(
+  'ecsDataQualityDashboard.ecsDataQualityDashboardSubtitle',
+  {
+    defaultMessage: 'Check index mappings and values for compatibility with the',
+  }
+);
+
+export const DATA_QUALITY_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.ecsDataQualityDashboardTitle',
+  {
+    defaultMessage: 'Data quality',
+  }
+);
+
+export const DEFAULT_PANEL_TITLE = i18n.translate('ecsDataQualityDashboard.defaultPanelTitle', {
+  defaultMessage: 'Check index mappings',
+});
+
+export const ECS_VERSION = i18n.translate('ecsDataQualityDashboard.ecsVersionStat', {
+  defaultMessage: 'ECS version',
+});
+
+export const ERROR_LOADING_ECS_METADATA = (details: string) =>
+  i18n.translate('ecsDataQualityDashboard.errorLoadingEcsMetadataLabel', {
+    values: { details },
+    defaultMessage: 'Error loading ECS metadata: {details}',
+  });
+
+export const ERROR_LOADING_ECS_METADATA_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.emptyErrorPrompt.errorLoadingEcsMetadataTitle',
+  {
+    defaultMessage: 'Unable to load ECS metadata',
+  }
+);
+
+export const ERROR_LOADING_ECS_VERSION = (details: string) =>
+  i18n.translate('ecsDataQualityDashboard.errorLoadingEcsVersionLabel', {
+    values: { details },
+    defaultMessage: 'Error loading ECS version: {details}',
+  });
+
+export const ERROR_LOADING_ECS_VERSION_TITLE = i18n.translate(
+  'ecsDataQualityDashboard.emptyErrorPrompt.errorLoadingEcsVersionTitle',
+  {
+    defaultMessage: 'Unable to load ECS version',
+  }
+);
+
+export const ERROR_LOADING_ILM_EXPLAIN = (details: string) =>
+  i18n.translate('ecsDataQualityDashboard.errorLoadingIlmExplainLabel', {
+    values: { details },
+    defaultMessage: 'Error loading ILM Explain: {details}',
+  });
+
+export const ERROR_LOADING_MAPPINGS = ({
+  details,
+  patternOrIndexName,
+}: {
+  details: string;
+  patternOrIndexName: string;
+}) =>
+  i18n.translate('ecsDataQualityDashboard.errorLoadingMappingsLabel', {
+    values: { details, patternOrIndexName },
+    defaultMessage: 'Error loading mappings for {patternOrIndexName}: {details}',
+  });
+
+export const ERROR_LOADING_STATS = (details: string) =>
+  i18n.translate('ecsDataQualityDashboard.errorLoadingStatsLabel', {
+    values: { details },
+    defaultMessage: 'Error loading stats: {details}',
+  });
+
+export const ERROR_LOADING_UNALLOWED_VALUES = ({
+  details,
+  indexName,
+}: {
+  details: string;
+  indexName: string;
+}) =>
+  i18n.translate('ecsDataQualityDashboard.errorLoadingUnallowedValuesLabel', {
+    values: { details, indexName },
+    defaultMessage: 'Error loading unallowed values for index {indexName}: {details}',
+  });
+
+export const FIELDS = i18n.translate('ecsDataQualityDashboard.fieldsLabel', {
+  defaultMessage: 'Fields',
+});
+
+export const FROZEN_DESCRIPTION = i18n.translate('ecsDataQualityDashboard.frozenDescription', {
+  defaultMessage: `The index is no longer being updated and is queried rarely. The information still needs to be searchable, but it's okay if those queries are extremely slow.`,
+});
+
+export const FROZEN_PATTERN_TOOLTIP = ({
+  indices,
+  pattern,
+}: {
+  indices: number;
+  pattern: string;
+}) =>
+  i18n.translate('ecsDataQualityDashboard.frozenPatternTooltip', {
+    values: { indices, pattern },
+    defaultMessage: `{indices} {indices, plural, =1 {index} other {indices}} matching the {pattern} pattern {indices, plural, =1 {is} other {are}} frozen. Frozen indices are no longer being updated and are queried rarely. The information still needs to be searchable, but it's okay if those queries are extremely slow.`,
+  });
+
+export const HOT_DESCRIPTION = i18n.translate('ecsDataQualityDashboard.hotDescription', {
+  defaultMessage: 'The index is actively being updated and queried',
+});
+
+export const HOT_PATTERN_TOOLTIP = ({ indices, pattern }: { indices: number; pattern: string }) =>
+  i18n.translate('ecsDataQualityDashboard.hotPatternTooltip', {
+    values: { indices, pattern },
+    defaultMessage:
+      '{indices} {indices, plural, =1 {index} other {indices}} matching the {pattern} pattern {indices, plural, =1 {is} other {are}} hot. Hot indices are actively being updated and queried.',
+  });
+
+/** The tooltip for the `ILM phase` combo box on the Data Quality Dashboard */
+export const INDEX_LIFECYCLE_MANAGEMENT_PHASES: string = i18n.translate(
+  'ecsDataQualityDashboard.indexLifecycleManagementPhasesTooltip',
+  {
+    defaultMessage:
+      'Indices with these Index Lifecycle Management (ILM) phases will be checked for data quality',
+  }
+);
+
+export const INDEX_NAME = i18n.translate('ecsDataQualityDashboard.indexNameLabel', {
+  defaultMessage: 'Index name',
+});
+
+/** The label displayed for the `ILM phase` combo box on the Data Quality dashboard */
+export const ILM_PHASE: string = i18n.translate('ecsDataQualityDashboard.ilmPhaseLabel', {
+  defaultMessage: 'ILM phase',
+});
+
+export const LAST_CHECKED = i18n.translate('ecsDataQualityDashboard.lastCheckedLabel', {
+  defaultMessage: 'Last checked',
+});
+
+export const LOADING_ECS_METADATA = i18n.translate(
+  'ecsDataQualityDashboard.emptyLoadingPrompt.loadingEcsMetadataPrompt',
+  {
+    defaultMessage: 'Loading ECS metadata',
+  }
+);
+
+export const SELECT_AN_INDEX = i18n.translate('ecsDataQualityDashboard.selectAnIndexPrompt', {
+  defaultMessage: 'Select an index to compare it against ECS version',
+});
+
+/** The placeholder for the `ILM phase` combo box on the Data Quality Dashboard */
+export const SELECT_ONE_OR_MORE_ILM_PHASES: string = i18n.translate(
+  'ecsDataQualityDashboard.selectOneOrMorPhasesPlaceholder',
+  {
+    defaultMessage: 'Select one or more ILM phases',
+  }
+);
+
+export const TECHNICAL_PREVIEW = i18n.translate('ecsDataQualityDashboard.technicalPreviewBadge', {
+  defaultMessage: 'Technical preview',
+});
+
+export const TIMESTAMP_DESCRIPTION = i18n.translate(
+  'ecsDataQualityDashboard.timestampDescriptionLabel',
+  {
+    defaultMessage:
+      'Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events.',
+  }
+);
+
+export const UNMANAGED_DESCRIPTION = i18n.translate(
+  'ecsDataQualityDashboard.unmanagedDescription',
+  {
+    defaultMessage: `The index isn't managed by Index Lifecycle Management (ILM)`,
+  }
+);
+
+export const UNMANAGED_PATTERN_TOOLTIP = ({
+  indices,
+  pattern,
+}: {
+  indices: number;
+  pattern: string;
+}) =>
+  i18n.translate('ecsDataQualityDashboard.unmanagedPatternTooltip', {
+    values: { indices, pattern },
+    defaultMessage: `{indices} {indices, plural, =1 {index} other {indices}} matching the {pattern} pattern {indices, plural, =1 {is} other {are}} unmanaged by Index Lifecycle Management (ILM)`,
+  });
+
+export const WARM_DESCRIPTION = i18n.translate('ecsDataQualityDashboard.warmDescription', {
+  defaultMessage: 'The index is no longer being updated but is still being queried',
+});
+
+export const WARM_PATTERN_TOOLTIP = ({ indices, pattern }: { indices: number; pattern: string }) =>
+  i18n.translate('ecsDataQualityDashboard.warmPatternTooltip', {
+    values: { indices, pattern },
+    defaultMessage:
+      '{indices} {indices, plural, =1 {index} other {indices}} matching the {pattern} pattern {indices, plural, =1 {is} other {are}} warm. Warm indices are no longer being updated but are still being queried.',
+  });
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/types.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/types.ts
new file mode 100644
index 0000000000000..7a0ec3698a315
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/types.ts
@@ -0,0 +1,155 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  IlmExplainLifecycleLifecycleExplain,
+  IndicesGetMappingIndexMappingRecord,
+  IndicesStatsIndicesStats,
+} from '@elastic/elasticsearch/lib/api/types';
+
+export interface Mappings {
+  pattern: string;
+  indexes: Record<string, IndicesGetMappingIndexMappingRecord>;
+}
+
+export interface AllowedValue {
+  description?: string;
+  name?: string;
+}
+
+export interface EcsMetadata {
+  allowed_values?: AllowedValue[];
+  dashed_name?: string;
+  description?: string;
+  example?: string;
+  flat_name?: string;
+  level?: string;
+  name?: string;
+  required?: boolean;
+  short?: string;
+  type?: string;
+}
+
+export type EnrichedFieldMetadata = EcsMetadata & {
+  hasEcsMetadata: boolean;
+  indexFieldName: string;
+  indexFieldType: string;
+  indexInvalidValues: UnallowedValueCount[];
+  isEcsCompliant: boolean;
+};
+
+export interface PartitionedFieldMetadata {
+  all: EnrichedFieldMetadata[];
+  custom: EnrichedFieldMetadata[];
+  ecsCompliant: EnrichedFieldMetadata[];
+  incompatible: EnrichedFieldMetadata[];
+}
+
+export interface PartitionedFieldMetadataStats {
+  all: number;
+  custom: number;
+  ecsCompliant: number;
+  incompatible: number;
+}
+
+export interface UnallowedValueRequestItem {
+  allowedValues: string[];
+  indexFieldName: string;
+  indexName: string;
+}
+
+export interface Bucket {
+  key: string;
+  doc_count: number;
+}
+
+export interface UnallowedValueCount {
+  fieldName: string;
+  count: number;
+}
+
+export interface UnallowedValueSearchResult {
+  aggregations?: {
+    [x: string]: {
+      buckets?: Bucket[];
+    };
+  };
+}
+
+export type IlmPhase = 'hot' | 'warm' | 'cold' | 'frozen' | 'unmanaged';
+
+export interface IlmExplainPhaseCounts {
+  hot: number;
+  warm: number;
+  cold: number;
+  frozen: number;
+  unmanaged: number;
+}
+
+export interface DataQualityCheckResult {
+  docsCount: number | undefined;
+  error: string | null;
+  ilmPhase: IlmPhase | undefined;
+  incompatible: number | undefined;
+  indexName: string;
+  markdownComments: string[];
+  pattern: string;
+}
+
+export interface PatternRollup {
+  docsCount: number | undefined;
+  error: string | null;
+  ilmExplain: Record<string, IlmExplainLifecycleLifecycleExplain> | null;
+  ilmExplainPhaseCounts: IlmExplainPhaseCounts | undefined;
+  indices: number | undefined;
+  pattern: string;
+  results: Record<string, DataQualityCheckResult> | undefined;
+  stats: Record<string, IndicesStatsIndicesStats> | null;
+}
+
+export interface CheckIndexRequest {
+  pattern: string;
+  indexName: string;
+}
+
+export interface RequestQueueRequest<T> {
+  topicId: string;
+  request: T;
+}
+
+export interface RequestQueueResponse<T, U> {
+  topicId: string;
+  request: T;
+  response: U;
+}
+
+export interface IndexToCheck {
+  pattern: string;
+  indexName: string;
+}
+
+export type OnCheckCompleted = ({
+  error,
+  formatNumber,
+  indexName,
+  partitionedFieldMetadata,
+  pattern,
+  version,
+}: {
+  error: string | null;
+  formatNumber: (value: number | undefined) => string;
+  indexName: string;
+  partitionedFieldMetadata: PartitionedFieldMetadata | null;
+  pattern: string;
+  version: string;
+}) => void;
+
+export interface ErrorSummary {
+  error: string;
+  indexName: string | null;
+  pattern: string;
+}
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_add_to_new_case/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_add_to_new_case/index.tsx
new file mode 100644
index 0000000000000..b011259c6d81f
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_add_to_new_case/index.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useMemo } from 'react';
+
+import * as i18n from './translations';
+
+interface Props {
+  canUserCreateAndReadCases: () => boolean;
+  indexName?: string;
+  onClick?: () => void;
+  openCreateCaseFlyout: ({
+    comments,
+    headerContent,
+  }: {
+    comments: string[];
+    headerContent?: React.ReactNode;
+  }) => void;
+}
+
+export const useAddToNewCase = ({
+  canUserCreateAndReadCases,
+  indexName,
+  onClick,
+  openCreateCaseFlyout,
+}: Props): {
+  disabled: boolean;
+  onAddToNewCase: (markdownComments: string[]) => void;
+} => {
+  const headerContent = useMemo(
+    () => (
+      <div>
+        {indexName != null
+          ? i18n.CREATE_A_DATA_QUALITY_CASE_FOR_INDEX(indexName)
+          : i18n.CREATE_A_DATA_QUALITY_CASE}
+      </div>
+    ),
+    [indexName]
+  );
+
+  const onAddToNewCase = useCallback(
+    (markdownComments: string[]) => {
+      if (onClick) {
+        onClick();
+      }
+
+      openCreateCaseFlyout({ comments: markdownComments, headerContent });
+    },
+    [headerContent, onClick, openCreateCaseFlyout]
+  );
+
+  return {
+    disabled: !canUserCreateAndReadCases(),
+    onAddToNewCase,
+  };
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_add_to_new_case/translations.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_add_to_new_case/translations.ts
new file mode 100644
index 0000000000000..aadb58c56996b
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_add_to_new_case/translations.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ADD_TO_CASE_SUCCESS = i18n.translate('ecsDataQualityDashboard.addToCaseSuccessToast', {
+  defaultMessage: 'Successfully added data quality results to the case',
+});
+
+export const CREATE_A_DATA_QUALITY_CASE = i18n.translate(
+  'ecsDataQualityDashboard.createADataQualityCaseHeaderText',
+  {
+    defaultMessage: 'Create a data quality case',
+  }
+);
+
+export const CREATE_A_DATA_QUALITY_CASE_FOR_INDEX = (indexName: string) =>
+  i18n.translate('ecsDataQualityDashboard.createADataQualityCaseForIndexHeaderText', {
+    values: { indexName },
+    defaultMessage: 'Create a data quality case for index {indexName}',
+  });
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_ilm_explain/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_ilm_explain/index.tsx
new file mode 100644
index 0000000000000..72d75408301ab
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_ilm_explain/index.tsx
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IlmExplainLifecycleLifecycleExplain } from '@elastic/elasticsearch/lib/api/types';
+import { useEffect, useState } from 'react';
+
+import * as i18n from '../translations';
+
+const ILM_EXPLAIN_ENDPOINT = '/internal/ecs_data_quality_dashboard/ilm_explain';
+
+interface UseIlmExplain {
+  ilmExplain: Record<string, IlmExplainLifecycleLifecycleExplain> | null;
+  error: string | null;
+  loading: boolean;
+}
+
+export const useIlmExplain = (pattern: string): UseIlmExplain => {
+  const [ilmExplain, setIlmExplain] = useState<Record<
+    string,
+    IlmExplainLifecycleLifecycleExplain
+  > | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState<boolean>(true);
+
+  useEffect(() => {
+    const abortController = new AbortController();
+
+    async function fetchData() {
+      try {
+        const encodedIndexName = encodeURIComponent(`${pattern}`);
+
+        const response = await fetch(`${ILM_EXPLAIN_ENDPOINT}/${encodedIndexName}`, {
+          method: 'GET',
+          signal: abortController.signal,
+        });
+
+        if (response.ok) {
+          const json = await response.json();
+
+          if (!abortController.signal.aborted) {
+            setIlmExplain(json);
+          }
+        } else {
+          throw new Error(response.statusText);
+        }
+      } catch (e) {
+        if (!abortController.signal.aborted) {
+          setError(i18n.ERROR_LOADING_ILM_EXPLAIN(e));
+        }
+      } finally {
+        if (!abortController.signal.aborted) {
+          setLoading(false);
+        }
+      }
+    }
+
+    fetchData();
+
+    return () => {
+      abortController.abort();
+    };
+  }, [pattern, setError]);
+
+  return { ilmExplain, error, loading };
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_mappings/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_mappings/helpers.ts
new file mode 100644
index 0000000000000..57d7787bbfee9
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_mappings/helpers.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IndicesGetMappingIndexMappingRecord } from '@elastic/elasticsearch/lib/api/types';
+
+import * as i18n from '../translations';
+
+export const MAPPINGS_API_ROUTE = '/internal/ecs_data_quality_dashboard/mappings';
+
+export async function fetchMappings({
+  abortController,
+  patternOrIndexName,
+}: {
+  abortController: AbortController;
+  patternOrIndexName: string;
+}): Promise<Record<string, IndicesGetMappingIndexMappingRecord>> {
+  const encodedIndexName = encodeURIComponent(`${patternOrIndexName}`);
+
+  const response = await fetch(`${MAPPINGS_API_ROUTE}/${encodedIndexName}`, {
+    method: 'GET',
+    signal: abortController.signal,
+  });
+
+  if (response.ok) {
+    return response.json();
+  }
+
+  throw new Error(
+    i18n.ERROR_LOADING_MAPPINGS({ details: response.statusText, patternOrIndexName })
+  );
+}
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_mappings/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_mappings/index.tsx
new file mode 100644
index 0000000000000..09c47bb5532d7
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_mappings/index.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IndicesGetMappingIndexMappingRecord } from '@elastic/elasticsearch/lib/api/types';
+import { useEffect, useState } from 'react';
+
+import * as i18n from '../translations';
+
+import { fetchMappings } from './helpers';
+
+interface UseMappings {
+  indexes: Record<string, IndicesGetMappingIndexMappingRecord> | null;
+  error: string | null;
+  loading: boolean;
+}
+
+export const useMappings = (patternOrIndexName: string): UseMappings => {
+  const [indexes, setIndexes] = useState<Record<
+    string,
+    IndicesGetMappingIndexMappingRecord
+  > | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState<boolean>(true);
+
+  useEffect(() => {
+    const abortController = new AbortController();
+
+    async function fetchData() {
+      try {
+        setIndexes(await fetchMappings({ abortController, patternOrIndexName }));
+      } catch (e) {
+        if (!abortController.signal.aborted) {
+          setError(i18n.ERROR_LOADING_MAPPINGS({ details: e, patternOrIndexName }));
+        }
+      } finally {
+        if (!abortController.signal.aborted) {
+          setLoading(false);
+        }
+      }
+    }
+
+    fetchData();
+
+    return () => {
+      abortController.abort();
+    };
+  }, [patternOrIndexName, setError]);
+
+  return { indexes, error, loading };
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_results_rollup/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_results_rollup/helpers.ts
new file mode 100644
index 0000000000000..995ac8eac86c4
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_results_rollup/helpers.ts
@@ -0,0 +1,135 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getIndexDocsCountFromRollup } from '../data_quality_panel/data_quality_summary/summary_actions/check_all/helpers';
+import { getIlmPhase } from '../data_quality_panel/pattern/helpers';
+import { getAllIncompatibleMarkdownComments } from '../data_quality_panel/tabs/incompatible_tab/helpers';
+import { getTotalPatternIncompatible, getTotalPatternIndicesChecked } from '../helpers';
+import type { IlmPhase, PartitionedFieldMetadata, PatternRollup } from '../types';
+
+export const getTotalIndices = (
+  patternRollups: Record<string, PatternRollup>
+): number | undefined => {
+  const allRollups = Object.values(patternRollups);
+  const allRollupsHaveIndices = allRollups.every(({ indices }) => Number.isInteger(indices));
+
+  // only return the total when all `PatternRollup`s have a `indices`:
+  return allRollupsHaveIndices
+    ? allRollups.reduce((acc, { indices }) => acc + (indices ?? 0), 0)
+    : undefined;
+};
+
+export const getTotalDocsCount = (
+  patternRollups: Record<string, PatternRollup>
+): number | undefined => {
+  const allRollups = Object.values(patternRollups);
+  const allRollupsHaveDocsCount = allRollups.every(({ docsCount }) => Number.isInteger(docsCount));
+
+  // only return the total when all `PatternRollup`s have a `docsCount`:
+  return allRollupsHaveDocsCount
+    ? allRollups.reduce((acc, { docsCount }) => acc + (docsCount ?? 0), 0)
+    : undefined;
+};
+
+export const getTotalIncompatible = (
+  patternRollups: Record<string, PatternRollup>
+): number | undefined => {
+  const allRollups = Object.values(patternRollups);
+  const anyRollupsHaveResults = allRollups.some(({ results }) => results != null);
+
+  // only return the total when at least one `PatternRollup` has results:
+  return anyRollupsHaveResults
+    ? allRollups.reduce((acc, { results }) => acc + (getTotalPatternIncompatible(results) ?? 0), 0)
+    : undefined;
+};
+
+export const getTotalIndicesChecked = (patternRollups: Record<string, PatternRollup>): number => {
+  const allRollups = Object.values(patternRollups);
+
+  return allRollups.reduce(
+    (acc, patternRollup) => acc + getTotalPatternIndicesChecked(patternRollup),
+    0
+  );
+};
+
+export const onPatternRollupUpdated = ({
+  patternRollup,
+  patternRollups,
+}: {
+  patternRollup: PatternRollup;
+  patternRollups: Record<string, PatternRollup>;
+}): Record<string, PatternRollup> => ({
+  ...patternRollups,
+  [patternRollup.pattern]: patternRollup,
+});
+
+export const updateResultOnCheckCompleted = ({
+  error,
+  formatNumber,
+  indexName,
+  partitionedFieldMetadata,
+  pattern,
+  patternRollups,
+}: {
+  error: string | null;
+  formatNumber: (value: number | undefined) => string;
+  indexName: string;
+  partitionedFieldMetadata: PartitionedFieldMetadata | null;
+  pattern: string;
+  patternRollups: Record<string, PatternRollup>;
+}): Record<string, PatternRollup> => {
+  const patternRollup: PatternRollup | undefined = patternRollups[pattern];
+
+  if (patternRollup != null) {
+    const ilmExplain = patternRollup.ilmExplain ?? null;
+
+    const ilmPhase: IlmPhase | undefined =
+      ilmExplain != null ? getIlmPhase(ilmExplain[indexName]) : undefined;
+
+    const docsCount = getIndexDocsCountFromRollup({
+      indexName,
+      patternRollup,
+    });
+
+    const patternDocsCount = patternRollup.docsCount ?? 0;
+
+    const markdownComments =
+      partitionedFieldMetadata != null
+        ? getAllIncompatibleMarkdownComments({
+            docsCount,
+            formatNumber,
+            ilmPhase,
+            indexName,
+            partitionedFieldMetadata,
+            patternDocsCount,
+          })
+        : [];
+
+    const incompatible = partitionedFieldMetadata?.incompatible.length;
+
+    return {
+      ...patternRollups,
+      [pattern]: {
+        ...patternRollup,
+        results: {
+          ...(patternRollup.results ?? {}),
+          [indexName]: {
+            docsCount,
+            error,
+            ilmPhase,
+            incompatible,
+            indexName,
+            markdownComments,
+            pattern,
+          },
+        },
+      },
+    };
+  } else {
+    return patternRollups;
+  }
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_results_rollup/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_results_rollup/index.tsx
new file mode 100644
index 0000000000000..da5745deaa3cd
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_results_rollup/index.tsx
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useEffect, useMemo, useState } from 'react';
+
+interface Props {
+  ilmPhases: string[];
+  patterns: string[];
+}
+
+import {
+  getTotalDocsCount,
+  getTotalIncompatible,
+  getTotalIndices,
+  getTotalIndicesChecked,
+  onPatternRollupUpdated,
+  updateResultOnCheckCompleted,
+} from './helpers';
+
+import type { OnCheckCompleted, PartitionedFieldMetadata, PatternRollup } from '../types';
+
+interface UseResultsRollup {
+  onCheckCompleted: OnCheckCompleted;
+  patternIndexNames: Record<string, string[]>;
+  patternRollups: Record<string, PatternRollup>;
+  totalDocsCount: number | undefined;
+  totalIncompatible: number | undefined;
+  totalIndices: number | undefined;
+  totalIndicesChecked: number | undefined;
+  updatePatternIndexNames: ({
+    indexNames,
+    pattern,
+  }: {
+    indexNames: string[];
+    pattern: string;
+  }) => void;
+  updatePatternRollup: (patternRollup: PatternRollup) => void;
+}
+
+export const useResultsRollup = ({ ilmPhases, patterns }: Props): UseResultsRollup => {
+  const [patternIndexNames, setPatternIndexNames] = useState<Record<string, string[]>>({});
+  const [patternRollups, setPatternRollups] = useState<Record<string, PatternRollup>>({});
+
+  const updatePatternRollup = useCallback((patternRollup: PatternRollup) => {
+    setPatternRollups((current) =>
+      onPatternRollupUpdated({ patternRollup, patternRollups: current })
+    );
+  }, []);
+
+  const totalDocsCount = useMemo(() => getTotalDocsCount(patternRollups), [patternRollups]);
+  const totalIncompatible = useMemo(() => getTotalIncompatible(patternRollups), [patternRollups]);
+  const totalIndices = useMemo(() => getTotalIndices(patternRollups), [patternRollups]);
+  const totalIndicesChecked = useMemo(
+    () => getTotalIndicesChecked(patternRollups),
+    [patternRollups]
+  );
+
+  const updatePatternIndexNames = useCallback(
+    ({ indexNames, pattern }: { indexNames: string[]; pattern: string }) => {
+      setPatternIndexNames((current) => ({
+        ...current,
+        [pattern]: indexNames,
+      }));
+    },
+    []
+  );
+
+  const onCheckCompleted: OnCheckCompleted = useCallback(
+    ({
+      error,
+      formatNumber,
+      indexName,
+      partitionedFieldMetadata,
+      pattern,
+    }: {
+      error: string | null;
+      formatNumber: (value: number | undefined) => string;
+      indexName: string;
+      partitionedFieldMetadata: PartitionedFieldMetadata | null;
+      pattern: string;
+    }) => {
+      setPatternRollups((current) =>
+        updateResultOnCheckCompleted({
+          error,
+          formatNumber,
+          indexName,
+          partitionedFieldMetadata,
+          pattern,
+          patternRollups: current,
+        })
+      );
+    },
+    []
+  );
+
+  useEffect(() => {
+    // reset all state
+    setPatternRollups({});
+    setPatternIndexNames({});
+  }, [ilmPhases, patterns]);
+
+  return {
+    onCheckCompleted,
+    patternIndexNames,
+    patternRollups,
+    totalDocsCount,
+    totalIncompatible,
+    totalIndices,
+    totalIndicesChecked,
+    updatePatternIndexNames,
+    updatePatternRollup,
+  };
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_stats/index.tsx b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_stats/index.tsx
new file mode 100644
index 0000000000000..d2c39e70fb9c9
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_stats/index.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IndicesStatsIndicesStats } from '@elastic/elasticsearch/lib/api/types';
+import { useEffect, useState } from 'react';
+
+import * as i18n from '../translations';
+
+const STATS_ENDPOINT = '/internal/ecs_data_quality_dashboard/stats';
+
+interface UseStats {
+  stats: Record<string, IndicesStatsIndicesStats> | null;
+  error: string | null;
+  loading: boolean;
+}
+
+export const useStats = (pattern: string): UseStats => {
+  const [stats, setStats] = useState<Record<string, IndicesStatsIndicesStats> | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState<boolean>(true);
+
+  useEffect(() => {
+    const abortController = new AbortController();
+
+    async function fetchData() {
+      try {
+        const encodedIndexName = encodeURIComponent(`${pattern}`);
+
+        const response = await fetch(`${STATS_ENDPOINT}/${encodedIndexName}`, {
+          method: 'GET',
+          signal: abortController.signal,
+        });
+
+        if (response.ok) {
+          const json = await response.json();
+
+          if (!abortController.signal.aborted) {
+            setStats(json);
+          }
+        } else {
+          throw new Error(response.statusText);
+        }
+      } catch (e) {
+        if (!abortController.signal.aborted) {
+          setError(i18n.ERROR_LOADING_STATS(e));
+        }
+      } finally {
+        if (!abortController.signal.aborted) {
+          setLoading(false);
+        }
+      }
+    }
+
+    fetchData();
+
+    return () => {
+      abortController.abort();
+    };
+  }, [pattern, setError]);
+
+  return { stats, error, loading };
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_unallowed_values/helpers.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_unallowed_values/helpers.ts
new file mode 100644
index 0000000000000..1fa8991ce9264
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_unallowed_values/helpers.ts
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as i18n from '../translations';
+import type {
+  Bucket,
+  UnallowedValueCount,
+  UnallowedValueRequestItem,
+  UnallowedValueSearchResult,
+} from '../types';
+
+const UNALLOWED_VALUES_API_ROUTE = '/internal/ecs_data_quality_dashboard/unallowed_field_values';
+
+export const isBucket = (maybeBucket: unknown): maybeBucket is Bucket =>
+  typeof (maybeBucket as Bucket).key === 'string' &&
+  typeof (maybeBucket as Bucket).doc_count === 'number';
+
+// eslint-disable-next-line @typescript-eslint/naming-convention
+export const getUnallowedValueCount = ({ doc_count, key }: Bucket): UnallowedValueCount => ({
+  count: doc_count,
+  fieldName: key,
+});
+
+export const getUnallowedValues = ({
+  requestItems,
+  searchResults,
+}: {
+  requestItems: UnallowedValueRequestItem[];
+  searchResults: UnallowedValueSearchResult[] | null;
+}): Record<string, UnallowedValueCount[]> => {
+  if (searchResults == null || !Array.isArray(searchResults)) {
+    return {};
+  }
+
+  return requestItems.reduce((acc, { indexFieldName }) => {
+    const searchResult = searchResults.find(
+      (x) =>
+        typeof x.aggregations === 'object' && Array.isArray(x.aggregations[indexFieldName]?.buckets)
+    );
+
+    if (
+      searchResult != null &&
+      searchResult.aggregations != null &&
+      searchResult.aggregations[indexFieldName] != null
+    ) {
+      const buckets = searchResult.aggregations[indexFieldName]?.buckets;
+
+      return {
+        ...acc,
+        [indexFieldName]: buckets?.flatMap((x) => (isBucket(x) ? getUnallowedValueCount(x) : [])),
+      };
+    } else {
+      return {
+        ...acc,
+        [indexFieldName]: [],
+      };
+    }
+  }, {});
+};
+
+export async function fetchUnallowedValues({
+  abortController,
+  indexName,
+  requestItems,
+}: {
+  abortController: AbortController;
+  indexName: string;
+  requestItems: UnallowedValueRequestItem[];
+}): Promise<UnallowedValueSearchResult[]> {
+  const response = await fetch(UNALLOWED_VALUES_API_ROUTE, {
+    body: JSON.stringify(requestItems),
+    headers: { 'Content-Type': 'application/json', 'kbn-xsrf': 'xsrf' },
+    method: 'POST',
+    signal: abortController.signal,
+  });
+
+  if (response.ok) {
+    return response.json();
+  }
+
+  throw new Error(
+    i18n.ERROR_LOADING_UNALLOWED_VALUES({
+      details: response.statusText,
+      indexName,
+    })
+  );
+}
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_unallowed_values/index.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_unallowed_values/index.ts
new file mode 100644
index 0000000000000..744cc344cea12
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/use_unallowed_values/index.ts
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useEffect, useState } from 'react';
+
+import { fetchUnallowedValues, getUnallowedValues } from './helpers';
+import type { UnallowedValueCount, UnallowedValueRequestItem } from '../types';
+
+interface UseUnallowedValues {
+  unallowedValues: Record<string, UnallowedValueCount[]> | null;
+  error: string | null;
+  loading: boolean;
+}
+
+export const useUnallowedValues = ({
+  indexName,
+  requestItems,
+}: {
+  indexName: string;
+  requestItems: UnallowedValueRequestItem[];
+}): UseUnallowedValues => {
+  const [unallowedValues, setUnallowedValues] = useState<Record<
+    string,
+    UnallowedValueCount[]
+  > | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState<boolean>(true);
+
+  useEffect(() => {
+    if (requestItems.length === 0) {
+      return;
+    }
+
+    const abortController = new AbortController();
+
+    async function fetchData() {
+      try {
+        // if (indexName === '.ds-logs-endpoint.alerts-default-2023.01.17-000001') {
+        //   throw new Error(
+        //     'simulated useUnallowedValues failure just for .ds-logs-endpoint.alerts-default-2023.01.17-000001'
+        //   );
+        // }
+
+        const searchResults = await fetchUnallowedValues({
+          abortController,
+          indexName,
+          requestItems,
+        });
+
+        const unallowedValuesMap = getUnallowedValues({
+          requestItems,
+          searchResults,
+        });
+
+        if (!abortController.signal.aborted) {
+          setUnallowedValues(unallowedValuesMap);
+        }
+      } catch (e) {
+        if (!abortController.signal.aborted) {
+          setError(e);
+        }
+      } finally {
+        if (!abortController.signal.aborted) {
+          setLoading(false);
+        }
+      }
+    }
+
+    fetchData();
+
+    return () => {
+      abortController.abort();
+    };
+  }, [indexName, requestItems, setError]);
+
+  return { unallowedValues, error, loading };
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/index.ts b/x-pack/packages/kbn-ecs-data-quality-dashboard/index.ts
new file mode 100644
index 0000000000000..6e5f3c69f14c4
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/index.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { DataQualityPanel } from './impl/data_quality';
+
+export { getIlmPhaseDescription } from './impl/data_quality/helpers';
+
+export {
+  DATA_QUALITY_SUBTITLE,
+  ILM_PHASE,
+  INDEX_LIFECYCLE_MANAGEMENT_PHASES,
+  SELECT_ONE_OR_MORE_ILM_PHASES,
+} from './impl/data_quality/translations';
+
+export { ECS_REFERENCE_URL } from './impl/data_quality/data_quality_panel/index_properties/markdown/helpers';
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/jest.config.js b/x-pack/packages/kbn-ecs-data-quality-dashboard/jest.config.js
new file mode 100644
index 0000000000000..5f6465bb21a52
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/jest.config.js
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../..',
+  roots: ['<rootDir>/x-pack/packages/kbn-ecs-data-quality-dashboard'],
+};
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/kibana.jsonc b/x-pack/packages/kbn-ecs-data-quality-dashboard/kibana.jsonc
new file mode 100644
index 0000000000000..a001420fade88
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-browser",
+  "id": "@kbn/ecs-data-quality-dashboard",
+  "owner": "@elastic/security-threat-hunting-investigations"
+}
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/package.json b/x-pack/packages/kbn-ecs-data-quality-dashboard/package.json
new file mode 100644
index 0000000000000..657b31b0f8e8c
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/ecs-data-quality-dashboard",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}
\ No newline at end of file
diff --git a/x-pack/packages/kbn-ecs-data-quality-dashboard/tsconfig.json b/x-pack/packages/kbn-ecs-data-quality-dashboard/tsconfig.json
new file mode 100644
index 0000000000000..ddb539c293a2b
--- /dev/null
+++ b/x-pack/packages/kbn-ecs-data-quality-dashboard/tsconfig.json
@@ -0,0 +1,23 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node",
+      "react"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/ecs",
+    "@kbn/i18n",
+    "@kbn/ui-theme",
+  ]
+}
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/README.md b/x-pack/plugins/ecs_data_quality_dashboard/README.md
new file mode 100755
index 0000000000000..78c68dc00035d
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/README.md
@@ -0,0 +1,10 @@
+# ECS Data Quality Dashboard
+
+This plugin implements (server) APIs used to render the content of the _Data Quality_ dashboard.
+
+- The Data Quality dashboard checks the mappings and values in indices for [ECS](https://github.com/elastic/ecs) compliance
+- Results are added to a new case, or exported as markdown
+
+## Maintainers
+
+Maintained by the Security Solution _Threat Hunting Investigations_ team
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/common/constants.ts b/x-pack/plugins/ecs_data_quality_dashboard/common/constants.ts
new file mode 100755
index 0000000000000..51455c071b519
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/common/constants.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const PLUGIN_ID = 'ecsDataQualityDashboard';
+export const PLUGIN_NAME = 'ecsDataQualityDashboard';
+
+export const BASE_PATH = '/internal/ecs_data_quality_dashboard';
+export const GET_INDEX_STATS = `${BASE_PATH}/stats/{pattern}`;
+export const GET_INDEX_MAPPINGS = `${BASE_PATH}/mappings/{pattern}`;
+export const GET_UNALLOWED_FIELD_VALUES = `${BASE_PATH}/unallowed_field_values`;
+export const GET_ILM_EXPLAIN = `${BASE_PATH}/ilm_explain/{pattern}`;
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/jest.config.js b/x-pack/plugins/ecs_data_quality_dashboard/jest.config.js
new file mode 100644
index 0000000000000..cc9c79fe6d1e5
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/jest.config.js
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+module.exports = {
+  collectCoverageFrom: [
+    '<rootDir>/x-pack/plugins/ecs_data_quality_dashboard/{common,lib,server}/**/*.{ts,tsx}',
+  ],
+  coverageDirectory:
+    '<rootDir>/target/kibana-coverage/jest/x-pack/plugins/ecs_data_quality_dashboard',
+  coverageReporters: ['text', 'html'],
+  rootDir: '../../..',
+  roots: ['<rootDir>/x-pack/plugins/ecs_data_quality_dashboard'],
+  preset: '@kbn/test',
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/kibana.json b/x-pack/plugins/ecs_data_quality_dashboard/kibana.json
new file mode 100755
index 0000000000000..f4637e0775b43
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/kibana.json
@@ -0,0 +1,14 @@
+{
+  "description": "APIs used to assess the quality of data in Elasticsearch indexes",
+  "id": "ecsDataQualityDashboard",
+  "kibanaVersion": "kibana",
+  "optionalPlugins": [],
+  "owner": {
+    "githubTeam": "security-threat-hunting-investigations",
+    "name": "Threat Hunting Investigations"
+  },
+  "requiredPlugins": ["data"],
+  "server": true,
+  "ui": false,
+  "version": "1.0.0"
+}
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/request.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/request.ts
new file mode 100644
index 0000000000000..827f08683e0b8
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/request.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { httpServerMock } from '@kbn/core/server/mocks';
+
+export const requestMock = {
+  create: httpServerMock.createKibanaRequest,
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/request_context.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/request_context.ts
new file mode 100644
index 0000000000000..19fb44f7f8bac
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/request_context.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { coreMock } from '@kbn/core/server/mocks';
+import { licensingMock } from '@kbn/licensing-plugin/server/mocks';
+
+export const createMockClients = () => {
+  const core = coreMock.createRequestHandlerContext();
+  const license = licensingMock.createLicenseMock();
+
+  return {
+    core,
+    clusterClient: core.elasticsearch.client,
+    savedObjectsClient: core.savedObjects.client,
+
+    licensing: {
+      ...licensingMock.createRequestHandlerContext({ license }),
+      license,
+    },
+
+    config: createMockConfig(),
+    appClient: createAppClientMock(),
+  };
+};
+
+type MockClients = ReturnType<typeof createMockClients>;
+
+const convertRequestContextMock = <T>(context: T) => {
+  return coreMock.createCustomRequestHandlerContext(context);
+};
+
+const createMockConfig = () => ({});
+
+const createAppClientMock = () => ({});
+
+const createRequestContextMock = (clients: MockClients = createMockClients()) => {
+  return {
+    core: clients.core,
+  };
+};
+
+const createTools = () => {
+  const clients = createMockClients();
+  const context = createRequestContextMock(clients);
+
+  return { clients, context };
+};
+
+export const requestContextMock = {
+  create: createRequestContextMock,
+  convertContext: convertRequestContextMock,
+  createTools,
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/response.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/response.ts
new file mode 100644
index 0000000000000..8efe2407f2245
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/response.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { httpServerMock } from '@kbn/core/server/mocks';
+
+export const responseMock = {
+  create: httpServerMock.createResponseFactory,
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts
new file mode 100644
index 0000000000000..7ac44e1beedf1
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { httpServiceMock } from '@kbn/core/server/mocks';
+import type { RequestHandler, RouteConfig, KibanaRequest } from '@kbn/core/server';
+import type { RequestHandlerContext } from '@kbn/core-http-request-handler-context-server';
+
+import { requestMock } from './request';
+import { responseMock as responseFactoryMock } from './response';
+import { requestContextMock } from './request_context';
+import { responseAdapter } from './test_adapters';
+
+interface Route {
+  config: RouteConfig<unknown, unknown, unknown, 'get' | 'post' | 'delete' | 'patch' | 'put'>;
+  handler: RequestHandler;
+}
+
+const getRoute = (routerMock: MockServer['router']): Route => {
+  const routeCalls = [
+    ...routerMock.get.mock.calls,
+    ...routerMock.post.mock.calls,
+    ...routerMock.put.mock.calls,
+    ...routerMock.patch.mock.calls,
+    ...routerMock.delete.mock.calls,
+  ];
+
+  const [route] = routeCalls;
+  if (!route) {
+    throw new Error('No route registered!');
+  }
+
+  const [config, handler] = route;
+  return { config, handler };
+};
+
+const buildResultMock = () => ({ ok: jest.fn((x) => x), badRequest: jest.fn((x) => x) });
+
+class MockServer {
+  constructor(
+    public readonly router = httpServiceMock.createRouter(),
+    private responseMock = responseFactoryMock.create(),
+    private contextMock = requestContextMock.convertContext(requestContextMock.create()),
+    private resultMock = buildResultMock()
+  ) {}
+
+  public validate(request: KibanaRequest) {
+    this.validateRequest(request);
+    return this.resultMock;
+  }
+
+  public async inject(request: KibanaRequest, context: RequestHandlerContext = this.contextMock) {
+    const validatedRequest = this.validateRequest(request);
+    const [rejection] = this.resultMock.badRequest.mock.calls;
+    if (rejection) {
+      throw new Error(`Request was rejected with message: '${rejection}'`);
+    }
+
+    await this.getRoute().handler(context, validatedRequest, this.responseMock);
+    return responseAdapter(this.responseMock);
+  }
+
+  private getRoute(): Route {
+    return getRoute(this.router);
+  }
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  private maybeValidate(part: any, validator?: any): any {
+    return typeof validator === 'function' ? validator(part, this.resultMock) : part;
+  }
+
+  private validateRequest(request: KibanaRequest): KibanaRequest {
+    const validations = this.getRoute().config.validate;
+    if (!validations) {
+      return request;
+    }
+
+    const validatedRequest = requestMock.create({
+      path: request.route.path,
+      method: request.route.method,
+      body: this.maybeValidate(request.body, validations.body),
+      query: this.maybeValidate(request.query, validations.query),
+      params: this.maybeValidate(request.params, validations.params),
+    });
+
+    return validatedRequest;
+  }
+}
+const createMockServer = () => new MockServer();
+
+export const serverMock = {
+  create: createMockServer,
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/test_adapters.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/test_adapters.ts
new file mode 100644
index 0000000000000..4de81ca931692
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/test_adapters.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { responseMock } from './response';
+
+type ResponseMock = ReturnType<typeof responseMock.create>;
+type Method = keyof ResponseMock;
+
+type MockCall = any; // eslint-disable-line @typescript-eslint/no-explicit-any
+
+interface ResponseCall {
+  body: any; // eslint-disable-line @typescript-eslint/no-explicit-any
+  status: number;
+}
+
+/**
+ * @internal
+ */
+export interface Response extends ResponseCall {
+  calls: ResponseCall[];
+}
+
+const buildResponses = (method: Method, calls: MockCall[]): ResponseCall[] => {
+  if (!calls.length) return [];
+
+  switch (method) {
+    case 'ok':
+      return calls.map(([call]) => ({ status: 200, body: call.body }));
+    case 'custom':
+      return calls.map(([call]) => ({
+        status: call.statusCode,
+        body: JSON.parse(call.body),
+      }));
+    case 'customError':
+      return calls.map(([call]) => ({
+        status: call.statusCode,
+        body: call.body,
+      }));
+    default:
+      throw new Error(`Encountered unexpected call to response.${method}`);
+  }
+};
+
+export const responseAdapter = (response: ResponseMock): Response => {
+  const methods = Object.keys(response) as Method[];
+  const calls = methods
+    .reduce<Response['calls']>((responses, method) => {
+      const methodMock = response[method];
+      return [...responses, ...buildResponses(method, methodMock.mock.calls)];
+    }, [])
+    .sort((call, other) => other.status - call.status);
+
+  const [{ body, status }] = calls;
+
+  return {
+    body,
+    status,
+    calls,
+  };
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/helpers/get_unallowed_field_requests.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/helpers/get_unallowed_field_requests.test.ts
new file mode 100644
index 0000000000000..32ab83c1ccee2
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/helpers/get_unallowed_field_requests.test.ts
@@ -0,0 +1,112 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getMSearchRequestBody, getMSearchRequestHeader } from './get_unallowed_field_requests';
+
+describe('getMSearchRequest', () => {
+  test('getMSearchRequestHeader', () => {
+    expect(getMSearchRequestHeader('auditbeat')).toMatchInlineSnapshot(`
+      Object {
+        "expand_wildcards": Array [
+          "open",
+        ],
+        "index": "auditbeat",
+      }
+    `);
+  });
+
+  test('getMSearchRequestBody', () => {
+    expect(
+      getMSearchRequestBody({
+        indexName: 'auditbeat',
+        indexFieldName: 'event.category',
+        allowedValues: ['process'],
+      })
+    ).toMatchInlineSnapshot(`
+      Object {
+        "aggregations": Object {
+          "event.category": Object {
+            "terms": Object {
+              "field": "event.category",
+              "order": Object {
+                "_count": "desc",
+              },
+            },
+          },
+        },
+        "query": Object {
+          "bool": Object {
+            "filter": Array [
+              Object {
+                "bool": Object {
+                  "filter": Array [],
+                  "must": Array [],
+                  "must_not": Array [
+                    Object {
+                      "bool": Object {
+                        "minimum_should_match": 1,
+                        "should": Array [
+                          Object {
+                            "match_phrase": Object {
+                              "event.category": "process",
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  ],
+                  "should": Array [],
+                },
+              },
+            ],
+          },
+        },
+        "runtime_mappings": Object {},
+        "size": 0,
+      }
+    `);
+  });
+
+  test('getMSearchRequestBody - without allowedValues', () => {
+    expect(
+      getMSearchRequestBody({
+        indexName: 'auditbeat',
+        indexFieldName: 'event.category',
+        allowedValues: [],
+      })
+    ).toMatchInlineSnapshot(`
+      Object {
+        "aggregations": Object {
+          "event.category": Object {
+            "terms": Object {
+              "field": "event.category",
+              "order": Object {
+                "_count": "desc",
+              },
+            },
+          },
+        },
+        "query": Object {
+          "bool": Object {
+            "filter": Array [
+              Object {
+                "bool": Object {
+                  "filter": Array [],
+                  "must": Array [],
+                  "must_not": Array [],
+                  "should": Array [],
+                },
+              },
+            ],
+          },
+        },
+        "runtime_mappings": Object {},
+        "size": 0,
+      }
+    `);
+  });
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/helpers/get_unallowed_field_requests.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/helpers/get_unallowed_field_requests.ts
new file mode 100644
index 0000000000000..c5b30da92295e
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/helpers/get_unallowed_field_requests.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  MsearchMultisearchHeader,
+  MsearchMultisearchBody,
+} from '@elastic/elasticsearch/lib/api/types';
+import { AllowedValuesInputs } from '../schemas/get_unallowed_field_values';
+
+export const getMSearchRequestHeader = (indexName: string): MsearchMultisearchHeader => ({
+  expand_wildcards: ['open'],
+  index: indexName,
+});
+
+export const getMSearchRequestBody = ({
+  indexName,
+  indexFieldName,
+  allowedValues,
+}: {
+  indexName: string;
+  indexFieldName: string;
+  allowedValues: AllowedValuesInputs;
+}): MsearchMultisearchBody => ({
+  aggregations: {
+    [indexFieldName]: {
+      terms: {
+        field: indexFieldName,
+        order: {
+          _count: 'desc',
+        },
+      },
+    },
+  },
+  query: {
+    bool: {
+      filter: [
+        {
+          bool: {
+            must: [],
+            filter: [],
+            should: [],
+            must_not:
+              allowedValues.length > 0
+                ? [
+                    {
+                      bool: {
+                        should: allowedValues.map((allowedValue) => ({
+                          match_phrase: {
+                            [indexFieldName]: allowedValue,
+                          },
+                        })),
+                        minimum_should_match: 1,
+                      },
+                    },
+                  ]
+                : [],
+          },
+        },
+      ],
+    },
+  },
+  runtime_mappings: {},
+  size: 0,
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/index.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/index.ts
new file mode 100755
index 0000000000000..e7b580e50a762
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/index.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { PluginInitializerContext } from '@kbn/core/server';
+import { EcsDataQualityDashboardPlugin } from './plugin';
+
+//  This exports static code and TypeScript types,
+//  as well as, Kibana Platform `plugin()` initializer.
+
+export function plugin(initializerContext: PluginInitializerContext) {
+  return new EcsDataQualityDashboardPlugin(initializerContext);
+}
+
+export type {
+  EcsDataQualityDashboardPluginSetup,
+  EcsDataQualityDashboardPluginStart,
+} from './types';
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/lib/build_response/index.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/build_response/index.ts
new file mode 100644
index 0000000000000..bbec702c74915
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/build_response/index.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { CustomHttpResponseOptions, KibanaResponseFactory } from '@kbn/core-http-server';
+
+const statusToErrorMessage = (
+  statusCode: number
+):
+  | 'Bad Request'
+  | 'Unauthorized'
+  | 'Forbidden'
+  | 'Not Found'
+  | 'Conflict'
+  | 'Internal Error'
+  | '(unknown error)' => {
+  switch (statusCode) {
+    case 400:
+      return 'Bad Request';
+    case 401:
+      return 'Unauthorized';
+    case 403:
+      return 'Forbidden';
+    case 404:
+      return 'Not Found';
+    case 409:
+      return 'Conflict';
+    case 500:
+      return 'Internal Error';
+    default:
+      return '(unknown error)';
+  }
+};
+
+/** Creates responses */
+export class ResponseFactory {
+  /** constructor */
+  constructor(private response: KibanaResponseFactory) {}
+
+  /** error */
+  error<T>({ statusCode, body, headers }: CustomHttpResponseOptions<T>) {
+    const contentType: CustomHttpResponseOptions<T>['headers'] = {
+      'content-type': 'application/json',
+    };
+    const defaultedHeaders: CustomHttpResponseOptions<T>['headers'] = {
+      ...contentType,
+      ...(headers ?? {}),
+    };
+
+    return this.response.custom({
+      body: Buffer.from(
+        JSON.stringify({
+          message: body ?? statusToErrorMessage(statusCode),
+          status_code: statusCode,
+        })
+      ),
+      headers: defaultedHeaders,
+      statusCode,
+    });
+  }
+}
+
+/** builds a response */
+export const buildResponse = (response: KibanaResponseFactory): ResponseFactory =>
+  new ResponseFactory(response);
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_ilm_explain.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_ilm_explain.ts
new file mode 100644
index 0000000000000..cb7d5535e217d
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_ilm_explain.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IlmExplainLifecycleResponse } from '@elastic/elasticsearch/lib/api/types';
+import type { IScopedClusterClient } from '@kbn/core/server';
+
+export const fetchILMExplain = async (
+  client: IScopedClusterClient,
+  indexPattern: string
+): Promise<IlmExplainLifecycleResponse> =>
+  client.asCurrentUser.ilm.explainLifecycle({
+    index: indexPattern,
+  });
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_mappings.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_mappings.ts
new file mode 100644
index 0000000000000..aa5ca64dd565e
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_mappings.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IndicesGetMappingIndexMappingRecord } from '@elastic/elasticsearch/lib/api/types';
+import type { IScopedClusterClient } from '@kbn/core/server';
+
+export const fetchMappings = async (
+  client: IScopedClusterClient,
+  indexPattern: string
+): Promise<Record<string, IndicesGetMappingIndexMappingRecord>> =>
+  client.asCurrentUser.indices.getMapping({
+    expand_wildcards: ['open'],
+    index: indexPattern,
+  });
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_stats.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_stats.ts
new file mode 100644
index 0000000000000..2fe27f77b6154
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/fetch_stats.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IndicesStatsResponse } from '@elastic/elasticsearch/lib/api/types';
+import type { IScopedClusterClient } from '@kbn/core/server';
+
+export const fetchStats = async (
+  client: IScopedClusterClient,
+  indexPattern: string
+): Promise<IndicesStatsResponse> =>
+  client.asCurrentUser.indices.stats({
+    expand_wildcards: ['open'],
+    index: indexPattern,
+  });
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/lib/get_unallowed_field_values.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/get_unallowed_field_values.ts
new file mode 100644
index 0000000000000..2079a58ce5b8d
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/get_unallowed_field_values.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { ElasticsearchClient } from '@kbn/core/server';
+
+import { MsearchRequestItem } from '@elastic/elasticsearch/lib/api/types';
+import {
+  getMSearchRequestBody,
+  getMSearchRequestHeader,
+} from '../helpers/get_unallowed_field_requests';
+import { GetUnallowedFieldValuesInputs } from '../schemas/get_unallowed_field_values';
+
+export const getUnallowedFieldValues = (
+  esClient: ElasticsearchClient,
+  items: GetUnallowedFieldValuesInputs
+) => {
+  const searches: MsearchRequestItem[] = items.reduce<MsearchRequestItem[]>(
+    (acc, { indexName, indexFieldName, allowedValues }) =>
+      acc.concat([
+        getMSearchRequestHeader(indexName),
+        getMSearchRequestBody({ indexName, indexFieldName, allowedValues }),
+      ]),
+    []
+  );
+
+  return esClient.msearch({
+    searches,
+  });
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/lib/index.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/index.ts
new file mode 100644
index 0000000000000..79b8d9b4f13c2
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/lib/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './fetch_mappings';
+export * from './fetch_stats';
+export * from './get_unallowed_field_values';
+export * from './fetch_ilm_explain';
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/plugin.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/plugin.ts
new file mode 100755
index 0000000000000..d93766d2f3a7e
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/plugin.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { PluginInitializerContext, CoreSetup, CoreStart, Plugin, Logger } from '@kbn/core/server';
+
+import { EcsDataQualityDashboardPluginSetup, EcsDataQualityDashboardPluginStart } from './types';
+import {
+  getILMExplainRoute,
+  getIndexMappingsRoute,
+  getIndexStatsRoute,
+  getUnallowedFieldValuesRoute,
+} from './routes';
+
+export class EcsDataQualityDashboardPlugin
+  implements Plugin<EcsDataQualityDashboardPluginSetup, EcsDataQualityDashboardPluginStart>
+{
+  private readonly logger: Logger;
+
+  constructor(initializerContext: PluginInitializerContext) {
+    this.logger = initializerContext.logger.get();
+  }
+
+  public setup(core: CoreSetup) {
+    this.logger.debug('ecsDataQualityDashboard: Setup'); // this would be deleted when plugin is removed
+    const router = core.http.createRouter(); // this would be deleted when plugin is removed
+
+    // Register server side APIs
+    getIndexMappingsRoute(router);
+    getIndexStatsRoute(router);
+    getUnallowedFieldValuesRoute(router);
+    getILMExplainRoute(router);
+    return {};
+  }
+
+  public start(core: CoreStart) {
+    this.logger.debug('ecsDataQualityDashboard: Started');
+    return {};
+  }
+
+  public stop() {}
+}
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.test.ts
new file mode 100644
index 0000000000000..737ddf781f1a9
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.test.ts
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { GET_ILM_EXPLAIN } from '../../common/constants';
+
+import { fetchILMExplain } from '../lib';
+
+import { serverMock } from '../__mocks__/server';
+import { requestMock } from '../__mocks__/request';
+import { requestContextMock } from '../__mocks__/request_context';
+import { getILMExplainRoute } from './get_ilm_explain';
+
+jest.mock('../lib', () => ({
+  fetchILMExplain: jest.fn(),
+}));
+
+describe('getILMExplainRoute route', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let { context } = requestContextMock.createTools();
+  const req = requestMock.create({
+    method: 'get',
+    path: GET_ILM_EXPLAIN,
+    params: {
+      pattern: '.internal.alerts-security.alerts-default-000001',
+    },
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    server = serverMock.create();
+    ({ context } = requestContextMock.createTools());
+
+    getILMExplainRoute(server.router);
+  });
+
+  test('Returns index ilm information', async () => {
+    const mockIlmExplain = {
+      indices: {
+        '.internal.alerts-security.alerts-default-000001': {
+          index: '.internal.alerts-security.alerts-default-000001',
+          managed: true,
+          policy: '.alerts-ilm-policy',
+          index_creation_date_millis: 1673997720742,
+          time_since_index_creation: '13.96d',
+          lifecycle_date_millis: 1673997720742,
+          age: '13.96d',
+          phase: 'hot',
+          phase_time_millis: 1673997721040,
+          action: 'rollover',
+          action_time_millis: 1673997721040,
+          step: 'check-rollover-ready',
+          step_time_millis: 1673997721040,
+          phase_execution: {
+            policy: '.alerts-ilm-policy',
+            phase_definition: {
+              min_age: '0ms',
+              actions: {
+                rollover: {
+                  max_primary_shard_size: '50gb',
+                  max_age: '30d',
+                },
+              },
+            },
+            version: 1,
+            modified_date_in_millis: 1673996949964,
+          },
+        },
+      },
+    };
+
+    (fetchILMExplain as jest.Mock).mockResolvedValue(mockIlmExplain);
+
+    const response = await server.inject(req, requestContextMock.convertContext(context));
+    expect(response.status).toEqual(200);
+    expect(response.body).toEqual(mockIlmExplain.indices);
+  });
+
+  test('Handles error', async () => {
+    const errorMessage = 'Error!';
+    (fetchILMExplain as jest.Mock).mockRejectedValue({ message: errorMessage });
+
+    const response = await server.inject(req, requestContextMock.convertContext(context));
+    expect(response.status).toEqual(500);
+    expect(response.body).toEqual({ message: errorMessage, status_code: 500 });
+  });
+});
+
+describe('request validation', () => {
+  let server: ReturnType<typeof serverMock.create>;
+
+  beforeEach(() => {
+    server = serverMock.create();
+
+    getILMExplainRoute(server.router);
+  });
+
+  test('disallows invalid pattern', () => {
+    const request = requestMock.create({
+      method: 'get',
+      path: GET_ILM_EXPLAIN,
+      params: {
+        pattern: 123,
+      },
+    });
+    const result = server.validate(request);
+
+    expect(result.badRequest).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts
new file mode 100644
index 0000000000000..dab234eecaae7
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IRouter } from '@kbn/core/server';
+import { transformError } from '@kbn/securitysolution-es-utils';
+
+import { GET_ILM_EXPLAIN } from '../../common/constants';
+import { fetchILMExplain } from '../lib';
+import { buildResponse } from '../lib/build_response';
+import { buildRouteValidation } from '../schemas/common';
+import { GetILMExplainParams } from '../schemas/get_ilm_explain';
+
+export const getILMExplainRoute = (router: IRouter) => {
+  router.get(
+    {
+      path: GET_ILM_EXPLAIN,
+      validate: { params: buildRouteValidation(GetILMExplainParams) },
+    },
+    async (context, request, response) => {
+      const resp = buildResponse(response);
+
+      try {
+        const { client } = (await context.core).elasticsearch;
+        const decodedIndexName = decodeURIComponent(request.params.pattern);
+
+        const ilmExplain = await fetchILMExplain(client, decodedIndexName);
+
+        return response.ok({
+          body: ilmExplain.indices,
+        });
+      } catch (err) {
+        const error = transformError(err);
+
+        return resp.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.test.ts
new file mode 100644
index 0000000000000..6c76c84396299
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.test.ts
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { GET_INDEX_MAPPINGS } from '../../common/constants';
+
+import { fetchMappings } from '../lib';
+
+import { serverMock } from '../__mocks__/server';
+import { requestMock } from '../__mocks__/request';
+import { requestContextMock } from '../__mocks__/request_context';
+import { getIndexMappingsRoute } from './get_index_mappings';
+
+jest.mock('../lib', () => ({
+  fetchMappings: jest.fn(),
+}));
+
+describe('getIndexMappingsRoute route', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let { context } = requestContextMock.createTools();
+  const req = requestMock.create({
+    method: 'get',
+    path: GET_INDEX_MAPPINGS,
+    params: {
+      pattern: 'auditbeat-*',
+    },
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    server = serverMock.create();
+    ({ context } = requestContextMock.createTools());
+
+    getIndexMappingsRoute(server.router);
+  });
+
+  test('Returns index stats', async () => {
+    const mockIndices = { 'auditbeat-7.15.1-2022.12.06-000001': {} };
+    (fetchMappings as jest.Mock).mockResolvedValue(mockIndices);
+
+    const response = await server.inject(req, requestContextMock.convertContext(context));
+    expect(response.status).toEqual(200);
+    expect(response.body).toEqual(mockIndices);
+  });
+
+  test('Handles error', async () => {
+    const errorMessage = 'Error!';
+    (fetchMappings as jest.Mock).mockRejectedValue({ message: errorMessage });
+
+    const response = await server.inject(req, requestContextMock.convertContext(context));
+    expect(response.status).toEqual(500);
+    expect(response.body).toEqual({ message: errorMessage, status_code: 500 });
+  });
+});
+
+describe('request validation', () => {
+  let server: ReturnType<typeof serverMock.create>;
+
+  beforeEach(() => {
+    server = serverMock.create();
+
+    getIndexMappingsRoute(server.router);
+  });
+
+  test('disallows invalid pattern', () => {
+    const request = requestMock.create({
+      method: 'get',
+      path: GET_INDEX_MAPPINGS,
+      params: {
+        pattern: 123,
+      },
+    });
+    const result = server.validate(request);
+
+    expect(result.badRequest).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts
new file mode 100755
index 0000000000000..8b81daebeec8d
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IRouter } from '@kbn/core/server';
+import { transformError } from '@kbn/securitysolution-es-utils';
+
+import { fetchMappings } from '../lib';
+import { buildResponse } from '../lib/build_response';
+import { GET_INDEX_MAPPINGS } from '../../common/constants';
+import { GetIndexMappingsParams } from '../schemas/get_index_mappings';
+import { buildRouteValidation } from '../schemas/common';
+
+export const getIndexMappingsRoute = (router: IRouter) => {
+  router.get(
+    {
+      path: GET_INDEX_MAPPINGS,
+      validate: { params: buildRouteValidation(GetIndexMappingsParams) },
+    },
+    async (context, request, response) => {
+      const resp = buildResponse(response);
+
+      try {
+        const { client } = (await context.core).elasticsearch;
+        const decodedIndexName = decodeURIComponent(request.params.pattern);
+
+        const mappings = await fetchMappings(client, decodedIndexName);
+
+        return response.ok({
+          body: mappings,
+        });
+      } catch (err) {
+        const error = transformError(err);
+
+        return resp.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.test.ts
new file mode 100644
index 0000000000000..8a988ef636e80
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.test.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { GET_INDEX_STATS } from '../../common/constants';
+
+import { fetchStats } from '../lib';
+
+import { serverMock } from '../__mocks__/server';
+import { requestMock } from '../__mocks__/request';
+import { requestContextMock } from '../__mocks__/request_context';
+import { getIndexStatsRoute } from './get_index_stats';
+
+jest.mock('../lib', () => ({
+  fetchStats: jest.fn(),
+}));
+
+describe('getIndexStatsRoute route', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let { context } = requestContextMock.createTools();
+  const req = requestMock.create({
+    method: 'get',
+    path: GET_INDEX_STATS,
+    params: {
+      pattern: 'auditbeat-*',
+    },
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    server = serverMock.create();
+    ({ context } = requestContextMock.createTools());
+
+    getIndexStatsRoute(server.router);
+  });
+
+  test('Returns index stats', async () => {
+    const mockIndices = { 'auditbeat-7.15.1-2022.12.06-000001': {} };
+    (fetchStats as jest.Mock).mockResolvedValue({
+      indices: mockIndices,
+    });
+
+    const response = await server.inject(req, requestContextMock.convertContext(context));
+    expect(response.status).toEqual(200);
+    expect(response.body).toEqual(mockIndices);
+  });
+
+  test('Handles error', async () => {
+    const errorMessage = 'Error!';
+    (fetchStats as jest.Mock).mockRejectedValue({ message: errorMessage });
+
+    const response = await server.inject(req, requestContextMock.convertContext(context));
+    expect(response.status).toEqual(500);
+    expect(response.body).toEqual({ message: errorMessage, status_code: 500 });
+  });
+});
+
+describe('request validation', () => {
+  let server: ReturnType<typeof serverMock.create>;
+
+  beforeEach(() => {
+    server = serverMock.create();
+
+    getIndexStatsRoute(server.router);
+  });
+
+  test('disallows invalid pattern', () => {
+    const request = requestMock.create({
+      method: 'get',
+      path: GET_INDEX_STATS,
+      params: {
+        pattern: 123,
+      },
+    });
+    const result = server.validate(request);
+
+    expect(result.badRequest).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts
new file mode 100644
index 0000000000000..221a07699f69c
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IRouter } from '@kbn/core/server';
+import { transformError } from '@kbn/securitysolution-es-utils';
+
+import { fetchStats } from '../lib';
+import { buildResponse } from '../lib/build_response';
+import { GET_INDEX_STATS } from '../../common/constants';
+import { buildRouteValidation } from '../schemas/common';
+import { GetIndexStatsParams } from '../schemas/get_index_stats';
+
+export const getIndexStatsRoute = (router: IRouter) => {
+  router.get(
+    {
+      path: GET_INDEX_STATS,
+      validate: { params: buildRouteValidation(GetIndexStatsParams) },
+    },
+    async (context, request, response) => {
+      const resp = buildResponse(response);
+
+      try {
+        const { client } = (await context.core).elasticsearch;
+        const decodedIndexName = decodeURIComponent(request.params.pattern);
+
+        const stats = await fetchStats(client, decodedIndexName);
+
+        return response.ok({
+          body: stats.indices,
+        });
+      } catch (err) {
+        const error = transformError(err);
+
+        return resp.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.test.ts
new file mode 100644
index 0000000000000..bb59356111699
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.test.ts
@@ -0,0 +1,132 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { GET_UNALLOWED_FIELD_VALUES } from '../../common/constants';
+
+import { getUnallowedFieldValues } from '../lib';
+
+import { serverMock } from '../__mocks__/server';
+import { requestMock } from '../__mocks__/request';
+import { requestContextMock } from '../__mocks__/request_context';
+import { getUnallowedFieldValuesRoute } from './get_unallowed_field_values';
+
+jest.mock('../lib', () => ({
+  getUnallowedFieldValues: jest.fn(),
+}));
+
+describe('getUnallowedFieldValuesRoute route', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let { context } = requestContextMock.createTools();
+  const req = requestMock.create({
+    method: 'post',
+    path: GET_UNALLOWED_FIELD_VALUES,
+    body: [
+      {
+        indexName: 'auditbeat-*',
+        indexFieldName: 'event.category',
+        allowedValues: ['process'],
+      },
+    ],
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    server = serverMock.create();
+    ({ context } = requestContextMock.createTools());
+
+    getUnallowedFieldValuesRoute(server.router);
+  });
+
+  test('Returns unallowedValues', async () => {
+    const responses = {
+      responses: [
+        {
+          took: 3,
+          timed_out: false,
+          _shards: {
+            total: 1,
+            successful: 1,
+            skipped: 0,
+            failed: 0,
+          },
+          hits: {
+            total: {
+              value: 1394,
+              relation: 'eq',
+            },
+            max_score: null,
+            hits: [],
+          },
+          aggregations: {
+            unallowedValues: {
+              doc_count_error_upper_bound: 0,
+              sum_other_doc_count: 0,
+              buckets: [
+                {
+                  key: 'file',
+                  doc_count: 1346,
+                },
+                {
+                  key: 'package',
+                  doc_count: 44,
+                },
+                {
+                  key: 'host',
+                  doc_count: 4,
+                },
+              ],
+            },
+          },
+          status: 200,
+        },
+      ],
+    };
+    (getUnallowedFieldValues as jest.Mock).mockResolvedValue({
+      responses,
+      took: 3,
+    });
+
+    const response = await server.inject(req, requestContextMock.convertContext(context));
+    expect(response.status).toEqual(200);
+    expect(response.body).toEqual(responses);
+  });
+
+  test('Handles error', async () => {
+    const errorMessage = 'Error!';
+    (getUnallowedFieldValues as jest.Mock).mockRejectedValue({ message: errorMessage });
+
+    const response = await server.inject(req, requestContextMock.convertContext(context));
+    expect(response.status).toEqual(500);
+    expect(response.body).toEqual({ message: errorMessage, status_code: 500 });
+  });
+});
+
+describe('request validation', () => {
+  let server: ReturnType<typeof serverMock.create>;
+
+  beforeEach(() => {
+    server = serverMock.create();
+
+    getUnallowedFieldValuesRoute(server.router);
+  });
+
+  test('disallows invalid pattern', () => {
+    const request = requestMock.create({
+      method: 'post',
+      path: GET_UNALLOWED_FIELD_VALUES,
+      body: [
+        {
+          indexFieldName: 'event.category',
+          allowedValues: [{ name: 'process' }],
+        },
+      ],
+    });
+    const result = server.validate(request);
+
+    expect(result.badRequest).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts
new file mode 100644
index 0000000000000..be504a812e16b
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IRouter } from '@kbn/core/server';
+import { transformError } from '@kbn/securitysolution-es-utils';
+
+import { getUnallowedFieldValues } from '../lib';
+import { buildResponse } from '../lib/build_response';
+import { GET_UNALLOWED_FIELD_VALUES } from '../../common/constants';
+import { buildRouteValidation } from '../schemas/common';
+import { GetUnallowedFieldValuesBody } from '../schemas/get_unallowed_field_values';
+
+export const getUnallowedFieldValuesRoute = (router: IRouter) => {
+  router.post(
+    {
+      path: GET_UNALLOWED_FIELD_VALUES,
+      validate: { body: buildRouteValidation(GetUnallowedFieldValuesBody) },
+    },
+    async (context, request, response) => {
+      const resp = buildResponse(response);
+      const esClient = (await context.core).elasticsearch.client.asCurrentUser;
+
+      try {
+        const items = request.body;
+
+        const { responses } = await getUnallowedFieldValues(esClient, items);
+        return response.ok({
+          body: responses,
+        });
+      } catch (err) {
+        const error = transformError(err);
+
+        return resp.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/index.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/index.ts
new file mode 100644
index 0000000000000..6622471d463e3
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export { getIndexMappingsRoute } from './get_index_mappings';
+export { getIndexStatsRoute } from './get_index_stats';
+export { getUnallowedFieldValuesRoute } from './get_unallowed_field_values';
+export { getILMExplainRoute } from './get_ilm_explain';
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/common.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/common.ts
new file mode 100644
index 0000000000000..00e97a9326c5e
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/common.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { fold } from 'fp-ts/lib/Either';
+import { pipe } from 'fp-ts/lib/pipeable';
+import type * as rt from 'io-ts';
+import { exactCheck, formatErrors } from '@kbn/securitysolution-io-ts-utils';
+import type {
+  RouteValidationFunction,
+  RouteValidationResultFactory,
+  RouteValidationError,
+} from '@kbn/core/server';
+
+type RequestValidationResult<T> =
+  | {
+      value: T;
+      error?: undefined;
+    }
+  | {
+      value?: undefined;
+      error: RouteValidationError;
+    };
+
+export const buildRouteValidation =
+  <T extends rt.Mixed, A = rt.TypeOf<T>>(schema: T): RouteValidationFunction<A> =>
+  (inputValue: unknown, validationResult: RouteValidationResultFactory) =>
+    pipe(
+      schema.decode(inputValue),
+      (decoded) => exactCheck(inputValue, decoded),
+      fold<rt.Errors, A, RequestValidationResult<A>>(
+        (errors: rt.Errors) => validationResult.badRequest(formatErrors(errors).join()),
+        (validatedInput: A) => validationResult.ok(validatedInput)
+      )
+    );
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_ilm_explain.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_ilm_explain.ts
new file mode 100644
index 0000000000000..794b354c083a8
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_ilm_explain.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+export const GetILMExplainParams = t.type({
+  pattern: t.string,
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_index_mappings.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_index_mappings.ts
new file mode 100644
index 0000000000000..e912eadaef680
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_index_mappings.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import * as t from 'io-ts';
+
+export const GetIndexMappingsParams = t.type({
+  pattern: t.string,
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_index_stats.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_index_stats.ts
new file mode 100644
index 0000000000000..ee4a2694ec500
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_index_stats.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+export const GetIndexStatsParams = t.type({
+  pattern: t.string,
+});
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_unallowed_field_values.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_unallowed_field_values.ts
new file mode 100644
index 0000000000000..0d11adcd7945c
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/get_unallowed_field_values.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+export const AllowedValues = t.array(t.string);
+
+export type AllowedValuesInputs = t.TypeOf<typeof AllowedValues>;
+
+export const GetUnallowedFieldValuesBody = t.array(
+  t.type({
+    indexName: t.string,
+    indexFieldName: t.string,
+    allowedValues: AllowedValues,
+  })
+);
+
+export type GetUnallowedFieldValuesInputs = t.TypeOf<typeof GetUnallowedFieldValuesBody>;
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/types.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/types.ts
new file mode 100755
index 0000000000000..0e7c1c68af653
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/types.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/** The plugin setup interface */
+export interface EcsDataQualityDashboardPluginSetup {} // eslint-disable-line @typescript-eslint/no-empty-interface
+
+/** The plugin start interface */
+export interface EcsDataQualityDashboardPluginStart {} // eslint-disable-line @typescript-eslint/no-empty-interface
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/tsconfig.json b/x-pack/plugins/ecs_data_quality_dashboard/tsconfig.json
new file mode 100644
index 0000000000000..98177ac09c384
--- /dev/null
+++ b/x-pack/plugins/ecs_data_quality_dashboard/tsconfig.json
@@ -0,0 +1,25 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+  },
+  "include": [
+    "common/**/*",
+    "server/lib/**/*",
+    "server/**/*",
+    // have to declare *.json explicitly due to https://github.com/microsoft/TypeScript/issues/25636
+    "server/**/*.json",
+    "../../../typings/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/core",
+    "@kbn/core-http-server",
+    "@kbn/licensing-plugin",
+    "@kbn/core-http-request-handler-context-server",
+    "@kbn/securitysolution-es-utils",
+    "@kbn/securitysolution-io-ts-utils",
+  ],
+  "exclude": [
+    "target/**/*",
+  ]
+}
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 0e45a7ddbc788..c4ebcd19eb082 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -90,7 +90,9 @@ export enum SecurityPageName {
   cloudSecurityPostureBenchmarks = 'cloud_security_posture-benchmarks',
   cloudSecurityPostureDashboard = 'cloud_security_posture-dashboard',
   cloudSecurityPostureFindings = 'cloud_security_posture-findings',
+  cloudSecurityPostureRules = 'cloud_security_posture-rules',
   dashboardsLanding = 'dashboards',
+  dataQuality = 'data_quality',
   detections = 'detections',
   detectionAndResponse = 'detection_response',
   endpoints = 'endpoints',
@@ -142,6 +144,7 @@ export const TIMELINES_PATH = '/timelines' as const;
 export const CASES_PATH = '/cases' as const;
 export const OVERVIEW_PATH = '/overview' as const;
 export const LANDING_PATH = '/get_started' as const;
+export const DATA_QUALITY_PATH = '/data_quality' as const;
 export const DETECTION_RESPONSE_PATH = '/detection_response' as const;
 export const DETECTIONS_PATH = '/detections' as const;
 export const ALERTS_PATH = '/alerts' as const;
@@ -189,6 +192,7 @@ export const APP_BLOCKLIST_PATH = `${APP_PATH}${BLOCKLIST_PATH}` as const;
 export const APP_RESPONSE_ACTIONS_HISTORY_PATH =
   `${APP_PATH}${RESPONSE_ACTIONS_HISTORY_PATH}` as const;
 export const APP_ENTITY_ANALYTICS_PATH = `${APP_PATH}${ENTITY_ANALYTICS_PATH}` as const;
+export const APP_DATA_QUALITY_PATH = `${APP_PATH}${DATA_QUALITY_PATH}` as const;
 
 // cloud logs to exclude from default index pattern
 export const EXCLUDE_ELASTIC_CLOUD_INDICES = ['-*elastic-cloud-logs-*'];
diff --git a/x-pack/plugins/security_solution/kibana.json b/x-pack/plugins/security_solution/kibana.json
index 218c5510ff992..ec88134dab44f 100644
--- a/x-pack/plugins/security_solution/kibana.json
+++ b/x-pack/plugins/security_solution/kibana.json
@@ -16,6 +16,7 @@
     "cloudSecurityPosture",
     "dashboard",
     "data",
+    "ecsDataQualityDashboard",
     "dataViews",
     "embeddable",
     "eventLog",
diff --git a/x-pack/plugins/security_solution/public/app/deep_links/index.ts b/x-pack/plugins/security_solution/public/app/deep_links/index.ts
index db8cf4f92ccaf..9853c52502fb2 100644
--- a/x-pack/plugins/security_solution/public/app/deep_links/index.ts
+++ b/x-pack/plugins/security_solution/public/app/deep_links/index.ts
@@ -27,6 +27,7 @@ import {
   BLOCKLIST,
   CREATE_NEW_RULE,
   DASHBOARDS,
+  DATA_QUALITY,
   DETECT,
   DETECTION_RESPONSE,
   ENDPOINTS,
@@ -54,6 +55,7 @@ import {
   BLOCKLIST_PATH,
   CASES_FEATURE_ID,
   CASES_PATH,
+  DATA_QUALITY_PATH,
   DETECTION_RESPONSE_PATH,
   ENDPOINTS_PATH,
   EVENT_FILTERS_PATH,
@@ -180,6 +182,17 @@ export const securitySolutionsDeepLinks: SecuritySolutionDeepLink[] = [
           }),
         ],
       },
+      {
+        id: SecurityPageName.dataQuality,
+        title: DATA_QUALITY,
+        path: DATA_QUALITY_PATH,
+        features: [FEATURE.general],
+        keywords: [
+          i18n.translate('xpack.securitySolution.search.dataQualityDashboard', {
+            defaultMessage: 'Data quality',
+          }),
+        ],
+      },
     ],
   },
   {
diff --git a/x-pack/plugins/security_solution/public/app/home/home_navigations.ts b/x-pack/plugins/security_solution/public/app/home/home_navigations.ts
index 1a02a9ad75a82..bbff6ffa0a6f9 100644
--- a/x-pack/plugins/security_solution/public/app/home/home_navigations.ts
+++ b/x-pack/plugins/security_solution/public/app/home/home_navigations.ts
@@ -32,6 +32,7 @@ import {
   APP_LANDING_PATH,
   APP_RESPONSE_ACTIONS_HISTORY_PATH,
   APP_ENTITY_ANALYTICS_PATH,
+  APP_DATA_QUALITY_PATH,
   APP_PATH,
 } from '../../../common/constants';
 
@@ -192,6 +193,13 @@ export const navTabs: SecurityNav = {
     disabled: false,
     urlKey: 'entity_analytics',
   },
+  [SecurityPageName.dataQuality]: {
+    id: SecurityPageName.dataQuality,
+    name: i18n.DATA_QUALITY,
+    href: APP_DATA_QUALITY_PATH,
+    disabled: false,
+    urlKey: 'data_quality',
+  },
 };
 
 export const securityNavGroup: SecurityNavGroup = {
diff --git a/x-pack/plugins/security_solution/public/app/translations.ts b/x-pack/plugins/security_solution/public/app/translations.ts
index 36b13518f2626..3ea42f8229ea4 100644
--- a/x-pack/plugins/security_solution/public/app/translations.ts
+++ b/x-pack/plugins/security_solution/public/app/translations.ts
@@ -11,6 +11,13 @@ export const OVERVIEW = i18n.translate('xpack.securitySolution.navigation.overvi
   defaultMessage: 'Overview',
 });
 
+export const DATA_QUALITY = i18n.translate(
+  'xpack.securitySolution.navigation.ecsDataQualityDashboard',
+  {
+    defaultMessage: 'Data Quality',
+  }
+);
+
 export const DETECTION_RESPONSE = i18n.translate(
   'xpack.securitySolution.navigation.detectionResponse',
   {
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/types.ts b/x-pack/plugins/security_solution/public/common/components/navigation/types.ts
index a7e4184587ffd..b0190d40ced78 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/types.ts
@@ -44,7 +44,8 @@ export type UrlStateType =
   | 'indicators'
   | 'cloud_posture'
   | 'findings'
-  | 'entity_analytics';
+  | 'entity_analytics'
+  | 'data_quality';
 
 export type SecurityNavGroup = Record<SecurityNavGroupKey, NavGroupTab>;
 export interface NavTab {
@@ -84,6 +85,7 @@ export const securityNavKeys = [
   SecurityPageName.cloudSecurityPostureFindings,
   SecurityPageName.cloudSecurityPostureBenchmarks,
   SecurityPageName.entityAnalytics,
+  SecurityPageName.dataQuality,
 ] as const;
 export type SecurityNavKey = typeof securityNavKeys[number];
 
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/__snapshots__/index.test.tsx.snap
index 999076d36b553..d326bbca30f53 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/__snapshots__/index.test.tsx.snap
@@ -64,6 +64,16 @@ Object {
           "name": "Entity Analytics",
           "onClick": [Function],
         },
+        Object {
+          "data-href": "securitySolutionUI/data_quality",
+          "data-test-subj": "navigation-data_quality",
+          "disabled": false,
+          "href": "securitySolutionUI/data_quality",
+          "id": "data_quality",
+          "isSelected": false,
+          "name": "Data Quality",
+          "onClick": [Function],
+        },
       ],
       "name": "Dashboards",
     },
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.test.tsx
index 280d56d82e228..dbb8d87a90e68 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.test.tsx
@@ -107,7 +107,12 @@ describe('useSecuritySolutionNavigation', () => {
       () => useSecuritySolutionNavigation(),
       { wrapper: TestProviders }
     );
-    expect(result?.current?.items?.[1].items?.[4].id).toEqual(SecurityPageName.kubernetes);
+
+    const dashboards = result?.current?.items?.find(({ id }) => id === 'dashboards');
+    const hasKubernetes =
+      dashboards?.items?.some(({ id }) => id === SecurityPageName.kubernetes) ?? false;
+
+    expect(hasKubernetes).toBe(true);
   });
 
   it('should omit host isolation exceptions if no authz', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_navigation_items.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_navigation_items.tsx
index 3bc1e9c66205e..cd5da688ead2a 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_navigation_items.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_navigation_items.tsx
@@ -91,6 +91,7 @@ function usePrimaryNavigationItemsToDisplay(navTabs: Record<string, NavTab>) {
                 navTabs[SecurityPageName.detectionAndResponse],
                 navTabs[SecurityPageName.cloudSecurityPostureDashboard],
                 navTabs[SecurityPageName.entityAnalytics],
+                navTabs[SecurityPageName.dataQuality],
                 ...(navTabs[SecurityPageName.kubernetes] != null
                   ? [navTabs[SecurityPageName.kubernetes]]
                   : []),
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
index 43521274cde97..5c6b108736844 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
@@ -26,6 +26,7 @@ import {
   OVERVIEW_PATH,
   RULES_PATH,
   CASES_PATH,
+  DATA_QUALITY_PATH,
 } from '../../../../common/constants';
 import { TimelineId } from '../../../../common/types';
 import { useDeepEqualSelector } from '../../hooks/use_selector';
@@ -464,6 +465,7 @@ export const getScopeFromPath = (
 
 export const sourcererPaths = [
   ALERTS_PATH,
+  DATA_QUALITY_PATH,
   `${RULES_PATH}/id/:id`,
   HOSTS_PATH,
   USERS_PATH,
diff --git a/x-pack/plugins/security_solution/public/common/images/data_quality_dashboard_page.png b/x-pack/plugins/security_solution/public/common/images/data_quality_dashboard_page.png
new file mode 100644
index 0000000000000000000000000000000000000000..19c12415794da70df1f5eb1f3b6f892eeb8c578b
GIT binary patch
literal 84409
zcmeFYWmH|uwl0dhOK_Mt!QI{6-Q9w_yF+j%xCRXl!Gi~v;O<Vapn*5C)?WMW^X`4E
zz0=xz{|+=7bCmR6)qAh6s=hvEw6dZUG6FsV7#J9`jI_8a7#PGf7#MgO91KvhNISFv
z28M0uqpt0yYT^lUa&fe@v9kcVc{^EvEWB(i!N9y$O0#WTc6mJ`-psIdAj(2bcyOy4
zLg|I3<UX&rtjhSe)*0A;evbh)`4gpJ?J@tY`=aNee!h52Q}4LcE5Kz+0A+*y?Fnyc
zbL-~j{&9I@_<n|I*r4@(b>zbiN0*@W{vCb*QJ~S!Qx2q!<?`SapFrlGfa#l4juuDA
zu7lkaODrQbzlkFO<(N9uZ@xiSy6H?^Kc?g|56z-4Kli-y{2o0&ZF+kMr1V*BQ;NAN
zN#qYy^HBmF8@bs0r25H4`R$63@MZIXK+PLfQaB)HZdl1mQcG<@DDRe%j^wi2qN+#8
zZL=|L_c`^JVPt>zZg`h*sTFm0`1kH1-{CJ6Dx>&1+}RJ3n?-ej_ZJ@d9E~wah=q)o
z62EnKZsKpKTBn64Sekd}-r`74ZdM=d)$fY1T8sj&J48{x-XrszF@Hlo^foYI86-@I
zP2*yz&CCmB__4I>!<uzR;86X!JQrU_UunfPhQt+q%D%(sqFrxylF!K&NhCJ@?Pc-z
z9O8urU08wkFRkiKtvCeEIpu@fjJXl%w#$MQ%q^py&A`+}aTo;^%~&@GJ|i)C#GWLO
zK(yi~>&|W;=K0^mL1@k&%ved2z#Alm!Z7?k)<+0~2;lMM1<DAi@!%|-*+w(fX!pt_
z*0beoy%ayb<2mC-$xMQmqttMjn*-_a5ZtM`7Dq%-j#+9}>oz(Rmn6rgsoJ8`#An-j
z{ILDp+_G|N{dwQArfEg@)c$q}v%se7c17>fAL)Vz*W2lCD~!eRlg)vRL%NPtj(@zw
zV|AxpnueC1|3@Ovm91gMj*FIOVroL!<2|$TPd+QhR{FB%RGv4@dJbLZzxV_jekq=k
z^t^#SZ09yVn9EWxBvd;$Ef|SG^+mt8qCk2FZ{A4@jpe33>4(T8WueG(L-Zi`F016d
z6(5b6IdeYRd4y5B>s6YH#f8!S#E%zB$16v+!_=>Vne9S1ztk35tgQv`eBBE}PB7O!
zPp?4VD=GK0QM_%Aht^IE?<Kj?&ow-|BPpLW+Zpc&p7(a^LtoX4yu9+oKDDp$n1P@I
zj=a`g@d-KB?p$kU58fBLp?0zkI!C4jgvD6he;KoYC}0SE7pT2NGxv)HqRWN2I6qmx
zgoUbIw<A$tt3Dzic(`~hlV9$L4^2GZ%Ff<Gjsc%7#wX=+ty|Y|S;4XWqv~vDsZoTD
zRV`w}MlJ)f1tI^K@gt*s_=ixNJD+~4C9aFi{%TLgjLhCI@=%iW??gT-2w*-Mh+TxT
zR&2K<l&U16sRc;N<9{L}<5u^`EM4P92=^$wYHUsX{HPs}&p$^zALR4ikkwl<eC0!j
z_YdbpyhR+Y$-LF?JTsz7^QlTu)fa9uwA^iThu~7#;gz)MW;{8>H6MI@DsuG7BZze1
z5`C<6r{_QMhy`pkws}+&n>l??Ha8lLezf^~3q=%q>%2yos#E<rmp7_mXB=dsf}CV3
z-Q@p9Sb~d?VkA&)s~^Ix=Cc0m$`lvh&G0iThLL1+icRg4_@}Q5Y0oO`%roWIi>Y|y
z{#`=>$UAHyl_U!jGe0n^+MmDF+R<s>Z@Zz?vZx7si1b<iYJP6J?RGGNMbe~*&RC46
z*zHV);PTm|MIAz<gk>071BRu%M@khs<4kvf`Gc;{H{a`cvwL|{e+sDkaTJ*uY4;lc
z;06gEg6;BP9PjL$j&b}?65o4!``kg|iJX^;h_~3%YI?&NP-jj#v!vbYQt}ybq2sMi
zjtt|B4~Jl)dIpF2kdk+qqn5A<RLJU6Iv}d)#5RS}HP`44eD2ASRqHpupaaSK4<12k
z<q-WN)n|mU_DfKWN_d_dDRSgA?xDOfA02}l+!OsS)28go!`avUO&iC+FvrX#>DRPu
z8<e|GmL#PtzmIBrcIm<euD<$bh$y6;Mr{YZQ!L1XaE>{4L-s!y0pFuAO|#6bN(1{v
zESv6d8Ef14JCBAVMZea6y!fs6Js6+6;7stm;RRAhU&OcY?OI6PUFC?i(1~U5(xctm
z@a&@aHv9oGx&@U!M!hV!Ux^=zm$eGV;PGoRhO1Mlf)oyH&AN#oV$6aO-3sW8uO|_k
zR#QF7U#wktp+9k~WDmvAaec3!7RqS(bUP%NApA8%XAL1ucda%KfTPOVG*j3bY^E)!
zYJSlBeejRqnaV*Ed{WFHZwTY(@vLf<%&V^f2`a&@@!-iWGcrWF;K>LEF2;+#3(!AK
zqjib>QT5Ql+oF%S3=(yhYTY6}!>@;1*EXF>P_{yj*05#<E2KehG0*bq+0!&pT3{~`
z`VyD~l}DcLjV`E4JTE~1@(tP)-+O@P$b*VfmOulqr;0;VS)XfY_vI?Cf*)U+<H+yD
z{R!Tujs;@>YQ&H#YDKsDAyi!&altb*NynE;y%+O@zy;QCltJE?EGWq*KP_O#5lN?n
zs;CJf?{L{8g!bu-(}KFNZm2X9;yb&T(-%D_IZdBJ3Xd-R9W|JF+A7@0Y*=mzaMMDx
z80pGyXYlKZkZ~(J_V(4~m_aLgep17?9EXWuANIXe_RH=+TWdC~>W8s1QW4(wwN95+
zfGY7#L0mMvk!xr+yRWFxMCdjxSXDC6QcKx%QW7CS{FpQnW>v?%-<_tAmBmjIFg<C4
zv}e4k#ET0;df4%LzoIK7{R%F%7AScKhvHleA%&}<J(Tv_$1H?R(#<0Vlz3NQ+g?oc
z-74fR1~=3C9Lu`abya3ATNZ~FCHFSyTg8GJ^yC2?3JtHF5aRKU#ShSjBFv0Pf0Nk4
zC*%5_V<=jfj!{O28S`}g(c>9LJi=7aPZ3h;5OHszbVo%CiCgipJ(y{xTciWaawu7J
zTE!)4p$Eo_$f~lCFR9ehOL!2xNmQ_9#LW;No1mc5qMjiw4^2(xFFhf%QLb%8`J#U~
z2NDIuM<i6`eek1+T2eCe#~T&cd)U>k+ueR9e8s(VU;CZ6){~R-+%z7@!F8{;^=j#G
zQQrG|Vr@++_&KMYM**d&2FDiG@8w=c<jEcaS(xTws^Cj)@VT2IxSv;6lObZfnHO;w
z;?Gzlep@11tShB{ady|Rk@r^fCnMcKtEmDEfg(a^FV@9q*OKDX1n~V0BBU>9`XL}>
z>%fP`(I}{i8fntfadEnh%N5D_Q0XtQ=Gn&GM~rTIc!-l$$0L!v6DV}o%({Ki^X`0c
z+J)HD0Tld%grBA@k64-fxm83OPT5cJz$v?7Q)xGbuKFktgTg55z1<w?i4sVE>rZ2`
zV#&i33OgxU-&%T>u8WAhcVowQmWbEh_9KggB4*=?T77{(`j#S#XgZ>y^ks#5Jf10h
zeLWtAP<(b3A+(?m%tPtZTpKaca<2j{=a!y!<Ps^5(>TVsFboE4b67(a%33<j5rPHO
z0xkD4_@07KJ-Jsr^cnvkSh;X?B2I0$g1N-Gc@&g_c$;2h9}47qn038uaOxnHL)o)i
zD!b`Dk$ZK)I0J8~Yckaj;K#bv?n8(}-jOlOa6R#llC!E=QOa@3RH@hS&a$PDapXn)
zyCDKu(&Et$p*OM9FV3%wECy@O(om=;-kpY7L^GRBDA8@z$ZKN6v+oeMEwA<$QL*Ud
z#aN>poRgv(^v_?CQ0&JxLI!T4lu)Uc2|qV`nGXDP2xI{_j3X8ZSi#434jXCw`dPAn
z^)Os|&r;n}^xeLd*$UlHg|klc5LS8A7_OJ-tQMY%ok4~85Ct}d64!`H-=xS)g?Y8B
z1H-4%!YMQ{ye>}V0(-(#MKQv6l?Ii`PDtz#V(lhhBRz1Z=Yu&4`@c7Gs!nCmKe69J
zv?3<?4L-LuiIPGh;v&97M{*@R99;B%6dXx8AaXTwv(59}rbacNxWmHLXpTuZqG=cN
z!FwM+e<_E(I4u>dNZp}+fInvD1Y(6i&=)CsSmCU2fV$$LWVKxQ1;&bAD#lw6xiWOD
z&dJ#k?6HQs0>zCl;Wef<=0nEPyeVcDCv{ATfX*;wYV2SN6@e^(gG<v=55~AcN8%kg
zZ&om=s4jebVz@_3QXw%uZP`n7_pzNSPMjX?2d(=~lQ&2KcVp$}Z&`e?3)Q{Z>d#=V
zaQM51xVeOVlOc0OHX-zs4a*D#IDBD8CJOUrMLO1rGsu*KiQqrHuu|i`iVN3Bj3QUU
zL;e_nT30(NIq{0LELR9Civ<lr``M1|%fhF4be2<~OR|>3M!<+nm8m}o7qu_LG<sf~
zP!gKKh<IRp3c1Vxi_gnaijIDm8LK4bBX9Ba>goP^PoP6lf{9$Zo>oF3_$(U%X2G~U
zN>&JpgfoKQsA3So#-ma6Y&%|DM-);^NjrpTV_C3C9VJv}ne=}m{He>MOo|&~T5%<O
zBbs;}Ahx$n%#?|I|E3Oe)WR#4l9vM>f&2|lj?okB?L_Zas0<q6elX9h|BJ^@@GlV6
z=gWveIH^<hcWst7H)KO$bYTd6&sJ8(@O-tXTbV74hLFSO@d5{JM(qf~nW7m<(xt_B
z`0<O(!YdWZ38c+4r473uRU`)@D4Z3Hj_iWiclJv=!7HMYB*-umd6Y{V9b8m?rl2$M
zgZrP4p!-&<VXG3c){{OQO(ur-W(I?K-AaGTkx{NXLc36-!oxs<t?_G;AkP4UH0D0G
z^0hza>J8-od~IZCk{z;K$sKSZH){Vy&e!=n;tL7w5Nli*6JaKmc~@kEKyBM{nx;)6
zSR9gOf!9%Tb)+@3*==lzhJ6(Sm`#m*DhocT@>MII$G49w@(}(Xc(pggoN&l;R~Qk~
zLYoUxzTm8w7HNXyLkb0gItMSfFt8Jc!L@pEYpNMo`XMMjy#-MuV)V`zu_5d;p0T1*
zNLgEYFzFm5Axfa2>gzk;n8wsyCvMh9j?vC5zHm)O@I3o-hhyz>oZ?5Hz!^gY^QJKV
zP`v$G$a|7F%VbQ_2DfTs94BLWkvTH`70zFHd4;v~mP93~l;2G1qx`upk$7}0O%es)
z2a{=JCu<N0Q?0E*s*ayP)J<qhV!cTBr?C~P{o_vAmG#~7jr2Gij&C7R*oHlhUg<jF
zW3wV#Z`WF0nGl}xPsr}2>Z}9O1~Z#Wwr?F!V>6!O%(6p4JmmKFleA)p;u{Hcc2eKy
zx8ny0kY^%oek}Z)DQjFLK0ZTnlt3o+!wkT<8>BW%$45nqcayfRK^*>e6T|ovNh?D6
z3q4pJiQcR6JJ0BP#Gqfv*A|-Fm_l(+0Vz<@Asp?R`3{`BV!`}CQokzc=%VUV1=!#b
zEBVwmm{1X^X8Gp8SumNTZ}BcVRGqz6a3B~8+3bgC@n#;m#`z24fjP~U6SD_f8oH9D
z5pMv}jIq>}64eL4*-rIMWr4X|Osh0yIe78rl?Hb;U6mk({u<oYBa0WY65TmtHAXsP
z6Ma9yhtAd^^qki;9c-8h=}x>}r?)RYWfp7G7#|DD6p*5lJAZgMlNauu&i!S@kmeOh
za*2~*d^3%H1qCaR7PfOV5S*A;|6TvM)JED}MqT>hE~Jpz#vCjRAz%KBaM$GYvb_pd
znL-j29oYL=K`9dZ>~eUzQV+}!gx@$w?Ltii<%fK0_}ox9p*hKiKiyNaQKa#}3SdG5
zn;4kr>T+ob6JtoA8o|FPzsaNK6;ncNgPtzNOuLROFC$c9f6u)81W~*h(45O;a(xWO
zEN;(luRRg1`0JAVSg7+NVQkIF@P62W1Tq-ao_3?s6YX8pcUFWO_<TzHySw10%iP!H
z2bQ@!&i!92%AQTaVhCMABIrGWRfmsYM`0c9?>K3HQ^Jbq+HV99Om+=DqefIQe;-^n
zXv1ISx-25fbQ&byN+v90mYWa`@n!ujAs6s*k{hPMa*w??r9=qS#(X0O51MTdPeD9?
zLp0S@K2x{JygX<3=6^FYU3<&IBl1Fu8Xd$c;G_hrBGuU<YI8fxEXdd<bxz>_rI0{~
z1Q&8dVv|%TU_Tbqcoaj!gK7;nQg8xk9>r|h(qsUQMu2a)NieFSH;K{G5Q04zn{|!M
zp@5h}JQg?e(=Tdt`Kw1<1{ngxX+17GTw?BVe0Ro|%*Z^3Y2|cui6uiS-h-J%^N?C!
zP`nIjk8~j?U5TvrHp~&#!$~Ja#TR%7U4qzPWs&zNdKGqPN(u6?RVFYiVf;RBaOS%P
zW=POoeIVs+7wkc&yWWJG%0K~(P<&bk5_Ck`2?~xN(#2OJwE`!*BM||VMC~0nS!TW&
zWj;7#_Eed!69V}JPQTK#JK2f_!<hnDdi-hDyt=Ahx@t@7)fw>p=ur=cz7m;O6V=vk
zl>vTANoeD16V*Ykh2X{%w;7KJ50j>uOBQr`<f1_qF(GqkcYhB`L|B5<uLEQd$m<mn
zyFR6?NE*4~B;yCRRu<C}tE32cvQtWJSOPAKSZk^Yh-vzJYtpbmv9|}>orY5sczQ~~
zC(v@S#1$kN&xUvelrwx4@}lr=W@i@x#Er7=<MCKvn=AM3WzCgQTcTL5L>JAE^-GLW
z2NWJ~Q)c>Qwl)w;6TZo>g~gqYK_W({n(Ofr5nh>p!Tsh{iw=3v1=+05tO+$-5-F&6
zmBxI2gl(vTMH|(dd@WO6pbLiSQz3*@{&7PJ7Bw<+dIT(P7`jzH;+G83M+wOStoKdQ
zhj<rNSO}x+IF(1<xXiR11p+mv?A#BJp|HiVcMotQ%vrN@O)Q2#^BM=c?%eU*5JJ#C
z?fMOm8}}yvrpU#@OV(~mn@rk(G(eX^Cyh)h{c^1Rptu?4brH_=gE)>fhj3x+Lny>!
zu+R5ujNbQE?y~Q-1n?EKbsvPu-kjH7^M2g@pi5#e8@*+>++Mtm3f@gQQL4W0&U=m!
z`Z{nsz=_7)q#)L?HDUY1tU}t`irP0pqbP1z-Z4KqYU(HZY??TuFsUgn(+B_5+);K)
zYyn&DV&|lJHTl@mowImGYbdl0@RZr;hpJe=4;<uD=OtCJ9&(a+g`sv11IklL!6HqM
zmIXfo`N-FrX3Xg!B9c0c({C;Frnttw*Xo26cN6a@HE=d9rVDEh?_oi>!_(@CDkL}w
zGwRyYZ%s6z%2MEI#=O2yT;>`Z^(@{@6k7T06g(x}KO5@88}ohn>QNK4aqL||3RfD<
zoT;wr>v0ibDT#XI%dm2G3?m|`^B%M}5Cdiy#u9QpZ!40YVLMf<NBFT@&ZRdWv3@p!
z?sKHVbNz@zXDA(;?&3<K&MKrD=N&u0rY<37Ykxi;v(w|nMIgARH7{PskChOBc8#zR
z6H}HE6Z?m01^CrZ{z(GT{mNM3N@}GVv?v~E=;O-JeIXT5#hQh1*rGMlm7$|@Zv`@9
z$vZnVZSM$QbgFsVxKB^EXyHPHK(&mDF^sA^{xXFU)i}hLyPdu$m+P=_%@}jl@y^0?
z_H1|w(Z}PJxL)C?Vn?EA#jK5SJTkHc_WtW?Tt5s_t(q^N8-3=h2f^~C`Nxpvs5U@(
z8%@ZQ&jTi!i5feuJ1i-T(k~<KgS%Xl-Wkw&c${jZ-aE|onT{r<;W~ZuQRPwOm1Sz(
ziNCb>I|p^>G_-f~Ucw8jyBo&cbwi`f(B%?Aq9V`|smA289f~pG6uHAI53u?@;*8<?
z63j021xUyZr?79Kn~lvbDVT<;G%#-6+>^u1XiLy18pDr*9-p4zw*p~mZ_9f0AuR=E
z>NuN6(5E|)_4T<pEKu9lz@PGwmQxKzmE=bDgYMa$%8;f#5#8#%T|a!<y#<$^sm9>y
z?IUGQE<d~DyhLf4Jm1V4dI<ni{p6Ajj+B8028IG}190Ek3i7;Wj`oZu=8mQoj9&Im
z05=W>#xLaMWMcNg!VP3<VP)eWKz7;DLk6-j7a-H(P+(SY60@+jk@j)1Q1ek#H}m;m
z#$!$<B#6N8#R~|qw{SB7dD+`Jxbk`lko_f>7x?_An28MZR};4n0%Y0>${;aE7Yh(O
zBReBAgM^oj2P>H%0*K$m+>%#ST=HKcfF}VmYd1G1UM40_PftcqHbzGmD<&2m9v&uU
zRwh<f2A~CltG9!ji5G)|EBPN0f6EZJa5ZzWadNY9bO8O4X=3W=?j}G+2GoQ88K1qA
zg2KPWJGlPK3V=PByiA;!SQwd^?CqKUvxlpjga;txUjzC-_Hb1PQV2|{7Osx&E@l=I
z9u^L6<o_wc-0a`|o!njQ{+f=t8Iy&bg+0*J70}A^UsV1{M*O?Sf6@4-=C48ir+6tD
z1?7J?|6?&L8+)g}lmNc@FM{1{EdL(_|Ec-k1OwgwE%(0+;~!J~H431Wf&#C&qnZ1k
z*~o|skp0omYwl=fW6t~6M>aDy4t8@c76wi(a~1}69u^A*9!pLx1{PBeQxi5GGY)fh
zmj4hX<KXIM;$UX+M-(8O(FTyiX3lBC$z{RAU}?(6&cM#f&B4IK%EiiH$!x}9V$RIX
z%4K2sA0m`oY=9s(vHQ<a{Sjpjh_bNY;xJ?3v0yM|w%}x7=j1S9Fty||W8gMpV_~-B
z;xe(|GWkoCxf!pdql>)>;C&l=6DtcQCkLy)D*kwZSJ}qP!cJS<2AH%f5O4xyEG%qX
z|F>$L|Ey+a`FoOo+{G)REF(b1%E<gzhrddc?M&P(0d)do3MOVCCAI%mqYmg$b2Itl
z3>Ho<4i*kh4pvSM9(EQ^?*G+D)57KNVX!i?Ff+3KE%=XDc>!Ahelhv8DgXh0^#Dx4
zE9PQh;^ye0?&xSIK=x+@pg%qTT1+7RzkMog;|jF!{<FURwZhaaod16Md%@Y+{8a@4
z{k2GVP0apQ;%eeyVg8pQpx@tBX4WPSRu%x7{3{;+DYyAQ_}avjm6@5-l!d{}#LNN+
z7j`xVQxkJG23A&6b~6i06J{>1zkU60>8_5JZk{GC79v)_Oo7<|@%PtkKs0~b^8J4u
zjHk5)U<y`dRyGD^76vvJb!Jvx77kukP6lQ!US?)8rhm<t=?{qfGi83J|J^A3e?@|Z
ztA&f0qy3-g{|{4%*!}D2A5;B7AYMDb3_w&fm;>{0w{s&CR5Nq203yiR(T)Evb#^xY
zsr(-y{7nBRO@H_J57Yy?{#^#3DFDt)|3>G(W&UyF|DQkq3WonbRe(VMqvXG3-~Tb!
z|CsB)Wr6=z<Nt}S|1sBp%L4zc#{Uyt|DTx);eXxlEF6Gim?v<1%NDgs25x>ZrgBo^
zU~hkZ3%bfvfD(8oX&qNEFhtBhf8b!*pKyUfST`933D`q$5_nYn$P$)iFfb69jJSxp
z*UDL!=O?ZGtot{?!_~3d4L*D03NbYmbSP}oK8G`^vg$|5<q3ym|GXcW>(ut1b8*qx
z74@-XF{uS`G4q8;{nHW0T^Wvbho3e{*lyAa&BEYZdyJS2`^S$L+o${m@7-&kzfvg7
zu|q)w3xm+$pdk8mND(oC|9?M<3M2l%{+L1a<hm|A$1c8u@{g?2APO1j<l8}nqh07m
zw5fjy4UvOZn3IG%YDAxZVuL?4>GP}1|F`<VkuS=Ezsk#OMjH5cE~)K28$@Y`V-B|i
z`)ywyh~P;X{tOb3--a80Q}3gx@nfW6_l+pwRencDL&IE0vV1Pr)i3JrxdaP4v4F-{
zV~WI^E{~yF{aCN~<BDjclPLxo|J7hC`9OPu@9d*smLM@{K|+Ej@rH7g)jz|x#+d2X
zeNcCOQ_O~adf-O;S9!2;Q<SxF7|xRyIs?gDWQqbY);|W5j13a>VB8v=<;i!!D6Fg$
z<^RWil0^L*hr866DC8srtIn)SP5%s$Ih$LJ0qfD6fbg>R-M{4!^yeKl=84ll{nO64
z$;D6OLJi?4CEWR+R#3$%{Q0t|W7L>qqTK%|g8HORGFFZ;E-L;{iDZ?wpw7dP&D@f|
z3WV+)sKmCSG9q!;h#n)<8v&U&QR1t}-!lujp{+<zxU3d3$~*W{IdiFYbQg9Np{{Q7
z%%m@zbI0oZjtE|ph^mV|j_hwQI1vxrT=kqzS%fx9{3uw*D_SM6^uqZj^)$GPTIJTJ
z?njzdtxYbO`=#Mu!S#5Ms>A(CJarqyBtONnqvJ#@B@xtLH+_g)jNtpP@%pjgpR&Vq
zcK^J5#h*Ua2+Qo~CHp#6RS<(7D=bWdRn%||GOW8S>WXmEj&@t%;BdEF`U0;ocXV=6
z_W3ik1P=>MZEI@+xyFw`Eg`3-%IwL>TGx%*nws39A*zr*P>09mes8c?5h(&xh#dZ-
ze9ZIB7GiYNA>v1&YJ`LyVX!uR2g8TcF*kQlqtwI8n@8=}1-{$6d&ue8m7yeZ4X9Ak
zc*4)7Ryufv%17c?dIn=3>KLRnQm6dS_8sd=Iy-khwXSNZ^hG2H67voh=gWlw^Xkh;
zQnT5)!GL6NTNB!X`Ln{%Mf=bS(BYttPEUu8nYTPTW=`)YC@75UGr<80ueR2~PmqKv
zC3<g<0tp5(yKLK|<M{j(R)L&~Dx$4TTV12HwG~w+`RAh_O^m3YA0e1Pmw)K9wCn&N
z%ccG5sk0&`X7O;)wmvx#En&tQs(0IMc5^YIh-Rs{NIEJ(YEIqu^klj1*sP(EEsM7_
z%tlQPS4}<0uug1_JtP=(etuq&9W!A|PD%<MDw0t4IqX|L{D;<6F-J$Hm`XGvYz0%(
zZ+Op%PTX;ol@*n;N=m3cUBn5)u|+fkgM;WqMA%v38$Z@RuI>-nvFy6|Dq}&1icIZD
zAWk2<CH?+&cem@tI}<bz=2cWw1aqlEBd(>z^(qV&yDaY_%j%PhqM>noNn+f)-D^CZ
zf|egNVTt`w7lfv-tgazYgR+2#2@g0A9X|S3yrN;iBl0*Ec_qwmNR(PVKV;X#aml*H
zde=k74c|b9cd_A4+S@D8T5ML6^7@Qibeq2U3+W!_x$<`MSYr<D(MwCXoPJHwPfwD-
zNIus&7F5unb_m3jmA&I9Mr~d9!Bi_(ENiKaU)=N}&`Gb?sR`>xK*Z4>JX>bN!^Jh;
z@3>UcS`7PPDWai%(RHtgv9r7U)g3lBSHSP91s~6{4m)S_7c(im&EId`A1P!~&o|`u
z`^cB<Ik6<RpH6XD&7PXj7X_KOjPJ7Dfu>s?zR@3}cj8waNx8TVtLYE#VYNFhAbos%
zz_VV1!H2L88r_cX28M@K3=H}S#x?=16f#9!#i8$0sL>I^AGi8HQczPiIBoms>aKYC
z4$AWK`7+}pn_F3ZIZMxpifL%H81oQZ?!=Z!zw+r?bGcEql+Ty7vcjqBxq4Tqoav-p
zSV5DY<EV>|=LMilU-*H!sBU0ocu`^u0J%#lSm6ih?;H#~$W!E~W~Qe{zV_G~uPw3A
z#C*GM-7r~Z;9~W#LvMD!Q$G_LX|hRKZm{5EERT&O`HGsWcyNw=S#NpnbJ2b3@e&~9
z>|9T8;3I$%85;PS@ixXq>>ni6^9uH1(Z5%UK*;iBe$=}1dwj0%<Ng#0H4|6H!NEJt
zYQOyIGy3Xxh&DDh^oE^i#eE}R-A|W$dXhijFdB~{$A0E_O01*r%4=$3kJnt>ap}N&
zot$4<`u_I&K9H1-E+u<KSF=t>$wO0ffQ=9(@^i&f!s_|KtM8>~x`k$q?wAw-*VT0B
zeZq*D&)1A_Av7>#hmLc}kV3S;$FVW_?0IQBJEY4RT?G{rK`kSWgpCbB!+?DaED3OS
zenX}{Wwf9>62GVo<1M{SKfsnIyJZQ-Cl_Tsb@|Pw3pYQ-?voNTdutm6=#9EVu6Bo9
z_N1|s>76&bJPRujerRxz@hgDP{A|K*ok(c;ry+v3l7}2x+1zE}Wn^T~RnD)xtnE*Q
z7mhP|8nIGFrTzT)DO0G57EhOryc5S5a}*>c@xio=+<BOKu6YgXaF8>BWqsSEZfaJ9
z$5$5g@}iG{iTR$Ewxr?On4)-QKVzb#q9XC3ja!}ylQSnR@4}%>K5P8J*^JxofyUnc
z{A{f`au#n6?Bmf9O`Ig;%#6y>U1%ZNEKBaag{zgSwz{yq8@o?v-rXq|vUd#ZB0_{H
zA+NrKuP-&9#|2D5T_BhS;;u_aG%-RU_in7HM*B`oySb$$1`^DB`jP%)x7oQlIXyi-
zqu(b6B_$LopFW8@UqO9Ryq`|TNTy)fa#A)jnlkWQm(kRu$}V%hH)t&errKu1X0YCM
zR>vQvSXW%tnDgtG;?wi<=*aliU{80%I`LrYD5ZQp3v%%c2p`yV9wOlm)JQ8G;r?KK
zXkU;b*AZPJ1-uRyp&VhaHM^vECH)vKQm6?;urXNiHrtFPYnF<7nlcT4lhW@*<Fsjl
z+mUNyt;)I4iW94piU~{11`4V88WLU)i9zsy-#J1~N7LvS7(0M{(KL8EMi+-K)Y8q(
zbNTmv6TRyWH8e&>c9$MGJUmp@<%P`k`(@A#qg|tEt|OY<Yt33@gI}nOEAfLFWmz_v
z0?DTzZmI<e*j<3cH)qv;<LM$nq6J?5RAd=)UVdc-u;#DQ>ehmmO$$Ln34w3-B*yHx
zUeD*A4-=QKL1X*xkad9A`P@b!FpXiVnkx+A?$QD<Bqul+yfR)hB_~HrN{U)T<HvZ1
zDWh2o0*|i2#NKF1B1QDIKQ;gv=$M#;%R`vb$>KUXJnOCZz&3Pzc2d+67_`*J{p;*K
zH3vs{oq&r_OwpDb($?K0`6>(q=^Eob{06WIEj3$_$T_s3g!T#h`tk)ACSoKk65uh%
z5$H+lec-#P`wEe>F6pbs2gaFmzQ#AVdzPO1N!m^xX@4JkJeLo#d``jMK%l<9ez+PI
z{>r(ejH1!sSI1ljc+Uv|5s`*|1laRpbV}!><>X3%0d;o=?3kKae>fFRHwUnUGh0vh
z@p0-cr|jSz)w={7WG&zv3;sJi))F2|qj-}DM5q~6pH-jfhQsfn2<aEhT=+#abufxP
zu)PX00y_;{DN$G(@2YklELKFRdOgZ7Idk+&(d;P#ni-oZ=h3Ul;pHui&4r6fB5~|;
z1*TGy@pK0vLQ$ave_6knt->5!WWRN`q@p6q;&@N8Ri1w^fW)e5YEvaLnA4|s`p%Dp
zh5>iT07|&WNs>z?EI7USdqReig7WuuiPr*4z|tzw1&0XiSP8rxf8YaqaYZ%1yv?yX
z>+GBp&$?fOH(ixx%@7IPbzdY2+gs(>4Eyx)ow<3*&A~M`|I1H*VC$vfKYG;UNOPhY
zc&=JZN=}x3?1lvN+5w}mwsj!ILNH^-&E#~ag+<l8+A%UBWnf6VzLs@p+t$6lc2OdN
ztP!!ML5z%uz|fqImpQ6KvN&YMM*`3_QOn3TcA<syMNlX*VV>E_<Jjt#3bq?B5n^rD
zR4h}Mq?8r4WN~n9t>Mr|5-AZ8@J7q@>v2~m)_N~O4vxFMJ@e$890fgJK41nGC#liE
z_NJ_@EiLJjZM_6w+gK?dw#3X<qZ?67Q2`A?pD|jOA&Cr+8zY2EU`N7F=;{(O84Lyk
z6j~H^wax7T64ep;CN<q;2?xm+8R)G?Q5E&?ReVQBE-n@}f-32VT&|rIKSH(%$Gltb
zy}f+Zu<vRhk0JzrRN_}uN?v7RU1SNpYrGn8*3{~W6soH=U)C_g%fa^StF7N8+7k9h
z-F3x~j^k{sstkS8Y0uAJ7fM-c(pF(L6lTUPsjpAEjYDErC@$^_Jv*ZZ92pQ81XxBj
zIpxdhxmTBAc6PRN`<gbrrHiX;{i;3S6ktmQj!+;OiUI1x+}!A*iYCt{v)1M4j~_);
zu<-HmWfT?3czLs5Ujux6pK0jnjW0J`1lJpKy|u;%ckhxjGlhM0c>%};@Bk2gbawL1
zq0yvSw_cmRq_h+;Os;`JQ*(1tN=j&%ZJRzL;K}3j^ZtF0-TUX`({u9oJkfEt>~@?4
zUH<;J_o&K=`H^KdN!t5P+~WHBgjrd5net_GE48(?#5og^qN4l&+z$*4pkZQuETU=h
zbTehemywmFAk?(Bwl3%i1dAPv8#L{+W=~E}m-Y39l`Kw5O*L27C~j}h+UOQk*Pvu0
z&jm0Xhz*C<$g(mj;OL~8lU7|#UsPNK2NlZB!8y0M7&~fC1)#|MJl4z?Xox=O!EGlb
zUgS7Qpcikh12d8n4c0|6+Oz<q;l_$n;sUr3V!4$G>(R3Aa!CLFp<b&zIR^{xj{hvX
zFuuGqrHoj>XOl~GF(Z0Pn-VS$Yd#tLcKO{#FjpJtkx1+`1>cj;j%WKVr&O3$T>hV-
zo0!nbO2?v^&`gaCm>eCd5Bg52nW@OLX>zj8_6j@eR;)s?DXfoOejYh;-t0lLWwB6M
zOp})fQ=qO;o1PZhD{@5OZCse2=Gy64h%xmTbw@ff<_yh;h_7vci2NB@lTE*5-jcVb
zM6?ieYgKZ3O-=1|O7e^6fr1l7U8?uzix{e>7fva;C}nSXaY%<Js|8;#lRN_B&(`%O
zFS@YTTo>&#Cl1itlgRD$H6mBG+e!3P)ZKU=krp|Y)MO4vqn%oQ@vQrlH*{52CgG$3
z*D1ecs9On=Z-ut__C)^b?5IDB`79H&FhVJ0%&8=<7Ms(WJa}c|8h7s^A1XSNR?-8^
zWlZ~S^{MtKXMY?Xgc{sY46J^(KOtva8Sfm`*(*gJI&;5mUvB6L2imG)oau9L#C}S}
zRYyKqd3tOr3O6iIfNzH%ryKod_qEM3R!`msfo*r1-3bQUw8m%1d{`|xC#cfK4fR3$
z)do2-=czvHZq3yl9n%#v(l8>FX+T+f`%Xcl>DH_5Z3TWw-iK3@{pL6rrP@+}EA@c+
zgFfw7vu`@=1s$7XE9)Q6K3_<dr?h)J5NF_&7pG9J_^em2{}{<TA)dvkUSp+3ja?q0
zBOxxU4gj0td-gIHK|hY3>3rB$d9_%^l9wc!FksZQt154q5E0R3=b9KL7h;Hb@_-Fo
zcM2P$F1bD~R1_^_<}ym3nh!BYdQ$5t2_+3@z*ewZ*&H(CQljGHIe?luM~(2d={MnB
zfq59RXOoVvkIFkF+f|47d5NB9*_buIM`5nxsd|O<NfVTJykvzj)jvgZc-1k!ymIJv
znroZ&hws=L8<*G=gBC+@CsI7XqQW5gAXc7|WD$M4XWi|4Z%2hyN-BdvqQyQlztmsS
zNl_HXn`fXi8MK<PNwU+dbXvi)qNtdh`xHUE;J`1=T+O<L^5wc8a{h-q3nL#&-PmwU
zLe-J`ll8gBb%y5{iyS^?!_HE3U9>yjDI6V+5#CK7dRiF&UJX$|{`<<IDuRURmD%CW
zXd7*chZ#CwCvS+*k5b7_&;6Z^?b&x03i>SXbG<sEd(JCN*3)&%_Nfz%Qy(Yv_RnfA
z2%X1;l}&D5Em4Ti_ZqI=Q)nZ<9M^QsH}T>Agz~bP2=GYfVq*{@o*>ynt)e~lc*4!W
zRO*yaI?gm_O)hfwf>58oMMHRh%lG@`x~8kC`Hs!k4udEcCE#j>k@vaF3(|zv*2mj<
zopjbrVWbZ&P*+1nF5$GPg$3Vj{8OT$Xll}CS4aK<<6+dkLts<}7op{0u*W+CLx9Qw
zeG7x%ef+NF5T!2ghluGb?U%R=*2GG4kP1qrA%8OCk8Yqa;X?JF)iPPhWN%P4m1!cF
z!3u|LUT?blT2Ek(aZZ(P$dg{QX3nZ=rhR{fzT&%ni|SQj?Qz}TAvZb}RlIq;Yiz(J
znL928t2+&@He_YYb?V&a=chXJZAa%ZWAaEgxy{5wP@on}h7(f6D2U6Wc?UH@7&1X<
zKreq`dVc@FmrHT4VaM(36MttzSC)m^T&8BKI1N{@25iUY+Vc`OJ6rQjn6B|ume1zp
zgXs1PW}G8u+|!C`8Ho8@y_Me`ULWq3<r!uBwtqF=2@^cZcvMpfkl5Gkevdwm8;vs?
z-j0{%tsX*wt;uzGJ>6c$I;5IqrHplayOjK1$vdJHE26?d+*zCXIOk%0>hk4Ci)7c$
z3&e5I<RKl?e7$v-;^nMB*<;Y2;JC@1_0oj<X#?aK=ody5+3|3oKsk<^LhFO|7e^Ep
z)D6cdTt`m6A*xpwsjS_{%D&A|QsH*z%W`6|Q#3x$<*ueO7p^xOT!aDlA?zFNkp=4x
zJ?=y(k79~h4HPzVAhUcgPA?Zl0Xy<e5yN;+c4(Q1QBNeJQWWZaYk^HDk5Xgu8I<UE
z$~kUPleB)R)g`|Qg8UijUYr4tOjtj@wDS7tp>ZGq-VD_&rk%7jjY)VVF-cCP&*wAb
zf=c|yQBF51NK%PG=G$c+EX@l03yc1|clr$|Ifg?x3(8p7JxtQB(&XgM%=?;g>*IHg
zu&`9;kllSEGtQ*Hvdd<cb_<zDW%X|haJU&JW9;VVE`O4h4i-Q>zE_bBQmi8%G!-WL
ze(Fo5x@*VpB?cd;qc`ffvC_XYYiFwm3q;J%rH?6@`XDME_`g_60HQ-w>d2`nv$<M1
zotDjETRu^k%M=x__T5}w9=22s7tM`!_B5w24<73akY}uTP&<;`yf;jbkH+AqBAha3
zF-<Di+#j}OVcEKNEhvnXd6XF#(jNW7)9&sdsF@NR;29KDWXxv7i`{6;N7&i&Io{$X
zHdBZvMc{`4VfAG!J(Kj8pCdc<^9vr=!=7|rJB95>x4a0Z6Km|0X*_BTNkK!zsPF6F
z-3|}1`}m8zo_2}7%yrt;(odAvY!1(4*G8>3#<3be3htQMa|?*H5S|!Invfw)SgFq^
z6|yE%B;h%h4x$_P5`hFZBopRPO~Tu(Pn|Ft(eZR9IXXEgC%+fV$vx~or@ic~i(wrO
z-Ym^V%YRpr#5flEn^%T-G8IV%@v#M;QkP$UtNe|XAk$|&?OgFSC6k6N`pSb|QUFGw
z*tJ(mtUR_0R`1B=NvXp~VQxe|*32|J7iZzj>Yzj(U+>xZF(hs*#%!gH{TGRYmA{UF
z#4<b~_Zr~An;(NI@r&Cy43@>jDTYN~*CkwD!1C3bW-oq9F-}^}0!W%S3N7<;oyPjw
z`3r<<B$UKwW$|<97gdOl00zcs%e>R&&edL-cmi7I)jNTY0*3KTyxKig=$^_Fb09j(
zh|}Sr8>6~Qi_taylNCaC&#yF-F_aq)l0UZA?VATyKO#-ZrBX(BHsRh<3Di{!i60Lj
zwP>^?+j23N(%?n%Ii0|`p-_nHJ!GtwUH#Tmr_dR)p7uX>^-qw5xe<y40|>K<${52s
zp>y+=ZG;f&oX#>E{L0Ea7uGH7FNZk(zhjC(W7nG;DmQNTXJeCxT>%m*WLbLOOrX0A
zJvSPv^=a+3RMaCHXI{GO6+yU?_Yb=XLM&?|5rHV>jVTt7ao%D|lI48k(Br0&%hn(U
z%6E-2Qbtlj0j>Gp)}Ye$1taFg`FM4xI2UB~%y4RmAWKTbQ;01ngs9=GWD+)a&Ey?0
zJgVRWL2*<2q)gOF<0Ul77{ym#{hPS%jX6i?KN(0{$|Awfyi3M7Z)&}po0%1Ji%UCY
zA`nac5jJ-&#U$cj$zO)3ZB8-hfSYu@qmTC!3a;HB3#Syrkqi9;2id8G?g^ib^*J>M
zPxk2OJK5N|nPYQ8e@59D)vUynpyle~#+v+r0UFCVB{5A66q4hDp5f8`IoC`f1}pIv
z#4bfC!;tXb8oBKAo@}+uS>~8=OwyL}mh^ZwEDxOlwjVl}rSZpViO0g$po$nI*>lCU
zT$!#o1+L&#!t{w{W7(o&>zR3&@>a?O@lSZ86Y8C&?ow!E69)H@cih{u1O<^hCd5Hl
zLo<h_E&*il&WD=03Uw(gxNf+&*U%FzjNH#SmS$#bQ~dX2930KS^<VH|i@brA?TfCG
zz-VK8dm3<W1t<h1G;@KjF7>lI3N|*^`7S>Wh2qA>*z9awRn_F4#8WM-aQjscfWQe|
zetD$QiRd?}{9x<k+c`j_27P7PdwJjJc_~=UNvAp1uE4*cXNdlOqY>cRl9Mrj`^Zk8
z5cD}w?%9%#q=Ev`#6*qt$(Ngc5Nj8lq8tbfNZ9~K@CJG*7^8mwEs1<sUNoec=_MkW
z&+jxjuq67;6BFn{>Cjcx)iq+(tDosfn8_E?D2~H6{lTGARJiv1h$es27h2<+Nc3AL
zlJlh|PESiKL{sv9_vv%^bvO#?ugOGf;gp=G66lbtpsd0&a&42_+4m)eUgk*2dE+%P
zWVC><ueh!v)OqQv+8IBt=G3DfbOuai<@K`=e=G)y^V~<d>El~<O-+DB2~ADiQ*&sw
znWIkCBHYv4^g4o4(emB`tLuD%dAk$}WIgGeuB>eMaBukCBmJtzQQ#?DKad%BuVeF#
ztNVU^n1=Sn53>%k4@9TcEd@}`06B48)NtI}3zi^s#nydwBo;>^^y^d0@2R(YIe;7e
zK0b?QxBfL(r%@KTvSFaUzNevEow&^RNry%}Fk#0(K07lt?j1dET_0bnH<LWqqU_6R
z-@6h1P#Lj^15({EKa%41N=}PR_nvgwS-M(%>fBblxOv$9oDJN!nW81xX&j~uG6|;0
zl+LrnFFt<{%O9O%9Jo0OFuAC!FkfpUgXja<e7-6vD?=mT%d{UnyiwEAQnIq5_UOpH
z!W=@kXbq*1=%xW~oF6{$xx2fM@DgR0k;&yZe?CapJUKlPNgkOPrQ+i|P5zQwW<yw0
zTUgu$*=48%P;EuUu(9tS{Q@fE7p9k&WmHYcBqYK!<wMgnJA8dAs%nOTduU#sq>71%
zc&3|&hl<f=(9|J07Z<fDT`s+pPukFs<;u!RCa*gyZ*F`<gru(SDl`5^d0e6Rwzj2_
zuBw_EAc8Tge#kQ8ihq@cJc#JhF|12~ghlyti}V*Gw@ityH;avmkC#lQ0QlfY6r#dF
z<DjN_b<sjJ42*Y;S!-*bq_YQ{xaBo8IM&zKGbb#m6tbfxIFEXdkB_&HX7C~U!0?Xo
zu&}X_h*sr(%-BBpJWI>VmV5z`<ebmmSmG$*4mapI037PJhwsBf%0y?Q3-;#g!eVr6
zEIAf}bIA#ffIyeH#4?_cgWUj1pK{bt1eLCy9!t&y);sLP%tSC@V7V|bFyJD=07R4`
zpD>QTkNz#hiXA7b{dESL`<gUr8$gSrwFwxCnn3pmNrTYLd$+f0urF1$wc(_JxcOMK
z`dwN{X@7c~woEZ=B-eB8RVQ3U0k}AaAHKe5{h<zVou*e;LznF!WQu^&48wrjfdMEt
zUID$<i>-?e2Xboa=c3m2_}mVi*9C;xxmn;~akkW+Qx|yN*JokjJAI6tsX%ptkKgWm
zd^eusi3czPosS0y>KbAT$6k&<bT8VUIW5yC3yO<Va18zMT36*{Wf21PdV-~hyYs87
z$3@;kDQ1@D$8VUr$2GJJ<I6-OBq#xnTh7uF#{CXCHSK)oLjr%;sQKR9gx=EasHTfc
zBadHO%;Y3W_v6P%CS6}S4DMV-L;rJy<m8m7*pJ1{H6H;Itln+Z{pikTp;~Y1!eGCo
zy!>iAGN+=-(fHy_hg+Xfv*wlHe%%*VGv}j{;PSW1AEzT@6L?5Gl@)u1kr!sh#z8&Z
zx4b@GdCJ`5&sA?j>z?bAO`rc{6zFn<*8AF=&6ZmHapuYuEN6<KGd^i~a7U2zI<&I*
z{*tGqrFG{11mwAve$EWrZFHu+yzuMl>Mj{M2l-yKV|E!1Z*=W<z7FwWz1!P%;$Cib
z6!KiFkBg6IH1xhhMnJf}dW1~9T%96nWg>t7Ud8R3sIZYfY9w&y2Gi&Cd<Qtje4+X{
zRi3u2t2jlOIjYR&_U^9!YL{Wndzkh5#swGG>F1tOVBf9HTw(<O`1Y4?LkjuKWi<JE
zj$P2x4|8l&a|;VGP;Tz-yH0IhTd%%fq?V7ZFDa;~4vJd!0I*uW*Q|Hi<{0le>GFZ5
z_~%^!1VR+*9Knsa)pO!c>bXfnvy`!;qobA+**#as>Gt~0gZh;Tnr6%=?fYc}ELrlY
z=PMHnHLG}B9`q!E*Y7JUulfU@1$lGFFV^>OZ-1ra<;9oT%r9~^xUZrdj5AvNs#aCk
z*zUSttT*n{kk1#y?wJ}6<bO3v&Cp8B$mk!=Y5hZ80*uq26yV#FV}jAGhgPI0_2D?}
ze#6*-)82@Rq3>_|+N?nAg8KbAd;aU6kXY{y=BAehrUG6!#V!S~-<0FZrcU>P>A4OQ
zjnU+?e7v|I=JfB(3I>PW-+zuyh}|9{$N(}LIvpMY`2k<ULtgk%h-yu@zg1=NTCfV{
zqh`zzd805|0JM^{oI+t~^Pk+rYs;$`aobzfALIe}w1BIzw?7G9a|??vmJ_gRo|i;G
z4NBeAFp%8Yb@8^gv;Ahw>@xR}3k(BT{=kMj1C9v(=d}VHYM4;)T*XL3M{bj$uFcEc
zpM|u7D{Wc19;;i2PC7%|Zjz>V8VaR_h2i0dbuse1^jYfiR$8$5i2$I<+L9@~9Z$*U
zux8oJQAr7=8I1!(+Rl|1kcEM2T#j3|JNUKg01hLjd41yw_^l7PY-+3b{>tUM^6C`Z
zrdR0fuw`iYllR!Vd35sSZ)$E~bw4pb^B_p3a2~{VoneQI6l-es{5hU)RN}T`4(v@4
zgQkT&J^3;IX-nrGK)S2YhBl^hW^PqZRTaWAHVq);=-;scwE8%Gu8$12@-2)2WeT+k
zXAZEDiPkNmqeR+V9#OEc<b5lGke4J6hkhIw9QwGV8Pey3lM)QSJ8Z(5H8LW7nAdR$
zFzU(%YEl48A47$#0Cz5)4$DRVK5O85|I%q|3%yJ}Z=fU^Q&K{+&`G<G1kSiw*V@LO
zoRc&AYIoR_6;DP%fs~0U;VD8A0KA`1FC`SzX7$=%wCUG;#<UVGvV=jslerxaztyH#
z{hzSP<lp1H$Wo#~0100>Mh<n2emj<woD>;TQ?ddU2Yqz!b{=)2npZmsZ)UXtE2g!d
zTWcl?<N&kyeAy96E)}n;X3$?3_zX+z{SY8arO;VnPc9QGv+$$vbb%eYbv1O<Tzn3O
z?GPz&CBtI<r@pN)87*y0(KkON7=g-4Q`W5dRXY&!J1u<TfrsD0g{dLD<Cbh}WlE(T
z9g*L^1I+rMMMZYRs2v%(K-$`x9Xs;%&CSTzC>a(4Izr?$8SDaFu3N*Hgtae_(h=Je
zlolh?On0Y=!Dy!rwZ9$!52Xk4n)vW)0CU#9CYF-Ro{WL{C-F`%7x$jF*R<Z4Gpo(+
zf^c?D6-d#H4d?rPE9{SKKdj|b%&9pbvtJ{pY6QN8pk}l=puojw(z`9Hp{~B)$Rihn
zK`fs{D^syz6}ZTb3?$-btSN+qGJupSb0iAM_DB+Ki{0`NSI;9H&+>9nF%e}{mL`z(
znm0~pNJ-05R0qCQMTt2&I!T6wgi>}&I7`W^W2t%t1*Cq;fpci>1#yf0riiwRaB>BZ
zBR4go930%$X?oBVE~}~n_9q2fSymv@{BCE4-P}A>^z??W_vxH?4XCm0!7Ll2KYgPA
zw#|%p{8>IrUo>?+J}hFwvJ@ngKcUwGWGUo4l~73n9?&CENdR&j$e?Sx^t-QloK95x
z1QJD}Xqj+kWoq-Igo*&C7OxoKdza8J+Vt;C&CF)TSYc5Kzim6sE-j4@Dd;gRH-#ia
z>0}+dx!>3OD)BI8<Oulwnwgp5F%>`tLRn0Ooip%jT3((Z3X$M=&X^XEcSxa95Z1tM
zV4cg-XGL!ug{uJa`+BYRQgw^26E9Vn9F3{z>6-k+Q<PS6`BPGkMnXin288@>nH(S9
zB!S_WnwpM$mml80R@Q8Z1&<6Bi%f88`kD@pIfO}sEukt(*x`9u2t*F>e!+%bb9Vfs
zA_^h5xVt-YY3W?M$2P>*ug{Tr*nQU9on8eJmiocMKNHNk84kaE!>!fNLL-@K(Chvd
zlXlq%yw1>RNMbhp&ZJ%&h8iDv|E2Tgdb#t-mb~Zp?>S(fwe#R3uEPOK86Bt<*#C3V
zry&H`_AFo-8{BfT;eP~haGn2oEtZhiFH9IDd>m(!)TXF0Cx|(_Qt*)ySX|C5&CSUC
zH)l5#l$1MHPi??)LOOXsL(4!!?gN36z;8ko4+4Prf3GGB+(>CEW2#f$zt0+ZsXDwm
zsdD^z?kMp6ymj*%U0wGm@RAH*#Aq4#@hrBS3L3uHcLx1@bemSEEkqB$MX2O)eP<$^
zkXmN?-bjpe+?P@aiHHVsJ?VER_AkG9-@L<;0FXn_1(jU`8o64N4pq>LX-epg)%QMq
zPH4+~rg_o0ahWEIJv!ovD(`jIbzo?4%f-9>bkZVIUh?G?jH&YhfrUi{0N?t(h{2>d
z>WoQgs9zd{Tgz7YQsr}i{qWS(dtV-JzAW2SRDSO=>WW=7G@2~eYnc_=+M|=JBWDuA
z2{oLWEnU1BBA{Dpt;49>oC4rYT2{XI^5$wG=A+$u3uMNsg3U1&E9<PpAzutPlXpRa
z$Fno6hRHf&lngZs<8qv#`XJ{2McZ3OWwm|bqbdR-BB?Zpba$76g0x6C3ew$;bVx{p
zG>9l6-6h>EB_$2g-Eb$z-~ZnG<$k<pj57u*@a}i-wdQ)}6Y~wRK@vru0{93eWUkP=
zeVwe!LOk|8>;;l=-0b0?UW4X$tWXMf&M$qN<{AeOel8r&+wcvp9l)`qs6@ucN1&v%
z>*5ahN?)zXqC&4sojEAuK~B#6jm5{Uqxc0#@L&?sWqCz|(_}yx^8O)`&&j0+K>OT}
zXKo&~+RQ=?;j7<h7?kOeF4H{Q)(__o&wwL+Aug_0q834cl0ED<V$!I~0>|IZ>BYF2
zkHdjeEeJ}|ROF98a$@O`-1pmYLEcWDCh^lQXxAO^+<M1w{hGgKT9xrJg+$xJF2*Cy
zUqX)%3)+2p4MejEL;M_glJ5Gyb9k@Trpxk<g<!{}RyF_efs0^p#)D~oW-%YHZ{Jqa
zcL>oMgh90yk;j3i^(fsP`HmNvYjsdqSd&4?I}QTo?^n7z1n#1LUx>gXW5Z`92#qMf
zy%C?QcFr&0L2o#?wmgJe+P~5|XZMaPp>SdY<Tsp`L8Zgb^Yz=`6$R1-#9<hAAzb>Q
z8hrqE@v->52%?3ih<9UAB<2_~yLY{9F@Dd#cO*0CqtWg2&`B!37ggyvuXa*AzG}Cr
zXl0DLx<Ah*QTR8Ab^QfRJ7SYXv_$cmpVQ-eeYeT*m`Y``Y^UP>`+>d5SMe4HHrnsf
z>?2<ogxrpjefP5f<DO{~;iaE&kM4lPi$pt$$%Bl&l>eFFS{c%AOY<ch7$I0c7JU0s
zbaiFlYG0p)P#^P{;eWn5+IvQ~)FKP<{VM-&FXn#`MaP4~oMt2r3F}q$u%q+m42&S|
zC<+QS68q<2!5K+hoJkDbaWC2;nB}lX#Bet8Q@(v6QNUZWdr-j4!>u6|i9`F~z<GOQ
z?I_)t0FZCwmVCij>Y*+6!+`$3c<nY^n=j$d4mIq8lPflt|9L+fUj`FAoHI6W9v%uI
zxR=JBDDhc7*e#et%jC(kZ7)d?S!AQM3iTjjZW2ASjc-K>88p!`F{~^sR&V6L=FmAi
zJ41JteDI!uha0SS#KgpkDk|9b{XjL1j*iA4CYBKuMd0M*%zpIp^H)~GKB9Nx@`RVQ
zP68yK6BCV%jDVV8V`s<bci7;~+FV~-d)uEPh&gGfum4(8)6F~3jxQNNwDrNNJOLpg
zG<ACOEkV#|V3U%1{?>y<+||`}&rby8c@dF2l$4Z)(j(*J;~f#?;<CK)Y>B<#J#cI}
z<V%(Xh1JNy0x2ym?Sr?scU15@a1(BBzMrjk_Z1<dkbv-61U|b#$c$JPP4HKm;K%p<
zN_APjow^D2ZaSE{ySslLUi$@f=AU=Xvy+*eo`u?z9{tI`1C&eAf{Zk_YGqIl4wG#X
z`;z%f<>DAdxhOKs1H~s@y5Hn)>n^PpC(afys+Ss7zUz{>7Cii=@VR{fGjwD7nUYd|
zMTLq+ol9A{-P%x~`F8a>Q+`g4<S>Vf>t@+lX=P>Q@C@p++}vDjBtf(}D^*h?qk*fv
zxCWyeyHL&LhN18<5)xA1+Qi9ezo$^s(e*|Dbspj!FU)ng<;D%ym)mkK1y>8gSEBHf
zJWH%NF9)@qmtruFFZ=kne^pmk_l>83Da!u0L$Q7*R(?Z+4!ks~pNP7WQp{1!?4?Bu
zpXb?dDhG@X>{|ESs#+1tyZ(uQt~q3GsH^*IeSLj+%A#U<|Mcc&`H7I3t8$~_dPBeb
zWyju8et$@3&HXBzMw{D4Y+0AbztO5o+NA!6>~G};xt*UDUrrbX6e%(>jd7?JHa0gy
zo$`u{i^ZJsrYyMS<>jC1|JiQYblCr;Ah#=gy)Vp@+}AOSh9ufj4z$Sp{5!A&iJRq)
zt$)wU6Ug0pc>C9{UppUlF1&HIo!++0zE=~<cBp;d{W!&WIRVp?e@0<_*U9PfaO`w9
z-1EURSS&AJz9bTI!wYC`jFJ-y(k@s@oV}n53JRhoTKMUOP<wT@PQF#usLPYfjL#HD
zZ=;2Xh)C@;x-dWgbPnJ3cxx%H;ewK0Igh82D*J2*uD4OnV=oGGJ*Brwt1Aijc78hR
z-yw@vksYp#7;Y%{jt&ND-torgtG44{|6M1W8g%(vVC8jdn%{Bgx{pw|^kMLZ{AVts
z!s^e+AHewIxe~^|g(oj9HOv9WBUO|HM`?o(Kxm+K!zRoOcIR7(cx`<B{rxf5HSI@~
z0KcR>(LdUpY!^irgu0I`6~|P!NQdk(XlG})(}c?WDKfGtPpw3?&gGC7T?iUwr^68y
zFxWkhea|7ozb4=X=7Jf|Yj<!g{x&UGLKZ%`4Vww>Pds&slXtlARXnbaTZHM4s^z=4
zr)OvTf0vn_u4abIx`rsAtk%~H-2&F8CHN72A)1n+pz_Yc>-_Ta*hlorpQ56gTY|9F
zN(_39kGHLOoX*y=$;X&^<nE}Ca9o*QTd3E`ib?HN7k;%i)MT1i#(U8u<fYqUMBt+>
zZeYSdwSai`hf+e7N``8^e3F%#O8#<E2iw9@sP)v?>9@M^S+nKqI;M<*s@qu=gxih5
z^3F9x55@KGD1cXomX;RNi>iB%SH>4B=|_+xgJ$KYZMPME=oxp1Q?Cy0-X?zZ$X<l<
zj}=c3b*dZI?rWig0Z{-(C_X7j$+GQ$bo#<Q4#;7hO%%RG&@MR6t3dY?fxGC>X*&8T
zBBJqNZFr*06jw$@hB|OOC+7xyi<p@)sOY$J?yvL%2Ef9?QY|&YTv}TCH8L_dJuSmS
z6xKry&fhxM<2~414`qfc4@Wg78a#!?!-#m-Z%-6{C|A!1_lLW(g^SUhg`yc7pT?hK
z^+%lb=hNG7R8$<*Z|CRG71SLOtdA8?Q&Rfz+Aa@FPXh^{;rBs^lwXE5f#uui;6mB+
zW)l|OfpxKhb;&0@O4ONA%tlX9rA!DYg-_)ezJKS*4fke9-79+FJjGGJ$L5tId0@=D
z=zh-nS=)_dJN+_qPy6ubNbGKD_tJdXn6}<RTj;HxRN>Uzg8I+i-gj8NcD7p#N_G#1
z<rKi~<L-W`X2>>PVM#h!ZcdJIZ)c>yBL=qUoR<)SpP!$=<-ssm+W_D8+1{TV;0Oi4
zUg&meb9Q#7T5g7aJmboYipwPMR;yxC#?{qTe}~uo>>x03WX-N8kvn`P#r0u8^K*B1
zL6Y!*_;@_9=zt|f`1-WJw4$O!xAD$Z|MjWxl;f=X3dNqQi_6mn%ke@lctit3L;tP$
zLfzX6U!@yOh=09jH|WuYy#p*GY=OS<<(nlBHPC6Js6AfLm5aIVAks*6Mf6#BWXo84
z%)M@~k9*!TOy(3FUY)8>-Wt<>Hl#R2a*D+I^5v^c9)a|N0_OST^P`Fe!FLlt{InLo
z?>>S0(gUtLar?8J2HcVf>9=pmtd8E7x(kt-j{SHKha2#`#YTfqp{4X=?SE!sV)EjF
zXUgp**isXf*5pu@rd+q{U=6%%N(yUT*c})gy#1i90G-q^{@~!?6;&v#G{AhUtgLtM
z+y<QiVa90z?G}ma25WIiNx#HufJk~rQHAAfUnutso?5xXraFn|h4qZbx%rQVD;I{x
zs8v-}KRfK4v;U&cIIj?2!PT?cE=yZfuTg>Y&|f)i^xW+uAd*ZhM^V9EPv^(pw=-gA
zp8w`VWf|Yd)E?LJI9<9m<+Ko*r&{C<&n{e?#QE+A*y}qRCH?abH7^mWe{Re+r1mCq
zFC4lg2zv^}X*nd|wIqoHI?yOLo68oyq`ftJeRWLB$S9bFfgaEt(U>ip&Hpy#!-QFw
z(-(d|zNf~2ySlqi8__*(-ITn(7!_^jJ{_kANTL*o#6L-|c93u0c#6|J%HH1ItrJ*o
ztzHPoeG<`@)73F!I-ben<El4rXt^hWoT`At=j0(Z#yv6O;90rm8v0$*oENDva(~gJ
z3JncHU23F1a|GR7&c*ii6*H2Lm#^<#3W;}MIJkKi#l>uJg5cl06tsaaM5~_xPA@l~
zY!fGSe_>!iwZGi^(Fqe#M*wu?-@m&GJTFaeS=65zSk&&e4d2%Q=N0_-0`^pvL(O!=
zQwpfL&?-PpIb9&V4jf)vEbeAnSWdL0qNBT?+Rr_&+4llCkekan9j&PM`)UkM`?n<%
z@m%Hv;75UX9#C3d{zhKjx~b)t!XT`0ROZ@eT3W<#9Sim6Th01x?o4v^7+@@ZW);L@
zb%GIQt}$>&h$A&%i!&F0ybhHEZ6z!}&G>H4Lxufc+ppA0;}2TLG6@mWiGhcOx2`+z
zk!xd4T1rZ<Gm;W;-tB?WQ862v;`rB2Uf*(a7jE96{wLdE8SWrO?-kn*`80XzWx?>U
z5qw@sdK{Icf?xus`M|sigI)rCwPkp3;Pd_t?sNp7DC@+;!~{Nj6a8s8x&j0E$jK2(
zCVKqQ2v4Arcr`v{loLF}xmnph&vSBfZ;#hHv%}fLqXW(lD5QfD+cmP;H{l2<0~8X$
zU*ZU5Gvngo#1#}2^fTrXpu^huUG_1CUPUbB7%ays&@%s?oTLR>Drxejl;1oUgT5r%
z{{lCfd(5vINPAZhDMN-Pdw(M53e!&rF20o)WFj(E(Up`SGjA+oxqtUSin*=@4Cqj`
z+eutQocEX0#{fzQC@Q+eCQxv4DnY8mcX&;I_^XVfqM|MbLDgpY<csCd{gAK5<SolH
zb*>XY51_0Q3pimYDJ2NG^Fd01f{BTV?GG(Iz20EP%Xn!jkVb$UA=A>*`l;J0oI4WS
zJQo=F7dCoMPL3>(n1TW}c++)gXlQid`>6$IfB#m$I@Gy-gqQT>q;A_C9RwH%&E!Hq
zc;+%RG}L#N8v$0p+98&Bsq>14%T1JZCFn6{uP<kB@UUVzHdz|D^S(9X;fi0_OWo^F
z^t{ORx#HYTw=2!~DAnRHA&@~OD?&h7^cB#(+sRx2EP8N|g9ZdEq}+0rgtpr1c-m3i
zU>~)QIVWdmYKn-qht+aMAeKps4vATZWzH%-C541ThFnO91kO@`0M2`z)N-m71qI==
z7t7qYfHnvqw5ap~6aOu!TWV0G3AxO45C4upGjY=;0IpYU@DLPA4PXCJ69$I~ygpPe
zIKXFl$$s$QJ=p8kxr&6Q*xH&E(9Zjwc-Dyb2nYy}lz}t&@khkW!9a%Y+WkKMjp>>=
z>xDK}j|(SQRBB}=k8UL-BuFRm?B;Edb+f@#6oK6qZ1UfqDI_?!xl3%8B&%y`5(J#t
zDrQ{hfyEVhmWmFLw9fr<e3NT_Vg6|<DTGXNzG7h$U-}Ul7Gi}bR*tKJAv^;iC)e@`
zEo(%4{3`0u+~G00Zi!mIYR#1!@$4L)+o>9Zfr;t5ge2eYZ%&!!h20FAF2thlPO(ae
z^_<jd&o3;1j+?DH1~q?jEWFo*Qb=ekI+e-Q#dX)E_9iw|l6;D|ZBqrQ89cMZU2E#{
z$r+&yc?V$Ac*=dXo?v{b$wme#{LP#Bz#xI(4A7hcW=Ws0l98;__Ce$av<2DhsLD#7
zj0`bZ?fvsho}`;Bi(Ft0YCto{8`xkC?bOczChIi~$D1bvp%fG?ANy+~Qal$6Sp8m(
zvzN$X^=Hd#YxvY;BI+q~RXNVcOnr%z$E?52;(lgVe_Xe{8<l$D%RTEB1^?T&?3otS
z#X_Mx@O_Hry)Vjwr+>P)1k{Bt3wv;&;Pt#U57EWNiZC_K{oQ8Lt4}>W(y<I`HX_x0
z62L$fgx^~o8hTTIbyy(21>Fux#jFSa`O#)(Mus;siIZ;25k5Ztl=Dh*!~+HuU~DC*
zsaym|QarDmL9wJ^Vp@(6Cn19ZBN1t2YPxW`lG?szx7R@)4sE5hjSZXQv^_2|I?0!u
zoM1S)4}DF6*A%Cv<*j*O3=CK|b3+oegGpAG0Nyrc>iD0gk-Baac?OPFeL*ap-8MWA
zV{_OTm(WS|`9?#i@HN^Bh{U3aJW$fwR*r2i?Z-UGGS^1S9fU5d$aU&g!Z2qrQ~TQ!
zE$e$nRJ1y$s!Et%1swO)<W}wlcjK{tUG<)Q-7wpaOzH*!2`5kwob^s8dm7Fp4Ps@p
zzkZEfT{VJx0nr>m*KT<wzg$qXQL(qd(F;MgworPJNLde^M=#$Ff9(a{inyX(%I3|T
ziYXiHQ|Bu3yQyD|IXF2>=93+bEw_PtDYR<j?D?z&eiMEJ!4tb~WuenW1-GkPw4Ff=
zHA_^$cgfK`QBunK@gwEYcI^!x$~x%qqyDcX9H)L162C@A!FIq`UG2h}h}M(p$ys6;
z^R$}{be7tZJwcOo0<e}x_r<q0L3mS@!AU@y%lyn&(Diuk(5bUWT5oNLa&g%p)#?%%
zo!DR`r>t_CBr<Yd&8GP<gqVL^8+_Ah*NsR?vef88R-{2eC=uo$RjXEPApm5nS~$|6
zrRi9>95MZFX%w=^_mKW=aY^yX*%%2<$w9=k;epzRrRgXFw<5K}XFT>o2#Y&?mu-D0
z(kmtgLNnq-?d&+hh0bWy)YL8j_GA?oV|@UmuvNP+3%M?B1E?W?rA|E385JX+lDq<o
z%{yqs!$<`A-aVa!g5|e)Evtbpx5Yo&_b`AQD`Urp^x~F8BxoF}46)cp)*H9l^w}U}
zf!*0^&XrgN$R6Im!0BRC1dqW7s9-5>dlJk2siYGHo%(#nO8t6L)$4~Y04tt89a*w@
z$>wu0EPRQ53*v08A8~;Obe{9Wh4e=S`8iMrm^$ab$5ab-8&Uk6DI^He8~n||B5qJ}
z`lX47kB@Ku7c1U_OqXYl+IQ`E@(RHlp<LGh5wn^ER=xXcTU&DzE7~t&DPyOs;5pS*
zPLY6jNKH9{!nmbdTd6Ev_N8d-5+=8r(n$JytYU%jTM$ef;RH#8Kuvs@1DMTlk4rM>
zL_dFh$wwzM{4~_CGW{VlsWwuGst2Ft-yH`i_`iR<NE%A>FKd=XX}5oGS+XJ*a&Uhs
zFP79@)IjQb@tQ{3R*JByY65uudRDtluV<fNF?aTNlhYa(`WorzkbdT>OwOR8p7L4P
zwBFbiu0c*s&d#8L<u*7vD(m6FB$m1Rr5qTd|HQ==;)*w#0x6ElKj!l*W|ws8ugC9M
zn$qCRXQ^l#LR?MY;Lm0Bb}k6@^!VHs4^U8cBM$!(5~!YTor8p%kF&V43vr9xE!SM<
z)kasjv+ukZ_x467w=b_ZrtO_HR}zkQx6=$>kdFoqM)o}ECKBzz;kV{7PBcpt`CX5y
z<y0}<v{gRoSWzoO_TV8;5i!3*PY;b+q#6|~`-6UgZBp`3MvdZRj%k_C=eAn)SQ6~w
zD@nZUXUXSN{k9!_eSZ=P1Z1qOX-#K!`Uh$?OI?U3%eSA<(gwAYxW{+pn9Qh^`JYs(
z0{on)cgGEt>2+JNY>-h<U@xfKeeCSa3tcRzD$TptegeBE<Si{PO7?n{Zgg<N)Jv0w
z+1ZJS)^+;Xx4YiXA%xuiU@I#AJ3Vp%JP<J$lmMGfzIgf4W_O-alS$=|Gh@E_#T+{G
zyp6N5scHMxPWUg6)y8v#_PX|kxw0`84-5J`+^8~ghCKyWgiGg~1o@AfWjvoDvF)`B
zzr0)zzYIs`^4z-PKVq^JM4h7B8vF=Yhk@Z?pAnN*T^3!g#3d@a)IyLdwO!UIwVmb=
zOV!Q)uuEkQ0y`iI{mvg-E)EVwhw)S^vv7QNs)5P8v2_#_l*W~P#O2r8wNAUla<AWj
z-q{VJM1_D58(SpQ$xnd9<h8YBf$aGH{d-GW8#LQ&y1MlV6J`&SYG*F0k9!v*Vq?Y3
z%*_5+ni(0<*e>_H1t5B{<=Al3Kn4ch6A=+%Nsvak(guW5YCL>rQjddR+et44lU%IO
ze3C2rP3pOFhHy7^diT=1W`9Nojp{%NY}5fGju&Dtpv4tvy+S~Siu%mQ|LEwU@(;Iw
zoWCai=)HPdwXQ*dfj^gQ<lngXL$5nLGuZiy7Q4!E)DCtMF>x{xkDYH6buhd*w0d@J
zE8&MKpIr)ue{VW`YWBSMf4l$>N%$o7^vI=R8T5O9ANC}%CV%_(ipz4st1)fmZ<)<g
za)zE%?nE-tVtGmHr7q6$?Qvit7-4OIQoP)sD5I|a*BoKn@8f$o5~4uh5(_5?YF|L)
zIB^TsYnQe8^Yd+z1upjey#y}%p|m*RNq#=S+k}RFN#eP~#a35D_wTnY>^nQJOqWTg
z@TAn%YDT{ixNger`OKMIJ4L2hZxfTufBZ&G?WKu2-O)_9J3*-bi0LT1eHR6|gvJZs
z(#sD<XfhToUcHxkmO0mzWi#WpuEi9q^{(R+Lo9>(GdnvRKzGpj7hBGf<(Qb@adE_*
z?yq1FV*51D>2BBifCPtA(B8Z#fn9k#gRfcd7UMXhB?S>TVy$U`qmJO){j!tlldO1$
z5AY*jzVP+y39;)-5_If-pSO?OwQ6K(*te0eddSxnh7ZvE7o+9xjEr}AyUKg*q0bA(
z6j+2(XN8UhxDw5O-pU^|>geq?7;3qbk?}Nvg)H@u)a*-o5enEyMsk%HbjqV4LJZH2
zwo^h;St%kWCWx}BY45!h@X?fXbdei9b~(AGojpBIrryncXBL!jaUl>|(lgS2NR9gO
zY`VCt;EWg-`=!Sf9<<-^Jaw<Ve3FD6y-rSe>JPH0VOeWdxx{$XAxjqN?}~t*@AS~}
z3ge_RRLReFh53!b@K5Y;VY(5+XQnI|2blB}&*$b+*WDfT4!>_-(&s<(Y!hy(d(`Ij
zKp7E-wEx*7or=lci4w!xNO?mK4_pq>9urB=u0Muz$?4iH`uLM_F7b|IrRI;H$q1xw
zJB=Dm=b^Vx+N|8U*Ig>MsPsK8uIev%ADfg+>^LPsnK{T^TwYq*88N&H4!nnYzqQ^y
z0Q_9~M;i$^DRj$IRr|o?cXct9{GBet!3oiuNm4VLt&eg)N1wCfo2b~n)gG3tyWC?O
zLc|+_E<Dv#X8NcO`J1r7wy;$o_{7-F|Kc#r%_*vk4NU7b1Km3pFll6B@~*Fr9rU0)
zwVH=<-7jy-UVV9FV4&4wX6-+zZ<db>{@B!5y4r4?ogry^E|?F!QBY;Ed>F^9l~G?$
zk}oC-yTG!(E*Pu{#kw;@KeXtxtE<a(5Gx9rP_5=)V4|U+G1OSHDp1KSj*QKI&Cl;8
zt^N@`JgtX%F_WuOFf=?Zs;7XxU0?B7$_Wp;i<Sk4V%PqwpB@E2et<<JGC2m!NtyAi
z?sUUnWkJ2lc;0;FBMv!z26dje@=>lCmvcer5gx@T<+(UA($aQLRoG#cmD!t37ZcY^
z_m!D0;o!!xIQ9YF)&2>#uS%Cgx}YHCud*o}l|`BHw%gJ@+=`b4D)VHFf_@<FahcC_
z?JiJH)NJ26mQJ>jVu4iG^KAA)`$<`ktB)&AYfEFS1P2udW)-ESP*jPXJTx^Kc6SF$
z%k2Ny@qPc6_u#_R!h(#ZqXXf1R{Y(&JCd}La;dFmTv4BNA)<vrh#SgVxs8<=Q9EV!
zTYb{HW|~2pBNekb;Ld9$CDHdvjNgrESMB)ncC8_n2&_X-XVlA$sk%7py7a5I91nXL
zMwHQ$pQOEMX;0u(GBz`LN=qA&*Yn_-vNn;xF*7ssjB$JUNGqVZ^SeSTtP<EXSOsI^
zqN3!F9$lFi<mE(4?6itM9L7p%)nQBR$Bj>66&Ah@yM0EEm^YJKlKRWFW6tWey88W}
z881It5b7_vpX290bF{Yyr^`0a8-C9zqb+!z>iLhuCwte}SMYglC~A&3s96Uk--+CT
z!c<zSc(gGgepSf|MJ0q;;FJYSB+qDHIyg{0mg14=?d3^k0`mi0Ue?9owR3D~sfJ|;
z1|eZ{BqeHRUl#>6bz<tpf#I(aPVmV1%;-WRlXW+-7tS>6qYb~w9}Q#cSvl38dqOxK
zGbM??vSLX{Si9&(zq&lTo%hUg02`aIH~3NaJ#^IeO$XbP4*3nPYf7h&txezL$>RmS
ze}Ky?B`BOQH{!VRGH{QxJZm7n(Bb6dN|!IR8Wea+{uJ+XTysRGAI+Id!bO}h*dks@
zmPV$;N`fVWBpf*lhuu*6{b@0!D#M(<A<)~`7l>u{_L|jpDB<nmk|u1=pNolw;r024
zY5>jo7`op)CtY5?y0EaYhfkj}fa~@qJ8WXYrk?B{5_01d20A)3vjjW3Ntffz>rd$S
zp*Q7msQpx3jl`rwYj`H8U@_73;|CLyR(%(21ht}fw7AT%yG<Vpb}v0ovpsySG-au&
zqKb6<egXg}nS{9=H&B0I@-JJ_lhn20g4xFPp(Xk}=W7HK^&+B=lu3Iw%r12g%`LAT
zbU1%hWg!-f5%MhDj09{BNW|wf;pyZ)P^Zu0aoxH@$Yt>r9M$79_gg}5|F$T}9A2}$
z_|j~|F>l9n{pDCoMg}cAxPK?#uwjVbJ~Ap3j=HN0L{ENi?SAf5_vIf<WcSHhR=i}h
z7k1l8R|dsNDY@ZuKZpg;kPv{G(eI9B1jHo!`}-9Zf}OrTg+onLSXiG&T@Dyc+P+f3
zjktx@*(u>gr~ZldUSe-p|4L@{*T>nzonh1G&u9gNUP_wWx2PZtANx4rRwvF-;h3ha
zr@#)@R<p_axbg8<J<A%*5;Q<^4c<LWDNE?3ioWxoNr0Sz14qm95qpPGi%F=@<ge5^
zAyPQbfj0+hjBAD9oy<YciWG=s0v$;UXMJ<|W(~Mf4ClO^fg%Jy-Qe0G4Gv%O!%#6%
zi8Xw1p!jNAQqXh+PH+8Oa?sHUAe<T3E<lE?dGi_tlh9*5%fjI`J6OQ8#lIzKqxZIb
z*7LD~E64G?U32qcPY{I09vwLlIUx5k=5I_mV${h7bT3hHGb1N!i-UO-&}v%lq^y}V
zM{h5qm)aAY`@aqw?~Pfu4b&w6EW-BFtg;E+_S_~#dHC?_#?X6!v!Cah1CF<B8+0L7
z_lsgnqxv3@<H`n9*>b6e6|*nI?h36+8?Yx6kFDgv0vz9PXlib{>7OotMR}zr^p06(
ztIMmk<`&d-dOO>?On$gnUoYgp<8A;LqVI=nlZYq+sj{G;V4il}!_3B?7tXe4T316R
zWzsYq)ZB*mR{D|+r_Vw`IYvafW5Pku)YNQbW>mS`nx0#8F87(BN7(52?!vw}v|YDh
zm_|>$P)ujk{WJGlsARsC+ExjmCm6od>NVJ3ap+s>m-+CJ4H1)oKyqzu7;3{?metD=
zA)J)?3qMqWvksrDuqDF&1B;HpPKlsZJN5dVmS&nIQoBbui>WKGbBBjUrV+b@CqFdA
z@!kn-)9JiC;!d5LJ{~Q4yFf+adXTPh7K+SQrFbHq5T~LDgI>UKef4)G%XEtETIop$
zot--I?yhx`fEt*Nxzp3rVF2rb4WCPM92DK40*@tHK7M{cZJbH`jwvujhDw&^p1!8}
zHq8cf0k2s+1ctW~q{Us4LqpNL2HtZJtZr=FO)JYsgH@=U+iG?{qbMC8^cE{C7N&~C
zT$OHQb@PD_{p&Sk&rHAN=N`*l<KjOD3`RpbC@&A8Urb!wW^!~UY91btQoY(2z|Zp8
zex2)sx24;rF^4*%Ma4p!j@Q@<TB+&cN_Z=HQ7gF9l$DgQA3eg4rzGd3#9!Kn{?31d
zAfSImG<PKOQ~aOs#hmTCJ$_^Blr$Z9_bSx$W1+!;KD_Vpn7P%6<Bf)foM~<Yn+3~i
z(8rp?uLz-`GPP%a!3T)f|Lc3yojD!~3g6gRuIif0^Oh|*H(XK@*t21aSXXJ@oX5n;
z$*`($3ssvCd{|IF1`non^pggR5QO)y=mF9Of*qRp(Eb%thQx$~z9PMLa4Ap-35CIa
z02je4NlCl|!I9%BuN-no+Rup^G<0-xxjOFmqiAU`mdT&$chQsiV$4S!8A9@vjo`Ei
zm*oA}kIOta+eg&0kBhE+(4F0vG+=z`nPCgwm*U((6KK)tR{C`oI|i|#6z~3Cw**9d
zTSQbeUda9_1ncKIiWWAe9Y4kCc+?$_e!jw|c=s;D`R{jX9`|Jd;IJAOb~XDWeQ=^;
z_9ECR5<?DfJT9VAcb7G`_X1XQz7|)gT^qo-j^$*fTzScer09;U?y>PIQ)XNy?RSTN
z?b8O+22CnemD>tD_xXQl)`>}((jVHR-9=6uG%35{@|p33s!}%t7_&CRJ9hc8Y!bub
zpE+zetJoK<7sQIp&zT%Hes_0qtANG)&NDmd2NneZoBT(wl^uf62)V$6^5eMw$fBfC
zcV`x3ZX5+#fQNUBeFDO)H%=tL6Z#YUWH$pqP*9YCda~x*+?e(Zgdr}#Gk3=3PZk}H
z7y4>^voy;1{ym|oNr8yZu9kb%G$<r^xn}}3Iy$9o&E`~`_Shm@yFfg1kj3QJy&o|u
zJB|J_Njz#DuBM~uV}v(TC4kLZ@i@K%C@h44mk7?@?t)s`xALrj@{r=Xp<ALG`=PW0
zN7&G>U((N?3o%uE<eqhj!=?@%FSKTlq6#D3p}Tu>zNq7NYVTsk#ej(!9i#R2;6RNa
z@pF-SJ}mC#(3tJlii$k}gcW~wD__Y;A^f?tCmgSHB^3==me*2{vhFmd%gu46$L9mk
zN(^|TwP?XF&uw3ejeQ6VyNg3v-51LZ*RZeAgHTXFz2GvNl7>qJyBoop@prGFJxigv
z-0$C)s%Gn+>FEuBm|WO(8m~5|&J;%@=ciW?8u7&t2^40ZM)y2vCOuRtI=g}?Rl_D_
zq`5k8G6yl<qEOS*`{d-9FlknPXkU1{n}I03mTWraiSY3?Tmp2qV6{mfF~W;Xe(9!3
zR8%wwF!hbHvY3Gw-$&f@6`qiaw#?hI$#if4Crljo>G#CTkDFaR_iheYdW(Wi4HE)}
zhO;H4q*}KMqf%nUARxh&7z)#TL`1w{6cOmPQOP&InPF|sINsYE96}FzdmGKz*jx@?
zf!+JeTnADh4v9W<&HMLIQ7IW2{URgZfTczbVhU<%3Ho2MBiSiX(Fnp)dHS-7=>bS)
zrs-aMAlK$3D5O%Yayz~6_cEI$u_pvCR!Uo&DIx;1<%Re#<X%q8OhX9y{o_|@{2z2u
z!S987!W5&GQTZi$XUB?4wu73NGAKUY2pmZga#E;0G%$Ke6i#1qfAq}k?10i}eKQ9_
zYPl2&UfziFxY;pRy$BktJY^=GdYI#3EFvPBz`vpm44=fS!lChjpMZ{?YPDf8cXaeT
zq2vwvq|2V1tOX5hLb`Jmg8w)WJHYz!cwV_}PyKr9w)-(0s-c8qcqsH95sCc1z)jfL
z+R!jFuS}_3KWhNEiYFf-Z)aDkprRwL9D7~X{Yq}7sr6&DR`m<mIH=40#CBcOaow$J
z!`UdPXj$p?DZzX9LF_<5MI~n(X%GfUl}AZ4L^j*7Gtv(r{KEbzji5UL;I8sfWr$M1
zOCciyEQH&I`RGyO+OQ$~4K;0N7s4?!IUAdIZ0utbQxkl!%goKaebCuAKeW_+bG+O&
z6$lsD(``s>sMI1cD<=UL2}onnadA;m?7p8qy%r$hp4OVyH~5N;iRm@H^=G5XRyvuB
zlI3MOhR8iKA))NywQa6}wKKGPn>AQ@ute_v=ug}@bb+tH+I8S^NzL|jWMTKHX18^E
zkCv1MDamwTb2n{!llY3l4jj^oiqf!eF(WWFYhSkkG-!3aKIOkkndjfx=AZpAxwe0L
zhW4yx*d|GKrTuet$EL&V$o8tKd*$THQCZmoJ1aD<v65>?%~W+O7VQEUUv(ZtEXpm5
zf1F)CdC5Caeq6V<)v|urWoHXl+mbB}TodFIG6(VS`t28b4X?!gtvr%;9-J78;8A$u
z3(XB?18M>n@X?0ghfbmwQd0b=k9*)iJYz~Nz_;VyUPhwhW?EV3J9n;lYnf(WHEoNW
zNVnpkLcQhSx=khE8LhV(MHF*kjXdQZ-MK_50N4W~Rq&ep(Q5yFP?8-T<<f%jNl2)o
z#&7;b#I4Vbj&30JQDbAH=aAw%xJEd4m{XM<yl(EUF9uec-+y0xy2S|J4e#K(Tv!9W
z^i43pemXi>9B42nrffC@0p@cBchOBTaT~9F_nl@jEC5jZqdo=ZqhVp^!B#m=oJgz7
zPloRiX%>-?l3C;4_wHWG$SA&FGyU8}oemboW$fgyUm@-5tpudh>`!i9T_jLW{DZQj
z^`<(ar_&Xs=Qn#kS{l55a`Xb2_clB_)5mYwAU=^r4_W0rYiog{@n%3$^M|M7HHO0L
zqn1DQ+4L$VLHMn2S(PV;ljw$UilLuvoU@xRoWy5$zzG-J!vJ4w3JGCBU43M+R2&K$
z5+(^rpMsp=P0&p?+Xn$TywGICgi7x7PrdMImqg2(%eqH)rE;ef6x-f&QkL{5saaCE
z@+unr1s?lEP{vptHjHFb7&3mON046qNricRd77sW+rvnynLJp{&CP2o&fM$wmY5?_
zg~POJj`w~OTJA@Ap5IOzFEJz~7ki*L*mMd(y1kOrYyYGT1?gnI1UTtl%d0gXHynGS
z+-EC>#OBeqa0jqQye<bkets_>5XOp!_mWiZXZ(9?q^+r0$iFQr6qM9j$5}I35fLLI
zBHDK5nrRpWUV@DtIxV1y+?tx3p-8?z+Q7%bO-+Z#laYayHwxNOd&Y=KJaAaL3K(Nu
z^s8HIb4{)EA^7aUpFZhA=NQlT9!uqiHaJUc=9&-<dgH|u6)E1neGBS~e}+O<rKT)f
z3EOGgSnAuZ=pdR@Ic?|v?%M7e$^ht1FJAa!W7}RbdBAy8T3$9+$Pcbc$}4{oecM9(
ztc%NT8JS*qj)*QPjB|6o0Rh9WXFrTBwCb~A{hoA5A2I3dkj^a0{0IdFMApuZSEy6!
zd`(zkZ>|VizGP?V7WrnnN#^wbTgt=OX)$k{1X46Cbn=Idp(fNh@^9$e9!;zApnegK
zod5OuvWAlY4Q$qace3u>o@me{h7PA<GPHkP)V2BNvry%aduTYZoO@mWZI_$%IBLWJ
z@&gp}X~Ai)*VCiFWq}z+%JeEM#2|7IPs7@P5siOKSJ7OW$Qi(0jugAH>tw}8{NjaJ
z+OWy4lN*>2f7)oMtD~Ty0*4X&=aVjE2@(3sCO3@Asy)0k{<rXzJ|MxfL9o-LtAQw2
zIvgPx^H?Br-$O;CWM@y-Yexl11~QAb`L*6HzC0qLA|3dV67Q8LA&dufTAvP0W>!`x
zunFGMRNkUJU~L35_)Q>kd{+cin8ro}V7qx-4k)-1r-hTXULsoW7OkQoIcNR1;ajNZ
z``J(f290!go2twvs-u9OhE845NtFhhIt={rtS-M^X}hi2+wn2N2D(IkxF5sp8Btis
z;=jBUk;v{VEOgC=xX^CBxM~gK;$Fe}xV69B_pbLh8V45_WJCko7Yuq<<!?!+2t?e3
z869DK)jO1x)j{l=vkdyxJL_Mgn^yL_=$Zf9a6*qm$JUj89+K!6;1-O11WS0q*s*ey
zFdwwdz}9@r&xZxVYSUtcg_Y-(s#9&}N3T-w=g>()PL7(}@zo!H8gLbZFJO3NT1HWy
z0?cS+&~EI^epqVqW22*^M?rZ=<@$>21|ltKLz$pg`7v+Dcf-dTzTy(gWZl{S`<DQq
zI~-s}4cq@MhI@l?FTs)}mWc^rFxeGLlr6&9V?)#dcQ+wFWqv30;%ej9f2OZ`R`w4G
zznsW>GX1Nd?I;7DN50NAI}fHDKFn@<IAmKf%&GnN)GyTb@;C1Mt1uML{=Ep<ZT0{D
z?H<a&e@j~A)rZIbzPMBRZ?j{iy~q9cE&re2JFoB}b8zY^Y`pm6e;46f>H517t3oXE
zIW4qEF?AIG?lCTy!X&?YR5=aYa@Vs$8Zaq?p;chc-H`aVf2*LA1cq|euKG5+O~Wns
zlKT6l(-v_U|IP*>+_?#h3S_zgpF#A;DP`)6fcgKk<MA7m;74`(Y8S-S(f{{CSMOkj
zZaDBi3_!?N{s@>mcLWN~w$L-vGWF;;UKlXKaCK`7B15QIzZkFoUGYg?Wf5cMwvLYO
z);ag<b+IS(=%qjFua6LoZlZVvq*k{p66Zz#w|VrO>Q7zW6I8N?5$_!69&ih*(T*@%
zuiI5W<E-9Z5lUr#?Ho(@@AjQAAg$JWTk9-u(v!?;y4UkcqyI*5U+_G10pkdIsF+Xx
z3hIH+6kZDDi~p4XS0@sN7qjElgK_rAxytM3IbGZyB?a?SD&|OMjH_)s42}PurrW6Z
zLGLj4>^Q1>Hb3TH%ZIH9SsOy`n?&yERm_^ROfRH<{(F+w!?#amXGy<xx!L-iEvF(@
zvu_#9xo;A3&&0f>wU<i!_g(YDBtMW*d)z0E9oVfN5TqgBAN28CBqXJN{%?V}sr&5f
z>Y#JvPj8YGG@K@KAB)ajwA7b}Cc0)Ln_T}}EAzv68J1&x)-^j*%+F>|J|xn2B3ybW
zB9thm{@eG4l<?Pw&+>_U1d*Qs#yg{&_4=AcxN&`6AG^cwZ<)}Ooyl$z`5<oaBdty%
z{`IOS3Gp@kw?c%8BZd1GkkER#J@YRr6EOr;pTvIp-;d?axfI?%fJ?+n+s4VD<oI_x
z8%kN+RWAG8Z@UyeV;C{`_iLO{haAsRmfQCB#nF1OzW%#39Z945$!GZulYZzpvF~RL
z|M#u;MlMMlZ4nNVbGqKx|GQPG*?$E7Fc5i4zK(tNZ*5*h-q}wk;WqjZ`{Cc!Q0UG|
zUS~5s`?p~FvH$<scOw7K9{s;@RL#HF{D1Ff&xD&zcK7BDxf!eqqZ59Q&L}I3ffU$l
z3{q0@SFZwV&#t?P9wI}hKL01(Cj?K(`+Qp`Og8&mF;Bx*3Kd*mMgti5_+G8=B5<W|
z-cxGot<C*YXgje@XFW-4dZ9BvL=_7oIt{u`0S*$(NPPK^Kel>Ln8lKBaDgvEwQkvc
z^vC4S6A&eMO{rK12LT<Q%Q<`)`1I*IW(VwRT%$kSN%NJv6?D#?f}nBQ65a_Y5CUaD
zj&}s!<JE@C59|-@mq88a9Tj~mk5c2f`Ez0SO3kBvJLQ}h6_*hxEsu}G+5H`Z_Q(Ji
zq?6f#oNWzk`b&*{1N?4-tER`d^Vn*(7+LlFs`@&{zGTu2#5gaI;;eXxQcw0=&A4VX
z>ipG?`xc7YQ~vZMl-T@tGgC1=Ssxhz;}qWOFP2G0!4nS|jqn4vEF4I=(_{f>E}FaP
zX#um5i;j_Kp%e}3Le3o_3x|x1ta91{TJg^szXQWRX4cdYCiePw>fdLOqV?-FXt$`y
z95G={lp$^S`z<ZEhVX{q%C1}Baupx}&o2uSA|@7*+vLldX$$xxD*+nV>5tA6#@1Wm
z2ct!Dhu_w}J=bKymCeRRg!DZOXoj!ix*v^Of>9EvAPxdFaB3i;KK>NP9sR3R5#mqa
zu7a?$34QK8HoU^aabUfl($L(?Qq)z0&~a4fFUw@&hsgI?Ru94Q$3f6*9)?TJrGb8{
zk&G-}Xm9t<^t2X~Y`}GvyxO21!OOkI3l)R3%IfMWv>_Onn9qS30FF~}j1!Z{>?;_x
zwo*udt5`i8n~jCPzq(a02y#10EM3`6#khSIb*~RP;!3wQERX|?%GAN&+tJmdfACG-
zcM9j0<+4o`kLTQ-M@x@1>6zPC_9I{vgqRpov;RY2+2)}~q_1h&5_Ekn$!h->2Y?Qk
z%^4s88iFqv+?1gZeWaYcPDn6O`yLhW<Wl1!`oO@#0RZ+v*wo*?eM>7ULV;nSAVi7o
z`?JA^ENgiG-2@~9blhifLJ$5P^&ixI0<jx1QU6b=!asCwnOa(AfBE7I9!BU+0z*Qc
z@X{uviw3}eic!ld#{B%~*yuO2ujSsqe-yi81%?2SY{~ff2|p|^8<bm2%BrZ~f@`3s
z{#Y9{4Vo+-yHys${^aKM!(zM6cMvh+wa)kyIfNB0C;$3Wc(1|AVy6hO`D)d6tggqK
zH<kbpUP(Moo;z$$bf*Zq1_lN-Z|+(xuF9A4F&;}N`oj?6j={`Z&_0(K%{Be3PUW$V
zRA{AyM+VAzCs-U=6TFe!>VQzJR9qI;z6Ce?m5fZ5?!^iJQ5$_04HIp8b<XGD;QR2|
zwrj>~kTi%)O(h*a25Nd?wP?Xfzyg|nASHR-7HMc8DA7WZit>NF0L(>ab(}=}E=dEr
z*jifCX1{9_;1_|H^*Kn*`T6-tbWF=#G4veVWx(YH!srWX!+Q&DVKF3ElRGYT9Gn#}
z%{!=3_oT;C&ej$caQuyA4vPtn{Ew6uvDhy_$>=p8=i~cZP95%erUkHYU?AMV&ECOb
zZvPapY*zUXk~(d1?-4rWOlUIW&K}rSX__o0T7JhbS*A(mRZn2t?II${J|JWLo3d8&
zE77tp3v5Zz?F;h#ms`hOpQC@=Qc|>&q|J(++*Ce4B7S|$==n_TU8Le`)jT%8_U~zh
zJodAD=OZ(9=h4G!iX`DGo8whd&p(L}eyu+%v;0<cihc8~XDizta^^F&FMD+gRa?~+
zltgU&i>b153t#1S5ppSyjE>R;G^cx<=FWagZ*GSRlSDlJVOU71-5bxTVLo0cKVf!M
z^LrWkk3${d^Qx{Mk{s`*cQF%K**&p5S)4Dw`+bbf0oD?UWO8ESyT|#IEnS0dWE0-^
zn}0?RQ{I)p|I6=r9iEf7@#aqvG=zT}JdSKRZF-#i$V3n|=3`hnl;N^QO8Pyd9zA{p
zZ@1d+v{-%jPjeRrR_4{wc73MF`rqg`lFoJ7htMRx@e@;jlm?SWV%|vB9SqUawSCU8
zTQ)j8!Pa>_{Iy@P5p(zE^^SACepPl~N+_T&eQPqbXq=Ot{@neNa8}X(6JE@xq;#xE
zcEu3Rm#tL#-xxK@b28h*zE9XL)7v^FogH1DnvM(&5vX2YpZCuy#IC-`Vr~6qK3PFu
zFy`7_5AyxrX~$Uw+Z9H|vp+`H>jO1%d#F^okoS>*r%#s^?E*Hmkxx@|CaXJxf9sBw
zkz<Pt`?bsF8^xn3sU+}4FWW!1;bbi{s(t~pW7M9L06b)&6WvS#PAVNlzt$W|skraw
zv9ks6wm3Z-pDO9-6ksXXD%!b8>hd!V2AMQAQRWnWdsU^$blAS4^E$Kr5se;Hv~fIw
z+^;gJSu<|?j7xTWF?g!3t^sEw1)jMOnGlXzhcwZz^k#7-L&LZ?lHWJ^9dbP{D^lsQ
zhqHj7R-7!~RD9T;U*HLx>&>ryNaRD>4zA804@m^}B2p_Xub-D$T#AiMPv>9lT+sh*
zMz84bqVYZXc$DztnTpET4#a}L=jIw-)hSeYp0eQt<LbEhp}tpfx(uy|XLIiQFv6FG
z^ZtF@NqFj2bkqFsqCvLx>=5PZArhp3nj-Z4+^&&@=R?PI$S5fh(J&t4OBe+v<WD+A
zM(ZwJQSJj_OhHM#zr-vYx>YvDt7PN9`t4Qy$>JR-C4Lh`ps)MY7VXJ={;W}HIY^Y^
zbRqBJVpa?6^vy62m(BB=W*vs_M!)f~C=knpwr~MxWMTjrQn)kSxG8Rt;1D0pb4~>(
z8Q4@izeq%ZXJg(6jnH|nRRxZd`76qj1TJ&B|2zrh$z|(8Ke0&KD(Wv8K}d6kiPKJp
zWifUR_O{nURUxFQ{aM{{6P|xCNZl&^4h}f{^$jzh`+yan?kNuR0RHPSO!>+_lnn7(
z<%FYZxnvyUA<qj|{>)`kP^vngTv1Y}V&5KED}B+b%7S+Q@rPK(n(%>v*V=CHDc_QT
zBR{2cinjy?NKk@n00t~sU(Hi?b<<aYDMDWU6s)V@^9rNw=*T!N0UvNxR@R+A^Q~-L
z=D(%Ecu<lpH(#G6#e#&dR_B72-LI{?0E#ic1;gn=8(QV{M=43CD?eObmkSC}HU+g>
zquWs0zyoi)b@9^UI$#CT$Oc1Sf{Zx8xgS*Q`$p5{v8m>RaKTF7@px6RoC}{_3E!wO
z<(pG7PDV6xLRa??5f>yRrD4z$cAi#E7)(f7p5+gvCh^3nXm9>IVp?f)NC0ZfyQxa+
z2gIMbS9kZU=|6eWK3avY6!Et^jLjtoMFJUCY(d!L{3!g*edvha{Ebb8s41lX)1Ytj
z!hct*ZTY7Py1Cf~YkcTrQr`@mS9-;5Z@O<AA++c98bBbc7iP&|5D+v)cVgplJ8<wN
z$8K#|s86bcdBdpevq$&F+FE*TEt{3}gYqk%#|j@{DddfwJg?YqJB|U6v$CH)yk-O^
zE*#T!+Wnd6!XIQE*B36f9km)_%Nvi}XKgtMWE$MbeKCfbc2QXH9=NS1&VB)8n=ZPK
z$H##l*9|74mG9rwo5Rc#jV&$7c`2QL-f~~vdE1xL@XFR5RGky?ud>PBVh9WS`w2CR
z&mV3Gw?J<$@#@t*f&LW*3e|<vY1`}GK+I+Y(k*iF2P=y5nAwtjpFp81elL|EU>tc}
zY;=Q<r|s+}s|<hRP)XA~Vc>{f{PKc;FcECGzP`R`(euB{_8<~O*!&s{Wsn^icQO0*
ziyI5`antyq9^_`|)I<G$MJoc`bdx*>>T!Jhg|RVhs0<^{V)&fv>^T#!XffpPjW~At
zYD{@-kBG`RIeh~(XlQA(VD`@-dBFbh?5PHoT*?a#4Z`bPQsEoc0gAYhnc3am_H)r?
z2Up<Ko(iADZNo6^kFwdB_4W0$dVt&Fg)Ny36flIZCp@u;6WV+5hfn8mQw{>`L;a^}
z1)7>gs$M$;b>&F5f$}(Yy8mnBG>+5bf(P78$eIC#J1iv52bjw}$x@)0z$a8Rt{=Wp
zlW&~Zf3HbX^TJ-~Fzxo)MnVZrToTo|*?hO0a4WW)z(X2H)ATi5O*YuBu1c7!o1ANx
z{oG}<ae6p=z9r21w&^YaS;%n&kh)-G54Zk3Oq7t2{Bw04$8Ifh8-&&<YPq4AnXor3
zHZ3eLcF1qS>}jJ(77VQd?^o<hc>-io%(%`O*CC883Z}XhzE_!puN4%!WApigLJF;}
z-r)lq4KAqgDI!m)H(FYPH+GGjYVfl1#4>6~OWI&D#eIzO%O0=T#<<^la>3dY?}1K$
zW;R=dn%ynqu0;+W#wq@F60iX9J8V)iF~y$8F_J-D*k56`nqQ=a3`0ze63F;$mRn|E
ziQjP&fN2*YU@u>=;=yNiqxp#23k=t8JFa&6jv{S?`<8S4=>|JY+ELJa(-l{La+iPu
z9L4*8O)Vi#Dd*tucz<OYhUv_Q1`xxQ0iN5KcKs9<Cfl|Y{&wzy*Kzs`e({Oburf>p
zUs{R*&Xd)&O;9>X^+P8Pe4q&~q3~4Kgzbuibm7q8poFwE2T6Dw_}Z{BjptH~6`=Kj
zNK#ysUn@;kJi8$k*e$`QeWUWuea%-K`xTj#)Pm3*_pYpMcx0q^Yx-*Cg_szN>9Qd3
zwUQ!0a@;wfrsU=AoV8Wa5SKA$1mL^?+DqQGE<*JTx<<`(*x!7QDWWvFM{$4l&t7#)
z8*JCRgDm9xCK###Lpqh23u9Kc9J}#Q%g_DaH7=^VKQ9*-m#2nw@bA$R444$CD2RpN
zJ%>-cFelc!SP#FBsyjbof4@f|7E1ISL{R12m`|TDpk{eqqhGi9GuHgLro79hkbkjr
zJ_}}FlJ?J^etw&)O5$~l5U$-}gJuJE-2F_kFbZlz20-Hw7g7Mc-yK(wF=%9DZm!p#
zQU`e)pk|tv=*MoMLF15FRCL4P$0#Y?S_E;<(uf3F(r@2r>UTpe2Vf~S>OSG(iv9X^
zIs8zale={H=iYmLbbRkYBcf81-zwJk70Wm;=?$@|rJv9ac6H9PE2=2z!SIk8RWTT4
zMB9n7_yAvI=ZO!6LSz&QIx6hV6d1S&9}v>*_YrrZN)H#xYho{Jhl~~nAbCh17#W*V
zvo(oW8`GB0G)4pQIBw>kNrFD2Gy**}vbIomckfiyF&l&hJbXwlskI57rB{8wlMoT{
z{6<2i%XL02<EEu!dVf|5o=46kun)kfBouV?W`m0Tq3(j6sOvNHhO`ZP9_N+KIOo;$
zN2#Bk%dS=S*#B7Z@ye@q4Ac@W!-?4XF>bv0J>lpH53sZi*UcXxj8mdN=+?!gWw3cp
zc=DTF&US0c8K!@AxJ%)t53f%ET_8zoAl(o!I?5%R%G>UP&X5f%4(a8jXVJV@7K2*t
z2iQ|3;2EsHP|;~wvf1sP73i->b^pB79cQ&Gg1`MkyPI9dIT${dC^$Iy#@z^gme5q`
zjS5R8oAfioZ@<!JiLQG~;{~Y0pq7I<a8p>Bg8-<97Iqzv$RO-EFlu-G<y=46({W$(
zkK!V|v4zcjHSb9l#6~omC?;my`H9fIWzz3lCj`6&ulq6sJ&CG6s4<twq*#Qw&4uaC
zdG6N;bo9BZ#YRH*_J<(%`x*~_O^Xh%_7^MVyRL>(k%)kd&TiRP2OTY-0I_%8F;Ja6
zPZqkR<3IKLdb`2o9~e^eV{!ZHNFzzuGX)0r?CmtugVSXZIO@fvB`hKa1S3BX$b>Nu
z4-fNPjs>q~`#nWP50yMm@Yq5iUI_Kw@?0|u2hIYTpAa1S+og2kQsBRC&j<ZEYr+&5
zR*{&5@9@-A1I_&G8q-@s-Q>RT*<3^6UTB5Wdj9c5;gvgA-s}UKHo1<K$=M6O?l@+0
z9-h0oBVE5FF6q<Kq3L%Oo$J7CKJA;mLW9q9fk=0Ldi6ZrcER*5o_H2x0?+fY+4=hO
z*mot9#ztm$IW%*>%{O?QYE0D)AN$42tR5hJ*5EJV-#CfRsLJAeofR4qc<*8h#{GG$
z4~_rgSaom_)V{X=bK4$1cg6SAALG<|adDA_f<KXch3SpU*#qc~GmCSA`?g3x0XJOy
z*0^%~BR^Mf`h5NLwBRanj~@4;n~*Q~N#<_(2xDlQFyYOoLBQq&jzegwHk9PN?dL9*
z+5IN0$6|U43Jt-9H}an)rGUW2j|x_L`j3|G`)b}kqD~8k+!N{=jibGjw@I7DLjG)D
zEo;E1<AgwE0SkUSSJm}yhFi`tg$Q}7)rUdd#l}b760(v{;WI3B;3H6OFiKWdOkbbu
z)!g<q5@^<#<o@ys8UbRNZ)dNXdr|~_@Y%m2hIz>(R<J?ka=S56-=UK300Ia;2}u?p
zNDG*1t;aW^Ywn#r`Y@mJ9oy-T*ZUXZFTpPJG4*nfHzz0OM%?a>V|;l#nK&72l!{79
zP&8i@!wgs7fQW>I=dWH}M?Lp@HyZN&#tsha4Ikh5Vm_`Rv)r)`VPr)itEIga3;$7&
zawa9YVDdhER8d8LyIFnBahlwzYPlWj@ODBlXr>$UkHBOA6Gaz+0CPLc)u953!lEK^
zv|L$}Nv<L4E!cy<D`Z!Cp1y&JYk^>a0>=g@Gkqy_&p>{@F;4VS0hs~0w`0h)A%{Lr
z)&}DgIWuz{Yo^#C|0#|LkdvNwvT)APi57)DkLatbH{Fh1ubbSZ;&h8%6nb1DU(9p&
zPuI6)41P*U>D!IUzK4P`=cjWa?7xh*x!Jydtx0?DKAXoP?Jfs5A}(OVq=^zZS$VE^
z!e{3or4Caeq8(KVvNCc$dtO~NL<$R~raL=d>|b9ZPm%O9cCVxA&dtq1bU#i$Q*5u9
z)GZtc#}d!$=jB`D5-;CBf-$ZH32F(z8b(CNcZ`@ml1>zeAiembbB`_I*`acms|qV0
zT`-{KccI~#U&~WQN0k9>1ce_TKPM6P@cz0?1xInFSm^zWh|xc!MG$of0`Jxv_=$oH
zB)I|7h7cz`JT`)OURxv$$BlXYIa;>z?LRQ9EZ#c=HUJ#C0;?IaNj#m~sh+nB#=6HE
zc4boB=B;n0H5_ia)}Eb75<MJy(oO(`Ad&&0gmmCaV!ubS>sJ{7&7{mm9BDuG?>_}s
zM0ho!#Z*t)6Y}FJ_8XT={eE%-+#s7UBEhz0Mh&n*&z<7xP%#RI@|GCx`%$O<Ne>{Y
zHTENW+BBpw_t>C>*GfqwcLWOu#~19wFz66AL{szSet3YNUql?CKP;F0y3me}j-PCi
zSoxJ&Owa>f9luq@BM5yw08%ODFW3KzvbT(?^6T1oX+bFgDMe5^ln!a6r38@_P&%ZM
zE(JkKq`O-L1O%iu(nupB-QC@F=6>GzaK;($7-x*<!{eXY``-7x)|zu(*YA4SYRosg
z>T%5?r~C~26(%?dq_mpspXmMl_ZM_o%3#C@TCXo7CM8`8@94aKO!>V*Pr@+rPQ5;v
zz!Uh`xA--yhu5<Z84+gz3_LYiOldx6?SKFBOxPUj-7wD~(Xe`z?#1%(&xhgpoUE){
z0M@HG<_5CjYn&<!<)-t`%e}oeHMQ2j`opYjuw6>aT{0CEtbO9Jk=;NxHgD2B!s+TI
zDuYWc1Gg?HM%z}MI7EHe;D|<j&>2Gr(=bFB%qBqy70~z^c$*1QT5O<e`~;PykjO{O
z{pF~%v~cjqPn_Oz`9^5PLkZP!>)5-y`CqMDR_!1_#dpAb0q#iPd?taOh&)d0b9{V!
zt)j%$uRmk|WHh&v|Ddc7+k)(*T;QHENKXB$9hbP?b&@12lNC<sDp)VxfwDkV{Mob4
z^pNe+(UE#9{#JT=Fei&7(JPR0yX_e(F40VRo{PM7zCpE_Vr*>uB_W~l$}bR^o0Qky
z)}L`j?0-CM(Ejlj8E9>cdM8Gqtq1u$PiG6%U=Nm+muCjwQ7)KFfy){J-E+0)9I4;B
z*+AP01X^<*O66qXR)7^j+mHG2<BXr#7>77ZX5qsMAdLrMcad^nWmW5Z>gq8eDdkhp
z5rbV!MI}5eK3@)iE9B;r;MX!*E*3fQ)L-gNP?D0u2*ZOJZAD~EYSRbI{dfU;G!S5I
zZ9Tr{+-`kVd+GQ6+b&K^n-tPer{cm7)igAiAM4k3oNt%h2n&GPo7+m`fGVWHtBB><
z`>xI0jMCdso@x}D9B+x-d*Y5;GOPfn!u{nQlcmtrl?okw-BUiLo+3~@pni#uXG$}i
za5I?pe40f9nq=UTC;?V(Ks5qM7FN}kcGkeMx3_=qOrJv%6T=(d)9C;4<5`+#GulgA
z6W8=UKZQ6L+X|@8-UK-wkdC3h4~Sl%D)jOrjx?cd0F7A%$H7CCubyA0V@mFd85Zk5
zYM+InG0}&?)%4ohBoH{fb@rgiXJF7N)tT3VVjueMNj=mTVrvIZ6MrR3q91axpp}nG
zfy}HqVDU{Ah!-qYkEb+!TZsZ%iP{#SI8{^xTY#GzJ!o3A=H~%*Yk2zSBM2EF%kcXs
z6)f_z4o@hAOnIUhl+$Z+1HeKg3#up3=d<1@M;_N@i}-wgS`c3!mK#8rWbfB11GCPB
z-{4Qn9JDO3Hh(>Nc9`5?7ZJsH>xt*V2-OW03m(d?YBNgAQzHSp74qw=sI)TsK~uFC
zY69LD7-oG2bR%!~2>uLC>D9`(x(YxT(^{h7)n)s2<7~6+$-k;p>Ab<cskLJZ3+t@!
z-#<Mm-##QL9^FjSbl<x82(VAgrs>xodQ4%EVT-7^894YmBC9>#YnyFsTxg`+MNFqC
z;DL4mbc2<EG6yXaplaXmO=X`Ky53PyWFnsya$UuKRCFaFaf`IK-7?H<&L0iAyuqq{
zF&=*HS2gVx7ZBjytH&f+I1m|^6ap*pZ{vqgm~p^|4zW;T*NY`?hZX!6jJVXx6;v}G
zSbh;36So0mveWzZ7zY3IC0A<-?;E{TBO<`f7N<GwnskQcqabgi%tw5)4O)$k!!}@X
zF__&y+i|N0l~5MOjT=UMn5x75KxLrrhkQa%tBur~QR}CbOn0NAgE9y{n@})liwGZ|
zFF(=Nl6v~|VV?3G`>Q5;(A1LiI{05N3Al_<Kz#$Kq;rqI<ANu@RlJ|Uv#KI?NiVEV
z0Bp#tuU}&?&k3IEI8Xv6$7R|Z46#|V__T+7j5>2RpM_e#Y`irzG;&=W;*aNb6r`um
zv#_>?eL}SP2Q#tjc?vI_Auup8cN^Q3U^TgwqU=J}etKBQgKSW3BhW+daVEndmYAAM
z+AuR_Y)lZ;2?a$(d4;t}JxMNH7Ma&4L*^B(b)uiCgd~jp7h_GxNMjvVc2tpu&}u6J
zidANy2T~^Kh@YDI0RES!ui-=xu3>gIL%GGEGh~dp+O_W0`e=TAKb0Qb|Ai2$yvEKd
zjolqdg8n}fO^uT65ErJ_(DxQ#k}IlNT2)t)FmjUdOC{iYJ6m#nwvKz3FM4K%5RU&b
z^2E28m_@(_1Yqr@VF8B&0XWrjLj7I*s#@mDz)8f?Z?dPKu5oIpFIQy6&e*=0+uP$<
zO@T}#&-L}F8UQIieb>q_{yO(}_0~O6{g!{5wb-{fIV}uPJ)Aeug*^dn!2ok0(Dr`w
zb`hCbvNAZQgxV2=IuNx5E8J0F3@zgmcsPc54?`)QM3;CjS}b)V;$~iR4|jICt$v(F
zzklET<PD5Z&L+QSm+TErj7TZziO}bD{dCx5QSsTufnT)iCIWKxGOKA$XOLfQc?IsC
z)^*pJaT$0lb%8l;?lZsF&U8KdJwT9}NZ&apAS?6OmN>dEfOZluVueK@c0dD-zX5X|
zu*4yUZ`IX7Atsumh-E^?kY|9R?yh&i3Ku(KB6c_P?&#_Q$lk!%pQeu?ngR})@d}zO
z@(S_`5rG=t4O=h4({TfftdfV{v21~jmsbe`b2Z_Kks$Kvv+ugUBY3hljF17}l5}3M
z_Iab}#AlmS_ce<@e~PE;a)9vxj#7t}U;1-JIG|#WgT@@wuk~H%!StMV-ANYliGZnW
zWKtCI2mx>m#1K1zZ!)glONWc@aezsPAXy+q#N%^MQk7x(Xad~0V1vTIgYJk!W<IpB
z9p8>shID*?4F}9>&qGQj>&b6gm7l=4p{k|Tv1DDl<6769v~Jq~`K1qFI9J?@zqWRF
zr23jE@N@D^X9bH)SjS?)b>Ea%yQUuX8MTjBpQ1x#@`im`2MsC__FXjp`UvKHY>m>&
zV~uf-q4BAyua|n`WB>H60xRCJW2nb|>X>@LheK-|QGX0rj`Q=&OZz5Nj63S;2m7AF
zo^p}gV$+9L-b)0eoUk=RBkQBIG!&IFiNQomy(yB;&POlLgCULfP5JW|y6x4O4$mhR
zaPP`ES5_4&N_vS19p8V`cO|(oQjykM{MaD?-*{m17FfkvTnr<=BsFdxy)J(jG36EN
zPFB7OK)B{b2T&l&ZAD1Ax{}v({Q(z1_RfVH%y~f!^^lD%8fhV}(bWKDEV-aDb`(RH
zq(tM`sJyy5$(uJBOu?Z;mcUR;Ak4aLrAek!l-S)Z3K*~qjl!Kl;Gp+0^6*3#ykG!Z
zCUV~fwc>oc%Iiuk5P#DGuNldQ*LigN_H44KSAf62zz-eZ^L*B)0PO9%fkI7{ZYopd
zlum%C1^|Yg=>B~$UrT4H4(6$_H#I#4irv!0s3TC}A`=q<WMm}fNUwlnZe>d=`uOw8
zikx6kO1$FK{z7Zx(3{y=SOmc+{VZ<inYX?ulp@}jWpZ*m-rfL}k&+U~9nn%#b5GYO
zgaEtDj8b63GDJ?5Gh#`iz$F2+PG0(qF!U3jl-tsRATGZHo02j~!2W^`*!~4C7zb-L
z+m1bCC?p6G@93meqmvHjdOzb&klwl~EtN}KQJXD`FXiVYj!yP`$vs;E>asmBWuX(%
z$}GUN`#oD12}yF^_k6<g(GQ#gaI_-_d+rmTD`1;^nQRb)m!_O13Oa4PvWMKR{WQ~m
zo#5r~1>a<0WwEfa$n6^Y2!P~&BnqZ!iU2JGdPZ>YvtFndGsSguC@m}sG%?MkRRvtO
z?!6ou`ce4<WK0P>77yXvp~aR0*FCZ3Oc30Vy97J5!fc@@Cm38@T+lLW;7o^MvE%Yh
z@Tq1)EH8?W&r``}2qnl=+1A$-{%2ZlzqFy9n3QN?eaKf1pd+X_6if6eG;veQb&8VV
z@q_d{n5J`*qhaIW(Pn94<#y%np~LlstX6Vp>2bC|fTCbZibf}EUEvdaN}dkQEx<8$
zlqpUlF6Exp@U$k6Zs4JkhEPBo?PPb}E8}}jO#qCxp?kIaa}t-lKMk-$=c&4SdP*hU
z&DeY^_JVpF6Nm_ewl*T<Ei`4@!#&P5!6Med-!okO0WCNr7}>z*;P?b$U%0<3DtO_K
zL4*L{0w1!Ar6sOWexa$B<*H|A9fn>I^nfjFY%&HdTgmT9DJrrhBzSR9*7F9y(HTbc
zGrO*G&(<U~G?sWjq$b@mF_{`-zDv2gzi-y@MFM6PhNVsp;Kkg!%;^!zbJ8LQCmg_`
zd`irQe^LO0nYZg;?p2EcT^*H}edIi&a_P#J&_Mps@I3`Ek_=e#4&Q5W-~D@GvAt<0
zAnM{7kjaFoPPEmi*4v=H)HaruIF0VxwJ-rn4lLE5CfKl>jvtGUudNqc%y>O?lp#zU
zA}ct52)7-xLDlD9E9Qm_%6per`<`R1;;|;l%8WIA2}-m3R>c!PC%4!y1yPjqZiUHs
zL2yA?=%fwUOFUO4ILp|KTm<?pd4^x!b+h+gU3W78=aWX^<%Gk@kC16i&7>6>Rg&pr
zD@&W)y1Ea8r>7TZzo+3x;`u$WeB6!_wj{JPV+rhrT%MD(9$zB5&5m7#!H->H?qi>+
zQCM;YxA*I+an-^hL&Bj)OAEhWEG(lKye0o1EkK${<A>@r!HP^8><=_(2Se{QV>!w0
zs3P3ygB+KLA`?E=mPZ92Qm6l0{glRaXA@6xn;v`ppVzPPE=@bc_joWyJq>NFE5A?z
zL2B#MTTNBLlQzJ{xlL|Pc%Dmx-Q?1(L?y*kpia)swPN3%5{;;jZW%W<EI4{R@}Q}F
zM;b6!fYy6z>`KloLR1X|IH*twQKe7*!DmdoPj>4Aji>D7U&@uPic|sRsmNL!-S40D
z#oVyHTz@io%?1FVN!#rS&`I-OTF%YQgK~%X@;#;mA%?`s7N&Vz>(iknB`wxY)%8QE
z@cRl{8vkCR-}=v&2{C5Jw{rW?H@T9S4X#mHDiTA_snZKf-zWAYeW5ER*E*4|p0t4n
zE5Zb`NLj&Lu7k|7cY9@pM(i3)ib@@2Pr=T4d47Ccq;?b&8`LEY=hHGau#aMMQc9Cy
zAYTC?#_jZa-oC|kG4ZV7^D|*9$)_kmoyWs81?v8$rn@Ff%z%^?zRWYT6HI|Z4`QUR
zy_;#L#>d9AYn>k{OzZcK?zjG^)OFk24FoSnpAvIi;+PHq`X0f{>gen=Z2WNQ|1n_B
zPGF^Mv@V2j<<M{eLE|YwMP=%|F%hOyWGa6Bwv&~Gf`{X--|V2~oRzh8vrQH35ne-h
z){qE;hZhExO&|7UTE3)5KPsxC;t8)~JbkodtL-w9!R)u)Bx$h23y!4zd|oN32^~E&
zy~kv{Llsgo(uN!pBW{SYvfy9hFaSy|H@nr*u_E8`^41o1T-q%FQ$Z4On1(_!vkY4|
zttY*WWkp_AQP{8ecvdXjXDoLfP*BkIB&ldhV;WT62pZos9bDS{=4y+FiMd=-eX+S*
z0KjTMuVm#fphe7PD5miQ1KJDD+cwJ80?EmpUGw!r>!1p1*>phvZZ!<&wG}fq?LA57
z&9N|G;d<oLOwfe4H=hykJM8qofg!Yom8}^J3wU@dJeT%+Q&?x3!z*W;YKrk6y?j}B
zKJ}H|$-8>!cbTHSJo9*^P5b<*C87ZoI$`{AYMRq0IZszWIm8SWn^@LCFe*>ETEQ(>
z!G9nut*TXPBa*kLY*ZOPTK7(9bCYT={Teri?D0-}UfN;>f9zf-Ysr3t%2g^d8@H{E
zK~<nB&f$esIyx~CwxZn6ngH!cj@&%r<W%qG3JN5yS}?+-+T-?ng{~#<v)^NWgR3dW
z$5H$ALMh5Xq7raFp|QtdMjA@ny$==8(9nv>lb4)p!HbA^5+rsiXj3&#<~n3~cqil=
z@VK6n(8)h7tUVB3CGM-z>Rw0_?HbK=Af0*_Xq$n-DW^<WYyeZp<vub_<9_k8<82r>
zG9FEP%eiXBv%l6Y(i2F*|7(dSA@Lr13$JYWD<9uY2LL`_5>-;stuFx3cG4+|L;KPb
zP}FtK@8i?3t!@>OQ%;=Mj2bER{52tE7-e|7WZn=&+nOD}I@Li#NB81A1bYZvLKp(M
z*HgcLk2MWX+3}T9>>_Jt=i5pemo)C$nwsz9RODfea*+$?+BuQfxVQ&B@3$tMHSQ@h
zLK_2QdE=Xi#ZE0%lI`O-6ZlOaDz2Y`xl6#aoQE9!Gqr7?DQ1gRp0L?Y-X~Q6Oj$^N
z2b1^NOgPTXn+Nr|$F|DqmUkK@BoOOgnrDAmRy^#w=`JQBG0FQK!f2JP7;WNi6=?)E
z650)+y{Qtc>QX8Rb-M4lBMT*%n&$AYue{s)vjJfM{_#XZ$Ai7i%q-9LGT_%Qaf2rv
zWuBu~`Owr#ANDwI?^R}XuBD23_K@b6Z(5puvahu7Rj{XqKrEfjj|csRtJyz(`2YEH
z3lJ-R+;eXm;z|@DoTY0<H>_(4N=lZSKHh3cG=z*3MwnR6%)ExG8?<H1zux;{kY`Ek
zrFOV%PASQ_Bh75^hFMrynb}Ly%f8+OrM2hr1_2;z5lih&nGbK?3PD+kh;9K8u_vlm
z`)4Yrccb6}#-$Km2{w$Nvvn19-Vl)ee81haoS5?7uTmq%FY1<92iqz-I$u|4A7Kw$
zbp4}(dq)=fFSEDbWas4WE&VYO-b*96O-?SSs)_^6xa@*z%&M-QjnP30KBo?oSuA8n
z;HUj9v%WiXc7pQHLYwE0eCgis>5lwxWBn*ipRaDI7D=4I=@o2yr&CuO+;LV@1}fG{
zA}le%_C~VcTO$I<)va&(`>3GM^Y^Dr5IX0B3GK>SS*gpmw{ohWQsAhflM~%7n>0yJ
z&wCnHWaCxa3-itGC_!KdH|<N5*l8t|mv1s$UATNljmBZS#RkvM$WMz~ycLI9MS7q(
zeP3$i0Q({dDQUU=AfL|oSRENhh5v67kFMA%I><0!^|?N8=;&Mn0V{La#+$Yuzj5!4
zP{%y$8Fj?;{O(PgLdsfNstO`RPA3kq`R)OLEy3sftzxd$<5x^(o9F9L#7pL=aT=W&
z2M|yP_n5*G<aJNX{$_bjRCbH24e)jV1OsZV)1Bs?pA$A{7ncbF_H37DCSJ=m%<_@`
z&vKp?X%JJ}8eVNWx^7jInQxmj()>!Bn^XH|JK|q47z|7NpX^fjAhBbfNt?XnrS|?A
z1dg%4l)Tkh0Z~GhbSWuQmz4+vs(enak2C3fdl;!6JKTdurK4}Zy{bqw5ZTpDT>FZ`
zk0avl(3e?jCqSi1wF5%bitUp5v}^YSBU$_tZ`)^bi@OGw$+cut9|3gmk<7q!bB%zb
zwH=-t+lKN)va3U303CoEG%8Crd=DU^<xZ<yGirldzZ#oQx6{O$LMaAuaB;I|UZE0P
zZ8Yq3+)s7i!!hvPS}WU~3t``%J$nbMH;P3;!7J@!wl`JdND#8m)%vZL7XR72;oXZa
z+d0=Giho|;k;sDE>6o*EO356bxy^1-2<MA|z%(PP8EHZ<`vxQ4#(;1>Fow1!>r?zy
z9|kh8M@xcYeofy40RD!Hi7HA<(*tahAI9^;`nti{YF~UK|EPh7s@qSjnp#Xute1>*
zVAP_15&Z}7s=!A-vs|(qc+8%g)!hBhT4;5gomg5Gil02$a14e}>Yf0+B+#th6;nFr
zhv%$A$SV=t;d9%|?NeSiz)UL?vV{ntl?^ZT==0vHb-4{h*h!BgRrOb$zE_vxA1aUV
z@x46Bt>R+FmwRN2G)iZ)9zh?I!+OnFM|b?BeV?7kjO#WP)$beY{QY9J?Dg))nVFf9
z(;|m##0;VJ6;^VS_u<9`ZSY)btBcxmyVP(#8+wr}M$3xCMOF<iK^F`!_v5)&jc)k&
zE=H>A6LocVJMP2D)Rx^NFgp5vcal&@O^u-Q=9FxjXgzQa7dNWWNW0TQbh4JR@RE=Z
zs|#Cvd#|2H$4X4wmj`|Yg+<MVt91nm4L-V3GX6k<QiSI60~y+`*oH1&)KOeY0pBq=
zr05?#9#9>CPUqfi;N76m(AQ%><N=g?v?U_v?ydq?3JR3jj6iSy!P#uEnkDr-M*D%?
zKm9m3^Sf8O^3_FLLq?>rn){LQ+CmU4SFWo=`~w!entz?gH=Ti6)nssebno4vQfMbt
z`@(Nx0k1PQA?NM+a36Qlm~6w{x!MGgb-v7pw63;?f)|$uiuaNflzX2?zK8_6*PB+M
z?NYaK<+H;+(<SRcFfN+x#}+NXjJvA@0dQI_$v}LGNV=w{ei0^%!QWZs(+4erLY1Vl
zhF)c<O^wsj!7$Q;w8v<B3f*aRqdSQ=rd!lYPM&mDo6rVX+z0rgfUyz#=FOHrqpLz&
zf<ljyh2JGY2@drln3R9~a7IqLYjNUC2pE-9O;2_*vX2$fUvG@OI-(Z97Ke>fFeRWl
zFnplOmO&DWpvGdJ9-$0ejOdt{-40qYB;)|LRR@RgE%E0{&JBtI1b3gkPJci9L=rS>
zkDx<ew&!rqnGw3u`9qe%_Y>fs&=Q18!~>4PEQ1Dw91#@hz$#^lNsL|6&?xav`$9;2
z%!UX7={{ho0Ci)w7L7x4Cl0cx?5ahQ+1Z|E4fUHia=Gq^KcuA%`h*QgyxX2i3KSFS
zAQY1)X8aOQ9<E#n@dx2BE#mpXn>lPnks=hFo-Ph-fzdj*^VS+N0|gr|FZ3eoq6^n1
zB3L6qAH6cfN>!oL45lqOOQ^%=SBAED=MKPg9yT>UvF9T2d+_DQ4-!KoLj;)~7QH+y
zhO<sJ(B=iQ6Yy8bpN7iJ%_|{U2Ib2)SBCkc%F3RZ_9QE-sXZ)Xi;9kygR253F7W5c
z;!|h2Y~u#tQibj^bdS-0Lb;5=FfSi{D(S^)rFk6&WGA>DzzJU>@Hy+cGbsR$Bp4ZH
ze9cYm7NubGnt$0u`_SCRatYSHr5w#^<HfHpFJ^9pXmeaUE0&hloivHzC_Xb<i<X~o
z?0X1mBRE+@7w`j!D&c}bOP9g2;%1RX^XP}Ca5R2m0J@B>L?7FeT2#R1Fu%x!d>R4!
zIl7pNo(Vo9%5u}*mcBj}40DN-%p1duy|hp^)=nw|w~DV8o#bN>aT^gSsf?tg(eZqG
z*S~ktK5aAU;_8w9nM~Q)2Q!T~d|FcL&w<%7<R3tx?R2bnAor{;C#0}^aJ+ro{J^>7
zc_DlyAf0I{*w@z=#USD2{G7In>v7fHkk;U#F=;(7be0%O*yhsTqpKFagjp9HyleRb
z{2%nA1b-OcY_oCc?;nxU^|%3C+)u5G4nUL!F^+7GMi$e}>T22`?$$Zy>H*84{2KJs
zXOY-Ar#9bA3nSGL%rC%SNf~xr>!S1RWSzapykL0U>(Z7z#4r94<h|6}I^zItMoWv_
zxz-N`d2A^fV6=PwoFjmIb$}KpOrr~^nV&v|E{v2$dH#Gu`yx-#uyX-ty4t%x?eCjP
z=vg8&cOXWrdAg54(xs<VXLA$X8lrMsh4Xpi+IR}oS>TO)p$obi^>SNbB=~OC=dJI7
z#C>_#4X5nGB1N*Se>=TF1eV7|6BAcqfcc^WegI%V03?OwcD{kyCwQk{Vek*ENGIm&
zk3XOtko)<Kmc0}5_Vxy=D}<*}h9$P;nu4Yn#QK}}Ls#mvhF9MqFR=U+;$6AvRKV!l
zjN;<YUgt-uYC4^5N=Z;&CQVL>d|BzzTcD={bq-kN<kd1dxZG2Y9Y3M^f7lrs62!#7
zAS5$0blSoOx&fT0kO&b@&i8=4-wMfwiG(l!nFUhNQK9=(=knz{-J7iy@xlS*yIL)C
z-tA6H%gWAPh$ZNUlp_Fd^(KqLYG`*4U&zhPY-KPHQgU87{;W*XR{?3@CKc5LpVv(p
zBMvAdH=J((_5eg=4r}W7n*;G=@&;93y@F#0bl6d&m;<P<SG)lX;I?0M2g3U#G04&6
z<hL5rB}Q?nMM=WPB|&3m&p-@7EKof`?+Y9MCh|PCP%vnG*mHru^=&FC_QaJKm_VRm
zi}*_$k+`N~aJ}8d{?OjO)JeORiH!x0Ee3Fu-`i7(nk-?run++;0VvvdE-o)EtoMtP
zW|s5vDsw+K`eAWc8sjsnES9=;@nI3%mvj2-!iwQ;OcB==1ZVtJCvZoEcP&0(Vj=_^
ziAP|<-rmi~D38|_&Z^qlzkj_Sh0h3XU(gG}yM0|HB;Zl(yRdLyPW<~o2SMC~By4g%
z?n~Q$`FVm-9-$pnDS+_-j`rHIs|m4dN&GKz)ZPU1z8mg$FHADl&Zw*;EjU-^V!y_f
z4PSoXVt~S9$%~4L`cs7K&Yc(__IsO#bpwgwbbUJ2Xu6#-VzY?uK#sA0=DGl#OiVuZ
z4g&pA=m$G1Jr0pn1*LQ3LzlAofUc#Z<F=&s{*}8!00G=YNaY!ji*cSEf7B?_;CBCu
zJ@u;Q9^5-amdq^GD8Vi_tJV^AV%ZIT$8*xcOyTFm<IJoq+fy!Xa$Mk5r}A#wro*fr
z%t!E;b*zoIlRbT$YIa8&05ItT<}0JzVK7rFw>&%teWd-$eAdDGI3y-8$$ajZ9U7im
z=&6b|;%eR7oz0r?8b;fmu?P=DkwgI{1?=a+F@^uic8W0-lLRBek}BcY{~daj!ZCdf
zmn+_|_Jb?X^fWkTVF4GYxrs|l8aA!O-#%1r@3)3u{Z5b)o;<hG(qe*>i)pJ6D`;u3
z^Hj)QSB%x4SI&7QXZk|-mNUx{xx#_4#&Py3MesKc&y(j+!1h^{JTd_`7##!scaLLK
zm{T>a3}iv>Cu8u#s44ESX4&vT?ng1{;>|7_Z_|MR*LFlz8==kuSHRrXYJQ5EjgE(h
z1c-+-66o5yTPy+iR4vtxA6wdFqDJ%h!Kx)s+`e~IcHBV~BMH^e;UV6|&K2Fw5Cy1p
zSiugR15}y*=d^7zukH8lpq`D>kC2CgsWm4u|7&sEmfcB{g`)y@*(6pQioqkux**rn
z!@sz6Qlu7(m3EmP(kt9Z3Dk)MI5)U`MEAY+_xIh-uCEl`r0-NIQFS#5ZPPs9d=GIS
zyZ`<yBKig{+kE{87t;&Z|2S!eg@rjynm;;h<$EDPXcPY|$M9cw0iu=ngP)&P-O1yN
z%X+0*$UbGDuLf2Vw0#c1NmL4ij#&pmkQ0K)73^AVk>{i@RP{eUE1GQ=(|H<KK^#LD
zkvbIx8K@zhoh<N5FYJCB{u%V}X6&^2(_$|r?N(d+F)+|!9F9@=HzD;1RnoViL`WMz
zUbnV&eCgc!vW_QfKLM5V_2!!4*$?>xMFq*c!GUr!7BTl3QPAa;j@N3{ttfN-@c>Du
zmcz6mXc@5a@eO;E6JGtaLydXX3Lo{S(BO1LaVnS^?w`!oXXi4YPoZYw?An8v{|_r|
z$^%I(qWh%oT`}biY1GFPjyF_QZ?8DHZ)w-{4=d3!F?|B<$Lp0;gl*%8C&`^cVXcM?
zE`RN0mY2XLDe?R{VO3v}yxgbT6*@iL34`*A!FeD{e~(`NyR&=4<^jiU^Z9nh&z~6J
zF25Kz8>n?*#|=P19y3(!IjxJVLpvy*$;h0!*bu$~^fKhrlHJ#acw)5|k+2UE-MO=x
zq6315-sJI)E+NPx5rPw4y2|zx;xR9+>=Ge>TCA<9e*X@F2NKjK<{!cuF)*<}ODrqp
z%A~NR8_L{Er~K=oxKAwxB`&BSGDH*FGqNBei!>rOF*uV688rRn(-&3;VA5jG%Mj3R
zA813FyD}}71dwlVaL9(=&-wQ4o{x`DWMrf$ZF46~MI36<<E38kI4*aaPSv?VWM9Dx
zw~>v{tX#!uX{nHF-A#JS?KF>>iHQbgFktO@@lww*W%{oWja1g)>n)CXhiWM@e2Eh@
zRQF%L8w$(ezr+LZDLhvLgazU=ByV_}^Xof%($lp>eIeXFuXZWHbvJn>qFJw>M_aC9
z>wdhpSkHWoKe=I9p@T(0xl%M6{WvwE?)?+KCACK$Qc@>(3a{xI7(oBgFCxCv`L7yi
zhEVsHoQ*HOxY5?u1{lTpbGI4atBz641`WAS5pS9UUR7+`@WK|Xxe*0tcf?yCUJmnq
zU)H1Hfoj?k?MgqaqXv@B%S&?6w@hW3C#KQWS_Mw_=S-99w_lM^QAs;F{e5JRng)M0
zF+RS}=D|&DY#K(hk(Y~(oIbcKX>i6yXh!?^Hi)5P8Aqi|4(l>AveZlYUhzfJ1x-x6
zs@xor{;s<O<?{Px+0Qdh0;A<F)K}i_$;ApvuVKj$BJG~<u0~T%?p)qw^j4bwhJax^
zF!v<fq<JY;Er1Vr^kO*^G2&FHQSjaQo&C<t19)hm1&bt{A`|aiMl+cP1~}stOaK1k
zwVUaG<9&IZ+5*!Oi8q{^RI%%4sUR-_GF+1+8mw6!$e9o%5<P$ec55Ruwn6DS4sP1J
zi30WMNu#}xR9jK2U;APB0axGJeW+PUi>ofw(@Hl*t!smW6W5<iy)^jk{Rqy-72AK|
z96IyVf*F)>vm2*|H*YFn<8l5ev1M@13t3A%W8Gp{?n#jZEf#QwOxBMkH^%DwhW&xm
z)I=M8k>|qYBfl3G60yj7{s*os*K#HE##niHk8Y(Sv}8Z{q2a)^s-Mtza`r%kuhzhT
zA@r^+gj`m<!$T_YzdxrH)2jOf1Yk8a4Y$>E6sFEQUN=$QkGFb!Q7`RlK07RJxZzVh
zX&tdQ3JMRG&AQDf@INhgTk+SgX$VA5w!vHZLR&j%e7=pu>LDXz;O2PMyqzF6LHLdm
zKOmA?BhR<!%T*Ze#4N(N?qPwtl#~?5+mYv>(u8Rb3>ILJ>T|koFp$p+TlUFRx$QLD
z)x4RQ$<B-f%(&;4Aq=h032;qJENm^acKziZsqn#eMbaM=Sq0~OEhC}}@;|`<WtF&b
zwu|@Rrw(jr*Y3C)oA%U%;mo(+rlt-r_Rz`P+2Qa$6l+-6nWcr@3?grKkN1fuGyZEx
zfsm$KBu)M}wdjz+bW<>8t0rx5)M8V=<f`q498>TI7}Mqr>J59qIY&Eoz&og#Cq<dD
zjO`pN7KS;<|2-6k0SfZ}G(D1~4HhT#-(~@0bbZ0?(Z#2K%sJ@j9tKH>rFCsO5BB#%
zUXDzT8W8xFbr+RSEJrt;;b;eq<&)D>$n|~vXp7#{ghV={ygVu~k&;CE0Zg1>R?|l%
z&fLWX)<q~!|0^k&;qhbqA`Oooi9i@_m5=_kn?>vC>48n{%a<?x_0JQJcfr{VJ%YD<
z<7S8|n5ha1>fr8?pz6R#X8l3!D=jNaCXe$+V+0%M;?vwIs4ADJDV$Oy{mcFz->v`K
zg$Nipj=z8Z9^^YlU~G^f>DTm(0<KuwUE8`wgx5L514DcdNVExjme35E!fu$s(hb6S
z=%6j<192Dh*MQphg;=Cvp@d&~!X+T$hrprlZ<?`yh61k*xU=BZ0u&WCST7FVt=EzF
z$FUpqf)&Qx!lKc%{5D7|K`IEaPm_g?2mq^r_8ggjHd^htoY#9X>rf4X;2X%SE-XKZ
zw{p<0f*sj`qjWTXx;AM~Of0N??t`uBLnU<{L+$=Pe9BXp>0KQ+nDr#`B4X}wb8!{x
zFsqz6!0HVFSn~yWsdIqqK}>^g`9W71Q+mmB1%+GCZ$qX~<o)>Z_xK!a<1p438y`R2
zwDsu<VMkz#LlPkrG{z7R1+C$K#d=+kG6W81=^~B6si|HF-s&_87lA%HL~edbOzZ?v
z27J<xu(;DMb`=5d1JVHCN;EY!v0BExWVr*TU_fZ0z!khN#jg9GcZ4AQ*LgEI?Swiy
zmy(AQr^AN7EJu>0`yIv#GH(dLnTb$b!gU1ILgs55G(hA*`R2vX1gDQ56%|1rs&RUg
zpET2k3!{lUJM+OcNW1&YL^~G*=VYnNJxT4C$I~hxQDan2Mhab<Hl54gj&eCTI6(CZ
zGsB%f3hZFwr{FOsR1x0A0Gm*<fc*z#SQE_VLB`(#CPnCRLqJX3K$fh5D*C2#t=r|{
zur{Q?%;?4J$uKAoBG6HFR7u8q_%`s#s+#JfG_u;r7s8cU&nR%39#LaV-v8T1m>GNV
z$=4slQiHA8`NBw*V_2d{qa3mgA$g$>?loiropi>8RG;uZE)aFVQ+W%p`Pw8MN_O_u
zTR95I77FrafWA-K-E{ag*3VBX$8C_YlW^YvwoOh^F}tiRl9*8$1}hH7-MZyweKNqU
zgrvKT(Q;HdIXM~#9D?@*_ZZx~xtb;VpgMkah=9uqB?~%-^%xK29Kvpdz+Cx<e-|v+
zMqjS0yfH;EF>9NZbY;nAA7JrNa{iJdv@tpR&T)1zZNQnEXH;02GxeHKkH47PoK3sT
zA08MO7Bd4#`J+P=Jn-<i;KSJ$NsO1tQYGnBA|fMehb{?}!ypdduEAP>Y8s?io?^?3
zi=0;f*wk6>Kn)6I+}Vc;Xj@0pA(v`oz95}E{5n{?f-|8&m(<p#n9=K-8?3B=ncwx*
zCBVI@pdPcad3<?xNPKtaoFx4Yrl6oTU7P<D*PFj8B{_)Sp<VO0VR5iIv?HPlGjQUG
zeD)D9BE^<YTqT|Z6&ePzvVkieZp0M0STf=F!(_5Ds;jl550#>mlSAp``PCEh)CxMf
zyB8A7QfI4|Q;i@{0FZLTBqR&BnjvOs9+E48h(jY!bai!w7@G%PKq^FZt*xyI0H&Zl
zoSG4K4oDmXh^J%EG27$Ertm{Qe*ECDnGgUo0E=Z>gDom$T@ST^CSi;T1#mPp3hON+
zNT4!Y;h5jv4o{oTQ@NF0<N7)%DxPNIOyarXi{n;yY)VeHrS%%^+a{NXKegsPv-p{z
zH4J|TnZh-wBGv<;1T*KrhN479jEJ}&h`$TlS8{aZzCIgnFgG{fx!l^S-9~1N4CC&>
zNDW}a-yv%V%HrQWJ@i6Cx^L@jt4l7Q0n!m}n~b8O%^DYT?buT1cY6D~FcT|jC=H!6
z+<qPR=uM38|7ZcA6ub%I4NJ?m`3UVQ8xauw6VWF9*EIbVe1IU^>hnJ0PW3*sfRzC$
zb8NEp-oFc5oRqvg4&-7RZjMz9Z>Ufa5&h>2-up?@91xU*f=u$-?dI-#ZeZXuG{3&K
zhRn`HwGBIk5myOC_s4BFUuS`PAihf3|JXWAm7bKC2<dg)d`XvIU+bx<1&?oL!a<fK
zE_x3NAK|N(7x#p`iHbBN8@#<nE3Fwx%cb91|7ZIbje@CdPMp5s`oAI+WK!V899aW$
z{g^9lzfa50Pv#p4(O8K_m`GMbnK2H5$N^!)`Q)}%ohv8GcKz}F^W*IX7Gf#^yI=gD
z4zA9($@YDxA0n>!=rE0?kt#jwahFVuf>kk^q)$5>B$&NvVk+{#G2sxfk`xo9oM*CJ
zTo3bPN*>BbSu)7_0@c;3TxBT*`X%?XI02V^JiyNyvbRSmJh>kW(EEV)`OLDfiHHY=
z=>h-Qr_*{D9pD5gG2KTi1IUUe6g#~)L@fU@9c}JE?swW4;e>}yz-|Tw9{+rG7NEEQ
z>y#7>61ew;<3mGnQ2@UP7MF&(dXNa5!di~%dP5jG4Vq5d)zY4q))<jhepj6@*O?wy
z{{ntDRIS8iY>o#jocivk?~v-d3M=;Q5?z(RQ8c3bp|4x-QQ}0)AT?#^AMv01vJr3x
z|Nc!O^SnQY-ptR>57dHx|NaXqdi0+Y#vKyr#!csW=UP<~On5Az^Siwbt2ZRn!%!O}
zKBmW8lfG3x6^*aOi!_jdG&_wqP7h0bddmAm72y7Xu@kh#>}P(V{;K6UUPMQqwBd)N
z<<X<u{dI$DIGV@XUT&Ct80L3K%Ie^P5JuyvWPm^a-9@@D^<K39t`nB|Oxc*M%?;1T
zLSLV#%2xhu+<X0LemC$rf#V8I<>HZ5p>ERy_icP+>yh>3l`<5g18+!mbqNtAEr)W1
z{wi>W(XMu&2k95=f<(7(H&VGwNO*gT!Uey8q+H|CG82$rJ1lhEzIpQ|3b~lKFwDGU
zN`_$)(iYEY1mHdb$Z?&49UB&SD8=#%3Si5C$MYT*F8PcHGHeYQl!yX589AgBzl?eS
zhcttCRdLbKLeFCq7RF8LQHG&BY5B*i(NUPYUtC;pU|>Ovb-(2gxk&#r;*>Rd`G-7o
z7`2nT3EO5><8Y9^jeG;)6E@K`lq7jCqFeEP3hdMr6v!)<J4ZdKJyyyaWbQm;0KFLE
z^4w56smIj&VxAhE!=#f0xHAxAxidsqqFeR3rbeM?1STZNa8vLg5K&R#iMzWCA|DXs
z0}HED7`w5b3ug=@3UT{fd7d3@u6ta&Ot}R@*@bF1?R5-?T6VrK*!{y%ne3O6sw5xK
z(4o5ka1>!Rwa9|v;zrAgx$W)1OyB0!Y-p9t%+O5#;EAMzL#Kjnt&2>!6|V;z4vaR}
z9`=&3R#wt@_N~x9ly~3B`x$#dSTRLVk=DQzy*{(N+#b#Rf}G<u3QNp0T+5mu<Z{%?
z?%n8f(e49Zm4%}}Q*@FzY(obtjd1^iS`YM<a4F$%2!Iz9=n#f#6k^teq#|=juP)E`
z;kXDVqtBBz@DU`#$>q=BAjGch)FZ$?!p{$^b*-(2Yi~&001qcj=#Z0dOUt!8j^bTq
zum~HCR68=xq)_&~=J<q1k9P3Rbh*o!4mt`gIP<QjL;R=14f>gdU2WMx^Bk>haL5nB
zCRnbIvHE$wB_yY`>%62{I0R!{UnpBXf#I@=-Ff@x20kMHCx)09RPIDA|499}b$#*i
z=uJoLR0;WYY}`d4cPf(xfdxmOP;$<vBrU@<3=B(OKPm#yiJpGS!VU<tp3-DD>-7P6
zo4aif%87dY>x6A&j16onWo%H#gTrU|+r*$b4=(lNUZscP)1W@|A)WMs@gY`)PS^l>
z6J$iv!9eS;CGYj+{&kDxCgfAR;UMo{e+P|Z@6+jUP#?jlYp*^Qv=<K^q`o%d07o^<
z{W1p3;S;$+2W%R6Zn{^wp%<uqz)FOaMa|xXS*%g}XH>u|=d0*h>H?9je}kMQX3ep=
z(#|R>y5whbOs2TSOJa*40~PM*OeTSQ`06Y}FT3<vf}d)};nnMh%Vb@34;NT((C~~<
z`-qh~fz}M9V$|@B$n6OZ^2gIYVxTxA`uNZ@3biKTuRpd;PJ)({FX?}2vx?i55^m_^
zy&N>DeJ4{Vq<5bL^S^%y_J^Hn#2%$NO46jXmF(~%UMiJz2^G6^Y8KA-)&E(fKkU4_
zVU7|v?#DJwiK-JRo~0VH!-iY~;T1R{>zM!SMTiioJcIu#N+k&Y_rLz{3jlH0e+$th
zVAAv7Kl8ue_J4o%|NbTa_gDY-PyBy<+yC#^`QN`}wiZN+-~K&@nojeq1}cZPHW`?^
zfgB3T57m(-mw>b15R1HbZs!29tr<vQouA2&yeH;Oq+rGf-3vG)deLvgSiF0U*9v$T
zQjv6)mR2AEl!RMjXZclyJ6^=?2=cJDJ}+fxqOA}6eCn}bgp|{mXA{IYO+^m+Ab(ko
z(X3z2dBM1EZfU~+Pchugs^V2NKr)6B;0XYn<dFdV8rw~?&5ez0=+XOJqd=x;wU02^
z!dj-qd}9hVh$)GlK`&4~((`;h*kvjwBO~H(babDW7t}9~eIk9iJxQts>c|kt$A!>E
zm72EFFV4*kxWhUH`HIjy6QACOcy;Z{x0vw9$Z-Qo>XYGKyvye)1wz@`+1qsod#oTM
zBBG$c@%@h=8D6wLEgM^CM+Y{YeADKU9ZXtE8m<_SKOQz!<^-1i@v1a<WxKoWflp%M
z!Uq?dNbVx{%fjJr^pAKCS-TjTdiLw(bzySz?NvQ8Jql1sC(8}`aG4DxW1(hmgc)7c
zxV>NsQ!pBkx*KQhKoJUL56uf@RTB8}suPqcP}`cU|FhN-6k>kNJX?@=CFkb$al681
z!O>>Al(>8p(4$Z~0|^sy7Bwg8J;X}TLvo@(Q~TUN)2G#}Y<v?cL=x#;FVk>YnOKv1
z_<`H!@F?|Qt{i=Ko^o@!gNLUSt^e~Eq&W6+_X#T~SXmvnp03TG&N;GQU5zcX*@yZN
z8*At0R>m5&hoAS3KaPVS$@k5(Af=r?s&(zLe^q%|T%pH)wG~z3xO>QsSZcLuWh{Z|
z)r@m({r1qMtF$Vp3c%ESCH8lC_<=mpljcC!kOEr`-+=ZH&g`#t@A(q9tH3#S;k-C*
zJ1GuuMMy<F9LwN<05tFWPeD#qP{0hzvs!#TZ|e$>$>=t`FMeFOeGV%NZ0Bx1lkOXn
z!;>oBaV7J)D+dYOa4MZ~c;aTY>HzfqVu8;|x;m~Gy9T9h`=o573deZCAEAr2*Fqfr
zrqoGamG3_ZkmUsOYWBtHzSCD*%%TvB4og0gIR=tU=i2#Tqw^>e=iTGDxc0^I3!Ma+
z6H5z(ib18U+C!H~w;NvPrn{giEVVkef!71WO=J%^DsN9tS=n%Eq8gIeBIDxv+QO2)
z3*Ez|5{!rOyqb>td*q8S2p0|2$TK?KbAd74d*u?iIpF5(yWW>Rq865dj0UirC?JV(
zE1B-Q+27$Ez(Z&+kODdyuKmhYTnaAoxbYrYYHQ<Z1bRz?p@rq!J&`J~BfeV~&Hh%G
z4BcOFIns@dk7-w4P;LF3cZPaIyL3*EK`Hqch(}s)(_l~AeNx^|=!`t~76--2lXooP
z*QZ1CZ>N5Ilnx<P)7S3>uPd_mxv_yzOyvn$Sz&^S`HA_w3`p%|O--q7k~mX3@|iy0
z6K%@v(N!&=lL_xNk?OUB-kOwzPtUmeR`Ji1@#!?Ae*i)y>E!2*+#G=hlu=)w0?kKz
zIP1dMUke8JL_~9-vNIdZeU!{90IfV8)4o)Bao_jwtYr=47nImS<{GE<7zzIU3y?XJ
zlCs6C^!-rR_u9mR&P*g7kZXTI@+O6_ISp_vK-A-~(hq6Hyj9bpaV`E*8YNz7P(bZ1
zn_aiDU!O07?kn<Jw<rvzpnKIGo;Fh-QwWCuqpgW2&|OStD%+-f2_I9~U4B*Vmpxw^
z{o+NvSYU5Q0j|gQx2-~d{|!Z@`6OnyNCgLn>>eMt8*{0usWshL7t02o3a60+__jjX
zUwx30ltgFMESiPNO3FXb$Yn%A6`BtlFf#`hhY?Qz2PCSMm7h;OSJ=k0RhfP_diSZG
z4gbx~q3}Qc@OL~Wyw8O}s0nuCxeER`Xz_c{I+ZTzX&A%MaemtS0wp+eXGY~3v=&^M
zSw?nGAb!sE%Zt1{aDSTiZfL{N$R1WOWS|Qyov`k5S^S}c>1VC;rs?ojJ=pCyP4=W<
zQWp+SC2(HuiFik5`@1gnB!P<Wg4gN_Qx)Ay4@Un`$RNELFNa>{t4}ROLn~a|+xxyz
z+k)E5m#shpdImZ!kVwnK^|XCTMjGs2=;`^v?`)P$0%&~4eF6~M<<!^X<($tzZVO;C
zqd)D~!4rPan)HS)2wdQ)9#@z!Yy!pjBK7qJ8L+E1Mi71gDocPyAn|ML*YmL{D4@)|
z+8b^d{5#R%ziR{yKE@<I>xa-L36p6B0*zLMC2tsB7@Rgk>J11Hcj)MTpBq3?D*x<R
zW=2LTY=Tp+`$}NZCr=TI1OwoAo5>q6LIxa|t;59$j?D7sOh6REy#wvbUdKK$m{1$;
zq)Q-uD)se}B-{K<Vq$5JbSwXqn^7t$h1FFYSi=JgAs%n`bCp7Sse(o)8sS>Vz`|ks
zNKZzh@k!ffDu}GgbK9csgA$9Gjm@}kON5S|!43)*@AL6#VoJ-Fe<miYf2u$N2>Wj`
zOcRMnDL*vM^j(Xd>VCDdgyIQgsnM#mj=)3`-tR8&C<_#=_qc7y!)1EFbl~j{(J2t>
zaf^sZ&Tgmw0bEi!qZhPL^Q2c);MJgODJZZ)^8HPl@Fb8|p4v6beluujJg)ci`>--t
zNM@f)es<gk_0kI+oo6o`xve*?K>>d)Suz+YWQk#mI3@Ks+S(K)s(awRI^KmmRX=&s
z41&R<?McjEA0a;dV)I43p;C4(o#RDIP@!c*1M>^Uu!npM!7!`_A<Af(8|$doIfwJb
zij^n=de!h5K=^a1vvcN<IXFLlirn8*UPKOakx?jsS#)xWf8u$94b#Mf^|)5r>qGK8
zi;K|9hStSpDnumy@yNBmXkmWKcNb_mMxca)=!e9mSktSkiT&wB2O`un(wAE5O(E>{
zP2ty<dEdNzM8r;yeI$zpzFTzhffNY877z9%z&}A)>3FgU-{6o5eXsG_)_!)nh5-wo
zZJN<<mj{2>oj@`X3Wg`>y6w@Qy>&x(>;0a=7VjhExZFFtQT>!Hg%p&ct3#}QwPcTt
zdpAZE$>TzhmHCh(M7?a8J|<&=4mN`m(ofd2m=&gbvK&%kKkX&<Gc!B^mfc9ENAl)8
zme9bjEdE@7j_+_hc?+Uq1R+ykS$&Eb>^pKW(1d@P!HNX2L$nLH)Sm~)72hhdrKFJ7
z)O<VGNRW9A_vRWuK$^ZJ2?b;B+nViV%X?nz-i8Gc$V|q2(eg-8!wu>SoRBU3PtfAK
z45Wr7l*e?6&kr070PlIfwq|K7p2YVN0yjZV2HrrAa@T=}ZDDu2en+{%VUbSW5V{;}
z`gO>uEiox&Q?(-|1{NixTY^_@_WL-5T7y*f>~K@z6Q@5QA&Bmg`0Ety1uSoM^=(%5
z8C_kBS9{Dp6&<U?D{tMnEX;hp`eUbQy-T%F9b(7fWBmAW8BRhdpn!@@7`+k294mo-
zgOHdQFSzRN(|7N91H<n%({{lN0SVao(fu8Ll_5)TK;(b>X1uo`KT-M`6{+H3egGdT
z$XOUfMW=KvaykySCeL&Ki5eUa>8Q%7Y=hz=>vSb63>wwnU9P<ul*v^LpI-2W@56=P
zIc~W2YfnA#0R#`X(+c4QIvP;gCf*IFKz}?C;3JSj5!yb_P#{ZWSwUG|4Hc9$H2hHm
zP+;Ez##%eA2WWQqK_^YX|5iLpW8S_Nj&hL7iC#YX5Wl13?Bq(+YqWccLilXO2bmud
z!rm}vZKFo=oMdip?o+r5Xb5iCE31Ux7m-tzU-ATLDD{(0=w(B=RvV%D&Y|p}Ih>U$
z?cEALeK@9jz<M)y&*aQZ9zi_Nn!dHYO%QxM1GG-)J{e25Ichi5Alv+<42rn|TMa%z
zE;Ly>csHRd^XH#U+vaUATFlw;c{N8nSgqmYgG<c^h`(FG9{@M5O2T7#Co=mfeZg~i
zqF~Pg?GaiJY&@J<GBKa%rlyCWh3o)Ny4*8G8YU(=o=NW)ywGC~K-pFbl__kb?V9xR
zy<<?A<L}SrQBxJ+pB?Gh_p(5pMxN;=c>Ccb-KP>hz6pJ3br#+@1K;eebzj*dl$*+d
zQJ}2+?sbk23UPT;Q--1&W6x{OB|MC)O01eHo@TIh<*O61#B^#Z`7eZxUb#QwEG-3x
z?S4p_SnvS3XDiK7$Ys^y*7do*`1|}0Ie6pnskqJUwj+z+OI3RLe7ZaL!#9Kk6UT%i
z=y2fnGD|xp#>50%Q4Jo*Ob@nVB&4KT_$gD_DLD-V?%Y|tfH_VOe=8R<Dk7z`w$1VN
z$`=U;E~kF*Kn6BqXrJUEGH%Dvz2U*4Eue!*fQ79U(k8jx(C`^LM0Ce;4{B{0$}%D8
zwE6mSl>jymv-3(S9zN>@6_sn$s&+{!V+_C)YIB=$x%A#cLu>g366yvFsPsV~OCgXh
z2Ddy?6T7>A?d}iSdq)=bw1sG6U`c$`$a*vO!{VEEIYb`9n1KtHb1Z0q1jz>-^lf$R
zUwgg>l>zd6G|FxE%HE8EkWd_Crx5qoY|Q2LTl7=s%j;*#%BJg;oA54upj9whYQ+wU
z=v#1I{QX@4whzaK+5YxGc)Sl*2K=CmT5L?aAW!P)Re%N6Ak}NBEGiaOujt@l7SXYv
zL3q?&Qd0%OkwnA^9B<G-<UBC}CDk8R*b7@dST#94N1nr&t`j8K+Gj^xg56XbVs>BN
zNMadrx<FJ0rF-rn9cwwi)xTomp33RmaoR<-{QF`yxJgwul6k|9M;qGDXO`jq1BvC{
zKtLGC{6>CQaKpv(KRID#HHua#bcjG|qP@MZV1_XGrt-@GYYO@~fgulA5|8t;e~`ot
z)~Y~fB((AU#zaL3#bBO&s{l8SM&177l#~>Jw<XCFw;6I^oK1~Ez3En-3*ce!#bVs$
zw*j-3_l3{VmT>piv)<!Nk4?94ZmAheUvFBz#-dOsA(T!g;*}weauQs1N;<H!ahXOe
zPYinXisY$?r6>yqsS*<}qlP`CLF=TU*;g08^Bj0ue}xG=Qjc|x!}X$xBsi7xr-%2M
zo>v@?S(U6FYd2UZC25>y@RML-o`U;qU~&*L8(9EWFrSEdE1uU1%kmYZOGMRO2v@#!
zBMxltP2dibst=ObLmpmp;tWjTh^Zc}ve?SY?z4ox0JKSuqmA~(Jrqjmj~`L;EtBQx
z>4BcMzwn}OXFkwdO2hPDOMGsKtsyTMU*oxQ4kC*h$u@5y<z`%hg3pv~@Zrcn+pdga
zH`gM6wbRMUruE%7xYOZ?N&w~8pY`JTzpI0|_;@fM=@j=78yb4)z~$Y9AQ~J&g~b|7
zK)gdkz~X`vIK_R+%=Gjx32?vj@wNSqVl34z`leO-VRev&Gf5HD1@V=Ye6eiW-JLP~
z5itotJ(fA;<>*lZExg0sK#Y#h&NhD9hyrss2Kpxnba_!xhm2wl{P^L+A;a?-Q0qTu
z@^5?%A+!`yS*kL!0SO{j3_xX}FJ_S08+)rk+MA}}=Jtf1z7?X4qoCIar$0G)rNylh
zpD?KZdsBtF9`R3ihmPq4VBJu4a(@;avWQDK=eTg>N`Ch){k@x+Us=jcd*;TcuSnsO
z0S6XzidVMQ<`j)+Uk>J#yB|V0*s`jY`X{Tmq3|NrzNGc-Ep`Fou6=voaZMc^^5{G-
zi-q9rKh`Kz3_R3UeHoK6`-UXF=4&tlAqv$)ypBfO&JK2|Ry4gr>~q~0T^$`9Frf!|
zKH_rIHX<rT$wV4+xi2lRpfn;m`JVSqvl!5?28M@KR8=3qQs#8*6t&>Q<+y|!5EvNL
zp2eockp^>-8M_gCfej2v3B+a54J0p#f`TIXiDSUOSkjw&w~&d*VARdd$$`u`DNusL
z(g(nGNYjDPDN>`XEX6d@6tFTw&J|4QYQeme3l&@P2H@*bdZPcR0kjDQQ`tYW<8^Jk
zT?ilif`$n)CO(l;k%1c>J!qSw;#(+1#Za=aedND?q%f0e(Q}!S5Wa8r)+riV`OkHA
z{o3a<Y73J>L!FAXe}2Kdwe$k|O}~E8;2j>qD?#kfR2Agsi<b=hSf2AxhW(iyR*^Bq
z%86p+7UYs*qs+*w3PeolvuUu7j*j|EK0s=G`{df+@;P+%Q~@WQ{61xFZf+uMeNtAc
z!o4%UP)tKUe*L-{6q{>rWMqVaj%wPI`mx8-$lQ*wytS!9A(k*m3aQGEkn>NdcnOaR
zH~a&L>Byqg$til<^IR9o8db<;pXn#eqonkea!IbM6SfFC^Jh-%w%ywbA_{qPk#(g`
zmiwOj)!Z_*Ge_I}uGHXgo>PCDVQJUVb#VK9+M2X9_AZ5fQszL&%`t+r(~kv+$A|9r
z@2X!>?5dVb512<&U$q*Pxeh!<9M^AucB${zBiVSbAj&x7*BL?JJ{?nc?e}VBZa0tZ
zyvfPhpn_}5VfcNQb-0R<pXU&TF>zg&YY;InXa4dZv1^XBqu-YjWRGzAo_YoqE5+e7
z$DLJYG7+UV&^&fYxym251-~SRkEq+JTO4j3HHn&7{=MqR8;+L+ekYH+h4<la6zU-K
zw(733Khy5s4u4bd9+~2R_{pOLlK(7za=T7kh5t=GnX}A_Qlj~<NDvJ3|3pAM5WSPu
zNz-&Y?z$|h{6C=**t^>O>m+~FL{Ia|yjf7kjQ`S#6#iF;#PaH3Vw(!q?VJDk(cRl}
z)c^fU{@-~kpZZdSJO2~LGskt&h^_DQ$@SHxqNqyV;Oq}wyAj2*U3z3f%TJP*FD-<o
zdwWy1zpuq6!42;=oo}Bu-IuFm3)6(I>_|f>8G{E`>F$RQPI!K<a@oRqy*u~uue#>!
zq5J6W(PQ@-kLM(qF9(^}I+k-|x?tTh_-UPOLAe}=HLC6st!vtC=-_O4w^cnRtLRbP
z3m>$k$+jZLr5BMAIKR?|n{$l<Deh6`e*F<@!dnrKM@Hs`u=}K!ch}t9`T-+%Qb|uk
z09|3so3ywdS$yufeY@k#btXB5d3CcJlHSy}x^fNq$QOTI24iE;x_Umi$489icYl%l
zq+9D%>pB6d+$Th^UWJ|j4_<<T4)$&iL0?`U&)!D4)d<3f|GoH3<gEStUE4q7!+pVv
z{C_3~y8yi&B$EX_L4EDo)M`gFZb#EceWK@Rw6wG!lLEjL4C1@ADmSn|zOb^g*7Evf
zZYUu?QRamTf5S-4$EseQnZxty=UhJyoc5arB-siQBsAQy8peOzwiQsMBQ=^VPHB1m
z(_#wk=touAu~V~jS6CrSdm?3ll~`Y=+b{<a{@%t`6{^7G!22o72du0~)@GFCPPK03
zyCkQ-nd9k%eJaqLm_GCvw!Gms;=NnyiFG|%WD0NlN?gv_7h@${f4rZ6E(>A($z1WW
zbL(Eho99Q3X3UgfL?Nxlc|L9Jaf7oneGS)CHb1=wOv0-&8Xx4ojDDfP_Yt5L+`?P|
zU%vvsd#m=?3XnZfV~H%Fg)w@}&kzM@8nn)?E-+hV78Rvfk+S_VzIYfQh8H#3E!m~H
z7xr~5$eQGHtH9*YZzcMucwL=ND(>Z(Kg@q!DhEY{TX2q<43c=`5;F}EszM=WM|{E=
zGc9T&jVMB6<3B6hvA9DNPX2w6=7H~CcYf2qD*kd{&i-L3xvWmFT0&}L_C|8JIywbG
zV9@Dh{=lbu8wMjuukccoPya3vZFJbN|Bn^`K_ZO`DZMNdGhdxwYRI;{4EyZOPhcz9
zL!c2|{xg@*?<(r|+3l*kyd+J@2|<~)t_hrJao@ZCAIjbWs;c#i7sUbz0RaVRq?PUl
zk#0m#B&EB%C8a^6OG1zqQ97hMwzPDEbT_=o|Gobm<J~vjxc826#yFe<d+)XOTI>7f
zoWBYXY#_J2>)i)*mD0E1iM*n-w>ZoZE=A?5U2;8S7AGOuzH@#Fl1q<O^PnKfk77?@
z)7G8~kfz27hAL`c{qW6{?b!Hm_~?S+*?~;c+<m@O-(CH?*cB7a3Ekqh%5#r&!m<!_
z`T2TW$=5BR4Kgsq#|%o%&d%<x&#9=0gba6}Wq?Um%)nZ)#bsNYCK$0ox&hpaCP|Rz
zQGF3^t0N42{)8SQ*n3OgF(TddgH%1f`$5eH21cK_r^8<ia-5x`5D*i$7;r%|_HoKc
zR+Dz#78I>JZk|-RR4P&F+@;=Na0Fh`J`%7eLJ^BQAwYnJm>Ld;$NM=y`qYX`@%o{g
zj7*5K>Z9;({5UXqnO}M{!U~nn)NahA^Nb)tn8d3dBM@Qq8uypFACp2=M8{NpqA94Z
z6FL2b#a^NpzbsA?p`4T$kZ(%twq5lw6tT3=#@vA9r=Tbos*;l0{Jq_8SeKlW{)u0s
zkAkw4BM(7X>rPM;m3krW_Hn^8F86sCnbN;XMQVW{4-O3>aID$6cRQPwc93VR|G1>)
z;X<r-?(0W7idfC<kq?PTs4Yh<{+O9j+j^k7)@dW71kpWv)?{+AWA}EDqiK%Ct?o)c
zmUjMGC6`ugo_2};@{q-r23sO+d8*-YXR+dj0>i(<fl@D$v^e|PW7}ZmlK7(sL^~W@
z+ME;bEqVfG$SN(0Uh@zy@672R93Fa`tq%-2#6jJljS$b68+ro8fp=^7(dos;j5l_C
zx2I|v@hxwkXoNBnR8YL5f6hv)A2~WWmA-Gzd0srMrW(7y!VeUkgY=8UQkN9ZbF6`>
zLHARl5to#T@-1BhgU{JiE0WdD7N(Z^gE>V=KP#MV&KwpDQU1b*?_Z#s^9&~N<Ty2y
z#Y<6%QsDqX;92`?(~>Z`Z|`E?e06Q}&X?TW_;_t?S^Wj|oAB79O@2r!Ln1EVhu);*
zD<rBpu5;Vvl%mQH-VYG1-TTLfNz4aUSdy-mQxd+7V!c`I3x>^s+$TEMXJo`e?}GU1
z3;QR6NN|BT@fi<4IzC<Uy)wm}OF#UgninOMf{cJ__74o~xc9M=X;jqr<|kWMZ-n>a
zw|=!^;RpzQCW^sFl9ZESN@aCB7M;@#jjoG2p4FDUz(*lhQkC=12BsSG+l~kJ%eK{7
zsegU-j?(x#ua+g6-VDgF+bv_rU+-G~yjo3mxIFNlGc}L-xl0Wj%amZ9!1a8$zv!Eh
zsi(xj->-jD^i?=ZJ>SQlRGpyc(_{Otw?*|@eqpVGFgTC!xlz2wM#y^&1*RwHj|Z;0
z$Pyg->!@PossA1R**!x(kf2=KU)Fi_t3Qg4pofM%TI#bO3KlSKA;1f~<HP8`#_$e~
zwIs!lyyB}$Kq0M+2f|9<ub+saF}YWEI6y~lfegEOgF6VR&rq<MndJ<Eu^@!CuJo0&
zncAVoK2l+YHu3P#eo=~KPAXx%%m}(CF#%Fq(i$EE*g5p|*^L#_8_mjWdwpG@(4^5W
zplKT1>9`L_c+<j>lB!_%5BjeT&c|##JS_t|EHp6>A=^9DTzhG<>hV_H@j95H9&HMP
zeP&j^8DR|VBb^^cd^k7X%6qV!%q#q++x5AV0K?7g{EXM@f(i+eQmF+6AE*wmf`4QE
z6&?^+#L-vuIg)tXenvcDH~T(enZh$JVrGVBnnyoGQX;9c075tLV`n7@!+3yIcJ%83
z0fvNHVdcXZ1i+bD9%fIHav%*u=-IQb&aN(x3M7&zOC8brm4ezis&VX|Zq)htI7BmX
zA4Gi40tewdl-}_rCM7+)5E3@-{{;zm!D3mj-zXYyniJVnX%d9fJbRY&=g(gWl?8P+
z_CYX&qoD6}?bOfxbtsUlklJR!#V#PgXIr+qf6C)<LI8s3M0PXqjWoChS1aM0()yWR
zDg5u`W=Wh9dggQ)$6*I3PkCmh8zErfW9tG3XDT%}E&p!nJS$iel++#Zk(R_O(e+Ha
zma$$S>L-4=Gq0^Z0h<IfK0bbzt<!j@{V<V0Ub^t%eB1C(HV$M;1ZdS9*=!3s-=Hbk
zpPoXN!>#oG_I~eOb08mgc6RBtN2E?xo5Ao%1rV9pRKasPdZy)#s>gi%H7D)fCmNXu
zIz@p~jFo<87Rz_{=4?J595}==X?Y+X91JsH-~WD|>Upu)E}U6e2^l~bKyy+pu5+Rg
zYDkyjX&TB?0m|cYXKvaOMCJe^kk*PVB9)w%I`PL3dY$?v*%I1ri`LD<OtW`-U*>d$
z+4s@Et21C!O||ITLP?5$KPt@kP>}l}avkZNzhVvhB0ORLj-%PMDM{X_j*$KB|LH3#
z;d|@n+py)qT)O_w=9H9+59`aOmW`i3i;ZAiry+VvymNZ5=h-n4`GNiGO9q~ID4Vlj
zvY@QSb+1mleRY+f{a*wwT0mYQLvD8E$B{TLZ8ulO7@3eN$KhVNbnOocwCrfI4-RO1
zEQZR=UeG%;&@bin=8kKR?(V+KYZQ6s_&~g3N};=~pT(^<VymM3%PJn4+H~03OQx{&
zuSffv&`>`NmvEV1Tj6!tVS#mY=JLu^(+Ud^{DUx#y}kYKZ;Lp%(xA!r{%yhrn1wV1
zlE|<S7|cxHxd0j1_XI||)v@|ZOD^l_5QSX8H;7V%XCh|EW~)|4W)Dx5@JN{J573&M
zDK+z(bu=biwY^Rs6>{;{33^(%noo#PWJj&$!>c5~*ebYnLEw5)_UEruV_h4ccJE`V
z%gZ~EY(6Ik?#+VX7rq`C$b!ig7E6nrK-5NGA8Cl_UXoB97GsHQ$L*a=Y8$b%E`t>;
zMFAzbqPBH*fc)jl=8L0UT2#rW2gg`D2kgwV`=@J=V2Wt>l4K#sEZP+Cb}=Mr)b#-b
z28VbXOI^nsjPA8>e;|((I&x1+>WB7MOy?S@w|50j6b=RaS{2;h5za~Z*SQ~MnGy;L
z)>%xH;-0%?B%3_>2<L$ei-Rp6NulSaBRGvJ;$=dM3c;>+8)LT6rZP9w#$`!H%we6l
zu6=#OYx^VZ;3o%z5qo0d69XfosJJw+#O786Z9jbdBm0{G&-j{f@RfQp4fT|lr>%^y
zXv-15BuRyLe*pY@oZ!77cIJWUG@eM(>q`|_7-OQN70hJ1PByUkv}Y=V`--hV^rPNz
z^#B-9?XV7_U=qJjRn3g1J3P#V6#{n#_+`<lsnTu|d|(Cr#dLeZx~RzVbG%}!9xD_%
zk%RAz4ID6l=hAGIMJ`MhI-XLgY+_1{hX&D^z(9Bib=S}k9_S^W5D@4(^t6s81a-#9
zet+8o7F=_?C-?9A-CWGQMI68ffK~=-=t0Cd^u!=2v~T`n-YF$}r+8Y)KBGn!ia44W
z)X-K@&t_BPpg<ny;(I|;5t(#h7?FE0KmyXEgtxbFYAU2Z8z8YP+u5FUC|hY)U7+in
zdvwY?&WcWIdRm@py>u~)gz~QcJ!(K6Jwpx;WsFR+pP(_(8X1xPWnRn>9^NOjGW&18
zVq>&Yd5XB=9>;yZwqW<v&ngsFmb8_4EWQ@JSy8sjAtb-lW~zEuPkC?fPwA>d%P^Mp
zuMUk`|B!}j+LW&<BGEPnhHt#{gHvJc%E?PizuLeL3lE=ja(DR$50YJWL|-2hWPh>3
z9h5n^4ynHo0gHirsp?6BqccFb>THhcFlj4KUqg77Cp_G`H{O~q)oayt@C?oRfz6&f
zR+Q_tbHZ8OwtlS~8KPfSfK+l2hqF3y&9v~XEu~6#4vPRs%lNWAEcIF0-=gx@9#PR!
z?`{-x-k3SK+8f72r?pidTH7rA_)5nYV92fA|HE(;c)&`-Jjausw5O*a_EK|mKc{1a
z6uy}gKDB~?#zu;N5$WW3^$szwZIvI+oNoa<Xqm!mX}DegQtT<BrCb%y&D|Xp`Q@Zb
zv*QBimu3#mbnp_7p;wVPJsY(G=NMKF4msQRLY%{ckVXU*HQW^myjg+ZRSkx9V#aT{
z85xUAk|coYzoe3jjS<)(rI=N1#>Z~_pVSI?bYqfZT7QL>G%oG!z!e8d2d~Wz3ls(O
zX*JuB{yI2~0DdhcVYpoeC-=iW98T5PM~0JL6VJemlYn$uQQ&bi_(6Xy#EU@)Xx~Wy
z9JB_CxUAB=#5_a81i9@aWv*oTNxN<tSVV-<)4@(_*2$eE?ARIo?(GyF<^HbNZfLt{
zaWG4bw{LARKcnL0jIG(K4bRLJozIsMZ+$HxDM8oKpH;fXKvNbV9TS?DsvOX~MGgma
zFop`{F-(c`*J8nNx*v8&ppZU+o%8DI7E*O}4JZSaO1v*958Ozao0~b(OqY`a_F+B%
z!*w(}`!e;?3ke4|l17mzn18itGJQ&sZplQT??${8a8lmSnzG7*>M1&!H6%0?PH6#(
z6%Khy`0_*c^87`EFOk7L05~}(wL<Xz($bj3PW(vlIQxsfnBV0obs;VrXS22V`Zf0<
zruhAUmykIe{1^>_4?7Jc!rOPx?*MqMSeQJR$boqDZ|ZS)LBYT)ynxBcl;HX;gh?1!
zmqaJW$is*ZR2|N5E4CcLLsmjY=Gl#h3h*9$eFY#lt`VKN-d{V{c&_Ob06-!iIB&>&
z=;-f0e>LRujLv{MSJ%DY#fSc00E2z_-jGHz3z3|M{W#hm5=<mD=66kjb=x+T8EJc;
zq#5!R4qj}nZnx^PDQmoKNePib7O?WF^J2`)GZnCDW;+OJN|;e}_9mN2YKSsO4zD`B
zSNrpr1nr0YcXdlL?bDdFG?TdjX`ZuZbk7;*l8>k4trRe?uLjfY|2a^Ki{CpqJl-D_
zK9xn=+jrUER{Xw_dg-yQajdMx8UFXlFyOx0yDqqpb*RX;iZ+WSA(fo6AI!+Ue7vx|
zMse8ZK9JaRH!zSTC%e{KcW(G8{kXK5Sy#;ma%?#~`mUNRzw`6+we4*f@!by>Bj6y!
zAUHsV8g-g65RZhHcN~zZPbmt4fszD7_BV#=z8U1mb!pLa51F`g^1!SYf;HzI{z5dh
ze^W;2*<*>P58<hVeDn9L$)ySMiw4HHk?jx=AyzWlP&2*Y{qN9CjiKQK%#r5TjI}{0
z60c#cCCxxci6f1n5E>D5Kx9=J2kBJ%ll$gi1ZsTvFBul<?2I{#xZS2-9{=!Os~S2O
ze1_WyiHF!JKj+Q-@j31wRm4mRmDOvUMiy#LS3M;J8UA#zBXVeK*XKW-DP}z4lE(O>
zI?kIe^0yam@pjaEqO6e-{I=lwBh1p_&JEt=94UN$od)ELjE}^XztN@p=9q%VoIY1F
zZaODvA=AbTl;B_k`?+FzQbKdMaxT!Eo`H`1aX2t4lzl1*+t>G%m7^oIOWO5Hqf%q;
zQ6c*~IUj#F>{b(LHsJV_k|a>-0my4W6VOf)w$ij2jP##+m=n^WmAZI%=#p)(k2JfF
zs4C;>mGU5@@KgsshFzPMjT69WXX-tJa27BFx3j|mRc5I&K50o1Y)Qz-f#5y@mqw0e
zLG0R4eh~iH;GH3_TEQdl-|3YP2}_2tf?fid8*Cw<Tf<#n+O6#D>8j3unGI%0M-yrd
zxsNFQ+c&>vdOYJxZGtJ^)t0rloB(OVH;ot|q%6sIzpb~R56P_g#!_5Jm-{30LRRJN
z8eTy1vW`8XzfgjbyFaD*M^fT8(d?U~*xs2bNA74BjF_vb%&jzWS(>Y~Ih(!N2i?JK
z3;1=y!&WQ&+{Fne&W^iOIgcJ^so<?eP)yTuG6sN7)`IJ~Q}QG5)$d+<%FccVB1$vq
zZZ_Squ@0BgAO%E*)VlxORYjHK@9{GY2oZ%(iC@{#grW^4>a_W|>M`?WmUIODOA12M
z7?YLWiti2OrJIwjLVK*JNG2X|FTR9|2+KX>)BO(_HhLl10IYy4uyVa`!p2?T;P_CV
zh2ZpiT3Sfvz%)V{w(+ZT@ALLxM;ApmD#CC!78Wr#w`W0^B#;HVSA<e8t*?R$pjVZN
zD;U<m3O!kCcdx3dD#g^|DgX1BwCU+kUxTM6)VKEn63K6{noRL$Ajl(H?oCZy-4-<5
z6YsXR66(HiwTBQkiUufu9Gnj!Ek+Ki1mL6dC*>eKj)+Z7P34ka_awGSfLyD2H6gUT
ze7`3}ITWFrT~mY40SPW=145Z0kcG7$-v9A^CUkv~0%!a*^3P~!xrwAO&M+jO-o1V6
zrmvs5>eczQ=x|evXbnxNm2fL*ai#(dp4Hrlapm1RM7WOBwM$ftb_p#31|T?|o}SrX
zb9ZO`u)v0Z^k`G?H^|w#A8>0rBiz~8*-UsG!FJ0O0|UcmPwdX9PEEo^tpLo3D|g%0
zq4UcGM_3RRJMdkeT=`^Vya#edkIv;VmXxCWQlhbr*f7VR!B@65?W^nSkf8Es%pnf)
z1?snX_Rc(77Hnl`<CXZT7BgoQlhs~$Hq!&Q3WVn<S0Yi+cKBfVH$fCV8-OK&fhuyz
zYQe*18PHk;s^li}{R+#-pnz5ma3_Q8Tu_+Hd0v{r%X?3cFu?>I&>eU|Bak=yJ38og
zT~bEMoq!d09q`Zi+bB^2Z$Vs2%EmDXR=ii;)pM;VPoQ*fKj`=FI;Sl!Jy3b1Sudx?
z#7E``8_pnNS{x3ks){#-cTmdKmLepx*+lNO!rhmR!ExNM{NfI?Z!83dANq5;tVX=s
zV^2w!a<Q8EPU_bw*4PzG5c7%kYxZq4lJ${ScB7-x&z_%8iXN<v5kNW5cvHNzn@{0H
z?`I;aW#)~I$`b$lk*>YiD*)p<oBggOf&EEB$U@`xZ+cj)ReN7Ncc)#o(_3KgjS43k
z`aVzvA)#^vJ3`FVa?^#o&>Sie_4B{TTeS<|&76OFiL1EZ5~Ik@!y|Vf_$xX;9}H2%
z91l6tyyw92m7k7pt6@9sc-VxW7!%&j^{5K}v@zW~zO<Be#M%WONl4M)GhOJt^se24
zGUQiDoq~)Ej$2lAVWHejD4e-DQN!ux_N@etJpZJB&tOd6TUAyhaIxNQ<L<#w=Y<OM
z<I{a3KnR}$49Lc|T<tPpvaS7y`R?D^NdfJv=64+O`osCL;440F^A~#lCZk_Ck?ncb
zJgoqj$(A%kNK?1gp8W$aS}?r&weVhLkOO9r&#kMYN4c$*e>eJ7Y6)#!FAHv0@w!#0
zu`zQ8jcQMbn7t!Z$@%;P+B<Mx0D)`ORy8&56w&m0lKJxf0ek;`M^=OU(A~)GbT|*S
zsUM$c)7>Iq!_sT;*iQ>4e8|z!A(i#h0jH#{oHR9aU~H(XCy^7n1Z8FIK5H`XPoIbI
z=1Wh+KG@FLbaiwXbSF=+5=<|`;#y}NlCxf{)dP~aerE5(`yWIShAWC&Sf`=%`<Dzp
zsdu=N@A)BG4o8_^l#H@xl?U3d{B=1fy{T*_f6hzn+1Z20VY2*8O<Qvx4VVrTk3;QO
zNWgbuQ;t5hCxy4{WVkspV~`$D80EJ%yRV}N-y9=}Ciiyz4B0Cv7ni%gYvp<|jb4#s
z3W{(e2^#L1+A!mE_lITU{!?4CIgh%b-TADL)&gUsR=v{idZ*#5hjwY+6wY-{v3*%k
zMeKB(;fl=@3Rh*tr8u<H{xL^PjD%Dy5yK2k&rLDin31&Iahc;opTeHC`eD_*)wc|R
zGi1N#zT*aq4Xhm!JV3tv0ZFaEF;n7|vcp>jqo>jLNlWmdIU2WU+s491qxRZ%;DfyB
zySHCpNZc`sK~+^ny?cAC9fd;t>BHBM=)yL4i~@6Ocqv$%b0s_Kk-ya&_W~Lr7!5%*
zh^~hq<lA#4Th<l?gn-95aRfF7@_ostV1Wf>{u4jG`L{)J!7MO@*gdO-M&k~lS3|l9
zM_{i}vr(D$j}Z{rLfL>CL^-y>wZTOM=H0q1QsmeKSa}h_SJ@v#u)WEBv~!yi7h6nN
zu)`(VEA%sELpu#xbXl;`0%+>>d5CF9BS9wqu~qNH!wcG4`p!<kWSL<!H1TGp=QI6R
z+`-(ud~i>sB*2)5lASO-p*N?cnhp&i1rjKs()8vzY%roacVQHx!)w!HRUD#gTd=Lw
zW`^?v*DP{uDgq2Z7HoKk<5MMvwy|ch?y?X<Zm0yfHG!wS6i3KR{OXx**~EACqF};V
z5u}??a1$!*`=HW+bUpaq<Z@chQ2Z!FGnD3S%R_v}^<Jo`W+K3)D%?dNqJQP(An5eg
zJmsg7;u3br@z62`sU!N)_v733Sm7uDs3?8=ecS?fUj*I*avx~QP-}X*c2gH@V?}-|
zvJkYG$rCf<mut`w)65=cMF@XuF<{gBDTJSsQazxxypN;2KukiSXKsyurGyk^T2wsp
z*`VyLdbCDM%7I)@_49(=ZOwBuEoLFbx%5k)ObxY8ql?>w#JhUG2yFi{#utAMl|T(@
z9&78SXqXX3crxJx&mNv3ZDy|j4M<OxlOV=yr!IN%LHBM2vy_$5kBz&i17sO-JjFj&
z#PDkro%Sz>Iq{76gi8%+%?N(Uj&7I`Cgo>(v?jkSanaZtCK4_*W#QxN+D>-~4B2D5
z8D$ngrnBEk$7^~0YbD|9np3I_7rD%R{4be^!ohu==Vt1k6WztJW)btjjh!J1v_+^o
ze~>OsqmeuhYo68E5FGLq=k?_}nQ^W4DIR@MrTJUHd@76DPgW{&+U03X&AQN>>Rg!f
z{k!hGw412MYg_q+*0lY*3wtLA%rXHlq{8<_k6j-d7-Xpk)fOrpxFu%Gq4B|fQfA2c
z<a-jvkDwM+FsGh%P>6m&A>>3wwBv5b?$LOF;?Z$uv7Rr?O)$d-BU$yb2l-Qez61+i
zt4S0F)vb5;DO$*sJAUvI?1pvboZRj#=Z#9-sOL+;MAzRUuk+jLxBBRN+bApgr$O=t
z66ydz*3+^jbdzsbg0H6*DKgu>VjZY@*W8gvO|xEB6lLB&_Hq>cq%HX_B-Ul}BJr01
zos8aJvBcDcXALx(MP)Ydaq(Jj!|e?WK61PB?*#bL;bfJ_5b9Qpy-j@6Qu~vkhfPfa
za=CE6{0GSPueAFk^grX^B<UyQqVj%y^~&@42N)0Gko>XJ^#_L6>AK`ETjJ024n9N_
z<O@Wr-TXq-qrT0U^HlV|D0+QiHWs8s-u&vnpAm(``2R-Q|7VaK0^;F&y7`;`d;#!-
zl+O)#4?o=g|9h|h^_%{G-s^w;rvE*O|8ao-<A?w41N=WY>;E3$|G`=R_W=F>`@{eK
z0p5I-^Rm>yAD9sq;UK(x<&pj$PLcVo-z)o|=R<I8dX}Ky^#yc6XU~~zsmw!YM$#+2
zeF0qh9!9o9&QwlGi4LY1#eY8gBy;EVqR@2>3**59Z;DZ2V$3oKvaX#Liz?z*?gs*%
z3>D6ep%nxkVh7h=FV9X^sf`qSlBlX)FZNG=pL?K?VsX;3%@59n{LY&ccxd3g29|va
z|B1eS#oj>!H&!APq##oX7JCZAADCn*f8N#2`!c#du!iG^g6~ygN*Iy}{|S;|BvsYm
z_J!ai<W$T$ZQ;@j^ajNX1>vjh6Y*{(RmXYG_;+3c#hLlG91k4$4E0U{1PQmcpb=)q
z2WncT`7*1q8lzhsX8KI~*eU_S<Zh}$l}X~2PkKZ|Uog1G7hNxzh`e#ef|3)dMXz*s
zJL481Un*(c)f8X+TZV|7JTQy`hijM^Lnl~oyFEIvet^Fji9P{Ug$|;;VbcBoxsg4R
z@B-4Ng{CKego76?O!(gaQdf8EM(fIryEQN|+P+?5ol{d24`t9+rRSr7fP4PU4<kqm
z^pE+^Mf}FgjBPF*LqUyNG~tAeCP}bLW?*CTk*K)gF@S$yMb^>NHQP5~{q+lZIyhHi
zlI2n2VGa(Di`&{he6BVrC2ji<2s<Do*gYy11P)S;Vu`^pBR2>#PkI*=Upd!)2qJS$
zX*lZ^1_n`B3@xF{PUE?<lt(U<V`=qQUR_Yb>9sxpSU%EwrG*TbN7W0o<G<Xo!1o%|
zy*B&u-LOx-`MD;V!Kfmr^j|Ijwzb7yh)4zZxKO}j<FqUMfjkA<8U(mlc<7@W_i;og
zCx=fgP_R?_y=4GHg$-Ix>O|;Ca4-VLz)o5+GF9YG+>{Fmpx})LY=6ebTidv&vvVur
zFD^W`su$E?h6g3ejYvh`kyc7t`u*CWYyxkYnkd}v`A^?a!Gg#x9J7jPn_V1{RxhN+
zpd+Iu!KcC15HPU`LB_jdSq+kduhnL%KMf5TKz^tcO!qV9IM%r>=Kr>$t5+YqbJ}tX
zf^qGae8Q|O{hQ3eDtn`w-tBtf`rP>+kwU54VXuoI>9mLWx!A|cew|CqtQY;M&eMTY
zMhjTpF5#uD_@0+{K*Zzwb(DE|+I=hY(u1E?kqd&p)gAZc@g6PPpIa7mbasJ+Z(w-p
z0mv71G#U~Y4QN5LMU<bv*Hy6IUgKV?VLuJ1cW?5H9)c6S(sc>#Uj)fYQ4xQ!OLyzS
zGfGN*aKr$Aoi&D9BT^#m83>8yM=~F^{8CgD4s|b;uy7=ME>Uo+o=K9-^>1?05)>b}
zlXm*jJQ=iq`mDz>7<9*3IvgLsrrf6A;Ogspp;_;=V%ehqFwNs1uV@A~xUbwyPWZRp
z_HL-N^LU&PWGKDGG@)owU3#u_ha_Br6$YAA_jjoc*^*BFYE=LXAPEeIhKpfqKnyS<
z!{&G0PJ+&_17WC>qnIvXtwRQaAo%>7!LX+LX6CL`-fr76w>p@&<>%P0Gjg*!Z!!2b
zk^^v~Ki71xCrMqFg+O;Or(%EuOj4;sSL{|&E27ilB*s5?UI6eX|Hhdcc#gK`mKB+1
zgkWc4{K>C)%c@v;ncdY6wNo0CMv<w}s6y*Ni-RLhyW!)6bxkZhh%~WyyJhLZqSn^i
zV#h&JR870MhtLB>rF`;NK-{!wDk`{*vuK5C>yIqCRaL4k%QfEqaG?N<dU^RV&=_sq
zK?&%X1ajx|&+_!tFtOlc6Fm{U{P9Sff&k-2tg}_Q&-IuoK~jJ;7aAEz*cr@CwyBwd
zP&vI{?-E|W`i}%;ECF2{k+BNnCj!XW2DT_#XzNpyA2(5M#*Ena;j#qgn?h;*N=4;k
zn_i(##m!S0$DrK;+<#iMFS3tm^1Bkcfh&PTPRoxT(|HguMU#{R4cGm<zJQuY-=ePn
zS*S+DrSX*Gp97zq5iWG$U=0RZ1%+H(q};(5Rb^pt^1zgVxnv6)WXXM$czU<3-}`13
zw2Bn4NJYE6YyP2C585CtsT#b+C4~dQk@Z6=TH1%GlB-*5OT884tbEHfFkYUERtES8
z=b`%GKwCfJIK46|KH0A^>TM3fq{*mE>-9^b$O4#Pz~Ikc!TY}aAaHr`9^vDLw^cS>
zgyon*cL$m9N_g-%LxsO!>mDqjZ(wW~Ug8J2VpM^W5;G45K#bbFjir>3&b@mX8XAg3
zKuFrQxof++QyN@906i{MaX!#OA5^qAms|3q2KoY%%1^aoGHl%9lb<?N9A{+?%W{;^
zFfW{32yInfa#=NOa^1KwT{tT$Iq%_lUsqtk#g_vU121nR@86MJq~)7V{86j8l}?-H
z8<SP&KIvEI4bkc8*B>&@2icbG01ZXZqhSUuPzKGo2!NxjK9JXIug)Z{*01*!UjyO!
zE(S%t93J&U0cOmgsMy#K{VVzg4xa(Yn<T{|A<_CQpD5>~_8168xG#QWm7x?2LmshI
z?WrKT+=Xn-B1*d8s0<yRsI1IWoM0Bd`6jCh73U2eeSIshgJxl{n%z6<OU1ydBNE|M
zeHmU5f5B8_xq0^`1zh0_oBQcAK~q+g*cb|Thc7OO?d*QMb?labxn)auL-YG<T(0TX
z3_ecAM+L*8#&7Tkb5&veB_JiOGC?;HvHKANixGe@z_-fGCj@0ST=VFd7;!Zt!itjm
zfNTTWIi&>X-QeJ(r4pX};$%n=j)w`W*Wr%-Yqi%(>gr68NjRUs8!IK7VUvJMyRKeg
zOGFxpuR7SlO!oz5XXq>aIX{0o=-Kox_i9vb*Pp99u5ZFx>!L?hnQs;r7WTtykZZ*H
z?~xVb;L2<;ZQ3kY*esQho}oInM|x);S5H}8?c+B<s<Qrxr%(hje<ygOnQOZxJ|GgB
z#(OKODfkoXw5V<92fcxj;a*Ejzulq<NlERGh$0Q=FQ(sJ5FSA1i3GS6bZHN@y*+W!
z@%to8M)&8+7@p%^3w!1y-jEG)N`v2MYbh!y@VUBH@x-J61U@)8A={ic2#LOy^UJD;
zwU6zbn529lcy^unu^z$w-FoJQLaNnbD`yE?Rrbe}l$2miYqrD$UVUVUlm@y|)JXZh
z!0w`bZJF_m<b>1TuUuJy0GU=-hpeP|2j6V5HOENq$0XI?*nnFG0t$9BbM*=@Tu@1Z
zLsy-^-s-~19j_c!HN6V{v6D8VcN%}kex5R>xo(O3Hr~8&5qzgJ3ks6$SKdL;Cr=6{
zZ*~Con@5)o7v1pB%HdqJ)ZK;|MLN8C6T)0{phRRSC73XvC2{S#->{RK#4;bwml7cR
z&3WQm!{1TiG@5YynHug*wzf31aS79~ss`)bX8;@x4-bQzg&#<-sLkv}-~WpsGj3i_
z=CRL@F7don*xTPjtUI>ov0{=5HEq?Qi1-D09jw58v~Y|<BeddYmIcf_uLd$Czs8*p
zP>0_37p1@xuUh>Dyp>?Fu~JWziRtO^UbFXC7pIFWOX1vQUM`j{Q@aZS#}}ajXUQ|R
z^>u#H(eIsV>p~w8aqDwEsl2LQZy3;0@&DL5@83j`6Bi4$j?yrJN_Q7aGFY;+KApn`
zsy&c>l!bnU&1Fy|^{2I({jz}x4_H-EQ&Of5eKz>FPPDqY3Cgf4h8kOXLc&`O=^KR%
zU@D2=h}9+k4OBtUPSarD*X4MUAXM}TNb&%r0V)auQdo1LV1fs&3@oGo>r;B;d^>$q
z@^pv|D21S|YynInI<XHzBLO@FNv<AiGNhPMV&8wIt{ynLzOdNowzqGuUa$8A5IMNU
zVG?%+pLO3H8aH<kRCs+Asks(1^xTs!g5_AN4H;oGx+^Oy5MK}=JWC6+H}LujHaBx~
zBOD)Bhkc2J%wk+bGhA6i<K_GJw?JnB(`h#LKVbRv{!g|v!2`D&pnqThn|tbK%3hw~
zm<87j1!#O+T*V&uacJU%wGJS8H0p_o7+4QfoG<QrrANj-f1{+%dT4LDi7WcCTbun?
z<o;N`urd#E&evbD%Q;5ihZWrR8V!99&NjQc8m(YBB*&D4lN%zKZ$Y>hY}MdxV}S(3
zAh5l}(${B#t*r{`w}nfT8>_&$5w&+3?_PZ93X!Q5BD>zazBE?g{I$E&e;tdmbxi{p
zsaB0MZn(saQgu1(39*1n)FBbqkJH{F7tdSu*Hh<-YP{i~3<phncL|wm*!8KmSD<$8
zckg30ppx>8{<&@PS%JwAR7$YlXgOq%5fUz6obDeS9|P4uTtR^g9&%W{q9CVgx7tOZ
z4=Qk8=i-2^Evu&pI`|zP9-fklR(SKAuCA_+AUNwndWGGp6v>mdyu#`wqx^#Ww^eqn
z;@veVtns1xl99XH*SqZh6ge|h@O(2^ybqhVZI1<=*^BH5C9-;~=<46i@19VvNUNy=
z`gN7P<5alC)BaDv=9+uE^~)%rV9d6RVNf$NjXVBp`g&@YPJ$^Z^i$`1j_J4jvkZF?
z@03j^YVK{|`I!-($$Ip6Tb{!_P}^F>4whcCgGAb|u)Bj+&-G+9a<5IJ=HopNAGDSP
z?_SZX4fmNjek?B{uv4?PW}dk&+m233?DxKEZ(wylV!#uBZ($Jzi5Knm%*89`GndGt
zpl5&e3TJ9c@M5_la=%+LoqQJS1&7FH&pSX_F6(m!!1|l?>X4FnvLW94Quw-UQ98!O
zeMLdr&5*<?`CjsHPgbPx%K`Qd4ULNE<aqvF?V4dIg6dle*0pmFEr<x@2zrdJ)*3E8
zreB=2!_@x{RkcK+YjAG5XWBx0#2q(s(f88y!mg_*9xII~ogEz_gB(Yj6aD%Pr;N;X
z)u@^8$#;?byVhbaPBI#10m{AMLp5A(Zu7X+k`}b~4D8SeU$*KS<a{l2*=>4`HjtH-
z<>2g$i-8QB+bNfrpA!oiS#^H!oTCoRKVPxCwZ9OCIzW$R6!YXB)04ChSQx*_9?O&%
zC`|>ReD)Zb*!;9^o49RXW$2+Kn+mP#(rpJF9kPDG>)Vp+3QAhMiRTTjWKPL9v`?Fh
zMS9ZfDO?8i+K*6UecrA2&+Alh*seQy_GOf)qgT55%jg|6Xw^W@zxVI2BNcyPPbzEb
zDf;r@#9(*%CO=S;ygkI*E!bjG(pIlPJ@U5FhT>&2<%Wwp{*}nbZ2=oB(8s`BnWK~`
z7`;9sUdJ=s9G`i4t7NKi%lXKrzAnZ%UE`&j8?yIhOb{@tE&l#Y1UCs(0aE6Q8QbUR
zj~QmcKX7C65Hs@f2o=Naj`u#dx4g46);f1>Ut_amB6}7a;&WnR=Q8)q;%r7%?aq8R
z5X!`1WrL(6jRZz!73e0RT-3S#yV>)tD3xF%;oHwYOd8lVZJLEMJA7)Pu{GP(e$Gc5
z`b#P592_Y$IN`Q~UCE1u*z>qhEOf%;maRGbW(;(7awA%|stN#~$|!h_4@b3Rc|Mu6
zP1c{2=h15ep+Ld)G&ZtQ4G%cinWcHCCCnmgi+WePWLL~!UmiHKz0z=f?EQZ8EIi(`
zAqO(+A498$mOk3f?|#I}HPmQX@TSyZ?G*&Me-P1~Kg`d!YqzY}6TWU2)@Mr`tFR^$
zc3ZUuSe=;H&fkWo2ZCs~H^#f+{;@Y2-rFhh0uUdKk`g@fFG4th+M6+l2OM1>gIc|H
z6O4_G1r3&!mSeX|87ncLW;?vvxG!byFLh|ucD?n$$OsU+k@xoPs@D7XtDHLZK=Q3!
z!p%x}73sDFvjn(3V2V66GO~j&d~pk8YZepre)85<3pe2>Y*!!kV|s!aTWFi~SoKR2
z3}3>)45SCl5HXT$T^|hHHfTb|YF!~m>DTwA-Xen>>W7g9F16EGm_2k~G%sT2=H7$L
zg@`g;szBo3zl1R2@9gY^Pum+QC&37J6EewwV>ocTJjq-DHA0xgf(!dr4H-d1%Z>5^
z)X;#0Lqb$>qHsK;wPpK~9moLvW>yy7PD#Ta_(AvMgA!}8Tos`4k)&!N9bjPqxZ7A;
zWnVQH_!SDeKcl1VaGc_hl?3TaNE}b2q4Kzo1iAt3c$2-?4rs`JUYV#ri??`$Pm>$;
zdzR`~3$!W>9tvNND*}-LKmaf;loxA1e|z0}OhyGEuz&t^+Hw77YN#20>+h0`1H}zK
zV|Ot|frJ*)-O(deGvD|$KPNM9d*sJ6v=a}Zz`!77AGl9JY=+y=-`#yFX6~C=$`f!e
z0QZuT1QP{l7vGX($O#M#T<(hJ+U!BFFFK7au(rI<R=i2J)idV4s}B%`RZeQRNocv$
zYEOIYGkWcI2l0O229q{4fZNi}qR(!<V|WZPwxtuyX?vYk6%8fAUlAq-t$Ry_Z|gPt
zZr@BfKNfI`m?ueq{lUyN!ka>{we1p1pyLkKq@=bLDF9E)%w89fW0vKizN{h)q`BU@
zx=-&$gh#OQ@EoKq(TG~8ff#v(-=;<o0~1qODGEyj9@fTP!pX>ayARU_L*P@_c(67I
z0tq1c02d2E&j)Y|oVAOmwwY1SdlMJ`ucJ)!=~vs{#5!rd3b}F@iLt5jD*BYd=cmkT
ztN)fGYU=yaJ-2Isd|rB<DkyL^wt$QEqO#|m!bMSLW{S=wI2x}vfq;_6i2nZ`7?brI
zpOMGf@W`2K5bb`!5=ZP7p={}|{rQTAj}NF4n1F4gmcUnp+WJX>fp7ux#Q@Ij0QAQF
zcx&k(G3Qvq9=<fFj8NpWPA$+K9UV=Q+6D$#+W-CAIrn=*ki>lV6%jmm{>^i;cTFfY
zrYA%CS156UZHkwO!Fv*1BBDPp!pws#x4E(B31`c^Ele;>*Vf?vex)rG3$=yQ)?{m`
zz9XoNZkWk#KcWqC{a{X_*Scp2T%L^4bz66)nbg*W-TC8FnyXYG;9gfauh_nNz0%a~
zJ?!4^&@a?ekJQ}5vVn1)`LXgjvUpb81AQFva0C^1)pC-UYl-qg0dn|q_($0Rv8Nx=
zf83`#ukS-D!@?*l5d^)#o7CgTKupTePd=!2_34U2(P@LjTDkcJX?%|VT<M+>c6@mu
zUUwCrp3ZE~FN^<q%ZhfJ`6`N<%&TdxnzB#}1|OuyrZa<3p}o`}lnzBbJUD=GpymdO
z^%ZY$oNt|Lb~LuU<do0)@dL8-&Y2mr!0e^`=xD!K*sqcN*RP-kJ)6Zv%u$kztgM(c
zQf`fMi}u~G^zN^$BetwCi5apSu5Wd9Kew%NV;Y+&b#U^`q8tE-4qSD9gKl8wDih1Z
zd>aVgmke6fVJ(%@Dp(d={P7B;@|_>poHobX6-h7Y)j|W{o5q{k4Nz&aFW5)lD;1Yi
zo*8So_Pi30W7GkMCS4urwbA15@t=}>8+FO41%rj__h{8hu2R~`t{?60+O`)3HQ}3&
zvYvkk`WPPmH9PxmMY|s(UlO>?f{N#6-uEXv*kZCawvPJTbun7<35N@dc4YD|^U*=X
z(rid~j@{`}JcLMmEYsL^sV&qzeInr(o%Ht|$mvM0rgdcY@g9+ck6UEs<pr$hT-*T%
zk%j5){(qd7;-8pa!|ZLYU6y{lB7HqqC%hTadv-|F(b>mmNxy!Hf@wD^!V43+2~?H(
zfBz!ByL3uk95Z`4DGWAU(*EHH@5(oWOv&EDnr+ahjgAWAq3yOMTib8fl|kOnaXO|b
zxAnLT<PCMk^p)ttoPDmB8-J&6+Y<(xwI!EA6n8^~Pd<YFT!n`vJvP0F0(d%*t9jZi
z8~{-#+9%CqYcVPQnXA~MS>M0=tPPgXd{rbHfAQz^p-8eE4H`Py$@C`o_vO$B9y@cd
z;)>piH~L&1^sh^f_6eRu5bgGMulJKw%(P9$>ty7YM@+dNt3-{)Z)<uBf{a^#c!g*{
zjE9Ab0HddNR|532>St?cPVvMBqc@51?^>u;n3kI(g{cPyTX*TFMa@2LF}*1%Kv4Lh
z*sf9Im)Y*C$zXmiv-alYp5*ZZ!}6f#<a{I!CWOw@UeC=(i*gGykw1`gKTkC;sY-%U
z0R4VH|5cxJaqa{HETX)dmW%k+E8e3g-H&gobJ=sTs+~iI*1)z}bJD3h+~fNqu8>Aq
z#350|05`2>Y+=EKbbRypI)B6y!K7V%=kJ#7OkCCzy&27ilTPc-OVbR}{*s@%G1Xpa
z3V_X25L8UkvhoxZtQ0u9HB(j>Uczp5x7@=>vKmF`@S4^SZ{4Q23%hWNr=;@EnMY+L
zQR9(|Kr~|T8{Ko|c6mYmnJP^tc+r2NabbIo76L~L{~>IeEY#%Q$5rO5$LHXw@hv}a
zT(8ZlOnhtk)I$g)=K1-D|DMMepvXTUYna-yIUI&-i6<U>p#h$V6%$XL2VSdw&20}C
zo|RPL1n4(IX|;A;pW?2<8!Ra3^Pf#k-6RB&Msok?Ys-2P4d6WF<f7eUP3)QDPj4jm
z{B*wadxK0@_}#KVtsMR>@7dL<frJir4glQY(N4;FU;6gxHfn(A!NCDw^sI#PV-|>+
z>WhgCrH>y10($DNwKtrIASmp@6M-Xix~Nj`zApz`{LTC@V4IEz19`(qBb$svK6E1z
z(!W<Bx?B4=EsYeE`+TXQ4h}!%)amc6+CS&!j=#QIVy^tx^&A*dpvgg0=m=XNxbpM!
z2mB?#Se)|3D(plcddtYmLlsx<=<B0lE)k{#f2f>9Zftxa+1IZt1uSJ`$bbqX)D}r5
zDQk~DZxZkul$=aS0@1p3Ek3mZ7|4{;!KeZk3n+=6I#D3a=*ii^dP+|ptaCBH0!HM2
zhKBq_q7tHf5GJ}!{<gLIeMCr_cAeCkY)g9oi2fls!Vi8rfZ_8aUY1+nZ)7(*<;-Tc
zct1%aX>DUetYk1ID(d$vg&#d354O+6tvfEWSLcZ=Rsf}wye)ieXKxoA9-39W#R3wu
z!i~ZXJ6bscnC{^Xb8`Nys32p+w}^Ewqq_B6SVO+^>W%|1F%>m!^k@mQb^Rq~q`(Cd
zkk%m0P0j0w7YZY2!iyWO%-X_9>@{t0y~bSE{yZY4EBL*Q6_pwrk)QvC4xDF%w8}qq
zb(uNv34#xhrv2fgnGogQAXa?rx${syoN?6wO@%3~MI2xL_Ls~bN#dbGivx3fdiwe&
z@JJboXnVu$XFh7B+duuPI+f|{Kzcrhs00!haX}YpoL*$qT@L1cq7C)qn!=aw^z@ti
z4Imz%d$@TXOGs4NVUlG5Bsl!14&yQq8nn7*Yv1}vrOKd79B7RY>~i8TZVdKz{*WMy
zw$}crif@Jv&B4KGZ=UR`WA=skYqgOt`4q+V|Lj6SCBF==(M@^#U<se$IY$N!4GD2@
zaIhM^uB02O@%BtlHqusvX~ppHFNUjG%IfNBWe2oTO~)q-?UAkPhkLE~>wq>f!vis{
z{$$eS<%yu7;gZKiryV>CdZjFzf9NrYxE3|uaA{F^plE`rZgg~C4^i<77IR%lGeRCN
z(4$yYFdSl=BxQC>ZTe}dLcs2Z2OC;-HKoVNE*oSf0&XXl#1R)tqnMrB-V3Ln`SsTW
zaRjTyDtV5!-7cbL;}gc0{#F!13=G28Ex$8AoYZRf7}+nznb_`j;QnoIZMAEC6rW}K
z7jeg^(o#)rL^?h_G4X|wk%YnP`7u?4_b<FkoPbz3$zi`NjcJ0$%gYNx8h9RWJ*B**
z!c>3aZwON_f9z;3ow&~l9n|r1w|=i5k~03a)02n-<uBO8KqmrDmK}Q%WQ;mjOWQnp
zEjAET1frSM*e-=nOb&xgb^e#<-SkYPeU+?PHasZ~{M87K53qI7%D#c1BW#$)n3`A^
zH2NNQ^mKg0Gk>KT+nZcryC@}Cwsl6@s1yZ0_(XUQ?m_6#`-L1!SQ%i7@c5<<sF_;v
zL@LUEw#}&N&)L;gH`Cw;H3{72%>x;J51&ptd!8@ZtbJ8EF<4^*l&#eV<y=Ku`-QYA
z{a~(60I*pv&%!;9#?8PhK;tIe5}+xAk*Nw?5|Y-xzlgpS<{P!_WPA~M6YnRVTrqp-
zT4mdIxO&J3f~*&MuWpZOdfrRb(&|Y)e+Kg~$RL`_ii~5^Yf%DcD_+ev?J@Rg`hS1Q
z_U%7>6<f@NB9tD<zf~FFhtmD_Y)uBfI8aj5o{t7-dLXDmkRRLa=srp2whp%_iRe>!
zEl-Voe<%K)HzjikGrRQ#rhKow$8IZfNC+|*#`QM-u(PUPLq0$jloeKQ+go~Gb-GM+
zdJ*b~_jsAz$bnT}zPEBJ&HmllrLZ_`=dPFMAe@uY)MP-Pc8#2mZl)*YO=-)ax%x3{
zoqZrp0oiMj!rBsMW^AL{_V+-o^J|^!l~R<VtLwek*kJ*da}=OsVUiU$Zy$Fey+a;Y
zNmEenTP<Hnj2jXps>le_$@<oj=+XBk9Ot?5812qs*Qv~(fSW`&u<-ytA)pKKXbDD#
z@d*ktIc?K}cs=IFo(yn@QnjXtd0&w|aUA3T$3YnaVJnV1$Opo1y8^+7MBKM@E5=z9
z!z`w2V>4bNv*){rl^9d?y|LUR85$v-kCr6O^lqsCmM=3?&kHV*ww1+cb70u$)MH{%
zZUP2ekaNV`wto1^eU(K!JsoV40GCG%e2q!MCkEFO#wav$1l{1`sDu~r`LmEol1T0-
zI3{<_%v}5UpYT{UTs{W02&}a{O06j0XnN5bF2%x!v1Eg(V=%&`WgT5fQ{dC$A{9;y
zP6D6de8v0+mYB{C!@-<Sv9ZAjU4zT&-n)J;ZiM3r@^Wbc4{LfsXFwLmc)hWTdPk{=
z(=ItlW7W>VZtd%FR9c*jlM_wAy;JCJWn?gCk6d^iDlx^Cl{gzSs`)^`1-lc#JIU~U
zA}<~S>~ZKz5QZ9GIr{MaU3hdvAKXiH>ud!h?<iPds(&Sqd4CCe{}M&n{aeIM6-G--
zB#(Q;w}*5f4Rd~wHG*}dGROBQ<*d-)@Y3!(JNLwBYeYU}qkq7@rjr>0#<RW(JG97h
z;B4mKayO#&y{J$7dZWjrpTAShgVaoN|1UZXnxqMy%pnTxGmn|(6}{8iqbUzpJg<q9
z7f9SWmc9aY7=lx>5FayrIJ*d4E5Wre)0D7L>3)27IIzn>Z@e6*cHnlWwY3#i?Tags
zlF(2%J-BubA-*%)xkYt;NiQ9FwC0SJ0dCbUiDU}$%gK5C?%hP?YG$y3K@RS#mjq#M
z4w5Tc>v#cUmDZBKGgTbMHjlFW*xca35WVj<Y1Lzd{<v&u)hGCr>Pc+Vpf1RG%U4%T
zFP`xImkZGGTR~Hk*sYE<s4N+(l3vCl4$cZ}NQd}1*9_RPrt{{oTq0ZIRL${T6PdPA
zZxVA~H}8^he$9mR%a`nHrg@c9+J%p04W5026aM>HUNI6~RTV*W5dDEIRe^$u>2XYF
z%lG$wuDVB9aIyE>lF?7Pb*3}wvR;y!Fq0#X-}^+RbsuPg&-g;X$b~71BhA<M*2(3q
zckeVh`+zx}$7}bg2Yx8tx}PN(F80wTFk%3~J1`Ytb-;ILrtTC-C|LbhS6HuA-^3&*
z+iM>ynwgRH7(q-4)CcbwfRkJ2E=#~+LN59->&c3HfB3J2UIU|?IU5K2-r;y$A|k(L
zMEJ}$EiZ4dP-iF1*dj~yCH1)y!PZ#Rnk6bGRov~}GvTwjW8POf{TkMF-IT(vKG1KS
z9d>89w6L^=llc+8%Cj~hXQxaBt6nI+Qd6~B#x^1K)M<OV9ZHt^0Df~9F9#4lLu~>6
zegM+F1iu{kGo5-4Dt5{Tkp2n_O>^Lb*5L)cnQ0twypqwrt{<~R$Tb|v6pqlrR*&F#
zP&O{6uaDbG8N_Zn?*a+G-FuJHS<M_+={-L+s7~dX5q=OsN}o~uy=}Z*@98i4%&8{z
zCNpeG!OR?MutJ9kEbyBh9r5t7gxyBp4*dNKeGZOSL*$=Jl(kWAeDMziHL31f^?qQD
zns$0g2KK>U743cqjCCPFg58>c;QRc4!d9E;FIci~LrvJ89jx!-y&Dup28C>n5jg6d
zHXd(F5DOwe#R65~2kx17KACht%goO=e<-Q)o{Nj?$82f<ECe4!$VH@7rRAjsx6c{)
z_>xQqnGAP7MVeZff|2pSpFeF;8GcVa?HNL&v3;ZR^;igQeBr^SQ-5v-pIukPyWC=`
zaVNtMh~4k!TTpwFk7=yyOMO7z3YNQ#$5wSu#8L4(en_Y%a@gK>42s;DZfb>|LtfK!
zi9<-M{*zTMu5)Cv;JM5R0&AOsk}+Jlwb^B5>KGPZ41oWBI`hp6q%=|7@Anis8jd78
zeB|Ti;4S|#QeR2=;r4|i#X?&|&d&pKt4QWr>rfkh3UFx;q{r83(YY@F2xZIA5UJ>k
z_md~3U{M<8x_{l&6cF0k*9l1)@^T3*fuYPvE&0RgS^3XS@9aU2AwK-;dpgbV!l|^9
zs#f#Ouju%ak~D0bob5+bD{#ojB<b+<4!-G4Urva&g)sr6+m7weAUHX+=yBPP!_MB#
zkDe%COAIzqkXeps(9r=GHuY);>UeE8R=}FU?Cv4a^FdT?B|kP%BfNO3H4QPC%g28H
zl#n2$W`ry#Xa#<n1OhHBk3*m24vM>q--8r9@JR)bth28#6T-%WvXYyccJ8#R4s!zf
zO8{Pj;G;xZksM7aiG3d#QUK<prXJ#@0-GB74)UUBkulBH;61+=GBQVlBh!H|tiM1n
z47yUFjjgS&>dyWag^?=Y)$m>k@D`AhBN;KIqM{Kxu}Q;89a~%L75y)F7(R>lRpjW(
zjc3`#EmznVpmCR<_7Rw0m^T40f$}44AY+M%tJ6P!o(p01p{;UY|95Av$sR#6H3deE
ze?~?mG&KcSorrdKccb&mR?yS?6;0Q?&JNdsuRO1-{^VsKMw=ej;NU_IL~u7Xc|a1k
z4WHJ=#2a7G+dx!@xH8~~Pa&bPE94nC+)B!Yk(7)|N=wtHrlvyEf&AzJ6+JyF#a-aN
zyjD}i#W<0cQ2;8d&+0ci*!A-A^K%LcLQhUy_V!VtQZ6?0X$K}JMa2!NfpJSWci?5Z
zmUken5FwzkwCgffQGzGw%w4`}f`;-q>T|+<pNUP-UP1OOP2pqo%d=xz{^z(Qqu@kF
z4e6@{;m8oxAZw*i?(szjdEk2fFb&&*M*tAEzV=lpvmY8);8+S?-f>HvBAwJ0-osgB
zIIK~i7%^&nY#EnIk!lZ(Z@!mXzW#XLD>u_55#^JSuNQpf({x{KjMj5Z|I(A42u;oO
z{jAH+$2WM9Tr%jLgdH8mrsM2gkA1%1<GoG0?JYm3gtw&ON*s0d;Fg1iF_x%E;glWe
z)@xr~rPlEUTCO&k&r6G0G9;K-8BsDRQ@)uo{d#HPURVJf)mlOuT<GO=iCW+aFa0U|
zTF%%L^C$MK-Fb(!;z<`G_4>7h-v<$;))lN2HXo-Wmrl9xW|OElo5m$G6xn7j9$rsG
zWN%)1K(?MDR+)r7^LD2&{~0Kq9h~_a)Z76Of2j}1!R%*CynA@5c7OApBw?>Eb=Wg&
zr$+_`w#DSU__t;|I5}ze7f(6_r_aacCtnS`9hLN-09=uD1v<P;_~u7O%1cs_bW~MS
znDCRF^xVO99#(%@t*M7da3h0rFgINGXfC*Q%j`$3{_^wPNA_dTzIgccD++?+NnUCm
zbmB)_Q$hXP+lSTIzC{`pWhT2pCXy=1Bs_21wgla8L9(&oRr2-#0zuEOd~-fjPejs#
zMaX}{XiY^+W&hWm)wnpd$IRNk?F*-`bc<}i7vA=JA!%iWN&WTwbl-g6_1_x)&5h#&
zZ@%A^zPvkW&usgx95cDM?e~X!9<>gq_o7*@EY>$R=EJ%1#X^{f7o6Oic*P{cTUPeV
z9M;&<yq51>owN&6`jazq#tL<!!oC0OT<bqqW&dvjHIRmVfleiKVL}f*8CXe5%G7R6
zylH~!8wUr6j)@eAN6TfZ>2PMW336&V3UwccJ`0IdE?P-<da;$UfnmnbFv;AXJQW)r
zHzm$+T^2DFd-RGaJ6z`46FY+zUT)eTn4OA7PRRSNP4@h<G_%V1d4ROg7EaS;W;juv
zI=0CL^$_OhFs1(&Ag)41rvg<uP`}(|k7801qznx?TU(nc>AylV@q|^6K-A=Otm=1X
z9aInkz=SJ0I$A<{&CAVg(!r5;r*bNcR4^nZg#iXd6V4l%IXQ8#<3n6yAdG#W!~)0L
zjCvu>FXY%5Y*rgL?8q@4x2Q{$ZYdcVgNsT8tcg&vYm{$&xsnn@4MugTo5p4GA|y)Q
zsT9O}{CL)ehb5^;(`)=Sm&N2qY+o2njgKdO-VpA{md5Rq$#axGdqz=$;;ljSj@(C&
z1v@p>zUgJdQ@p1GQ}X>8@34JWH!OOBrRSXXI^Dp&2oku%iEGNr%D~szZiP=4KKk(R
z5DMxZBX&Ru5_*@lSGs}T178M^JYba{tgzOB0J1*1g3bViK@K=c`2Vmad`e7|29-8V
z%v$#4xBO>N1pw6nw2u%s5`CmY%iC1CNqGM*7<Mi$FCX!3qf!iTghxbRf*l^fkO%9d
zkwZhTF_4>4(<%JH3=~4?z*O(I0b6u@yrhSR0AH$t(XA?_+a{?B?dPFFdf=!6p<#m~
zf19S9XFB7GCQc{Zx7m$`=wS7JX=%v_ZKv#O2Rx&);IX&-ISY10W=U{m113`}kculk
z2w}Lp_CuBYu0+-c7(?Pv+(ljxR^t>Bil8e97>QHEnP2Gd<a6RD_PA<w3&bMx9XBvK
zPV)q+zyK|8;+t!Z$hqbqY{OE3($Oog>)mag_)pIfqIUt@)DgU*$_fbrWs0lkmBz(<
z11UB3&OX!zcz77Iy6Vv9#a?XW3TI^0r^R3KL>3gMNH|yA#E<S@ZqM}gY1Kf|9Im){
zK;enSgAYFG=EYSZH)H>#{!uo!*Q{iod-SoYK?Gb5EGXSw5HfkKV7q&Nq-a74N;dA^
zl*SdELj9$#VGMu}04@eMcHZ}%$;lc3|FpEX;@}g#ge`S_)N;d7_lNj|iKS_bigC8R
z_YVwYTkav1^CJx&uEIONQ*?fRyuKvK`M;_=?|-WQ|Nn~yA{7c{XSA#kvLngtr9)*V
zvm|tEGNL3A4Jw-)D<>;Sh-BoInWT(3X2?$V=XT!T*FW*?(hrG_JkR5Kf8NLKe!G5i
zadb>^^fG;xwMx+;PW6UP`>4_rTV<V2-fr9I<+YyrF%{fYKw0qd{?lboCFH5ozbz~C
zUYRW6gqs0V?|R3*GQ%*Ci>TDQx9;PHgvW4Ro~aj%YN-s6n{t=npgM-j-xx-g2!Fd8
zCt2jljm4c7jn_(g_B1dbO;C>W$HMppP_`x~C*jwLwq$;OK5Vf3&0IgSpFi^Cbn-73
zIj{Alk**>~)}Edo^wc1E1AlR_Y8$W3^v^2N{>=&=`Nuqeo5}KUtA<BL+BL)oMY~Nt
z%W#FYxrNV|5Kc@eXb}Vg6{}}pFaqLN8VaNsQwstCI5)4^1`(K0q?DEI0}{u{>4>0K
zB=yA)0G75cEFMC0(SfVe+>^bpbp7HpuIFAu26LI$9pEb#;@F<y)+1xm_WgV9vF4_s
zwk#zkUWJf_aapj<;>5SS3r6UU$e7l*li<+j;FRHD3Q<q7=+gachy9{WaI*US^=#Pm
zxh=ca6SFe}q?!3QV{g6-_S^5L61{_7e|<geDaG+-Lu+vWE`R~a@%!v_NdfSJowtuV
zYi|BwwDn`RPopkM6iG>0<Cp94k&*h+{2T<uU|+kQAdDOWcs5k1KsuXgK4f~591EC+
z0p*4ME-($dofEz3V$Ixkp}z56EvY<7Up32~!*NdfK~}7phMSwfJ>|b4<9X#V;6u3e
zxSP0k6=gYndlRZsDZ3G}Fgf!^(ByO7j$upX%zgJyLE%{75k=IeV<q3oD7JL@TS{X1
z(h;~@Ig8_;b|1paartwN>wW7iiPxU18cEs=24?Th?KUvcJZPK1&9=T;dAFgl%t~tl
zGyNu5mUbZkk)!3uEGdgCROA*+R4=XknT+n-&d4Z0$D~e=H}vCVNuNG}z)pi3%NG2w
z%<NCUI&#K-{Tk@M!z;|sujcW~QH*x)k@N3a4HVUYK0qLcM<!sGu-`*qf#vWUO5_Qw
z00Ju|2?&=(z?wT+^K@I8sCl^FbJ={ycIfPt|9xnn-0;SgqAyqHt;l2i^5REWmqNR)
zHMr2--EA>><?2=MUs<F$l>lXo%rSwW0ul4f%f7w3M29#_Ma`j9;S9{qKE&fce-@Le
z+dG4yZin*;&<6u^%_<}$cXd3zN8I{_{GZb~@YkPa>C3=4>?1Zeh;JdKPtTZF!yrML
z>u&h#-Hf3U9Mzj<V;?Rb4p&!Kr&T6TMJV@C7O=gheOj?(TY{k>^IkziHrgPo!G(x<
z;{3A9tAN}`4sw~tF^WJWJ|HZN{!Qx`QA1M;O%J&G|D3w_<Ut%qRF{o<yT;$DGn+14
z7(*ukl7X|WtzL>2TwKr3mpKcfGmBm@8UZ}yDA25wg#Cn^q@IV}&8G`~{nZ%T!Dq*F
zN7+If#meau^zR@C7Zx^4l@_jz{OC7O6#Ms$7aol%55oJ|vexiSadm}(id&I}f@in8
z`#GiczOdI@nX<YZQuv<btb};z<(TyM<g>5x3^<p?79GyhaNzo^qf(VWPiHpOOuDhm
zG*MbAy7%X!Gz1^z<<T^YszRa%&NrmzJPgl%fOI`Eq1dmuv^-8WA`n75u7I>H4;+?&
zl)_tA%Be)ZS?vnY%TN}HYo!?Ux1^jrV)`1J&s$I3=lUofu%rV^ba?akzbxss2Awk(
z5VS_|%6Pb4;~lJx5z?9VDengN2aBQ)5lg5i5+BuN6LR9@Tm`77=wOy-M=hFTu&Hf?
zlI66X-U~z+a;I;#$5C-{dng@Iia5XN-%7=Y;aLm_5(Bwn`OuG&>-Ifw-6MEacy3j_
zFR*Qd%HtRu#2`?+G4$AEH~nTW%KhW#!6=*?X|^B!_v!rP50gmsfFE?D(-s;w#6A44
zemFsT3C@fxO0UeEoH~jtD?59r@Mf4>L0X7m&)`=W06=)v+STFxol)KL>-V<Xja?_*
z+y>-L%kkr|aqm|&)Hn0nFSK%|fwyI9bn*AXRfP`1DRKql=HM@1_N$Xd-~4`-bC8^g
zP_jnaA)uJ(lGVMw_Eh#7V~%k^WLl$|Qv|#h4;bf}-Pb3j*;pQAzONUke(4gwl9G~{
zw6_%IEg+6Vv<bOKG9D81^XJg!IB6eC32D|b&=KNbZ0l}ACAh3z`7rH=+L<JqCA!$A
z$rPdV)TsNU=EZ>1M7uo;Q>$C1nvPmtVXby3X&-?Nho<I3kEO>o>^nBAl2sRfvD52F
zR|vX?yt9bVx?XM}igbkv$o+i0ujWdzTL-};-)qLY^hSbhv(n;zpl09A!d}|4Vl{-X
zEH{@4gIChA%e73X^zLM5BT(ey=+FQt)zH}Z!6v43&cLVFRqijA`Dx-5+z)}5r%Gy<
z^!w|Apn$iFMMg#juD=iB<8={$5DX%?WWr&;O#Qx_By8$;$~t{}Kk)IM_rP6|H%r6M
z4d{~z1R)Nl*|NU1NXg5!(-hu~xV07EBobYa>Y(*Oe*T~=Ba#&0e0+)>Hh=<yi@7DX
zF|>IE^6<8n7F83Iy{y8zKLHW3S^YZ`t(Nuq`El@@RrU0kol8zg>1iw*Z*5^zDCbGg
zm*+Zt2<Ag@mqACCbIu~*9snntgpRnIlaHZo-NhJ+3Bu3v(0gwve@r<g`23z%TS-Vb
zPl)!KzKKJ73LM(ViaZtm)9vWcMK@!31U^Oh!e~6{2EWh?7FLmnp`J>y1M>1u=jXq;
z1d>~FY_cuLTCJfZrTzO#32c!T2Sl}gjJ~>f6vr^%dgzM9^W(gQU0fDPX@cDf=2Nz{
zwKay)E_{t9xdSaJ7rS|Q5q=PqoR@y<?s-@EV6oR!LsyrnwCjQ>W4B*B)B60zFmixK
z2im-{KZo#4Ea{PYSSr5p6ivI+XY`dFE72%@5S>`HzP3$pQ&DRBrItG+ce%G^sIG@n
z?+JgRD<|qdWn~pzUfW(XJVLqVlzdQOIb=IQlPog#eT<%<**ex@dW3KD6$w?(E;agP
zwM>oy))vnDd(UlTWuLilfs_1hmXW5U*XJ-UWIiTI0sw<Olex;F<RcA8GCInM#GO=Y
zbeN4|i&#udtiV6A*~X@@YcRRS5j>_x2tI6@V+-$-GaREaWXWL%GPZH3y5B`(Sq8DR
zAU-aRV;S?+aoUl_p>iW5BY1_yQfI6XC>LKe_^T}Z@SxOC?T{OigZqGaIY|FwX=&i^
zuXOkBUFe{9adY3#a9r&SSlbK3jMFx~bCM~BqEbTeSikt>@<y%J)g~!D*3?;-amV#M
zhNM1mNHzxhEXXFA**^1?{(uzn`}p_>TnpKWF*@U&G}FzrK^BcS6cPrS$>sdGcW;=P
z_AyMpvmnFuG8L4X)l0t*r@nq|?C{Lv(^S{ceAu77M5Fcc>^!~9Y>)31^qXm`huj!o
z(YB;tWo779uAJg{@r}5j@-C*Wni3ql@tq;}%Fd3S@|`H#M!N||GNgTMx4HQam?8_V
z?V;Zs(mWM)WbT_UT~MHl+}qH!GE+FZ_Roc?lw@QWKl-i0_jdn|e8)Ls$(5=kfPKE!
z`*KG*_Y)Na*T}Ho9UI%VL(5B^CrS%HV6{h&$v=lI)+sqy(+cTS;fTmJ0_7}jWj0B}
zSF6r(<=>${cZX$357GmcInuM$PrMEAFnM(E=wi2!@rZ5Mea~*;Rr3Uq*DRqLb%{Nx
z^I7uNbLE9KBbT+pWNyvY{NYs*eS7$@*qimM*RHXb^xZ6@(SVzcsJQrEohL`+J(>-1
zD-VVART48sw2!*^kzc-KKi=n8NK=DNGdK|*(qE~-gHF<Qpr-y0`eaYIeQv9#JopPX
zr6yhnHP-;3<Lu_<=IZUzGZTf)jH)Q)?g6E8*GfW^HYhL?F9-~8`09?{fDQltxh0>Y
zCWMaq>uE1uXhO5KT@^JOBWaFzq!?J7nHp9Ds#_weUVdjNL|n&TmW1=4yiE@gzjNu(
z9^j?izPmeIy~>JB99ZU9z@si4nw(F}E6gjkTFLC1m~YUhr;0|CEI*hG+a1|6r%nEL
zRD^S>=*MKYf9Ik=T5;VI*Mh~9a&&c3H@#R+QO1l~<L`IboJy0NWxGbcv_Tm*;z`OI
z{YGD;Pg?mW>3pPVA8WgozxRCq`IYI8Uw4xNMh&^CLwIXzfoqeKX0nskPO_#prhcVK
z?h4$kt*w@&=G#~fS*u!X)GKf@Z;jCEEVitySRLI~sQ;ZehG-lmX)nhm@?~e!hdYkz
zDp6_aFM{-=9Dhnk*>$TD?Y?g5@WdXeZR3-Ct14O=o`6+X=+y*`7}5(pc@*1Q)v3KY
zW-4bM^4hzP9<fn@#*mT=pO{CE&kxT-FpU*I0G=Hu?YJAyg|LX}#i_oe>S}fLNWCCh
zf-e_BLV-)aIvxT$FX)??bTY7fx!H4K6Ykb-V!Pf%Uu6<ds|60Nsr7vYg@y3G_Z@|n
z@?c+IS62gak$+dFDh&_<SyWafkOV*8x46$ElGb4;V)#JPebt5WwlQLP@K+<=+=|*w
z%&t$=C$E2fbns!rzLuodUuCVWFV}zi_wPmjS$BQLCq}yWmcDx@H8+brZn9TUdL6&N
zEiqurMzr9()8F9tK}zS=mt!{vtaEV2n(s;+aNQ(&_%P*o<q|WE%G#Jg=|n-}tBWto
zX>U=EO`h&!(rd?I8v@HlY5QKW14>E>cX)5c9W=^_Cq4@#{`%>Srp)RulS*sQvY9v}
z0=0PkA2F~BYkb#DP<XtJ$1Cs-k58DA@1Ixp%{(+1KGtE9B53q{!ed26#$6bz!~l>}
zvp3`1^J@C~J8*5^+ZAF-^9uE%<7=1tHr6bW1@?}|9|}o+@gfxW(L<3$FIps1Cs~xf
zjMJ(rG}Ad0HmF941S);^OI)v)UJcr5+?Yjo<6gt*s2>KopM83__=TrFcno84yV`&+
zi~kUq$tqzDd?T*feO9YZ5)Y(_91Nj!GoJ3Pl8#c3qt+s<)-G}NJ~OBei~c4S7(Hqw
zQIA~%M+XObUdoX@pw5TrlP-fi9qqAC)+rhJKJ|J$-hO>7=hg`5DHeV+nijs3GRQfp
zO!znBd1XGI8y;6ExR_V?$w#TI%YmT558t`H7G6Pk>))C1?MIb?*r4s|DhYfJq!xzf
z&S{`KgSmHPk&d3;8tHeY2a)&+=?(Qtf$Lfc>MGE23b3Q2*66Eq&4tcA3VV*6SG{!U
zl8w#MH|{XR3+la3Lk0HEw47u~@F=>d5Jl^t8Klf0`@O82DAzq=OG1u6Dthd7rcu)V
zn5ew84?~(6GRnRy`b8bO5j_GYPAZVzeby^->Q-$Ts^-|I^Q)%e{PKL&vu9^!<0Q{r
z$Q3=snkd7&i}9U{+PpRz1Su&&Rub`Ua~&p@w!QDXu?_C)>zm#~zPWJtHWOzx>Oor?
z|E6v1=g#QpP}>mR=oi55cXh&Eg>pw_l^^#@!L5o6v^!HZ?|I=1sF@d_@f6U$2ikPR
zmH6o`P(&gZ1AYZ)W-xiT8ef%r@f*%D+{zmwA`c%unm14?8gVN<Uuefng8{LbN0+UQ
zO~|%FVg2~}wih};o^zk@{GE;kpxvsx3dAsABW4HgiPKKwBF)StZN%s19w`l~Ji19b
zL@U|o;l#-GDke=el2J>-u<VP5Oc9}m+buTpe#R?n4t+Xp@=DVe(ni1Kb9a6+Xx02d
zFSmbCcVh>w8ika^*Dbb_D?=@<bxb^hX`4DdPJ~ZSlky)QB2gM1S+vzRG%DjObQF&N
zxIEI7unOe69o+J1RtH5?E`80t0RMc{u<Bv;MH=!ihX*my4A@xdqh2+*xbi)H`gHYA
zNu_Od2t#HzS3`Sl=Qu7TvTzt%H^U@AAnO<P1fsihp+wBAgNPT5-X3>Z=ylXlO3v$B
zT~2oO5BMi~%b%mGhp44$Y`h2ET$DI?Km|^-MPIJ+2jIj&WlehO-P{fu&mQ-^R9K3n
zWPayOm+XSUHg7i7JD%y+H%@_S#<xh&R$vip^4Vy|A({A@GM~E<Y<Po?SzJ-4-IRPQ
zJ4K$Gp1kiPk5<xD&;23Vr=|`dgRjoi8F)#YArN5wRgE2%8#L5dfCgUg;g7LIXWB|q
zqE9$Bmrmh!D(*c0mgsokG_>Yagb3WWJ1v)z7elkrxvAp~h)0`;MuVqjb!{qu*D<Yq
z>~GS>5-&Up!RWe7&DyZ1C<bI21?S|Wl|;+8Z(;3YHdsZ+GIKG=jI=FZzSQ7#uygub
z=9%9i>bY_6Amm;w4#zW;$9F<<kC<6lkFz~m7u0DNn&}IjmIkPRAj?C4D;9QSB5t0D
z@0tL07Mo;EA+$+hgMhs1H>OCRETkQ?KDl`(qW~Az&Y<_L1A3R_J1wJ{9FlEY)%|=+
zSPx~<aF1HASaB*xrjJ*g{L|5C6<#hu?VoCSc>G}?=VYJpSyl-bd_f{%o_$#BZBwc$
z-_E6t%bv~z!i$`ooX&*qygV^Tv3$xse|^a+pfeC;W7G_`r;p;`Z7f+G@}SYw)Kr{)
zPltXr`g^<w({@PQ7}ot=vEp1C!O42T7-a?SMcxm0SnR)Kp8b>)`VS2aU4yoU+PQMt
z^Cc$~?=PUNj-JH(_7v3->}%PuePY#-O^}w6(d<2j0th6~9f;NXI7!$JBzNv(NZf=Z
zQ@=jqh99Tb*gme<UFuCgA7j+W6({$0G&hrPa4zNe^RZ)2UgQWa0k-P17PmY5-}kj{
zVvM5<fXBt!Uc$RoKKstjVBq9_jgRkAmvH&13a7=vM?r-(V?;MV<k0{}pA9V-2x?|l
z*6@y|nfxS5LAiJ7!|evP6cXN84R7zIF*<%tenG)o@7}$uzgk>ej3A2<OAto<D8!H+
z&CbmUUU(6*6G*x^DpTm{*CRLA#w~HNw}(veL1e-TNDEu&45e=IkihVQ54GKmxpYsD
zo&?7MWo4e{pHHc&sij+mXJ-Q&yqDDO{oNg8MJ6uk)5ZdiHWguvbX;fqma{Y;`RKqM
zu7<=tJ3Dbc=z?Cm*YHz&uZjG+xD%dY$ic96y=Ih@;`l7L%{MXHNDd<)ngphJA?;<i
z2R0J%1(88JgZ)?jM90LaJ3IeYVOQi`Vbb2(^1o4$cApP29e~aOG^l}4-}a7~)gapr
z>J$sV73gLqul)Dt80vrNe}4_>(*OH(j1A4v|2``f_~gIO{x?*kenjW+|JT2rzjh!*
zj?}1R(ioc_u=hh~K`ORZ$er5)Qv<84Fsn#uPe`~L_CFu1_tyDPJQ@<%fgDd2wO>_Q
zyQyMV$a$+j=Xg|xBlb_Q1Bp>dgo;5-dO(tuL`d^u6eR}sl}@rr#gv%&&)ZTUvmg)z
zM}jxbQSJM=Af4ggys*FwW2xP&tTRh~B1+pzm3ZbAxcA%}x_Yz{P7k#ib}$2UkvE?o
zd#J0c`|m+$3zB$qI;aedwsGZL<EwB0ZMX*I1p0e%y25w>2tVX}*ude)O22t##UC#7
zy0sKbmY<6&FyoD`U{lAR7`EO@78Qk@7VUYh0ebi}MQs`h+F<derQtRb)wQC*FKtbI
KjXZU$;Qs^3S6}r2

literal 0
HcmV?d00001

diff --git a/x-pack/plugins/security_solution/public/landing_pages/links.ts b/x-pack/plugins/security_solution/public/landing_pages/links.ts
index 8a0681fa01f72..adbb37a59de5b 100644
--- a/x-pack/plugins/security_solution/public/landing_pages/links.ts
+++ b/x-pack/plugins/security_solution/public/landing_pages/links.ts
@@ -14,7 +14,12 @@ import {
 } from '../../common/constants';
 import { DASHBOARDS, EXPLORE } from '../app/translations';
 import type { LinkItem } from '../common/links/types';
-import { overviewLinks, detectionResponseLinks, entityAnalyticsLinks } from '../overview/links';
+import {
+  ecsDataQualityDashboardLinks,
+  detectionResponseLinks,
+  entityAnalyticsLinks,
+  overviewLinks,
+} from '../overview/links';
 import { exploreLinks } from '../explore/links';
 import { links as kubernetesLinks } from '../kubernetes/links';
 import { dashboardLinks as cloudSecurityPostureLinks } from '../cloud_security_posture/links';
@@ -36,6 +41,7 @@ export const dashboardsLandingLinks: LinkItem = {
     kubernetesLinks,
     cloudSecurityPostureLinks,
     entityAnalyticsLinks,
+    ecsDataQualityDashboardLinks,
   ],
   skipUrlState: true,
 };
diff --git a/x-pack/plugins/security_solution/public/overview/links.ts b/x-pack/plugins/security_solution/public/overview/links.ts
index e2f8cf012c27a..2d75eee57bece 100644
--- a/x-pack/plugins/security_solution/public/overview/links.ts
+++ b/x-pack/plugins/security_solution/public/overview/links.ts
@@ -7,6 +7,7 @@
 
 import { i18n } from '@kbn/i18n';
 import {
+  DATA_QUALITY_PATH,
   DETECTION_RESPONSE_PATH,
   ENTITY_ANALYTICS_PATH,
   LANDING_PATH,
@@ -15,6 +16,7 @@ import {
   SERVER_APP_ID,
 } from '../../common/constants';
 import {
+  DATA_QUALITY,
   DETECTION_RESPONSE,
   GETTING_STARTED,
   OVERVIEW,
@@ -22,6 +24,7 @@ import {
 } from '../app/translations';
 import type { LinkItem } from '../common/links/types';
 import overviewPageImg from '../common/images/overview_page.png';
+import dataQualityDashboardPageImg from '../common/images/data_quality_dashboard_page.png';
 import detectionResponsePageImg from '../common/images/detection_response_page.png';
 import entityAnalyticsDashboard from '../common/images/entity_analytics_dashboard.png';
 
@@ -86,3 +89,24 @@ export const entityAnalyticsLinks: LinkItem = {
   isBeta: false,
   globalSearchKeywords: [ENTITY_ANALYTICS],
 };
+
+export const ecsDataQualityDashboardLinks: LinkItem = {
+  id: SecurityPageName.dataQuality,
+  title: DATA_QUALITY,
+  landingImage: dataQualityDashboardPageImg,
+  description: i18n.translate(
+    'xpack.securitySolution.appLinks.ecsDataQualityDashboardDescription',
+    {
+      defaultMessage:
+        'Check index mappings and values for compatibility with the Elastic Common Schema (ECS)',
+    }
+  ),
+  path: DATA_QUALITY_PATH,
+  capabilities: [`${SERVER_APP_ID}.show`],
+  isBeta: true,
+  globalSearchKeywords: [
+    i18n.translate('xpack.securitySolution.appLinks.ecsDataQualityDashboard', {
+      defaultMessage: 'Data Quality',
+    }),
+  ],
+};
diff --git a/x-pack/plugins/security_solution/public/overview/pages/data_quality.tsx b/x-pack/plugins/security_solution/public/overview/pages/data_quality.tsx
new file mode 100644
index 0000000000000..a19fe43bd36a7
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/overview/pages/data_quality.tsx
@@ -0,0 +1,262 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CommentType } from '@kbn/cases-plugin/common';
+import {
+  DataQualityPanel,
+  DATA_QUALITY_SUBTITLE,
+  ECS_REFERENCE_URL,
+  getIlmPhaseDescription,
+  ILM_PHASE,
+  INDEX_LIFECYCLE_MANAGEMENT_PHASES,
+  SELECT_ONE_OR_MORE_ILM_PHASES,
+} from '@kbn/ecs-data-quality-dashboard';
+import type { EuiComboBoxOptionOption } from '@elastic/eui';
+import {
+  EuiComboBox,
+  EuiFormControlLayout,
+  EuiFormLabel,
+  EuiLink,
+  EuiLoadingSpinner,
+  EuiText,
+  EuiToolTip,
+  useGeneratedHtmlId,
+} from '@elastic/eui';
+import React, { useCallback, useMemo, useState } from 'react';
+import styled from 'styled-components';
+
+import { SecurityPageName } from '../../app/types';
+import { getGroupByFieldsOnClick } from '../../common/components/alerts_treemap/lib/helpers';
+import { useTheme } from '../../common/components/charts/common';
+import { HeaderPage } from '../../common/components/header_page';
+import type { BadgeOptions } from '../../common/components/header_page/types';
+import { LandingPageComponent } from '../../common/components/landing_page';
+import { useLocalStorage } from '../../common/components/local_storage';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
+import { DEFAULT_NUMBER_FORMAT } from '../../../common/constants';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
+import {
+  useGetUserCasesPermissions,
+  useKibana,
+  useToasts,
+  useUiSetting$,
+} from '../../common/lib/kibana';
+import { SpyRoute } from '../../common/utils/route/spy_routes';
+import { useSignalIndex } from '../../detections/containers/detection_engine/alerts/use_signal_index';
+import * as i18n from './translations';
+
+const LOCAL_STORAGE_KEY = 'dataQualityDashboardLastChecked';
+
+const badgeOptions: BadgeOptions = {
+  beta: true,
+  text: i18n.BETA,
+};
+
+const comboBoxStyle: React.CSSProperties = {
+  width: '322px',
+};
+
+const FormControlLayout = styled(EuiFormControlLayout)`
+  max-width: 500px;
+  height: 42px;
+
+  .euiFormControlLayout__childrenWrapper {
+    overflow: visible;
+  }
+`;
+
+const Option = styled.div`
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  width: 100%;
+`;
+
+const OptionLabel = styled.span`
+  font-weight: bold;
+`;
+
+const options: EuiComboBoxOptionOption[] = [
+  {
+    label: i18n.HOT,
+    value: 'hot',
+  },
+  {
+    label: i18n.WARM,
+    value: 'warm',
+  },
+  {
+    disabled: true,
+    label: i18n.COLD,
+    value: 'cold',
+  },
+  {
+    disabled: true,
+    label: i18n.FROZEN,
+    value: 'frozen',
+  },
+  {
+    label: i18n.UNMANAGED,
+    value: 'unmanaged',
+  },
+];
+
+const defaultOptions: EuiComboBoxOptionOption[] = [
+  {
+    label: i18n.HOT,
+    value: 'hot',
+  },
+  {
+    label: i18n.WARM,
+    value: 'warm',
+  },
+  {
+    label: i18n.UNMANAGED,
+    value: 'unmanaged',
+  },
+];
+
+const renderOption = (
+  option: EuiComboBoxOptionOption<string | number | string[] | undefined>
+): React.ReactNode => (
+  <EuiToolTip content={`${option.label}: ${getIlmPhaseDescription(option.label)}`}>
+    <Option>
+      <OptionLabel>{`${option.label}`}</OptionLabel>
+      {': '}
+      <span>{getIlmPhaseDescription(option.label)}</span>
+    </Option>
+  </EuiToolTip>
+);
+
+const DataQualityComponent: React.FC = () => {
+  const theme = useTheme();
+  const toasts = useToasts();
+  const addSuccessToast = useCallback(
+    (toast: { title: string }) => {
+      toasts.addSuccess(toast);
+    },
+    [toasts]
+  );
+  const [defaultNumberFormat] = useUiSetting$<string>(DEFAULT_NUMBER_FORMAT);
+  const labelInputId = useGeneratedHtmlId({ prefix: 'labelInput' });
+  const [selectedOptions, setSelectedOptions] = useState<EuiComboBoxOptionOption[]>(defaultOptions);
+  const { indicesExist, loading: isSourcererLoading, selectedPatterns } = useSourcererDataView();
+  const { signalIndexName, loading: isSignalIndexNameLoading } = useSignalIndex();
+
+  const alertsAndSelectedPatterns = useMemo(
+    () =>
+      signalIndexName != null ? [signalIndexName, ...selectedPatterns] : [...selectedPatterns],
+    [selectedPatterns, signalIndexName]
+  );
+
+  const subtitle = useMemo(
+    () => (
+      <EuiText color="subdued" size="s">
+        <span>{DATA_QUALITY_SUBTITLE}</span>{' '}
+        <EuiLink external={true} href={ECS_REFERENCE_URL} rel="noopener noreferrer" target="_blank">
+          {i18n.ELASTIC_COMMON_SCHEMA}
+        </EuiLink>
+      </EuiText>
+    ),
+    []
+  );
+
+  const ilmPhases: string[] = useMemo(
+    () => selectedOptions.map(({ label }) => label),
+    [selectedOptions]
+  );
+
+  const ilmFormLabel = useMemo(
+    () => <EuiFormLabel htmlFor={labelInputId}>{ILM_PHASE}</EuiFormLabel>,
+    [labelInputId]
+  );
+
+  const [lastChecked, setLastChecked] = useLocalStorage<string>({
+    defaultValue: '',
+    key: LOCAL_STORAGE_KEY,
+  });
+
+  const userCasesPermissions = useGetUserCasesPermissions();
+  const canUserCreateAndReadCases = useCallback(
+    () => userCasesPermissions.create && userCasesPermissions.read,
+    [userCasesPermissions.create, userCasesPermissions.read]
+  );
+
+  const { cases } = useKibana().services;
+  const createCaseFlyout = cases.hooks.getUseCasesAddToNewCaseFlyout({
+    toastContent: i18n.ADD_TO_CASE_SUCCESS,
+  });
+  const openCreateCaseFlyout = useCallback(
+    ({ comments, headerContent }: { comments: string[]; headerContent?: React.ReactNode }) => {
+      const attachments: Array<{
+        comment: string;
+        type: CommentType.user;
+      }> = comments.map((x) => ({
+        comment: x,
+        type: CommentType.user,
+      }));
+
+      createCaseFlyout.open({ attachments, headerContent });
+    },
+    [createCaseFlyout]
+  );
+
+  return (
+    <>
+      {indicesExist ? (
+        <>
+          <SecuritySolutionPageWrapper data-test-subj="ecsDataQualityDashboardPage">
+            <HeaderPage
+              badgeOptions={badgeOptions}
+              subtitle={subtitle}
+              title={i18n.DATA_QUALITY_TITLE}
+            >
+              <EuiToolTip content={INDEX_LIFECYCLE_MANAGEMENT_PHASES}>
+                <FormControlLayout prepend={ilmFormLabel}>
+                  <EuiComboBox
+                    id={labelInputId}
+                    placeholder={SELECT_ONE_OR_MORE_ILM_PHASES}
+                    renderOption={renderOption}
+                    selectedOptions={selectedOptions}
+                    style={comboBoxStyle}
+                    options={options}
+                    onChange={setSelectedOptions}
+                  />
+                </FormControlLayout>
+              </EuiToolTip>
+            </HeaderPage>
+
+            {isSourcererLoading || isSignalIndexNameLoading ? (
+              <EuiLoadingSpinner size="l" data-test-subj="ecsDataQualityDashboardLoader" />
+            ) : (
+              <DataQualityPanel
+                addSuccessToast={addSuccessToast}
+                canUserCreateAndReadCases={canUserCreateAndReadCases}
+                defaultNumberFormat={defaultNumberFormat}
+                getGroupByFieldsOnClick={getGroupByFieldsOnClick}
+                ilmPhases={ilmPhases}
+                lastChecked={lastChecked}
+                openCreateCaseFlyout={openCreateCaseFlyout}
+                patterns={alertsAndSelectedPatterns}
+                setLastChecked={setLastChecked}
+                theme={theme}
+              />
+            )}
+          </SecuritySolutionPageWrapper>
+        </>
+      ) : (
+        <LandingPageComponent />
+      )}
+
+      <SpyRoute pageName={SecurityPageName.dataQuality} />
+    </>
+  );
+};
+
+DataQualityComponent.displayName = 'DataQualityComponent';
+
+export const DataQuality = React.memo(DataQualityComponent);
diff --git a/x-pack/plugins/security_solution/public/overview/pages/translations.ts b/x-pack/plugins/security_solution/public/overview/pages/translations.ts
index 9f6e885dbfa1d..474bb1db94fdf 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/translations.ts
+++ b/x-pack/plugins/security_solution/public/overview/pages/translations.ts
@@ -7,10 +7,56 @@
 
 import { i18n } from '@kbn/i18n';
 
+export const ADD_TO_CASE_SUCCESS = i18n.translate(
+  'xpack.securitySolution.dataQualityDashboard.addToCaseSuccessToast',
+  {
+    defaultMessage: 'Successfully added data quality results to the case',
+  }
+);
+
+export const BETA = i18n.translate('xpack.securitySolution.dataQualityDashboard.betaBadge', {
+  defaultMessage: 'Beta',
+});
+
+export const COLD = i18n.translate('xpack.securitySolution.overview.ilmPhaseCold', {
+  defaultMessage: 'cold',
+});
+
+export const DATA_QUALITY_TITLE = i18n.translate(
+  'xpack.securitySolution.dataQualityDashboard.pageTitle',
+  {
+    defaultMessage: 'Data Quality',
+  }
+);
+
+export const ELASTIC_COMMON_SCHEMA = i18n.translate(
+  'xpack.securitySolution.dataQualityDashboard.elasticCommonSchemaReferenceLink',
+  {
+    defaultMessage: 'Elastic Common Schema (ECS)',
+  }
+);
+
+export const SECURITY_SOLUTION_DEFAULT_INDEX_TOOLTIP = (settingName: string) =>
+  i18n.translate(
+    'xpack.securitySolution.dataQualityDashboard.securitySolutionDefaultIndexTooltip',
+    {
+      values: { settingName },
+      defaultMessage: `Indices and patterns from the {settingName} setting`,
+    }
+  );
+
 export const EVENTS = i18n.translate('xpack.securitySolution.overview.eventsTitle', {
   defaultMessage: 'Event count',
 });
 
+export const FROZEN = i18n.translate('xpack.securitySolution.overview.ilmPhaseFrozen', {
+  defaultMessage: 'frozen',
+});
+
+export const HOT = i18n.translate('xpack.securitySolution.overview.ilmPhaseHot', {
+  defaultMessage: 'hot',
+});
+
 export const NEWS_FEED_TITLE = i18n.translate(
   'xpack.securitySolution.overview.newsFeedSidebarTitle',
   {
@@ -35,6 +81,10 @@ export const TOP = (fieldName: string) =>
     defaultMessage: `Top {fieldName}`,
   });
 
+export const UNMANAGED = i18n.translate('xpack.securitySolution.overview.ilmPhaseUnmanaged', {
+  defaultMessage: 'unmanaged',
+});
+
 export const VIEW_ALERTS = i18n.translate('xpack.securitySolution.overview.viewAlertsButtonLabel', {
   defaultMessage: 'View alerts',
 });
@@ -43,6 +93,10 @@ export const VIEW_EVENTS = i18n.translate('xpack.securitySolution.overview.viewE
   defaultMessage: 'View events',
 });
 
+export const WARM = i18n.translate('xpack.securitySolution.overview.ilmPhaseWarm', {
+  defaultMessage: 'warm',
+});
+
 export const DETECTION_RESPONSE_TITLE = i18n.translate(
   'xpack.securitySolution.detectionResponse.pageTitle',
   {
diff --git a/x-pack/plugins/security_solution/public/overview/routes.tsx b/x-pack/plugins/security_solution/public/overview/routes.tsx
index cf42fa4cd0a3a..b5ff8ba4807ec 100644
--- a/x-pack/plugins/security_solution/public/overview/routes.tsx
+++ b/x-pack/plugins/security_solution/public/overview/routes.tsx
@@ -10,6 +10,7 @@ import { TrackApplicationView } from '@kbn/usage-collection-plugin/public';
 import {
   LANDING_PATH,
   OVERVIEW_PATH,
+  DATA_QUALITY_PATH,
   DETECTION_RESPONSE_PATH,
   SecurityPageName,
   ENTITY_ANALYTICS_PATH,
@@ -18,6 +19,7 @@ import type { SecuritySubPluginRoutes } from '../app/types';
 
 import { LandingPage } from './pages/landing';
 import { StatefulOverview } from './pages/overview';
+import { DataQuality } from './pages/data_quality';
 import { DetectionResponse } from './pages/detection_response';
 import { PluginTemplateWrapper } from '../common/components/plugin_template_wrapper';
 import { EntityAnalyticsPage } from './pages/entity_analytics';
@@ -54,6 +56,14 @@ const EntityAnalyticsRoutes = () => (
   </PluginTemplateWrapper>
 );
 
+const DataQualityRoutes = () => (
+  <PluginTemplateWrapper>
+    <TrackApplicationView viewId={SecurityPageName.dataQuality}>
+      <DataQuality />
+    </TrackApplicationView>
+  </PluginTemplateWrapper>
+);
+
 export const routes: SecuritySubPluginRoutes = [
   {
     path: OVERVIEW_PATH,
@@ -71,4 +81,8 @@ export const routes: SecuritySubPluginRoutes = [
     path: ENTITY_ANALYTICS_PATH,
     render: EntityAnalyticsRoutes,
   },
+  {
+    path: DATA_QUALITY_PATH,
+    component: DataQualityRoutes,
+  },
 ];
diff --git a/x-pack/plugins/security_solution/tsconfig.json b/x-pack/plugins/security_solution/tsconfig.json
index 531fd7c0a6f38..9d312e57f98af 100644
--- a/x-pack/plugins/security_solution/tsconfig.json
+++ b/x-pack/plugins/security_solution/tsconfig.json
@@ -79,6 +79,7 @@
     "@kbn/i18n-react",
     "@kbn/kibana-react-plugin",
     "@kbn/core-chrome-browser",
+    "@kbn/ecs-data-quality-dashboard",
     "@kbn/data-views-plugin",
     "@kbn/datemath",
     "@kbn/ui-theme",
diff --git a/yarn.lock b/yarn.lock
index 8b1d994f4f695..8019abe753c62 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3669,6 +3669,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/ecs-data-quality-dashboard@link:x-pack/packages/kbn-ecs-data-quality-dashboard":
+  version "0.0.0"
+  uid ""
+
 "@kbn/ecs@link:packages/kbn-ecs":
   version "0.0.0"
   uid ""

From c71725ee46587671b51b9c3db384089e06f0b01e Mon Sep 17 00:00:00 2001
From: Diana Marcela Prieto <dianam.prieto@gmail.com>
Date: Mon, 6 Feb 2023 23:43:18 -0500
Subject: [PATCH 028/134] =?UTF-8?q?[Dashboard]=20Unlink=20from=20library?=
 =?UTF-8?q?=20/=20Save=20to=20library=20actions=20do=20not=20work=E2=80=A6?=
 =?UTF-8?q?=20(#150338)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

… for maximized panels #139915

## Summary
As suggested in the issue comments
https://github.com/elastic/kibana/issues/139915#issuecomment-1234408466,
in this PR I added some logic after linking/unlinking to the library to
set the expanded visualization id to undefined.

After testing this changes in a local development environment, the
visualization is no longer disappearing from the dashboard after
linking/unlinking to the library
---
 .../public/dashboard_actions/add_to_library_action.tsx         | 3 +++
 .../public/dashboard_actions/unlink_from_library_action.tsx    | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx b/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx
index 165f77b2c177e..1431c7fc61ed2 100644
--- a/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx
+++ b/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx
@@ -97,6 +97,9 @@ export class AddToLibraryAction implements Action<AddToLibraryActionContext> {
     const title = dashboardAddToLibraryActionStrings.getSuccessMessage(
       embeddable.getTitle() ? `'${embeddable.getTitle()}'` : ''
     );
+    if (dashboard.getExpandedPanelId() !== undefined) {
+      dashboard.setExpandedPanelId(undefined);
+    }
     this.toastsService.addSuccess({
       title,
       'data-test-subj': 'addPanelToLibrarySuccess',
diff --git a/src/plugins/dashboard/public/dashboard_actions/unlink_from_library_action.tsx b/src/plugins/dashboard/public/dashboard_actions/unlink_from_library_action.tsx
index 1dafc89972a3c..6be0001c62b59 100644
--- a/src/plugins/dashboard/public/dashboard_actions/unlink_from_library_action.tsx
+++ b/src/plugins/dashboard/public/dashboard_actions/unlink_from_library_action.tsx
@@ -91,6 +91,9 @@ export class UnlinkFromLibraryAction implements Action<UnlinkFromLibraryActionCo
     const title = dashboardUnlinkFromLibraryActionStrings.getSuccessMessage(
       embeddable.getTitle() ? `'${embeddable.getTitle()}'` : ''
     );
+    if (dashboard.getExpandedPanelId() !== undefined) {
+      dashboard.setExpandedPanelId(undefined);
+    }
 
     this.toastsService.addSuccess({
       title,

From 705ba7b5c83099723abfd35be68a8e259aca15d2 Mon Sep 17 00:00:00 2001
From: Yuliia Naumenko <jo.naumenko@gmail.com>
Date: Mon, 6 Feb 2023 21:01:31 -0800
Subject: [PATCH 029/134] [Security Solution] Alerts Grouping MVP (#149145)

Current PR introducing the new grouping functionality to the alerts
tables: on Alerts and Rule Details pages.
The existing grouping design is a technical preview functionality and is
a subject of the change.
MVP description:
1. Grouping is available only for alerts tables on the Alerts and Rules
Details page as selectable dropdown options list in the right top level
menu of the alerts table:
<img width="1565" alt="Screenshot 2023-01-28 at 2 00 33 PM"
src="https://user-images.githubusercontent.com/55110838/215293513-a46e5989-0e49-4b4c-b191-e00d6ef14eff.png">
2. Default selected option "None" means that the group alerts by is
turned off and none of the field is selected. In 8.7 feature has a
**technical preview** badge on the right of the select option.
<img width="373" alt="Screenshot 2023-01-28 at 2 21 24 PM"
src="https://user-images.githubusercontent.com/55110838/215293745-ae232e12-eb92-4429-a667-7b76a2be8c61.png">
3. The default fields options list is different for Alerts and Rule
Details pages and relevant to the page context:
<img width="1555" alt="Screenshot 2023-01-28 at 2 30 02 PM"
src="https://user-images.githubusercontent.com/55110838/215294128-a0e2a875-088b-446e-ba96-28bcb1d114d0.png">
<img width="1498" alt="Screenshot 2023-01-28 at 2 31 22 PM"
src="https://user-images.githubusercontent.com/55110838/215294132-0ca11882-73e9-446c-9e75-112569b9bdc7.png">

4. Group by custom field is a separate option which allows to group the
alerts data by any other index field.
<img width="980" alt="Screenshot 2023-01-28 at 2 34 28 PM"
src="https://user-images.githubusercontent.com/55110838/215294168-f787093c-72e9-483d-8881-70320b1f4343.png">

5. Custom field provides a limited to the field value only default
rendering for the panel and default set of stats metrics: Rules count
and Alerts count.
<img width="1209" alt="Screenshot 2023-01-28 at 2 35 47 PM"
src="https://user-images.githubusercontent.com/55110838/215294237-17c6105c-d9a3-4ced-be2b-c17ffd181e14.png">
For rule name for example the is also additionally rendered metrics,
rule name, rule description and rule tags:
<img width="1899" alt="Screenshot 2023-01-28 at 2 40 02 PM"
src="https://user-images.githubusercontent.com/55110838/215294351-8935ee93-c416-4357-80cd-ce28c0127993.png">

6. Each group panel provides the list of bulk actions options which
could be applied to the whole group by clicking on the **Take actions**
button. For now the list is limited to the three available actions:
<img width="1557" alt="Screenshot 2023-01-28 at 2 32 24 PM"
src="https://user-images.githubusercontent.com/55110838/215294393-513dc001-be83-4f76-ac09-3a36b2b89e00.png">

7. Existing technical preview functionality is limited to display only
one expanded group at a time.
8. For a big number of groups there is a paging functionality with the
ability to define the items per page:
<img width="735" alt="Screenshot 2023-01-28 at 2 32 40 PM"
src="https://user-images.githubusercontent.com/55110838/215294444-98dfef11-b6b5-413b-b82f-0dcea90f0e65.png">
9. Grouping setting is stored in the local storage for each page
separately and after the hard refresh should be picked up and rendered
on the page.

---------

Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>
Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../common/search_strategy/common/index.ts    |   2 +-
 .../use_alert_count_by_rule_by_status.ts      |   3 +-
 .../lib/flatten/flatten_bucket.ts             |   3 +-
 .../components/alerts_treemap/lib/helpers.ts  |   6 +-
 .../lib/legend/get_flattened_legend_items.ts  |   7 +-
 .../alerts_treemap/lib/legend/index.ts        |  11 +-
 .../components/events_viewer/index.test.tsx   |  40 ++-
 .../common/components/events_viewer/index.tsx |   3 +
 .../events_viewer/right_top_menu.tsx          |  16 ++
 .../common/components/filter_group/index.tsx  |   4 +
 .../accordion_panel/group_stats.test.tsx      |  88 ++++++
 .../grouping/accordion_panel/group_stats.tsx  | 120 ++++++++
 .../grouping/accordion_panel/helpers.ts       |  31 +++
 .../grouping/accordion_panel/index.test.tsx   |  93 +++++++
 .../grouping/accordion_panel/index.tsx        | 101 +++++++
 .../grouping/container/index.test.tsx         | 180 ++++++++++++
 .../components/grouping/container/index.tsx   | 189 +++++++++++++
 .../grouping/empty_resuls_panel.tsx           |  67 +++++
 .../groups_selector/custom_field_panel.tsx    | 104 +++++++
 .../grouping/groups_selector/index.test.tsx   | 104 +++++++
 .../grouping/groups_selector/index.tsx        | 139 ++++++++++
 .../common/components/grouping/index.tsx      |  15 +
 .../common/components/grouping/query/index.ts | 174 ++++++++++++
 .../common/components/grouping/styles.tsx     |  94 +++++++
 .../components/grouping/translations.ts       |  32 +++
 .../common/components/grouping/types.ts       |  66 +++++
 .../common/components/landing_cards/index.tsx |   1 -
 .../pages/rule_details/index.tsx              |   2 +
 .../alerts_histogram_panel/helpers.tsx        |   2 +
 .../group_panel_renderers.test.tsx            |  56 ++++
 .../group_panel_renderers.tsx                 | 150 ++++++++++
 .../grouping_settings/group_stats.test.tsx    |  64 +++++
 .../grouping_settings/group_stats.tsx         | 180 ++++++++++++
 .../group_take_action_items.test.tsx          |  61 +++++
 .../group_take_action_items.tsx               | 188 +++++++++++++
 .../alerts_table/grouping_settings/index.tsx  |  56 ++++
 .../grouping_settings/query_builder.test.ts   | 258 ++++++++++++++++++
 .../grouping_settings/query_builder.ts        | 253 +++++++++++++++++
 .../components/alerts_table/index.test.tsx    | 188 ++++++++++++-
 .../components/alerts_table/index.tsx         | 253 ++++++++++++++++-
 .../components/alerts_table/translations.ts   | 124 +++++++++
 .../detection_engine/alerts/constants.ts      |   1 +
 .../detection_engine/detection_engine.tsx     |   2 +
 .../use_host_alerts_items.ts                  |   3 +-
 .../use_user_alerts_items.ts                  |   3 +-
 .../factory/network/http/__mocks__/index.ts   |  32 +--
 .../factory/network/http/helpers.ts           |  38 +--
 47 files changed, 3544 insertions(+), 63 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/group_stats.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/group_stats.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/helpers.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/index.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/container/index.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/container/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/empty_resuls_panel.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/custom_field_panel.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/query/index.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/styles.tsx
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/translations.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/components/grouping/types.ts
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_panel_renderers.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_panel_renderers.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_stats.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_stats.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/query_builder.test.ts
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/query_builder.ts

diff --git a/x-pack/plugins/security_solution/common/search_strategy/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/common/index.ts
index 851ffaeba2227..d73b39ceb282d 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/common/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/common/index.ts
@@ -70,7 +70,7 @@ export interface Hits<T, U> {
 }
 
 export interface GenericBuckets {
-  key: string;
+  key: string | string[];
   key_as_string?: string; // contains, for example, formatted dates
   doc_count: number;
 }
diff --git a/x-pack/plugins/security_solution/public/common/components/alert_count_by_status/use_alert_count_by_rule_by_status.ts b/x-pack/plugins/security_solution/public/common/components/alert_count_by_status/use_alert_count_by_rule_by_status.ts
index 1bb5b4e7c6ca0..515a5306ae913 100644
--- a/x-pack/plugins/security_solution/public/common/components/alert_count_by_status/use_alert_count_by_rule_by_status.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alert_count_by_status/use_alert_count_by_rule_by_status.ts
@@ -7,6 +7,7 @@
 
 import { useCallback, useEffect, useState } from 'react';
 
+import { firstNonNullValue } from '../../../../common/endpoint/models/ecs_safety_helpers';
 import type { ESBoolQuery } from '../../../../common/typed_json';
 import type { Status } from '../../../../common/detection_engine/schemas/common';
 import type { GenericBuckets } from '../../../../common/search_strategy';
@@ -202,7 +203,7 @@ const parseAlertCountByRuleItems = (
   return buckets.map<AlertCountByRuleByStatusItem>((bucket) => {
     const uuid = bucket.ruleUuid.hits?.hits[0]?._source['kibana.alert.rule.uuid'] || '';
     return {
-      ruleName: bucket.key,
+      ruleName: firstNonNullValue(bucket.key) ?? '-',
       count: bucket.doc_count,
       uuid,
     };
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/flatten/flatten_bucket.ts b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/flatten/flatten_bucket.ts
index ef15178cbc256..c0780b4e7bd66 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/flatten/flatten_bucket.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/flatten/flatten_bucket.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { firstNonNullValue } from '../../../../../../common/endpoint/models/ecs_safety_helpers';
 import type { RawBucket, FlattenedBucket } from '../../types';
 
 export const flattenBucket = ({
@@ -18,6 +19,6 @@ export const flattenBucket = ({
     doc_count: bucket.doc_count,
     key: bucket.key_as_string ?? bucket.key, // prefer key_as_string when available, because it contains a formatted date
     maxRiskSubAggregation: bucket.maxRiskSubAggregation,
-    stackByField1Key: x.key_as_string ?? x.key,
+    stackByField1Key: x.key_as_string ?? firstNonNullValue(x.key),
     stackByField1DocCount: x.doc_count,
   })) ?? [];
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/helpers.ts b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/helpers.ts
index f71c49f08b05f..e41d2ddeacaca 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/helpers.ts
@@ -13,6 +13,7 @@ import type {
   WordCloudElementEvent,
   XYChartElementEvent,
 } from '@elastic/charts';
+import { firstNonNullValue } from '../../../../../common/endpoint/models/ecs_safety_helpers';
 
 import type { RawBucket } from '../types';
 
@@ -28,7 +29,10 @@ export const getMaxRiskSubAggregations = (
   buckets: RawBucket[]
 ): Record<string, number | undefined> =>
   buckets.reduce<Record<string, number | undefined>>(
-    (acc, x) => ({ ...acc, [x.key]: x.maxRiskSubAggregation?.value ?? undefined }),
+    (acc, x) => ({
+      ...acc,
+      [firstNonNullValue(x.key) ?? '']: x.maxRiskSubAggregation?.value ?? undefined,
+    }),
     {}
   );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/get_flattened_legend_items.ts b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/get_flattened_legend_items.ts
index a904d6ef90bd0..5b8ba7230485a 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/get_flattened_legend_items.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/get_flattened_legend_items.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { firstNonNullValue } from '../../../../../../common/endpoint/models/ecs_safety_helpers';
 import type { LegendItem } from '../../../charts/draggable_legend_item';
 import { getLegendMap, getLegendItemFromFlattenedBucket } from '.';
 import type { FlattenedBucket, RawBucket } from '../../types';
@@ -38,8 +39,8 @@ export const getFlattenedLegendItems = ({
   >(
     (acc, flattenedBucket) => ({
       ...acc,
-      [flattenedBucket.key]: [
-        ...(acc[flattenedBucket.key] ?? []),
+      [firstNonNullValue(flattenedBucket.key) ?? '']: [
+        ...(acc[firstNonNullValue(flattenedBucket.key) ?? ''] ?? []),
         getLegendItemFromFlattenedBucket({
           colorPalette,
           flattenedBucket,
@@ -54,7 +55,7 @@ export const getFlattenedLegendItems = ({
 
   // reduce all the legend items to a single array in the same order as the raw buckets:
   return buckets.reduce<LegendItem[]>(
-    (acc, bucket) => [...acc, ...combinedLegendItems[bucket.key]],
+    (acc, bucket) => [...acc, ...combinedLegendItems[firstNonNullValue(bucket.key) ?? '']],
     []
   );
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.ts b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.ts
index a47245e70389f..9736987003252 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/lib/legend/index.ts
@@ -7,6 +7,7 @@
 
 import { v4 as uuidv4 } from 'uuid';
 
+import { firstNonNullValue } from '../../../../../../common/endpoint/models/ecs_safety_helpers';
 import type { LegendItem } from '../../../charts/draggable_legend_item';
 import { getFillColor } from '../chart_palette';
 import { escapeDataProviderId } from '../../../drag_and_drop/helpers';
@@ -28,7 +29,7 @@ export const getLegendItemFromRawBucket = ({
 }): LegendItem => ({
   color: showColor
     ? getFillColor({
-        riskScore: maxRiskSubAggregations[bucket.key] ?? 0,
+        riskScore: maxRiskSubAggregations[firstNonNullValue(bucket.key) ?? ''] ?? 0,
         colorPalette,
       })
     : undefined,
@@ -38,11 +39,11 @@ export const getLegendItemFromRawBucket = ({
   ),
   render: () =>
     getLabel({
-      baseLabel: bucket.key_as_string ?? bucket.key, // prefer key_as_string when available, because it contains a formatted date
+      baseLabel: bucket.key_as_string ?? firstNonNullValue(bucket.key) ?? '', // prefer key_as_string when available, because it contains a formatted date
       riskScore: bucket.maxRiskSubAggregation?.value,
     }),
   field: stackByField0,
-  value: bucket.key_as_string ?? bucket.key,
+  value: bucket.key_as_string ?? firstNonNullValue(bucket.key) ?? 0,
 });
 
 export const getLegendItemFromFlattenedBucket = ({
@@ -59,7 +60,7 @@ export const getLegendItemFromFlattenedBucket = ({
   stackByField1: string | undefined;
 }): LegendItem => ({
   color: getFillColor({
-    riskScore: maxRiskSubAggregations[key] ?? 0,
+    riskScore: maxRiskSubAggregations[firstNonNullValue(key) ?? ''] ?? 0,
     colorPalette,
   }),
   count: stackByField1DocCount,
@@ -106,7 +107,7 @@ export const getLegendMap = ({
   buckets.reduce<Record<string, LegendItem[]>>(
     (acc, bucket) => ({
       ...acc,
-      [bucket.key]: [
+      [firstNonNullValue(bucket.key) ?? '']: [
         getLegendItemFromRawBucket({
           bucket,
           colorPalette,
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
index 81f8498b39796..ca6d1f14a03f3 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
@@ -18,7 +18,7 @@ import { eventsDefaultModel } from './default_model';
 import { EntityType } from '@kbn/timelines-plugin/common';
 import { SourcererScopeName } from '../../store/sourcerer/model';
 import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
-import { useTimelineEvents } from '../../../timelines/containers';
+import { useTimelineEvents } from './use_timelines_events';
 import { getDefaultControlColumn } from '../../../timelines/components/timeline/body/control_columns';
 import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
 import { defaultCellActions } from '../../lib/cell_actions/default_cell_actions';
@@ -46,9 +46,7 @@ const originalKibanaLib = jest.requireActual('../../lib/kibana');
 const mockUseGetUserCasesPermissions = useGetUserCasesPermissions as jest.Mock;
 mockUseGetUserCasesPermissions.mockImplementation(originalKibanaLib.useGetUserCasesPermissions);
 
-jest.mock('../../../timelines/containers', () => ({
-  useTimelineEvents: jest.fn(),
-}));
+jest.mock('./use_timelines_events');
 
 jest.mock('../../utils/normalize_time_range');
 
@@ -57,12 +55,6 @@ jest.mock('../../../timelines/components/fields_browser', () => ({
   useFieldBrowserOptions: (props: UseFieldBrowserOptionsProps) => mockUseFieldBrowserOptions(props),
 }));
 
-jest.mock('./helpers', () => ({
-  getDefaultViewSelection: () => 'gridView',
-  resolverIsShowing: () => false,
-  getCombinedFilterQuery: () => undefined,
-}));
-
 const mockUseResizeObserver: jest.Mock = useResizeObserver as jest.Mock;
 jest.mock('use-resize-observer/polyfilled');
 mockUseResizeObserver.mockImplementation(() => ({}));
@@ -87,7 +79,12 @@ const testProps = {
   hasCrudPermissions: true,
 };
 describe('StatefulEventsViewer', () => {
-  (useTimelineEvents as jest.Mock).mockReturnValue([false, mockEventViewerResponse]);
+  beforeAll(() => {
+    (useTimelineEvents as jest.Mock).mockReturnValue([false, mockEventViewerResponse]);
+  });
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
 
   test('it renders the events viewer', () => {
     const wrapper = mount(
@@ -127,4 +124,25 @@ describe('StatefulEventsViewer', () => {
     unmount();
     expect(mockCloseEditor).toHaveBeenCalled();
   });
+
+  test('renders the RightTopMenu additional menu options when given additionalRightMenuOptions props', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <StatefulEventsViewer
+          {...testProps}
+          additionalRightMenuOptions={[<p data-test-subj="right-option" />]}
+        />
+      </TestProviders>
+    );
+    expect(getByTestId('right-option')).toBeInTheDocument();
+  });
+
+  test('does not render the RightTopMenu additional menu options when additionalRightMenuOptions props are not given', () => {
+    const { queryByTestId } = render(
+      <TestProviders>
+        <StatefulEventsViewer {...testProps} />
+      </TestProviders>
+    );
+    expect(queryByTestId('right-option')).not.toBeInTheDocument();
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
index 5c5054bd0fa56..c8a1d1131b1fb 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
@@ -96,6 +96,7 @@ export interface EventsViewerProps {
   unit?: (n: number) => string;
   indexNames?: string[];
   bulkActions: boolean | BulkActionsProp;
+  additionalRightMenuOptions?: React.ReactNode[];
 }
 
 /**
@@ -124,6 +125,7 @@ const StatefulEventsViewerComponent: React.FC<EventsViewerProps & PropsFromRedux
   bulkActions,
   setSelected,
   clearSelected,
+  additionalRightMenuOptions,
 }) => {
   const dispatch = useDispatch();
   const theme: EuiTheme = useContext(ThemeContext);
@@ -554,6 +556,7 @@ const StatefulEventsViewerComponent: React.FC<EventsViewerProps & PropsFromRedux
                     onViewChange={(selectedView) => setTableView(selectedView)}
                     additionalFilters={additionalFilters}
                     hasRightOffset={tableView === 'gridView' && nonDeletedEvents.length > 0}
+                    additionalMenuOptions={additionalRightMenuOptions}
                   />
 
                   {!hasAlerts && !loading && !graphOverlay && <EmptyTable height="short" />}
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/right_top_menu.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/right_top_menu.tsx
index d22c2cae61f8f..8294cc78d77ce 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/right_top_menu.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/right_top_menu.tsx
@@ -26,6 +26,7 @@ interface Props {
   onViewChange: (viewSelection: ViewSelection) => void;
   additionalFilters?: React.ReactNode;
   hasRightOffset?: boolean;
+  additionalMenuOptions?: React.ReactNode[];
 }
 
 export const RightTopMenu = ({
@@ -36,6 +37,7 @@ export const RightTopMenu = ({
   onViewChange,
   additionalFilters,
   hasRightOffset,
+  additionalMenuOptions = [],
 }: Props) => {
   const alignItems = tableView === 'gridView' ? 'baseline' : 'center';
   const justTitle = useMemo(() => <TitleText data-test-subj="title">{title}</TitleText>, [title]);
@@ -43,6 +45,19 @@ export const RightTopMenu = ({
   const tGridEventRenderedViewEnabled = useIsExperimentalFeatureEnabled(
     'tGridEventRenderedViewEnabled'
   );
+
+  const menuOptions = useMemo(
+    () =>
+      additionalMenuOptions.length
+        ? additionalMenuOptions.map((additionalMenuOption, i) => (
+            <UpdatedFlexItem grow={false} $show={!loading} key={i}>
+              {additionalMenuOption}
+            </UpdatedFlexItem>
+          ))
+        : null,
+    [additionalMenuOptions, loading]
+  );
+
   return (
     <UpdatedFlexGroup
       alignItems={alignItems}
@@ -63,6 +78,7 @@ export const RightTopMenu = ({
             <SummaryViewSelector viewSelected={tableView} onViewChange={onViewChange} />
           </UpdatedFlexItem>
         )}
+      {menuOptions}
     </UpdatedFlexGroup>
   );
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/filter_group/index.tsx b/x-pack/plugins/security_solution/public/common/components/filter_group/index.tsx
index e0ca253e1fe51..5e918b7c4d46d 100644
--- a/x-pack/plugins/security_solution/public/common/components/filter_group/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/filter_group/index.tsx
@@ -12,6 +12,7 @@ import type {
   OptionsListEmbeddableInput,
   ControlGroupContainer,
 } from '@kbn/controls-plugin/public';
+import { i18n } from '@kbn/i18n';
 import { LazyControlGroupRenderer } from '@kbn/controls-plugin/public';
 import type { PropsWithChildren } from 'react';
 import React, { createContext, useCallback, useEffect, useState, useRef, useMemo } from 'react';
@@ -344,6 +345,9 @@ const FilterGroupComponent = (props: PropsWithChildren<FilterGroupProps>) => {
             id="filter-group__context-menu"
             button={
               <EuiButtonIcon
+                aria-label={i18n.translate('xpack.securitySolution.filterGroup.groupMenuTitle', {
+                  defaultMessage: 'Filter group menu',
+                })}
                 display="empty"
                 size="s"
                 iconType="boxesHorizontal"
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/group_stats.test.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/group_stats.test.tsx
new file mode 100644
index 0000000000000..175a00ee7d2ac
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/group_stats.test.tsx
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, render } from '@testing-library/react';
+import { GroupStats } from './group_stats';
+import { TestProviders } from '../../../mock';
+
+const onTakeActionsOpen = jest.fn();
+const testProps = {
+  badgeMetricStats: [
+    { title: "IP's:", value: 1 },
+    { title: 'Rules:', value: 2 },
+    { title: 'Alerts:', value: 2, width: 50, color: '#a83632' },
+  ],
+  bucket: {
+    key: '9nk5mo2fby',
+    doc_count: 2,
+    hostsCountAggregation: { value: 1 },
+    ruleTags: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+    alertsCount: { value: 2 },
+    rulesCountAggregation: { value: 2 },
+    severitiesSubAggregation: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [{ key: 'low', doc_count: 2 }],
+    },
+    countSeveritySubAggregation: { value: 1 },
+    usersCountAggregation: { value: 1 },
+  },
+  onTakeActionsOpen,
+  customMetricStats: [
+    {
+      title: 'Severity',
+      customStatRenderer: <p data-test-subj="customMetricStat" />,
+    },
+  ],
+  takeActionItems: [
+    <p data-test-subj="takeActionItem-1" key={1} />,
+    <p data-test-subj="takeActionItem-2" key={2} />,
+  ],
+};
+describe('Group stats', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+  it('renders each stat item', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <GroupStats {...testProps} />
+      </TestProviders>
+    );
+    expect(getByTestId('group-stats')).toBeInTheDocument();
+    testProps.badgeMetricStats.forEach(({ title: stat }) => {
+      expect(getByTestId(`metric-${stat}`)).toBeInTheDocument();
+    });
+    testProps.customMetricStats.forEach(({ title: stat }) => {
+      expect(getByTestId(`customMetric-${stat}`)).toBeInTheDocument();
+    });
+  });
+  it('when onTakeActionsOpen is defined, call onTakeActionsOpen on popover click', () => {
+    const { getByTestId, queryByTestId } = render(
+      <TestProviders>
+        <GroupStats {...testProps} />
+      </TestProviders>
+    );
+    fireEvent.click(getByTestId('take-action-button'));
+    expect(onTakeActionsOpen).toHaveBeenCalled();
+    ['takeActionItem-1', 'takeActionItem-2'].forEach((actionItem) => {
+      expect(queryByTestId(actionItem)).not.toBeInTheDocument();
+    });
+  });
+  it('when onTakeActionsOpen is undefined, render take actions dropdown on popover click', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <GroupStats {...testProps} onTakeActionsOpen={undefined} />
+      </TestProviders>
+    );
+    fireEvent.click(getByTestId('take-action-button'));
+    ['takeActionItem-1', 'takeActionItem-2'].forEach((actionItem) => {
+      expect(getByTestId(actionItem)).toBeInTheDocument();
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/group_stats.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/group_stats.tsx
new file mode 100644
index 0000000000000..9611019434c86
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/group_stats.tsx
@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiBadge,
+  EuiButtonEmpty,
+  EuiContextMenuPanel,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiPopover,
+  EuiToolTip,
+} from '@elastic/eui';
+import React, { useCallback, useMemo, useState } from 'react';
+import type { BadgeMetric, CustomMetric } from '.';
+import { StatsContainer } from '../styles';
+import { TAKE_ACTION } from '../translations';
+import type { RawBucket } from '../types';
+
+interface GroupStatsProps {
+  badgeMetricStats?: BadgeMetric[];
+  bucket: RawBucket;
+  customMetricStats?: CustomMetric[];
+  onTakeActionsOpen?: () => void;
+  takeActionItems: JSX.Element[];
+}
+
+const GroupStatsComponent = ({
+  badgeMetricStats,
+  bucket,
+  customMetricStats,
+  onTakeActionsOpen,
+  takeActionItems,
+}: GroupStatsProps) => {
+  const [isPopoverOpen, setPopover] = useState(false);
+
+  const onButtonClick = useCallback(
+    () => (!isPopoverOpen && onTakeActionsOpen ? onTakeActionsOpen() : setPopover(!isPopoverOpen)),
+    [isPopoverOpen, onTakeActionsOpen]
+  );
+
+  const badgesComponents = useMemo(
+    () =>
+      badgeMetricStats?.map((metric) => (
+        <EuiFlexItem grow={false} key={metric.title}>
+          <StatsContainer data-test-subj={`metric-${metric.title}`}>
+            <>
+              {metric.title}
+              <EuiToolTip position="top" content={metric.value}>
+                <EuiBadge
+                  style={{ marginLeft: 10, width: metric.width ?? 35 }}
+                  color={metric.color ?? 'hollow'}
+                >
+                  {metric.value > 99 ? '99+' : metric.value.toString()}
+                </EuiBadge>
+              </EuiToolTip>
+            </>
+          </StatsContainer>
+        </EuiFlexItem>
+      )),
+    [badgeMetricStats]
+  );
+
+  const customComponents = useMemo(
+    () =>
+      customMetricStats?.map((customMetric) => (
+        <EuiFlexItem grow={false} key={customMetric.title}>
+          <StatsContainer data-test-subj={`customMetric-${customMetric.title}`}>
+            {customMetric.title}
+            {customMetric.customStatRenderer}
+          </StatsContainer>
+        </EuiFlexItem>
+      )),
+    [customMetricStats]
+  );
+
+  const popoverComponent = useMemo(
+    () => (
+      <EuiFlexItem grow={false}>
+        <EuiPopover
+          anchorPosition="downLeft"
+          button={
+            <EuiButtonEmpty
+              data-test-subj="take-action-button"
+              onClick={onButtonClick}
+              iconType="arrowDown"
+              iconSide="right"
+            >
+              {TAKE_ACTION}
+            </EuiButtonEmpty>
+          }
+          closePopover={() => setPopover(false)}
+          isOpen={isPopoverOpen}
+          panelPaddingSize="none"
+        >
+          <EuiContextMenuPanel items={takeActionItems} />
+        </EuiPopover>
+      </EuiFlexItem>
+    ),
+    [isPopoverOpen, onButtonClick, takeActionItems]
+  );
+
+  return (
+    <EuiFlexGroup
+      data-test-subj="group-stats"
+      key={`stats-${bucket.key[0]}`}
+      gutterSize="none"
+      alignItems="center"
+    >
+      {customComponents}
+      {badgesComponents}
+      {popoverComponent}
+    </EuiFlexGroup>
+  );
+};
+
+export const GroupStats = React.memo(GroupStatsComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/helpers.ts b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/helpers.ts
new file mode 100644
index 0000000000000..d496b8d79068a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/helpers.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const createGroupFilter = (selectedGroup: string, query?: string) =>
+  query && selectedGroup
+    ? [
+        {
+          meta: {
+            alias: null,
+            disabled: false,
+            key: selectedGroup,
+            negate: false,
+            params: {
+              query,
+            },
+            type: 'phrase',
+          },
+          query: {
+            match_phrase: {
+              [selectedGroup]: {
+                query,
+              },
+            },
+          },
+        },
+      ]
+    : [];
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/index.test.tsx
new file mode 100644
index 0000000000000..3da0aefb35895
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/index.test.tsx
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { fireEvent, render } from '@testing-library/react';
+import { GroupPanel } from '.';
+import { createGroupFilter } from './helpers';
+import React from 'react';
+
+const onToggleGroup = jest.fn();
+const renderChildComponent = jest.fn();
+const ruleName = 'Rule name';
+const ruleDesc = 'Rule description';
+
+const testProps = {
+  groupBucket: {
+    key: [ruleName, ruleDesc],
+    key_as_string: `${ruleName}|${ruleDesc}`,
+    doc_count: 98,
+    hostsCountAggregation: {
+      value: 5,
+    },
+    ruleTags: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [],
+    },
+    alertsCount: {
+      value: 98,
+    },
+    rulesCountAggregation: {
+      value: 1,
+    },
+    severitiesSubAggregation: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [
+        {
+          key: 'low',
+          doc_count: 98,
+        },
+      ],
+    },
+    countSeveritySubAggregation: {
+      value: 1,
+    },
+    usersCountAggregation: {
+      value: 98,
+    },
+  },
+  renderChildComponent,
+  selectedGroup: 'kibana.alert.rule.name',
+};
+
+describe('grouping accordion panel', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+  it('creates the query for the selectedGroup attribute', () => {
+    const { getByTestId } = render(<GroupPanel {...testProps} />);
+    expect(getByTestId('grouping-accordion')).toBeInTheDocument();
+    expect(renderChildComponent).toHaveBeenCalledWith(
+      createGroupFilter(testProps.selectedGroup, ruleName)
+    );
+  });
+  it('does not create query without a valid groupFieldValue', () => {
+    const { queryByTestId } = render(
+      <GroupPanel
+        {...testProps}
+        groupBucket={{
+          ...testProps.groupBucket,
+          // @ts-expect-error
+          key: null,
+        }}
+      />
+    );
+    expect(queryByTestId('grouping-accordion')).not.toBeInTheDocument();
+    expect(renderChildComponent).not.toHaveBeenCalled();
+  });
+  it('When onToggleGroup not defined, does nothing on toggle', () => {
+    const { container } = render(<GroupPanel {...testProps} />);
+    fireEvent.click(container.querySelector('[data-test-subj="grouping-accordion"] button')!);
+    expect(onToggleGroup).not.toHaveBeenCalled();
+  });
+  it('When onToggleGroup is defined, calls function with proper args on toggle', () => {
+    const { container } = render(<GroupPanel {...testProps} onToggleGroup={onToggleGroup} />);
+    fireEvent.click(container.querySelector('[data-test-subj="grouping-accordion"] button')!);
+    expect(onToggleGroup).toHaveBeenCalledWith(true, testProps.groupBucket);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/index.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/index.tsx
new file mode 100644
index 0000000000000..446b872f3d5f1
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/accordion_panel/index.tsx
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiAccordion, EuiFlexGroup, EuiFlexItem, EuiTitle } from '@elastic/eui';
+import type { Filter } from '@kbn/es-query';
+import React, { useCallback, useMemo } from 'react';
+import { firstNonNullValue } from '../../../../../common/endpoint/models/ecs_safety_helpers';
+import type { RawBucket } from '../types';
+import { createGroupFilter } from './helpers';
+
+export interface BadgeMetric {
+  title: string;
+  value: number;
+  color?: string;
+  width?: number;
+}
+
+export interface CustomMetric {
+  title: string;
+  customStatRenderer: JSX.Element;
+}
+
+interface GroupPanelProps {
+  customAccordionButtonClassName?: string;
+  customAccordionClassName?: string;
+  extraAction?: React.ReactNode;
+  forceState?: 'open' | 'closed';
+  groupBucket: RawBucket;
+  groupPanelRenderer?: JSX.Element;
+  level?: number;
+  onToggleGroup?: (isOpen: boolean, groupBucket: RawBucket) => void;
+  renderChildComponent: (groupFilter: Filter[]) => React.ReactNode;
+  selectedGroup: string;
+}
+
+const DefaultGroupPanelRenderer = ({ title }: { title: string }) => (
+  <div>
+    <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
+      <EuiFlexItem>
+        <EuiTitle size="xs" className="euiAccordionForm__title">
+          <h4 className="eui-textTruncate">{title}</h4>
+        </EuiTitle>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  </div>
+);
+
+const GroupPanelComponent = ({
+  customAccordionButtonClassName = 'groupingAccordionForm__button',
+  customAccordionClassName = 'groupingAccordionForm',
+  extraAction,
+  forceState,
+  groupBucket,
+  groupPanelRenderer,
+  level = 0,
+  onToggleGroup,
+  renderChildComponent,
+  selectedGroup,
+}: GroupPanelProps) => {
+  const groupFieldValue = useMemo(() => firstNonNullValue(groupBucket.key), [groupBucket.key]);
+
+  const groupFilters = useMemo(
+    () => createGroupFilter(selectedGroup, groupFieldValue),
+    [groupFieldValue, selectedGroup]
+  );
+
+  const onToggle = useCallback(
+    (isOpen) => {
+      if (onToggleGroup) {
+        onToggleGroup(isOpen, groupBucket);
+      }
+    },
+    [groupBucket, onToggleGroup]
+  );
+
+  return !groupFieldValue ? null : (
+    <EuiAccordion
+      buttonClassName={customAccordionButtonClassName}
+      buttonContent={
+        <div className="groupingPanelRenderer">
+          {groupPanelRenderer ?? <DefaultGroupPanelRenderer title={groupFieldValue} />}
+        </div>
+      }
+      className={customAccordionClassName}
+      data-test-subj="grouping-accordion"
+      extraAction={extraAction}
+      forceState={forceState}
+      id={`group${level}-${groupFieldValue}`}
+      onToggle={onToggle}
+      paddingSize="m"
+    >
+      {renderChildComponent(groupFilters)}
+    </EuiAccordion>
+  );
+};
+
+export const GroupPanel = React.memo(GroupPanelComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/container/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/container/index.test.tsx
new file mode 100644
index 0000000000000..f51b722af2dec
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/container/index.test.tsx
@@ -0,0 +1,180 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { fireEvent, render, within } from '@testing-library/react';
+import React from 'react';
+import { GroupingContainer } from '..';
+import { TestProviders } from '../../../mock';
+import { createGroupFilter } from '../accordion_panel/helpers';
+
+const renderChildComponent = jest.fn();
+const takeActionItems = jest.fn();
+const rule1Name = 'Rule 1 name';
+const rule1Desc = 'Rule 1 description';
+const rule2Name = 'Rule 2 name';
+const rule2Desc = 'Rule 2 description';
+
+const testProps = {
+  data: {
+    groupsNumber: {
+      value: 2,
+    },
+    stackByMultipleFields0: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [
+        {
+          key: [rule1Name, rule1Desc],
+          key_as_string: `${rule1Name}|${rule1Desc}`,
+          doc_count: 1,
+          hostsCountAggregation: {
+            value: 1,
+          },
+          ruleTags: {
+            doc_count_error_upper_bound: 0,
+            sum_other_doc_count: 0,
+            buckets: [],
+          },
+          alertsCount: {
+            value: 1,
+          },
+          severitiesSubAggregation: {
+            doc_count_error_upper_bound: 0,
+            sum_other_doc_count: 0,
+            buckets: [
+              {
+                key: 'low',
+                doc_count: 1,
+              },
+            ],
+          },
+          countSeveritySubAggregation: {
+            value: 1,
+          },
+          usersCountAggregation: {
+            value: 1,
+          },
+        },
+        {
+          key: [rule2Name, rule2Desc],
+          key_as_string: `${rule2Name}|${rule2Desc}`,
+          doc_count: 1,
+          hostsCountAggregation: {
+            value: 1,
+          },
+          ruleTags: {
+            doc_count_error_upper_bound: 0,
+            sum_other_doc_count: 0,
+            buckets: [],
+          },
+          alertsCount: {
+            value: 1,
+          },
+          severitiesSubAggregation: {
+            doc_count_error_upper_bound: 0,
+            sum_other_doc_count: 0,
+            buckets: [
+              {
+                key: 'low',
+                doc_count: 1,
+              },
+            ],
+          },
+          countSeveritySubAggregation: {
+            value: 1,
+          },
+          usersCountAggregation: {
+            value: 1,
+          },
+        },
+      ],
+    },
+    alertsCount: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [
+        {
+          key: 'siem',
+          doc_count: 2,
+        },
+      ],
+    },
+  },
+  pagination: {
+    pageIndex: 0,
+    pageSize: 25,
+    onChangeItemsPerPage: jest.fn(),
+    onChangePage: jest.fn(),
+  },
+  renderChildComponent,
+  selectedGroup: 'kibana.alert.rule.name',
+  takeActionItems,
+};
+
+describe('grouping container', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+  it('Renders group counts when groupsNumber > 0', () => {
+    const { getByTestId, getAllByTestId, queryByTestId } = render(
+      <TestProviders>
+        <GroupingContainer {...testProps} />
+      </TestProviders>
+    );
+    expect(getByTestId('alert-count').textContent).toBe('2 alerts');
+    expect(getByTestId('groups-count').textContent).toBe('2 groups');
+    expect(getAllByTestId('grouping-accordion').length).toBe(2);
+    expect(queryByTestId('empty-results-panel')).not.toBeInTheDocument();
+  });
+
+  it('Does not render group counts when groupsNumber = 0', () => {
+    const data = {
+      groupsNumber: {
+        value: 0,
+      },
+      stackByMultipleFields0: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [],
+      },
+      alertsCount: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [],
+      },
+    };
+    const { getByTestId, queryByTestId } = render(
+      <TestProviders>
+        <GroupingContainer {...testProps} data={data} />
+      </TestProviders>
+    );
+    expect(queryByTestId('alert-count')).not.toBeInTheDocument();
+    expect(queryByTestId('groups-count')).not.toBeInTheDocument();
+    expect(queryByTestId('grouping-accordion')).not.toBeInTheDocument();
+    expect(getByTestId('empty-results-panel')).toBeInTheDocument();
+  });
+
+  it('Opens one group at a time when each group is clicked', () => {
+    const { getAllByTestId } = render(
+      <TestProviders>
+        <GroupingContainer {...testProps} />
+      </TestProviders>
+    );
+    const group1 = within(getAllByTestId('grouping-accordion')[0]).getAllByRole('button')[0];
+    const group2 = within(getAllByTestId('grouping-accordion')[1]).getAllByRole('button')[0];
+    fireEvent.click(group1);
+    expect(renderChildComponent).toHaveBeenNthCalledWith(
+      1,
+      createGroupFilter(testProps.selectedGroup, rule1Name)
+    );
+    fireEvent.click(group2);
+    expect(renderChildComponent).toHaveBeenNthCalledWith(
+      2,
+      createGroupFilter(testProps.selectedGroup, rule2Name)
+    );
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/container/index.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/container/index.tsx
new file mode 100644
index 0000000000000..d23e220e3c567
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/container/index.tsx
@@ -0,0 +1,189 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTablePagination } from '@elastic/eui';
+import type { Filter } from '@kbn/es-query';
+import React, { useMemo, useState } from 'react';
+import { firstNonNullValue } from '../../../../../common/endpoint/models/ecs_safety_helpers';
+import { createGroupFilter } from '../accordion_panel/helpers';
+import { tableDefaults } from '../../../store/data_table/defaults';
+import { defaultUnit } from '../../toolbar/unit';
+import type { BadgeMetric, CustomMetric } from '../accordion_panel';
+import { GroupPanel } from '../accordion_panel';
+import { GroupStats } from '../accordion_panel/group_stats';
+import { EmptyGroupingComponent } from '../empty_resuls_panel';
+import { GroupingStyledContainer, GroupsUnitCount } from '../styles';
+import { GROUPS_UNIT } from '../translations';
+import type { GroupingTableAggregation, RawBucket } from '../types';
+
+interface GroupingContainerProps {
+  badgeMetricStats?: (fieldBucket: RawBucket) => BadgeMetric[];
+  customMetricStats?: (fieldBucket: RawBucket) => CustomMetric[];
+  data: GroupingTableAggregation &
+    Record<
+      string,
+      {
+        value?: number | null;
+        buckets?: Array<{
+          doc_count?: number | null;
+        }>;
+      }
+    >;
+  groupPanelRenderer?: (fieldBucket: RawBucket) => JSX.Element | undefined;
+  groupsSelector?: JSX.Element;
+  inspectButton?: JSX.Element;
+  pagination: {
+    pageIndex: number;
+    pageSize: number;
+    onChangeItemsPerPage: (itemsPerPageNumber: number) => void;
+    onChangePage: (pageNumber: number) => void;
+  };
+  renderChildComponent: (groupFilter: Filter[]) => React.ReactNode;
+  selectedGroup: string;
+  takeActionItems: (groupFilters: Filter[]) => JSX.Element[];
+  unit?: (n: number) => string;
+}
+
+const GroupingContainerComponent = ({
+  badgeMetricStats,
+  customMetricStats,
+  data,
+  groupPanelRenderer,
+  groupsSelector,
+  inspectButton,
+  pagination,
+  renderChildComponent,
+  selectedGroup,
+  takeActionItems,
+  unit = defaultUnit,
+}: GroupingContainerProps) => {
+  const [trigger, setTrigger] = useState<
+    Record<string, { state: 'open' | 'closed' | undefined; selectedBucket: RawBucket }>
+  >({});
+
+  const groupsNumber = data?.groupsNumber?.value ?? 0;
+  const unitCountText = useMemo(() => {
+    const count =
+      data?.alertsCount?.buckets && data?.alertsCount?.buckets.length > 0
+        ? data?.alertsCount?.buckets[0].doc_count ?? 0
+        : 0;
+    return `${count.toLocaleString()} ${unit && unit(count)}`;
+  }, [data?.alertsCount?.buckets, unit]);
+
+  const unitGroupsCountText = useMemo(
+    () => `${groupsNumber.toLocaleString()} ${GROUPS_UNIT(groupsNumber)}`,
+    [groupsNumber]
+  );
+
+  const groupPanels = useMemo(
+    () =>
+      data.stackByMultipleFields0?.buckets?.map((groupBucket) => {
+        const group = firstNonNullValue(groupBucket.key);
+        const groupKey = `group0-${group}`;
+
+        return (
+          <span key={groupKey}>
+            <GroupPanel
+              extraAction={
+                <GroupStats
+                  bucket={groupBucket}
+                  takeActionItems={takeActionItems(createGroupFilter(selectedGroup, group))}
+                  badgeMetricStats={badgeMetricStats && badgeMetricStats(groupBucket)}
+                  customMetricStats={customMetricStats && customMetricStats(groupBucket)}
+                />
+              }
+              forceState={(trigger[groupKey] && trigger[groupKey].state) ?? 'closed'}
+              groupBucket={groupBucket}
+              groupPanelRenderer={groupPanelRenderer && groupPanelRenderer(groupBucket)}
+              onToggleGroup={(isOpen) => {
+                setTrigger({
+                  // ...trigger, -> this change will keep only one group at a time expanded and one table displayed
+                  [groupKey]: {
+                    state: isOpen ? 'open' : 'closed',
+                    selectedBucket: groupBucket,
+                  },
+                });
+              }}
+              renderChildComponent={
+                trigger[groupKey] && trigger[groupKey].state === 'open'
+                  ? renderChildComponent
+                  : () => null
+              }
+              selectedGroup={selectedGroup}
+            />
+            <EuiSpacer size="s" />
+          </span>
+        );
+      }),
+    [
+      badgeMetricStats,
+      customMetricStats,
+      data.stackByMultipleFields0?.buckets,
+      groupPanelRenderer,
+      renderChildComponent,
+      selectedGroup,
+      takeActionItems,
+      trigger,
+    ]
+  );
+  const pageCount = useMemo(
+    () => (groupsNumber && pagination.pageSize ? Math.ceil(groupsNumber / pagination.pageSize) : 1),
+    [groupsNumber, pagination.pageSize]
+  );
+  return (
+    <>
+      <EuiFlexGroup
+        justifyContent="spaceBetween"
+        alignItems="center"
+        style={{ paddingBottom: 20, paddingTop: 20 }}
+      >
+        <EuiFlexItem grow={false}>
+          {groupsNumber > 0 ? (
+            <EuiFlexGroup gutterSize="none">
+              <EuiFlexItem grow={false}>
+                <GroupsUnitCount data-test-subj="alert-count">{unitCountText}</GroupsUnitCount>
+              </EuiFlexItem>
+              <EuiFlexItem>
+                <GroupsUnitCount data-test-subj="groups-count" style={{ borderRight: 'none' }}>
+                  {unitGroupsCountText}
+                </GroupsUnitCount>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          ) : null}
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiFlexGroup gutterSize="xs">
+            {inspectButton && <EuiFlexItem>{inspectButton}</EuiFlexItem>}
+            <EuiFlexItem>{groupsSelector}</EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <GroupingStyledContainer className="eui-xScroll">
+        {groupsNumber > 0 ? (
+          <>
+            {groupPanels}
+            <EuiSpacer size="m" />
+            <EuiTablePagination
+              activePage={pagination.pageIndex}
+              data-test-subj="grouping-table-pagination"
+              itemsPerPage={pagination.pageSize}
+              itemsPerPageOptions={tableDefaults.itemsPerPageOptions}
+              onChangeItemsPerPage={pagination.onChangeItemsPerPage}
+              onChangePage={pagination.onChangePage}
+              pageCount={pageCount}
+              showPerPageOptions
+            />
+          </>
+        ) : (
+          <EmptyGroupingComponent />
+        )}
+      </GroupingStyledContainer>
+    </>
+  );
+};
+
+export const GroupingContainer = React.memo(GroupingContainerComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/empty_resuls_panel.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/empty_resuls_panel.tsx
new file mode 100644
index 0000000000000..b51cd14e84bab
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/empty_resuls_panel.tsx
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiImage, EuiPanel, EuiText, EuiTitle } from '@elastic/eui';
+import React from 'react';
+import type { CoreStart } from '@kbn/core/public';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { useKibana } from '@kbn/kibana-react-plugin/public';
+
+const panelStyle = {
+  maxWidth: 500,
+};
+
+const heights = {
+  tall: 490,
+  short: 250,
+};
+
+export const EmptyGroupingComponent: React.FC<{ height?: keyof typeof heights }> = ({
+  height = 'tall',
+}) => {
+  const { http } = useKibana<CoreStart>().services;
+
+  return (
+    <EuiPanel color="subdued" data-test-subj="empty-results-panel">
+      <EuiFlexGroup style={{ height: heights[height] }} alignItems="center" justifyContent="center">
+        <EuiFlexItem grow={false}>
+          <EuiPanel hasBorder={true} style={panelStyle}>
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <EuiText size="s">
+                  <EuiTitle>
+                    <h3>
+                      <FormattedMessage
+                        id="xpack.securitySolution.grouping.empty.title"
+                        defaultMessage="No grouping results match your selected Group alerts field"
+                      />
+                    </h3>
+                  </EuiTitle>
+                  <p>
+                    <FormattedMessage
+                      id="xpack.securitySolution.grouping.empty.description"
+                      defaultMessage="Try searching over a longer period of time or modifying your Group alerts field"
+                    />
+                  </p>
+                </EuiText>
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiImage
+                  size="200"
+                  alt=""
+                  url={http.basePath.prepend(
+                    '/plugins/timelines/assets/illustration_product_no_results_magnifying_glass.svg'
+                  )}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiPanel>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiPanel>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/custom_field_panel.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/custom_field_panel.tsx
new file mode 100644
index 0000000000000..dc45df7d7bf2e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/custom_field_panel.tsx
@@ -0,0 +1,104 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EuiComboBoxOptionOption } from '@elastic/eui';
+import { EuiButton, EuiComboBox, EuiForm, EuiFormRow } from '@elastic/eui';
+import type { FieldSpec } from '@kbn/data-views-plugin/common';
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+
+export interface GroupByOptions {
+  text: string;
+  field: string;
+}
+
+interface Props {
+  onSubmit: (field: string) => void;
+  fields: FieldSpec[];
+  currentOptions: GroupByOptions[];
+}
+
+interface SelectedOption {
+  label: string;
+}
+
+const initialState = {
+  selectedOptions: [] as SelectedOption[],
+};
+
+type State = Readonly<typeof initialState>;
+
+export class CustomFieldPanel extends React.PureComponent<Props, State> {
+  public static displayName = 'CustomFieldPanel';
+  public readonly state: State = initialState;
+  public render() {
+    const { fields, currentOptions } = this.props;
+    const options = fields
+      .filter(
+        (f) =>
+          f.aggregatable &&
+          f.type === 'string' &&
+          !(currentOptions && currentOptions.some((o) => o.field === f.name))
+      )
+      .map<EuiComboBoxOptionOption>((f) => ({ label: f.name }));
+    const isSubmitDisabled = !this.state.selectedOptions.length;
+    return (
+      <div data-test-subj="custom-field-panel" style={{ padding: 16 }}>
+        <EuiForm>
+          <EuiFormRow
+            label={i18n.translate('xpack.securitySolution.groupsSelector.customGroupByFieldLabel', {
+              defaultMessage: 'Field',
+            })}
+            helpText={i18n.translate(
+              'xpack.securitySolution.groupsSelector.customGroupByHelpText',
+              {
+                defaultMessage: 'This is the field used for the terms aggregation',
+              }
+            )}
+            display="rowCompressed"
+            fullWidth
+          >
+            <EuiComboBox
+              data-test-subj="groupByCustomField"
+              placeholder={i18n.translate(
+                'xpack.securitySolution.groupsSelector.customGroupByDropdownPlacehoder',
+                {
+                  defaultMessage: 'Select one',
+                }
+              )}
+              singleSelection={{ asPlainText: true }}
+              selectedOptions={this.state.selectedOptions}
+              options={options as EuiComboBoxOptionOption[]}
+              onChange={this.handleFieldSelection}
+              fullWidth
+              isClearable={false}
+            />
+          </EuiFormRow>
+          <EuiButton
+            data-test-subj="groupByCustomFieldAddButton"
+            disabled={isSubmitDisabled}
+            type="submit"
+            size="s"
+            fill
+            onClick={this.handleSubmit}
+          >
+            {i18n.translate('xpack.securitySolution.selector.grouping.label.add', {
+              defaultMessage: 'Add',
+            })}
+          </EuiButton>
+        </EuiForm>
+      </div>
+    );
+  }
+  private handleSubmit = () => {
+    this.props.onSubmit(this.state.selectedOptions[0].label);
+  };
+
+  private handleFieldSelection = (selectedOptions: SelectedOption[]) => {
+    this.setState({ selectedOptions });
+  };
+}
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.test.tsx
new file mode 100644
index 0000000000000..a587206572f9d
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.test.tsx
@@ -0,0 +1,104 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { fireEvent, render } from '@testing-library/react';
+import { TestProviders } from '../../../mock';
+import { GroupsSelector } from '..';
+import React from 'react';
+
+const onGroupChange = jest.fn();
+const testProps = {
+  fields: [
+    {
+      name: 'kibana.alert.rule.name',
+      searchable: true,
+      type: 'string',
+      aggregatable: true,
+      esTypes: ['keyword'],
+    },
+    {
+      name: 'host.name',
+      searchable: true,
+      type: 'string',
+      aggregatable: true,
+      esTypes: ['keyword'],
+    },
+    {
+      name: 'user.name',
+      searchable: true,
+      type: 'string',
+      aggregatable: true,
+      esTypes: ['keyword'],
+    },
+    {
+      name: 'source.ip',
+      searchable: true,
+      type: 'ip',
+      aggregatable: true,
+      esTypes: ['ip'],
+    },
+  ],
+  groupSelected: 'kibana.alert.rule.name',
+  onGroupChange,
+  options: [
+    {
+      label: 'Rule name',
+      key: 'kibana.alert.rule.name',
+    },
+    {
+      label: 'User name',
+      key: 'user.name',
+    },
+    {
+      label: 'Host name',
+      key: 'host.name',
+    },
+    {
+      label: 'Source IP',
+      key: 'source.ip',
+    },
+  ],
+  title: 'Group alerts by',
+};
+describe('group selector', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+  it('Sets the selected group from the groupSelected prop', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <GroupsSelector {...testProps} />
+      </TestProviders>
+    );
+    expect(getByTestId('group-selector-dropdown').textContent).toBe('Group alerts by: Rule name');
+  });
+  it('Presents correct option when group selector dropdown is clicked', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <GroupsSelector {...testProps} />
+      </TestProviders>
+    );
+    fireEvent.click(getByTestId('group-selector-dropdown'));
+    [
+      ...testProps.options,
+      { key: 'none', label: 'None' },
+      { key: 'custom', label: 'Custom field' },
+    ].forEach((o) => {
+      expect(getByTestId(`panel-${o.key}`).textContent).toBe(o.label);
+    });
+  });
+  it('Presents fields dropdown when custom field option is selected', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <GroupsSelector {...testProps} />
+      </TestProviders>
+    );
+    fireEvent.click(getByTestId('group-selector-dropdown'));
+    fireEvent.click(getByTestId('panel-none'));
+    expect(onGroupChange).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.tsx
new file mode 100644
index 0000000000000..389645bf549da
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.tsx
@@ -0,0 +1,139 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  EuiContextMenuPanelDescriptor,
+  EuiContextMenuPanelItemDescriptor,
+} from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiBetaBadge, EuiPopover } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { useCallback, useMemo, useState } from 'react';
+import type { FieldSpec } from '@kbn/data-views-plugin/common';
+import { CustomFieldPanel } from './custom_field_panel';
+import { GROUP_BY, TECHNICAL_PREVIEW } from '../translations';
+import { StyledContextMenu, StyledEuiButtonEmpty } from '../styles';
+
+const none = i18n.translate('xpack.securitySolution.groupsSelector.noneGroupByOptionName', {
+  defaultMessage: 'None',
+});
+
+interface GroupSelectorProps {
+  fields: FieldSpec[];
+  groupSelected: string;
+  onGroupChange: (groupSelection: string) => void;
+  options: Array<{ key: string; label: string }>;
+  title?: string;
+}
+
+const GroupsSelectorComponent = ({
+  fields,
+  groupSelected = 'none',
+  onGroupChange,
+  options,
+  title = '',
+}: GroupSelectorProps) => {
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+  const panels: EuiContextMenuPanelDescriptor[] = useMemo(
+    () => [
+      {
+        id: 'firstPanel',
+        items: [
+          {
+            'data-test-subj': 'panel-none',
+            name: none,
+            icon: groupSelected === 'none' ? 'check' : 'empty',
+            onClick: () => onGroupChange('none'),
+          },
+          ...options.map<EuiContextMenuPanelItemDescriptor>((o) => ({
+            'data-test-subj': `panel-${o.key}`,
+            name: o.label,
+            onClick: () => onGroupChange(o.key),
+            icon: groupSelected === o.key ? 'check' : 'empty',
+          })),
+          {
+            'data-test-subj': `panel-custom`,
+            name: i18n.translate('xpack.securitySolution.groupsSelector.customGroupByOptionName', {
+              defaultMessage: 'Custom field',
+            }),
+            icon: 'empty',
+            panel: 'customPanel',
+          },
+        ],
+      },
+      {
+        id: 'customPanel',
+        title: i18n.translate('xpack.securitySolution.groupsSelector.customGroupByPanelTitle', {
+          defaultMessage: 'Group By Custom Field',
+        }),
+        width: 685,
+        content: (
+          <CustomFieldPanel
+            currentOptions={options.map((o) => ({ text: o.label, field: o.key }))}
+            onSubmit={(field: string) => {
+              onGroupChange(field);
+            }}
+            fields={fields}
+          />
+        ),
+      },
+    ],
+    [fields, groupSelected, onGroupChange, options]
+  );
+  const selectedOption = useMemo(
+    () => options.filter((groupOption) => groupOption.key === groupSelected),
+    [groupSelected, options]
+  );
+
+  const onButtonClick = useCallback(() => setIsPopoverOpen((currentVal) => !currentVal), []);
+  const closePopover = useCallback(() => setIsPopoverOpen(false), []);
+
+  const button = useMemo(
+    () => (
+      <StyledEuiButtonEmpty
+        data-test-subj="group-selector-dropdown"
+        flush="both"
+        iconSide="right"
+        iconSize="s"
+        iconType="arrowDown"
+        onClick={onButtonClick}
+        title={
+          groupSelected !== 'none' && selectedOption.length > 0 ? selectedOption[0].label : none
+        }
+        size="xs"
+      >
+        {`${title ?? GROUP_BY}: ${
+          groupSelected !== 'none' && selectedOption.length > 0 ? selectedOption[0].label : none
+        }`}
+      </StyledEuiButtonEmpty>
+    ),
+    [groupSelected, onButtonClick, selectedOption, title]
+  );
+
+  return (
+    <EuiFlexGroup gutterSize="xs">
+      <EuiFlexItem>
+        <EuiPopover
+          button={button}
+          closePopover={closePopover}
+          isOpen={isPopoverOpen}
+          panelPaddingSize="none"
+        >
+          <StyledContextMenu
+            data-test-subj="groupByContextMenu"
+            initialPanelId="firstPanel"
+            panels={panels}
+          />
+        </EuiPopover>
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <EuiBetaBadge label={TECHNICAL_PREVIEW} size="s" style={{ marginTop: 2 }} />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+export const GroupsSelector = React.memo(GroupsSelectorComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/index.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/index.tsx
new file mode 100644
index 0000000000000..46b3002ba5c54
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/index.tsx
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { NONE_GROUP_KEY } from './types';
+
+export * from './container';
+export * from './query';
+export * from './groups_selector';
+export * from './types';
+
+export const isNoneGroup = (groupKey: string) => groupKey === NONE_GROUP_KEY;
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/query/index.ts b/x-pack/plugins/security_solution/public/common/components/grouping/query/index.ts
new file mode 100644
index 0000000000000..8ea6a07f522f7
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/query/index.ts
@@ -0,0 +1,174 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isEmpty } from 'lodash/fp';
+import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+/** The maximum number of items to render */
+export const DEFAULT_STACK_BY_FIELD0_SIZE = 10;
+export const DEFAULT_STACK_BY_FIELD1_SIZE = 10;
+
+interface OptionalSubAggregation {
+  stackByMultipleFields1: {
+    multi_terms: {
+      terms: Array<{
+        field: string;
+      }>;
+    };
+  };
+}
+
+export interface CardinalitySubAggregation {
+  [category: string]: {
+    cardinality: {
+      field: string;
+    };
+  };
+}
+
+export interface TermsSubAggregation {
+  [category: string]: {
+    terms: {
+      field: string;
+      exclude?: string[];
+    };
+  };
+}
+
+export const getOptionalSubAggregation = ({
+  stackByMultipleFields1,
+  stackByMultipleFields1Size,
+  stackByMultipleFields1From = 0,
+  stackByMultipleFields1Sort,
+  additionalStatsAggregationsFields1,
+}: {
+  stackByMultipleFields1: string[] | undefined;
+  stackByMultipleFields1Size: number;
+  stackByMultipleFields1From?: number;
+  stackByMultipleFields1Sort?: Array<{ [category: string]: { order: 'asc' | 'desc' } }>;
+  additionalStatsAggregationsFields1: Array<CardinalitySubAggregation | TermsSubAggregation>;
+}): OptionalSubAggregation | {} =>
+  stackByMultipleFields1 != null && !isEmpty(stackByMultipleFields1)
+    ? {
+        stackByMultipleFields1: {
+          multi_terms: {
+            terms: stackByMultipleFields1.map((stackByMultipleField1) => ({
+              field: stackByMultipleField1,
+            })),
+          },
+          aggs: {
+            bucket_truncate: {
+              bucket_sort: {
+                sort: stackByMultipleFields1Sort,
+                from: stackByMultipleFields1From,
+                size: stackByMultipleFields1Size,
+              },
+            },
+            ...additionalStatsAggregationsFields1.reduce(
+              (aggObj, subAgg) => Object.assign(aggObj, subAgg),
+              {}
+            ),
+          },
+        },
+      }
+    : {};
+
+export const getGroupingQuery = ({
+  additionalFilters = [],
+  additionalAggregationsRoot,
+  additionalStatsAggregationsFields0,
+  additionalStatsAggregationsFields1,
+  from,
+  runtimeMappings,
+  stackByMultipleFields0,
+  stackByMultipleFields0Size = DEFAULT_STACK_BY_FIELD0_SIZE,
+  stackByMultipleFields0From,
+  stackByMultipleFields0Sort,
+  stackByMultipleFields1,
+  stackByMultipleFields1Size = DEFAULT_STACK_BY_FIELD1_SIZE,
+  stackByMultipleFields1From,
+  stackByMultipleFields1Sort,
+  to,
+}: {
+  additionalFilters: Array<{
+    bool: { filter: unknown[]; should: unknown[]; must_not: unknown[]; must: unknown[] };
+  }>;
+  from: string;
+  runtimeMappings?: MappingRuntimeFields;
+  additionalAggregationsRoot?: Array<CardinalitySubAggregation | TermsSubAggregation>;
+  stackByMultipleFields0: string[];
+  stackByMultipleFields0Size?: number;
+  stackByMultipleFields0From?: number;
+  stackByMultipleFields0Sort?: Array<{ [category: string]: { order: 'asc' | 'desc' } }>;
+  additionalStatsAggregationsFields0: Array<CardinalitySubAggregation | TermsSubAggregation>;
+  stackByMultipleFields1: string[] | undefined;
+  stackByMultipleFields1Size?: number;
+  stackByMultipleFields1From?: number;
+  stackByMultipleFields1Sort?: Array<{ [category: string]: { order: 'asc' | 'desc' } }>;
+  additionalStatsAggregationsFields1: Array<CardinalitySubAggregation | TermsSubAggregation>;
+  to: string;
+}) => ({
+  size: 0,
+  aggs: {
+    stackByMultipleFields0: {
+      ...(stackByMultipleFields0.length > 1
+        ? {
+            multi_terms: {
+              terms: stackByMultipleFields0.map((stackByMultipleField0) => ({
+                field: stackByMultipleField0,
+              })),
+            },
+          }
+        : {
+            terms: {
+              field: stackByMultipleFields0[0],
+              size: 10000,
+            },
+          }),
+      aggs: {
+        ...getOptionalSubAggregation({
+          stackByMultipleFields1,
+          stackByMultipleFields1Size,
+          stackByMultipleFields1From,
+          stackByMultipleFields1Sort,
+          additionalStatsAggregationsFields1,
+        }),
+        bucket_truncate: {
+          bucket_sort: {
+            sort: stackByMultipleFields0Sort,
+            from: stackByMultipleFields0From,
+            size: stackByMultipleFields0Size,
+          },
+        },
+        ...additionalStatsAggregationsFields0.reduce(
+          (aggObj, subAgg) => Object.assign(aggObj, subAgg),
+          {}
+        ),
+      },
+    },
+    ...(additionalAggregationsRoot
+      ? additionalAggregationsRoot.reduce((aggObj, subAgg) => Object.assign(aggObj, subAgg), {})
+      : {}),
+  },
+  query: {
+    bool: {
+      filter: [
+        ...additionalFilters,
+        {
+          range: {
+            '@timestamp': {
+              gte: from,
+              lte: to,
+            },
+          },
+        },
+      ],
+    },
+  },
+  runtime_mappings: runtimeMappings,
+  _source: false,
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/styles.tsx b/x-pack/plugins/security_solution/public/common/components/grouping/styles.tsx
new file mode 100644
index 0000000000000..80eb0183cb510
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/styles.tsx
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButtonEmpty, EuiContextMenu } from '@elastic/eui';
+import { euiStyled } from '@kbn/kibana-react-plugin/common';
+import styled from 'styled-components';
+
+export const GroupsUnitCount = styled.span`
+  font-size: ${({ theme }) => theme.eui.euiFontSizeXS};
+  font-weight: ${({ theme }) => theme.eui.euiFontWeightSemiBold};
+  border-right: ${({ theme }) => theme.eui.euiBorderThin};
+  margin-right: 16px;
+  padding-right: 16px;
+`;
+
+export const StatsContainer = styled.span`
+  font-size: ${({ theme }) => theme.eui.euiFontSizeXS};
+  font-weight: ${({ theme }) => theme.eui.euiFontWeightSemiBold};
+  border-right: ${({ theme }) => theme.eui.euiBorderThin};
+  margin-right: 16px;
+  padding-right: 16px;
+  .smallDot {
+    width: 3px !important;
+    display: inline-block;
+  }
+  .euiBadge__text {
+    text-align: center;
+    width: 100%;
+  }
+`;
+
+export const GroupingStyledContainer = styled.div`
+  .euiAccordion__childWrapper .euiAccordion__padding--m {
+    margin-left: 8px;
+    margin-right: 8px;
+    border-left: ${({ theme }) => theme.eui.euiBorderThin};
+    border-right: ${({ theme }) => theme.eui.euiBorderThin};
+    border-bottom: ${({ theme }) => theme.eui.euiBorderThin};
+    border-radius: 0 0 6px 6px;
+  }
+  .euiAccordion__triggerWrapper {
+    border-bottom: ${({ theme }) => theme.eui.euiBorderThin};
+    border-left: ${({ theme }) => theme.eui.euiBorderThin};
+    border-right: ${({ theme }) => theme.eui.euiBorderThin};
+    border-radius: 6px;
+    min-height: 78px;
+    padding-left: 16px;
+    padding-right: 16px;
+  }
+  .groupingAccordionForm {
+    border-top: ${({ theme }) => theme.eui.euiBorderThin};
+    border-bottom: none;
+    border-radius: 6px;
+    min-width: 1090px;
+  }
+  .groupingAccordionForm__button {
+    text-decoration: none !important;
+  }
+  .groupingPanelRenderer {
+    display: table;
+    table-layout: fixed;
+    width: 100%;
+    padding-right: 32px;
+  }
+`;
+
+export const StyledContextMenu = euiStyled(EuiContextMenu)`
+  width: 250px;
+  & .euiContextMenuItem__text {
+    overflow: hidden;
+    text-overflow: ellipsis;
+  }
+  .euiContextMenuItem {
+    border-bottom: ${({ theme }) => theme.eui.euiBorderThin};
+  }
+  .euiContextMenuItem:last-child {
+    border: none;
+  }
+`;
+
+export const StyledEuiButtonEmpty = euiStyled(EuiButtonEmpty)`
+  font-weight: 'normal';
+
+  .euiButtonEmpty__text {
+    max-width: 300px;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+  }
+`;
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/translations.ts b/x-pack/plugins/security_solution/public/common/components/grouping/translations.ts
new file mode 100644
index 0000000000000..2e73e95b80de5
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/translations.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const GROUPS_UNIT = (totalCount: number) =>
+  i18n.translate('xpack.securitySolution.grouping.total.unit', {
+    values: { totalCount },
+    defaultMessage: `{totalCount, plural, =1 {group} other {groups}}`,
+  });
+
+export const TAKE_ACTION = i18n.translate(
+  'xpack.securitySolution.grouping.additionalActions.takeAction',
+  {
+    defaultMessage: 'Take actions',
+  }
+);
+
+export const TECHNICAL_PREVIEW = i18n.translate(
+  'xpack.securitySolution.grouping.technicalPreviewLabel',
+  {
+    defaultMessage: 'Technical Preview',
+  }
+);
+
+export const GROUP_BY = i18n.translate('xpack.securitySolution.selector.grouping.label', {
+  defaultMessage: 'Group by field',
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/grouping/types.ts b/x-pack/plugins/security_solution/public/common/components/grouping/types.ts
new file mode 100644
index 0000000000000..b4685c75cab29
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/grouping/types.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { GenericBuckets } from '../../../../common/search_strategy/common';
+
+export const DEFAULT_GROUPING_QUERY_ID = 'defaultGroupingQuery';
+
+export const NONE_GROUP_KEY = 'none';
+
+export type RawBucket = GenericBuckets & {
+  alertsCount?: {
+    value?: number | null; // Elasticsearch returns `null` when a sub-aggregation cannot be computed
+  };
+  severitiesSubAggregation?: {
+    buckets?: GenericBuckets[];
+  };
+  countSeveritySubAggregation?: {
+    value?: number | null; // Elasticsearch returns `null` when a sub-aggregation cannot be computed
+  };
+  usersCountAggregation?: {
+    value?: number | null; // Elasticsearch returns `null` when a sub-aggregation cannot be computed
+  };
+  hostsCountAggregation?: {
+    value?: number | null; // Elasticsearch returns `null` when a sub-aggregation cannot be computed
+  };
+  rulesCountAggregation?: {
+    value?: number | null; // Elasticsearch returns `null` when a sub-aggregation cannot be computed
+  };
+  ruleTags?: {
+    doc_count_error_upper_bound?: number;
+    sum_other_doc_count?: number;
+    buckets?: GenericBuckets[];
+  };
+  stackByMultipleFields1?: {
+    buckets?: GenericBuckets[];
+    doc_count_error_upper_bound?: number;
+    sum_other_doc_count?: number;
+  };
+};
+
+/** Defines the shape of the aggregation returned by Elasticsearch */
+export interface GroupingTableAggregation {
+  stackByMultipleFields0?: {
+    buckets?: RawBucket[];
+  };
+  groupsCount0?: {
+    value?: number | null;
+  };
+}
+
+export type GroupingFieldTotalAggregation = Record<
+  string,
+  { value?: number | null; buckets?: Array<{ doc_count?: number | null }> }
+>;
+
+export type FlattenedBucket = Pick<
+  RawBucket,
+  'doc_count' | 'key' | 'key_as_string' | 'alertsCount'
+> & {
+  stackByMultipleFields1Key?: string;
+  stackByMultipleFields1DocCount?: number;
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/landing_cards/index.tsx b/x-pack/plugins/security_solution/public/common/components/landing_cards/index.tsx
index 463f98feb2050..d145598faab9e 100644
--- a/x-pack/plugins/security_solution/public/common/components/landing_cards/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/landing_cards/index.tsx
@@ -94,7 +94,6 @@ export const LandingCards = memo(() => {
           <EuiFlexItem>
             <iframe
               allowFullScreen
-              allowTransparency
               className="vidyard_iframe"
               frameBorder="0"
               height="100%"
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx
index f9638456e6814..0b6a0f5f5e799 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx
@@ -853,6 +853,8 @@ const RuleDetailsPageComponent: React.FC<DetectionEngineComponentProps> = ({
                         }
                         onRuleChange={refreshRule}
                         to={to}
+                        signalIndexName={signalIndexName}
+                        runtimeMappings={runtimeMappings}
                       />
                     )}
                   </>
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/helpers.tsx
index 8c0cc73bac5a4..db84fc4b775bd 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/helpers.tsx
@@ -85,6 +85,8 @@ export const getAlertsHistogramQuery = (
       },
     },
     runtime_mappings: runtimeMappings,
+    _source: false,
+    size: 0,
   };
 };
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_panel_renderers.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_panel_renderers.test.tsx
new file mode 100644
index 0000000000000..faccd845ce186
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_panel_renderers.test.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { shallow } from 'enzyme';
+
+import { getSelectedGroupButtonContent } from '.';
+
+describe('getSelectedGroupButtonContent', () => {
+  it('renders correctly when the field renderer exists', () => {
+    const wrapperRuleName = shallow(
+      getSelectedGroupButtonContent('kibana.alert.rule.name', {
+        key: ['Rule name test', 'Some description'],
+        doc_count: 10,
+      })!
+    );
+
+    expect(wrapperRuleName.find('[data-test-subj="rule-name-group-renderer"]')).toBeTruthy();
+    const wrapperHostName = shallow(
+      getSelectedGroupButtonContent('host.name', {
+        key: 'Host',
+        doc_count: 2,
+      })!
+    );
+
+    expect(wrapperHostName.find('[data-test-subj="host-name-group-renderer"]')).toBeTruthy();
+    const wrapperUserName = shallow(
+      getSelectedGroupButtonContent('user.name', {
+        key: 'User test',
+        doc_count: 1,
+      })!
+    );
+
+    expect(wrapperUserName.find('[data-test-subj="host-name-group-renderer"]')).toBeTruthy();
+    const wrapperSourceIp = shallow(
+      getSelectedGroupButtonContent('source.ip', {
+        key: 'sourceIp',
+        doc_count: 23,
+      })!
+    );
+
+    expect(wrapperSourceIp.find('[data-test-subj="source-ip-group-renderer"]')).toBeTruthy();
+  });
+
+  it('returns undefined when the renderer does not exist', () => {
+    const wrapper = getSelectedGroupButtonContent('process.name', {
+      key: 'process',
+      doc_count: 10,
+    });
+
+    expect(wrapper).toBeUndefined();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_panel_renderers.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_panel_renderers.tsx
new file mode 100644
index 0000000000000..ce400a4373b39
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_panel_renderers.tsx
@@ -0,0 +1,150 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiAvatar,
+  EuiBadge,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiText,
+  EuiTextColor,
+  EuiTitle,
+} from '@elastic/eui';
+import { euiThemeVars } from '@kbn/ui-theme';
+import { isArray } from 'lodash/fp';
+import React from 'react';
+import { firstNonNullValue } from '../../../../../common/endpoint/models/ecs_safety_helpers';
+import type { GenericBuckets } from '../../../../../common/search_strategy';
+import type { RawBucket } from '../../../../common/components/grouping';
+import { PopoverItems } from '../../../../common/components/popover_items';
+import { COLUMN_TAGS } from '../../../pages/detection_engine/rules/translations';
+
+export const getSelectedGroupButtonContent = (selectedGroup: string, bucket: RawBucket) => {
+  switch (selectedGroup) {
+    case 'kibana.alert.rule.name':
+      return isArray(bucket.key) ? (
+        <RuleNameGroupContent
+          ruleName={bucket.key[0]}
+          ruleDescription={bucket.key[1]}
+          tags={bucket.ruleTags?.buckets}
+        />
+      ) : undefined;
+    case 'host.name':
+      return <HostNameGroupContent hostName={bucket.key} />;
+    case 'user.name':
+      return <UserNameGroupContent userName={bucket.key} />;
+    case 'source.ip':
+      return <SourceIpGroupContent sourceIp={bucket.key} />;
+  }
+};
+
+const RuleNameGroupContent = React.memo<{
+  ruleName: string;
+  ruleDescription: string;
+  tags?: GenericBuckets[] | undefined;
+}>(({ ruleName, ruleDescription, tags }) => {
+  const renderItem = (tag: string, i: number) => (
+    <EuiBadge color="hollow" key={`${tag}-${i}`} data-test-subj="tag">
+      {tag}
+    </EuiBadge>
+  );
+  return (
+    <>
+      <EuiFlexGroup data-test-subj="rule-name-group-renderer" gutterSize="m" alignItems="center">
+        <EuiFlexItem grow={false} style={{ display: 'table', tableLayout: 'fixed', width: '100%' }}>
+          <EuiTitle size="xs">
+            <h5 className="eui-textTruncate">{ruleName.trim()}</h5>
+          </EuiTitle>
+        </EuiFlexItem>
+        {tags && tags.length > 0 ? (
+          <EuiFlexItem onClick={(e) => e.stopPropagation()} grow={false}>
+            <PopoverItems
+              items={tags.map((tag) => tag.key.toString())}
+              popoverTitle={COLUMN_TAGS}
+              popoverButtonTitle={tags.length.toString()}
+              popoverButtonIcon="tag"
+              dataTestPrefix="tags"
+              renderItem={renderItem}
+            />
+          </EuiFlexItem>
+        ) : null}
+      </EuiFlexGroup>
+
+      <EuiText size="s">
+        <p className="eui-textTruncate">
+          <EuiTextColor color="subdued">{ruleDescription}</EuiTextColor>
+        </p>
+      </EuiText>
+    </>
+  );
+});
+RuleNameGroupContent.displayName = 'RuleNameGroup';
+
+const HostNameGroupContent = React.memo<{ hostName: string | string[] }>(({ hostName }) => (
+  <EuiFlexGroup
+    data-test-subj="host-name-group-renderer"
+    gutterSize="s"
+    alignItems="center"
+    justifyContent="center"
+  >
+    <EuiFlexItem
+      grow={false}
+      style={{
+        backgroundColor: euiThemeVars.euiColorVis1_behindText,
+        borderRadius: '50%',
+      }}
+    >
+      <EuiIcon type="database" size="l" style={{ padding: 4 }} />
+    </EuiFlexItem>
+
+    <EuiFlexItem>
+      <EuiTitle size="xs">
+        <h5>{hostName}</h5>
+      </EuiTitle>
+    </EuiFlexItem>
+  </EuiFlexGroup>
+));
+HostNameGroupContent.displayName = 'HostNameGroupContent';
+
+const UserNameGroupContent = React.memo<{ userName: string | string[] }>(({ userName }) => {
+  const userNameValue = firstNonNullValue(userName) ?? '-';
+  return (
+    <EuiFlexGroup data-test-subj="user-name-group-renderer" gutterSize="s" alignItems="center">
+      <EuiFlexItem grow={false}>
+        <EuiAvatar name={userNameValue} color={euiThemeVars.euiColorVis0} />
+      </EuiFlexItem>
+
+      <EuiFlexItem>
+        <EuiTitle size="xs">
+          <h5>{userName}</h5>
+        </EuiTitle>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+});
+UserNameGroupContent.displayName = 'UserNameGroupContent';
+
+const SourceIpGroupContent = React.memo<{ sourceIp: string | string[] }>(({ sourceIp }) => (
+  <EuiFlexGroup data-test-subj="source-ip-group-renderer" gutterSize="s" alignItems="center">
+    <EuiFlexItem
+      grow={false}
+      style={{
+        backgroundColor: euiThemeVars.euiColorVis3_behindText,
+        borderRadius: '50%',
+      }}
+    >
+      <EuiIcon style={{ padding: 4 }} type="ip" size="l" />
+    </EuiFlexItem>
+    <EuiFlexItem>
+      <EuiTitle size="xs">
+        <h5>{sourceIp}</h5>
+      </EuiTitle>
+    </EuiFlexItem>
+  </EuiFlexGroup>
+));
+SourceIpGroupContent.displayName = 'SourceIpGroupContent';
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_stats.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_stats.test.tsx
new file mode 100644
index 0000000000000..33b079cb88bc8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_stats.test.tsx
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getSelectedGroupBadgeMetrics } from '.';
+
+describe('getSelectedGroupBadgeMetrics', () => {
+  it('returns array of badges which roccespondes to the field name', () => {
+    const badgesRuleName = getSelectedGroupBadgeMetrics('kibana.alert.rule.name', {
+      key: ['Rule name test', 'Some description'],
+      usersCountAggregation: {
+        value: 10,
+      },
+      doc_count: 10,
+    });
+
+    expect(
+      badgesRuleName.find((badge) => badge.title === 'Users:' && badge.value === 10)
+    ).toBeTruthy();
+    expect(
+      badgesRuleName.find((badge) => badge.title === 'Alerts:' && badge.value === 10)
+    ).toBeTruthy();
+
+    const badgesHostName = getSelectedGroupBadgeMetrics('host.name', {
+      key: 'Host',
+      rulesCountAggregation: {
+        value: 3,
+      },
+      doc_count: 2,
+    });
+
+    expect(
+      badgesHostName.find((badge) => badge.title === 'Rules:' && badge.value === 3)
+    ).toBeTruthy();
+
+    const badgesUserName = getSelectedGroupBadgeMetrics('user.name', {
+      key: 'User test',
+      hostsCountAggregation: {
+        value: 1,
+      },
+      doc_count: 1,
+    });
+    expect(
+      badgesUserName.find((badge) => badge.title === `IP's:` && badge.value === 1)
+    ).toBeTruthy();
+  });
+
+  it('returns default badges if the field specific does not exist', () => {
+    const badges = getSelectedGroupBadgeMetrics('process.name', {
+      key: 'process',
+      rulesCountAggregation: {
+        value: 3,
+      },
+      doc_count: 10,
+    });
+
+    expect(badges.length).toBe(2);
+    expect(badges.find((badge) => badge.title === 'Rules:' && badge.value === 3)).toBeTruthy();
+    expect(badges.find((badge) => badge.title === 'Alerts:' && badge.value === 10)).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_stats.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_stats.tsx
new file mode 100644
index 0000000000000..51cbfc5d51553
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_stats.tsx
@@ -0,0 +1,180 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiIcon } from '@elastic/eui';
+import React from 'react';
+import type {
+  BadgeMetric,
+  CustomMetric,
+} from '../../../../common/components/grouping/accordion_panel';
+import type { RawBucket } from '../../../../common/components/grouping';
+import * as i18n from '../translations';
+
+const getSingleGroupSeverity = (severity?: string) => {
+  switch (severity) {
+    case 'low':
+      return (
+        <>
+          <EuiIcon type="dot" color="#54b399" />
+          {i18n.STATS_GROUP_SEVERITY_LOW}
+        </>
+      );
+    case 'medium':
+      return (
+        <>
+          <EuiIcon type="dot" color="#d6bf57" />
+          {i18n.STATS_GROUP_SEVERITY_MEDIUM}
+        </>
+      );
+    case 'high':
+      return (
+        <>
+          <EuiIcon type="dot" color="#da8b45" />
+          {i18n.STATS_GROUP_SEVERITY_HIGH}
+        </>
+      );
+    case 'critical':
+      return (
+        <>
+          <EuiIcon type="dot" color="#e7664c" />
+          {i18n.STATS_GROUP_SEVERITY_CRITICAL}
+        </>
+      );
+  }
+  return null;
+};
+
+const multiSeverity = (
+  <>
+    <span className="smallDot">
+      <EuiIcon type="dot" color="#54b399" />
+    </span>
+    <span className="smallDot">
+      <EuiIcon type="dot" color="#d6bf57" />
+    </span>
+    <span className="smallDot">
+      <EuiIcon type="dot" color="#da8b45" />
+    </span>
+
+    <span>
+      <EuiIcon type="dot" color="#e7664c" />
+    </span>
+    {i18n.STATS_GROUP_SEVERITY_MULTI}
+  </>
+);
+
+export const getSelectedGroupBadgeMetrics = (
+  selectedGroup: string,
+  bucket: RawBucket
+): BadgeMetric[] => {
+  const defaultBadges = [
+    {
+      title: i18n.STATS_GROUP_ALERTS,
+      value: bucket.doc_count,
+      width: 50,
+      color: '#a83632',
+    },
+  ];
+  switch (selectedGroup) {
+    case 'kibana.alert.rule.name':
+      return [
+        {
+          title: i18n.STATS_GROUP_USERS,
+          value: bucket.usersCountAggregation?.value ?? 0,
+        },
+        {
+          title: i18n.STATS_GROUP_HOSTS,
+          value: bucket.hostsCountAggregation?.value ?? 0,
+        },
+        ...defaultBadges,
+      ];
+    case 'host.name':
+      return [
+        {
+          title: i18n.STATS_GROUP_USERS,
+          value: bucket.usersCountAggregation?.value ?? 0,
+        },
+        {
+          title: i18n.STATS_GROUP_RULES,
+          value: bucket.rulesCountAggregation?.value ?? 0,
+        },
+        ...defaultBadges,
+      ];
+    case 'user.name':
+      return [
+        {
+          title: i18n.STATS_GROUP_IPS,
+          value: bucket.hostsCountAggregation?.value ?? 0,
+        },
+        {
+          title: i18n.STATS_GROUP_RULES,
+          value: bucket.rulesCountAggregation?.value ?? 0,
+        },
+        ...defaultBadges,
+      ];
+    case 'source.ip':
+      return [
+        {
+          title: i18n.STATS_GROUP_IPS,
+          value: bucket.hostsCountAggregation?.value ?? 0,
+        },
+        {
+          title: i18n.STATS_GROUP_RULES,
+          value: bucket.rulesCountAggregation?.value ?? 0,
+        },
+        ...defaultBadges,
+      ];
+  }
+  return [
+    {
+      title: i18n.STATS_GROUP_RULES,
+      value: bucket.rulesCountAggregation?.value ?? 0,
+    },
+    ...defaultBadges,
+  ];
+};
+
+export const getSelectedGroupCustomMetrics = (
+  selectedGroup: string,
+  bucket: RawBucket
+): CustomMetric[] => {
+  const singleSeverityComponent =
+    bucket.severitiesSubAggregation?.buckets && bucket.severitiesSubAggregation?.buckets?.length
+      ? getSingleGroupSeverity(bucket.severitiesSubAggregation?.buckets[0].key.toString())
+      : null;
+  const severityComponent =
+    bucket.countSeveritySubAggregation?.value && bucket.countSeveritySubAggregation?.value > 1
+      ? multiSeverity
+      : singleSeverityComponent;
+  if (!severityComponent) {
+    return [];
+  }
+  switch (selectedGroup) {
+    case 'kibana.alert.rule.name':
+      return [
+        {
+          title: i18n.STATS_GROUP_SEVERITY,
+          customStatRenderer: severityComponent,
+        },
+      ];
+    case 'host.name':
+      return [
+        {
+          title: i18n.STATS_GROUP_SEVERITY,
+          customStatRenderer: severityComponent,
+        },
+      ];
+    case 'user.name':
+      return [
+        {
+          title: i18n.STATS_GROUP_SEVERITY,
+          customStatRenderer: severityComponent,
+        },
+      ];
+  }
+  return [];
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.test.tsx
new file mode 100644
index 0000000000000..4bd1d0b6005f4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.test.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TestProviders } from '@kbn/timelines-plugin/public/mock';
+import { act, renderHook } from '@testing-library/react-hooks';
+import React from 'react';
+import { useGroupTakeActionsItems } from '.';
+
+jest.mock('../../../../common/store', () => ({
+  inputsSelectors: {
+    globalQuery: jest.fn(),
+  },
+  inputsModel: {},
+}));
+
+jest.mock('../../../../common/hooks/use_selector', () => ({
+  useDeepEqualSelector: () => jest.fn(),
+}));
+
+describe('useGroupTakeActionsItems', () => {
+  const wrapperContainer: React.FC<{ children?: React.ReactNode }> = ({ children }) => (
+    <TestProviders>{children}</TestProviders>
+  );
+  it('returns array take actions items available for alerts table if showAlertStatusActions is true', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook(
+        () =>
+          useGroupTakeActionsItems({
+            indexName: '.alerts-security.alerts-default',
+            showAlertStatusActions: true,
+          }),
+        {
+          wrapper: wrapperContainer,
+        }
+      );
+      await waitForNextUpdate();
+      expect(result.current().length).toEqual(3);
+    });
+  });
+
+  it('returns  empty array of take actions items available for alerts table if showAlertStatusActions is false', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook(
+        () =>
+          useGroupTakeActionsItems({
+            indexName: '.alerts-security.alerts-default',
+            showAlertStatusActions: false,
+          }),
+        {
+          wrapper: wrapperContainer,
+        }
+      );
+      await waitForNextUpdate();
+      expect(result.current().length).toEqual(0);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.tsx
new file mode 100644
index 0000000000000..5829ba18cd431
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.tsx
@@ -0,0 +1,188 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo, useCallback } from 'react';
+import { EuiContextMenuItem } from '@elastic/eui';
+import type { inputsModel } from '../../../../common/store';
+import { inputsSelectors } from '../../../../common/store';
+import { useStartTransaction } from '../../../../common/lib/apm/use_start_transaction';
+import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
+import type { AlertWorkflowStatus } from '../../../../common/types';
+import { APM_USER_INTERACTIONS } from '../../../../common/lib/apm/constants';
+import { useUpdateAlertsStatus } from '../../../../common/components/toolbar/bulk_actions/use_update_alerts';
+import {
+  BULK_ACTION_ACKNOWLEDGED_SELECTED,
+  BULK_ACTION_CLOSE_SELECTED,
+  BULK_ACTION_OPEN_SELECTED,
+} from '../../../../common/components/toolbar/bulk_actions/translations';
+import {
+  UPDATE_ALERT_STATUS_FAILED,
+  UPDATE_ALERT_STATUS_FAILED_DETAILED,
+} from '../../../../common/translations';
+import { FILTER_ACKNOWLEDGED, FILTER_CLOSED, FILTER_OPEN } from '../../../../../common/types';
+import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
+import * as i18n from '../translations';
+
+export interface TakeActionsProps {
+  currentStatus?: AlertWorkflowStatus;
+  indexName: string;
+  showAlertStatusActions?: boolean;
+}
+
+export const useGroupTakeActionsItems = ({
+  currentStatus,
+  indexName,
+  showAlertStatusActions = true,
+}: TakeActionsProps) => {
+  const { updateAlertStatus } = useUpdateAlertsStatus();
+  const { addSuccess, addError, addWarning } = useAppToasts();
+  const { startTransaction } = useStartTransaction();
+  const getGlobalQuerySelector = inputsSelectors.globalQuery();
+  const globalQueries = useDeepEqualSelector(getGlobalQuerySelector);
+  const refetchQuery = useCallback(() => {
+    globalQueries.forEach((q) => q.refetch && (q.refetch as inputsModel.Refetch)());
+  }, [globalQueries]);
+
+  const onUpdateSuccess = useCallback(
+    (updated: number, conflicts: number, newStatus: AlertWorkflowStatus) => {
+      refetchQuery();
+    },
+    [refetchQuery]
+  );
+
+  const onUpdateFailure = useCallback(
+    (newStatus: AlertWorkflowStatus, error: Error) => {
+      refetchQuery();
+    },
+    [refetchQuery]
+  );
+
+  const onAlertStatusUpdateSuccess = useCallback(
+    (updated: number, conflicts: number, newStatus: AlertWorkflowStatus) => {
+      if (conflicts > 0) {
+        // Partial failure
+        addWarning({
+          title: UPDATE_ALERT_STATUS_FAILED(conflicts),
+          text: UPDATE_ALERT_STATUS_FAILED_DETAILED(updated, conflicts),
+        });
+      } else {
+        let title: string;
+        switch (newStatus) {
+          case 'closed':
+            title = i18n.CLOSED_ALERT_SUCCESS_TOAST(updated);
+            break;
+          case 'open':
+            title = i18n.OPENED_ALERT_SUCCESS_TOAST(updated);
+            break;
+          case 'acknowledged':
+            title = i18n.ACKNOWLEDGED_ALERT_SUCCESS_TOAST(updated);
+        }
+        addSuccess({ title });
+      }
+      if (onUpdateSuccess) {
+        onUpdateSuccess(updated, conflicts, newStatus);
+      }
+    },
+    [addSuccess, addWarning, onUpdateSuccess]
+  );
+
+  const onAlertStatusUpdateFailure = useCallback(
+    (newStatus: AlertWorkflowStatus, error: Error) => {
+      let title: string;
+      switch (newStatus) {
+        case 'closed':
+          title = i18n.CLOSED_ALERT_FAILED_TOAST;
+          break;
+        case 'open':
+          title = i18n.OPENED_ALERT_FAILED_TOAST;
+          break;
+        case 'acknowledged':
+          title = i18n.ACKNOWLEDGED_ALERT_FAILED_TOAST;
+      }
+      addError(error.message, { title });
+      if (onUpdateFailure) {
+        onUpdateFailure(newStatus, error);
+      }
+    },
+    [addError, onUpdateFailure]
+  );
+
+  const onClickUpdate = useCallback(
+    async (status: AlertWorkflowStatus, query?: string) => {
+      if (query) {
+        startTransaction({ name: APM_USER_INTERACTIONS.BULK_QUERY_STATUS_UPDATE });
+      } else {
+        startTransaction({ name: APM_USER_INTERACTIONS.STATUS_UPDATE });
+      }
+
+      try {
+        const response = await updateAlertStatus({
+          index: indexName,
+          status,
+          query: query ? JSON.parse(query) : {},
+        });
+
+        onAlertStatusUpdateSuccess(response.updated ?? 0, response.version_conflicts ?? 0, status);
+      } catch (error) {
+        onAlertStatusUpdateFailure(status, error);
+      }
+    },
+    [
+      updateAlertStatus,
+      indexName,
+      onAlertStatusUpdateSuccess,
+      onAlertStatusUpdateFailure,
+      startTransaction,
+    ]
+  );
+
+  const items = useMemo(() => {
+    const getActionItems = (query?: string) => {
+      const actionItems: JSX.Element[] = [];
+      if (showAlertStatusActions) {
+        if (currentStatus !== FILTER_OPEN) {
+          actionItems.push(
+            <EuiContextMenuItem
+              key="open"
+              data-test-subj="open-alert-status"
+              onClick={() => onClickUpdate(FILTER_OPEN as AlertWorkflowStatus, query)}
+            >
+              {BULK_ACTION_OPEN_SELECTED}
+            </EuiContextMenuItem>
+          );
+        }
+        if (currentStatus !== FILTER_ACKNOWLEDGED) {
+          actionItems.push(
+            <EuiContextMenuItem
+              key="acknowledge"
+              data-test-subj="acknowledged-alert-status"
+              onClick={() => onClickUpdate(FILTER_ACKNOWLEDGED as AlertWorkflowStatus, query)}
+            >
+              {BULK_ACTION_ACKNOWLEDGED_SELECTED}
+            </EuiContextMenuItem>
+          );
+        }
+        if (currentStatus !== FILTER_CLOSED) {
+          actionItems.push(
+            <EuiContextMenuItem
+              key="close"
+              data-test-subj="close-alert-status"
+              onClick={() => onClickUpdate(FILTER_CLOSED as AlertWorkflowStatus, query)}
+            >
+              {BULK_ACTION_CLOSE_SELECTED}
+            </EuiContextMenuItem>
+          );
+        }
+      }
+      return actionItems;
+    };
+
+    return getActionItems;
+  }, [currentStatus, onClickUpdate, showAlertStatusActions]);
+
+  return items;
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/index.tsx
new file mode 100644
index 0000000000000..475f11abeb11e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/index.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { TableId } from '../../../../../common/types';
+import * as i18n from '../translations';
+
+export * from './group_stats';
+export * from './group_panel_renderers';
+export * from './group_take_action_items';
+export * from './query_builder';
+
+export const getDefaultGroupingOptions = (tableId: TableId) => {
+  if (tableId === TableId.alertsOnAlertsPage) {
+    return [
+      {
+        label: i18n.ruleName,
+        key: 'kibana.alert.rule.name',
+      },
+      {
+        label: i18n.userName,
+        key: 'user.name',
+      },
+      {
+        label: i18n.hostName,
+        key: 'host.name',
+      },
+      {
+        label: i18n.sourceIP,
+        key: 'source.ip',
+      },
+    ];
+  } else if (tableId === TableId.alertsOnRuleDetailsPage) {
+    return [
+      {
+        label: i18n.sourceAddress,
+        key: 'source.address',
+      },
+      {
+        label: i18n.userName,
+        key: 'user.name',
+      },
+      {
+        label: i18n.hostName,
+        key: 'host.name',
+      },
+      {
+        label: i18n.destinationAddress,
+        key: 'destination.address,',
+      },
+    ];
+  }
+  return [];
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/query_builder.test.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/query_builder.test.ts
new file mode 100644
index 0000000000000..e8392e0243c87
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/query_builder.test.ts
@@ -0,0 +1,258 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getAlertsGroupingQuery } from '.';
+
+describe('getAlertsGroupingQuery', () => {
+  it('returns query with aggregations for kibana.alert.rule.name', () => {
+    const groupingQuery = getAlertsGroupingQuery({
+      from: '2022-12-29T22:57:34.029Z',
+      to: '2023-01-28T22:57:29.029Z',
+      pageIndex: 0,
+      pageSize: 25,
+      runtimeMappings: {},
+      selectedGroup: 'kibana.alert.rule.name',
+      additionalFilters: [
+        {
+          bool: {
+            must: [],
+            filter: [
+              {
+                match_phrase: {
+                  'kibana.alert.workflow_status': 'acknowledged',
+                },
+              },
+            ],
+            should: [],
+            must_not: [
+              {
+                exists: {
+                  field: 'kibana.alert.building_block_type',
+                },
+              },
+            ],
+          },
+        },
+      ],
+    });
+
+    expect(groupingQuery).toStrictEqual({
+      _source: false,
+      aggs: {
+        alertsCount: {
+          terms: {
+            exclude: ['alerts'],
+            field: 'kibana.alert.rule.producer',
+          },
+        },
+        groupsNumber: {
+          cardinality: {
+            field: 'kibana.alert.rule.name',
+          },
+        },
+        stackByMultipleFields0: {
+          aggs: {
+            alertsCount: {
+              cardinality: {
+                field: 'kibana.alert.uuid',
+              },
+            },
+            bucket_truncate: {
+              bucket_sort: {
+                from: 0,
+                size: 25,
+                sort: undefined,
+              },
+            },
+            countSeveritySubAggregation: {
+              cardinality: {
+                field: 'kibana.alert.severity',
+              },
+            },
+            hostsCountAggregation: {
+              cardinality: {
+                field: 'host.name',
+              },
+            },
+            ruleTags: {
+              terms: {
+                field: 'kibana.alert.rule.tags',
+              },
+            },
+            severitiesSubAggregation: {
+              terms: {
+                field: 'kibana.alert.severity',
+              },
+            },
+            usersCountAggregation: {
+              cardinality: {
+                field: 'user.name',
+              },
+            },
+          },
+          multi_terms: {
+            terms: [
+              {
+                field: 'kibana.alert.rule.name',
+              },
+              {
+                field: 'kibana.alert.rule.description',
+              },
+            ],
+          },
+        },
+      },
+      query: {
+        bool: {
+          filter: [
+            {
+              bool: {
+                filter: [
+                  {
+                    match_phrase: {
+                      'kibana.alert.workflow_status': 'acknowledged',
+                    },
+                  },
+                ],
+                must: [],
+                must_not: [
+                  {
+                    exists: {
+                      field: 'kibana.alert.building_block_type',
+                    },
+                  },
+                ],
+                should: [],
+              },
+            },
+            {
+              range: {
+                '@timestamp': {
+                  gte: '2022-12-29T22:57:34.029Z',
+                  lte: '2023-01-28T22:57:29.029Z',
+                },
+              },
+            },
+          ],
+        },
+      },
+      runtime_mappings: {},
+      size: 0,
+    });
+  });
+
+  it('returns default query with aggregations if the field specific metrics was not defined', () => {
+    const groupingQuery = getAlertsGroupingQuery({
+      from: '2022-12-29T22:57:34.029Z',
+      to: '2023-01-28T22:57:29.029Z',
+      pageIndex: 0,
+      pageSize: 25,
+      runtimeMappings: {},
+      selectedGroup: 'process.name',
+      additionalFilters: [
+        {
+          bool: {
+            must: [],
+            filter: [
+              {
+                match_phrase: {
+                  'kibana.alert.workflow_status': 'acknowledged',
+                },
+              },
+            ],
+            should: [],
+            must_not: [
+              {
+                exists: {
+                  field: 'kibana.alert.building_block_type',
+                },
+              },
+            ],
+          },
+        },
+      ],
+    });
+
+    expect(groupingQuery).toStrictEqual({
+      _source: false,
+      aggs: {
+        alertsCount: {
+          terms: {
+            exclude: ['alerts'],
+            field: 'kibana.alert.rule.producer',
+          },
+        },
+        groupsNumber: {
+          cardinality: {
+            field: 'process.name',
+          },
+        },
+        stackByMultipleFields0: {
+          aggs: {
+            alertsCount: {
+              cardinality: {
+                field: 'kibana.alert.uuid',
+              },
+            },
+            bucket_truncate: {
+              bucket_sort: {
+                from: 0,
+                size: 25,
+                sort: undefined,
+              },
+            },
+            rulesCountAggregation: {
+              cardinality: {
+                field: 'kibana.alert.rule.rule_id',
+              },
+            },
+          },
+          terms: {
+            field: 'process.name',
+            size: 10000,
+          },
+        },
+      },
+      query: {
+        bool: {
+          filter: [
+            {
+              bool: {
+                filter: [
+                  {
+                    match_phrase: {
+                      'kibana.alert.workflow_status': 'acknowledged',
+                    },
+                  },
+                ],
+                must: [],
+                must_not: [
+                  {
+                    exists: {
+                      field: 'kibana.alert.building_block_type',
+                    },
+                  },
+                ],
+                should: [],
+              },
+            },
+            {
+              range: {
+                '@timestamp': {
+                  gte: '2022-12-29T22:57:34.029Z',
+                  lte: '2023-01-28T22:57:29.029Z',
+                },
+              },
+            },
+          ],
+        },
+      },
+      runtime_mappings: {},
+      size: 0,
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/query_builder.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/query_builder.ts
new file mode 100644
index 0000000000000..2757f39e937e3
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/query_builder.ts
@@ -0,0 +1,253 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/types';
+import type { BoolQuery } from '@kbn/es-query';
+import type {
+  CardinalitySubAggregation,
+  TermsSubAggregation,
+} from '../../../../common/components/grouping';
+import { getGroupingQuery } from '../../../../common/components/grouping';
+
+const getGroupFields = (groupValue: string) => {
+  if (groupValue === 'kibana.alert.rule.name') {
+    return [groupValue, 'kibana.alert.rule.description'];
+  } else {
+    return [groupValue];
+  }
+};
+
+interface AlertsGroupingQueryParams {
+  from: string;
+  to: string;
+  additionalFilters: Array<{
+    bool: BoolQuery;
+  }>;
+  selectedGroup: string;
+  runtimeMappings: MappingRuntimeFields;
+  pageSize: number;
+  pageIndex: number;
+}
+
+export const getAlertsGroupingQuery = ({
+  from,
+  to,
+  additionalFilters,
+  selectedGroup,
+  runtimeMappings,
+  pageSize,
+  pageIndex,
+}: AlertsGroupingQueryParams) =>
+  getGroupingQuery({
+    additionalFilters,
+    additionalAggregationsRoot: [
+      {
+        alertsCount: {
+          terms: {
+            field: 'kibana.alert.rule.producer',
+            exclude: ['alerts'],
+          },
+        },
+      },
+      ...(selectedGroup !== 'none'
+        ? [
+            {
+              groupsNumber: {
+                cardinality: {
+                  field: selectedGroup,
+                },
+              },
+            },
+          ]
+        : []),
+    ],
+    from,
+    runtimeMappings,
+    stackByMultipleFields0: selectedGroup !== 'none' ? getGroupFields(selectedGroup) : [],
+    to,
+    additionalStatsAggregationsFields0:
+      selectedGroup !== 'none' ? getAggregationsByGroupField(selectedGroup) : [],
+    stackByMultipleFields0Size: pageSize,
+    stackByMultipleFields0From: pageIndex * pageSize,
+    additionalStatsAggregationsFields1: [],
+    stackByMultipleFields1: [],
+  });
+
+const getAggregationsByGroupField = (
+  field: string
+): Array<CardinalitySubAggregation | TermsSubAggregation> => {
+  const aggMetrics: Array<CardinalitySubAggregation | TermsSubAggregation> = [
+    {
+      alertsCount: {
+        cardinality: {
+          field: 'kibana.alert.uuid',
+        },
+      },
+    },
+  ];
+  switch (field) {
+    case 'kibana.alert.rule.name':
+      aggMetrics.push(
+        ...[
+          {
+            countSeveritySubAggregation: {
+              cardinality: {
+                field: 'kibana.alert.severity',
+              },
+            },
+          },
+          {
+            severitiesSubAggregation: {
+              terms: {
+                field: 'kibana.alert.severity',
+              },
+            },
+          },
+          {
+            usersCountAggregation: {
+              cardinality: {
+                field: 'user.name',
+              },
+            },
+          },
+          {
+            hostsCountAggregation: {
+              cardinality: {
+                field: 'host.name',
+              },
+            },
+          },
+          {
+            ruleTags: {
+              terms: {
+                field: 'kibana.alert.rule.tags',
+              },
+            },
+          },
+        ]
+      );
+      break;
+    case 'host.name':
+      aggMetrics.push(
+        ...[
+          {
+            rulesCountAggregation: {
+              cardinality: {
+                field: 'kibana.alert.rule.rule_id',
+              },
+            },
+          },
+          {
+            countSeveritySubAggregation: {
+              cardinality: {
+                field: 'kibana.alert.severity',
+              },
+            },
+          },
+          {
+            severitiesSubAggregation: {
+              terms: {
+                field: 'kibana.alert.severity',
+              },
+            },
+          },
+          {
+            usersCountAggregation: {
+              cardinality: {
+                field: 'user.name',
+              },
+            },
+          },
+        ]
+      );
+      break;
+    case 'user.name':
+      aggMetrics.push(
+        ...[
+          {
+            rulesCountAggregation: {
+              cardinality: {
+                field: 'kibana.alert.rule.rule_id',
+              },
+            },
+          },
+          {
+            countSeveritySubAggregation: {
+              cardinality: {
+                field: 'kibana.alert.severity',
+              },
+            },
+          },
+          {
+            severitiesSubAggregation: {
+              terms: {
+                field: 'kibana.alert.severity',
+              },
+            },
+          },
+          {
+            usersCountAggregation: {
+              cardinality: {
+                field: 'host.name',
+              },
+            },
+          },
+          {
+            usersCountAggregation: {
+              cardinality: {
+                field: 'user.name',
+              },
+            },
+          },
+        ]
+      );
+      break;
+    case 'source.ip':
+      aggMetrics.push(
+        ...[
+          {
+            rulesCountAggregation: {
+              cardinality: {
+                field: 'kibana.alert.rule.rule_id',
+              },
+            },
+          },
+          {
+            countSeveritySubAggregation: {
+              cardinality: {
+                field: 'kibana.alert.severity',
+              },
+            },
+          },
+          {
+            severitiesSubAggregation: {
+              terms: {
+                field: 'kibana.alert.severity',
+              },
+            },
+          },
+          {
+            usersCountAggregation: {
+              cardinality: {
+                field: 'host.name',
+              },
+            },
+          },
+        ]
+      );
+      break;
+    default:
+      aggMetrics.push({
+        rulesCountAggregation: {
+          cardinality: {
+            field: 'kibana.alert.rule.rule_id',
+          },
+        },
+      });
+  }
+  return aggMetrics;
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.test.tsx
index d09b2616353c2..85ddea6277e20 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.test.tsx
@@ -6,14 +6,162 @@
  */
 
 import React from 'react';
-import { shallow } from 'enzyme';
+import { mount, shallow } from 'enzyme';
+import { waitFor } from '@testing-library/react';
+
+import useResizeObserver from 'use-resize-observer/polyfilled';
 
 import '../../../common/mock/match_media';
-import { TestProviders } from '../../../common/mock';
+import {
+  createSecuritySolutionStorageMock,
+  kibanaObservable,
+  mockGlobalState,
+  SUB_PLUGINS_REDUCER,
+  TestProviders,
+} from '../../../common/mock';
 import { AlertsTableComponent } from '.';
 import { TableId } from '../../../../common/types';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
+import type { UseFieldBrowserOptionsProps } from '../../../timelines/components/fields_browser';
+import { mockCasesContext } from '@kbn/cases-plugin/public/mocks/mock_cases_context';
+import { mockTimelines } from '../../../common/mock/mock_timelines_plugin';
+import { createFilterManagerMock } from '@kbn/data-plugin/public/query/filter_manager/filter_manager.mock';
+import type { State } from '../../../common/store';
+import { createStore } from '../../../common/store';
+
+jest.mock('../../../common/containers/sourcerer');
+jest.mock('../../../common/containers/use_global_time', () => ({
+  useGlobalTime: jest.fn().mockReturnValue({
+    from: '2020-07-07T08:20:18.966Z',
+    isInitializing: false,
+    to: '2020-07-08T08:20:18.966Z',
+    setQuery: jest.fn(),
+  }),
+}));
+
+jest.mock('./grouping_settings', () => ({
+  getAlertsGroupingQuery: jest.fn(),
+  getDefaultGroupingOptions: () => [
+    {
+      label: 'ruleName',
+      key: 'kibana.alert.rule.name',
+    },
+    {
+      label: 'userName',
+      key: 'user.name',
+    },
+    {
+      label: 'hostName',
+      key: 'host.name',
+    },
+    {
+      label: 'sourceIP',
+      key: 'source.ip',
+    },
+  ],
+  getSelectedGroupBadgeMetrics: jest.fn(),
+  getSelectedGroupButtonContent: jest.fn(),
+  getSelectedGroupCustomMetrics: jest.fn(),
+  useGroupTakeActionsItems: jest.fn(),
+}));
+
+const mockDispatch = jest.fn();
+jest.mock('react-redux', () => {
+  const original = jest.requireActual('react-redux');
+
+  return {
+    ...original,
+    useDispatch: () => mockDispatch,
+  };
+});
+jest.mock('../../../common/utils/normalize_time_range');
+
+const mockUseFieldBrowserOptions = jest.fn();
+jest.mock('../../../timelines/components/fields_browser', () => ({
+  useFieldBrowserOptions: (props: UseFieldBrowserOptionsProps) => mockUseFieldBrowserOptions(props),
+}));
+
+const mockUseResizeObserver: jest.Mock = useResizeObserver as jest.Mock;
+jest.mock('use-resize-observer/polyfilled');
+mockUseResizeObserver.mockImplementation(() => ({}));
+
+const mockFilterManager = createFilterManagerMock();
+
+jest.mock('../../../common/lib/kibana', () => {
+  const original = jest.requireActual('../../../common/lib/kibana');
+
+  return {
+    ...original,
+    useUiSetting$: jest.fn().mockReturnValue([]),
+    useKibana: () => ({
+      services: {
+        application: {
+          navigateToUrl: jest.fn(),
+          capabilities: {
+            siem: { crud_alerts: true, read_alerts: true },
+          },
+        },
+        cases: {
+          ui: { getCasesContext: mockCasesContext },
+        },
+        uiSettings: {
+          get: jest.fn(),
+        },
+        timelines: { ...mockTimelines },
+        data: {
+          query: {
+            filterManager: mockFilterManager,
+          },
+        },
+        docLinks: {
+          links: {
+            siem: {
+              privileges: 'link',
+            },
+          },
+        },
+        storage: {
+          get: jest.fn(),
+          set: jest.fn(),
+        },
+      },
+    }),
+    useToasts: jest.fn().mockReturnValue({
+      addError: jest.fn(),
+      addSuccess: jest.fn(),
+      addWarning: jest.fn(),
+      remove: jest.fn(),
+    }),
+  };
+});
+const state: State = {
+  ...mockGlobalState,
+};
+const { storage } = createSecuritySolutionStorageMock();
+const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
+
+jest.mock('./timeline_actions/use_add_bulk_to_timeline', () => ({
+  useAddBulkToTimelineAction: jest.fn(() => {}),
+}));
+
+jest.mock('./timeline_actions/use_bulk_add_to_case_actions', () => ({
+  useBulkAddToCaseActions: jest.fn(() => []),
+}));
+
+const sourcererDataView = {
+  indicesExist: true,
+  loading: false,
+  indexPattern: {
+    fields: [],
+  },
+};
 
 describe('AlertsTableComponent', () => {
+  (useSourcererDataView as jest.Mock).mockReturnValue({
+    ...sourcererDataView,
+    selectedPatterns: ['myFakebeat-*'],
+  });
+
   it('renders correctly', () => {
     const wrapper = shallow(
       <TestProviders>
@@ -36,10 +184,46 @@ describe('AlertsTableComponent', () => {
           showOnlyThreatIndicatorAlerts={false}
           onShowOnlyThreatIndicatorAlertsChanged={jest.fn()}
           dispatch={jest.fn()}
+          runtimeMappings={{}}
+          signalIndexName={'test'}
         />
       </TestProviders>
     );
 
     expect(wrapper.find('[title="Alerts"]')).toBeTruthy();
   });
+
+  it('it renders groupping fields options when the grouping field is selected', async () => {
+    const wrapper = mount(
+      <TestProviders store={store}>
+        <AlertsTableComponent
+          tableId={TableId.test}
+          hasIndexWrite
+          hasIndexMaintenance
+          from={'2020-07-07T08:20:18.966Z'}
+          loading={false}
+          to={'2020-07-08T08:20:18.966Z'}
+          globalQuery={{
+            query: 'query',
+            language: 'language',
+          }}
+          globalFilters={[]}
+          loadingEventIds={[]}
+          isSelectAllChecked={false}
+          showBuildingBlockAlerts={false}
+          onShowBuildingBlockAlertsChanged={jest.fn()}
+          showOnlyThreatIndicatorAlerts={false}
+          onShowOnlyThreatIndicatorAlertsChanged={jest.fn()}
+          dispatch={jest.fn()}
+          runtimeMappings={{}}
+          signalIndexName={'test'}
+        />
+      </TestProviders>
+    );
+    await waitFor(() => {
+      expect(wrapper.find('[data-test-subj="group-selector-dropdown"]').exists()).toBe(true);
+      wrapper.find('[data-test-subj="group-selector-dropdown"]').first().simulate('click');
+      expect(wrapper.find('[data-test-subj="panel-kibana.alert.rule.name"]').exists()).toBe(true);
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 8b601880fc64b..b6de0e4f80c7b 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -6,11 +6,29 @@
  */
 
 import { isEmpty } from 'lodash/fp';
-import React, { useCallback, useEffect, useMemo } from 'react';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/types';
 import type { ConnectedProps } from 'react-redux';
 import { connect, useDispatch } from 'react-redux';
+import { v4 as uuidv4 } from 'uuid';
 import type { Filter } from '@kbn/es-query';
+import { buildEsQuery } from '@kbn/es-query';
 import { getEsQueryConfig } from '@kbn/data-plugin/common';
+import { Storage } from '@kbn/kibana-utils-plugin/public';
+import { InspectButton } from '../../../common/components/inspect';
+import { defaultUnit } from '../../../common/components/toolbar/unit';
+import type {
+  GroupingFieldTotalAggregation,
+  GroupingTableAggregation,
+  RawBucket,
+} from '../../../common/components/grouping';
+import {
+  GroupingContainer,
+  GroupsSelector,
+  isNoneGroup,
+  NONE_GROUP_KEY,
+} from '../../../common/components/grouping';
+import { useGlobalTime } from '../../../common/containers/use_global_time';
 import { combineQueries } from '../../../common/lib/kuery';
 import type { AlertWorkflowStatus } from '../../../common/types';
 import type { TableIdLiteral } from '../../../../common/types';
@@ -30,6 +48,8 @@ import { DEFAULT_COLUMN_MIN_WIDTH } from '../../../timelines/components/timeline
 import { getDefaultControlColumn } from '../../../timelines/components/timeline/body/control_columns';
 import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
 import { getColumns, RenderCellValue } from '../../configurations/security_solution_detections';
+import { useInspectButton } from '../alerts_kpis/common/hooks';
+
 import { AdditionalFiltersAction } from './additional_filters_action';
 import {
   getAlertsDefaultModel,
@@ -41,6 +61,22 @@ import * as i18n from './translations';
 import { useLicense } from '../../../common/hooks/use_license';
 import { useBulkAddToCaseActions } from './timeline_actions/use_bulk_add_to_case_actions';
 import { useAddBulkToTimelineAction } from './timeline_actions/use_add_bulk_to_timeline';
+import { useQueryAlerts } from '../../containers/detection_engine/alerts/use_query';
+import { ALERTS_QUERY_NAMES } from '../../containers/detection_engine/alerts/constants';
+import {
+  getAlertsGroupingQuery,
+  getDefaultGroupingOptions,
+  getSelectedGroupBadgeMetrics,
+  getSelectedGroupButtonContent,
+  getSelectedGroupCustomMetrics,
+  useGroupTakeActionsItems,
+} from './grouping_settings';
+
+/** This local storage key stores the `Grid / Event rendered view` selection */
+export const ALERTS_TABLE_GROUPS_SELECTION_KEY = 'securitySolution.alerts.table.group-selection';
+const storage = new Storage(localStorage);
+
+const ALERTS_GROUPING_ID = 'alerts-grouping';
 
 interface OwnProps {
   defaultFilters?: Filter[];
@@ -56,6 +92,8 @@ interface OwnProps {
   tableId: TableIdLiteral;
   to: string;
   filterGroup?: Status;
+  runtimeMappings: MappingRuntimeFields;
+  signalIndexName: string | null;
 }
 
 type AlertsTableComponentProps = OwnProps & PropsFromRedux;
@@ -78,8 +116,13 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   tableId,
   to,
   filterGroup,
+  runtimeMappings,
+  signalIndexName,
 }) => {
   const dispatch = useDispatch();
+  const [selectedGroup, setSelectedGroup] = useState<string>(
+    storage.get(`${ALERTS_TABLE_GROUPS_SELECTION_KEY}-${tableId}`) ?? NONE_GROUP_KEY
+  );
 
   const {
     browserFields,
@@ -211,11 +254,165 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
     [addToCaseBulkActions, addBulkToTimelineAction]
   );
 
-  if (loading || isEmpty(selectedPatterns)) {
+  const { deleteQuery, setQuery } = useGlobalTime(false);
+  // create a unique, but stable (across re-renders) query id
+  const uniqueQueryId = useMemo(() => `${ALERTS_GROUPING_ID}-${uuidv4()}`, []);
+
+  const additionalFilters = useMemo(() => {
+    try {
+      return [
+        buildEsQuery(undefined, globalQuery != null ? [globalQuery] : [], [
+          ...(globalFilters?.filter((f) => f.meta.disabled === false) ?? []),
+          ...(defaultFiltersMemo ?? []),
+        ]),
+      ];
+    } catch (e) {
+      return [];
+    }
+  }, [defaultFiltersMemo, globalFilters, globalQuery]);
+
+  const [groupsActivePage, setGroupsActivePage] = useState<number>(0);
+  const [groupsItemsPerPage, setGroupsItemsPerPage] = useState<number>(25);
+
+  const pagination = useMemo(
+    () => ({
+      pageIndex: groupsActivePage,
+      pageSize: groupsItemsPerPage,
+      onChangeItemsPerPage: (itemsPerPageNumber: number) =>
+        setGroupsItemsPerPage(itemsPerPageNumber),
+      onChangePage: (pageNumber: number) => setGroupsActivePage(pageNumber),
+    }),
+    [groupsActivePage, groupsItemsPerPage]
+  );
+
+  const queryGroups = useMemo(
+    () =>
+      getAlertsGroupingQuery({
+        additionalFilters,
+        selectedGroup,
+        from,
+        runtimeMappings,
+        to,
+        pageSize: pagination.pageSize,
+        pageIndex: pagination.pageIndex,
+      }),
+    [
+      additionalFilters,
+      selectedGroup,
+      from,
+      runtimeMappings,
+      to,
+      pagination.pageSize,
+      pagination.pageIndex,
+    ]
+  );
+
+  const {
+    data: alertsGroupsData,
+    loading: isLoadingGroups,
+    refetch,
+    request,
+    response,
+    setQuery: setAlertsQuery,
+  } = useQueryAlerts<{}, GroupingTableAggregation & GroupingFieldTotalAggregation>({
+    query: queryGroups,
+    indexName: signalIndexName,
+    queryName: ALERTS_QUERY_NAMES.ALERTS_GROUPING,
+    skip: isNoneGroup(selectedGroup),
+  });
+
+  useEffect(() => {
+    if (!isNoneGroup(selectedGroup)) {
+      setAlertsQuery(queryGroups);
+    }
+  }, [queryGroups, selectedGroup, setAlertsQuery]);
+
+  useInspectButton({
+    deleteQuery,
+    loading: isLoadingGroups,
+    response,
+    setQuery,
+    refetch,
+    request,
+    uniqueQueryId,
+  });
+
+  const inspect = useMemo(
+    () => (
+      <InspectButton queryId={uniqueQueryId} inspectIndex={0} title={i18n.INSPECT_GROUPING_TITLE} />
+    ),
+    [uniqueQueryId]
+  );
+
+  const defaultGroupingOptions = getDefaultGroupingOptions(tableId);
+  const [options, setOptions] = useState(
+    defaultGroupingOptions.find((o) => o.key === selectedGroup)
+      ? defaultGroupingOptions
+      : [
+          ...defaultGroupingOptions,
+          ...(!isNoneGroup(selectedGroup)
+            ? [
+                {
+                  key: selectedGroup,
+                  label: selectedGroup,
+                },
+              ]
+            : []),
+        ]
+  );
+
+  const groupsSelector = useMemo(
+    () => (
+      <GroupsSelector
+        groupSelected={selectedGroup}
+        data-test-subj="alerts-table-group-selector"
+        onGroupChange={(groupSelection: string) => {
+          if (groupSelection === selectedGroup) {
+            return;
+          }
+          storage.set(`${ALERTS_TABLE_GROUPS_SELECTION_KEY}-${tableId}`, groupSelection);
+          setGroupsActivePage(0);
+          setSelectedGroup(groupSelection);
+
+          if (!isNoneGroup(groupSelection) && !options.find((o) => o.key === groupSelection)) {
+            setOptions([
+              ...defaultGroupingOptions,
+              {
+                label: groupSelection,
+                key: groupSelection,
+              },
+            ]);
+          } else {
+            setOptions(defaultGroupingOptions);
+          }
+        }}
+        fields={indexPatterns.fields}
+        options={options}
+        title={i18n.GROUP_ALERTS_SELECTOR}
+      />
+    ),
+    [defaultGroupingOptions, indexPatterns.fields, options, selectedGroup, tableId]
+  );
+
+  const takeActionItems = useGroupTakeActionsItems({
+    indexName: indexPatterns.title,
+    currentStatus: filterGroup as AlertWorkflowStatus,
+    showAlertStatusActions: hasIndexWrite && hasIndexMaintenance,
+  });
+
+  const getTakeActionItems = useCallback(
+    (groupFilters: Filter[]) =>
+      takeActionItems(
+        getGlobalQuery([...(defaultFiltersMemo ?? []), ...groupFilters])?.filterQuery
+      ),
+    [defaultFiltersMemo, getGlobalQuery, takeActionItems]
+  );
+
+  if (loading || isLoadingGroups || isEmpty(selectedPatterns)) {
     return null;
   }
 
-  return (
+  const dataTable = (
     <StatefulEventsViewer
       additionalFilters={additionalFiltersComponent}
       currentFilter={filterGroup as AlertWorkflowStatus}
@@ -232,8 +429,58 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
       rowRenderers={defaultRowRenderers}
       sourcererScope={SourcererScopeName.detections}
       start={from}
+      additionalRightMenuOptions={isNoneGroup(selectedGroup) ? [groupsSelector] : []}
     />
   );
+
+  return (
+    <>
+      {isNoneGroup(selectedGroup) ? (
+        dataTable
+      ) : (
+        <>
+          <GroupingContainer
+            selectedGroup={selectedGroup}
+            groupsSelector={groupsSelector}
+            inspectButton={inspect}
+            takeActionItems={getTakeActionItems}
+            data={alertsGroupsData?.aggregations ?? {}}
+            renderChildComponent={(groupFilter) => (
+              <StatefulEventsViewer
+                additionalFilters={additionalFiltersComponent}
+                currentFilter={filterGroup as AlertWorkflowStatus}
+                defaultCellActions={defaultCellActions}
+                defaultModel={getAlertsDefaultModel(license)}
+                end={to}
+                bulkActions={bulkActions}
+                hasCrudPermissions={hasIndexWrite && hasIndexMaintenance}
+                tableId={tableId}
+                leadingControlColumns={leadingControlColumns}
+                onRuleChange={onRuleChange}
+                pageFilters={[...(defaultFiltersMemo ?? []), ...groupFilter]}
+                renderCellValue={RenderCellValue}
+                rowRenderers={defaultRowRenderers}
+                sourcererScope={SourcererScopeName.detections}
+                start={from}
+                additionalRightMenuOptions={isNoneGroup(selectedGroup) ? [groupsSelector] : []}
+              />
+            )}
+            unit={defaultUnit}
+            pagination={pagination}
+            groupPanelRenderer={(fieldBucket: RawBucket) =>
+              getSelectedGroupButtonContent(selectedGroup, fieldBucket)
+            }
+            badgeMetricStats={(fieldBucket: RawBucket) =>
+              getSelectedGroupBadgeMetrics(selectedGroup, fieldBucket)
+            }
+            customMetricStats={(fieldBucket: RawBucket) =>
+              getSelectedGroupCustomMetrics(selectedGroup, fieldBucket)
+            }
+          />
+        </>
+      )}
+    </>
+  );
 };
 
 const makeMapStateToProps = () => {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
index 21e80a6770c1f..ec5b23f0851d6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
@@ -294,3 +294,127 @@ export const INVESTIGATE_BULK_IN_TIMELINE = i18n.translate(
     defaultMessage: 'Investigate in timeline',
   }
 );
+
+export const TAKE_ACTION = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.additionalActions.takeAction',
+  {
+    defaultMessage: 'Take actions',
+  }
+);
+
+export const STATS_GROUP_ALERTS = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.alertsCount',
+  {
+    defaultMessage: 'Alerts:',
+  }
+);
+
+export const STATS_GROUP_HOSTS = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.hostsCount',
+  {
+    defaultMessage: 'Hosts:',
+  }
+);
+
+export const STATS_GROUP_IPS = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.ipsCount',
+  {
+    defaultMessage: `IP's:`,
+  }
+);
+
+export const GROUP_ALERTS_SELECTOR = i18n.translate(
+  'xpack.securitySolution.detectionEngine.selectGroup.title',
+  {
+    defaultMessage: `Group alerts by`,
+  }
+);
+
+export const STATS_GROUP_USERS = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.usersCount',
+  {
+    defaultMessage: 'Users:',
+  }
+);
+
+export const STATS_GROUP_RULES = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.rulesCount',
+  {
+    defaultMessage: 'Rules:',
+  }
+);
+
+export const STATS_GROUP_SEVERITY = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.severity',
+  {
+    defaultMessage: 'Severity:',
+  }
+);
+
+export const STATS_GROUP_SEVERITY_MULTI = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.severity.multi',
+  {
+    defaultMessage: 'Multi',
+  }
+);
+
+export const STATS_GROUP_SEVERITY_LOW = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.severity.low',
+  {
+    defaultMessage: 'Low',
+  }
+);
+
+export const STATS_GROUP_SEVERITY_HIGH = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.severity.high',
+  {
+    defaultMessage: 'High',
+  }
+);
+
+export const STATS_GROUP_SEVERITY_CRITICAL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.severity.critical',
+  {
+    defaultMessage: 'Critical',
+  }
+);
+
+export const STATS_GROUP_SEVERITY_MEDIUM = i18n.translate(
+  'xpack.securitySolution.detectionEngine.groups.stats.severity.medium',
+  {
+    defaultMessage: 'Medium',
+  }
+);
+
+export const ruleName = i18n.translate('xpack.securitySolution.selector.groups.ruleName.label', {
+  defaultMessage: 'Rule name',
+});
+export const userName = i18n.translate('xpack.securitySolution.selector.grouping.userName.label', {
+  defaultMessage: 'User name',
+});
+export const hostName = i18n.translate('xpack.securitySolution.selector.grouping.hostName.label', {
+  defaultMessage: 'Host name',
+});
+export const sourceIP = i18n.translate('xpack.securitySolution.selector.grouping.sourceIP.label', {
+  defaultMessage: 'Source IP',
+});
+export const sourceAddress = i18n.translate(
+  'xpack.securitySolution.selector.groups.sourceAddress.label',
+  {
+    defaultMessage: 'Source address',
+  }
+);
+
+export const destinationAddress = i18n.translate(
+  'xpack.securitySolution.selector.groups.destinationAddress.label',
+  {
+    defaultMessage: 'Destination address',
+  }
+);
+
+export const INSPECT_GROUPING_TITLE = i18n.translate(
+  'xpack.securitySolution.detectionsEngine.grouping.inspectTitle',
+  {
+    defaultMessage: 'Grouping query',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/constants.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/constants.ts
index a6dcf82dd4071..ca8929860df7d 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/constants.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/constants.ts
@@ -10,6 +10,7 @@ import { APP_UI_ID } from '../../../../../common/constants';
 export const ALERTS_QUERY_NAMES = {
   ADD_EXCEPTION_FLYOUT: `${APP_UI_ID} fetchAlerts addExceptionFlyout`,
   ALERTS_COUNT_BY_STATUS: `${APP_UI_ID} fetchAlerts byRulebyCount`,
+  ALERTS_GROUPING: `${APP_UI_ID} fetchAlerts grouping`,
   BY_ID: `${APP_UI_ID} fetchAlerts byId`,
   BY_RULE_BY_STATUS: `${APP_UI_ID} fetchAlerts byRulebyStatus`,
   BY_RULE_ID: `${APP_UI_ID} fetchAlerts byRuleId`,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
index dfb4b0c299d0c..8cc5c6ad0afa9 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
@@ -458,6 +458,8 @@ const DetectionEnginePageComponent: React.FC<DetectionEngineComponentProps> = ({
               onShowBuildingBlockAlertsChanged={onShowBuildingBlockAlertsChangedCallback}
               showOnlyThreatIndicatorAlerts={showOnlyThreatIndicatorAlerts}
               onShowOnlyThreatIndicatorAlertsChanged={onShowOnlyThreatIndicatorAlertsCallback}
+              signalIndexName={signalIndexName}
+              runtimeMappings={runtimeMappings}
               to={to}
             />
           </SecuritySolutionPageWrapper>
diff --git a/x-pack/plugins/security_solution/public/overview/components/detection_response/host_alerts_table/use_host_alerts_items.ts b/x-pack/plugins/security_solution/public/overview/components/detection_response/host_alerts_table/use_host_alerts_items.ts
index c2f5bbb6bd319..301ea396e418d 100644
--- a/x-pack/plugins/security_solution/public/overview/components/detection_response/host_alerts_table/use_host_alerts_items.ts
+++ b/x-pack/plugins/security_solution/public/overview/components/detection_response/host_alerts_table/use_host_alerts_items.ts
@@ -7,6 +7,7 @@
 
 import { useCallback, useEffect, useState } from 'react';
 
+import { firstNonNullValue } from '../../../../../common/endpoint/models/ecs_safety_helpers';
 import { useQueryInspector } from '../../../../common/components/page/manage_query';
 import { useGlobalTime } from '../../../../common/containers/use_global_time';
 import type { GenericBuckets } from '../../../../../common/search_strategy';
@@ -248,7 +249,7 @@ function parseHostsData(
 
   return buckets.reduce<HostAlertsItem[]>((accumalatedAlertsByHost, currentHost) => {
     accumalatedAlertsByHost.push({
-      hostName: currentHost.key || '—',
+      hostName: firstNonNullValue(currentHost.key) ?? '-',
       totalAlerts: currentHost.doc_count,
       low: currentHost.low.doc_count,
       medium: currentHost.medium.doc_count,
diff --git a/x-pack/plugins/security_solution/public/overview/components/detection_response/user_alerts_table/use_user_alerts_items.ts b/x-pack/plugins/security_solution/public/overview/components/detection_response/user_alerts_table/use_user_alerts_items.ts
index 826f7fb1e931a..496d332ed8f76 100644
--- a/x-pack/plugins/security_solution/public/overview/components/detection_response/user_alerts_table/use_user_alerts_items.ts
+++ b/x-pack/plugins/security_solution/public/overview/components/detection_response/user_alerts_table/use_user_alerts_items.ts
@@ -7,6 +7,7 @@
 
 import { useCallback, useEffect, useState } from 'react';
 
+import { firstNonNullValue } from '../../../../../common/endpoint/models/ecs_safety_helpers';
 import { useQueryInspector } from '../../../../common/components/page/manage_query';
 import { useGlobalTime } from '../../../../common/containers/use_global_time';
 import type { GenericBuckets } from '../../../../../common/search_strategy';
@@ -246,7 +247,7 @@ function parseUsersData(rawAggregation: AlertCountersBySeverityAggregation): Use
 
   return buckets.reduce<UserAlertsItem[]>((accumalatedAlertsByUser, currentUser) => {
     accumalatedAlertsByUser.push({
-      userName: currentUser.key || '—',
+      userName: firstNonNullValue(currentUser.key) ?? '-',
       totalAlerts: currentUser.doc_count,
       low: currentUser.low.doc_count,
       medium: currentUser.medium.doc_count,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
index ddba77e929256..32837920d5fc8 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
@@ -83,8 +83,8 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
               buckets: [
-                { key: 200, doc_count: 72174 },
-                { key: 401, doc_count: 34530 },
+                { key: '200', doc_count: 72174 },
+                { key: '401', doc_count: 34530 },
               ],
             },
           },
@@ -125,8 +125,8 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
               buckets: [
-                { key: 200, doc_count: 75394 },
-                { key: 401, doc_count: 1350 },
+                { key: '200', doc_count: 75394 },
+                { key: '401', doc_count: 1350 },
               ],
             },
           },
@@ -166,7 +166,7 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
             status: {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
-              buckets: [{ key: 200, doc_count: 58746 }],
+              buckets: [{ key: '200', doc_count: 58746 }],
             },
           },
           {
@@ -202,7 +202,7 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
             status: {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
-              buckets: [{ key: 200, doc_count: 28715 }],
+              buckets: [{ key: '200', doc_count: 28715 }],
             },
           },
           {
@@ -238,7 +238,7 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
             status: {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
-              buckets: [{ key: 200, doc_count: 28161 }],
+              buckets: [{ key: '200', doc_count: 28161 }],
             },
           },
           {
@@ -277,7 +277,7 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
             status: {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
-              buckets: [{ key: 200, doc_count: 23283 }],
+              buckets: [{ key: '200', doc_count: 23283 }],
             },
           },
           {
@@ -317,8 +317,8 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
               buckets: [
-                { key: 200, doc_count: 12084 },
-                { key: 401, doc_count: 8640 },
+                { key: '200', doc_count: 12084 },
+                { key: '401', doc_count: 8640 },
               ],
             },
           },
@@ -365,10 +365,10 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 3,
               buckets: [
-                { key: 401, doc_count: 18220 },
-                { key: 404, doc_count: 30 },
-                { key: 302, doc_count: 27 },
-                { key: 200, doc_count: 26 },
+                { key: '401', doc_count: 18220 },
+                { key: '404', doc_count: 30 },
+                { key: '302', doc_count: 27 },
+                { key: '200', doc_count: 26 },
               ],
             },
           },
@@ -408,7 +408,7 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
             status: {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
-              buckets: [{ key: 200, doc_count: 18048 }],
+              buckets: [{ key: '200', doc_count: 18048 }],
             },
           },
           {
@@ -444,7 +444,7 @@ export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
             status: {
               doc_count_error_upper_bound: 0,
               sum_other_doc_count: 0,
-              buckets: [{ key: 200, doc_count: 14046 }],
+              buckets: [{ key: '200', doc_count: 14046 }],
             },
           },
         ],
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts
index 79a3c3adbb97b..7b458da183b71 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts
@@ -8,6 +8,7 @@
 import { get, getOr } from 'lodash/fp';
 
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
+import { firstNonNullValue } from '../../../../../../common/endpoint/models/ecs_safety_helpers';
 import type {
   NetworkHttpBuckets,
   NetworkHttpEdges,
@@ -17,19 +18,24 @@ export const getHttpEdges = (response: IEsSearchResponse<unknown>): NetworkHttpE
   formatHttpEdges(getOr([], `aggregations.url.buckets`, response.rawResponse));
 
 const formatHttpEdges = (buckets: NetworkHttpBuckets[]): NetworkHttpEdges[] =>
-  buckets.map((bucket: NetworkHttpBuckets) => ({
-    node: {
-      _id: bucket.key,
-      domains: bucket.domains.buckets.map(({ key }) => key),
-      methods: bucket.methods.buckets.map(({ key }) => key),
-      statuses: bucket.status.buckets.map(({ key }) => `${key}`),
-      lastHost: get('source.hits.hits[0].fields["host.name"]', bucket),
-      lastSourceIp: get('source.hits.hits[0].fields["source.ip"]', bucket),
-      path: bucket.key,
-      requestCount: bucket.doc_count,
-    },
-    cursor: {
-      value: bucket.key,
-      tiebreaker: null,
-    },
-  }));
+  buckets.map((bucket: NetworkHttpBuckets) => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const getKey = ({ key }: any) => firstNonNullValue(key);
+    const bucketKey = firstNonNullValue(bucket.key);
+    return {
+      node: {
+        _id: bucketKey,
+        domains: bucket.domains.buckets.map(getKey),
+        methods: bucket.methods.buckets.map(getKey),
+        statuses: bucket.status.buckets.map(getKey),
+        lastHost: get('source.hits.hits[0].fields["host.name"]', bucket),
+        lastSourceIp: get('source.hits.hits[0].fields["source.ip"]', bucket),
+        path: bucketKey,
+        requestCount: bucket.doc_count,
+      },
+      cursor: {
+        value: bucketKey,
+        tiebreaker: null,
+      },
+    };
+  });

From af33ea1b081e2d87cea5879569f0fc01cba408c6 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 7 Feb 2023 00:48:05 -0500
Subject: [PATCH 030/134] [api-docs] 2023-02-07 Daily api_docs build (#150404)

Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/241
---
 api_docs/actions.mdx                          |   2 +-
 api_docs/advanced_settings.mdx                |   2 +-
 api_docs/aiops.mdx                            |   2 +-
 api_docs/alerting.mdx                         |   2 +-
 api_docs/apm.devdocs.json                     |  70 ++++++-
 api_docs/apm.mdx                              |   4 +-
 api_docs/banners.mdx                          |   2 +-
 api_docs/bfetch.mdx                           |   2 +-
 api_docs/canvas.mdx                           |   2 +-
 api_docs/cases.mdx                            |   2 +-
 api_docs/charts.mdx                           |   2 +-
 api_docs/cloud.mdx                            |   2 +-
 api_docs/cloud_chat.mdx                       |   2 +-
 api_docs/cloud_data_migration.mdx             |   2 +-
 api_docs/cloud_defend.mdx                     |   2 +-
 api_docs/cloud_experiments.mdx                |   2 +-
 api_docs/cloud_security_posture.mdx           |   2 +-
 api_docs/console.mdx                          |   2 +-
 api_docs/content_management.mdx               |   2 +-
 api_docs/controls.devdocs.json                |  66 +++++--
 api_docs/controls.mdx                         |   4 +-
 api_docs/core.devdocs.json                    |  36 ++--
 api_docs/core.mdx                             |   2 +-
 api_docs/custom_integrations.mdx              |   2 +-
 api_docs/dashboard.devdocs.json               |  14 ++
 api_docs/dashboard.mdx                        |   4 +-
 api_docs/dashboard_enhanced.mdx               |   2 +-
 api_docs/data.devdocs.json                    |  48 +----
 api_docs/data.mdx                             |   2 +-
 api_docs/data_query.mdx                       |   2 +-
 api_docs/data_search.mdx                      |   2 +-
 api_docs/data_view_editor.mdx                 |   2 +-
 api_docs/data_view_field_editor.mdx           |   2 +-
 api_docs/data_view_management.mdx             |   2 +-
 api_docs/data_views.devdocs.json              |  72 ++------
 api_docs/data_views.mdx                       |   2 +-
 api_docs/data_visualizer.devdocs.json         |   8 +-
 api_docs/data_visualizer.mdx                  |   4 +-
 api_docs/deprecations_by_api.mdx              |   6 +-
 api_docs/deprecations_by_plugin.mdx           |  28 ++-
 api_docs/deprecations_by_team.mdx             |   2 +-
 api_docs/dev_tools.mdx                        |   2 +-
 api_docs/discover.mdx                         |   2 +-
 api_docs/discover_enhanced.mdx                |   2 +-
 .../ecs_data_quality_dashboard.devdocs.json   |  59 ++++++
 api_docs/ecs_data_quality_dashboard.mdx       |  33 ++++
 api_docs/embeddable.mdx                       |   2 +-
 api_docs/embeddable_enhanced.mdx              |   2 +-
 api_docs/encrypted_saved_objects.mdx          |   2 +-
 api_docs/enterprise_search.mdx                |   2 +-
 api_docs/es_ui_shared.mdx                     |   2 +-
 api_docs/event_annotation.mdx                 |   2 +-
 api_docs/event_log.mdx                        |   2 +-
 api_docs/expression_error.mdx                 |   2 +-
 api_docs/expression_gauge.mdx                 |   2 +-
 api_docs/expression_heatmap.mdx               |   2 +-
 api_docs/expression_image.mdx                 |   2 +-
 api_docs/expression_legacy_metric_vis.mdx     |   2 +-
 api_docs/expression_metric.mdx                |   2 +-
 api_docs/expression_metric_vis.mdx            |   2 +-
 api_docs/expression_partition_vis.mdx         |   2 +-
 api_docs/expression_repeat_image.mdx          |   2 +-
 api_docs/expression_reveal_image.mdx          |   2 +-
 api_docs/expression_shape.mdx                 |   2 +-
 api_docs/expression_tagcloud.mdx              |   2 +-
 api_docs/expression_x_y.mdx                   |   2 +-
 api_docs/expressions.mdx                      |   2 +-
 api_docs/features.mdx                         |   2 +-
 api_docs/field_formats.mdx                    |   2 +-
 api_docs/file_upload.mdx                      |   2 +-
 api_docs/files.mdx                            |   2 +-
 api_docs/files_management.mdx                 |   2 +-
 api_docs/fleet.mdx                            |   2 +-
 api_docs/global_search.mdx                    |   2 +-
 api_docs/guided_onboarding.devdocs.json       |  22 ++-
 api_docs/guided_onboarding.mdx                |   2 +-
 api_docs/home.mdx                             |   2 +-
 api_docs/image_embeddable.mdx                 |   2 +-
 api_docs/index_lifecycle_management.mdx       |   2 +-
 api_docs/index_management.mdx                 |   2 +-
 api_docs/infra.mdx                            |   2 +-
 api_docs/inspector.mdx                        |   2 +-
 api_docs/interactive_setup.mdx                |   2 +-
 api_docs/kbn_ace.mdx                          |   2 +-
 api_docs/kbn_aiops_components.mdx             |   2 +-
 api_docs/kbn_aiops_utils.mdx                  |   2 +-
 api_docs/kbn_alerts.mdx                       |   2 +-
 api_docs/kbn_analytics.mdx                    |   2 +-
 api_docs/kbn_analytics_client.mdx             |   2 +-
 ..._analytics_shippers_elastic_v3_browser.mdx |   2 +-
 ...n_analytics_shippers_elastic_v3_common.mdx |   2 +-
 ...n_analytics_shippers_elastic_v3_server.mdx |   2 +-
 api_docs/kbn_analytics_shippers_fullstory.mdx |   2 +-
 api_docs/kbn_analytics_shippers_gainsight.mdx |   2 +-
 api_docs/kbn_apm_config_loader.mdx            |   2 +-
 api_docs/kbn_apm_synthtrace.mdx               |   2 +-
 api_docs/kbn_apm_synthtrace_client.mdx        |   2 +-
 api_docs/kbn_apm_utils.mdx                    |   2 +-
 api_docs/kbn_axe_config.mdx                   |   2 +-
 api_docs/kbn_cases_components.mdx             |   2 +-
 api_docs/kbn_cell_actions.mdx                 |   2 +-
 api_docs/kbn_chart_icons.mdx                  |   2 +-
 api_docs/kbn_ci_stats_core.mdx                |   2 +-
 api_docs/kbn_ci_stats_performance_metrics.mdx |   2 +-
 api_docs/kbn_ci_stats_reporter.mdx            |   2 +-
 api_docs/kbn_cli_dev_mode.mdx                 |   2 +-
 api_docs/kbn_code_editor.mdx                  |   2 +-
 api_docs/kbn_code_editor_mocks.mdx            |   2 +-
 api_docs/kbn_coloring.mdx                     |   2 +-
 api_docs/kbn_config.mdx                       |   2 +-
 api_docs/kbn_config_mocks.mdx                 |   2 +-
 api_docs/kbn_config_schema.mdx                |   2 +-
 .../kbn_content_management_content_editor.mdx |   2 +-
 .../kbn_content_management_table_list.mdx     |   2 +-
 api_docs/kbn_core_analytics_browser.mdx       |   2 +-
 .../kbn_core_analytics_browser_internal.mdx   |   2 +-
 api_docs/kbn_core_analytics_browser_mocks.mdx |   2 +-
 api_docs/kbn_core_analytics_server.mdx        |   2 +-
 .../kbn_core_analytics_server_internal.mdx    |   2 +-
 api_docs/kbn_core_analytics_server_mocks.mdx  |   2 +-
 api_docs/kbn_core_application_browser.mdx     |   2 +-
 .../kbn_core_application_browser_internal.mdx |   2 +-
 .../kbn_core_application_browser_mocks.mdx    |   2 +-
 api_docs/kbn_core_application_common.mdx      |   2 +-
 api_docs/kbn_core_apps_browser_internal.mdx   |   2 +-
 api_docs/kbn_core_apps_browser_mocks.mdx      |   2 +-
 api_docs/kbn_core_apps_server_internal.mdx    |   2 +-
 api_docs/kbn_core_base_browser_mocks.mdx      |   2 +-
 api_docs/kbn_core_base_common.mdx             |   2 +-
 api_docs/kbn_core_base_server_internal.mdx    |   2 +-
 api_docs/kbn_core_base_server_mocks.mdx       |   2 +-
 .../kbn_core_capabilities_browser_mocks.mdx   |   2 +-
 api_docs/kbn_core_capabilities_common.mdx     |   2 +-
 api_docs/kbn_core_capabilities_server.mdx     |   2 +-
 .../kbn_core_capabilities_server_mocks.mdx    |   2 +-
 api_docs/kbn_core_chrome_browser.mdx          |   2 +-
 api_docs/kbn_core_chrome_browser_mocks.mdx    |   2 +-
 api_docs/kbn_core_config_server_internal.mdx  |   2 +-
 api_docs/kbn_core_custom_branding_browser.mdx |   2 +-
 ..._core_custom_branding_browser_internal.mdx |   2 +-
 ...kbn_core_custom_branding_browser_mocks.mdx |   2 +-
 api_docs/kbn_core_custom_branding_common.mdx  |   2 +-
 api_docs/kbn_core_custom_branding_server.mdx  |   2 +-
 ...n_core_custom_branding_server_internal.mdx |   2 +-
 .../kbn_core_custom_branding_server_mocks.mdx |   2 +-
 api_docs/kbn_core_deprecations_browser.mdx    |   2 +-
 ...kbn_core_deprecations_browser_internal.mdx |   2 +-
 .../kbn_core_deprecations_browser_mocks.mdx   |   2 +-
 api_docs/kbn_core_deprecations_common.mdx     |   2 +-
 api_docs/kbn_core_deprecations_server.mdx     |   2 +-
 .../kbn_core_deprecations_server_internal.mdx |   2 +-
 .../kbn_core_deprecations_server_mocks.mdx    |   2 +-
 api_docs/kbn_core_doc_links_browser.mdx       |   2 +-
 api_docs/kbn_core_doc_links_browser_mocks.mdx |   2 +-
 api_docs/kbn_core_doc_links_server.mdx        |   2 +-
 api_docs/kbn_core_doc_links_server_mocks.mdx  |   2 +-
 ...e_elasticsearch_client_server_internal.mdx |   2 +-
 ...core_elasticsearch_client_server_mocks.mdx |   2 +-
 api_docs/kbn_core_elasticsearch_server.mdx    |   2 +-
 ...kbn_core_elasticsearch_server_internal.mdx |   2 +-
 .../kbn_core_elasticsearch_server_mocks.mdx   |   2 +-
 .../kbn_core_environment_server_internal.mdx  |   2 +-
 .../kbn_core_environment_server_mocks.mdx     |   2 +-
 .../kbn_core_execution_context_browser.mdx    |   2 +-
 ...ore_execution_context_browser_internal.mdx |   2 +-
 ...n_core_execution_context_browser_mocks.mdx |   2 +-
 .../kbn_core_execution_context_common.mdx     |   2 +-
 .../kbn_core_execution_context_server.mdx     |   2 +-
 ...core_execution_context_server_internal.mdx |   2 +-
 ...bn_core_execution_context_server_mocks.mdx |   2 +-
 api_docs/kbn_core_fatal_errors_browser.mdx    |   2 +-
 .../kbn_core_fatal_errors_browser_mocks.mdx   |   2 +-
 api_docs/kbn_core_http_browser.mdx            |   2 +-
 api_docs/kbn_core_http_browser_internal.mdx   |   2 +-
 api_docs/kbn_core_http_browser_mocks.mdx      |   2 +-
 api_docs/kbn_core_http_common.mdx             |   2 +-
 .../kbn_core_http_context_server_mocks.mdx    |   2 +-
 ...re_http_request_handler_context_server.mdx |   2 +-
 api_docs/kbn_core_http_resources_server.mdx   |   2 +-
 ...bn_core_http_resources_server_internal.mdx |   2 +-
 .../kbn_core_http_resources_server_mocks.mdx  |   2 +-
 .../kbn_core_http_router_server_internal.mdx  |   2 +-
 .../kbn_core_http_router_server_mocks.mdx     |   2 +-
 api_docs/kbn_core_http_server.mdx             |   2 +-
 api_docs/kbn_core_http_server_internal.mdx    |   2 +-
 api_docs/kbn_core_http_server_mocks.mdx       |   2 +-
 api_docs/kbn_core_i18n_browser.mdx            |   2 +-
 api_docs/kbn_core_i18n_browser_mocks.mdx      |   2 +-
 api_docs/kbn_core_i18n_server.mdx             |   2 +-
 api_docs/kbn_core_i18n_server_internal.mdx    |   2 +-
 api_docs/kbn_core_i18n_server_mocks.mdx       |   2 +-
 ...n_core_injected_metadata_browser_mocks.mdx |   2 +-
 ...kbn_core_integrations_browser_internal.mdx |   2 +-
 .../kbn_core_integrations_browser_mocks.mdx   |   2 +-
 .../kbn_core_lifecycle_browser.devdocs.json   |   4 +
 api_docs/kbn_core_lifecycle_browser.mdx       |   2 +-
 api_docs/kbn_core_lifecycle_browser_mocks.mdx |   2 +-
 api_docs/kbn_core_lifecycle_server.mdx        |   2 +-
 api_docs/kbn_core_lifecycle_server_mocks.mdx  |   2 +-
 api_docs/kbn_core_logging_browser_mocks.mdx   |   2 +-
 api_docs/kbn_core_logging_common_internal.mdx |   2 +-
 api_docs/kbn_core_logging_server.mdx          |   2 +-
 api_docs/kbn_core_logging_server_internal.mdx |   2 +-
 api_docs/kbn_core_logging_server_mocks.mdx    |   2 +-
 ...ore_metrics_collectors_server_internal.mdx |   2 +-
 ...n_core_metrics_collectors_server_mocks.mdx |   2 +-
 api_docs/kbn_core_metrics_server.mdx          |   2 +-
 api_docs/kbn_core_metrics_server_internal.mdx |   2 +-
 api_docs/kbn_core_metrics_server_mocks.mdx    |   2 +-
 api_docs/kbn_core_mount_utils_browser.mdx     |   2 +-
 api_docs/kbn_core_node_server.mdx             |   2 +-
 api_docs/kbn_core_node_server_internal.mdx    |   2 +-
 api_docs/kbn_core_node_server_mocks.mdx       |   2 +-
 api_docs/kbn_core_notifications_browser.mdx   |   2 +-
 ...bn_core_notifications_browser_internal.mdx |   2 +-
 .../kbn_core_notifications_browser_mocks.mdx  |   2 +-
 api_docs/kbn_core_overlays_browser.mdx        |   2 +-
 .../kbn_core_overlays_browser_internal.mdx    |   2 +-
 api_docs/kbn_core_overlays_browser_mocks.mdx  |   2 +-
 api_docs/kbn_core_plugins_browser.mdx         |   2 +-
 api_docs/kbn_core_plugins_browser_mocks.mdx   |   2 +-
 api_docs/kbn_core_plugins_server.mdx          |   2 +-
 api_docs/kbn_core_plugins_server_mocks.mdx    |   2 +-
 api_docs/kbn_core_preboot_server.mdx          |   2 +-
 api_docs/kbn_core_preboot_server_mocks.mdx    |   2 +-
 api_docs/kbn_core_rendering_browser_mocks.mdx |   2 +-
 .../kbn_core_rendering_server_internal.mdx    |   2 +-
 api_docs/kbn_core_rendering_server_mocks.mdx  |   2 +-
 api_docs/kbn_core_root_server_internal.mdx    |   2 +-
 ...ore_saved_objects_api_browser.devdocs.json |  32 ++--
 .../kbn_core_saved_objects_api_browser.mdx    |   2 +-
 .../kbn_core_saved_objects_api_server.mdx     |   2 +-
 ...core_saved_objects_api_server_internal.mdx |   2 +-
 ...bn_core_saved_objects_api_server_mocks.mdx |   2 +-
 ...ore_saved_objects_base_server_internal.mdx |   2 +-
 ...n_core_saved_objects_base_server_mocks.mdx |   2 +-
 api_docs/kbn_core_saved_objects_browser.mdx   |   2 +-
 ...bn_core_saved_objects_browser_internal.mdx |   2 +-
 .../kbn_core_saved_objects_browser_mocks.mdx  |   2 +-
 api_docs/kbn_core_saved_objects_common.mdx    |   2 +-
 ..._objects_import_export_server_internal.mdx |   2 +-
 ...ved_objects_import_export_server_mocks.mdx |   2 +-
 ...aved_objects_migration_server_internal.mdx |   2 +-
 ...e_saved_objects_migration_server_mocks.mdx |   2 +-
 api_docs/kbn_core_saved_objects_server.mdx    |   2 +-
 ...kbn_core_saved_objects_server_internal.mdx |   2 +-
 .../kbn_core_saved_objects_server_mocks.mdx   |   2 +-
 .../kbn_core_saved_objects_utils_server.mdx   |   2 +-
 api_docs/kbn_core_status_common.mdx           |   2 +-
 api_docs/kbn_core_status_common_internal.mdx  |   2 +-
 api_docs/kbn_core_status_server.mdx           |   2 +-
 api_docs/kbn_core_status_server_internal.mdx  |   2 +-
 api_docs/kbn_core_status_server_mocks.mdx     |   2 +-
 ...core_test_helpers_deprecations_getters.mdx |   2 +-
 ...n_core_test_helpers_http_setup_browser.mdx |   2 +-
 api_docs/kbn_core_test_helpers_kbn_server.mdx |   2 +-
 ...n_core_test_helpers_so_type_serializer.mdx |   2 +-
 api_docs/kbn_core_test_helpers_test_utils.mdx |   2 +-
 api_docs/kbn_core_theme_browser.mdx           |   2 +-
 api_docs/kbn_core_theme_browser_internal.mdx  |   2 +-
 api_docs/kbn_core_theme_browser_mocks.mdx     |   2 +-
 api_docs/kbn_core_ui_settings_browser.mdx     |   2 +-
 .../kbn_core_ui_settings_browser_internal.mdx |   2 +-
 .../kbn_core_ui_settings_browser_mocks.mdx    |   2 +-
 api_docs/kbn_core_ui_settings_common.mdx      |   2 +-
 api_docs/kbn_core_ui_settings_server.mdx      |   2 +-
 .../kbn_core_ui_settings_server_internal.mdx  |   2 +-
 .../kbn_core_ui_settings_server_mocks.mdx     |   2 +-
 api_docs/kbn_core_usage_data_server.mdx       |   2 +-
 .../kbn_core_usage_data_server_internal.mdx   |   2 +-
 api_docs/kbn_core_usage_data_server_mocks.mdx |   2 +-
 api_docs/kbn_crypto.mdx                       |   2 +-
 api_docs/kbn_crypto_browser.mdx               |   2 +-
 api_docs/kbn_cypress_config.mdx               |   2 +-
 api_docs/kbn_datemath.mdx                     |   2 +-
 api_docs/kbn_dev_cli_errors.mdx               |   2 +-
 api_docs/kbn_dev_cli_runner.mdx               |   2 +-
 api_docs/kbn_dev_proc_runner.mdx              |   2 +-
 api_docs/kbn_dev_utils.mdx                    |   2 +-
 api_docs/kbn_doc_links.devdocs.json           |   2 +-
 api_docs/kbn_doc_links.mdx                    |   2 +-
 api_docs/kbn_docs_utils.mdx                   |   2 +-
 api_docs/kbn_ebt_tools.mdx                    |   2 +-
 api_docs/kbn_ecs.mdx                          |   2 +-
 ...bn_ecs_data_quality_dashboard.devdocs.json | 171 ++++++++++++++++++
 api_docs/kbn_ecs_data_quality_dashboard.mdx   |  33 ++++
 api_docs/kbn_es.mdx                           |   2 +-
 api_docs/kbn_es_archiver.mdx                  |   2 +-
 api_docs/kbn_es_errors.mdx                    |   2 +-
 api_docs/kbn_es_query.mdx                     |   2 +-
 api_docs/kbn_es_types.mdx                     |   2 +-
 api_docs/kbn_eslint_plugin_imports.mdx        |   2 +-
 api_docs/kbn_field_types.mdx                  |   2 +-
 api_docs/kbn_find_used_node_modules.mdx       |   2 +-
 .../kbn_ftr_common_functional_services.mdx    |   2 +-
 api_docs/kbn_generate.mdx                     |   2 +-
 api_docs/kbn_get_repo_files.mdx               |   2 +-
 api_docs/kbn_guided_onboarding.devdocs.json   |   6 +-
 api_docs/kbn_guided_onboarding.mdx            |   2 +-
 api_docs/kbn_handlebars.mdx                   |   2 +-
 api_docs/kbn_hapi_mocks.mdx                   |   2 +-
 api_docs/kbn_health_gateway_server.mdx        |   2 +-
 api_docs/kbn_home_sample_data_card.mdx        |   2 +-
 api_docs/kbn_home_sample_data_tab.mdx         |   2 +-
 api_docs/kbn_i18n.mdx                         |   2 +-
 api_docs/kbn_i18n_react.mdx                   |   2 +-
 api_docs/kbn_import_resolver.mdx              |   2 +-
 api_docs/kbn_interpreter.mdx                  |   2 +-
 api_docs/kbn_io_ts_utils.mdx                  |   2 +-
 api_docs/kbn_jest_serializers.mdx             |   2 +-
 api_docs/kbn_journeys.mdx                     |   2 +-
 api_docs/kbn_json_ast.mdx                     |   2 +-
 api_docs/kbn_kibana_manifest_schema.mdx       |   2 +-
 .../kbn_language_documentation_popover.mdx    |   2 +-
 api_docs/kbn_logging.mdx                      |   2 +-
 api_docs/kbn_logging_mocks.mdx                |   2 +-
 api_docs/kbn_managed_vscode_config.mdx        |   2 +-
 api_docs/kbn_mapbox_gl.mdx                    |   2 +-
 api_docs/kbn_ml_agg_utils.mdx                 |   2 +-
 api_docs/kbn_ml_date_picker.mdx               |   2 +-
 api_docs/kbn_ml_is_defined.mdx                |   2 +-
 api_docs/kbn_ml_is_populated_object.mdx       |   2 +-
 api_docs/kbn_ml_local_storage.mdx             |   2 +-
 api_docs/kbn_ml_nested_property.mdx           |   2 +-
 api_docs/kbn_ml_query_utils.mdx               |   2 +-
 api_docs/kbn_ml_string_hash.mdx               |   2 +-
 api_docs/kbn_ml_url_state.mdx                 |   2 +-
 api_docs/kbn_monaco.mdx                       |   2 +-
 api_docs/kbn_optimizer.mdx                    |   2 +-
 api_docs/kbn_optimizer_webpack_helpers.mdx    |   2 +-
 api_docs/kbn_osquery_io_ts_types.mdx          |   2 +-
 ..._performance_testing_dataset_extractor.mdx |   2 +-
 api_docs/kbn_plugin_generator.mdx             |   2 +-
 api_docs/kbn_plugin_helpers.mdx               |   2 +-
 api_docs/kbn_react_field.mdx                  |   2 +-
 api_docs/kbn_repo_file_maps.mdx               |   2 +-
 api_docs/kbn_repo_linter.mdx                  |   2 +-
 api_docs/kbn_repo_path.mdx                    |   2 +-
 api_docs/kbn_repo_source_classifier.mdx       |   2 +-
 api_docs/kbn_rison.mdx                        |   2 +-
 api_docs/kbn_rule_data_utils.mdx              |   2 +-
 ...securitysolution_autocomplete.devdocs.json |   4 +-
 .../kbn_securitysolution_autocomplete.mdx     |   2 +-
 api_docs/kbn_securitysolution_ecs.mdx         |   2 +-
 api_docs/kbn_securitysolution_es_utils.mdx    |   2 +-
 ...ritysolution_exception_list_components.mdx |   2 +-
 api_docs/kbn_securitysolution_hook_utils.mdx  |   2 +-
 ..._securitysolution_io_ts_alerting_types.mdx |   2 +-
 .../kbn_securitysolution_io_ts_list_types.mdx |   2 +-
 ..._securitysolution_io_ts_types.devdocs.json |   6 +-
 api_docs/kbn_securitysolution_io_ts_types.mdx |   2 +-
 api_docs/kbn_securitysolution_io_ts_utils.mdx |   2 +-
 api_docs/kbn_securitysolution_list_api.mdx    |   2 +-
 .../kbn_securitysolution_list_constants.mdx   |   2 +-
 api_docs/kbn_securitysolution_list_hooks.mdx  |   2 +-
 ...n_securitysolution_list_utils.devdocs.json | 156 ++++++++++++++++
 api_docs/kbn_securitysolution_list_utils.mdx  |   4 +-
 api_docs/kbn_securitysolution_rules.mdx       |   2 +-
 api_docs/kbn_securitysolution_t_grid.mdx      |   2 +-
 api_docs/kbn_securitysolution_utils.mdx       |   2 +-
 api_docs/kbn_server_http_tools.mdx            |   2 +-
 api_docs/kbn_server_route_repository.mdx      |   2 +-
 api_docs/kbn_shared_svg.mdx                   |   2 +-
 api_docs/kbn_shared_ux_avatar_solution.mdx    |   2 +-
 ...ared_ux_avatar_user_profile_components.mdx |   2 +-
 .../kbn_shared_ux_button_exit_full_screen.mdx |   2 +-
 ...hared_ux_button_exit_full_screen_mocks.mdx |   2 +-
 api_docs/kbn_shared_ux_button_toolbar.mdx     |   2 +-
 api_docs/kbn_shared_ux_card_no_data.mdx       |   2 +-
 api_docs/kbn_shared_ux_card_no_data_mocks.mdx |   2 +-
 api_docs/kbn_shared_ux_file_context.mdx       |   2 +-
 api_docs/kbn_shared_ux_file_image.mdx         |   2 +-
 api_docs/kbn_shared_ux_file_image_mocks.mdx   |   2 +-
 api_docs/kbn_shared_ux_file_mocks.mdx         |   2 +-
 api_docs/kbn_shared_ux_file_picker.mdx        |   2 +-
 api_docs/kbn_shared_ux_file_upload.mdx        |   2 +-
 api_docs/kbn_shared_ux_file_util.mdx          |   2 +-
 api_docs/kbn_shared_ux_link_redirect_app.mdx  |   2 +-
 .../kbn_shared_ux_link_redirect_app_mocks.mdx |   2 +-
 api_docs/kbn_shared_ux_markdown.mdx           |   2 +-
 api_docs/kbn_shared_ux_markdown_mocks.mdx     |   2 +-
 .../kbn_shared_ux_page_analytics_no_data.mdx  |   2 +-
 ...shared_ux_page_analytics_no_data_mocks.mdx |   2 +-
 .../kbn_shared_ux_page_kibana_no_data.mdx     |   2 +-
 ...bn_shared_ux_page_kibana_no_data_mocks.mdx |   2 +-
 .../kbn_shared_ux_page_kibana_template.mdx    |   2 +-
 ...n_shared_ux_page_kibana_template_mocks.mdx |   2 +-
 api_docs/kbn_shared_ux_page_no_data.mdx       |   2 +-
 .../kbn_shared_ux_page_no_data_config.mdx     |   2 +-
 ...bn_shared_ux_page_no_data_config_mocks.mdx |   2 +-
 api_docs/kbn_shared_ux_page_no_data_mocks.mdx |   2 +-
 api_docs/kbn_shared_ux_page_solution_nav.mdx  |   2 +-
 .../kbn_shared_ux_prompt_no_data_views.mdx    |   2 +-
 ...n_shared_ux_prompt_no_data_views_mocks.mdx |   2 +-
 api_docs/kbn_shared_ux_prompt_not_found.mdx   |   2 +-
 api_docs/kbn_shared_ux_router.mdx             |   2 +-
 api_docs/kbn_shared_ux_router_mocks.mdx       |   2 +-
 api_docs/kbn_shared_ux_storybook_config.mdx   |   2 +-
 api_docs/kbn_shared_ux_storybook_mock.mdx     |   2 +-
 api_docs/kbn_shared_ux_utility.mdx            |   2 +-
 api_docs/kbn_slo_schema.mdx                   |   2 +-
 api_docs/kbn_some_dev_log.mdx                 |   2 +-
 api_docs/kbn_std.mdx                          |   2 +-
 api_docs/kbn_stdio_dev_helpers.mdx            |   2 +-
 api_docs/kbn_storybook.mdx                    |   2 +-
 api_docs/kbn_telemetry_tools.mdx              |   2 +-
 api_docs/kbn_test.mdx                         |   2 +-
 api_docs/kbn_test_jest_helpers.mdx            |   2 +-
 api_docs/kbn_test_subj_selector.mdx           |   2 +-
 api_docs/kbn_tooling_log.mdx                  |   2 +-
 api_docs/kbn_ts_projects.mdx                  |   2 +-
 api_docs/kbn_typed_react_router_config.mdx    |   2 +-
 api_docs/kbn_ui_actions_browser.mdx           |   2 +-
 api_docs/kbn_ui_shared_deps_src.mdx           |   2 +-
 api_docs/kbn_ui_theme.mdx                     |   2 +-
 api_docs/kbn_user_profile_components.mdx      |   2 +-
 api_docs/kbn_utility_types.mdx                |   2 +-
 api_docs/kbn_utility_types_jest.mdx           |   2 +-
 api_docs/kbn_utils.mdx                        |   2 +-
 api_docs/kbn_yarn_lock_validator.mdx          |   2 +-
 api_docs/kibana_overview.mdx                  |   2 +-
 api_docs/kibana_react.mdx                     |   2 +-
 api_docs/kibana_utils.mdx                     |   2 +-
 api_docs/kubernetes_security.mdx              |   2 +-
 api_docs/lens.mdx                             |   2 +-
 api_docs/license_api_guard.mdx                |   2 +-
 api_docs/license_management.mdx               |   2 +-
 api_docs/licensing.mdx                        |   2 +-
 api_docs/lists.mdx                            |   2 +-
 api_docs/management.mdx                       |   2 +-
 api_docs/maps.mdx                             |   2 +-
 api_docs/maps_ems.mdx                         |   2 +-
 api_docs/ml.devdocs.json                      |  21 +++
 api_docs/ml.mdx                               |   4 +-
 api_docs/monitoring.mdx                       |   2 +-
 api_docs/monitoring_collection.mdx            |   2 +-
 api_docs/navigation.mdx                       |   2 +-
 api_docs/newsfeed.mdx                         |   2 +-
 api_docs/notifications.mdx                    |   2 +-
 api_docs/observability.devdocs.json           | 134 --------------
 api_docs/observability.mdx                    |   4 +-
 api_docs/osquery.mdx                          |   2 +-
 api_docs/plugin_directory.mdx                 |  28 +--
 api_docs/presentation_util.mdx                |   2 +-
 api_docs/profiling.mdx                        |   2 +-
 api_docs/remote_clusters.mdx                  |   2 +-
 api_docs/reporting.mdx                        |   2 +-
 api_docs/rollup.mdx                           |   2 +-
 api_docs/rule_registry.devdocs.json           |  77 +++++---
 api_docs/rule_registry.mdx                    |   4 +-
 api_docs/runtime_fields.mdx                   |   2 +-
 api_docs/saved_objects.mdx                    |   2 +-
 api_docs/saved_objects_finder.mdx             |   2 +-
 api_docs/saved_objects_management.mdx         |   2 +-
 api_docs/saved_objects_tagging.mdx            |   2 +-
 api_docs/saved_objects_tagging_oss.mdx        |   2 +-
 api_docs/saved_search.mdx                     |   2 +-
 api_docs/screenshot_mode.mdx                  |   2 +-
 api_docs/screenshotting.mdx                   |   2 +-
 api_docs/security.mdx                         |   2 +-
 api_docs/security_solution.devdocs.json       |  64 ++++++-
 api_docs/security_solution.mdx                |   4 +-
 api_docs/session_view.mdx                     |   2 +-
 api_docs/share.mdx                            |   2 +-
 api_docs/snapshot_restore.mdx                 |   2 +-
 api_docs/spaces.mdx                           |   2 +-
 api_docs/stack_alerts.mdx                     |   2 +-
 api_docs/stack_connectors.mdx                 |   2 +-
 api_docs/task_manager.mdx                     |   2 +-
 api_docs/telemetry.mdx                        |   2 +-
 api_docs/telemetry_collection_manager.mdx     |   2 +-
 api_docs/telemetry_collection_xpack.mdx       |   2 +-
 api_docs/telemetry_management_section.mdx     |   2 +-
 api_docs/threat_intelligence.mdx              |   2 +-
 api_docs/timelines.mdx                        |   2 +-
 api_docs/transform.mdx                        |   2 +-
 api_docs/triggers_actions_ui.devdocs.json     |  26 ++-
 api_docs/triggers_actions_ui.mdx              |   4 +-
 api_docs/ui_actions.mdx                       |   2 +-
 api_docs/ui_actions_enhanced.mdx              |   2 +-
 api_docs/unified_field_list.mdx               |   2 +-
 api_docs/unified_histogram.mdx                |   2 +-
 api_docs/unified_search.mdx                   |   2 +-
 api_docs/unified_search_autocomplete.mdx      |   2 +-
 api_docs/url_forwarding.mdx                   |   2 +-
 api_docs/usage_collection.mdx                 |   2 +-
 api_docs/ux.mdx                               |   2 +-
 api_docs/vis_default_editor.mdx               |   2 +-
 api_docs/vis_type_gauge.mdx                   |   2 +-
 api_docs/vis_type_heatmap.mdx                 |   2 +-
 api_docs/vis_type_pie.mdx                     |   2 +-
 api_docs/vis_type_table.mdx                   |   2 +-
 api_docs/vis_type_timelion.mdx                |   2 +-
 api_docs/vis_type_timeseries.mdx              |   2 +-
 api_docs/vis_type_vega.mdx                    |   2 +-
 api_docs/vis_type_vislib.mdx                  |   2 +-
 api_docs/vis_type_xy.mdx                      |   2 +-
 api_docs/visualizations.mdx                   |   2 +-
 498 files changed, 1352 insertions(+), 836 deletions(-)
 create mode 100644 api_docs/ecs_data_quality_dashboard.devdocs.json
 create mode 100644 api_docs/ecs_data_quality_dashboard.mdx
 create mode 100644 api_docs/kbn_ecs_data_quality_dashboard.devdocs.json
 create mode 100644 api_docs/kbn_ecs_data_quality_dashboard.mdx

diff --git a/api_docs/actions.mdx b/api_docs/actions.mdx
index 6088695f37f3d..3ba970f4118c1 100644
--- a/api_docs/actions.mdx
+++ b/api_docs/actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/actions
 title: "actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the actions plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'actions']
 ---
 import actionsObj from './actions.devdocs.json';
diff --git a/api_docs/advanced_settings.mdx b/api_docs/advanced_settings.mdx
index 1e8a774d93c54..db3fe435f1a30 100644
--- a/api_docs/advanced_settings.mdx
+++ b/api_docs/advanced_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/advancedSettings
 title: "advancedSettings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the advancedSettings plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'advancedSettings']
 ---
 import advancedSettingsObj from './advanced_settings.devdocs.json';
diff --git a/api_docs/aiops.mdx b/api_docs/aiops.mdx
index d39921cf49bb1..5af3e2fb16988 100644
--- a/api_docs/aiops.mdx
+++ b/api_docs/aiops.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/aiops
 title: "aiops"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the aiops plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'aiops']
 ---
 import aiopsObj from './aiops.devdocs.json';
diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx
index 0a7fc408c7d96..cbc14cce11e3e 100644
--- a/api_docs/alerting.mdx
+++ b/api_docs/alerting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/alerting
 title: "alerting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the alerting plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'alerting']
 ---
 import alertingObj from './alerting.devdocs.json';
diff --git a/api_docs/apm.devdocs.json b/api_docs/apm.devdocs.json
index 262193c912651..b51fad1b153ba 100644
--- a/api_docs/apm.devdocs.json
+++ b/api_docs/apm.devdocs.json
@@ -810,7 +810,7 @@
         "label": "APIEndpoint",
         "description": [],
         "signature": [
-          "\"POST /internal/apm/data_view/static\" | \"GET /internal/apm/data_view/title\" | \"GET /internal/apm/environments\" | \"GET /internal/apm/services/{serviceName}/errors/groups/main_statistics\" | \"GET /internal/apm/services/{serviceName}/errors/groups/main_statistics_by_transaction_name\" | \"POST /internal/apm/services/{serviceName}/errors/groups/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/samples\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/error/{errorId}\" | \"GET /internal/apm/services/{serviceName}/errors/distribution\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/top_erroneous_transactions\" | \"POST /internal/apm/latency/overall_distribution/transactions\" | \"GET /internal/apm/services/{serviceName}/metrics/charts\" | \"GET /internal/apm/services/{serviceName}/metrics/nodes\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/charts\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/summary\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/functions_overview\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/active_instances\" | \"GET /internal/apm/observability_overview\" | \"GET /internal/apm/observability_overview/has_data\" | \"GET /internal/apm/service-map\" | \"GET /internal/apm/service-map/service/{serviceName}\" | \"GET /internal/apm/service-map/dependency\" | \"GET /internal/apm/services\" | \"POST /internal/apm/services/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/metadata/details\" | \"GET /internal/apm/services/{serviceName}/metadata/icons\" | \"GET /internal/apm/services/{serviceName}/agent\" | \"GET /internal/apm/services/{serviceName}/transaction_types\" | \"GET /internal/apm/services/{serviceName}/node/{serviceNodeName}/metadata\" | \"GET /api/apm/services/{serviceName}/annotation/search\" | \"POST /api/apm/services/{serviceName}/annotation\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/details/{serviceNodeName}\" | \"GET /internal/apm/services/{serviceName}/throughput\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/main_statistics\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/dependencies\" | \"GET /internal/apm/services/{serviceName}/dependencies/breakdown\" | \"GET /internal/apm/services/{serviceName}/anomaly_charts\" | \"GET /internal/apm/services/{serviceName}/alerts_count\" | \"GET /internal/apm/service-groups\" | \"GET /internal/apm/service-group\" | \"POST /internal/apm/service-group\" | \"DELETE /internal/apm/service-group\" | \"GET /internal/apm/service-group/services\" | \"GET /internal/apm/service-group/counts\" | \"GET /internal/apm/suggestions\" | \"GET /internal/apm/traces/{traceId}\" | \"GET /internal/apm/traces\" | \"GET /internal/apm/traces/{traceId}/root_transaction\" | \"GET /internal/apm/transactions/{transactionId}\" | \"GET /internal/apm/traces/find\" | \"POST /internal/apm/traces/aggregated_critical_path\" | \"GET /internal/apm/traces/{traceId}/transactions/{transactionId}\" | \"GET /internal/apm/traces/{traceId}/spans/{spanId}\" | \"GET /internal/apm/services/{serviceName}/transactions/groups/main_statistics\" | \"GET /internal/apm/services/{serviceName}/transactions/groups/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/latency\" | \"GET /internal/apm/services/{serviceName}/transactions/traces/samples\" | \"GET /internal/apm/services/{serviceName}/transaction/charts/breakdown\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/error_rate\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/coldstart_rate\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/coldstart_rate_by_transaction_name\" | \"GET /internal/apm/rule_types/transaction_error_rate/chart_preview\" | \"GET /internal/apm/rule_types/transaction_duration/chart_preview\" | \"GET /internal/apm/rule_types/error_count/chart_preview\" | \"GET /api/apm/settings/agent-configuration\" | \"GET /api/apm/settings/agent-configuration/view\" | \"DELETE /api/apm/settings/agent-configuration\" | \"PUT /api/apm/settings/agent-configuration\" | \"POST /api/apm/settings/agent-configuration/search\" | \"GET /api/apm/settings/agent-configuration/environments\" | \"GET /api/apm/settings/agent-configuration/agent_name\" | \"GET /internal/apm/settings/anomaly-detection/jobs\" | \"POST /internal/apm/settings/anomaly-detection/jobs\" | \"GET /internal/apm/settings/anomaly-detection/environments\" | \"POST /internal/apm/settings/anomaly-detection/update_to_v3\" | \"GET /internal/apm/settings/apm-index-settings\" | \"GET /internal/apm/settings/apm-indices\" | \"POST /internal/apm/settings/apm-indices/save\" | \"GET /internal/apm/settings/custom_links/transaction\" | \"GET /internal/apm/settings/custom_links\" | \"POST /internal/apm/settings/custom_links\" | \"PUT /internal/apm/settings/custom_links/{id}\" | \"DELETE /internal/apm/settings/custom_links/{id}\" | \"GET /api/apm/sourcemaps\" | \"POST /api/apm/sourcemaps\" | \"DELETE /api/apm/sourcemaps/{id}\" | \"POST /internal/apm/sourcemaps/migrate_fleet_artifacts\" | \"GET /internal/apm/fleet/has_apm_policies\" | \"GET /internal/apm/fleet/agents\" | \"POST /api/apm/fleet/apm_server_schema\" | \"GET /internal/apm/fleet/apm_server_schema/unsupported\" | \"GET /internal/apm/fleet/migration_check\" | \"POST /internal/apm/fleet/cloud_apm_package_policy\" | \"GET /internal/apm/fleet/java_agent_versions\" | \"GET /internal/apm/dependencies/top_dependencies\" | \"GET /internal/apm/dependencies/upstream_services\" | \"GET /internal/apm/dependencies/metadata\" | \"GET /internal/apm/dependencies/charts/latency\" | \"GET /internal/apm/dependencies/charts/throughput\" | \"GET /internal/apm/dependencies/charts/error_rate\" | \"GET /internal/apm/dependencies/operations\" | \"GET /internal/apm/dependencies/charts/distribution\" | \"GET /internal/apm/dependencies/operations/spans\" | \"GET /internal/apm/correlations/field_candidates/transactions\" | \"GET /internal/apm/correlations/field_value_stats/transactions\" | \"POST /internal/apm/correlations/field_value_pairs/transactions\" | \"POST /internal/apm/correlations/significant_correlations/transactions\" | \"POST /internal/apm/correlations/p_values/transactions\" | \"GET /internal/apm/fallback_to_transactions\" | \"GET /internal/apm/has_data\" | \"GET /internal/apm/event_metadata/{processorEvent}/{id}\" | \"GET /internal/apm/agent_keys\" | \"GET /internal/apm/agent_keys/privileges\" | \"POST /internal/apm/api_key/invalidate\" | \"POST /api/apm/agent_keys\" | \"GET /internal/apm/storage_explorer\" | \"GET /internal/apm/services/{serviceName}/storage_details\" | \"GET /internal/apm/storage_chart\" | \"GET /internal/apm/storage_explorer/privileges\" | \"GET /internal/apm/storage_explorer_summary_stats\" | \"GET /internal/apm/storage_explorer/is_cross_cluster_search\" | \"GET /internal/apm/storage_explorer/get_services\" | \"GET /internal/apm/traces/{traceId}/span_links/{spanId}/parents\" | \"GET /internal/apm/traces/{traceId}/span_links/{spanId}/children\" | \"GET /internal/apm/services/{serviceName}/infrastructure_attributes\" | \"GET /internal/apm/debug-telemetry\" | \"GET /internal/apm/time_range_metadata\" | \"GET /internal/apm/settings/labs\" | \"GET /internal/apm/get_agents_per_service\" | \"GET /internal/apm/services/{serviceName}/agent_instances\" | \"GET /internal/apm/services/{serviceName}/mobile/filters\" | \"GET /internal/apm/mobile-services/{serviceName}/transactions/charts/sessions\" | \"GET /internal/apm/mobile-services/{serviceName}/transactions/charts/http_requests\" | \"GET /internal/apm/mobile-services/{serviceName}/stats\""
+          "\"POST /internal/apm/data_view/static\" | \"GET /internal/apm/data_view/title\" | \"GET /internal/apm/environments\" | \"GET /internal/apm/services/{serviceName}/errors/groups/main_statistics\" | \"GET /internal/apm/services/{serviceName}/errors/groups/main_statistics_by_transaction_name\" | \"POST /internal/apm/services/{serviceName}/errors/groups/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/samples\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/error/{errorId}\" | \"GET /internal/apm/services/{serviceName}/errors/distribution\" | \"GET /internal/apm/services/{serviceName}/errors/{groupId}/top_erroneous_transactions\" | \"POST /internal/apm/latency/overall_distribution/transactions\" | \"GET /internal/apm/services/{serviceName}/metrics/charts\" | \"GET /internal/apm/services/{serviceName}/metrics/nodes\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/charts\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/summary\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/functions_overview\" | \"GET /internal/apm/services/{serviceName}/metrics/serverless/active_instances\" | \"GET /internal/apm/observability_overview\" | \"GET /internal/apm/observability_overview/has_data\" | \"GET /internal/apm/service-map\" | \"GET /internal/apm/service-map/service/{serviceName}\" | \"GET /internal/apm/service-map/dependency\" | \"GET /internal/apm/services\" | \"POST /internal/apm/services/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/metadata/details\" | \"GET /internal/apm/services/{serviceName}/metadata/icons\" | \"GET /internal/apm/services/{serviceName}/agent\" | \"GET /internal/apm/services/{serviceName}/transaction_types\" | \"GET /internal/apm/services/{serviceName}/node/{serviceNodeName}/metadata\" | \"GET /api/apm/services/{serviceName}/annotation/search\" | \"POST /api/apm/services/{serviceName}/annotation\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/details/{serviceNodeName}\" | \"GET /internal/apm/services/{serviceName}/throughput\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/main_statistics\" | \"GET /internal/apm/services/{serviceName}/service_overview_instances/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/dependencies\" | \"GET /internal/apm/services/{serviceName}/dependencies/breakdown\" | \"GET /internal/apm/services/{serviceName}/anomaly_charts\" | \"GET /internal/apm/services/{serviceName}/alerts_count\" | \"GET /internal/apm/service-groups\" | \"GET /internal/apm/service-group\" | \"POST /internal/apm/service-group\" | \"DELETE /internal/apm/service-group\" | \"GET /internal/apm/service-group/services\" | \"GET /internal/apm/service-group/counts\" | \"GET /internal/apm/suggestions\" | \"GET /internal/apm/traces/{traceId}\" | \"GET /internal/apm/traces\" | \"GET /internal/apm/traces/{traceId}/root_transaction\" | \"GET /internal/apm/transactions/{transactionId}\" | \"GET /internal/apm/traces/find\" | \"POST /internal/apm/traces/aggregated_critical_path\" | \"GET /internal/apm/traces/{traceId}/transactions/{transactionId}\" | \"GET /internal/apm/traces/{traceId}/spans/{spanId}\" | \"GET /internal/apm/services/{serviceName}/transactions/groups/main_statistics\" | \"GET /internal/apm/services/{serviceName}/transactions/groups/detailed_statistics\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/latency\" | \"GET /internal/apm/services/{serviceName}/transactions/traces/samples\" | \"GET /internal/apm/services/{serviceName}/transaction/charts/breakdown\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/error_rate\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/coldstart_rate\" | \"GET /internal/apm/services/{serviceName}/transactions/charts/coldstart_rate_by_transaction_name\" | \"GET /internal/apm/rule_types/transaction_error_rate/chart_preview\" | \"GET /internal/apm/rule_types/transaction_duration/chart_preview\" | \"GET /internal/apm/rule_types/error_count/chart_preview\" | \"GET /api/apm/settings/agent-configuration\" | \"GET /api/apm/settings/agent-configuration/view\" | \"DELETE /api/apm/settings/agent-configuration\" | \"PUT /api/apm/settings/agent-configuration\" | \"POST /api/apm/settings/agent-configuration/search\" | \"GET /api/apm/settings/agent-configuration/environments\" | \"GET /api/apm/settings/agent-configuration/agent_name\" | \"GET /internal/apm/settings/anomaly-detection/jobs\" | \"POST /internal/apm/settings/anomaly-detection/jobs\" | \"GET /internal/apm/settings/anomaly-detection/environments\" | \"POST /internal/apm/settings/anomaly-detection/update_to_v3\" | \"GET /internal/apm/settings/apm-index-settings\" | \"GET /internal/apm/settings/apm-indices\" | \"POST /internal/apm/settings/apm-indices/save\" | \"GET /internal/apm/settings/custom_links/transaction\" | \"GET /internal/apm/settings/custom_links\" | \"POST /internal/apm/settings/custom_links\" | \"PUT /internal/apm/settings/custom_links/{id}\" | \"DELETE /internal/apm/settings/custom_links/{id}\" | \"GET /api/apm/sourcemaps\" | \"POST /api/apm/sourcemaps\" | \"DELETE /api/apm/sourcemaps/{id}\" | \"POST /internal/apm/sourcemaps/migrate_fleet_artifacts\" | \"GET /internal/apm/fleet/has_apm_policies\" | \"GET /internal/apm/fleet/agents\" | \"POST /api/apm/fleet/apm_server_schema\" | \"GET /internal/apm/fleet/apm_server_schema/unsupported\" | \"GET /internal/apm/fleet/migration_check\" | \"POST /internal/apm/fleet/cloud_apm_package_policy\" | \"GET /internal/apm/fleet/java_agent_versions\" | \"GET /internal/apm/dependencies/top_dependencies\" | \"GET /internal/apm/dependencies/upstream_services\" | \"GET /internal/apm/dependencies/metadata\" | \"GET /internal/apm/dependencies/charts/latency\" | \"GET /internal/apm/dependencies/charts/throughput\" | \"GET /internal/apm/dependencies/charts/error_rate\" | \"GET /internal/apm/dependencies/operations\" | \"GET /internal/apm/dependencies/charts/distribution\" | \"GET /internal/apm/dependencies/operations/spans\" | \"GET /internal/apm/correlations/field_candidates/transactions\" | \"GET /internal/apm/correlations/field_value_stats/transactions\" | \"POST /internal/apm/correlations/field_value_pairs/transactions\" | \"POST /internal/apm/correlations/significant_correlations/transactions\" | \"POST /internal/apm/correlations/p_values/transactions\" | \"GET /internal/apm/fallback_to_transactions\" | \"GET /internal/apm/has_data\" | \"GET /internal/apm/event_metadata/{processorEvent}/{id}\" | \"GET /internal/apm/agent_keys\" | \"GET /internal/apm/agent_keys/privileges\" | \"POST /internal/apm/api_key/invalidate\" | \"POST /api/apm/agent_keys\" | \"GET /internal/apm/storage_explorer\" | \"GET /internal/apm/services/{serviceName}/storage_details\" | \"GET /internal/apm/storage_chart\" | \"GET /internal/apm/storage_explorer/privileges\" | \"GET /internal/apm/storage_explorer_summary_stats\" | \"GET /internal/apm/storage_explorer/is_cross_cluster_search\" | \"GET /internal/apm/storage_explorer/get_services\" | \"GET /internal/apm/traces/{traceId}/span_links/{spanId}/parents\" | \"GET /internal/apm/traces/{traceId}/span_links/{spanId}/children\" | \"GET /internal/apm/services/{serviceName}/infrastructure_attributes\" | \"GET /internal/apm/debug-telemetry\" | \"GET /internal/apm/time_range_metadata\" | \"GET /internal/apm/settings/labs\" | \"GET /internal/apm/get_agents_per_service\" | \"GET /internal/apm/services/{serviceName}/agent_instances\" | \"GET /internal/apm/services/{serviceName}/mobile/filters\" | \"GET /internal/apm/mobile-services/{serviceName}/transactions/charts/sessions\" | \"GET /internal/apm/mobile-services/{serviceName}/transactions/charts/http_requests\" | \"GET /internal/apm/mobile-services/{serviceName}/stats\" | \"GET /internal/apm/mobile-services/{serviceName}/location/stats\""
         ],
         "path": "x-pack/plugins/apm/server/routes/apm_routes/get_global_apm_server_route_repository.ts",
         "deprecated": false,
@@ -872,7 +872,73 @@
         "label": "APMServerRouteRepository",
         "description": [],
         "signature": [
-          "{ \"GET /internal/apm/mobile-services/{serviceName}/stats\": ",
+          "{ \"GET /internal/apm/mobile-services/{serviceName}/location/stats\": ",
+          {
+            "pluginId": "@kbn/server-route-repository",
+            "scope": "public",
+            "docId": "kibKbnServerRouteRepositoryPluginApi",
+            "section": "def-public.ServerRoute",
+            "text": "ServerRoute"
+          },
+          "<\"GET /internal/apm/mobile-services/{serviceName}/location/stats\", ",
+          "TypeC",
+          "<{ path: ",
+          "TypeC",
+          "<{ serviceName: ",
+          "StringC",
+          "; }>; query: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ kuery: ",
+          "StringC",
+          "; }>, ",
+          "TypeC",
+          "<{ start: ",
+          "Type",
+          "<number, string, unknown>; end: ",
+          "Type",
+          "<number, string, unknown>; }>, ",
+          "TypeC",
+          "<{ environment: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"ENVIRONMENT_NOT_DEFINED\">, ",
+          "LiteralC",
+          "<\"ENVIRONMENT_ALL\">, ",
+          "BrandC",
+          "<",
+          "StringC",
+          ", ",
+          {
+            "pluginId": "@kbn/io-ts-utils",
+            "scope": "common",
+            "docId": "kibKbnIoTsUtilsPluginApi",
+            "section": "def-common.NonEmptyStringBrand",
+            "text": "NonEmptyStringBrand"
+          },
+          ">]>; }>, ",
+          "PartialC",
+          "<{ offset: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ locationField: ",
+          "StringC",
+          "; }>]>; }>, ",
+          {
+            "pluginId": "apm",
+            "scope": "server",
+            "docId": "kibApmPluginApi",
+            "section": "def-server.APMRouteHandlerResources",
+            "text": "APMRouteHandlerResources"
+          },
+          ", ",
+          "MobileLocationStats",
+          ", ",
+          "APMRouteCreateOptions",
+          ">; \"GET /internal/apm/mobile-services/{serviceName}/stats\": ",
           {
             "pluginId": "@kbn/server-route-repository",
             "scope": "public",
diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx
index aa844e5b09b98..0165d4f0b364a 100644
--- a/api_docs/apm.mdx
+++ b/api_docs/apm.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apm
 title: "apm"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apm plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apm']
 ---
 import apmObj from './apm.devdocs.json';
@@ -21,7 +21,7 @@ Contact [APM UI](https://github.com/orgs/elastic/teams/apm-ui) for questions reg
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 42 | 0 | 42 | 64 |
+| 42 | 0 | 42 | 65 |
 
 ## Client
 
diff --git a/api_docs/banners.mdx b/api_docs/banners.mdx
index e42aa66ba1513..f292ea0186524 100644
--- a/api_docs/banners.mdx
+++ b/api_docs/banners.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/banners
 title: "banners"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the banners plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'banners']
 ---
 import bannersObj from './banners.devdocs.json';
diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx
index a9089191525aa..ebf72b61a4b2a 100644
--- a/api_docs/bfetch.mdx
+++ b/api_docs/bfetch.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/bfetch
 title: "bfetch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the bfetch plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'bfetch']
 ---
 import bfetchObj from './bfetch.devdocs.json';
diff --git a/api_docs/canvas.mdx b/api_docs/canvas.mdx
index 507a20dfa46ac..c22791f7de815 100644
--- a/api_docs/canvas.mdx
+++ b/api_docs/canvas.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/canvas
 title: "canvas"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the canvas plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'canvas']
 ---
 import canvasObj from './canvas.devdocs.json';
diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx
index 2d8551887ea6b..3dabaf44f09a4 100644
--- a/api_docs/cases.mdx
+++ b/api_docs/cases.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cases
 title: "cases"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cases plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cases']
 ---
 import casesObj from './cases.devdocs.json';
diff --git a/api_docs/charts.mdx b/api_docs/charts.mdx
index d0d2e02408c12..23d021370466a 100644
--- a/api_docs/charts.mdx
+++ b/api_docs/charts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/charts
 title: "charts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the charts plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'charts']
 ---
 import chartsObj from './charts.devdocs.json';
diff --git a/api_docs/cloud.mdx b/api_docs/cloud.mdx
index 36afca8e9eaa3..aede4e71fd19e 100644
--- a/api_docs/cloud.mdx
+++ b/api_docs/cloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloud
 title: "cloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloud plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloud']
 ---
 import cloudObj from './cloud.devdocs.json';
diff --git a/api_docs/cloud_chat.mdx b/api_docs/cloud_chat.mdx
index 388ea70a265d4..6b2bbf437d941 100644
--- a/api_docs/cloud_chat.mdx
+++ b/api_docs/cloud_chat.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudChat
 title: "cloudChat"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudChat plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudChat']
 ---
 import cloudChatObj from './cloud_chat.devdocs.json';
diff --git a/api_docs/cloud_data_migration.mdx b/api_docs/cloud_data_migration.mdx
index b5cc444de5929..d0810c875d703 100644
--- a/api_docs/cloud_data_migration.mdx
+++ b/api_docs/cloud_data_migration.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDataMigration
 title: "cloudDataMigration"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDataMigration plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDataMigration']
 ---
 import cloudDataMigrationObj from './cloud_data_migration.devdocs.json';
diff --git a/api_docs/cloud_defend.mdx b/api_docs/cloud_defend.mdx
index 709f926ca9947..df770a4f04e89 100644
--- a/api_docs/cloud_defend.mdx
+++ b/api_docs/cloud_defend.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDefend
 title: "cloudDefend"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDefend plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDefend']
 ---
 import cloudDefendObj from './cloud_defend.devdocs.json';
diff --git a/api_docs/cloud_experiments.mdx b/api_docs/cloud_experiments.mdx
index a595af1bdc56d..d3904afff1417 100644
--- a/api_docs/cloud_experiments.mdx
+++ b/api_docs/cloud_experiments.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudExperiments
 title: "cloudExperiments"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudExperiments plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudExperiments']
 ---
 import cloudExperimentsObj from './cloud_experiments.devdocs.json';
diff --git a/api_docs/cloud_security_posture.mdx b/api_docs/cloud_security_posture.mdx
index 2bfbb41b0a580..990ab1988d90b 100644
--- a/api_docs/cloud_security_posture.mdx
+++ b/api_docs/cloud_security_posture.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudSecurityPosture
 title: "cloudSecurityPosture"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudSecurityPosture plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudSecurityPosture']
 ---
 import cloudSecurityPostureObj from './cloud_security_posture.devdocs.json';
diff --git a/api_docs/console.mdx b/api_docs/console.mdx
index a74023abe5093..71c4d57113721 100644
--- a/api_docs/console.mdx
+++ b/api_docs/console.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/console
 title: "console"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the console plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'console']
 ---
 import consoleObj from './console.devdocs.json';
diff --git a/api_docs/content_management.mdx b/api_docs/content_management.mdx
index 42c25c9b8cab3..e7cf55833194e 100644
--- a/api_docs/content_management.mdx
+++ b/api_docs/content_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/contentManagement
 title: "contentManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the contentManagement plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'contentManagement']
 ---
 import contentManagementObj from './content_management.devdocs.json';
diff --git a/api_docs/controls.devdocs.json b/api_docs/controls.devdocs.json
index dcb9d22fa212e..fa83ba64ab654 100644
--- a/api_docs/controls.devdocs.json
+++ b/api_docs/controls.devdocs.json
@@ -1695,6 +1695,38 @@
             "children": [],
             "returnComment": []
           },
+          {
+            "parentPluginId": "controls",
+            "id": "def-public.OptionsListEmbeddable.onFatalError",
+            "type": "Function",
+            "tags": [],
+            "label": "onFatalError",
+            "description": [],
+            "signature": [
+              "(e: Error) => void"
+            ],
+            "path": "src/plugins/controls/public/options_list/embeddable/options_list_embeddable.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "controls",
+                "id": "def-public.OptionsListEmbeddable.onFatalError.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "e",
+                "description": [],
+                "signature": [
+                  "Error"
+                ],
+                "path": "src/plugins/controls/public/options_list/embeddable/options_list_embeddable.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
           {
             "parentPluginId": "controls",
             "id": "def-public.OptionsListEmbeddable.destroy",
@@ -4337,10 +4369,10 @@
           },
           {
             "parentPluginId": "controls",
-            "id": "def-public.OptionsListEmbeddableInput.hideExclude",
+            "id": "def-public.OptionsListEmbeddableInput.hideActionBar",
             "type": "CompoundType",
             "tags": [],
-            "label": "hideExclude",
+            "label": "hideActionBar",
             "description": [],
             "signature": [
               "boolean | undefined"
@@ -4351,10 +4383,10 @@
           },
           {
             "parentPluginId": "controls",
-            "id": "def-public.OptionsListEmbeddableInput.hideExists",
+            "id": "def-public.OptionsListEmbeddableInput.hideExclude",
             "type": "CompoundType",
             "tags": [],
-            "label": "hideExists",
+            "label": "hideExclude",
             "description": [],
             "signature": [
               "boolean | undefined"
@@ -4365,10 +4397,10 @@
           },
           {
             "parentPluginId": "controls",
-            "id": "def-public.OptionsListEmbeddableInput.hideSort",
+            "id": "def-public.OptionsListEmbeddableInput.hideExists",
             "type": "CompoundType",
             "tags": [],
-            "label": "hideSort",
+            "label": "hideExists",
             "description": [],
             "signature": [
               "boolean | undefined"
@@ -4379,10 +4411,10 @@
           },
           {
             "parentPluginId": "controls",
-            "id": "def-public.OptionsListEmbeddableInput.hideActionBar",
+            "id": "def-public.OptionsListEmbeddableInput.hideSort",
             "type": "CompoundType",
             "tags": [],
-            "label": "hideActionBar",
+            "label": "hideSort",
             "description": [],
             "signature": [
               "boolean | undefined"
@@ -4833,7 +4865,7 @@
           "ControlStyle",
           " | undefined; ignoreParentSettings?: ",
           "ParentIgnoreSettings",
-          " | undefined; } & { fieldName: string; parentFieldName?: string | undefined; childFieldName?: string | undefined; dataViewId: string; }"
+          " | undefined; } & { fieldName: string; dataViewId: string; }"
         ],
         "path": "src/plugins/controls/common/types.ts",
         "deprecated": false,
@@ -5947,10 +5979,10 @@
           },
           {
             "parentPluginId": "controls",
-            "id": "def-common.OptionsListEmbeddableInput.hideExclude",
+            "id": "def-common.OptionsListEmbeddableInput.hideActionBar",
             "type": "CompoundType",
             "tags": [],
-            "label": "hideExclude",
+            "label": "hideActionBar",
             "description": [],
             "signature": [
               "boolean | undefined"
@@ -5961,10 +5993,10 @@
           },
           {
             "parentPluginId": "controls",
-            "id": "def-common.OptionsListEmbeddableInput.hideExists",
+            "id": "def-common.OptionsListEmbeddableInput.hideExclude",
             "type": "CompoundType",
             "tags": [],
-            "label": "hideExists",
+            "label": "hideExclude",
             "description": [],
             "signature": [
               "boolean | undefined"
@@ -5975,10 +6007,10 @@
           },
           {
             "parentPluginId": "controls",
-            "id": "def-common.OptionsListEmbeddableInput.hideSort",
+            "id": "def-common.OptionsListEmbeddableInput.hideExists",
             "type": "CompoundType",
             "tags": [],
-            "label": "hideSort",
+            "label": "hideExists",
             "description": [],
             "signature": [
               "boolean | undefined"
@@ -5989,10 +6021,10 @@
           },
           {
             "parentPluginId": "controls",
-            "id": "def-common.OptionsListEmbeddableInput.hideActionBar",
+            "id": "def-common.OptionsListEmbeddableInput.hideSort",
             "type": "CompoundType",
             "tags": [],
-            "label": "hideActionBar",
+            "label": "hideSort",
             "description": [],
             "signature": [
               "boolean | undefined"
diff --git a/api_docs/controls.mdx b/api_docs/controls.mdx
index 708a14c08b8b0..0e6b485d34eab 100644
--- a/api_docs/controls.mdx
+++ b/api_docs/controls.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/controls
 title: "controls"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the controls plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'controls']
 ---
 import controlsObj from './controls.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-prese
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 268 | 0 | 264 | 9 |
+| 270 | 0 | 266 | 9 |
 
 ## Client
 
diff --git a/api_docs/core.devdocs.json b/api_docs/core.devdocs.json
index acff52ac22585..4c82e4fc45cc0 100644
--- a/api_docs/core.devdocs.json
+++ b/api_docs/core.devdocs.json
@@ -5004,6 +5004,10 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/app.tsx"
               },
+              {
+                "plugin": "ml",
+                "path": "x-pack/plugins/ml/public/application/app.tsx"
+              },
               {
                 "plugin": "infra",
                 "path": "x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx"
@@ -14014,6 +14018,18 @@
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/util/dependency_cache.ts"
           },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/use_resolver.ts"
+          },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/use_resolver.ts"
+          },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/use_resolver.ts"
+          },
           {
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/services/dashboard_service.ts"
@@ -14022,6 +14038,14 @@
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/services/dashboard_service.ts"
           },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
+          },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
+          },
           {
             "plugin": "canvas",
             "path": "x-pack/plugins/canvas/public/services/platform.ts"
@@ -15327,10 +15351,6 @@
                 "plugin": "dashboard",
                 "path": "src/plugins/dashboard/public/dashboard_actions/clone_panel_action.tsx"
               },
-              {
-                "plugin": "dataVisualizer",
-                "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
@@ -18319,14 +18339,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/common/types/index.ts"
           },
-          {
-            "plugin": "dataVisualizer",
-            "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
-          },
-          {
-            "plugin": "dataVisualizer",
-            "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
-          },
           {
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx"
diff --git a/api_docs/core.mdx b/api_docs/core.mdx
index 348cfb20916a1..98ade83d17019 100644
--- a/api_docs/core.mdx
+++ b/api_docs/core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/core
 title: "core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the core plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core']
 ---
 import coreObj from './core.devdocs.json';
diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx
index a9c18267655e3..11e0ff18cd678 100644
--- a/api_docs/custom_integrations.mdx
+++ b/api_docs/custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/customIntegrations
 title: "customIntegrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the customIntegrations plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'customIntegrations']
 ---
 import customIntegrationsObj from './custom_integrations.devdocs.json';
diff --git a/api_docs/dashboard.devdocs.json b/api_docs/dashboard.devdocs.json
index 66e3597db0e0f..7a51fb8b8f8a7 100644
--- a/api_docs/dashboard.devdocs.json
+++ b/api_docs/dashboard.devdocs.json
@@ -84,6 +84,20 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.onDestroyControlGroup",
+            "type": "Function",
+            "tags": [],
+            "label": "onDestroyControlGroup",
+            "description": [],
+            "signature": [
+              "(() => void) | undefined"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "dashboard",
             "id": "def-public.DashboardContainer.Unnamed",
diff --git a/api_docs/dashboard.mdx b/api_docs/dashboard.mdx
index 416fe1235d58b..30d924a498aee 100644
--- a/api_docs/dashboard.mdx
+++ b/api_docs/dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboard
 title: "dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboard plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboard']
 ---
 import dashboardObj from './dashboard.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-prese
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 171 | 0 | 163 | 10 |
+| 172 | 0 | 164 | 10 |
 
 ## Client
 
diff --git a/api_docs/dashboard_enhanced.mdx b/api_docs/dashboard_enhanced.mdx
index d97c2286de38c..0b50bda4b45cd 100644
--- a/api_docs/dashboard_enhanced.mdx
+++ b/api_docs/dashboard_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboardEnhanced
 title: "dashboardEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboardEnhanced plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboardEnhanced']
 ---
 import dashboardEnhancedObj from './dashboard_enhanced.devdocs.json';
diff --git a/api_docs/data.devdocs.json b/api_docs/data.devdocs.json
index 3d45e7d631c18..2760bc6c34e27 100644
--- a/api_docs/data.devdocs.json
+++ b/api_docs/data.devdocs.json
@@ -13621,6 +13621,10 @@
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts"
               },
+              {
+                "plugin": "securitySolution",
+                "path": "x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx"
+              },
               {
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts"
@@ -13969,10 +13973,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/page.tsx"
@@ -13993,18 +13993,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts"
@@ -14013,10 +14001,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
@@ -21244,6 +21228,10 @@
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts"
               },
+              {
+                "plugin": "securitySolution",
+                "path": "x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx"
+              },
               {
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts"
@@ -21592,10 +21580,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/page.tsx"
@@ -21616,18 +21600,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts"
@@ -21636,10 +21608,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
diff --git a/api_docs/data.mdx b/api_docs/data.mdx
index d829300596d89..4a319348aef3b 100644
--- a/api_docs/data.mdx
+++ b/api_docs/data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data
 title: "data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data']
 ---
 import dataObj from './data.devdocs.json';
diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx
index 7c8eafe649cbd..c4eb3f5f85c0d 100644
--- a/api_docs/data_query.mdx
+++ b/api_docs/data_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-query
 title: "data.query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.query plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.query']
 ---
 import dataQueryObj from './data_query.devdocs.json';
diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx
index 91cc7e4c2924f..98409cf43954f 100644
--- a/api_docs/data_search.mdx
+++ b/api_docs/data_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-search
 title: "data.search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.search plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.search']
 ---
 import dataSearchObj from './data_search.devdocs.json';
diff --git a/api_docs/data_view_editor.mdx b/api_docs/data_view_editor.mdx
index 36047624b82e2..fc0cd6752eb1c 100644
--- a/api_docs/data_view_editor.mdx
+++ b/api_docs/data_view_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewEditor
 title: "dataViewEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewEditor plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewEditor']
 ---
 import dataViewEditorObj from './data_view_editor.devdocs.json';
diff --git a/api_docs/data_view_field_editor.mdx b/api_docs/data_view_field_editor.mdx
index e8a675ca53942..aca829f9055ee 100644
--- a/api_docs/data_view_field_editor.mdx
+++ b/api_docs/data_view_field_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewFieldEditor
 title: "dataViewFieldEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewFieldEditor plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewFieldEditor']
 ---
 import dataViewFieldEditorObj from './data_view_field_editor.devdocs.json';
diff --git a/api_docs/data_view_management.mdx b/api_docs/data_view_management.mdx
index b9b27a6a79c1e..63782947a7d1b 100644
--- a/api_docs/data_view_management.mdx
+++ b/api_docs/data_view_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewManagement
 title: "dataViewManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewManagement plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewManagement']
 ---
 import dataViewManagementObj from './data_view_management.devdocs.json';
diff --git a/api_docs/data_views.devdocs.json b/api_docs/data_views.devdocs.json
index 7ec56e83fd9d3..7a30addcc1725 100644
--- a/api_docs/data_views.devdocs.json
+++ b/api_docs/data_views.devdocs.json
@@ -83,6 +83,10 @@
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts"
               },
+              {
+                "plugin": "securitySolution",
+                "path": "x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx"
+              },
               {
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts"
@@ -439,10 +443,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/page.tsx"
@@ -463,18 +463,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts"
@@ -483,10 +471,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
@@ -8291,6 +8275,10 @@
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts"
               },
+              {
+                "plugin": "securitySolution",
+                "path": "x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx"
+              },
               {
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts"
@@ -8647,10 +8635,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/page.tsx"
@@ -8671,18 +8655,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts"
@@ -8691,10 +8663,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
@@ -15594,6 +15562,10 @@
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts"
               },
+              {
+                "plugin": "securitySolution",
+                "path": "x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx"
+              },
               {
                 "plugin": "securitySolution",
                 "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts"
@@ -15950,10 +15922,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/page.tsx"
@@ -15974,18 +15942,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts"
@@ -15994,10 +15950,6 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx"
               },
-              {
-                "plugin": "ml",
-                "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts"
diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx
index 5e69285dd7632..9a8f7e7172efc 100644
--- a/api_docs/data_views.mdx
+++ b/api_docs/data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViews
 title: "dataViews"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViews plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViews']
 ---
 import dataViewsObj from './data_views.devdocs.json';
diff --git a/api_docs/data_visualizer.devdocs.json b/api_docs/data_visualizer.devdocs.json
index 4511b96755536..f690a34438943 100644
--- a/api_docs/data_visualizer.devdocs.json
+++ b/api_docs/data_visualizer.devdocs.json
@@ -96,7 +96,13 @@
             "label": "currentSavedSearch",
             "description": [],
             "signature": [
-              "SavedSearchSavedObject",
+              {
+                "pluginId": "savedSearch",
+                "scope": "public",
+                "docId": "kibSavedSearchPluginApi",
+                "section": "def-public.SavedSearch",
+                "text": "SavedSearch"
+              },
               " | null"
             ],
             "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx",
diff --git a/api_docs/data_visualizer.mdx b/api_docs/data_visualizer.mdx
index a9e9e8ede22b3..d6a01cccb285c 100644
--- a/api_docs/data_visualizer.mdx
+++ b/api_docs/data_visualizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataVisualizer
 title: "dataVisualizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataVisualizer plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataVisualizer']
 ---
 import dataVisualizerObj from './data_visualizer.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) for q
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 28 | 3 | 24 | 1 |
+| 28 | 3 | 24 | 0 |
 
 ## Client
 
diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx
index 046acf2408e77..e5e89e69a1a14 100644
--- a/api_docs/deprecations_by_api.mdx
+++ b/api_docs/deprecations_by_api.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByApi
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-api
 title: Deprecated API usage by API
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -63,8 +63,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract.find" text="find"/> | @kbn/core-saved-objects-browser-mocks, dataViews, savedObjects, presentationUtil, savedSearch, visualizations, dashboard, lens, savedObjectsFinder, cases, maps, ml, infra, cloudSecurityPosture, dashboardEnhanced, graph, securitySolution, synthetics, @kbn/core-saved-objects-browser-internal | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | @kbn/core-saved-objects-browser-internal, core, dataViews, savedObjects, embeddable, presentationUtil, visualizations, dashboard, lens, savedObjectsFinder, aiops, ml, cases, maps, dataVisualizer, infra, fleet, cloudSecurityPosture, dashboardEnhanced, graph, synthetics, securitySolution, @kbn/core-saved-objects-browser-mocks | - |
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.fieldFormats" text="fieldFormats"/> | dashboard, dataVisualizer, stackAlerts, expressionPartitionVis | - |
-| <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsClientContract.get" text="get"/> | @kbn/core-saved-objects-browser-mocks, dataViews, savedObjects, visualizations, dashboard, dataVisualizer, ml, infra, cloudSecurityPosture, dashboardEnhanced, monitoring, synthetics, @kbn/core-saved-objects-browser-internal | - |
-| <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract.get" text="get"/> | @kbn/core-saved-objects-browser-mocks, dataViews, savedObjects, visualizations, dashboard, dataVisualizer, ml, infra, cloudSecurityPosture, dashboardEnhanced, monitoring, synthetics, @kbn/core-saved-objects-browser-internal | - |
+| <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsClientContract.get" text="get"/> | @kbn/core-saved-objects-browser-mocks, dataViews, savedObjects, visualizations, dashboard, ml, infra, cloudSecurityPosture, dashboardEnhanced, monitoring, synthetics, @kbn/core-saved-objects-browser-internal | - |
+| <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract.get" text="get"/> | @kbn/core-saved-objects-browser-mocks, dataViews, savedObjects, visualizations, dashboard, ml, infra, cloudSecurityPosture, dashboardEnhanced, monitoring, synthetics, @kbn/core-saved-objects-browser-internal | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SavedObjectAttribute" text="SavedObjectAttribute"/> | @kbn/core-saved-objects-common, advancedSettings, triggersActionsUi, visualizations | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SavedObjectAttributes" text="SavedObjectAttributes"/> | @kbn/core-saved-objects-common, savedObjects, embeddable, visualizations, dashboard, fleet, infra, canvas, graph, ml | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SavedObjectAttributeSingle" text="SavedObjectAttributeSingle"/> | @kbn/core-saved-objects-common | - |
diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx
index c0525f60f2034..1c078353fcc59 100644
--- a/api_docs/deprecations_by_plugin.mdx
+++ b/api_docs/deprecations_by_plugin.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByPlugin
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-plugin
 title: Deprecated API usage by plugin
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -735,12 +735,10 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.title" text="title"/> | [use_data_visualizer_grid_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts#:~:text=title), [index_data_visualizer_view.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx#:~:text=title), [use_data_visualizer_grid_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts#:~:text=title), [index_data_visualizer_view.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx#:~:text=title) | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.title" text="title"/> | [use_data_visualizer_grid_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts#:~:text=title), [index_data_visualizer_view.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx#:~:text=title) | - |
 | <DocLink id="kibDiscoverPluginApi" section="def-common.DiscoverAppLocatorParams.indexPatternId" text="indexPatternId"/> | [results_links.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx#:~:text=indexPatternId), [actions_panel.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx#:~:text=indexPatternId) | - |
-| <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsClientContract.get" text="get"/> | [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=get) | - |
-| <DocLink id="kibCorePluginApi" section="def-public.SimpleSavedObject" text="SimpleSavedObject"/> | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject), [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=SimpleSavedObject), [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=SimpleSavedObject) | - |
+| <DocLink id="kibCorePluginApi" section="def-public.SimpleSavedObject" text="SimpleSavedObject"/> | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.CoreStart.savedObjects" text="savedObjects"/> | [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=savedObjects) | - |
 | <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=savedObjects) | - |
-| <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract.get" text="get"/> | [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=get) | - |
-| <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject), [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=SimpleSavedObject), [index_data_visualizer.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx#:~:text=SimpleSavedObject) | - |
+| <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/data_visualizer/common/types/index.ts#:~:text=SimpleSavedObject) | - |
 
 
 
@@ -1146,22 +1144,22 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibDataPluginApi" section="def-common.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 50 more | - |
-| <DocLink id="kibDataPluginApi" section="def-server.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 50 more | - |
-| <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 20 more | - |
+| <DocLink id="kibDataPluginApi" section="def-common.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 40 more | - |
+| <DocLink id="kibDataPluginApi" section="def-server.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 40 more | - |
+| <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 15 more | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authc" text="authc"/> | [annotations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/routes/annotations.ts#:~:text=authc) | - |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authz" text="authz"/> | [initialization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/saved_objects/initialization/initialization.ts#:~:text=authz), [sync_task.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/saved_objects/sync_task.ts#:~:text=authz), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/plugin.ts#:~:text=authz), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/plugin.ts#:~:text=authz) | - |
-| <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsClientContract" text="SavedObjectsClientContract"/> | [dependency_cache.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=SavedObjectsClientContract), [dependency_cache.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=SavedObjectsClientContract), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=SavedObjectsClientContract), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=SavedObjectsClientContract) | - |
+| <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsClientContract" text="SavedObjectsClientContract"/> | [dependency_cache.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=SavedObjectsClientContract), [dependency_cache.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=SavedObjectsClientContract), [use_resolver.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/use_resolver.ts#:~:text=SavedObjectsClientContract), [use_resolver.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/use_resolver.ts#:~:text=SavedObjectsClientContract), [use_resolver.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/use_resolver.ts#:~:text=SavedObjectsClientContract), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=SavedObjectsClientContract), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=SavedObjectsClientContract), [router.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/router.tsx#:~:text=SavedObjectsClientContract), [router.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/router.tsx#:~:text=SavedObjectsClientContract) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsClientContract.find" text="find"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=find), [resolvers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/recognize/resolvers.ts#:~:text=find), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=find), [dashboard_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.test.ts#:~:text=find) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsClientContract.get" text="get"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=get), [route_resolver.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/job_from_lens/route_resolver.ts#:~:text=get) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SimpleSavedObject" text="SimpleSavedObject"/> | [kibana.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/common/types/kibana.ts#:~:text=SimpleSavedObject), [kibana.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/common/types/kibana.ts#:~:text=SimpleSavedObject), [source_selection.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx#:~:text=SimpleSavedObject), [source_selection.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx#:~:text=SimpleSavedObject) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SavedObjectAttributes" text="SavedObjectAttributes"/> | [modules.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/common/types/modules.ts#:~:text=SavedObjectAttributes), [modules.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/common/types/modules.ts#:~:text=SavedObjectAttributes) | - |
-| <DocLink id="kibCorePluginApi" section="def-public.CoreStart.savedObjects" text="savedObjects"/> | [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=savedObjects), [page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx#:~:text=savedObjects), [change_data_view.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx#:~:text=savedObjects), [source_selection.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx#:~:text=savedObjects), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=savedObjects) | - |
-| <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=savedObjects), [page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx#:~:text=savedObjects), [change_data_view.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx#:~:text=savedObjects), [source_selection.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx#:~:text=savedObjects), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=savedObjects) | - |
-| <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract" text="SavedObjectsClientContract"/> | [dependency_cache.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=SavedObjectsClientContract), [dependency_cache.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=SavedObjectsClientContract), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=SavedObjectsClientContract), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=SavedObjectsClientContract) | - |
+| <DocLink id="kibCorePluginApi" section="def-public.CoreStart.savedObjects" text="savedObjects"/> | [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=savedObjects), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=savedObjects), [page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx#:~:text=savedObjects), [change_data_view.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx#:~:text=savedObjects), [source_selection.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx#:~:text=savedObjects), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=savedObjects) | - |
+| <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=savedObjects), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=savedObjects), [page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx#:~:text=savedObjects), [change_data_view.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx#:~:text=savedObjects), [source_selection.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx#:~:text=savedObjects), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=savedObjects) | - |
+| <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract" text="SavedObjectsClientContract"/> | [dependency_cache.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=SavedObjectsClientContract), [dependency_cache.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/dependency_cache.ts#:~:text=SavedObjectsClientContract), [use_resolver.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/use_resolver.ts#:~:text=SavedObjectsClientContract), [use_resolver.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/use_resolver.ts#:~:text=SavedObjectsClientContract), [use_resolver.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/use_resolver.ts#:~:text=SavedObjectsClientContract), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=SavedObjectsClientContract), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=SavedObjectsClientContract), [router.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/router.tsx#:~:text=SavedObjectsClientContract), [router.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/routing/router.tsx#:~:text=SavedObjectsClientContract) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract.find" text="find"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=find), [resolvers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/recognize/resolvers.ts#:~:text=find), [dashboard_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.ts#:~:text=find), [dashboard_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/services/dashboard_service.test.ts#:~:text=find) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract.get" text="get"/> | [index_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/util/index_utils.ts#:~:text=get), [route_resolver.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/jobs/new_job/job_from_lens/route_resolver.ts#:~:text=get) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | [kibana.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/common/types/kibana.ts#:~:text=SimpleSavedObject), [kibana.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/common/types/kibana.ts#:~:text=SimpleSavedObject), [source_selection.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx#:~:text=SimpleSavedObject), [source_selection.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx#:~:text=SimpleSavedObject) | - |
@@ -1420,12 +1418,12 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 | <DocLink id="kibDataPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts#:~:text=SavedObject), [use_security_dashboards_table.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/use_security_dashboards_table.tsx#:~:text=SavedObject), [use_security_dashboards_table.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/use_security_dashboards_table.tsx#:~:text=SavedObject), [host_risk_score_dashboards.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts#:~:text=SavedObject), [host_risk_score_dashboards.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts#:~:text=SavedObject), [user_risk_score_dashboards.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts#:~:text=SavedObject), [user_risk_score_dashboards.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts#:~:text=SavedObject)+ 6 more | - |
 | <DocLink id="kibDataPluginApi" section="def-public.DataPublicPluginStart.indexPatterns" text="indexPatterns"/> | [dependencies_start_mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/mock/endpoint/dependencies_start_mock.ts#:~:text=indexPatterns) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.SavedObject" text="SavedObject"/> | [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts#:~:text=SavedObject), [use_security_dashboards_table.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/use_security_dashboards_table.tsx#:~:text=SavedObject), [use_security_dashboards_table.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/use_security_dashboards_table.tsx#:~:text=SavedObject), [host_risk_score_dashboards.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts#:~:text=SavedObject), [host_risk_score_dashboards.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts#:~:text=SavedObject), [user_risk_score_dashboards.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts#:~:text=SavedObject), [user_risk_score_dashboards.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts#:~:text=SavedObject)+ 14 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.DataView.title" text="title"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [use_rule_from_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_from_timeline.tsx#:~:text=title), [get_es_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts#:~:text=title), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts#:~:text=title), [middleware.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts#:~:text=title), [get_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.ts#:~:text=title), [index_pattern.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts#:~:text=title), [utils.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/alerts_actions/utils.test.ts#:~:text=title), [create_sourcerer_data_view.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/sourcerer/create_sourcerer_data_view.ts#:~:text=title)+ 18 more | - |
+| <DocLink id="kibDataPluginApi" section="def-common.DataView.title" text="title"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [use_rule_from_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_from_timeline.tsx#:~:text=title), [get_es_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx#:~:text=title), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts#:~:text=title), [middleware.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts#:~:text=title), [get_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.ts#:~:text=title), [index_pattern.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts#:~:text=title), [utils.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/alerts_actions/utils.test.ts#:~:text=title)+ 20 more | - |
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSource.create" text="create"/> | [wrap_search_source_client.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.ts#:~:text=create) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.SearchSource.fetch" text="fetch"/> | [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/wrap_search_source_client.test.ts#:~:text=fetch) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.EqlSearchStrategyRequest.options" text="options"/> | [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/hooks/eql/api.ts#:~:text=options) | - |
-| <DocLink id="kibDataPluginApi" section="def-server.DataView.title" text="title"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [use_rule_from_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_from_timeline.tsx#:~:text=title), [get_es_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts#:~:text=title), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts#:~:text=title), [middleware.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts#:~:text=title), [get_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.ts#:~:text=title), [index_pattern.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts#:~:text=title), [utils.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/alerts_actions/utils.test.ts#:~:text=title), [create_sourcerer_data_view.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/sourcerer/create_sourcerer_data_view.ts#:~:text=title)+ 18 more | - |
-| <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.title" text="title"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [use_rule_from_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_from_timeline.tsx#:~:text=title), [get_es_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts#:~:text=title), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts#:~:text=title), [middleware.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts#:~:text=title), [get_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.ts#:~:text=title), [index_pattern.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts#:~:text=title), [utils.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/alerts_actions/utils.test.ts#:~:text=title), [create_sourcerer_data_view.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/sourcerer/create_sourcerer_data_view.ts#:~:text=title)+ 4 more | - |
+| <DocLink id="kibDataPluginApi" section="def-server.DataView.title" text="title"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [use_rule_from_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_from_timeline.tsx#:~:text=title), [get_es_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx#:~:text=title), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts#:~:text=title), [middleware.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts#:~:text=title), [get_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.ts#:~:text=title), [index_pattern.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts#:~:text=title), [utils.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/alerts_actions/utils.test.ts#:~:text=title)+ 20 more | - |
+| <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.title" text="title"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/containers/source/index.tsx#:~:text=title), [use_rule_from_timeline.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_from_timeline.tsx#:~:text=title), [get_es_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts#:~:text=title), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx#:~:text=title), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts#:~:text=title), [middleware.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts#:~:text=title), [get_query_filter.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.ts#:~:text=title), [index_pattern.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts#:~:text=title), [utils.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/alerts_actions/utils.test.ts#:~:text=title)+ 5 more | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.PublicLicense.mode" text="mode"/> | [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [fleet_integration.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts#:~:text=mode), [fleet_integration.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts#:~:text=mode), [create_default_policy.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.test.ts#:~:text=mode), [create_default_policy.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode)+ 7 more | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.PublicLicense.mode" text="mode"/> | [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/common/license/policy_config.test.ts#:~:text=mode), [fleet_integration.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts#:~:text=mode), [fleet_integration.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts#:~:text=mode), [create_default_policy.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.test.ts#:~:text=mode), [create_default_policy.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode), [license_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/endpoint/lib/policy/license_watch.test.ts#:~:text=mode)+ 7 more | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [query.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/query.ts#:~:text=license%24) | 8.8.0 |
diff --git a/api_docs/deprecations_by_team.mdx b/api_docs/deprecations_by_team.mdx
index 485fd41c74f4e..4ab6c7239919f 100644
--- a/api_docs/deprecations_by_team.mdx
+++ b/api_docs/deprecations_by_team.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsDueByTeam
 slug: /kibana-dev-docs/api-meta/deprecations-due-by-team
 title: Deprecated APIs due to be removed, by team
 description: Lists the teams that are referencing deprecated APIs with a remove by date.
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
diff --git a/api_docs/dev_tools.mdx b/api_docs/dev_tools.mdx
index 420428ea297a3..56812df7a1d37 100644
--- a/api_docs/dev_tools.mdx
+++ b/api_docs/dev_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/devTools
 title: "devTools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the devTools plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'devTools']
 ---
 import devToolsObj from './dev_tools.devdocs.json';
diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx
index 30376e7cd0b79..1e26ab13c2deb 100644
--- a/api_docs/discover.mdx
+++ b/api_docs/discover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discover
 title: "discover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discover plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discover']
 ---
 import discoverObj from './discover.devdocs.json';
diff --git a/api_docs/discover_enhanced.mdx b/api_docs/discover_enhanced.mdx
index 13ae1bf4df5ea..3dc9d5192dcf4 100644
--- a/api_docs/discover_enhanced.mdx
+++ b/api_docs/discover_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discoverEnhanced
 title: "discoverEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discoverEnhanced plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverEnhanced']
 ---
 import discoverEnhancedObj from './discover_enhanced.devdocs.json';
diff --git a/api_docs/ecs_data_quality_dashboard.devdocs.json b/api_docs/ecs_data_quality_dashboard.devdocs.json
new file mode 100644
index 0000000000000..bff702356c0e2
--- /dev/null
+++ b/api_docs/ecs_data_quality_dashboard.devdocs.json
@@ -0,0 +1,59 @@
+{
+  "id": "ecsDataQualityDashboard",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": [],
+    "setup": {
+      "parentPluginId": "ecsDataQualityDashboard",
+      "id": "def-server.EcsDataQualityDashboardPluginSetup",
+      "type": "Interface",
+      "tags": [],
+      "label": "EcsDataQualityDashboardPluginSetup",
+      "description": [
+        "The plugin setup interface"
+      ],
+      "path": "x-pack/plugins/ecs_data_quality_dashboard/server/types.ts",
+      "deprecated": false,
+      "trackAdoption": false,
+      "children": [],
+      "lifecycle": "setup",
+      "initialIsOpen": true
+    },
+    "start": {
+      "parentPluginId": "ecsDataQualityDashboard",
+      "id": "def-server.EcsDataQualityDashboardPluginStart",
+      "type": "Interface",
+      "tags": [],
+      "label": "EcsDataQualityDashboardPluginStart",
+      "description": [
+        "The plugin start interface"
+      ],
+      "path": "x-pack/plugins/ecs_data_quality_dashboard/server/types.ts",
+      "deprecated": false,
+      "trackAdoption": false,
+      "children": [],
+      "lifecycle": "start",
+      "initialIsOpen": true
+    }
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/ecs_data_quality_dashboard.mdx b/api_docs/ecs_data_quality_dashboard.mdx
new file mode 100644
index 0000000000000..d24bd912d018b
--- /dev/null
+++ b/api_docs/ecs_data_quality_dashboard.mdx
@@ -0,0 +1,33 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibEcsDataQualityDashboardPluginApi
+slug: /kibana-dev-docs/api/ecsDataQualityDashboard
+title: "ecsDataQualityDashboard"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the ecsDataQualityDashboard plugin
+date: 2023-02-07
+tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ecsDataQualityDashboard']
+---
+import ecsDataQualityDashboardObj from './ecs_data_quality_dashboard.devdocs.json';
+
+APIs used to assess the quality of data in Elasticsearch indexes
+
+Contact [Threat Hunting Investigations](https://github.com/orgs/elastic/teams/security-threat-hunting-investigations) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 2 | 0 | 0 | 0 |
+
+## Server
+
+### Setup
+<DocDefinitionList data={[ecsDataQualityDashboardObj.server.setup]}/>
+
+### Start
+<DocDefinitionList data={[ecsDataQualityDashboardObj.server.start]}/>
+
diff --git a/api_docs/embeddable.mdx b/api_docs/embeddable.mdx
index 982b41fb11b5b..e960942ffc7ac 100644
--- a/api_docs/embeddable.mdx
+++ b/api_docs/embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddable
 title: "embeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddable plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddable']
 ---
 import embeddableObj from './embeddable.devdocs.json';
diff --git a/api_docs/embeddable_enhanced.mdx b/api_docs/embeddable_enhanced.mdx
index 4bb7ef7531821..81b3dc703df6c 100644
--- a/api_docs/embeddable_enhanced.mdx
+++ b/api_docs/embeddable_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddableEnhanced
 title: "embeddableEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddableEnhanced plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddableEnhanced']
 ---
 import embeddableEnhancedObj from './embeddable_enhanced.devdocs.json';
diff --git a/api_docs/encrypted_saved_objects.mdx b/api_docs/encrypted_saved_objects.mdx
index adb5699989c8d..3d02811b73d7c 100644
--- a/api_docs/encrypted_saved_objects.mdx
+++ b/api_docs/encrypted_saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/encryptedSavedObjects
 title: "encryptedSavedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the encryptedSavedObjects plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'encryptedSavedObjects']
 ---
 import encryptedSavedObjectsObj from './encrypted_saved_objects.devdocs.json';
diff --git a/api_docs/enterprise_search.mdx b/api_docs/enterprise_search.mdx
index 3f81d41e91a66..9f4d87207eb71 100644
--- a/api_docs/enterprise_search.mdx
+++ b/api_docs/enterprise_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/enterpriseSearch
 title: "enterpriseSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the enterpriseSearch plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'enterpriseSearch']
 ---
 import enterpriseSearchObj from './enterprise_search.devdocs.json';
diff --git a/api_docs/es_ui_shared.mdx b/api_docs/es_ui_shared.mdx
index 5a2fa0d60a377..6f1afc25be0de 100644
--- a/api_docs/es_ui_shared.mdx
+++ b/api_docs/es_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/esUiShared
 title: "esUiShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the esUiShared plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'esUiShared']
 ---
 import esUiSharedObj from './es_ui_shared.devdocs.json';
diff --git a/api_docs/event_annotation.mdx b/api_docs/event_annotation.mdx
index b772afb179e60..0051a373b10dc 100644
--- a/api_docs/event_annotation.mdx
+++ b/api_docs/event_annotation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotation
 title: "eventAnnotation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotation plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotation']
 ---
 import eventAnnotationObj from './event_annotation.devdocs.json';
diff --git a/api_docs/event_log.mdx b/api_docs/event_log.mdx
index b6a23a56b1374..389b02648a8ea 100644
--- a/api_docs/event_log.mdx
+++ b/api_docs/event_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventLog
 title: "eventLog"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventLog plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventLog']
 ---
 import eventLogObj from './event_log.devdocs.json';
diff --git a/api_docs/expression_error.mdx b/api_docs/expression_error.mdx
index 41b6022d49a8d..5f28b2b8ca52b 100644
--- a/api_docs/expression_error.mdx
+++ b/api_docs/expression_error.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionError
 title: "expressionError"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionError plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionError']
 ---
 import expressionErrorObj from './expression_error.devdocs.json';
diff --git a/api_docs/expression_gauge.mdx b/api_docs/expression_gauge.mdx
index bb707b22c75e5..8c8835a3e342b 100644
--- a/api_docs/expression_gauge.mdx
+++ b/api_docs/expression_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionGauge
 title: "expressionGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionGauge plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionGauge']
 ---
 import expressionGaugeObj from './expression_gauge.devdocs.json';
diff --git a/api_docs/expression_heatmap.mdx b/api_docs/expression_heatmap.mdx
index fdd8302742667..08243c1f43720 100644
--- a/api_docs/expression_heatmap.mdx
+++ b/api_docs/expression_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionHeatmap
 title: "expressionHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionHeatmap plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionHeatmap']
 ---
 import expressionHeatmapObj from './expression_heatmap.devdocs.json';
diff --git a/api_docs/expression_image.mdx b/api_docs/expression_image.mdx
index 87bee08d4ee15..c391a56806965 100644
--- a/api_docs/expression_image.mdx
+++ b/api_docs/expression_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionImage
 title: "expressionImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionImage plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionImage']
 ---
 import expressionImageObj from './expression_image.devdocs.json';
diff --git a/api_docs/expression_legacy_metric_vis.mdx b/api_docs/expression_legacy_metric_vis.mdx
index a2510b3e44ce4..ece42bacfcfcd 100644
--- a/api_docs/expression_legacy_metric_vis.mdx
+++ b/api_docs/expression_legacy_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionLegacyMetricVis
 title: "expressionLegacyMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionLegacyMetricVis plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionLegacyMetricVis']
 ---
 import expressionLegacyMetricVisObj from './expression_legacy_metric_vis.devdocs.json';
diff --git a/api_docs/expression_metric.mdx b/api_docs/expression_metric.mdx
index 088694c8d6b31..caa39ea326958 100644
--- a/api_docs/expression_metric.mdx
+++ b/api_docs/expression_metric.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetric
 title: "expressionMetric"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetric plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetric']
 ---
 import expressionMetricObj from './expression_metric.devdocs.json';
diff --git a/api_docs/expression_metric_vis.mdx b/api_docs/expression_metric_vis.mdx
index a40ab35d7830e..338a5a7cb0f43 100644
--- a/api_docs/expression_metric_vis.mdx
+++ b/api_docs/expression_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetricVis
 title: "expressionMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetricVis plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetricVis']
 ---
 import expressionMetricVisObj from './expression_metric_vis.devdocs.json';
diff --git a/api_docs/expression_partition_vis.mdx b/api_docs/expression_partition_vis.mdx
index 6231361a92ac0..961157460f1a6 100644
--- a/api_docs/expression_partition_vis.mdx
+++ b/api_docs/expression_partition_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionPartitionVis
 title: "expressionPartitionVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionPartitionVis plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionPartitionVis']
 ---
 import expressionPartitionVisObj from './expression_partition_vis.devdocs.json';
diff --git a/api_docs/expression_repeat_image.mdx b/api_docs/expression_repeat_image.mdx
index 1a07abf3be48b..8a9499ea73f28 100644
--- a/api_docs/expression_repeat_image.mdx
+++ b/api_docs/expression_repeat_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRepeatImage
 title: "expressionRepeatImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRepeatImage plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRepeatImage']
 ---
 import expressionRepeatImageObj from './expression_repeat_image.devdocs.json';
diff --git a/api_docs/expression_reveal_image.mdx b/api_docs/expression_reveal_image.mdx
index b83009430e224..619626f6e0814 100644
--- a/api_docs/expression_reveal_image.mdx
+++ b/api_docs/expression_reveal_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRevealImage
 title: "expressionRevealImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRevealImage plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRevealImage']
 ---
 import expressionRevealImageObj from './expression_reveal_image.devdocs.json';
diff --git a/api_docs/expression_shape.mdx b/api_docs/expression_shape.mdx
index 13b178d2c84c6..fea5fd680ebc3 100644
--- a/api_docs/expression_shape.mdx
+++ b/api_docs/expression_shape.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionShape
 title: "expressionShape"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionShape plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionShape']
 ---
 import expressionShapeObj from './expression_shape.devdocs.json';
diff --git a/api_docs/expression_tagcloud.mdx b/api_docs/expression_tagcloud.mdx
index 9c99922702562..be59582602b8c 100644
--- a/api_docs/expression_tagcloud.mdx
+++ b/api_docs/expression_tagcloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionTagcloud
 title: "expressionTagcloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionTagcloud plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionTagcloud']
 ---
 import expressionTagcloudObj from './expression_tagcloud.devdocs.json';
diff --git a/api_docs/expression_x_y.mdx b/api_docs/expression_x_y.mdx
index 37a5dc7eaf4f4..6fe27e22692ac 100644
--- a/api_docs/expression_x_y.mdx
+++ b/api_docs/expression_x_y.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionXY
 title: "expressionXY"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionXY plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionXY']
 ---
 import expressionXYObj from './expression_x_y.devdocs.json';
diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx
index 142010370c1c1..facc51eb94450 100644
--- a/api_docs/expressions.mdx
+++ b/api_docs/expressions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressions
 title: "expressions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressions plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressions']
 ---
 import expressionsObj from './expressions.devdocs.json';
diff --git a/api_docs/features.mdx b/api_docs/features.mdx
index 4552385f2f494..b2c0f12638ddc 100644
--- a/api_docs/features.mdx
+++ b/api_docs/features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/features
 title: "features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the features plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'features']
 ---
 import featuresObj from './features.devdocs.json';
diff --git a/api_docs/field_formats.mdx b/api_docs/field_formats.mdx
index f410ac8a9c406..ed72a41dc4fa6 100644
--- a/api_docs/field_formats.mdx
+++ b/api_docs/field_formats.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fieldFormats
 title: "fieldFormats"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fieldFormats plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fieldFormats']
 ---
 import fieldFormatsObj from './field_formats.devdocs.json';
diff --git a/api_docs/file_upload.mdx b/api_docs/file_upload.mdx
index 30a7a683dead4..d1398101e0fcc 100644
--- a/api_docs/file_upload.mdx
+++ b/api_docs/file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fileUpload
 title: "fileUpload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fileUpload plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fileUpload']
 ---
 import fileUploadObj from './file_upload.devdocs.json';
diff --git a/api_docs/files.mdx b/api_docs/files.mdx
index cf55e80277850..e72ef4a7726ff 100644
--- a/api_docs/files.mdx
+++ b/api_docs/files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/files
 title: "files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the files plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'files']
 ---
 import filesObj from './files.devdocs.json';
diff --git a/api_docs/files_management.mdx b/api_docs/files_management.mdx
index 8dc9a21707518..ae937b38ab5dd 100644
--- a/api_docs/files_management.mdx
+++ b/api_docs/files_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/filesManagement
 title: "filesManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the filesManagement plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'filesManagement']
 ---
 import filesManagementObj from './files_management.devdocs.json';
diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx
index 157a2c3c8c56b..5619c453e6e7f 100644
--- a/api_docs/fleet.mdx
+++ b/api_docs/fleet.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fleet
 title: "fleet"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fleet plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fleet']
 ---
 import fleetObj from './fleet.devdocs.json';
diff --git a/api_docs/global_search.mdx b/api_docs/global_search.mdx
index d524a8f297332..98efd78f2657a 100644
--- a/api_docs/global_search.mdx
+++ b/api_docs/global_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/globalSearch
 title: "globalSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the globalSearch plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'globalSearch']
 ---
 import globalSearchObj from './global_search.devdocs.json';
diff --git a/api_docs/guided_onboarding.devdocs.json b/api_docs/guided_onboarding.devdocs.json
index 4e356303de146..fe751c1b5aa3a 100644
--- a/api_docs/guided_onboarding.devdocs.json
+++ b/api_docs/guided_onboarding.devdocs.json
@@ -1191,7 +1191,7 @@
         "label": "GuidesConfig",
         "description": [],
         "signature": [
-          "{ search: ",
+          "{ kubernetes: ",
           {
             "pluginId": "@kbn/guided-onboarding",
             "scope": "common",
@@ -1199,7 +1199,7 @@
             "section": "def-common.GuideConfig",
             "text": "GuideConfig"
           },
-          "; kubernetes: ",
+          "; siem: ",
           {
             "pluginId": "@kbn/guided-onboarding",
             "scope": "common",
@@ -1207,7 +1207,23 @@
             "section": "def-common.GuideConfig",
             "text": "GuideConfig"
           },
-          "; siem: ",
+          "; appSearch: ",
+          {
+            "pluginId": "@kbn/guided-onboarding",
+            "scope": "common",
+            "docId": "kibKbnGuidedOnboardingPluginApi",
+            "section": "def-common.GuideConfig",
+            "text": "GuideConfig"
+          },
+          "; websiteSearch: ",
+          {
+            "pluginId": "@kbn/guided-onboarding",
+            "scope": "common",
+            "docId": "kibKbnGuidedOnboardingPluginApi",
+            "section": "def-common.GuideConfig",
+            "text": "GuideConfig"
+          },
+          "; databaseSearch: ",
           {
             "pluginId": "@kbn/guided-onboarding",
             "scope": "common",
diff --git a/api_docs/guided_onboarding.mdx b/api_docs/guided_onboarding.mdx
index c9bc8ee05101f..e18937f0e4b0e 100644
--- a/api_docs/guided_onboarding.mdx
+++ b/api_docs/guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/guidedOnboarding
 title: "guidedOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the guidedOnboarding plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'guidedOnboarding']
 ---
 import guidedOnboardingObj from './guided_onboarding.devdocs.json';
diff --git a/api_docs/home.mdx b/api_docs/home.mdx
index 980f106773ef3..4878e8d8fad62 100644
--- a/api_docs/home.mdx
+++ b/api_docs/home.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/home
 title: "home"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the home plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'home']
 ---
 import homeObj from './home.devdocs.json';
diff --git a/api_docs/image_embeddable.mdx b/api_docs/image_embeddable.mdx
index 4555a859bdbfe..e9147a31f60d1 100644
--- a/api_docs/image_embeddable.mdx
+++ b/api_docs/image_embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/imageEmbeddable
 title: "imageEmbeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the imageEmbeddable plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'imageEmbeddable']
 ---
 import imageEmbeddableObj from './image_embeddable.devdocs.json';
diff --git a/api_docs/index_lifecycle_management.mdx b/api_docs/index_lifecycle_management.mdx
index 76699352355d3..60011f99267e6 100644
--- a/api_docs/index_lifecycle_management.mdx
+++ b/api_docs/index_lifecycle_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexLifecycleManagement
 title: "indexLifecycleManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexLifecycleManagement plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexLifecycleManagement']
 ---
 import indexLifecycleManagementObj from './index_lifecycle_management.devdocs.json';
diff --git a/api_docs/index_management.mdx b/api_docs/index_management.mdx
index bc2a867738f1d..709f27c8dbca9 100644
--- a/api_docs/index_management.mdx
+++ b/api_docs/index_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexManagement
 title: "indexManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexManagement plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexManagement']
 ---
 import indexManagementObj from './index_management.devdocs.json';
diff --git a/api_docs/infra.mdx b/api_docs/infra.mdx
index 2135c0f786100..56bb5ed0e56dd 100644
--- a/api_docs/infra.mdx
+++ b/api_docs/infra.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/infra
 title: "infra"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the infra plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'infra']
 ---
 import infraObj from './infra.devdocs.json';
diff --git a/api_docs/inspector.mdx b/api_docs/inspector.mdx
index 69a44b6d81918..4bc5f5a9f5ce9 100644
--- a/api_docs/inspector.mdx
+++ b/api_docs/inspector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/inspector
 title: "inspector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the inspector plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'inspector']
 ---
 import inspectorObj from './inspector.devdocs.json';
diff --git a/api_docs/interactive_setup.mdx b/api_docs/interactive_setup.mdx
index e086228c90973..af939ff0a6862 100644
--- a/api_docs/interactive_setup.mdx
+++ b/api_docs/interactive_setup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/interactiveSetup
 title: "interactiveSetup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the interactiveSetup plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'interactiveSetup']
 ---
 import interactiveSetupObj from './interactive_setup.devdocs.json';
diff --git a/api_docs/kbn_ace.mdx b/api_docs/kbn_ace.mdx
index 6ac6b3768b9ab..bd5959e7d82f3 100644
--- a/api_docs/kbn_ace.mdx
+++ b/api_docs/kbn_ace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ace
 title: "@kbn/ace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ace plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ace']
 ---
 import kbnAceObj from './kbn_ace.devdocs.json';
diff --git a/api_docs/kbn_aiops_components.mdx b/api_docs/kbn_aiops_components.mdx
index bb348ec467e61..8e82d362e6d17 100644
--- a/api_docs/kbn_aiops_components.mdx
+++ b/api_docs/kbn_aiops_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-components
 title: "@kbn/aiops-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-components plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-components']
 ---
 import kbnAiopsComponentsObj from './kbn_aiops_components.devdocs.json';
diff --git a/api_docs/kbn_aiops_utils.mdx b/api_docs/kbn_aiops_utils.mdx
index ab0875b855424..59618d0d654b1 100644
--- a/api_docs/kbn_aiops_utils.mdx
+++ b/api_docs/kbn_aiops_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-utils
 title: "@kbn/aiops-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-utils']
 ---
 import kbnAiopsUtilsObj from './kbn_aiops_utils.devdocs.json';
diff --git a/api_docs/kbn_alerts.mdx b/api_docs/kbn_alerts.mdx
index 8c4828aa8c845..b6dbebf027522 100644
--- a/api_docs/kbn_alerts.mdx
+++ b/api_docs/kbn_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts
 title: "@kbn/alerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts']
 ---
 import kbnAlertsObj from './kbn_alerts.devdocs.json';
diff --git a/api_docs/kbn_analytics.mdx b/api_docs/kbn_analytics.mdx
index fe8eb6c543158..f01e1f34223d4 100644
--- a/api_docs/kbn_analytics.mdx
+++ b/api_docs/kbn_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics
 title: "@kbn/analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics']
 ---
 import kbnAnalyticsObj from './kbn_analytics.devdocs.json';
diff --git a/api_docs/kbn_analytics_client.mdx b/api_docs/kbn_analytics_client.mdx
index d2c65b5064228..4fb8f6e1b58cd 100644
--- a/api_docs/kbn_analytics_client.mdx
+++ b/api_docs/kbn_analytics_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-client
 title: "@kbn/analytics-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-client plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-client']
 ---
 import kbnAnalyticsClientObj from './kbn_analytics_client.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
index 246b9b080f3dc..e9d4ca59b0c2a 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-browser
 title: "@kbn/analytics-shippers-elastic-v3-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-browser']
 ---
 import kbnAnalyticsShippersElasticV3BrowserObj from './kbn_analytics_shippers_elastic_v3_browser.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
index e6fb7e0fca19f..e48d7b3694b51 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-common
 title: "@kbn/analytics-shippers-elastic-v3-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-common']
 ---
 import kbnAnalyticsShippersElasticV3CommonObj from './kbn_analytics_shippers_elastic_v3_common.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
index bcc88432ba153..1c3dec0b3d1b0 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-server
 title: "@kbn/analytics-shippers-elastic-v3-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-server']
 ---
 import kbnAnalyticsShippersElasticV3ServerObj from './kbn_analytics_shippers_elastic_v3_server.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_fullstory.mdx b/api_docs/kbn_analytics_shippers_fullstory.mdx
index 6a934db0d020b..c579c08e89a57 100644
--- a/api_docs/kbn_analytics_shippers_fullstory.mdx
+++ b/api_docs/kbn_analytics_shippers_fullstory.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-fullstory
 title: "@kbn/analytics-shippers-fullstory"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-fullstory plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-fullstory']
 ---
 import kbnAnalyticsShippersFullstoryObj from './kbn_analytics_shippers_fullstory.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_gainsight.mdx b/api_docs/kbn_analytics_shippers_gainsight.mdx
index 855a2fa53354c..c07838b49a8a8 100644
--- a/api_docs/kbn_analytics_shippers_gainsight.mdx
+++ b/api_docs/kbn_analytics_shippers_gainsight.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-gainsight
 title: "@kbn/analytics-shippers-gainsight"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-gainsight plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-gainsight']
 ---
 import kbnAnalyticsShippersGainsightObj from './kbn_analytics_shippers_gainsight.devdocs.json';
diff --git a/api_docs/kbn_apm_config_loader.mdx b/api_docs/kbn_apm_config_loader.mdx
index 6aa8a4c5a2315..b61b78269d4a1 100644
--- a/api_docs/kbn_apm_config_loader.mdx
+++ b/api_docs/kbn_apm_config_loader.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-config-loader
 title: "@kbn/apm-config-loader"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-config-loader plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-config-loader']
 ---
 import kbnApmConfigLoaderObj from './kbn_apm_config_loader.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace.mdx b/api_docs/kbn_apm_synthtrace.mdx
index 84ad6439c1861..24ed27014b0e9 100644
--- a/api_docs/kbn_apm_synthtrace.mdx
+++ b/api_docs/kbn_apm_synthtrace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace
 title: "@kbn/apm-synthtrace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace']
 ---
 import kbnApmSynthtraceObj from './kbn_apm_synthtrace.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace_client.mdx b/api_docs/kbn_apm_synthtrace_client.mdx
index 8847127b1167b..98372dda14b2f 100644
--- a/api_docs/kbn_apm_synthtrace_client.mdx
+++ b/api_docs/kbn_apm_synthtrace_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace-client
 title: "@kbn/apm-synthtrace-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace-client plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace-client']
 ---
 import kbnApmSynthtraceClientObj from './kbn_apm_synthtrace_client.devdocs.json';
diff --git a/api_docs/kbn_apm_utils.mdx b/api_docs/kbn_apm_utils.mdx
index bb6290785972f..e46a72c8945d9 100644
--- a/api_docs/kbn_apm_utils.mdx
+++ b/api_docs/kbn_apm_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-utils
 title: "@kbn/apm-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-utils']
 ---
 import kbnApmUtilsObj from './kbn_apm_utils.devdocs.json';
diff --git a/api_docs/kbn_axe_config.mdx b/api_docs/kbn_axe_config.mdx
index f13d82c7e5b07..27cfdc9b8f946 100644
--- a/api_docs/kbn_axe_config.mdx
+++ b/api_docs/kbn_axe_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-axe-config
 title: "@kbn/axe-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/axe-config plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/axe-config']
 ---
 import kbnAxeConfigObj from './kbn_axe_config.devdocs.json';
diff --git a/api_docs/kbn_cases_components.mdx b/api_docs/kbn_cases_components.mdx
index 14b56b40d9ae4..b1b97ecf4d3f7 100644
--- a/api_docs/kbn_cases_components.mdx
+++ b/api_docs/kbn_cases_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cases-components
 title: "@kbn/cases-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cases-components plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cases-components']
 ---
 import kbnCasesComponentsObj from './kbn_cases_components.devdocs.json';
diff --git a/api_docs/kbn_cell_actions.mdx b/api_docs/kbn_cell_actions.mdx
index db4126ba2899b..0f325222fdda7 100644
--- a/api_docs/kbn_cell_actions.mdx
+++ b/api_docs/kbn_cell_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cell-actions
 title: "@kbn/cell-actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cell-actions plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cell-actions']
 ---
 import kbnCellActionsObj from './kbn_cell_actions.devdocs.json';
diff --git a/api_docs/kbn_chart_icons.mdx b/api_docs/kbn_chart_icons.mdx
index 2cce790c01661..17f6642bf7f54 100644
--- a/api_docs/kbn_chart_icons.mdx
+++ b/api_docs/kbn_chart_icons.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-icons
 title: "@kbn/chart-icons"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-icons plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-icons']
 ---
 import kbnChartIconsObj from './kbn_chart_icons.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_core.mdx b/api_docs/kbn_ci_stats_core.mdx
index 7e699ce2cac7d..4049aa1a32456 100644
--- a/api_docs/kbn_ci_stats_core.mdx
+++ b/api_docs/kbn_ci_stats_core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-core
 title: "@kbn/ci-stats-core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-core plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-core']
 ---
 import kbnCiStatsCoreObj from './kbn_ci_stats_core.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_performance_metrics.mdx b/api_docs/kbn_ci_stats_performance_metrics.mdx
index 0ff104b780fdc..470d03ab737fb 100644
--- a/api_docs/kbn_ci_stats_performance_metrics.mdx
+++ b/api_docs/kbn_ci_stats_performance_metrics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-performance-metrics
 title: "@kbn/ci-stats-performance-metrics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-performance-metrics plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-performance-metrics']
 ---
 import kbnCiStatsPerformanceMetricsObj from './kbn_ci_stats_performance_metrics.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_reporter.mdx b/api_docs/kbn_ci_stats_reporter.mdx
index 4af115eb421f6..396571acc2dab 100644
--- a/api_docs/kbn_ci_stats_reporter.mdx
+++ b/api_docs/kbn_ci_stats_reporter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-reporter
 title: "@kbn/ci-stats-reporter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-reporter plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-reporter']
 ---
 import kbnCiStatsReporterObj from './kbn_ci_stats_reporter.devdocs.json';
diff --git a/api_docs/kbn_cli_dev_mode.mdx b/api_docs/kbn_cli_dev_mode.mdx
index 78480922f3037..0ba2c6c354b0c 100644
--- a/api_docs/kbn_cli_dev_mode.mdx
+++ b/api_docs/kbn_cli_dev_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cli-dev-mode
 title: "@kbn/cli-dev-mode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cli-dev-mode plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cli-dev-mode']
 ---
 import kbnCliDevModeObj from './kbn_cli_dev_mode.devdocs.json';
diff --git a/api_docs/kbn_code_editor.mdx b/api_docs/kbn_code_editor.mdx
index 0bc34f4809da1..7635df0d50818 100644
--- a/api_docs/kbn_code_editor.mdx
+++ b/api_docs/kbn_code_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor
 title: "@kbn/code-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor']
 ---
 import kbnCodeEditorObj from './kbn_code_editor.devdocs.json';
diff --git a/api_docs/kbn_code_editor_mocks.mdx b/api_docs/kbn_code_editor_mocks.mdx
index 602e670cc15ea..def3e23f62e11 100644
--- a/api_docs/kbn_code_editor_mocks.mdx
+++ b/api_docs/kbn_code_editor_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor-mocks
 title: "@kbn/code-editor-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor-mocks']
 ---
 import kbnCodeEditorMocksObj from './kbn_code_editor_mocks.devdocs.json';
diff --git a/api_docs/kbn_coloring.mdx b/api_docs/kbn_coloring.mdx
index 500b6ad46b394..34d399a215ee2 100644
--- a/api_docs/kbn_coloring.mdx
+++ b/api_docs/kbn_coloring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-coloring
 title: "@kbn/coloring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/coloring plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/coloring']
 ---
 import kbnColoringObj from './kbn_coloring.devdocs.json';
diff --git a/api_docs/kbn_config.mdx b/api_docs/kbn_config.mdx
index a70d935fce647..b05a88c1d3160 100644
--- a/api_docs/kbn_config.mdx
+++ b/api_docs/kbn_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config
 title: "@kbn/config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config']
 ---
 import kbnConfigObj from './kbn_config.devdocs.json';
diff --git a/api_docs/kbn_config_mocks.mdx b/api_docs/kbn_config_mocks.mdx
index ebadcf98e00e9..50a4abde17ce4 100644
--- a/api_docs/kbn_config_mocks.mdx
+++ b/api_docs/kbn_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-mocks
 title: "@kbn/config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-mocks']
 ---
 import kbnConfigMocksObj from './kbn_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_config_schema.mdx b/api_docs/kbn_config_schema.mdx
index 2418ec0f71a72..d3dafba3e6a04 100644
--- a/api_docs/kbn_config_schema.mdx
+++ b/api_docs/kbn_config_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-schema
 title: "@kbn/config-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-schema plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-schema']
 ---
 import kbnConfigSchemaObj from './kbn_config_schema.devdocs.json';
diff --git a/api_docs/kbn_content_management_content_editor.mdx b/api_docs/kbn_content_management_content_editor.mdx
index 7b3f9b3c47d84..b8c31b8fb0151 100644
--- a/api_docs/kbn_content_management_content_editor.mdx
+++ b/api_docs/kbn_content_management_content_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-content-editor
 title: "@kbn/content-management-content-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-content-editor plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-content-editor']
 ---
 import kbnContentManagementContentEditorObj from './kbn_content_management_content_editor.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list.mdx b/api_docs/kbn_content_management_table_list.mdx
index 0c5fe9a612976..eafc1dae14998 100644
--- a/api_docs/kbn_content_management_table_list.mdx
+++ b/api_docs/kbn_content_management_table_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list
 title: "@kbn/content-management-table-list"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list']
 ---
 import kbnContentManagementTableListObj from './kbn_content_management_table_list.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser.mdx b/api_docs/kbn_core_analytics_browser.mdx
index e78eb0265921e..a16db42bb56dc 100644
--- a/api_docs/kbn_core_analytics_browser.mdx
+++ b/api_docs/kbn_core_analytics_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser
 title: "@kbn/core-analytics-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser']
 ---
 import kbnCoreAnalyticsBrowserObj from './kbn_core_analytics_browser.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_internal.mdx b/api_docs/kbn_core_analytics_browser_internal.mdx
index 9021655914f51..37ce06dd81d6c 100644
--- a/api_docs/kbn_core_analytics_browser_internal.mdx
+++ b/api_docs/kbn_core_analytics_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-internal
 title: "@kbn/core-analytics-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-internal']
 ---
 import kbnCoreAnalyticsBrowserInternalObj from './kbn_core_analytics_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_mocks.mdx b/api_docs/kbn_core_analytics_browser_mocks.mdx
index 66c1ed181590e..3f040deea4fad 100644
--- a/api_docs/kbn_core_analytics_browser_mocks.mdx
+++ b/api_docs/kbn_core_analytics_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-mocks
 title: "@kbn/core-analytics-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-mocks']
 ---
 import kbnCoreAnalyticsBrowserMocksObj from './kbn_core_analytics_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server.mdx b/api_docs/kbn_core_analytics_server.mdx
index 69fecba05998c..768433cd1e855 100644
--- a/api_docs/kbn_core_analytics_server.mdx
+++ b/api_docs/kbn_core_analytics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server
 title: "@kbn/core-analytics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server']
 ---
 import kbnCoreAnalyticsServerObj from './kbn_core_analytics_server.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_internal.mdx b/api_docs/kbn_core_analytics_server_internal.mdx
index 1fc7923954384..4dc8b069b776a 100644
--- a/api_docs/kbn_core_analytics_server_internal.mdx
+++ b/api_docs/kbn_core_analytics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-internal
 title: "@kbn/core-analytics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-internal']
 ---
 import kbnCoreAnalyticsServerInternalObj from './kbn_core_analytics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_mocks.mdx b/api_docs/kbn_core_analytics_server_mocks.mdx
index a355e7e58dea2..edf5e7ce0b7ef 100644
--- a/api_docs/kbn_core_analytics_server_mocks.mdx
+++ b/api_docs/kbn_core_analytics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-mocks
 title: "@kbn/core-analytics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-mocks']
 ---
 import kbnCoreAnalyticsServerMocksObj from './kbn_core_analytics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser.mdx b/api_docs/kbn_core_application_browser.mdx
index 5e621b77b855f..4d2e574b934e0 100644
--- a/api_docs/kbn_core_application_browser.mdx
+++ b/api_docs/kbn_core_application_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser
 title: "@kbn/core-application-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser']
 ---
 import kbnCoreApplicationBrowserObj from './kbn_core_application_browser.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_internal.mdx b/api_docs/kbn_core_application_browser_internal.mdx
index a81107897ac10..bdbd0607fc99d 100644
--- a/api_docs/kbn_core_application_browser_internal.mdx
+++ b/api_docs/kbn_core_application_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-internal
 title: "@kbn/core-application-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-internal']
 ---
 import kbnCoreApplicationBrowserInternalObj from './kbn_core_application_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_mocks.mdx b/api_docs/kbn_core_application_browser_mocks.mdx
index eec7e523f7052..a4780d77ec77e 100644
--- a/api_docs/kbn_core_application_browser_mocks.mdx
+++ b/api_docs/kbn_core_application_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-mocks
 title: "@kbn/core-application-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-mocks']
 ---
 import kbnCoreApplicationBrowserMocksObj from './kbn_core_application_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_common.mdx b/api_docs/kbn_core_application_common.mdx
index 15e8f690c56cb..86c7adf9a0e35 100644
--- a/api_docs/kbn_core_application_common.mdx
+++ b/api_docs/kbn_core_application_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-common
 title: "@kbn/core-application-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-common']
 ---
 import kbnCoreApplicationCommonObj from './kbn_core_application_common.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_internal.mdx b/api_docs/kbn_core_apps_browser_internal.mdx
index 515c211550f5a..8739ec300f427 100644
--- a/api_docs/kbn_core_apps_browser_internal.mdx
+++ b/api_docs/kbn_core_apps_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-internal
 title: "@kbn/core-apps-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-internal']
 ---
 import kbnCoreAppsBrowserInternalObj from './kbn_core_apps_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_mocks.mdx b/api_docs/kbn_core_apps_browser_mocks.mdx
index c151c8568edca..5cb5d6c0c0545 100644
--- a/api_docs/kbn_core_apps_browser_mocks.mdx
+++ b/api_docs/kbn_core_apps_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-mocks
 title: "@kbn/core-apps-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-mocks']
 ---
 import kbnCoreAppsBrowserMocksObj from './kbn_core_apps_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_apps_server_internal.mdx b/api_docs/kbn_core_apps_server_internal.mdx
index 3aa6e61203902..ac34095183b62 100644
--- a/api_docs/kbn_core_apps_server_internal.mdx
+++ b/api_docs/kbn_core_apps_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-server-internal
 title: "@kbn/core-apps-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-server-internal']
 ---
 import kbnCoreAppsServerInternalObj from './kbn_core_apps_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_browser_mocks.mdx b/api_docs/kbn_core_base_browser_mocks.mdx
index 048314a4aa99d..05f5ea2574f8e 100644
--- a/api_docs/kbn_core_base_browser_mocks.mdx
+++ b/api_docs/kbn_core_base_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-browser-mocks
 title: "@kbn/core-base-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-browser-mocks']
 ---
 import kbnCoreBaseBrowserMocksObj from './kbn_core_base_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_base_common.mdx b/api_docs/kbn_core_base_common.mdx
index 841841559df44..bd16e1a4ef812 100644
--- a/api_docs/kbn_core_base_common.mdx
+++ b/api_docs/kbn_core_base_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-common
 title: "@kbn/core-base-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-common']
 ---
 import kbnCoreBaseCommonObj from './kbn_core_base_common.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_internal.mdx b/api_docs/kbn_core_base_server_internal.mdx
index 37e3f1feba541..c45eb938ea8d0 100644
--- a/api_docs/kbn_core_base_server_internal.mdx
+++ b/api_docs/kbn_core_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-internal
 title: "@kbn/core-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-internal']
 ---
 import kbnCoreBaseServerInternalObj from './kbn_core_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_mocks.mdx b/api_docs/kbn_core_base_server_mocks.mdx
index 0f36ccf0e33a3..d3b7d86398dea 100644
--- a/api_docs/kbn_core_base_server_mocks.mdx
+++ b/api_docs/kbn_core_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-mocks
 title: "@kbn/core-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-mocks']
 ---
 import kbnCoreBaseServerMocksObj from './kbn_core_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_browser_mocks.mdx b/api_docs/kbn_core_capabilities_browser_mocks.mdx
index cc0497e5ab4a0..4b9f07da23df1 100644
--- a/api_docs/kbn_core_capabilities_browser_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-browser-mocks
 title: "@kbn/core-capabilities-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-browser-mocks']
 ---
 import kbnCoreCapabilitiesBrowserMocksObj from './kbn_core_capabilities_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_common.mdx b/api_docs/kbn_core_capabilities_common.mdx
index 8994a768b8d4e..edf627592e10d 100644
--- a/api_docs/kbn_core_capabilities_common.mdx
+++ b/api_docs/kbn_core_capabilities_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-common
 title: "@kbn/core-capabilities-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-common']
 ---
 import kbnCoreCapabilitiesCommonObj from './kbn_core_capabilities_common.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server.mdx b/api_docs/kbn_core_capabilities_server.mdx
index 10528940f60ec..95733e9018c01 100644
--- a/api_docs/kbn_core_capabilities_server.mdx
+++ b/api_docs/kbn_core_capabilities_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server
 title: "@kbn/core-capabilities-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server']
 ---
 import kbnCoreCapabilitiesServerObj from './kbn_core_capabilities_server.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server_mocks.mdx b/api_docs/kbn_core_capabilities_server_mocks.mdx
index 14a2c149dfe1a..3ed44bc6e330c 100644
--- a/api_docs/kbn_core_capabilities_server_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server-mocks
 title: "@kbn/core-capabilities-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server-mocks']
 ---
 import kbnCoreCapabilitiesServerMocksObj from './kbn_core_capabilities_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser.mdx b/api_docs/kbn_core_chrome_browser.mdx
index bee89da0df614..92599f78fd0d6 100644
--- a/api_docs/kbn_core_chrome_browser.mdx
+++ b/api_docs/kbn_core_chrome_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser
 title: "@kbn/core-chrome-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser']
 ---
 import kbnCoreChromeBrowserObj from './kbn_core_chrome_browser.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser_mocks.mdx b/api_docs/kbn_core_chrome_browser_mocks.mdx
index b398421291857..6edcdd3bfe0ae 100644
--- a/api_docs/kbn_core_chrome_browser_mocks.mdx
+++ b/api_docs/kbn_core_chrome_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser-mocks
 title: "@kbn/core-chrome-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser-mocks']
 ---
 import kbnCoreChromeBrowserMocksObj from './kbn_core_chrome_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_config_server_internal.mdx b/api_docs/kbn_core_config_server_internal.mdx
index ba65df64e4d70..845a862f30d92 100644
--- a/api_docs/kbn_core_config_server_internal.mdx
+++ b/api_docs/kbn_core_config_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-config-server-internal
 title: "@kbn/core-config-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-config-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-config-server-internal']
 ---
 import kbnCoreConfigServerInternalObj from './kbn_core_config_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser.mdx b/api_docs/kbn_core_custom_branding_browser.mdx
index 7d3382acf95e5..63f4552466d56 100644
--- a/api_docs/kbn_core_custom_branding_browser.mdx
+++ b/api_docs/kbn_core_custom_branding_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser
 title: "@kbn/core-custom-branding-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser']
 ---
 import kbnCoreCustomBrandingBrowserObj from './kbn_core_custom_branding_browser.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_internal.mdx b/api_docs/kbn_core_custom_branding_browser_internal.mdx
index 79d4563cbcfe3..59c453123678c 100644
--- a/api_docs/kbn_core_custom_branding_browser_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-internal
 title: "@kbn/core-custom-branding-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-internal']
 ---
 import kbnCoreCustomBrandingBrowserInternalObj from './kbn_core_custom_branding_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_mocks.mdx b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
index b196e413247f7..f6e4aea1420fd 100644
--- a/api_docs/kbn_core_custom_branding_browser_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-mocks
 title: "@kbn/core-custom-branding-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-mocks']
 ---
 import kbnCoreCustomBrandingBrowserMocksObj from './kbn_core_custom_branding_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_common.mdx b/api_docs/kbn_core_custom_branding_common.mdx
index 93daedf7b13a4..6c06210748748 100644
--- a/api_docs/kbn_core_custom_branding_common.mdx
+++ b/api_docs/kbn_core_custom_branding_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-common
 title: "@kbn/core-custom-branding-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-common']
 ---
 import kbnCoreCustomBrandingCommonObj from './kbn_core_custom_branding_common.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server.mdx b/api_docs/kbn_core_custom_branding_server.mdx
index 479530c51bf81..ffe766f46c68f 100644
--- a/api_docs/kbn_core_custom_branding_server.mdx
+++ b/api_docs/kbn_core_custom_branding_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server
 title: "@kbn/core-custom-branding-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server']
 ---
 import kbnCoreCustomBrandingServerObj from './kbn_core_custom_branding_server.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_internal.mdx b/api_docs/kbn_core_custom_branding_server_internal.mdx
index 8ca298141f414..e578ff6f222e7 100644
--- a/api_docs/kbn_core_custom_branding_server_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-internal
 title: "@kbn/core-custom-branding-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-internal']
 ---
 import kbnCoreCustomBrandingServerInternalObj from './kbn_core_custom_branding_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_mocks.mdx b/api_docs/kbn_core_custom_branding_server_mocks.mdx
index 7fe86cc86a492..ec61d9e871e69 100644
--- a/api_docs/kbn_core_custom_branding_server_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-mocks
 title: "@kbn/core-custom-branding-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-mocks']
 ---
 import kbnCoreCustomBrandingServerMocksObj from './kbn_core_custom_branding_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser.mdx b/api_docs/kbn_core_deprecations_browser.mdx
index 09c29d178a0fe..1c3712442b5f0 100644
--- a/api_docs/kbn_core_deprecations_browser.mdx
+++ b/api_docs/kbn_core_deprecations_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser
 title: "@kbn/core-deprecations-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser']
 ---
 import kbnCoreDeprecationsBrowserObj from './kbn_core_deprecations_browser.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_internal.mdx b/api_docs/kbn_core_deprecations_browser_internal.mdx
index 0d2b7218e54ac..a1901060a7e91 100644
--- a/api_docs/kbn_core_deprecations_browser_internal.mdx
+++ b/api_docs/kbn_core_deprecations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-internal
 title: "@kbn/core-deprecations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-internal']
 ---
 import kbnCoreDeprecationsBrowserInternalObj from './kbn_core_deprecations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_mocks.mdx b/api_docs/kbn_core_deprecations_browser_mocks.mdx
index 740e7fe40341c..13e7500bca429 100644
--- a/api_docs/kbn_core_deprecations_browser_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-mocks
 title: "@kbn/core-deprecations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-mocks']
 ---
 import kbnCoreDeprecationsBrowserMocksObj from './kbn_core_deprecations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_common.mdx b/api_docs/kbn_core_deprecations_common.mdx
index 4b4be715f501d..359636705dd71 100644
--- a/api_docs/kbn_core_deprecations_common.mdx
+++ b/api_docs/kbn_core_deprecations_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-common
 title: "@kbn/core-deprecations-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-common']
 ---
 import kbnCoreDeprecationsCommonObj from './kbn_core_deprecations_common.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server.mdx b/api_docs/kbn_core_deprecations_server.mdx
index f6d99feabf108..1df75311b4c81 100644
--- a/api_docs/kbn_core_deprecations_server.mdx
+++ b/api_docs/kbn_core_deprecations_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server
 title: "@kbn/core-deprecations-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server']
 ---
 import kbnCoreDeprecationsServerObj from './kbn_core_deprecations_server.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_internal.mdx b/api_docs/kbn_core_deprecations_server_internal.mdx
index 83c02407894f4..b6aca33a1ac27 100644
--- a/api_docs/kbn_core_deprecations_server_internal.mdx
+++ b/api_docs/kbn_core_deprecations_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-internal
 title: "@kbn/core-deprecations-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-internal']
 ---
 import kbnCoreDeprecationsServerInternalObj from './kbn_core_deprecations_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_mocks.mdx b/api_docs/kbn_core_deprecations_server_mocks.mdx
index 1912a6996080e..180a778426ad6 100644
--- a/api_docs/kbn_core_deprecations_server_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-mocks
 title: "@kbn/core-deprecations-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-mocks']
 ---
 import kbnCoreDeprecationsServerMocksObj from './kbn_core_deprecations_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser.mdx b/api_docs/kbn_core_doc_links_browser.mdx
index a9c3c4fdbf9ae..b6c238567ffca 100644
--- a/api_docs/kbn_core_doc_links_browser.mdx
+++ b/api_docs/kbn_core_doc_links_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser
 title: "@kbn/core-doc-links-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser']
 ---
 import kbnCoreDocLinksBrowserObj from './kbn_core_doc_links_browser.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser_mocks.mdx b/api_docs/kbn_core_doc_links_browser_mocks.mdx
index ba7692df85c85..f9fba5f4c6094 100644
--- a/api_docs/kbn_core_doc_links_browser_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser-mocks
 title: "@kbn/core-doc-links-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser-mocks']
 ---
 import kbnCoreDocLinksBrowserMocksObj from './kbn_core_doc_links_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server.mdx b/api_docs/kbn_core_doc_links_server.mdx
index db1ca6333973f..16818648c7493 100644
--- a/api_docs/kbn_core_doc_links_server.mdx
+++ b/api_docs/kbn_core_doc_links_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server
 title: "@kbn/core-doc-links-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server']
 ---
 import kbnCoreDocLinksServerObj from './kbn_core_doc_links_server.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server_mocks.mdx b/api_docs/kbn_core_doc_links_server_mocks.mdx
index 1ba87f915cef1..541a80d1bea04 100644
--- a/api_docs/kbn_core_doc_links_server_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server-mocks
 title: "@kbn/core-doc-links-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server-mocks']
 ---
 import kbnCoreDocLinksServerMocksObj from './kbn_core_doc_links_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
index 6a68c6eb9499f..929ca5e6caa1e 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-internal
 title: "@kbn/core-elasticsearch-client-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-internal']
 ---
 import kbnCoreElasticsearchClientServerInternalObj from './kbn_core_elasticsearch_client_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
index e5c8803a0d35c..498cb10a4def6 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-mocks
 title: "@kbn/core-elasticsearch-client-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-mocks']
 ---
 import kbnCoreElasticsearchClientServerMocksObj from './kbn_core_elasticsearch_client_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server.mdx b/api_docs/kbn_core_elasticsearch_server.mdx
index 24b2cf14d9a23..e65237e9ac49c 100644
--- a/api_docs/kbn_core_elasticsearch_server.mdx
+++ b/api_docs/kbn_core_elasticsearch_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server
 title: "@kbn/core-elasticsearch-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server']
 ---
 import kbnCoreElasticsearchServerObj from './kbn_core_elasticsearch_server.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_internal.mdx b/api_docs/kbn_core_elasticsearch_server_internal.mdx
index 6751009159330..4ddb09949223d 100644
--- a/api_docs/kbn_core_elasticsearch_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-internal
 title: "@kbn/core-elasticsearch-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-internal']
 ---
 import kbnCoreElasticsearchServerInternalObj from './kbn_core_elasticsearch_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
index b5976699d9b8f..8a9797e655519 100644
--- a/api_docs/kbn_core_elasticsearch_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-mocks
 title: "@kbn/core-elasticsearch-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-mocks']
 ---
 import kbnCoreElasticsearchServerMocksObj from './kbn_core_elasticsearch_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_internal.mdx b/api_docs/kbn_core_environment_server_internal.mdx
index 5e6cdbe68c253..f6393471dcd17 100644
--- a/api_docs/kbn_core_environment_server_internal.mdx
+++ b/api_docs/kbn_core_environment_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-internal
 title: "@kbn/core-environment-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-internal']
 ---
 import kbnCoreEnvironmentServerInternalObj from './kbn_core_environment_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_mocks.mdx b/api_docs/kbn_core_environment_server_mocks.mdx
index b8e89fc2053bc..6165d77ee5eca 100644
--- a/api_docs/kbn_core_environment_server_mocks.mdx
+++ b/api_docs/kbn_core_environment_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-mocks
 title: "@kbn/core-environment-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-mocks']
 ---
 import kbnCoreEnvironmentServerMocksObj from './kbn_core_environment_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser.mdx b/api_docs/kbn_core_execution_context_browser.mdx
index 9e3998885fb02..fe060d70c55c5 100644
--- a/api_docs/kbn_core_execution_context_browser.mdx
+++ b/api_docs/kbn_core_execution_context_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser
 title: "@kbn/core-execution-context-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser']
 ---
 import kbnCoreExecutionContextBrowserObj from './kbn_core_execution_context_browser.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_internal.mdx b/api_docs/kbn_core_execution_context_browser_internal.mdx
index fa3c7a486a73e..a2b222884a4df 100644
--- a/api_docs/kbn_core_execution_context_browser_internal.mdx
+++ b/api_docs/kbn_core_execution_context_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-internal
 title: "@kbn/core-execution-context-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-internal']
 ---
 import kbnCoreExecutionContextBrowserInternalObj from './kbn_core_execution_context_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_mocks.mdx b/api_docs/kbn_core_execution_context_browser_mocks.mdx
index 4096893d6631b..c113243dee092 100644
--- a/api_docs/kbn_core_execution_context_browser_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-mocks
 title: "@kbn/core-execution-context-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-mocks']
 ---
 import kbnCoreExecutionContextBrowserMocksObj from './kbn_core_execution_context_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_common.mdx b/api_docs/kbn_core_execution_context_common.mdx
index d6c9da222caf9..d29a072ce8f79 100644
--- a/api_docs/kbn_core_execution_context_common.mdx
+++ b/api_docs/kbn_core_execution_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-common
 title: "@kbn/core-execution-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-common']
 ---
 import kbnCoreExecutionContextCommonObj from './kbn_core_execution_context_common.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server.mdx b/api_docs/kbn_core_execution_context_server.mdx
index a058956d068a0..7ca7ed98f95ef 100644
--- a/api_docs/kbn_core_execution_context_server.mdx
+++ b/api_docs/kbn_core_execution_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server
 title: "@kbn/core-execution-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server']
 ---
 import kbnCoreExecutionContextServerObj from './kbn_core_execution_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_internal.mdx b/api_docs/kbn_core_execution_context_server_internal.mdx
index 1ed91da55936f..45bc829fb0f88 100644
--- a/api_docs/kbn_core_execution_context_server_internal.mdx
+++ b/api_docs/kbn_core_execution_context_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-internal
 title: "@kbn/core-execution-context-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-internal']
 ---
 import kbnCoreExecutionContextServerInternalObj from './kbn_core_execution_context_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_mocks.mdx b/api_docs/kbn_core_execution_context_server_mocks.mdx
index 1c34a681a4ab0..9f7cfa97b24a3 100644
--- a/api_docs/kbn_core_execution_context_server_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-mocks
 title: "@kbn/core-execution-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-mocks']
 ---
 import kbnCoreExecutionContextServerMocksObj from './kbn_core_execution_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser.mdx b/api_docs/kbn_core_fatal_errors_browser.mdx
index 1828a48c46486..d5bb1f575c6f8 100644
--- a/api_docs/kbn_core_fatal_errors_browser.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser
 title: "@kbn/core-fatal-errors-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser']
 ---
 import kbnCoreFatalErrorsBrowserObj from './kbn_core_fatal_errors_browser.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
index f52a4555be911..e264d8198b711 100644
--- a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser-mocks
 title: "@kbn/core-fatal-errors-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser-mocks']
 ---
 import kbnCoreFatalErrorsBrowserMocksObj from './kbn_core_fatal_errors_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser.mdx b/api_docs/kbn_core_http_browser.mdx
index 42500c1449331..63967be48f38f 100644
--- a/api_docs/kbn_core_http_browser.mdx
+++ b/api_docs/kbn_core_http_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser
 title: "@kbn/core-http-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser']
 ---
 import kbnCoreHttpBrowserObj from './kbn_core_http_browser.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_internal.mdx b/api_docs/kbn_core_http_browser_internal.mdx
index e48eee0106d4c..fc84c83a80837 100644
--- a/api_docs/kbn_core_http_browser_internal.mdx
+++ b/api_docs/kbn_core_http_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-internal
 title: "@kbn/core-http-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-internal']
 ---
 import kbnCoreHttpBrowserInternalObj from './kbn_core_http_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_mocks.mdx b/api_docs/kbn_core_http_browser_mocks.mdx
index cbda349122f74..71bd148c57a2d 100644
--- a/api_docs/kbn_core_http_browser_mocks.mdx
+++ b/api_docs/kbn_core_http_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-mocks
 title: "@kbn/core-http-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-mocks']
 ---
 import kbnCoreHttpBrowserMocksObj from './kbn_core_http_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_common.mdx b/api_docs/kbn_core_http_common.mdx
index 5b91484d1b26c..1d13ce00852ac 100644
--- a/api_docs/kbn_core_http_common.mdx
+++ b/api_docs/kbn_core_http_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-common
 title: "@kbn/core-http-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-common']
 ---
 import kbnCoreHttpCommonObj from './kbn_core_http_common.devdocs.json';
diff --git a/api_docs/kbn_core_http_context_server_mocks.mdx b/api_docs/kbn_core_http_context_server_mocks.mdx
index 499563bcb3853..cd6feaac819b1 100644
--- a/api_docs/kbn_core_http_context_server_mocks.mdx
+++ b/api_docs/kbn_core_http_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-context-server-mocks
 title: "@kbn/core-http-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-context-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-context-server-mocks']
 ---
 import kbnCoreHttpContextServerMocksObj from './kbn_core_http_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_request_handler_context_server.mdx b/api_docs/kbn_core_http_request_handler_context_server.mdx
index d4dc541d22073..81147ac9134ee 100644
--- a/api_docs/kbn_core_http_request_handler_context_server.mdx
+++ b/api_docs/kbn_core_http_request_handler_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-request-handler-context-server
 title: "@kbn/core-http-request-handler-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-request-handler-context-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-request-handler-context-server']
 ---
 import kbnCoreHttpRequestHandlerContextServerObj from './kbn_core_http_request_handler_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server.mdx b/api_docs/kbn_core_http_resources_server.mdx
index 8a1057887dfad..04589671d9c8b 100644
--- a/api_docs/kbn_core_http_resources_server.mdx
+++ b/api_docs/kbn_core_http_resources_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server
 title: "@kbn/core-http-resources-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server']
 ---
 import kbnCoreHttpResourcesServerObj from './kbn_core_http_resources_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_internal.mdx b/api_docs/kbn_core_http_resources_server_internal.mdx
index 41d604dedd65d..8048532f90fd9 100644
--- a/api_docs/kbn_core_http_resources_server_internal.mdx
+++ b/api_docs/kbn_core_http_resources_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-internal
 title: "@kbn/core-http-resources-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-internal']
 ---
 import kbnCoreHttpResourcesServerInternalObj from './kbn_core_http_resources_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_mocks.mdx b/api_docs/kbn_core_http_resources_server_mocks.mdx
index ced317ad951b8..aedf50d4022af 100644
--- a/api_docs/kbn_core_http_resources_server_mocks.mdx
+++ b/api_docs/kbn_core_http_resources_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-mocks
 title: "@kbn/core-http-resources-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-mocks']
 ---
 import kbnCoreHttpResourcesServerMocksObj from './kbn_core_http_resources_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_internal.mdx b/api_docs/kbn_core_http_router_server_internal.mdx
index ec05bb42e941e..5edcfeacf73fb 100644
--- a/api_docs/kbn_core_http_router_server_internal.mdx
+++ b/api_docs/kbn_core_http_router_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-internal
 title: "@kbn/core-http-router-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-internal']
 ---
 import kbnCoreHttpRouterServerInternalObj from './kbn_core_http_router_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_mocks.mdx b/api_docs/kbn_core_http_router_server_mocks.mdx
index 7b3fe35f6b3bb..1b41384d41792 100644
--- a/api_docs/kbn_core_http_router_server_mocks.mdx
+++ b/api_docs/kbn_core_http_router_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-mocks
 title: "@kbn/core-http-router-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-mocks']
 ---
 import kbnCoreHttpRouterServerMocksObj from './kbn_core_http_router_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_server.mdx b/api_docs/kbn_core_http_server.mdx
index 814131d015e74..de04a5d277297 100644
--- a/api_docs/kbn_core_http_server.mdx
+++ b/api_docs/kbn_core_http_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server
 title: "@kbn/core-http-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server']
 ---
 import kbnCoreHttpServerObj from './kbn_core_http_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_internal.mdx b/api_docs/kbn_core_http_server_internal.mdx
index ec5849ed565e1..aca4f2410ad30 100644
--- a/api_docs/kbn_core_http_server_internal.mdx
+++ b/api_docs/kbn_core_http_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-internal
 title: "@kbn/core-http-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-internal']
 ---
 import kbnCoreHttpServerInternalObj from './kbn_core_http_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_mocks.mdx b/api_docs/kbn_core_http_server_mocks.mdx
index a2d52f79b1a88..4d3f0730e5acf 100644
--- a/api_docs/kbn_core_http_server_mocks.mdx
+++ b/api_docs/kbn_core_http_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-mocks
 title: "@kbn/core-http-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-mocks']
 ---
 import kbnCoreHttpServerMocksObj from './kbn_core_http_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser.mdx b/api_docs/kbn_core_i18n_browser.mdx
index 70ec5e53f7826..c86f6a4c451f2 100644
--- a/api_docs/kbn_core_i18n_browser.mdx
+++ b/api_docs/kbn_core_i18n_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser
 title: "@kbn/core-i18n-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser']
 ---
 import kbnCoreI18nBrowserObj from './kbn_core_i18n_browser.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser_mocks.mdx b/api_docs/kbn_core_i18n_browser_mocks.mdx
index b78a7a37e195c..8de9286f4106e 100644
--- a/api_docs/kbn_core_i18n_browser_mocks.mdx
+++ b/api_docs/kbn_core_i18n_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser-mocks
 title: "@kbn/core-i18n-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser-mocks']
 ---
 import kbnCoreI18nBrowserMocksObj from './kbn_core_i18n_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server.mdx b/api_docs/kbn_core_i18n_server.mdx
index ee3c22f3f7888..eb15fb4a47b67 100644
--- a/api_docs/kbn_core_i18n_server.mdx
+++ b/api_docs/kbn_core_i18n_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server
 title: "@kbn/core-i18n-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server']
 ---
 import kbnCoreI18nServerObj from './kbn_core_i18n_server.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_internal.mdx b/api_docs/kbn_core_i18n_server_internal.mdx
index 916009fcfd73e..06ffcd6a61b4a 100644
--- a/api_docs/kbn_core_i18n_server_internal.mdx
+++ b/api_docs/kbn_core_i18n_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-internal
 title: "@kbn/core-i18n-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-internal']
 ---
 import kbnCoreI18nServerInternalObj from './kbn_core_i18n_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_mocks.mdx b/api_docs/kbn_core_i18n_server_mocks.mdx
index 070b001b1966b..9d52f727daa74 100644
--- a/api_docs/kbn_core_i18n_server_mocks.mdx
+++ b/api_docs/kbn_core_i18n_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-mocks
 title: "@kbn/core-i18n-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-mocks']
 ---
 import kbnCoreI18nServerMocksObj from './kbn_core_i18n_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
index 4d03bcac5b5f1..d30da2296a083 100644
--- a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
+++ b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-injected-metadata-browser-mocks
 title: "@kbn/core-injected-metadata-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-injected-metadata-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-injected-metadata-browser-mocks']
 ---
 import kbnCoreInjectedMetadataBrowserMocksObj from './kbn_core_injected_metadata_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_internal.mdx b/api_docs/kbn_core_integrations_browser_internal.mdx
index ee3665e1077e9..2dae763b46197 100644
--- a/api_docs/kbn_core_integrations_browser_internal.mdx
+++ b/api_docs/kbn_core_integrations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-internal
 title: "@kbn/core-integrations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-internal']
 ---
 import kbnCoreIntegrationsBrowserInternalObj from './kbn_core_integrations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_mocks.mdx b/api_docs/kbn_core_integrations_browser_mocks.mdx
index e6fd91ff759ae..d578e8d7b0d8b 100644
--- a/api_docs/kbn_core_integrations_browser_mocks.mdx
+++ b/api_docs/kbn_core_integrations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-mocks
 title: "@kbn/core-integrations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-mocks']
 ---
 import kbnCoreIntegrationsBrowserMocksObj from './kbn_core_integrations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser.devdocs.json b/api_docs/kbn_core_lifecycle_browser.devdocs.json
index 2dc072deb9de8..69669e96d4319 100644
--- a/api_docs/kbn_core_lifecycle_browser.devdocs.json
+++ b/api_docs/kbn_core_lifecycle_browser.devdocs.json
@@ -709,6 +709,10 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/app.tsx"
               },
+              {
+                "plugin": "ml",
+                "path": "x-pack/plugins/ml/public/application/app.tsx"
+              },
               {
                 "plugin": "infra",
                 "path": "x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx"
diff --git a/api_docs/kbn_core_lifecycle_browser.mdx b/api_docs/kbn_core_lifecycle_browser.mdx
index 803e088c0d302..67232d6f5d9cf 100644
--- a/api_docs/kbn_core_lifecycle_browser.mdx
+++ b/api_docs/kbn_core_lifecycle_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser
 title: "@kbn/core-lifecycle-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser']
 ---
 import kbnCoreLifecycleBrowserObj from './kbn_core_lifecycle_browser.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser_mocks.mdx b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
index c5bb5bc287b94..3869ee3e94ed8 100644
--- a/api_docs/kbn_core_lifecycle_browser_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser-mocks
 title: "@kbn/core-lifecycle-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser-mocks']
 ---
 import kbnCoreLifecycleBrowserMocksObj from './kbn_core_lifecycle_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server.mdx b/api_docs/kbn_core_lifecycle_server.mdx
index acb577ddd9793..18fd2df3edc1b 100644
--- a/api_docs/kbn_core_lifecycle_server.mdx
+++ b/api_docs/kbn_core_lifecycle_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server
 title: "@kbn/core-lifecycle-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server']
 ---
 import kbnCoreLifecycleServerObj from './kbn_core_lifecycle_server.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server_mocks.mdx b/api_docs/kbn_core_lifecycle_server_mocks.mdx
index bccb040d98536..7f5da2fc1f82d 100644
--- a/api_docs/kbn_core_lifecycle_server_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server-mocks
 title: "@kbn/core-lifecycle-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server-mocks']
 ---
 import kbnCoreLifecycleServerMocksObj from './kbn_core_lifecycle_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_browser_mocks.mdx b/api_docs/kbn_core_logging_browser_mocks.mdx
index 5a1000962f821..fc76dcd0f04a6 100644
--- a/api_docs/kbn_core_logging_browser_mocks.mdx
+++ b/api_docs/kbn_core_logging_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-browser-mocks
 title: "@kbn/core-logging-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-browser-mocks']
 ---
 import kbnCoreLoggingBrowserMocksObj from './kbn_core_logging_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_common_internal.mdx b/api_docs/kbn_core_logging_common_internal.mdx
index b56580d60fed2..9fdb05e88447a 100644
--- a/api_docs/kbn_core_logging_common_internal.mdx
+++ b/api_docs/kbn_core_logging_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-common-internal
 title: "@kbn/core-logging-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-common-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-common-internal']
 ---
 import kbnCoreLoggingCommonInternalObj from './kbn_core_logging_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server.mdx b/api_docs/kbn_core_logging_server.mdx
index d0113e9a3eaad..29d4095e5395b 100644
--- a/api_docs/kbn_core_logging_server.mdx
+++ b/api_docs/kbn_core_logging_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server
 title: "@kbn/core-logging-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server']
 ---
 import kbnCoreLoggingServerObj from './kbn_core_logging_server.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_internal.mdx b/api_docs/kbn_core_logging_server_internal.mdx
index d1eff84a39eae..35a50425965d2 100644
--- a/api_docs/kbn_core_logging_server_internal.mdx
+++ b/api_docs/kbn_core_logging_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-internal
 title: "@kbn/core-logging-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-internal']
 ---
 import kbnCoreLoggingServerInternalObj from './kbn_core_logging_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_mocks.mdx b/api_docs/kbn_core_logging_server_mocks.mdx
index 0c0229fc331c2..c6057a0dad1b4 100644
--- a/api_docs/kbn_core_logging_server_mocks.mdx
+++ b/api_docs/kbn_core_logging_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-mocks
 title: "@kbn/core-logging-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-mocks']
 ---
 import kbnCoreLoggingServerMocksObj from './kbn_core_logging_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_internal.mdx b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
index fec8cab86e7a1..d988e2469ded8 100644
--- a/api_docs/kbn_core_metrics_collectors_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-internal
 title: "@kbn/core-metrics-collectors-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-internal']
 ---
 import kbnCoreMetricsCollectorsServerInternalObj from './kbn_core_metrics_collectors_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
index 802578f21771c..3a633bd70ae8d 100644
--- a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-mocks
 title: "@kbn/core-metrics-collectors-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-mocks']
 ---
 import kbnCoreMetricsCollectorsServerMocksObj from './kbn_core_metrics_collectors_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server.mdx b/api_docs/kbn_core_metrics_server.mdx
index 2ef489a080d62..6a801616924de 100644
--- a/api_docs/kbn_core_metrics_server.mdx
+++ b/api_docs/kbn_core_metrics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server
 title: "@kbn/core-metrics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server']
 ---
 import kbnCoreMetricsServerObj from './kbn_core_metrics_server.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_internal.mdx b/api_docs/kbn_core_metrics_server_internal.mdx
index 80d577ea9a36b..98f16d74311a3 100644
--- a/api_docs/kbn_core_metrics_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-internal
 title: "@kbn/core-metrics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-internal']
 ---
 import kbnCoreMetricsServerInternalObj from './kbn_core_metrics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_mocks.mdx b/api_docs/kbn_core_metrics_server_mocks.mdx
index 5b1d13f4e10d3..155ba6e7be2ab 100644
--- a/api_docs/kbn_core_metrics_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-mocks
 title: "@kbn/core-metrics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-mocks']
 ---
 import kbnCoreMetricsServerMocksObj from './kbn_core_metrics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_mount_utils_browser.mdx b/api_docs/kbn_core_mount_utils_browser.mdx
index 1a27bc7312a20..1a4d662b3a2df 100644
--- a/api_docs/kbn_core_mount_utils_browser.mdx
+++ b/api_docs/kbn_core_mount_utils_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-mount-utils-browser
 title: "@kbn/core-mount-utils-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-mount-utils-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-mount-utils-browser']
 ---
 import kbnCoreMountUtilsBrowserObj from './kbn_core_mount_utils_browser.devdocs.json';
diff --git a/api_docs/kbn_core_node_server.mdx b/api_docs/kbn_core_node_server.mdx
index 29168c8dd36c2..03bd610124f17 100644
--- a/api_docs/kbn_core_node_server.mdx
+++ b/api_docs/kbn_core_node_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server
 title: "@kbn/core-node-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server']
 ---
 import kbnCoreNodeServerObj from './kbn_core_node_server.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_internal.mdx b/api_docs/kbn_core_node_server_internal.mdx
index 01b61a79fe8ab..0df9692e82295 100644
--- a/api_docs/kbn_core_node_server_internal.mdx
+++ b/api_docs/kbn_core_node_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-internal
 title: "@kbn/core-node-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-internal']
 ---
 import kbnCoreNodeServerInternalObj from './kbn_core_node_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_mocks.mdx b/api_docs/kbn_core_node_server_mocks.mdx
index 89d6088c2e75a..1af721281233c 100644
--- a/api_docs/kbn_core_node_server_mocks.mdx
+++ b/api_docs/kbn_core_node_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-mocks
 title: "@kbn/core-node-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-mocks']
 ---
 import kbnCoreNodeServerMocksObj from './kbn_core_node_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser.mdx b/api_docs/kbn_core_notifications_browser.mdx
index 6cea67e883ea5..e5ceb80bfbf3d 100644
--- a/api_docs/kbn_core_notifications_browser.mdx
+++ b/api_docs/kbn_core_notifications_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser
 title: "@kbn/core-notifications-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser']
 ---
 import kbnCoreNotificationsBrowserObj from './kbn_core_notifications_browser.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_internal.mdx b/api_docs/kbn_core_notifications_browser_internal.mdx
index 3fe1ec109fba3..db585e1e7019d 100644
--- a/api_docs/kbn_core_notifications_browser_internal.mdx
+++ b/api_docs/kbn_core_notifications_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-internal
 title: "@kbn/core-notifications-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-internal']
 ---
 import kbnCoreNotificationsBrowserInternalObj from './kbn_core_notifications_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_mocks.mdx b/api_docs/kbn_core_notifications_browser_mocks.mdx
index b5fc67506249a..67229dca7a43b 100644
--- a/api_docs/kbn_core_notifications_browser_mocks.mdx
+++ b/api_docs/kbn_core_notifications_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-mocks
 title: "@kbn/core-notifications-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-mocks']
 ---
 import kbnCoreNotificationsBrowserMocksObj from './kbn_core_notifications_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser.mdx b/api_docs/kbn_core_overlays_browser.mdx
index 08bbe84068ee5..35e54d77796de 100644
--- a/api_docs/kbn_core_overlays_browser.mdx
+++ b/api_docs/kbn_core_overlays_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser
 title: "@kbn/core-overlays-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser']
 ---
 import kbnCoreOverlaysBrowserObj from './kbn_core_overlays_browser.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_internal.mdx b/api_docs/kbn_core_overlays_browser_internal.mdx
index aa973df88eb1b..b6f0a91c14752 100644
--- a/api_docs/kbn_core_overlays_browser_internal.mdx
+++ b/api_docs/kbn_core_overlays_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-internal
 title: "@kbn/core-overlays-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-internal']
 ---
 import kbnCoreOverlaysBrowserInternalObj from './kbn_core_overlays_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_mocks.mdx b/api_docs/kbn_core_overlays_browser_mocks.mdx
index f7b62ebf26211..4b7d2625fd3c1 100644
--- a/api_docs/kbn_core_overlays_browser_mocks.mdx
+++ b/api_docs/kbn_core_overlays_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-mocks
 title: "@kbn/core-overlays-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-mocks']
 ---
 import kbnCoreOverlaysBrowserMocksObj from './kbn_core_overlays_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser.mdx b/api_docs/kbn_core_plugins_browser.mdx
index 9b212f6e3f9c1..86f325a025185 100644
--- a/api_docs/kbn_core_plugins_browser.mdx
+++ b/api_docs/kbn_core_plugins_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser
 title: "@kbn/core-plugins-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser']
 ---
 import kbnCorePluginsBrowserObj from './kbn_core_plugins_browser.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser_mocks.mdx b/api_docs/kbn_core_plugins_browser_mocks.mdx
index 083d82c7aa728..82a3ca522cb2b 100644
--- a/api_docs/kbn_core_plugins_browser_mocks.mdx
+++ b/api_docs/kbn_core_plugins_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser-mocks
 title: "@kbn/core-plugins-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser-mocks']
 ---
 import kbnCorePluginsBrowserMocksObj from './kbn_core_plugins_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server.mdx b/api_docs/kbn_core_plugins_server.mdx
index 9bfe434c198c8..998a86017f32b 100644
--- a/api_docs/kbn_core_plugins_server.mdx
+++ b/api_docs/kbn_core_plugins_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server
 title: "@kbn/core-plugins-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server']
 ---
 import kbnCorePluginsServerObj from './kbn_core_plugins_server.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server_mocks.mdx b/api_docs/kbn_core_plugins_server_mocks.mdx
index d0c7ac93bd9b3..7b6c1e6265bff 100644
--- a/api_docs/kbn_core_plugins_server_mocks.mdx
+++ b/api_docs/kbn_core_plugins_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server-mocks
 title: "@kbn/core-plugins-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server-mocks']
 ---
 import kbnCorePluginsServerMocksObj from './kbn_core_plugins_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server.mdx b/api_docs/kbn_core_preboot_server.mdx
index 4af53b5883716..859ae78a6bc92 100644
--- a/api_docs/kbn_core_preboot_server.mdx
+++ b/api_docs/kbn_core_preboot_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server
 title: "@kbn/core-preboot-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server']
 ---
 import kbnCorePrebootServerObj from './kbn_core_preboot_server.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server_mocks.mdx b/api_docs/kbn_core_preboot_server_mocks.mdx
index ae4678eb866b3..0a2fc227d5caa 100644
--- a/api_docs/kbn_core_preboot_server_mocks.mdx
+++ b/api_docs/kbn_core_preboot_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server-mocks
 title: "@kbn/core-preboot-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server-mocks']
 ---
 import kbnCorePrebootServerMocksObj from './kbn_core_preboot_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_browser_mocks.mdx b/api_docs/kbn_core_rendering_browser_mocks.mdx
index dec57e714aee0..191991e420a16 100644
--- a/api_docs/kbn_core_rendering_browser_mocks.mdx
+++ b/api_docs/kbn_core_rendering_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-browser-mocks
 title: "@kbn/core-rendering-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-browser-mocks']
 ---
 import kbnCoreRenderingBrowserMocksObj from './kbn_core_rendering_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_internal.mdx b/api_docs/kbn_core_rendering_server_internal.mdx
index 60664c8a2b463..e003dcea80ff6 100644
--- a/api_docs/kbn_core_rendering_server_internal.mdx
+++ b/api_docs/kbn_core_rendering_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-internal
 title: "@kbn/core-rendering-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-internal']
 ---
 import kbnCoreRenderingServerInternalObj from './kbn_core_rendering_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_mocks.mdx b/api_docs/kbn_core_rendering_server_mocks.mdx
index 6b91b53cad58c..e77835e381a14 100644
--- a/api_docs/kbn_core_rendering_server_mocks.mdx
+++ b/api_docs/kbn_core_rendering_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-mocks
 title: "@kbn/core-rendering-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-mocks']
 ---
 import kbnCoreRenderingServerMocksObj from './kbn_core_rendering_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_root_server_internal.mdx b/api_docs/kbn_core_root_server_internal.mdx
index 1f8c1ee1c338e..3bab1873e311b 100644
--- a/api_docs/kbn_core_root_server_internal.mdx
+++ b/api_docs/kbn_core_root_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-root-server-internal
 title: "@kbn/core-root-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-root-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-root-server-internal']
 ---
 import kbnCoreRootServerInternalObj from './kbn_core_root_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_browser.devdocs.json b/api_docs/kbn_core_saved_objects_api_browser.devdocs.json
index 0875a3e75de10..9d56effb55676 100644
--- a/api_docs/kbn_core_saved_objects_api_browser.devdocs.json
+++ b/api_docs/kbn_core_saved_objects_api_browser.devdocs.json
@@ -1178,6 +1178,18 @@
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/util/dependency_cache.ts"
           },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/use_resolver.ts"
+          },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/use_resolver.ts"
+          },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/use_resolver.ts"
+          },
           {
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/services/dashboard_service.ts"
@@ -1186,6 +1198,14 @@
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/services/dashboard_service.ts"
           },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
+          },
+          {
+            "plugin": "ml",
+            "path": "x-pack/plugins/ml/public/application/routing/router.tsx"
+          },
           {
             "plugin": "canvas",
             "path": "x-pack/plugins/canvas/public/services/platform.ts"
@@ -2491,10 +2511,6 @@
                 "plugin": "dashboard",
                 "path": "src/plugins/dashboard/public/dashboard_actions/clone_panel_action.tsx"
               },
-              {
-                "plugin": "dataVisualizer",
-                "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
-              },
               {
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/public/application/util/index_utils.ts"
@@ -4136,14 +4152,6 @@
             "plugin": "dataVisualizer",
             "path": "x-pack/plugins/data_visualizer/common/types/index.ts"
           },
-          {
-            "plugin": "dataVisualizer",
-            "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
-          },
-          {
-            "plugin": "dataVisualizer",
-            "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index_data_visualizer.tsx"
-          },
           {
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx"
diff --git a/api_docs/kbn_core_saved_objects_api_browser.mdx b/api_docs/kbn_core_saved_objects_api_browser.mdx
index e5640680fa257..b717e572cd129 100644
--- a/api_docs/kbn_core_saved_objects_api_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_api_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-browser
 title: "@kbn/core-saved-objects-api-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-browser']
 ---
 import kbnCoreSavedObjectsApiBrowserObj from './kbn_core_saved_objects_api_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server.mdx b/api_docs/kbn_core_saved_objects_api_server.mdx
index 6d390c231be61..f528f3c2a7c21 100644
--- a/api_docs/kbn_core_saved_objects_api_server.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server
 title: "@kbn/core-saved-objects-api-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server']
 ---
 import kbnCoreSavedObjectsApiServerObj from './kbn_core_saved_objects_api_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_internal.mdx b/api_docs/kbn_core_saved_objects_api_server_internal.mdx
index b80de1f3a6c92..4cb188adf676c 100644
--- a/api_docs/kbn_core_saved_objects_api_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-internal
 title: "@kbn/core-saved-objects-api-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-internal']
 ---
 import kbnCoreSavedObjectsApiServerInternalObj from './kbn_core_saved_objects_api_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
index 29b09c2573e29..01da8e89e62fc 100644
--- a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-mocks
 title: "@kbn/core-saved-objects-api-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-mocks']
 ---
 import kbnCoreSavedObjectsApiServerMocksObj from './kbn_core_saved_objects_api_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_internal.mdx b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
index e516ee15767c4..54bb3e5d59610 100644
--- a/api_docs/kbn_core_saved_objects_base_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-internal
 title: "@kbn/core-saved-objects-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-internal']
 ---
 import kbnCoreSavedObjectsBaseServerInternalObj from './kbn_core_saved_objects_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
index c33f1cc283fc8..35e22c223d0ee 100644
--- a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-mocks
 title: "@kbn/core-saved-objects-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-mocks']
 ---
 import kbnCoreSavedObjectsBaseServerMocksObj from './kbn_core_saved_objects_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser.mdx b/api_docs/kbn_core_saved_objects_browser.mdx
index c9f4cc63fca35..03c1b6ea78491 100644
--- a/api_docs/kbn_core_saved_objects_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser
 title: "@kbn/core-saved-objects-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser']
 ---
 import kbnCoreSavedObjectsBrowserObj from './kbn_core_saved_objects_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_internal.mdx b/api_docs/kbn_core_saved_objects_browser_internal.mdx
index 61d43e236cb65..46f1fc4e5eeaf 100644
--- a/api_docs/kbn_core_saved_objects_browser_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-internal
 title: "@kbn/core-saved-objects-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-internal']
 ---
 import kbnCoreSavedObjectsBrowserInternalObj from './kbn_core_saved_objects_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_mocks.mdx b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
index d345960886630..77fcd6aec301f 100644
--- a/api_docs/kbn_core_saved_objects_browser_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-mocks
 title: "@kbn/core-saved-objects-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-mocks']
 ---
 import kbnCoreSavedObjectsBrowserMocksObj from './kbn_core_saved_objects_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_common.mdx b/api_docs/kbn_core_saved_objects_common.mdx
index cd1a2fe0b3ca9..bceaf34acb141 100644
--- a/api_docs/kbn_core_saved_objects_common.mdx
+++ b/api_docs/kbn_core_saved_objects_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-common
 title: "@kbn/core-saved-objects-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-common']
 ---
 import kbnCoreSavedObjectsCommonObj from './kbn_core_saved_objects_common.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
index 4df1f8396426b..76df69eb5e2b3 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-internal
 title: "@kbn/core-saved-objects-import-export-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-internal']
 ---
 import kbnCoreSavedObjectsImportExportServerInternalObj from './kbn_core_saved_objects_import_export_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
index 2b0cb885d0e0f..2217467893a31 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-mocks
 title: "@kbn/core-saved-objects-import-export-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-mocks']
 ---
 import kbnCoreSavedObjectsImportExportServerMocksObj from './kbn_core_saved_objects_import_export_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
index 6046df2517200..4c3a30ef6b819 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-internal
 title: "@kbn/core-saved-objects-migration-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-internal']
 ---
 import kbnCoreSavedObjectsMigrationServerInternalObj from './kbn_core_saved_objects_migration_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
index 0b3a3fa873489..f58d85478ab76 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-mocks
 title: "@kbn/core-saved-objects-migration-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-mocks']
 ---
 import kbnCoreSavedObjectsMigrationServerMocksObj from './kbn_core_saved_objects_migration_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server.mdx b/api_docs/kbn_core_saved_objects_server.mdx
index 87d773ba1eb89..0972d95cd67b3 100644
--- a/api_docs/kbn_core_saved_objects_server.mdx
+++ b/api_docs/kbn_core_saved_objects_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server
 title: "@kbn/core-saved-objects-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server']
 ---
 import kbnCoreSavedObjectsServerObj from './kbn_core_saved_objects_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_internal.mdx b/api_docs/kbn_core_saved_objects_server_internal.mdx
index e485af1e5360a..6f327ed6d46cd 100644
--- a/api_docs/kbn_core_saved_objects_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-internal
 title: "@kbn/core-saved-objects-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-internal']
 ---
 import kbnCoreSavedObjectsServerInternalObj from './kbn_core_saved_objects_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_mocks.mdx b/api_docs/kbn_core_saved_objects_server_mocks.mdx
index df25c86f56512..dcb59cf245b2d 100644
--- a/api_docs/kbn_core_saved_objects_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-mocks
 title: "@kbn/core-saved-objects-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-mocks']
 ---
 import kbnCoreSavedObjectsServerMocksObj from './kbn_core_saved_objects_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_utils_server.mdx b/api_docs/kbn_core_saved_objects_utils_server.mdx
index 6df7b9144b6e3..a71f5aa44486e 100644
--- a/api_docs/kbn_core_saved_objects_utils_server.mdx
+++ b/api_docs/kbn_core_saved_objects_utils_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-utils-server
 title: "@kbn/core-saved-objects-utils-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-utils-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-utils-server']
 ---
 import kbnCoreSavedObjectsUtilsServerObj from './kbn_core_saved_objects_utils_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_common.mdx b/api_docs/kbn_core_status_common.mdx
index 884151ff0d1b2..99371df20a800 100644
--- a/api_docs/kbn_core_status_common.mdx
+++ b/api_docs/kbn_core_status_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common
 title: "@kbn/core-status-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common']
 ---
 import kbnCoreStatusCommonObj from './kbn_core_status_common.devdocs.json';
diff --git a/api_docs/kbn_core_status_common_internal.mdx b/api_docs/kbn_core_status_common_internal.mdx
index fa9c757d58672..10d10f176db26 100644
--- a/api_docs/kbn_core_status_common_internal.mdx
+++ b/api_docs/kbn_core_status_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common-internal
 title: "@kbn/core-status-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common-internal']
 ---
 import kbnCoreStatusCommonInternalObj from './kbn_core_status_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server.mdx b/api_docs/kbn_core_status_server.mdx
index 4c8202bc5b0bd..cb47fa309e3da 100644
--- a/api_docs/kbn_core_status_server.mdx
+++ b/api_docs/kbn_core_status_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server
 title: "@kbn/core-status-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server']
 ---
 import kbnCoreStatusServerObj from './kbn_core_status_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_internal.mdx b/api_docs/kbn_core_status_server_internal.mdx
index a8247f55dabfc..a442f76ebbd8f 100644
--- a/api_docs/kbn_core_status_server_internal.mdx
+++ b/api_docs/kbn_core_status_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-internal
 title: "@kbn/core-status-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-internal']
 ---
 import kbnCoreStatusServerInternalObj from './kbn_core_status_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_mocks.mdx b/api_docs/kbn_core_status_server_mocks.mdx
index 2d1f6eb6439fd..e4c9055227729 100644
--- a/api_docs/kbn_core_status_server_mocks.mdx
+++ b/api_docs/kbn_core_status_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-mocks
 title: "@kbn/core-status-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-mocks']
 ---
 import kbnCoreStatusServerMocksObj from './kbn_core_status_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
index 810ea7cae355f..793ca7f5bd0c8 100644
--- a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
+++ b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-deprecations-getters
 title: "@kbn/core-test-helpers-deprecations-getters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-deprecations-getters plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-deprecations-getters']
 ---
 import kbnCoreTestHelpersDeprecationsGettersObj from './kbn_core_test_helpers_deprecations_getters.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
index 6141868f07e50..5e8abda566982 100644
--- a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
+++ b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-http-setup-browser
 title: "@kbn/core-test-helpers-http-setup-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-http-setup-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-http-setup-browser']
 ---
 import kbnCoreTestHelpersHttpSetupBrowserObj from './kbn_core_test_helpers_http_setup_browser.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_kbn_server.mdx b/api_docs/kbn_core_test_helpers_kbn_server.mdx
index 929e9cc8151c4..67bef888192aa 100644
--- a/api_docs/kbn_core_test_helpers_kbn_server.mdx
+++ b/api_docs/kbn_core_test_helpers_kbn_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-kbn-server
 title: "@kbn/core-test-helpers-kbn-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-kbn-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-kbn-server']
 ---
 import kbnCoreTestHelpersKbnServerObj from './kbn_core_test_helpers_kbn_server.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
index 5dffa7d5ca947..a5e87c444766d 100644
--- a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
+++ b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-so-type-serializer
 title: "@kbn/core-test-helpers-so-type-serializer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-so-type-serializer plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-so-type-serializer']
 ---
 import kbnCoreTestHelpersSoTypeSerializerObj from './kbn_core_test_helpers_so_type_serializer.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_test_utils.mdx b/api_docs/kbn_core_test_helpers_test_utils.mdx
index ddddbaa1a05c0..a06a9084b18b1 100644
--- a/api_docs/kbn_core_test_helpers_test_utils.mdx
+++ b/api_docs/kbn_core_test_helpers_test_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-test-utils
 title: "@kbn/core-test-helpers-test-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-test-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-test-utils']
 ---
 import kbnCoreTestHelpersTestUtilsObj from './kbn_core_test_helpers_test_utils.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser.mdx b/api_docs/kbn_core_theme_browser.mdx
index 04eb0a2ae1149..a8cd19ae434d3 100644
--- a/api_docs/kbn_core_theme_browser.mdx
+++ b/api_docs/kbn_core_theme_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser
 title: "@kbn/core-theme-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser']
 ---
 import kbnCoreThemeBrowserObj from './kbn_core_theme_browser.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_internal.mdx b/api_docs/kbn_core_theme_browser_internal.mdx
index 4a2d95da8c381..d397fd1b9bc19 100644
--- a/api_docs/kbn_core_theme_browser_internal.mdx
+++ b/api_docs/kbn_core_theme_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-internal
 title: "@kbn/core-theme-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-internal']
 ---
 import kbnCoreThemeBrowserInternalObj from './kbn_core_theme_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_mocks.mdx b/api_docs/kbn_core_theme_browser_mocks.mdx
index 11230e9260931..118532bd25a1a 100644
--- a/api_docs/kbn_core_theme_browser_mocks.mdx
+++ b/api_docs/kbn_core_theme_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-mocks
 title: "@kbn/core-theme-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-mocks']
 ---
 import kbnCoreThemeBrowserMocksObj from './kbn_core_theme_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser.mdx b/api_docs/kbn_core_ui_settings_browser.mdx
index f4ab6d78ad897..8f0ffccb27c9c 100644
--- a/api_docs/kbn_core_ui_settings_browser.mdx
+++ b/api_docs/kbn_core_ui_settings_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser
 title: "@kbn/core-ui-settings-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser']
 ---
 import kbnCoreUiSettingsBrowserObj from './kbn_core_ui_settings_browser.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_internal.mdx b/api_docs/kbn_core_ui_settings_browser_internal.mdx
index 2ca4f0691f1b6..91b5622bf35c5 100644
--- a/api_docs/kbn_core_ui_settings_browser_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-internal
 title: "@kbn/core-ui-settings-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-internal']
 ---
 import kbnCoreUiSettingsBrowserInternalObj from './kbn_core_ui_settings_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_mocks.mdx b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
index 2a91d8d64590b..c475e76a698ba 100644
--- a/api_docs/kbn_core_ui_settings_browser_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-mocks
 title: "@kbn/core-ui-settings-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-mocks']
 ---
 import kbnCoreUiSettingsBrowserMocksObj from './kbn_core_ui_settings_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_common.mdx b/api_docs/kbn_core_ui_settings_common.mdx
index 1ce16af43b5bc..58816825f33fe 100644
--- a/api_docs/kbn_core_ui_settings_common.mdx
+++ b/api_docs/kbn_core_ui_settings_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-common
 title: "@kbn/core-ui-settings-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-common plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-common']
 ---
 import kbnCoreUiSettingsCommonObj from './kbn_core_ui_settings_common.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server.mdx b/api_docs/kbn_core_ui_settings_server.mdx
index c10dbcfa72139..7159a34214e63 100644
--- a/api_docs/kbn_core_ui_settings_server.mdx
+++ b/api_docs/kbn_core_ui_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server
 title: "@kbn/core-ui-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server']
 ---
 import kbnCoreUiSettingsServerObj from './kbn_core_ui_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_internal.mdx b/api_docs/kbn_core_ui_settings_server_internal.mdx
index 820ed14a65e06..9fea9dbb6b2d1 100644
--- a/api_docs/kbn_core_ui_settings_server_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-internal
 title: "@kbn/core-ui-settings-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-internal']
 ---
 import kbnCoreUiSettingsServerInternalObj from './kbn_core_ui_settings_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_mocks.mdx b/api_docs/kbn_core_ui_settings_server_mocks.mdx
index 4eefd75e3529b..98e0a21db126f 100644
--- a/api_docs/kbn_core_ui_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-mocks
 title: "@kbn/core-ui-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-mocks']
 ---
 import kbnCoreUiSettingsServerMocksObj from './kbn_core_ui_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server.mdx b/api_docs/kbn_core_usage_data_server.mdx
index 748038923e349..8040f1bbb40a1 100644
--- a/api_docs/kbn_core_usage_data_server.mdx
+++ b/api_docs/kbn_core_usage_data_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server
 title: "@kbn/core-usage-data-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server']
 ---
 import kbnCoreUsageDataServerObj from './kbn_core_usage_data_server.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_internal.mdx b/api_docs/kbn_core_usage_data_server_internal.mdx
index 6c8faf76c54e4..7a8d46712ec62 100644
--- a/api_docs/kbn_core_usage_data_server_internal.mdx
+++ b/api_docs/kbn_core_usage_data_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-internal
 title: "@kbn/core-usage-data-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-internal plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-internal']
 ---
 import kbnCoreUsageDataServerInternalObj from './kbn_core_usage_data_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_mocks.mdx b/api_docs/kbn_core_usage_data_server_mocks.mdx
index 89dca6c96dbec..88b2724c6628b 100644
--- a/api_docs/kbn_core_usage_data_server_mocks.mdx
+++ b/api_docs/kbn_core_usage_data_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-mocks
 title: "@kbn/core-usage-data-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-mocks']
 ---
 import kbnCoreUsageDataServerMocksObj from './kbn_core_usage_data_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_crypto.mdx b/api_docs/kbn_crypto.mdx
index 67fbd85335110..54cbf7b9c3128 100644
--- a/api_docs/kbn_crypto.mdx
+++ b/api_docs/kbn_crypto.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto
 title: "@kbn/crypto"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto']
 ---
 import kbnCryptoObj from './kbn_crypto.devdocs.json';
diff --git a/api_docs/kbn_crypto_browser.mdx b/api_docs/kbn_crypto_browser.mdx
index a077e4ecf2b08..7c46776abe985 100644
--- a/api_docs/kbn_crypto_browser.mdx
+++ b/api_docs/kbn_crypto_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto-browser
 title: "@kbn/crypto-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto-browser']
 ---
 import kbnCryptoBrowserObj from './kbn_crypto_browser.devdocs.json';
diff --git a/api_docs/kbn_cypress_config.mdx b/api_docs/kbn_cypress_config.mdx
index 36e28090a2081..2dad325478146 100644
--- a/api_docs/kbn_cypress_config.mdx
+++ b/api_docs/kbn_cypress_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cypress-config
 title: "@kbn/cypress-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cypress-config plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cypress-config']
 ---
 import kbnCypressConfigObj from './kbn_cypress_config.devdocs.json';
diff --git a/api_docs/kbn_datemath.mdx b/api_docs/kbn_datemath.mdx
index 42ba58a97cf3d..5d30b54a0587e 100644
--- a/api_docs/kbn_datemath.mdx
+++ b/api_docs/kbn_datemath.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-datemath
 title: "@kbn/datemath"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/datemath plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/datemath']
 ---
 import kbnDatemathObj from './kbn_datemath.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_errors.mdx b/api_docs/kbn_dev_cli_errors.mdx
index d7e358e6a7aa4..560e2ae92467d 100644
--- a/api_docs/kbn_dev_cli_errors.mdx
+++ b/api_docs/kbn_dev_cli_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-errors
 title: "@kbn/dev-cli-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-errors plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-errors']
 ---
 import kbnDevCliErrorsObj from './kbn_dev_cli_errors.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_runner.mdx b/api_docs/kbn_dev_cli_runner.mdx
index 105d35cb62743..39204d4ac0b22 100644
--- a/api_docs/kbn_dev_cli_runner.mdx
+++ b/api_docs/kbn_dev_cli_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-runner
 title: "@kbn/dev-cli-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-runner plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-runner']
 ---
 import kbnDevCliRunnerObj from './kbn_dev_cli_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_proc_runner.mdx b/api_docs/kbn_dev_proc_runner.mdx
index b33576a76dd17..4769b3108a57b 100644
--- a/api_docs/kbn_dev_proc_runner.mdx
+++ b/api_docs/kbn_dev_proc_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-proc-runner
 title: "@kbn/dev-proc-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-proc-runner plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-proc-runner']
 ---
 import kbnDevProcRunnerObj from './kbn_dev_proc_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx
index 287865db53760..b0839412cd4d9 100644
--- a/api_docs/kbn_dev_utils.mdx
+++ b/api_docs/kbn_dev_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-utils
 title: "@kbn/dev-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-utils']
 ---
 import kbnDevUtilsObj from './kbn_dev_utils.devdocs.json';
diff --git a/api_docs/kbn_doc_links.devdocs.json b/api_docs/kbn_doc_links.devdocs.json
index 95bd54c7055c2..7bdb77584718b 100644
--- a/api_docs/kbn_doc_links.devdocs.json
+++ b/api_docs/kbn_doc_links.devdocs.json
@@ -300,7 +300,7 @@
             "label": "enterpriseSearch",
             "description": [],
             "signature": [
-              "{ readonly apiKeys: string; readonly behavioralAnalyticsEvents: string; readonly bulkApi: string; readonly configuration: string; readonly connectors: string; readonly connectorsMongoDB: string; readonly connectorsMySQL: string; readonly connectorsWorkplaceSearch: string; readonly crawlerManaging: string; readonly crawlerOverview: string; readonly deployTrainedModels: string; readonly documentLevelSecurity: string; readonly ingestPipelines: string; readonly languageAnalyzers: string; readonly languageClients: string; readonly licenseManagement: string; readonly machineLearningStart: string; readonly mailService: string; readonly start: string; readonly syncRules: string; readonly troubleshootSetup: string; readonly usersAccess: string; }"
+              "{ readonly apiKeys: string; readonly behavioralAnalyticsEvents: string; readonly bulkApi: string; readonly configuration: string; readonly connectors: string; readonly connectorsMongoDB: string; readonly connectorsMySQL: string; readonly connectorsWorkplaceSearch: string; readonly crawlerManaging: string; readonly crawlerOverview: string; readonly deployTrainedModels: string; readonly documentLevelSecurity: string; readonly engines: string; readonly ingestPipelines: string; readonly languageAnalyzers: string; readonly languageClients: string; readonly licenseManagement: string; readonly machineLearningStart: string; readonly mailService: string; readonly start: string; readonly syncRules: string; readonly troubleshootSetup: string; readonly usersAccess: string; }"
             ],
             "path": "packages/kbn-doc-links/src/types.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_doc_links.mdx b/api_docs/kbn_doc_links.mdx
index 306f686c6e60c..bb9fbbee94fee 100644
--- a/api_docs/kbn_doc_links.mdx
+++ b/api_docs/kbn_doc_links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-doc-links
 title: "@kbn/doc-links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/doc-links plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/doc-links']
 ---
 import kbnDocLinksObj from './kbn_doc_links.devdocs.json';
diff --git a/api_docs/kbn_docs_utils.mdx b/api_docs/kbn_docs_utils.mdx
index 25fd521f294fe..b217ba24d780b 100644
--- a/api_docs/kbn_docs_utils.mdx
+++ b/api_docs/kbn_docs_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-docs-utils
 title: "@kbn/docs-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/docs-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/docs-utils']
 ---
 import kbnDocsUtilsObj from './kbn_docs_utils.devdocs.json';
diff --git a/api_docs/kbn_ebt_tools.mdx b/api_docs/kbn_ebt_tools.mdx
index f9b8bdf0b5ab2..9ae9f63865031 100644
--- a/api_docs/kbn_ebt_tools.mdx
+++ b/api_docs/kbn_ebt_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ebt-tools
 title: "@kbn/ebt-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ebt-tools plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ebt-tools']
 ---
 import kbnEbtToolsObj from './kbn_ebt_tools.devdocs.json';
diff --git a/api_docs/kbn_ecs.mdx b/api_docs/kbn_ecs.mdx
index d87a7945a7f85..0f385928af215 100644
--- a/api_docs/kbn_ecs.mdx
+++ b/api_docs/kbn_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs
 title: "@kbn/ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs']
 ---
 import kbnEcsObj from './kbn_ecs.devdocs.json';
diff --git a/api_docs/kbn_ecs_data_quality_dashboard.devdocs.json b/api_docs/kbn_ecs_data_quality_dashboard.devdocs.json
new file mode 100644
index 0000000000000..bed657d0904a3
--- /dev/null
+++ b/api_docs/kbn_ecs_data_quality_dashboard.devdocs.json
@@ -0,0 +1,171 @@
+{
+  "id": "@kbn/ecs-data-quality-dashboard",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [
+      {
+        "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+        "id": "def-common.DataQualityPanel",
+        "type": "Function",
+        "tags": [],
+        "label": "DataQualityPanel",
+        "description": [
+          "Renders the `Data Quality` dashboard content"
+        ],
+        "signature": [
+          "React.NamedExoticComponent<Props>"
+        ],
+        "path": "x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/index.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [
+          {
+            "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+            "id": "def-common.DataQualityPanel.$1",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "props",
+            "description": [],
+            "signature": [
+              "P"
+            ],
+            "path": "node_modules/@types/react/index.d.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+        "id": "def-common.getIlmPhaseDescription",
+        "type": "Function",
+        "tags": [],
+        "label": "getIlmPhaseDescription",
+        "description": [
+          "\nReturns an i18n description of an an ILM phase"
+        ],
+        "signature": [
+          "(phase: string) => string"
+        ],
+        "path": "x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+            "id": "def-common.getIlmPhaseDescription.$1",
+            "type": "string",
+            "tags": [],
+            "label": "phase",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/helpers.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      }
+    ],
+    "interfaces": [],
+    "enums": [],
+    "misc": [
+      {
+        "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+        "id": "def-common.DATA_QUALITY_SUBTITLE",
+        "type": "string",
+        "tags": [],
+        "label": "DATA_QUALITY_SUBTITLE",
+        "description": [
+          "The subtitle displayed on the Data Quality dashboard"
+        ],
+        "path": "x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/translations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+        "id": "def-common.ECS_REFERENCE_URL",
+        "type": "string",
+        "tags": [],
+        "label": "ECS_REFERENCE_URL",
+        "description": [
+          "The documentation link shown in the `Data Quality` dashboard"
+        ],
+        "signature": [
+          "\"https://www.elastic.co/guide/en/ecs/current/ecs-reference.html\""
+        ],
+        "path": "x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/data_quality_panel/index_properties/markdown/helpers.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+        "id": "def-common.ILM_PHASE",
+        "type": "string",
+        "tags": [],
+        "label": "ILM_PHASE",
+        "description": [
+          "The label displayed for the `ILM phase` combo box on the Data Quality dashboard"
+        ],
+        "path": "x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/translations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+        "id": "def-common.INDEX_LIFECYCLE_MANAGEMENT_PHASES",
+        "type": "string",
+        "tags": [],
+        "label": "INDEX_LIFECYCLE_MANAGEMENT_PHASES",
+        "description": [
+          "The tooltip for the `ILM phase` combo box on the Data Quality Dashboard"
+        ],
+        "path": "x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/translations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/ecs-data-quality-dashboard",
+        "id": "def-common.SELECT_ONE_OR_MORE_ILM_PHASES",
+        "type": "string",
+        "tags": [],
+        "label": "SELECT_ONE_OR_MORE_ILM_PHASES",
+        "description": [
+          "The placeholder for the `ILM phase` combo box on the Data Quality Dashboard"
+        ],
+        "path": "x-pack/packages/kbn-ecs-data-quality-dashboard/impl/data_quality/translations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      }
+    ],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_ecs_data_quality_dashboard.mdx b/api_docs/kbn_ecs_data_quality_dashboard.mdx
new file mode 100644
index 0000000000000..527468ce299d5
--- /dev/null
+++ b/api_docs/kbn_ecs_data_quality_dashboard.mdx
@@ -0,0 +1,33 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnEcsDataQualityDashboardPluginApi
+slug: /kibana-dev-docs/api/kbn-ecs-data-quality-dashboard
+title: "@kbn/ecs-data-quality-dashboard"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/ecs-data-quality-dashboard plugin
+date: 2023-02-07
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs-data-quality-dashboard']
+---
+import kbnEcsDataQualityDashboardObj from './kbn_ecs_data_quality_dashboard.devdocs.json';
+
+
+
+Contact [Owner missing] for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 9 | 0 | 1 | 0 |
+
+## Common
+
+### Functions
+<DocDefinitionList data={kbnEcsDataQualityDashboardObj.common.functions}/>
+
+### Consts, variables and types
+<DocDefinitionList data={kbnEcsDataQualityDashboardObj.common.misc}/>
+
diff --git a/api_docs/kbn_es.mdx b/api_docs/kbn_es.mdx
index b52410eff9a41..4ecc3ffd100eb 100644
--- a/api_docs/kbn_es.mdx
+++ b/api_docs/kbn_es.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es
 title: "@kbn/es"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es']
 ---
 import kbnEsObj from './kbn_es.devdocs.json';
diff --git a/api_docs/kbn_es_archiver.mdx b/api_docs/kbn_es_archiver.mdx
index feb2d47ad4b36..e75dac18dd5ed 100644
--- a/api_docs/kbn_es_archiver.mdx
+++ b/api_docs/kbn_es_archiver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-archiver
 title: "@kbn/es-archiver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-archiver plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-archiver']
 ---
 import kbnEsArchiverObj from './kbn_es_archiver.devdocs.json';
diff --git a/api_docs/kbn_es_errors.mdx b/api_docs/kbn_es_errors.mdx
index 51a01c84ef002..cb48293350234 100644
--- a/api_docs/kbn_es_errors.mdx
+++ b/api_docs/kbn_es_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-errors
 title: "@kbn/es-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-errors plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-errors']
 ---
 import kbnEsErrorsObj from './kbn_es_errors.devdocs.json';
diff --git a/api_docs/kbn_es_query.mdx b/api_docs/kbn_es_query.mdx
index 5fb8d4c69710f..5a4c847cc29e9 100644
--- a/api_docs/kbn_es_query.mdx
+++ b/api_docs/kbn_es_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-query
 title: "@kbn/es-query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-query plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-query']
 ---
 import kbnEsQueryObj from './kbn_es_query.devdocs.json';
diff --git a/api_docs/kbn_es_types.mdx b/api_docs/kbn_es_types.mdx
index af915e1c8a60f..dc66020dc884e 100644
--- a/api_docs/kbn_es_types.mdx
+++ b/api_docs/kbn_es_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-types
 title: "@kbn/es-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-types plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-types']
 ---
 import kbnEsTypesObj from './kbn_es_types.devdocs.json';
diff --git a/api_docs/kbn_eslint_plugin_imports.mdx b/api_docs/kbn_eslint_plugin_imports.mdx
index 7e63ded0698bd..e5c350063e150 100644
--- a/api_docs/kbn_eslint_plugin_imports.mdx
+++ b/api_docs/kbn_eslint_plugin_imports.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-eslint-plugin-imports
 title: "@kbn/eslint-plugin-imports"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/eslint-plugin-imports plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/eslint-plugin-imports']
 ---
 import kbnEslintPluginImportsObj from './kbn_eslint_plugin_imports.devdocs.json';
diff --git a/api_docs/kbn_field_types.mdx b/api_docs/kbn_field_types.mdx
index 59f654dfea57a..ca6213c81e380 100644
--- a/api_docs/kbn_field_types.mdx
+++ b/api_docs/kbn_field_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-types
 title: "@kbn/field-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-types plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-types']
 ---
 import kbnFieldTypesObj from './kbn_field_types.devdocs.json';
diff --git a/api_docs/kbn_find_used_node_modules.mdx b/api_docs/kbn_find_used_node_modules.mdx
index 08aed69cb96af..7b9d7a56bcd77 100644
--- a/api_docs/kbn_find_used_node_modules.mdx
+++ b/api_docs/kbn_find_used_node_modules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-find-used-node-modules
 title: "@kbn/find-used-node-modules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/find-used-node-modules plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/find-used-node-modules']
 ---
 import kbnFindUsedNodeModulesObj from './kbn_find_used_node_modules.devdocs.json';
diff --git a/api_docs/kbn_ftr_common_functional_services.mdx b/api_docs/kbn_ftr_common_functional_services.mdx
index 3c46723d75692..95e49b66ce1fc 100644
--- a/api_docs/kbn_ftr_common_functional_services.mdx
+++ b/api_docs/kbn_ftr_common_functional_services.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ftr-common-functional-services
 title: "@kbn/ftr-common-functional-services"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ftr-common-functional-services plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ftr-common-functional-services']
 ---
 import kbnFtrCommonFunctionalServicesObj from './kbn_ftr_common_functional_services.devdocs.json';
diff --git a/api_docs/kbn_generate.mdx b/api_docs/kbn_generate.mdx
index 6f9a831445492..b37050dc7dfa8 100644
--- a/api_docs/kbn_generate.mdx
+++ b/api_docs/kbn_generate.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate
 title: "@kbn/generate"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate']
 ---
 import kbnGenerateObj from './kbn_generate.devdocs.json';
diff --git a/api_docs/kbn_get_repo_files.mdx b/api_docs/kbn_get_repo_files.mdx
index e3326f3f69562..3e18fd3dabc7e 100644
--- a/api_docs/kbn_get_repo_files.mdx
+++ b/api_docs/kbn_get_repo_files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-get-repo-files
 title: "@kbn/get-repo-files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/get-repo-files plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/get-repo-files']
 ---
 import kbnGetRepoFilesObj from './kbn_get_repo_files.devdocs.json';
diff --git a/api_docs/kbn_guided_onboarding.devdocs.json b/api_docs/kbn_guided_onboarding.devdocs.json
index 246ef8f89dd34..c0873add630c9 100644
--- a/api_docs/kbn_guided_onboarding.devdocs.json
+++ b/api_docs/kbn_guided_onboarding.devdocs.json
@@ -215,7 +215,7 @@
             "label": "guideId",
             "description": [],
             "signature": [
-              "\"search\" | \"kubernetes\" | \"siem\" | \"testGuide\""
+              "\"kubernetes\" | \"siem\" | \"appSearch\" | \"websiteSearch\" | \"databaseSearch\" | \"testGuide\""
             ],
             "path": "packages/kbn-guided-onboarding/src/types.ts",
             "deprecated": false,
@@ -549,7 +549,7 @@
         "label": "GuideId",
         "description": [],
         "signature": [
-          "\"search\" | \"kubernetes\" | \"siem\" | \"testGuide\""
+          "\"kubernetes\" | \"siem\" | \"appSearch\" | \"websiteSearch\" | \"databaseSearch\" | \"testGuide\""
         ],
         "path": "packages/kbn-guided-onboarding/src/types.ts",
         "deprecated": false,
@@ -613,7 +613,7 @@
         "label": "testGuideId",
         "description": [],
         "signature": [
-          "\"search\" | \"kubernetes\" | \"siem\" | \"testGuide\""
+          "\"kubernetes\" | \"siem\" | \"appSearch\" | \"websiteSearch\" | \"databaseSearch\" | \"testGuide\""
         ],
         "path": "packages/kbn-guided-onboarding/src/common/test_guide_config.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_guided_onboarding.mdx b/api_docs/kbn_guided_onboarding.mdx
index a94f6f9e8de73..3ad32ba17077c 100644
--- a/api_docs/kbn_guided_onboarding.mdx
+++ b/api_docs/kbn_guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-guided-onboarding
 title: "@kbn/guided-onboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/guided-onboarding plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/guided-onboarding']
 ---
 import kbnGuidedOnboardingObj from './kbn_guided_onboarding.devdocs.json';
diff --git a/api_docs/kbn_handlebars.mdx b/api_docs/kbn_handlebars.mdx
index 921a80cb393b2..158c60596c1d5 100644
--- a/api_docs/kbn_handlebars.mdx
+++ b/api_docs/kbn_handlebars.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-handlebars
 title: "@kbn/handlebars"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/handlebars plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/handlebars']
 ---
 import kbnHandlebarsObj from './kbn_handlebars.devdocs.json';
diff --git a/api_docs/kbn_hapi_mocks.mdx b/api_docs/kbn_hapi_mocks.mdx
index 36acec1860490..a2f8c6c95fde7 100644
--- a/api_docs/kbn_hapi_mocks.mdx
+++ b/api_docs/kbn_hapi_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-hapi-mocks
 title: "@kbn/hapi-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/hapi-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/hapi-mocks']
 ---
 import kbnHapiMocksObj from './kbn_hapi_mocks.devdocs.json';
diff --git a/api_docs/kbn_health_gateway_server.mdx b/api_docs/kbn_health_gateway_server.mdx
index 0abe353ee6aaf..4327ab9588121 100644
--- a/api_docs/kbn_health_gateway_server.mdx
+++ b/api_docs/kbn_health_gateway_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-health-gateway-server
 title: "@kbn/health-gateway-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/health-gateway-server plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/health-gateway-server']
 ---
 import kbnHealthGatewayServerObj from './kbn_health_gateway_server.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_card.mdx b/api_docs/kbn_home_sample_data_card.mdx
index 0d9d8bc394e75..2a833b8f08d08 100644
--- a/api_docs/kbn_home_sample_data_card.mdx
+++ b/api_docs/kbn_home_sample_data_card.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-card
 title: "@kbn/home-sample-data-card"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-card plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-card']
 ---
 import kbnHomeSampleDataCardObj from './kbn_home_sample_data_card.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_tab.mdx b/api_docs/kbn_home_sample_data_tab.mdx
index ce539b30554fd..1f5da1d622c5b 100644
--- a/api_docs/kbn_home_sample_data_tab.mdx
+++ b/api_docs/kbn_home_sample_data_tab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-tab
 title: "@kbn/home-sample-data-tab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-tab plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-tab']
 ---
 import kbnHomeSampleDataTabObj from './kbn_home_sample_data_tab.devdocs.json';
diff --git a/api_docs/kbn_i18n.mdx b/api_docs/kbn_i18n.mdx
index 413fe32532f29..8893927e1e0d9 100644
--- a/api_docs/kbn_i18n.mdx
+++ b/api_docs/kbn_i18n.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n
 title: "@kbn/i18n"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n']
 ---
 import kbnI18nObj from './kbn_i18n.devdocs.json';
diff --git a/api_docs/kbn_i18n_react.mdx b/api_docs/kbn_i18n_react.mdx
index 43a03ca9d1d6c..808d0020d6066 100644
--- a/api_docs/kbn_i18n_react.mdx
+++ b/api_docs/kbn_i18n_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n-react
 title: "@kbn/i18n-react"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n-react plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n-react']
 ---
 import kbnI18nReactObj from './kbn_i18n_react.devdocs.json';
diff --git a/api_docs/kbn_import_resolver.mdx b/api_docs/kbn_import_resolver.mdx
index 5fa285729b608..6abed10054cc2 100644
--- a/api_docs/kbn_import_resolver.mdx
+++ b/api_docs/kbn_import_resolver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-import-resolver
 title: "@kbn/import-resolver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/import-resolver plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/import-resolver']
 ---
 import kbnImportResolverObj from './kbn_import_resolver.devdocs.json';
diff --git a/api_docs/kbn_interpreter.mdx b/api_docs/kbn_interpreter.mdx
index afc33cb8104c9..0274e4c8fc0d8 100644
--- a/api_docs/kbn_interpreter.mdx
+++ b/api_docs/kbn_interpreter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-interpreter
 title: "@kbn/interpreter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/interpreter plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/interpreter']
 ---
 import kbnInterpreterObj from './kbn_interpreter.devdocs.json';
diff --git a/api_docs/kbn_io_ts_utils.mdx b/api_docs/kbn_io_ts_utils.mdx
index 7f60edb4c605e..a63fdf66043cc 100644
--- a/api_docs/kbn_io_ts_utils.mdx
+++ b/api_docs/kbn_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-io-ts-utils
 title: "@kbn/io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/io-ts-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/io-ts-utils']
 ---
 import kbnIoTsUtilsObj from './kbn_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_jest_serializers.mdx b/api_docs/kbn_jest_serializers.mdx
index f291fc872eac5..06ec7740a70be 100644
--- a/api_docs/kbn_jest_serializers.mdx
+++ b/api_docs/kbn_jest_serializers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-jest-serializers
 title: "@kbn/jest-serializers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/jest-serializers plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/jest-serializers']
 ---
 import kbnJestSerializersObj from './kbn_jest_serializers.devdocs.json';
diff --git a/api_docs/kbn_journeys.mdx b/api_docs/kbn_journeys.mdx
index 618196777b534..2d3bf270d4e04 100644
--- a/api_docs/kbn_journeys.mdx
+++ b/api_docs/kbn_journeys.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-journeys
 title: "@kbn/journeys"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/journeys plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/journeys']
 ---
 import kbnJourneysObj from './kbn_journeys.devdocs.json';
diff --git a/api_docs/kbn_json_ast.mdx b/api_docs/kbn_json_ast.mdx
index 8df69f024406f..53b66596abe06 100644
--- a/api_docs/kbn_json_ast.mdx
+++ b/api_docs/kbn_json_ast.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-json-ast
 title: "@kbn/json-ast"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/json-ast plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/json-ast']
 ---
 import kbnJsonAstObj from './kbn_json_ast.devdocs.json';
diff --git a/api_docs/kbn_kibana_manifest_schema.mdx b/api_docs/kbn_kibana_manifest_schema.mdx
index ae41b65315f1a..40e9af3dd0942 100644
--- a/api_docs/kbn_kibana_manifest_schema.mdx
+++ b/api_docs/kbn_kibana_manifest_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-kibana-manifest-schema
 title: "@kbn/kibana-manifest-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/kibana-manifest-schema plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/kibana-manifest-schema']
 ---
 import kbnKibanaManifestSchemaObj from './kbn_kibana_manifest_schema.devdocs.json';
diff --git a/api_docs/kbn_language_documentation_popover.mdx b/api_docs/kbn_language_documentation_popover.mdx
index 3ebcb0620b9ee..4f17f96800d1b 100644
--- a/api_docs/kbn_language_documentation_popover.mdx
+++ b/api_docs/kbn_language_documentation_popover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-language-documentation-popover
 title: "@kbn/language-documentation-popover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/language-documentation-popover plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/language-documentation-popover']
 ---
 import kbnLanguageDocumentationPopoverObj from './kbn_language_documentation_popover.devdocs.json';
diff --git a/api_docs/kbn_logging.mdx b/api_docs/kbn_logging.mdx
index 1ee481a2decb8..5235b83bc90ac 100644
--- a/api_docs/kbn_logging.mdx
+++ b/api_docs/kbn_logging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging
 title: "@kbn/logging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging']
 ---
 import kbnLoggingObj from './kbn_logging.devdocs.json';
diff --git a/api_docs/kbn_logging_mocks.mdx b/api_docs/kbn_logging_mocks.mdx
index 46fb35d66725b..f08b27876fcbe 100644
--- a/api_docs/kbn_logging_mocks.mdx
+++ b/api_docs/kbn_logging_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging-mocks
 title: "@kbn/logging-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging-mocks']
 ---
 import kbnLoggingMocksObj from './kbn_logging_mocks.devdocs.json';
diff --git a/api_docs/kbn_managed_vscode_config.mdx b/api_docs/kbn_managed_vscode_config.mdx
index 4a9bd326351c8..1ef83c71f603b 100644
--- a/api_docs/kbn_managed_vscode_config.mdx
+++ b/api_docs/kbn_managed_vscode_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-managed-vscode-config
 title: "@kbn/managed-vscode-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/managed-vscode-config plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/managed-vscode-config']
 ---
 import kbnManagedVscodeConfigObj from './kbn_managed_vscode_config.devdocs.json';
diff --git a/api_docs/kbn_mapbox_gl.mdx b/api_docs/kbn_mapbox_gl.mdx
index 29013130d6578..14965886a3e6e 100644
--- a/api_docs/kbn_mapbox_gl.mdx
+++ b/api_docs/kbn_mapbox_gl.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-mapbox-gl
 title: "@kbn/mapbox-gl"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/mapbox-gl plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mapbox-gl']
 ---
 import kbnMapboxGlObj from './kbn_mapbox_gl.devdocs.json';
diff --git a/api_docs/kbn_ml_agg_utils.mdx b/api_docs/kbn_ml_agg_utils.mdx
index 94bf4b0797552..c40a53ad05568 100644
--- a/api_docs/kbn_ml_agg_utils.mdx
+++ b/api_docs/kbn_ml_agg_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-agg-utils
 title: "@kbn/ml-agg-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-agg-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-agg-utils']
 ---
 import kbnMlAggUtilsObj from './kbn_ml_agg_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_date_picker.mdx b/api_docs/kbn_ml_date_picker.mdx
index bf67fc455dd61..4a3ebca5864dd 100644
--- a/api_docs/kbn_ml_date_picker.mdx
+++ b/api_docs/kbn_ml_date_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-picker
 title: "@kbn/ml-date-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-picker plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-picker']
 ---
 import kbnMlDatePickerObj from './kbn_ml_date_picker.devdocs.json';
diff --git a/api_docs/kbn_ml_is_defined.mdx b/api_docs/kbn_ml_is_defined.mdx
index b89c976edcd1f..9669b49177e5e 100644
--- a/api_docs/kbn_ml_is_defined.mdx
+++ b/api_docs/kbn_ml_is_defined.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-defined
 title: "@kbn/ml-is-defined"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-defined plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-defined']
 ---
 import kbnMlIsDefinedObj from './kbn_ml_is_defined.devdocs.json';
diff --git a/api_docs/kbn_ml_is_populated_object.mdx b/api_docs/kbn_ml_is_populated_object.mdx
index ff7786fde7e57..dfe7bf6280cb3 100644
--- a/api_docs/kbn_ml_is_populated_object.mdx
+++ b/api_docs/kbn_ml_is_populated_object.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-populated-object
 title: "@kbn/ml-is-populated-object"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-populated-object plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-populated-object']
 ---
 import kbnMlIsPopulatedObjectObj from './kbn_ml_is_populated_object.devdocs.json';
diff --git a/api_docs/kbn_ml_local_storage.mdx b/api_docs/kbn_ml_local_storage.mdx
index 353ff9e08b3f1..299ca53741106 100644
--- a/api_docs/kbn_ml_local_storage.mdx
+++ b/api_docs/kbn_ml_local_storage.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-local-storage
 title: "@kbn/ml-local-storage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-local-storage plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-local-storage']
 ---
 import kbnMlLocalStorageObj from './kbn_ml_local_storage.devdocs.json';
diff --git a/api_docs/kbn_ml_nested_property.mdx b/api_docs/kbn_ml_nested_property.mdx
index 9949cfa0c7038..9d52c5879194f 100644
--- a/api_docs/kbn_ml_nested_property.mdx
+++ b/api_docs/kbn_ml_nested_property.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-nested-property
 title: "@kbn/ml-nested-property"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-nested-property plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-nested-property']
 ---
 import kbnMlNestedPropertyObj from './kbn_ml_nested_property.devdocs.json';
diff --git a/api_docs/kbn_ml_query_utils.mdx b/api_docs/kbn_ml_query_utils.mdx
index 281a76c3602cf..a529d972ab9aa 100644
--- a/api_docs/kbn_ml_query_utils.mdx
+++ b/api_docs/kbn_ml_query_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-query-utils
 title: "@kbn/ml-query-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-query-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-query-utils']
 ---
 import kbnMlQueryUtilsObj from './kbn_ml_query_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_string_hash.mdx b/api_docs/kbn_ml_string_hash.mdx
index 947446d121dbb..f183462e4a98b 100644
--- a/api_docs/kbn_ml_string_hash.mdx
+++ b/api_docs/kbn_ml_string_hash.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-string-hash
 title: "@kbn/ml-string-hash"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-string-hash plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-string-hash']
 ---
 import kbnMlStringHashObj from './kbn_ml_string_hash.devdocs.json';
diff --git a/api_docs/kbn_ml_url_state.mdx b/api_docs/kbn_ml_url_state.mdx
index bea9a2ad65516..e5c1fc22380f7 100644
--- a/api_docs/kbn_ml_url_state.mdx
+++ b/api_docs/kbn_ml_url_state.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-url-state
 title: "@kbn/ml-url-state"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-url-state plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-url-state']
 ---
 import kbnMlUrlStateObj from './kbn_ml_url_state.devdocs.json';
diff --git a/api_docs/kbn_monaco.mdx b/api_docs/kbn_monaco.mdx
index efd3ed7177c98..481afd6c398b1 100644
--- a/api_docs/kbn_monaco.mdx
+++ b/api_docs/kbn_monaco.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-monaco
 title: "@kbn/monaco"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/monaco plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/monaco']
 ---
 import kbnMonacoObj from './kbn_monaco.devdocs.json';
diff --git a/api_docs/kbn_optimizer.mdx b/api_docs/kbn_optimizer.mdx
index 55c2bfaafc49f..2ca82258c2e62 100644
--- a/api_docs/kbn_optimizer.mdx
+++ b/api_docs/kbn_optimizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer
 title: "@kbn/optimizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer']
 ---
 import kbnOptimizerObj from './kbn_optimizer.devdocs.json';
diff --git a/api_docs/kbn_optimizer_webpack_helpers.mdx b/api_docs/kbn_optimizer_webpack_helpers.mdx
index ddde20ac38476..36428b40abbab 100644
--- a/api_docs/kbn_optimizer_webpack_helpers.mdx
+++ b/api_docs/kbn_optimizer_webpack_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer-webpack-helpers
 title: "@kbn/optimizer-webpack-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer-webpack-helpers plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer-webpack-helpers']
 ---
 import kbnOptimizerWebpackHelpersObj from './kbn_optimizer_webpack_helpers.devdocs.json';
diff --git a/api_docs/kbn_osquery_io_ts_types.mdx b/api_docs/kbn_osquery_io_ts_types.mdx
index 0c012f64a536e..7f9edf9420173 100644
--- a/api_docs/kbn_osquery_io_ts_types.mdx
+++ b/api_docs/kbn_osquery_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-osquery-io-ts-types
 title: "@kbn/osquery-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/osquery-io-ts-types plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/osquery-io-ts-types']
 ---
 import kbnOsqueryIoTsTypesObj from './kbn_osquery_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_performance_testing_dataset_extractor.mdx b/api_docs/kbn_performance_testing_dataset_extractor.mdx
index d4eb151fb325e..6992d7584228b 100644
--- a/api_docs/kbn_performance_testing_dataset_extractor.mdx
+++ b/api_docs/kbn_performance_testing_dataset_extractor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-performance-testing-dataset-extractor
 title: "@kbn/performance-testing-dataset-extractor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/performance-testing-dataset-extractor plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/performance-testing-dataset-extractor']
 ---
 import kbnPerformanceTestingDatasetExtractorObj from './kbn_performance_testing_dataset_extractor.devdocs.json';
diff --git a/api_docs/kbn_plugin_generator.mdx b/api_docs/kbn_plugin_generator.mdx
index bcd11b758380f..f55faae505430 100644
--- a/api_docs/kbn_plugin_generator.mdx
+++ b/api_docs/kbn_plugin_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-generator
 title: "@kbn/plugin-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-generator plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-generator']
 ---
 import kbnPluginGeneratorObj from './kbn_plugin_generator.devdocs.json';
diff --git a/api_docs/kbn_plugin_helpers.mdx b/api_docs/kbn_plugin_helpers.mdx
index 19b35137b05cc..fcb46b33ef383 100644
--- a/api_docs/kbn_plugin_helpers.mdx
+++ b/api_docs/kbn_plugin_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-helpers
 title: "@kbn/plugin-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-helpers plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-helpers']
 ---
 import kbnPluginHelpersObj from './kbn_plugin_helpers.devdocs.json';
diff --git a/api_docs/kbn_react_field.mdx b/api_docs/kbn_react_field.mdx
index 1d253f50ceef5..9797c96594f31 100644
--- a/api_docs/kbn_react_field.mdx
+++ b/api_docs/kbn_react_field.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-field
 title: "@kbn/react-field"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-field plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-field']
 ---
 import kbnReactFieldObj from './kbn_react_field.devdocs.json';
diff --git a/api_docs/kbn_repo_file_maps.mdx b/api_docs/kbn_repo_file_maps.mdx
index 3c4a7b66e105e..b4b8e854ab7f7 100644
--- a/api_docs/kbn_repo_file_maps.mdx
+++ b/api_docs/kbn_repo_file_maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-file-maps
 title: "@kbn/repo-file-maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-file-maps plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-file-maps']
 ---
 import kbnRepoFileMapsObj from './kbn_repo_file_maps.devdocs.json';
diff --git a/api_docs/kbn_repo_linter.mdx b/api_docs/kbn_repo_linter.mdx
index fb4efc0b607cf..6d9d4bd31633f 100644
--- a/api_docs/kbn_repo_linter.mdx
+++ b/api_docs/kbn_repo_linter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-linter
 title: "@kbn/repo-linter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-linter plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-linter']
 ---
 import kbnRepoLinterObj from './kbn_repo_linter.devdocs.json';
diff --git a/api_docs/kbn_repo_path.mdx b/api_docs/kbn_repo_path.mdx
index 6487df1870597..20a7f7e792f7d 100644
--- a/api_docs/kbn_repo_path.mdx
+++ b/api_docs/kbn_repo_path.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-path
 title: "@kbn/repo-path"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-path plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-path']
 ---
 import kbnRepoPathObj from './kbn_repo_path.devdocs.json';
diff --git a/api_docs/kbn_repo_source_classifier.mdx b/api_docs/kbn_repo_source_classifier.mdx
index aa0d0614ec653..62c5b1327bfed 100644
--- a/api_docs/kbn_repo_source_classifier.mdx
+++ b/api_docs/kbn_repo_source_classifier.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-source-classifier
 title: "@kbn/repo-source-classifier"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-source-classifier plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-source-classifier']
 ---
 import kbnRepoSourceClassifierObj from './kbn_repo_source_classifier.devdocs.json';
diff --git a/api_docs/kbn_rison.mdx b/api_docs/kbn_rison.mdx
index 3f7465b287e88..6d9a81f63c935 100644
--- a/api_docs/kbn_rison.mdx
+++ b/api_docs/kbn_rison.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rison
 title: "@kbn/rison"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rison plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rison']
 ---
 import kbnRisonObj from './kbn_rison.devdocs.json';
diff --git a/api_docs/kbn_rule_data_utils.mdx b/api_docs/kbn_rule_data_utils.mdx
index 9d7713964317c..9b1a46ae7fbb4 100644
--- a/api_docs/kbn_rule_data_utils.mdx
+++ b/api_docs/kbn_rule_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rule-data-utils
 title: "@kbn/rule-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rule-data-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rule-data-utils']
 ---
 import kbnRuleDataUtilsObj from './kbn_rule_data_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_autocomplete.devdocs.json b/api_docs/kbn_securitysolution_autocomplete.devdocs.json
index 5f57ad28f5f73..7ec2ad2781c64 100644
--- a/api_docs/kbn_securitysolution_autocomplete.devdocs.json
+++ b/api_docs/kbn_securitysolution_autocomplete.devdocs.json
@@ -300,7 +300,7 @@
         "label": "FieldComponent",
         "description": [],
         "signature": [
-          "{ ({ fieldInputWidth, fieldTypeFilter, indexPattern, isClearable, isDisabled, isLoading, isRequired, onChange, placeholder, selectedField, acceptsCustomOptions, }: React.PropsWithChildren<",
+          "{ ({ fieldInputWidth, fieldTypeFilter, indexPattern, isClearable, isDisabled, isLoading, isRequired, onChange, placeholder, selectedField, acceptsCustomOptions, showMappingConflicts, }: React.PropsWithChildren<",
           "FieldProps",
           ">): JSX.Element; displayName: string | undefined; }"
         ],
@@ -313,7 +313,7 @@
             "id": "def-common.FieldComponent.$1",
             "type": "CompoundType",
             "tags": [],
-            "label": "{\n  fieldInputWidth,\n  fieldTypeFilter = [],\n  indexPattern,\n  isClearable = false,\n  isDisabled = false,\n  isLoading = false,\n  isRequired = false,\n  onChange,\n  placeholder,\n  selectedField,\n  acceptsCustomOptions = false,\n}",
+            "label": "{\n  fieldInputWidth,\n  fieldTypeFilter = [],\n  indexPattern,\n  isClearable = false,\n  isDisabled = false,\n  isLoading = false,\n  isRequired = false,\n  onChange,\n  placeholder,\n  selectedField,\n  acceptsCustomOptions = false,\n  showMappingConflicts = false,\n}",
             "description": [],
             "signature": [
               "React.PropsWithChildren<",
diff --git a/api_docs/kbn_securitysolution_autocomplete.mdx b/api_docs/kbn_securitysolution_autocomplete.mdx
index 33d44627f331d..52cd9fca3742e 100644
--- a/api_docs/kbn_securitysolution_autocomplete.mdx
+++ b/api_docs/kbn_securitysolution_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-autocomplete
 title: "@kbn/securitysolution-autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-autocomplete plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-autocomplete']
 ---
 import kbnSecuritysolutionAutocompleteObj from './kbn_securitysolution_autocomplete.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_ecs.mdx b/api_docs/kbn_securitysolution_ecs.mdx
index 272ece5620933..3cf533ae5676a 100644
--- a/api_docs/kbn_securitysolution_ecs.mdx
+++ b/api_docs/kbn_securitysolution_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-ecs
 title: "@kbn/securitysolution-ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-ecs plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-ecs']
 ---
 import kbnSecuritysolutionEcsObj from './kbn_securitysolution_ecs.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_es_utils.mdx b/api_docs/kbn_securitysolution_es_utils.mdx
index c46a9195cc985..2ec7d76728d08 100644
--- a/api_docs/kbn_securitysolution_es_utils.mdx
+++ b/api_docs/kbn_securitysolution_es_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-es-utils
 title: "@kbn/securitysolution-es-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-es-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-es-utils']
 ---
 import kbnSecuritysolutionEsUtilsObj from './kbn_securitysolution_es_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_exception_list_components.mdx b/api_docs/kbn_securitysolution_exception_list_components.mdx
index a41a49860f388..bae06c5a982fa 100644
--- a/api_docs/kbn_securitysolution_exception_list_components.mdx
+++ b/api_docs/kbn_securitysolution_exception_list_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-exception-list-components
 title: "@kbn/securitysolution-exception-list-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-exception-list-components plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-exception-list-components']
 ---
 import kbnSecuritysolutionExceptionListComponentsObj from './kbn_securitysolution_exception_list_components.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_hook_utils.mdx b/api_docs/kbn_securitysolution_hook_utils.mdx
index 24361556df4f1..d2cb1e09271b4 100644
--- a/api_docs/kbn_securitysolution_hook_utils.mdx
+++ b/api_docs/kbn_securitysolution_hook_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-hook-utils
 title: "@kbn/securitysolution-hook-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-hook-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-hook-utils']
 ---
 import kbnSecuritysolutionHookUtilsObj from './kbn_securitysolution_hook_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
index 6ecb048228476..ddcf822de96fd 100644
--- a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-alerting-types
 title: "@kbn/securitysolution-io-ts-alerting-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-alerting-types plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-alerting-types']
 ---
 import kbnSecuritysolutionIoTsAlertingTypesObj from './kbn_securitysolution_io_ts_alerting_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.mdx b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
index 910f5acb70129..87c025c2d59ea 100644
--- a/api_docs/kbn_securitysolution_io_ts_list_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-list-types
 title: "@kbn/securitysolution-io-ts-list-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-list-types plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-list-types']
 ---
 import kbnSecuritysolutionIoTsListTypesObj from './kbn_securitysolution_io_ts_list_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_types.devdocs.json b/api_docs/kbn_securitysolution_io_ts_types.devdocs.json
index 36efacff31bf4..5cc2e1b1049d9 100644
--- a/api_docs/kbn_securitysolution_io_ts_types.devdocs.json
+++ b/api_docs/kbn_securitysolution_io_ts_types.devdocs.json
@@ -514,7 +514,7 @@
         "label": "ImportQuerySchema",
         "description": [],
         "signature": [
-          "{ overwrite?: boolean | undefined; overwrite_exceptions?: boolean | undefined; as_new_list?: boolean | undefined; }"
+          "{ overwrite?: boolean | undefined; overwrite_exceptions?: boolean | undefined; overwrite_action_connectors?: boolean | undefined; as_new_list?: boolean | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.ts",
         "deprecated": false,
@@ -529,7 +529,7 @@
         "label": "ImportQuerySchemaDecoded",
         "description": [],
         "signature": [
-          "Omit<{ overwrite?: boolean | undefined; overwrite_exceptions?: boolean | undefined; as_new_list?: boolean | undefined; }, \"overwrite\" | \"overwrite_exceptions\" | \"as_new_list\"> & { overwrite: boolean; overwrite_exceptions: boolean; as_new_list: boolean; }"
+          "Omit<{ overwrite?: boolean | undefined; overwrite_exceptions?: boolean | undefined; overwrite_action_connectors?: boolean | undefined; as_new_list?: boolean | undefined; }, \"overwrite\" | \"overwrite_exceptions\" | \"overwrite_action_connectors\" | \"as_new_list\"> & { overwrite: boolean; overwrite_exceptions: boolean; overwrite_action_connectors: boolean; as_new_list: boolean; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-types/src/import_query_schema/index.ts",
         "deprecated": false,
@@ -912,6 +912,8 @@
           "Type",
           "<boolean, string | boolean | undefined, unknown>; overwrite_exceptions: ",
           "Type",
+          "<boolean, string | boolean | undefined, unknown>; overwrite_action_connectors: ",
+          "Type",
           "<boolean, string | boolean | undefined, unknown>; as_new_list: ",
           "Type",
           "<boolean, string | boolean | undefined, unknown>; }>>"
diff --git a/api_docs/kbn_securitysolution_io_ts_types.mdx b/api_docs/kbn_securitysolution_io_ts_types.mdx
index 9a0626f30033a..dcec40a90dd20 100644
--- a/api_docs/kbn_securitysolution_io_ts_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-types
 title: "@kbn/securitysolution-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-types plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-types']
 ---
 import kbnSecuritysolutionIoTsTypesObj from './kbn_securitysolution_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_utils.mdx b/api_docs/kbn_securitysolution_io_ts_utils.mdx
index 7bbcc052575e3..5e447a827e7d4 100644
--- a/api_docs/kbn_securitysolution_io_ts_utils.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-utils
 title: "@kbn/securitysolution-io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-utils']
 ---
 import kbnSecuritysolutionIoTsUtilsObj from './kbn_securitysolution_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_api.mdx b/api_docs/kbn_securitysolution_list_api.mdx
index ed510cafc63b6..634ddd56b3b60 100644
--- a/api_docs/kbn_securitysolution_list_api.mdx
+++ b/api_docs/kbn_securitysolution_list_api.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-api
 title: "@kbn/securitysolution-list-api"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-api plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-api']
 ---
 import kbnSecuritysolutionListApiObj from './kbn_securitysolution_list_api.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_constants.mdx b/api_docs/kbn_securitysolution_list_constants.mdx
index 126f96e2de173..cdb41f0ccd69a 100644
--- a/api_docs/kbn_securitysolution_list_constants.mdx
+++ b/api_docs/kbn_securitysolution_list_constants.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-constants
 title: "@kbn/securitysolution-list-constants"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-constants plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-constants']
 ---
 import kbnSecuritysolutionListConstantsObj from './kbn_securitysolution_list_constants.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_hooks.mdx b/api_docs/kbn_securitysolution_list_hooks.mdx
index e770d71a7efce..4710c86dc94f9 100644
--- a/api_docs/kbn_securitysolution_list_hooks.mdx
+++ b/api_docs/kbn_securitysolution_list_hooks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-hooks
 title: "@kbn/securitysolution-list-hooks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-hooks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-hooks']
 ---
 import kbnSecuritysolutionListHooksObj from './kbn_securitysolution_list_hooks.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_utils.devdocs.json b/api_docs/kbn_securitysolution_list_utils.devdocs.json
index e874763d9e630..c986b7d4d909f 100644
--- a/api_docs/kbn_securitysolution_list_utils.devdocs.json
+++ b/api_docs/kbn_securitysolution_list_utils.devdocs.json
@@ -1668,6 +1668,61 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/securitysolution-list-utils",
+        "id": "def-common.getMappingConflictsInfo",
+        "type": "Function",
+        "tags": [],
+        "label": "getMappingConflictsInfo",
+        "description": [],
+        "signature": [
+          "(field: ",
+          {
+            "pluginId": "@kbn/securitysolution-list-utils",
+            "scope": "common",
+            "docId": "kibKbnSecuritysolutionListUtilsPluginApi",
+            "section": "def-common.DataViewField",
+            "text": "DataViewField"
+          },
+          ") => ",
+          {
+            "pluginId": "@kbn/securitysolution-list-utils",
+            "scope": "common",
+            "docId": "kibKbnSecuritysolutionListUtilsPluginApi",
+            "section": "def-common.FieldConflictsInfo",
+            "text": "FieldConflictsInfo"
+          },
+          "[] | null"
+        ],
+        "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-list-utils",
+            "id": "def-common.getMappingConflictsInfo.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "field",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-list-utils",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionListUtilsPluginApi",
+                "section": "def-common.DataViewField",
+                "text": "DataViewField"
+              }
+            ],
+            "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/securitysolution-list-utils",
         "id": "def-common.getNewExceptionItem",
@@ -2182,6 +2237,51 @@
       }
     ],
     "interfaces": [
+      {
+        "parentPluginId": "@kbn/securitysolution-list-utils",
+        "id": "def-common.DataViewField",
+        "type": "Interface",
+        "tags": [],
+        "label": "DataViewField",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/securitysolution-list-utils",
+            "scope": "common",
+            "docId": "kibKbnSecuritysolutionListUtilsPluginApi",
+            "section": "def-common.DataViewField",
+            "text": "DataViewField"
+          },
+          " extends ",
+          {
+            "pluginId": "@kbn/es-query",
+            "scope": "common",
+            "docId": "kibKbnEsQueryPluginApi",
+            "section": "def-common.DataViewFieldBase",
+            "text": "DataViewFieldBase"
+          }
+        ],
+        "path": "packages/kbn-securitysolution-list-utils/src/types/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-list-utils",
+            "id": "def-common.DataViewField.conflictDescriptions",
+            "type": "Object",
+            "tags": [],
+            "label": "conflictDescriptions",
+            "description": [],
+            "signature": [
+              "Record<string, string[]> | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-list-utils/src/types/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/securitysolution-list-utils",
         "id": "def-common.EmptyEntry",
@@ -2460,6 +2560,62 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/securitysolution-list-utils",
+        "id": "def-common.FieldConflictsInfo",
+        "type": "Interface",
+        "tags": [],
+        "label": "FieldConflictsInfo",
+        "description": [],
+        "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-list-utils",
+            "id": "def-common.FieldConflictsInfo.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [
+              "\nKibana field type"
+            ],
+            "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-list-utils",
+            "id": "def-common.FieldConflictsInfo.totalIndexCount",
+            "type": "number",
+            "tags": [],
+            "label": "totalIndexCount",
+            "description": [
+              "\nTotal count of the indices of this type"
+            ],
+            "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-list-utils",
+            "id": "def-common.FieldConflictsInfo.groupedIndices",
+            "type": "Array",
+            "tags": [],
+            "label": "groupedIndices",
+            "description": [
+              "\nGrouped indices info"
+            ],
+            "signature": [
+              "{ name: string; count: number; }[]"
+            ],
+            "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/securitysolution-list-utils",
         "id": "def-common.FormattedBuilderEntry",
diff --git a/api_docs/kbn_securitysolution_list_utils.mdx b/api_docs/kbn_securitysolution_list_utils.mdx
index 27b1b383f3441..e3c3832e66e49 100644
--- a/api_docs/kbn_securitysolution_list_utils.mdx
+++ b/api_docs/kbn_securitysolution_list_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-utils
 title: "@kbn/securitysolution-list-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-utils']
 ---
 import kbnSecuritysolutionListUtilsObj from './kbn_securitysolution_list_utils.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 194 | 10 | 150 | 0 |
+| 202 | 10 | 155 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_securitysolution_rules.mdx b/api_docs/kbn_securitysolution_rules.mdx
index a81f9136d6e34..40ff524695859 100644
--- a/api_docs/kbn_securitysolution_rules.mdx
+++ b/api_docs/kbn_securitysolution_rules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-rules
 title: "@kbn/securitysolution-rules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-rules plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-rules']
 ---
 import kbnSecuritysolutionRulesObj from './kbn_securitysolution_rules.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_t_grid.mdx b/api_docs/kbn_securitysolution_t_grid.mdx
index 1dfa4b77a3325..e000a16750235 100644
--- a/api_docs/kbn_securitysolution_t_grid.mdx
+++ b/api_docs/kbn_securitysolution_t_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-t-grid
 title: "@kbn/securitysolution-t-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-t-grid plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-t-grid']
 ---
 import kbnSecuritysolutionTGridObj from './kbn_securitysolution_t_grid.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx
index 21cab6dca73cd..a118ef42e9292 100644
--- a/api_docs/kbn_securitysolution_utils.mdx
+++ b/api_docs/kbn_securitysolution_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-utils
 title: "@kbn/securitysolution-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-utils']
 ---
 import kbnSecuritysolutionUtilsObj from './kbn_securitysolution_utils.devdocs.json';
diff --git a/api_docs/kbn_server_http_tools.mdx b/api_docs/kbn_server_http_tools.mdx
index 48cd3e2d2fc06..2471d185564e8 100644
--- a/api_docs/kbn_server_http_tools.mdx
+++ b/api_docs/kbn_server_http_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-http-tools
 title: "@kbn/server-http-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-http-tools plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-http-tools']
 ---
 import kbnServerHttpToolsObj from './kbn_server_http_tools.devdocs.json';
diff --git a/api_docs/kbn_server_route_repository.mdx b/api_docs/kbn_server_route_repository.mdx
index c4dc26b1493f1..46cc3e8022286 100644
--- a/api_docs/kbn_server_route_repository.mdx
+++ b/api_docs/kbn_server_route_repository.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-route-repository
 title: "@kbn/server-route-repository"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-route-repository plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-route-repository']
 ---
 import kbnServerRouteRepositoryObj from './kbn_server_route_repository.devdocs.json';
diff --git a/api_docs/kbn_shared_svg.mdx b/api_docs/kbn_shared_svg.mdx
index 238d11b5df36f..a5a8e452b1a0b 100644
--- a/api_docs/kbn_shared_svg.mdx
+++ b/api_docs/kbn_shared_svg.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-svg
 title: "@kbn/shared-svg"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-svg plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-svg']
 ---
 import kbnSharedSvgObj from './kbn_shared_svg.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_solution.mdx b/api_docs/kbn_shared_ux_avatar_solution.mdx
index cef5d9155657e..a20ea41fd39b6 100644
--- a/api_docs/kbn_shared_ux_avatar_solution.mdx
+++ b/api_docs/kbn_shared_ux_avatar_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-solution
 title: "@kbn/shared-ux-avatar-solution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-solution plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-solution']
 ---
 import kbnSharedUxAvatarSolutionObj from './kbn_shared_ux_avatar_solution.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
index 8bbbc0246b280..0e68addd6fccb 100644
--- a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
+++ b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-user-profile-components
 title: "@kbn/shared-ux-avatar-user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-user-profile-components plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-user-profile-components']
 ---
 import kbnSharedUxAvatarUserProfileComponentsObj from './kbn_shared_ux_avatar_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
index 731e75801d5e2..0a13d89e8fa3a 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen
 title: "@kbn/shared-ux-button-exit-full-screen"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen']
 ---
 import kbnSharedUxButtonExitFullScreenObj from './kbn_shared_ux_button_exit_full_screen.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
index f94e920547e50..eadbee884d434 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen-mocks
 title: "@kbn/shared-ux-button-exit-full-screen-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen-mocks']
 ---
 import kbnSharedUxButtonExitFullScreenMocksObj from './kbn_shared_ux_button_exit_full_screen_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_toolbar.mdx b/api_docs/kbn_shared_ux_button_toolbar.mdx
index d2f8081bd18e6..fc0abad984436 100644
--- a/api_docs/kbn_shared_ux_button_toolbar.mdx
+++ b/api_docs/kbn_shared_ux_button_toolbar.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-toolbar
 title: "@kbn/shared-ux-button-toolbar"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-toolbar plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-toolbar']
 ---
 import kbnSharedUxButtonToolbarObj from './kbn_shared_ux_button_toolbar.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data.mdx b/api_docs/kbn_shared_ux_card_no_data.mdx
index f3821a644324b..64ded261cbf82 100644
--- a/api_docs/kbn_shared_ux_card_no_data.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data
 title: "@kbn/shared-ux-card-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data']
 ---
 import kbnSharedUxCardNoDataObj from './kbn_shared_ux_card_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
index f5874e5f5be84..30d2b316ed83a 100644
--- a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data-mocks
 title: "@kbn/shared-ux-card-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data-mocks']
 ---
 import kbnSharedUxCardNoDataMocksObj from './kbn_shared_ux_card_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_context.mdx b/api_docs/kbn_shared_ux_file_context.mdx
index fe20f4a960a0a..c82fcb1f119e7 100644
--- a/api_docs/kbn_shared_ux_file_context.mdx
+++ b/api_docs/kbn_shared_ux_file_context.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-context
 title: "@kbn/shared-ux-file-context"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-context plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-context']
 ---
 import kbnSharedUxFileContextObj from './kbn_shared_ux_file_context.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image.mdx b/api_docs/kbn_shared_ux_file_image.mdx
index 15c6ac14b94d0..1f29487e02a00 100644
--- a/api_docs/kbn_shared_ux_file_image.mdx
+++ b/api_docs/kbn_shared_ux_file_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image
 title: "@kbn/shared-ux-file-image"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image']
 ---
 import kbnSharedUxFileImageObj from './kbn_shared_ux_file_image.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image_mocks.mdx b/api_docs/kbn_shared_ux_file_image_mocks.mdx
index bb4b37e38ca6f..b804cd4df130a 100644
--- a/api_docs/kbn_shared_ux_file_image_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_image_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image-mocks
 title: "@kbn/shared-ux-file-image-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image-mocks']
 ---
 import kbnSharedUxFileImageMocksObj from './kbn_shared_ux_file_image_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_mocks.mdx b/api_docs/kbn_shared_ux_file_mocks.mdx
index dc5e5983ecab0..fc718ca3768b8 100644
--- a/api_docs/kbn_shared_ux_file_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-mocks
 title: "@kbn/shared-ux-file-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-mocks']
 ---
 import kbnSharedUxFileMocksObj from './kbn_shared_ux_file_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_picker.mdx b/api_docs/kbn_shared_ux_file_picker.mdx
index 1af6ca76ecb2e..13b8d92994548 100644
--- a/api_docs/kbn_shared_ux_file_picker.mdx
+++ b/api_docs/kbn_shared_ux_file_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-picker
 title: "@kbn/shared-ux-file-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-picker plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-picker']
 ---
 import kbnSharedUxFilePickerObj from './kbn_shared_ux_file_picker.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_upload.mdx b/api_docs/kbn_shared_ux_file_upload.mdx
index 19767a62c5a10..bc54d2cb82af9 100644
--- a/api_docs/kbn_shared_ux_file_upload.mdx
+++ b/api_docs/kbn_shared_ux_file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-upload
 title: "@kbn/shared-ux-file-upload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-upload plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-upload']
 ---
 import kbnSharedUxFileUploadObj from './kbn_shared_ux_file_upload.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_util.mdx b/api_docs/kbn_shared_ux_file_util.mdx
index 66ccc135a2302..31b6d8bace03b 100644
--- a/api_docs/kbn_shared_ux_file_util.mdx
+++ b/api_docs/kbn_shared_ux_file_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-util
 title: "@kbn/shared-ux-file-util"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-util plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-util']
 ---
 import kbnSharedUxFileUtilObj from './kbn_shared_ux_file_util.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app.mdx b/api_docs/kbn_shared_ux_link_redirect_app.mdx
index dc3f682e7a1e7..c95515ec57f6b 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app
 title: "@kbn/shared-ux-link-redirect-app"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app']
 ---
 import kbnSharedUxLinkRedirectAppObj from './kbn_shared_ux_link_redirect_app.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
index 937ab78244d30..e5bb0c8195a4a 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app-mocks
 title: "@kbn/shared-ux-link-redirect-app-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app-mocks']
 ---
 import kbnSharedUxLinkRedirectAppMocksObj from './kbn_shared_ux_link_redirect_app_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown.mdx b/api_docs/kbn_shared_ux_markdown.mdx
index c75bee69ce164..e2f86c1536432 100644
--- a/api_docs/kbn_shared_ux_markdown.mdx
+++ b/api_docs/kbn_shared_ux_markdown.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown
 title: "@kbn/shared-ux-markdown"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown']
 ---
 import kbnSharedUxMarkdownObj from './kbn_shared_ux_markdown.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown_mocks.mdx b/api_docs/kbn_shared_ux_markdown_mocks.mdx
index a6bdfc03886cf..c7b7f92125c2b 100644
--- a/api_docs/kbn_shared_ux_markdown_mocks.mdx
+++ b/api_docs/kbn_shared_ux_markdown_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown-mocks
 title: "@kbn/shared-ux-markdown-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown-mocks']
 ---
 import kbnSharedUxMarkdownMocksObj from './kbn_shared_ux_markdown_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
index ef0c3e5991d9d..1066381444291 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data
 title: "@kbn/shared-ux-page-analytics-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data']
 ---
 import kbnSharedUxPageAnalyticsNoDataObj from './kbn_shared_ux_page_analytics_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
index dce9c136dee01..c309da0df8581 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data-mocks
 title: "@kbn/shared-ux-page-analytics-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data-mocks']
 ---
 import kbnSharedUxPageAnalyticsNoDataMocksObj from './kbn_shared_ux_page_analytics_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
index d12e9b7bfe5d0..7c06121b0a272 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data
 title: "@kbn/shared-ux-page-kibana-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data']
 ---
 import kbnSharedUxPageKibanaNoDataObj from './kbn_shared_ux_page_kibana_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
index f1d0999e08210..2107f409250ff 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data-mocks
 title: "@kbn/shared-ux-page-kibana-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data-mocks']
 ---
 import kbnSharedUxPageKibanaNoDataMocksObj from './kbn_shared_ux_page_kibana_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template.mdx b/api_docs/kbn_shared_ux_page_kibana_template.mdx
index a5075908d326e..9e71b8ea0b70f 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template
 title: "@kbn/shared-ux-page-kibana-template"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template']
 ---
 import kbnSharedUxPageKibanaTemplateObj from './kbn_shared_ux_page_kibana_template.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
index 6e1739dca4832..37b20f87221ba 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template-mocks
 title: "@kbn/shared-ux-page-kibana-template-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template-mocks']
 ---
 import kbnSharedUxPageKibanaTemplateMocksObj from './kbn_shared_ux_page_kibana_template_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data.mdx b/api_docs/kbn_shared_ux_page_no_data.mdx
index 54ea6ca0d852b..f045d255aff50 100644
--- a/api_docs/kbn_shared_ux_page_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data
 title: "@kbn/shared-ux-page-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data']
 ---
 import kbnSharedUxPageNoDataObj from './kbn_shared_ux_page_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config.mdx b/api_docs/kbn_shared_ux_page_no_data_config.mdx
index 31b36dbd0f925..08e9ddc433bb1 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config
 title: "@kbn/shared-ux-page-no-data-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config']
 ---
 import kbnSharedUxPageNoDataConfigObj from './kbn_shared_ux_page_no_data_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
index 783cc6539e1c6..d06493994b648 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config-mocks
 title: "@kbn/shared-ux-page-no-data-config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config-mocks']
 ---
 import kbnSharedUxPageNoDataConfigMocksObj from './kbn_shared_ux_page_no_data_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
index f2c4c291a6e1a..a8de8f722ecf4 100644
--- a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-mocks
 title: "@kbn/shared-ux-page-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-mocks']
 ---
 import kbnSharedUxPageNoDataMocksObj from './kbn_shared_ux_page_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_solution_nav.mdx b/api_docs/kbn_shared_ux_page_solution_nav.mdx
index 77080f3d55c46..217d92ce69baf 100644
--- a/api_docs/kbn_shared_ux_page_solution_nav.mdx
+++ b/api_docs/kbn_shared_ux_page_solution_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-solution-nav
 title: "@kbn/shared-ux-page-solution-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-solution-nav plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-solution-nav']
 ---
 import kbnSharedUxPageSolutionNavObj from './kbn_shared_ux_page_solution_nav.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
index e9253d2f8d8f4..27a97daed7045 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views
 title: "@kbn/shared-ux-prompt-no-data-views"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views']
 ---
 import kbnSharedUxPromptNoDataViewsObj from './kbn_shared_ux_prompt_no_data_views.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
index c71c34c58322c..0299e0620f636 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views-mocks
 title: "@kbn/shared-ux-prompt-no-data-views-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views-mocks']
 ---
 import kbnSharedUxPromptNoDataViewsMocksObj from './kbn_shared_ux_prompt_no_data_views_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_not_found.mdx b/api_docs/kbn_shared_ux_prompt_not_found.mdx
index 2f3001b45f776..79719bcf04711 100644
--- a/api_docs/kbn_shared_ux_prompt_not_found.mdx
+++ b/api_docs/kbn_shared_ux_prompt_not_found.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-not-found
 title: "@kbn/shared-ux-prompt-not-found"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-not-found plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-not-found']
 ---
 import kbnSharedUxPromptNotFoundObj from './kbn_shared_ux_prompt_not_found.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router.mdx b/api_docs/kbn_shared_ux_router.mdx
index b52b11f11c36a..ce4f047e86ce4 100644
--- a/api_docs/kbn_shared_ux_router.mdx
+++ b/api_docs/kbn_shared_ux_router.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router
 title: "@kbn/shared-ux-router"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router']
 ---
 import kbnSharedUxRouterObj from './kbn_shared_ux_router.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router_mocks.mdx b/api_docs/kbn_shared_ux_router_mocks.mdx
index b8828d154eeaf..b5420eaface8c 100644
--- a/api_docs/kbn_shared_ux_router_mocks.mdx
+++ b/api_docs/kbn_shared_ux_router_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router-mocks
 title: "@kbn/shared-ux-router-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router-mocks plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router-mocks']
 ---
 import kbnSharedUxRouterMocksObj from './kbn_shared_ux_router_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_config.mdx b/api_docs/kbn_shared_ux_storybook_config.mdx
index 090facba8c3b4..f163ac35cae58 100644
--- a/api_docs/kbn_shared_ux_storybook_config.mdx
+++ b/api_docs/kbn_shared_ux_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-config
 title: "@kbn/shared-ux-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-config plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-config']
 ---
 import kbnSharedUxStorybookConfigObj from './kbn_shared_ux_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_mock.mdx b/api_docs/kbn_shared_ux_storybook_mock.mdx
index cb1ed8d3cc7cb..3b0b70d1e10c7 100644
--- a/api_docs/kbn_shared_ux_storybook_mock.mdx
+++ b/api_docs/kbn_shared_ux_storybook_mock.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-mock
 title: "@kbn/shared-ux-storybook-mock"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-mock plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-mock']
 ---
 import kbnSharedUxStorybookMockObj from './kbn_shared_ux_storybook_mock.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_utility.mdx b/api_docs/kbn_shared_ux_utility.mdx
index 5e46e90268279..2f1dfe03c4afb 100644
--- a/api_docs/kbn_shared_ux_utility.mdx
+++ b/api_docs/kbn_shared_ux_utility.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-utility
 title: "@kbn/shared-ux-utility"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-utility plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-utility']
 ---
 import kbnSharedUxUtilityObj from './kbn_shared_ux_utility.devdocs.json';
diff --git a/api_docs/kbn_slo_schema.mdx b/api_docs/kbn_slo_schema.mdx
index 4053a2615f84e..e893afa2b9bec 100644
--- a/api_docs/kbn_slo_schema.mdx
+++ b/api_docs/kbn_slo_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-slo-schema
 title: "@kbn/slo-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/slo-schema plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/slo-schema']
 ---
 import kbnSloSchemaObj from './kbn_slo_schema.devdocs.json';
diff --git a/api_docs/kbn_some_dev_log.mdx b/api_docs/kbn_some_dev_log.mdx
index 9d5dbd5af2684..de9399bb42735 100644
--- a/api_docs/kbn_some_dev_log.mdx
+++ b/api_docs/kbn_some_dev_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-some-dev-log
 title: "@kbn/some-dev-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/some-dev-log plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/some-dev-log']
 ---
 import kbnSomeDevLogObj from './kbn_some_dev_log.devdocs.json';
diff --git a/api_docs/kbn_std.mdx b/api_docs/kbn_std.mdx
index bc87ab167ef32..a03301f209b92 100644
--- a/api_docs/kbn_std.mdx
+++ b/api_docs/kbn_std.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-std
 title: "@kbn/std"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/std plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/std']
 ---
 import kbnStdObj from './kbn_std.devdocs.json';
diff --git a/api_docs/kbn_stdio_dev_helpers.mdx b/api_docs/kbn_stdio_dev_helpers.mdx
index 645dde63fee56..d1da4dc55c50c 100644
--- a/api_docs/kbn_stdio_dev_helpers.mdx
+++ b/api_docs/kbn_stdio_dev_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-stdio-dev-helpers
 title: "@kbn/stdio-dev-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/stdio-dev-helpers plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/stdio-dev-helpers']
 ---
 import kbnStdioDevHelpersObj from './kbn_stdio_dev_helpers.devdocs.json';
diff --git a/api_docs/kbn_storybook.mdx b/api_docs/kbn_storybook.mdx
index 406e4569dbe0c..663d00c3d0b92 100644
--- a/api_docs/kbn_storybook.mdx
+++ b/api_docs/kbn_storybook.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-storybook
 title: "@kbn/storybook"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/storybook plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/storybook']
 ---
 import kbnStorybookObj from './kbn_storybook.devdocs.json';
diff --git a/api_docs/kbn_telemetry_tools.mdx b/api_docs/kbn_telemetry_tools.mdx
index c982fe1979f9d..bc6b9f06c7ac8 100644
--- a/api_docs/kbn_telemetry_tools.mdx
+++ b/api_docs/kbn_telemetry_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-telemetry-tools
 title: "@kbn/telemetry-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/telemetry-tools plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/telemetry-tools']
 ---
 import kbnTelemetryToolsObj from './kbn_telemetry_tools.devdocs.json';
diff --git a/api_docs/kbn_test.mdx b/api_docs/kbn_test.mdx
index 5dd48e5ab6cd0..3fc06bc66273b 100644
--- a/api_docs/kbn_test.mdx
+++ b/api_docs/kbn_test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test
 title: "@kbn/test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test']
 ---
 import kbnTestObj from './kbn_test.devdocs.json';
diff --git a/api_docs/kbn_test_jest_helpers.mdx b/api_docs/kbn_test_jest_helpers.mdx
index 7b7137653cbe6..6fd89dad00365 100644
--- a/api_docs/kbn_test_jest_helpers.mdx
+++ b/api_docs/kbn_test_jest_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-jest-helpers
 title: "@kbn/test-jest-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-jest-helpers plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-jest-helpers']
 ---
 import kbnTestJestHelpersObj from './kbn_test_jest_helpers.devdocs.json';
diff --git a/api_docs/kbn_test_subj_selector.mdx b/api_docs/kbn_test_subj_selector.mdx
index 1c813eb8023f8..36785a240a316 100644
--- a/api_docs/kbn_test_subj_selector.mdx
+++ b/api_docs/kbn_test_subj_selector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-subj-selector
 title: "@kbn/test-subj-selector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-subj-selector plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-subj-selector']
 ---
 import kbnTestSubjSelectorObj from './kbn_test_subj_selector.devdocs.json';
diff --git a/api_docs/kbn_tooling_log.mdx b/api_docs/kbn_tooling_log.mdx
index 27fc3b3a5eb75..2edba2d696413 100644
--- a/api_docs/kbn_tooling_log.mdx
+++ b/api_docs/kbn_tooling_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-tooling-log
 title: "@kbn/tooling-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/tooling-log plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/tooling-log']
 ---
 import kbnToolingLogObj from './kbn_tooling_log.devdocs.json';
diff --git a/api_docs/kbn_ts_projects.mdx b/api_docs/kbn_ts_projects.mdx
index fddaac9d78cdf..406cee9f9e4e4 100644
--- a/api_docs/kbn_ts_projects.mdx
+++ b/api_docs/kbn_ts_projects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ts-projects
 title: "@kbn/ts-projects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ts-projects plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ts-projects']
 ---
 import kbnTsProjectsObj from './kbn_ts_projects.devdocs.json';
diff --git a/api_docs/kbn_typed_react_router_config.mdx b/api_docs/kbn_typed_react_router_config.mdx
index ab0bb545d650d..c308e26fe8fe0 100644
--- a/api_docs/kbn_typed_react_router_config.mdx
+++ b/api_docs/kbn_typed_react_router_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-typed-react-router-config
 title: "@kbn/typed-react-router-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/typed-react-router-config plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/typed-react-router-config']
 ---
 import kbnTypedReactRouterConfigObj from './kbn_typed_react_router_config.devdocs.json';
diff --git a/api_docs/kbn_ui_actions_browser.mdx b/api_docs/kbn_ui_actions_browser.mdx
index d272acf61c00f..2ddb3e143940a 100644
--- a/api_docs/kbn_ui_actions_browser.mdx
+++ b/api_docs/kbn_ui_actions_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-actions-browser
 title: "@kbn/ui-actions-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-actions-browser plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-actions-browser']
 ---
 import kbnUiActionsBrowserObj from './kbn_ui_actions_browser.devdocs.json';
diff --git a/api_docs/kbn_ui_shared_deps_src.mdx b/api_docs/kbn_ui_shared_deps_src.mdx
index 76ad429b5bcd1..4c992a0b7ba97 100644
--- a/api_docs/kbn_ui_shared_deps_src.mdx
+++ b/api_docs/kbn_ui_shared_deps_src.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-shared-deps-src
 title: "@kbn/ui-shared-deps-src"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-shared-deps-src plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-shared-deps-src']
 ---
 import kbnUiSharedDepsSrcObj from './kbn_ui_shared_deps_src.devdocs.json';
diff --git a/api_docs/kbn_ui_theme.mdx b/api_docs/kbn_ui_theme.mdx
index 9e29563bbad59..b7cf721b289d8 100644
--- a/api_docs/kbn_ui_theme.mdx
+++ b/api_docs/kbn_ui_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-theme
 title: "@kbn/ui-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-theme plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-theme']
 ---
 import kbnUiThemeObj from './kbn_ui_theme.devdocs.json';
diff --git a/api_docs/kbn_user_profile_components.mdx b/api_docs/kbn_user_profile_components.mdx
index dc45fe405a7bc..b38dda89ff359 100644
--- a/api_docs/kbn_user_profile_components.mdx
+++ b/api_docs/kbn_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-user-profile-components
 title: "@kbn/user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/user-profile-components plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/user-profile-components']
 ---
 import kbnUserProfileComponentsObj from './kbn_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_utility_types.mdx b/api_docs/kbn_utility_types.mdx
index 66d30de19e6a2..d197cd04edbf7 100644
--- a/api_docs/kbn_utility_types.mdx
+++ b/api_docs/kbn_utility_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types
 title: "@kbn/utility-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types']
 ---
 import kbnUtilityTypesObj from './kbn_utility_types.devdocs.json';
diff --git a/api_docs/kbn_utility_types_jest.mdx b/api_docs/kbn_utility_types_jest.mdx
index a518af61425a1..0feb47cbc6bc9 100644
--- a/api_docs/kbn_utility_types_jest.mdx
+++ b/api_docs/kbn_utility_types_jest.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types-jest
 title: "@kbn/utility-types-jest"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types-jest plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types-jest']
 ---
 import kbnUtilityTypesJestObj from './kbn_utility_types_jest.devdocs.json';
diff --git a/api_docs/kbn_utils.mdx b/api_docs/kbn_utils.mdx
index 68fbef9c58555..84096ebbc599e 100644
--- a/api_docs/kbn_utils.mdx
+++ b/api_docs/kbn_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utils
 title: "@kbn/utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utils']
 ---
 import kbnUtilsObj from './kbn_utils.devdocs.json';
diff --git a/api_docs/kbn_yarn_lock_validator.mdx b/api_docs/kbn_yarn_lock_validator.mdx
index 0bd5ee0c7870f..8637fad69054c 100644
--- a/api_docs/kbn_yarn_lock_validator.mdx
+++ b/api_docs/kbn_yarn_lock_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-yarn-lock-validator
 title: "@kbn/yarn-lock-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/yarn-lock-validator plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/yarn-lock-validator']
 ---
 import kbnYarnLockValidatorObj from './kbn_yarn_lock_validator.devdocs.json';
diff --git a/api_docs/kibana_overview.mdx b/api_docs/kibana_overview.mdx
index 1a4c19f509b36..4bb00bbc43296 100644
--- a/api_docs/kibana_overview.mdx
+++ b/api_docs/kibana_overview.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaOverview
 title: "kibanaOverview"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaOverview plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaOverview']
 ---
 import kibanaOverviewObj from './kibana_overview.devdocs.json';
diff --git a/api_docs/kibana_react.mdx b/api_docs/kibana_react.mdx
index 2bdfd8872bef4..e1e393434e236 100644
--- a/api_docs/kibana_react.mdx
+++ b/api_docs/kibana_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaReact
 title: "kibanaReact"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaReact plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaReact']
 ---
 import kibanaReactObj from './kibana_react.devdocs.json';
diff --git a/api_docs/kibana_utils.mdx b/api_docs/kibana_utils.mdx
index e60c156dfbc37..b1808a5b8ea79 100644
--- a/api_docs/kibana_utils.mdx
+++ b/api_docs/kibana_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaUtils
 title: "kibanaUtils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaUtils plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaUtils']
 ---
 import kibanaUtilsObj from './kibana_utils.devdocs.json';
diff --git a/api_docs/kubernetes_security.mdx b/api_docs/kubernetes_security.mdx
index 7ee9fdec76330..c4a4435c11755 100644
--- a/api_docs/kubernetes_security.mdx
+++ b/api_docs/kubernetes_security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kubernetesSecurity
 title: "kubernetesSecurity"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kubernetesSecurity plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kubernetesSecurity']
 ---
 import kubernetesSecurityObj from './kubernetes_security.devdocs.json';
diff --git a/api_docs/lens.mdx b/api_docs/lens.mdx
index faee67a4f3e36..e3f29fec395bb 100644
--- a/api_docs/lens.mdx
+++ b/api_docs/lens.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lens
 title: "lens"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lens plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lens']
 ---
 import lensObj from './lens.devdocs.json';
diff --git a/api_docs/license_api_guard.mdx b/api_docs/license_api_guard.mdx
index 937e14bc54c0b..88da4e9c6f55a 100644
--- a/api_docs/license_api_guard.mdx
+++ b/api_docs/license_api_guard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseApiGuard
 title: "licenseApiGuard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseApiGuard plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseApiGuard']
 ---
 import licenseApiGuardObj from './license_api_guard.devdocs.json';
diff --git a/api_docs/license_management.mdx b/api_docs/license_management.mdx
index 4318bcf08b1bb..8d62bffef5c9e 100644
--- a/api_docs/license_management.mdx
+++ b/api_docs/license_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseManagement
 title: "licenseManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseManagement plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseManagement']
 ---
 import licenseManagementObj from './license_management.devdocs.json';
diff --git a/api_docs/licensing.mdx b/api_docs/licensing.mdx
index 03b50fbe92675..b445cf8518378 100644
--- a/api_docs/licensing.mdx
+++ b/api_docs/licensing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licensing
 title: "licensing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licensing plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licensing']
 ---
 import licensingObj from './licensing.devdocs.json';
diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx
index e686bf109bfca..9052518d9ee1e 100644
--- a/api_docs/lists.mdx
+++ b/api_docs/lists.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lists
 title: "lists"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lists plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lists']
 ---
 import listsObj from './lists.devdocs.json';
diff --git a/api_docs/management.mdx b/api_docs/management.mdx
index 0c224a310a7b8..dccfbe6ead7c8 100644
--- a/api_docs/management.mdx
+++ b/api_docs/management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/management
 title: "management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the management plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'management']
 ---
 import managementObj from './management.devdocs.json';
diff --git a/api_docs/maps.mdx b/api_docs/maps.mdx
index 22373cc3e6dd7..b1fae75481fef 100644
--- a/api_docs/maps.mdx
+++ b/api_docs/maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/maps
 title: "maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the maps plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'maps']
 ---
 import mapsObj from './maps.devdocs.json';
diff --git a/api_docs/maps_ems.mdx b/api_docs/maps_ems.mdx
index d8744e705d74b..6dce3959c9b6a 100644
--- a/api_docs/maps_ems.mdx
+++ b/api_docs/maps_ems.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/mapsEms
 title: "mapsEms"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the mapsEms plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mapsEms']
 ---
 import mapsEmsObj from './maps_ems.devdocs.json';
diff --git a/api_docs/ml.devdocs.json b/api_docs/ml.devdocs.json
index f879c92c8bb5f..e7a6ab48c2dfc 100644
--- a/api_docs/ml.devdocs.json
+++ b/api_docs/ml.devdocs.json
@@ -1413,6 +1413,27 @@
             "path": "x-pack/plugins/ml/public/application/components/data_grid/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "ml",
+            "id": "def-public.UseIndexDataReturnType.timeRangeMs",
+            "type": "Object",
+            "tags": [],
+            "label": "timeRangeMs",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/ml-date-picker",
+                "scope": "common",
+                "docId": "kibKbnMlDatePickerPluginApi",
+                "section": "def-common.TimeRange",
+                "text": "TimeRange"
+              },
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/ml/public/application/components/data_grid/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/ml.mdx b/api_docs/ml.mdx
index ad7af9876ac41..eb06159f2f6ab 100644
--- a/api_docs/ml.mdx
+++ b/api_docs/ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ml
 title: "ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ml plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ml']
 ---
 import mlObj from './ml.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) for q
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 254 | 9 | 78 | 40 |
+| 255 | 9 | 79 | 40 |
 
 ## Client
 
diff --git a/api_docs/monitoring.mdx b/api_docs/monitoring.mdx
index d18ed27a52bcb..d05078fa193c1 100644
--- a/api_docs/monitoring.mdx
+++ b/api_docs/monitoring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoring
 title: "monitoring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoring plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoring']
 ---
 import monitoringObj from './monitoring.devdocs.json';
diff --git a/api_docs/monitoring_collection.mdx b/api_docs/monitoring_collection.mdx
index 34ddfbc47e8e2..192d984ea3a5c 100644
--- a/api_docs/monitoring_collection.mdx
+++ b/api_docs/monitoring_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoringCollection
 title: "monitoringCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoringCollection plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoringCollection']
 ---
 import monitoringCollectionObj from './monitoring_collection.devdocs.json';
diff --git a/api_docs/navigation.mdx b/api_docs/navigation.mdx
index 4b1ecadab6edc..b0d05d781f546 100644
--- a/api_docs/navigation.mdx
+++ b/api_docs/navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/navigation
 title: "navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the navigation plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'navigation']
 ---
 import navigationObj from './navigation.devdocs.json';
diff --git a/api_docs/newsfeed.mdx b/api_docs/newsfeed.mdx
index 2e2a366abe4fd..60c19eb9a71cc 100644
--- a/api_docs/newsfeed.mdx
+++ b/api_docs/newsfeed.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/newsfeed
 title: "newsfeed"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the newsfeed plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'newsfeed']
 ---
 import newsfeedObj from './newsfeed.devdocs.json';
diff --git a/api_docs/notifications.mdx b/api_docs/notifications.mdx
index eb7e189938873..07f0428038f1e 100644
--- a/api_docs/notifications.mdx
+++ b/api_docs/notifications.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/notifications
 title: "notifications"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the notifications plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'notifications']
 ---
 import notificationsObj from './notifications.devdocs.json';
diff --git a/api_docs/observability.devdocs.json b/api_docs/observability.devdocs.json
index 79bf3acafe827..df3ecc2382fd7 100644
--- a/api_docs/observability.devdocs.json
+++ b/api_docs/observability.devdocs.json
@@ -5801,21 +5801,6 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "observability",
-        "id": "def-public.enableNewSyntheticsView",
-        "type": "string",
-        "tags": [],
-        "label": "enableNewSyntheticsView",
-        "description": [],
-        "signature": [
-          "\"observability:enableNewSyntheticsView\""
-        ],
-        "path": "x-pack/plugins/observability/common/ui_settings_keys.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "observability",
         "id": "def-public.ENVIRONMENT_ALL",
@@ -11241,110 +11226,6 @@
         "deprecated": false,
         "trackAdoption": false,
         "children": [
-          {
-            "parentPluginId": "observability",
-            "id": "def-server.uiSettings.enableNewSyntheticsView",
-            "type": "Object",
-            "tags": [],
-            "label": "[enableNewSyntheticsView]",
-            "description": [],
-            "path": "x-pack/plugins/observability/server/ui_settings.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "observability",
-                "id": "def-server.uiSettings.enableNewSyntheticsView.category",
-                "type": "Array",
-                "tags": [],
-                "label": "category",
-                "description": [],
-                "signature": [
-                  "string[]"
-                ],
-                "path": "x-pack/plugins/observability/server/ui_settings.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "observability",
-                "id": "def-server.uiSettings.enableNewSyntheticsView.name",
-                "type": "Any",
-                "tags": [],
-                "label": "name",
-                "description": [],
-                "signature": [
-                  "any"
-                ],
-                "path": "x-pack/plugins/observability/server/ui_settings.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "observability",
-                "id": "def-server.uiSettings.enableNewSyntheticsView.value",
-                "type": "boolean",
-                "tags": [],
-                "label": "value",
-                "description": [],
-                "signature": [
-                  "false"
-                ],
-                "path": "x-pack/plugins/observability/server/ui_settings.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "observability",
-                "id": "def-server.uiSettings.enableNewSyntheticsView.description",
-                "type": "Any",
-                "tags": [],
-                "label": "description",
-                "description": [],
-                "signature": [
-                  "any"
-                ],
-                "path": "x-pack/plugins/observability/server/ui_settings.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "observability",
-                "id": "def-server.uiSettings.enableNewSyntheticsView.schema",
-                "type": "Object",
-                "tags": [],
-                "label": "schema",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "@kbn/config-schema",
-                    "scope": "common",
-                    "docId": "kibKbnConfigSchemaPluginApi",
-                    "section": "def-common.Type",
-                    "text": "Type"
-                  },
-                  "<boolean>"
-                ],
-                "path": "x-pack/plugins/observability/server/ui_settings.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "observability",
-                "id": "def-server.uiSettings.enableNewSyntheticsView.requiresPageReload",
-                "type": "boolean",
-                "tags": [],
-                "label": "requiresPageReload",
-                "description": [],
-                "signature": [
-                  "true"
-                ],
-                "path": "x-pack/plugins/observability/server/ui_settings.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              }
-            ]
-          },
           {
             "parentPluginId": "observability",
             "id": "def-server.uiSettings.enableInspectEsQueries",
@@ -13932,21 +13813,6 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "observability",
-        "id": "def-common.enableNewSyntheticsView",
-        "type": "string",
-        "tags": [],
-        "label": "enableNewSyntheticsView",
-        "description": [],
-        "signature": [
-          "\"observability:enableNewSyntheticsView\""
-        ],
-        "path": "x-pack/plugins/observability/common/ui_settings_keys.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "observability",
         "id": "def-common.maxSuggestions",
diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx
index a77bf8f57e8a5..961ee4c3532bd 100644
--- a/api_docs/observability.mdx
+++ b/api_docs/observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observability
 title: "observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observability plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observability']
 ---
 import observabilityObj from './observability.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Observability UI](https://github.com/orgs/elastic/teams/observability-u
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 607 | 41 | 601 | 32 |
+| 598 | 39 | 592 | 32 |
 
 ## Client
 
diff --git a/api_docs/osquery.mdx b/api_docs/osquery.mdx
index f9292e024df14..c104339237870 100644
--- a/api_docs/osquery.mdx
+++ b/api_docs/osquery.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/osquery
 title: "osquery"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the osquery plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'osquery']
 ---
 import osqueryObj from './osquery.devdocs.json';
diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx
index 9b1dca4b7d7b5..3e388c16b1d10 100644
--- a/api_docs/plugin_directory.mdx
+++ b/api_docs/plugin_directory.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsPluginDirectory
 slug: /kibana-dev-docs/api-meta/plugin-api-directory
 title: Directory
 description: Directory of public APIs available through plugins or packages.
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -15,13 +15,13 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Count | Plugins or Packages with a <br /> public API | Number of teams |
 |--------------|----------|------------------------|
-| 568 | 467 | 44 |
+| 570 | 469 | 45 |
 
 ### Public API health stats
 
 | API Count | Any Count | Missing comments | Missing exports |
 |--------------|----------|-----------------|--------|
-| 70179 | 527 | 59384 | 1217 |
+| 70199 | 525 | 59391 | 1218 |
 
 ## Plugin Directory
 
@@ -31,7 +31,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibAdvancedSettingsPluginApi" text="advancedSettings"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 36 | 1 | 32 | 2 |
 | <DocLink id="kibAiopsPluginApi" text="aiops"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | AIOps plugin maintained by ML team. | 12 | 0 | 1 | 2 |
 | <DocLink id="kibAlertingPluginApi" text="alerting"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 471 | 1 | 461 | 39 |
-| <DocLink id="kibApmPluginApi" text="apm"/> | [APM UI](https://github.com/orgs/elastic/teams/apm-ui) | The user interface for Elastic APM | 42 | 0 | 42 | 64 |
+| <DocLink id="kibApmPluginApi" text="apm"/> | [APM UI](https://github.com/orgs/elastic/teams/apm-ui) | The user interface for Elastic APM | 42 | 0 | 42 | 65 |
 | <DocLink id="kibBannersPluginApi" text="banners"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibBfetchPluginApi" text="bfetch"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Considering using bfetch capabilities when fetching large amounts of data. This services supports batching HTTP requests and streaming responses back. | 89 | 1 | 74 | 2 |
 | <DocLink id="kibCanvasPluginApi" text="canvas"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds Canvas application to Kibana | 9 | 0 | 8 | 3 |
@@ -48,22 +48,23 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibCloudSecurityPosturePluginApi" text="cloudSecurityPosture"/> | [Cloud Security Posture](https://github.com/orgs/elastic/teams/cloud-posture-security) | The cloud security posture plugin | 17 | 0 | 2 | 2 |
 | <DocLink id="kibConsolePluginApi" text="console"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 13 | 0 | 13 | 1 |
 | <DocLink id="kibContentManagementPluginApi" text="contentManagement"/> | [@elastic/kibana-global-experience](https://github.com/orgs/elastic/teams/@elastic/kibana-global-experience) | Content management app | 5 | 0 | 5 | 0 |
-| <DocLink id="kibControlsPluginApi" text="controls"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Controls Plugin contains embeddable components intended to create a simple query interface for end users, and a powerful editing suite that allows dashboard authors to build controls | 268 | 0 | 264 | 9 |
+| <DocLink id="kibControlsPluginApi" text="controls"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Controls Plugin contains embeddable components intended to create a simple query interface for end users, and a powerful editing suite that allows dashboard authors to build controls | 270 | 0 | 266 | 9 |
 | <DocLink id="kibCorePluginApi" text="core"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2845 | 17 | 1029 | 0 |
 | crossClusterReplication | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
 | customBranding | [global-experience](https://github.com/orgs/elastic/teams/kibana-global-experience) |  Enables customization of Kibana | 0 | 0 | 0 | 0 |
 | <DocLink id="kibCustomIntegrationsPluginApi" text="customIntegrations"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 107 | 0 | 88 | 1 |
-| <DocLink id="kibDashboardPluginApi" text="dashboard"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds the Dashboard app to Kibana | 171 | 0 | 163 | 10 |
+| <DocLink id="kibDashboardPluginApi" text="dashboard"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds the Dashboard app to Kibana | 172 | 0 | 164 | 10 |
 | <DocLink id="kibDashboardEnhancedPluginApi" text="dashboardEnhanced"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 54 | 0 | 51 | 0 |
 | <DocLink id="kibDataPluginApi" text="data"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3276 | 119 | 2578 | 27 |
 | <DocLink id="kibDataViewEditorPluginApi" text="dataViewEditor"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | This plugin provides the ability to create data views via a modal flyout inside Kibana apps | 16 | 0 | 7 | 0 |
 | <DocLink id="kibDataViewFieldEditorPluginApi" text="dataViewFieldEditor"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Reusable data view field editor across Kibana | 72 | 0 | 33 | 0 |
 | <DocLink id="kibDataViewManagementPluginApi" text="dataViewManagement"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data view management app | 2 | 0 | 2 | 0 |
 | <DocLink id="kibDataViewsPluginApi" text="dataViews"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 1020 | 0 | 231 | 2 |
-| <DocLink id="kibDataVisualizerPluginApi" text="dataVisualizer"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | The Data Visualizer tools help you understand your data, by analyzing the metrics and fields in a log file or an existing Elasticsearch index. | 28 | 3 | 24 | 1 |
+| <DocLink id="kibDataVisualizerPluginApi" text="dataVisualizer"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | The Data Visualizer tools help you understand your data, by analyzing the metrics and fields in a log file or an existing Elasticsearch index. | 28 | 3 | 24 | 0 |
 | <DocLink id="kibDevToolsPluginApi" text="devTools"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 10 | 0 | 8 | 2 |
 | <DocLink id="kibDiscoverPluginApi" text="discover"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the Discover application and the saved search embeddable. | 107 | 0 | 88 | 7 |
 | <DocLink id="kibDiscoverEnhancedPluginApi" text="discoverEnhanced"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 37 | 0 | 35 | 2 |
+| <DocLink id="kibEcsDataQualityDashboardPluginApi" text="ecsDataQualityDashboard"/> | [Threat Hunting Investigations](https://github.com/orgs/elastic/teams/security-threat-hunting-investigations) | APIs used to assess the quality of data in Elasticsearch indexes | 2 | 0 | 0 | 0 |
 | <DocLink id="kibEmbeddablePluginApi" text="embeddable"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds embeddables service to Kibana | 532 | 8 | 430 | 4 |
 | <DocLink id="kibEmbeddableEnhancedPluginApi" text="embeddableEnhanced"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends embeddable plugin with more functionality | 14 | 0 | 14 | 0 |
 | <DocLink id="kibEncryptedSavedObjectsPluginApi" text="encryptedSavedObjects"/> | [Platform Security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides encryption and decryption utilities for saved objects containing sensitive information. | 51 | 0 | 44 | 0 |
@@ -121,13 +122,13 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibManagementPluginApi" text="management"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 41 | 0 | 41 | 6 |
 | <DocLink id="kibMapsPluginApi" text="maps"/> | [GIS](https://github.com/orgs/elastic/teams/kibana-gis) | - | 267 | 0 | 266 | 27 |
 | <DocLink id="kibMapsEmsPluginApi" text="mapsEms"/> | [GIS](https://github.com/orgs/elastic/teams/kibana-gis) | - | 67 | 0 | 67 | 0 |
-| <DocLink id="kibMlPluginApi" text="ml"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the machine learning features provided by Elastic. | 254 | 9 | 78 | 40 |
+| <DocLink id="kibMlPluginApi" text="ml"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the machine learning features provided by Elastic. | 255 | 9 | 79 | 40 |
 | <DocLink id="kibMonitoringPluginApi" text="monitoring"/> | [Stack Monitoring](https://github.com/orgs/elastic/teams/stack-monitoring-ui) | - | 15 | 3 | 13 | 1 |
 | <DocLink id="kibMonitoringCollectionPluginApi" text="monitoringCollection"/> | [Stack Monitoring](https://github.com/orgs/elastic/teams/stack-monitoring-ui) | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibNavigationPluginApi" text="navigation"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 34 | 0 | 34 | 2 |
 | <DocLink id="kibNewsfeedPluginApi" text="newsfeed"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 17 | 0 | 17 | 0 |
 | <DocLink id="kibNotificationsPluginApi" text="notifications"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 2 | 0 | 2 | 1 |
-| <DocLink id="kibObservabilityPluginApi" text="observability"/> | [Observability UI](https://github.com/orgs/elastic/teams/observability-ui) | - | 607 | 41 | 601 | 32 |
+| <DocLink id="kibObservabilityPluginApi" text="observability"/> | [Observability UI](https://github.com/orgs/elastic/teams/observability-ui) | - | 598 | 39 | 592 | 32 |
 | <DocLink id="kibOsqueryPluginApi" text="osquery"/> | [Security asset management](https://github.com/orgs/elastic/teams/security-asset-management) | - | 24 | 0 | 24 | 7 |
 | painlessLab | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibPresentationUtilPluginApi" text="presentationUtil"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Presentation Utility Plugin is a set of common, shared components and toolkits for solutions within the Presentation space, (e.g. Dashboards, Canvas). | 217 | 7 | 161 | 11 |
@@ -135,7 +136,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibRemoteClustersPluginApi" text="remoteClusters"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 4 | 0 | 4 | 0 |
 | <DocLink id="kibReportingPluginApi" text="reporting"/> | [Kibana Reporting Services](https://github.com/orgs/elastic/teams/kibana-reporting-services) | Reporting Services enables applications to feature reports that the user can automate with Watcher and download later. | 36 | 0 | 16 | 0 |
 | <DocLink id="kibRollupPluginApi" text="rollup"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 21 | 0 | 21 | 0 |
-| <DocLink id="kibRuleRegistryPluginApi" text="ruleRegistry"/> | [RAC](https://github.com/orgs/elastic/teams/rac) | - | 251 | 0 | 223 | 11 |
+| <DocLink id="kibRuleRegistryPluginApi" text="ruleRegistry"/> | [RAC](https://github.com/orgs/elastic/teams/rac) | - | 252 | 0 | 224 | 12 |
 | <DocLink id="kibRuntimeFieldsPluginApi" text="runtimeFields"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 24 | 0 | 19 | 2 |
 | <DocLink id="kibSavedObjectsPluginApi" text="savedObjects"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 196 | 2 | 155 | 5 |
 | <DocLink id="kibSavedObjectsFinderPluginApi" text="savedObjectsFinder"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 16 | 0 | 16 | 0 |
@@ -147,7 +148,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibScreenshottingPluginApi" text="screenshotting"/> | [Kibana Reporting Services](https://github.com/orgs/elastic/teams/kibana-reporting-services) | Kibana Screenshotting Plugin | 27 | 0 | 8 | 4 |
 | searchprofiler | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibSecurityPluginApi" text="security"/> | [Platform Security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides authentication and authorization features, and exposes functionality to understand the capabilities of the currently authenticated user. | 269 | 0 | 89 | 0 |
-| <DocLink id="kibSecuritySolutionPluginApi" text="securitySolution"/> | [Security solution](https://github.com/orgs/elastic/teams/security-solution) | - | 113 | 0 | 73 | 28 |
+| <DocLink id="kibSecuritySolutionPluginApi" text="securitySolution"/> | [Security solution](https://github.com/orgs/elastic/teams/security-solution) | - | 117 | 0 | 77 | 28 |
 | <DocLink id="kibSessionViewPluginApi" text="sessionView"/> | [Security Team](https://github.com/orgs/elastic/teams/security-team) | - | 7 | 0 | 7 | 1 |
 | <DocLink id="kibSharePluginApi" text="share"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds URL Service and sharing capabilities to Kibana | 118 | 0 | 59 | 10 |
 | <DocLink id="kibSnapshotRestorePluginApi" text="snapshotRestore"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 22 | 1 | 22 | 1 |
@@ -164,7 +165,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibTimelinesPluginApi" text="timelines"/> | [Security solution](https://github.com/orgs/elastic/teams/security-solution) | - | 257 | 1 | 214 | 20 |
 | <DocLink id="kibTransformPluginApi" text="transform"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the transforms features provided by Elastic. Transforms enable you to convert existing Elasticsearch indices into summarized indices, which provide opportunities for new insights and analytics. | 4 | 0 | 4 | 1 |
 | translations | [Kibana Localization](https://github.com/orgs/elastic/teams/kibana-localization) | - | 0 | 0 | 0 | 0 |
-| <DocLink id="kibTriggersActionsUiPluginApi" text="triggersActionsUi"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 590 | 11 | 561 | 53 |
+| <DocLink id="kibTriggersActionsUiPluginApi" text="triggersActionsUi"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 591 | 11 | 562 | 53 |
 | <DocLink id="kibUiActionsPluginApi" text="uiActions"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds UI Actions service to Kibana | 134 | 2 | 92 | 9 |
 | <DocLink id="kibUiActionsEnhancedPluginApi" text="uiActionsEnhanced"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends UI Actions plugin with more functionality | 206 | 0 | 140 | 9 |
 | <DocLink id="kibUnifiedFieldListPluginApi" text="unifiedFieldList"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Contains functionality for the field list which can be integrated into apps | 267 | 0 | 242 | 7 |
@@ -393,6 +394,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnDocsUtilsPluginApi" text="@kbn/docs-utils"/> | [Owner missing] | - | 1 | 0 | 1 | 0 |
 | <DocLink id="kibKbnEbtToolsPluginApi" text="@kbn/ebt-tools"/> | [Owner missing] | - | 19 | 0 | 11 | 0 |
 | <DocLink id="kibKbnEcsPluginApi" text="@kbn/ecs"/> | Kibana Core | - | 35102 | 0 | 34695 | 0 |
+| <DocLink id="kibKbnEcsDataQualityDashboardPluginApi" text="@kbn/ecs-data-quality-dashboard"/> | [Owner missing] | - | 9 | 0 | 1 | 0 |
 | <DocLink id="kibKbnEsPluginApi" text="@kbn/es"/> | [Owner missing] | - | 4 | 0 | 4 | 0 |
 | <DocLink id="kibKbnEsArchiverPluginApi" text="@kbn/es-archiver"/> | [Owner missing] | - | 27 | 0 | 14 | 1 |
 | <DocLink id="kibKbnEsErrorsPluginApi" text="@kbn/es-errors"/> | Kibana Core | - | 7 | 0 | 3 | 0 |
@@ -459,7 +461,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnSecuritysolutionListApiPluginApi" text="@kbn/securitysolution-list-api"/> | [Owner missing] | security solution list REST API | 67 | 0 | 64 | 0 |
 | <DocLink id="kibKbnSecuritysolutionListConstantsPluginApi" text="@kbn/securitysolution-list-constants"/> | [Owner missing] | security solution list constants to use across plugins such lists, security_solution, cases, etc... | 35 | 0 | 23 | 0 |
 | <DocLink id="kibKbnSecuritysolutionListHooksPluginApi" text="@kbn/securitysolution-list-hooks"/> | [Owner missing] | Security solution list ReactJS hooks | 60 | 0 | 47 | 0 |
-| <DocLink id="kibKbnSecuritysolutionListUtilsPluginApi" text="@kbn/securitysolution-list-utils"/> | [Owner missing] | security solution list utilities | 194 | 10 | 150 | 0 |
+| <DocLink id="kibKbnSecuritysolutionListUtilsPluginApi" text="@kbn/securitysolution-list-utils"/> | [Owner missing] | security solution list utilities | 202 | 10 | 155 | 0 |
 | <DocLink id="kibKbnSecuritysolutionRulesPluginApi" text="@kbn/securitysolution-rules"/> | [Owner missing] | security solution rule utilities to use across plugins | 26 | 0 | 23 | 0 |
 | <DocLink id="kibKbnSecuritysolutionTGridPluginApi" text="@kbn/securitysolution-t-grid"/> | [Owner missing] | security solution t-grid packages will allow sharing components between timelines and security_solution plugin until we transfer all functionality to timelines plugin | 120 | 0 | 116 | 0 |
 | <DocLink id="kibKbnSecuritysolutionUtilsPluginApi" text="@kbn/securitysolution-utils"/> | [Owner missing] | security solution utilities to use across plugins such lists, security_solution, cases, etc... | 31 | 2 | 29 | 0 |
diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx
index e0f33aeecc3f3..03c1f4acb2680 100644
--- a/api_docs/presentation_util.mdx
+++ b/api_docs/presentation_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/presentationUtil
 title: "presentationUtil"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the presentationUtil plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationUtil']
 ---
 import presentationUtilObj from './presentation_util.devdocs.json';
diff --git a/api_docs/profiling.mdx b/api_docs/profiling.mdx
index ad17cf27e84de..4148815eefdf4 100644
--- a/api_docs/profiling.mdx
+++ b/api_docs/profiling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profiling
 title: "profiling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profiling plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profiling']
 ---
 import profilingObj from './profiling.devdocs.json';
diff --git a/api_docs/remote_clusters.mdx b/api_docs/remote_clusters.mdx
index b669510b5220d..e38dd73a1d13d 100644
--- a/api_docs/remote_clusters.mdx
+++ b/api_docs/remote_clusters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/remoteClusters
 title: "remoteClusters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the remoteClusters plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'remoteClusters']
 ---
 import remoteClustersObj from './remote_clusters.devdocs.json';
diff --git a/api_docs/reporting.mdx b/api_docs/reporting.mdx
index ad7205239f2ed..17a918294935d 100644
--- a/api_docs/reporting.mdx
+++ b/api_docs/reporting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/reporting
 title: "reporting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the reporting plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'reporting']
 ---
 import reportingObj from './reporting.devdocs.json';
diff --git a/api_docs/rollup.mdx b/api_docs/rollup.mdx
index 977d2cb46bcdc..1fc983ed105d5 100644
--- a/api_docs/rollup.mdx
+++ b/api_docs/rollup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/rollup
 title: "rollup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the rollup plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'rollup']
 ---
 import rollupObj from './rollup.devdocs.json';
diff --git a/api_docs/rule_registry.devdocs.json b/api_docs/rule_registry.devdocs.json
index 9f933a7c7b86b..179dfc081f46e 100644
--- a/api_docs/rule_registry.devdocs.json
+++ b/api_docs/rule_registry.devdocs.json
@@ -4782,6 +4782,55 @@
           }
         ],
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "ruleRegistry",
+        "id": "def-common.RuleRegistrySearchResponse",
+        "type": "Interface",
+        "tags": [],
+        "label": "RuleRegistrySearchResponse",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "ruleRegistry",
+            "scope": "common",
+            "docId": "kibRuleRegistryPluginApi",
+            "section": "def-common.RuleRegistrySearchResponse",
+            "text": "RuleRegistrySearchResponse"
+          },
+          " extends ",
+          {
+            "pluginId": "data",
+            "scope": "common",
+            "docId": "kibDataSearchPluginApi",
+            "section": "def-common.IEsSearchResponse",
+            "text": "IEsSearchResponse"
+          },
+          "<",
+          "EcsFieldsResponse",
+          ">"
+        ],
+        "path": "x-pack/plugins/rule_registry/common/search_strategy/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-common.RuleRegistrySearchResponse.inspect",
+            "type": "Object",
+            "tags": [],
+            "label": "inspect",
+            "description": [],
+            "signature": [
+              "RuleRegistryInspect",
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/rule_registry/common/search_strategy/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
       }
     ],
     "enums": [],
@@ -4882,34 +4931,6 @@
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.RuleRegistrySearchResponse",
-        "type": "Type",
-        "tags": [],
-        "label": "RuleRegistrySearchResponse",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataSearchPluginApi",
-            "section": "def-common.IKibanaSearchResponse",
-            "text": "IKibanaSearchResponse"
-          },
-          "<",
-          "SearchResponse",
-          "<",
-          "EcsFieldsResponse",
-          ", Record<string, ",
-          "AggregationsAggregate",
-          ">>>"
-        ],
-        "path": "x-pack/plugins/rule_registry/common/search_strategy/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
       }
     ],
     "objects": []
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index e4b94c6021bc4..76d668d8caa65 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ruleRegistry
 title: "ruleRegistry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ruleRegistry plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ruleRegistry']
 ---
 import ruleRegistryObj from './rule_registry.devdocs.json';
@@ -21,7 +21,7 @@ Contact [RAC](https://github.com/orgs/elastic/teams/rac) for questions regarding
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 251 | 0 | 223 | 11 |
+| 252 | 0 | 224 | 12 |
 
 ## Server
 
diff --git a/api_docs/runtime_fields.mdx b/api_docs/runtime_fields.mdx
index c0b249b3f20e9..0c2f66b4944e2 100644
--- a/api_docs/runtime_fields.mdx
+++ b/api_docs/runtime_fields.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/runtimeFields
 title: "runtimeFields"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the runtimeFields plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'runtimeFields']
 ---
 import runtimeFieldsObj from './runtime_fields.devdocs.json';
diff --git a/api_docs/saved_objects.mdx b/api_docs/saved_objects.mdx
index 46068214afbc8..cf7a001a620b2 100644
--- a/api_docs/saved_objects.mdx
+++ b/api_docs/saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjects
 title: "savedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjects plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjects']
 ---
 import savedObjectsObj from './saved_objects.devdocs.json';
diff --git a/api_docs/saved_objects_finder.mdx b/api_docs/saved_objects_finder.mdx
index 5c922368d20fe..db78b1aabc68c 100644
--- a/api_docs/saved_objects_finder.mdx
+++ b/api_docs/saved_objects_finder.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsFinder
 title: "savedObjectsFinder"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsFinder plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsFinder']
 ---
 import savedObjectsFinderObj from './saved_objects_finder.devdocs.json';
diff --git a/api_docs/saved_objects_management.mdx b/api_docs/saved_objects_management.mdx
index 86d4ee0d533bd..4377f1beac2e2 100644
--- a/api_docs/saved_objects_management.mdx
+++ b/api_docs/saved_objects_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsManagement
 title: "savedObjectsManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsManagement plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsManagement']
 ---
 import savedObjectsManagementObj from './saved_objects_management.devdocs.json';
diff --git a/api_docs/saved_objects_tagging.mdx b/api_docs/saved_objects_tagging.mdx
index 46a93a4f07329..8c73088fa2659 100644
--- a/api_docs/saved_objects_tagging.mdx
+++ b/api_docs/saved_objects_tagging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTagging
 title: "savedObjectsTagging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTagging plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTagging']
 ---
 import savedObjectsTaggingObj from './saved_objects_tagging.devdocs.json';
diff --git a/api_docs/saved_objects_tagging_oss.mdx b/api_docs/saved_objects_tagging_oss.mdx
index cd4b3ddc5078d..cfe1398a962a6 100644
--- a/api_docs/saved_objects_tagging_oss.mdx
+++ b/api_docs/saved_objects_tagging_oss.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTaggingOss
 title: "savedObjectsTaggingOss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTaggingOss plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTaggingOss']
 ---
 import savedObjectsTaggingOssObj from './saved_objects_tagging_oss.devdocs.json';
diff --git a/api_docs/saved_search.mdx b/api_docs/saved_search.mdx
index 428e6ec3fa28f..2ced43ac416dc 100644
--- a/api_docs/saved_search.mdx
+++ b/api_docs/saved_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedSearch
 title: "savedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedSearch plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedSearch']
 ---
 import savedSearchObj from './saved_search.devdocs.json';
diff --git a/api_docs/screenshot_mode.mdx b/api_docs/screenshot_mode.mdx
index 645333392e113..5dcdb0e78d97e 100644
--- a/api_docs/screenshot_mode.mdx
+++ b/api_docs/screenshot_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotMode
 title: "screenshotMode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotMode plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotMode']
 ---
 import screenshotModeObj from './screenshot_mode.devdocs.json';
diff --git a/api_docs/screenshotting.mdx b/api_docs/screenshotting.mdx
index 4d2f4c94bafb8..370529b6a6a98 100644
--- a/api_docs/screenshotting.mdx
+++ b/api_docs/screenshotting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotting
 title: "screenshotting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotting plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotting']
 ---
 import screenshottingObj from './screenshotting.devdocs.json';
diff --git a/api_docs/security.mdx b/api_docs/security.mdx
index ef22e385eaa01..78ff2f6aaff02 100644
--- a/api_docs/security.mdx
+++ b/api_docs/security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/security
 title: "security"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the security plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'security']
 ---
 import securityObj from './security.devdocs.json';
diff --git a/api_docs/security_solution.devdocs.json b/api_docs/security_solution.devdocs.json
index 8d2f84311053b..037917ccefd0a 100644
--- a/api_docs/security_solution.devdocs.json
+++ b/api_docs/security_solution.devdocs.json
@@ -1357,7 +1357,7 @@
                 "id": "def-server.AppClient.Unnamed.$1",
                 "type": "string",
                 "tags": [],
-                "label": "_spaceId",
+                "label": "spaceId",
                 "description": [],
                 "signature": [
                   "string"
@@ -1387,6 +1387,36 @@
                 "deprecated": false,
                 "trackAdoption": false,
                 "isRequired": true
+              },
+              {
+                "parentPluginId": "securitySolution",
+                "id": "def-server.AppClient.Unnamed.$3",
+                "type": "string",
+                "tags": [],
+                "label": "kibanaVersion",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "x-pack/plugins/security_solution/server/client/client.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "securitySolution",
+                "id": "def-server.AppClient.Unnamed.$4",
+                "type": "string",
+                "tags": [],
+                "label": "kibanaBranch",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "x-pack/plugins/security_solution/server/client/client.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
               }
             ],
             "returnComment": []
@@ -1454,6 +1484,38 @@
             "trackAdoption": false,
             "children": [],
             "returnComment": []
+          },
+          {
+            "parentPluginId": "securitySolution",
+            "id": "def-server.AppClient.getKibanaVersion",
+            "type": "Function",
+            "tags": [],
+            "label": "getKibanaVersion",
+            "description": [],
+            "signature": [
+              "() => string"
+            ],
+            "path": "x-pack/plugins/security_solution/server/client/client.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "securitySolution",
+            "id": "def-server.AppClient.getKibanaBranch",
+            "type": "Function",
+            "tags": [],
+            "label": "getKibanaBranch",
+            "description": [],
+            "signature": [
+              "() => string"
+            ],
+            "path": "x-pack/plugins/security_solution/server/client/client.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx
index 4864037345cc8..cc4bdbfdcdc83 100644
--- a/api_docs/security_solution.mdx
+++ b/api_docs/security_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolution
 title: "securitySolution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolution plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolution']
 ---
 import securitySolutionObj from './security_solution.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Security solution](https://github.com/orgs/elastic/teams/security-solut
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 113 | 0 | 73 | 28 |
+| 117 | 0 | 77 | 28 |
 
 ## Client
 
diff --git a/api_docs/session_view.mdx b/api_docs/session_view.mdx
index 9108594417e0a..c286437356f5b 100644
--- a/api_docs/session_view.mdx
+++ b/api_docs/session_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/sessionView
 title: "sessionView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the sessionView plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sessionView']
 ---
 import sessionViewObj from './session_view.devdocs.json';
diff --git a/api_docs/share.mdx b/api_docs/share.mdx
index 11cadec0dc13f..c698baa7152db 100644
--- a/api_docs/share.mdx
+++ b/api_docs/share.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/share
 title: "share"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the share plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'share']
 ---
 import shareObj from './share.devdocs.json';
diff --git a/api_docs/snapshot_restore.mdx b/api_docs/snapshot_restore.mdx
index 26792eec17786..881af5e8dfa24 100644
--- a/api_docs/snapshot_restore.mdx
+++ b/api_docs/snapshot_restore.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/snapshotRestore
 title: "snapshotRestore"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the snapshotRestore plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'snapshotRestore']
 ---
 import snapshotRestoreObj from './snapshot_restore.devdocs.json';
diff --git a/api_docs/spaces.mdx b/api_docs/spaces.mdx
index 298a16ca075c7..0e6ee0a35f11b 100644
--- a/api_docs/spaces.mdx
+++ b/api_docs/spaces.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/spaces
 title: "spaces"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the spaces plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'spaces']
 ---
 import spacesObj from './spaces.devdocs.json';
diff --git a/api_docs/stack_alerts.mdx b/api_docs/stack_alerts.mdx
index b2bf482b11838..6b1c54c5e45c9 100644
--- a/api_docs/stack_alerts.mdx
+++ b/api_docs/stack_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackAlerts
 title: "stackAlerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackAlerts plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackAlerts']
 ---
 import stackAlertsObj from './stack_alerts.devdocs.json';
diff --git a/api_docs/stack_connectors.mdx b/api_docs/stack_connectors.mdx
index 2388475fe361e..d52f86ad8d6ae 100644
--- a/api_docs/stack_connectors.mdx
+++ b/api_docs/stack_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackConnectors
 title: "stackConnectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackConnectors plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackConnectors']
 ---
 import stackConnectorsObj from './stack_connectors.devdocs.json';
diff --git a/api_docs/task_manager.mdx b/api_docs/task_manager.mdx
index b259e89d91270..5d260a89bf443 100644
--- a/api_docs/task_manager.mdx
+++ b/api_docs/task_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/taskManager
 title: "taskManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the taskManager plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'taskManager']
 ---
 import taskManagerObj from './task_manager.devdocs.json';
diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx
index 1e1a91c6c12ec..01af319f3bda4 100644
--- a/api_docs/telemetry.mdx
+++ b/api_docs/telemetry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetry
 title: "telemetry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetry plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetry']
 ---
 import telemetryObj from './telemetry.devdocs.json';
diff --git a/api_docs/telemetry_collection_manager.mdx b/api_docs/telemetry_collection_manager.mdx
index 5b5e457298f13..c86d8166f16f9 100644
--- a/api_docs/telemetry_collection_manager.mdx
+++ b/api_docs/telemetry_collection_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionManager
 title: "telemetryCollectionManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionManager plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionManager']
 ---
 import telemetryCollectionManagerObj from './telemetry_collection_manager.devdocs.json';
diff --git a/api_docs/telemetry_collection_xpack.mdx b/api_docs/telemetry_collection_xpack.mdx
index 73709696fa8d3..59e2d2847e0dd 100644
--- a/api_docs/telemetry_collection_xpack.mdx
+++ b/api_docs/telemetry_collection_xpack.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionXpack
 title: "telemetryCollectionXpack"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionXpack plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionXpack']
 ---
 import telemetryCollectionXpackObj from './telemetry_collection_xpack.devdocs.json';
diff --git a/api_docs/telemetry_management_section.mdx b/api_docs/telemetry_management_section.mdx
index c9e42ef31ed4b..0594a57e39211 100644
--- a/api_docs/telemetry_management_section.mdx
+++ b/api_docs/telemetry_management_section.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryManagementSection
 title: "telemetryManagementSection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryManagementSection plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryManagementSection']
 ---
 import telemetryManagementSectionObj from './telemetry_management_section.devdocs.json';
diff --git a/api_docs/threat_intelligence.mdx b/api_docs/threat_intelligence.mdx
index 1dffe24f7d50a..e2621fa11d1ab 100644
--- a/api_docs/threat_intelligence.mdx
+++ b/api_docs/threat_intelligence.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/threatIntelligence
 title: "threatIntelligence"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the threatIntelligence plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'threatIntelligence']
 ---
 import threatIntelligenceObj from './threat_intelligence.devdocs.json';
diff --git a/api_docs/timelines.mdx b/api_docs/timelines.mdx
index 49f74345c8c2a..c8d8886c92dd1 100644
--- a/api_docs/timelines.mdx
+++ b/api_docs/timelines.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/timelines
 title: "timelines"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the timelines plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'timelines']
 ---
 import timelinesObj from './timelines.devdocs.json';
diff --git a/api_docs/transform.mdx b/api_docs/transform.mdx
index 96cbde843c10f..d381c66753f23 100644
--- a/api_docs/transform.mdx
+++ b/api_docs/transform.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/transform
 title: "transform"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the transform plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'transform']
 ---
 import transformObj from './transform.devdocs.json';
diff --git a/api_docs/triggers_actions_ui.devdocs.json b/api_docs/triggers_actions_ui.devdocs.json
index c0dfde4f934d2..727eba233d35b 100644
--- a/api_docs/triggers_actions_ui.devdocs.json
+++ b/api_docs/triggers_actions_ui.devdocs.json
@@ -3786,6 +3786,20 @@
             "path": "x-pack/plugins/triggers_actions_ui/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "triggersActionsUi",
+            "id": "def-public.AlertsTableProps.showInspectButton",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "showInspectButton",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "x-pack/plugins/triggers_actions_ui/public/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -4089,7 +4103,7 @@
         "tags": [],
         "label": "AlertSummaryTimeRange",
         "description": [],
-        "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/alert_summary/types.ts",
+        "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/alert_summary_widget/types.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
@@ -4100,7 +4114,7 @@
             "tags": [],
             "label": "utcFrom",
             "description": [],
-            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/alert_summary/types.ts",
+            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/alert_summary_widget/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
@@ -4111,7 +4125,7 @@
             "tags": [],
             "label": "utcTo",
             "description": [],
-            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/alert_summary/types.ts",
+            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/alert_summary_widget/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
@@ -4122,7 +4136,7 @@
             "tags": [],
             "label": "fixedInterval",
             "description": [],
-            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/alert_summary/types.ts",
+            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/alert_summary_widget/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
@@ -4136,7 +4150,7 @@
             "signature": [
               "string | JSX.Element | undefined"
             ],
-            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/alert_summary/types.ts",
+            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/alert_summary_widget/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
@@ -4150,7 +4164,7 @@
             "signature": [
               "string | undefined"
             ],
-            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/alert_summary/types.ts",
+            "path": "x-pack/plugins/triggers_actions_ui/public/application/sections/alert_summary_widget/types.ts",
             "deprecated": false,
             "trackAdoption": false
           }
diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx
index e2e4d6530c92f..1a60684e2242a 100644
--- a/api_docs/triggers_actions_ui.mdx
+++ b/api_docs/triggers_actions_ui.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/triggersActionsUi
 title: "triggersActionsUi"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the triggersActionsUi plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'triggersActionsUi']
 ---
 import triggersActionsUiObj from './triggers_actions_ui.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Response Ops](https://github.com/orgs/elastic/teams/response-ops) for q
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 590 | 11 | 561 | 53 |
+| 591 | 11 | 562 | 53 |
 
 ## Client
 
diff --git a/api_docs/ui_actions.mdx b/api_docs/ui_actions.mdx
index 807748e58ecd9..ac0099c091616 100644
--- a/api_docs/ui_actions.mdx
+++ b/api_docs/ui_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActions
 title: "uiActions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActions plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActions']
 ---
 import uiActionsObj from './ui_actions.devdocs.json';
diff --git a/api_docs/ui_actions_enhanced.mdx b/api_docs/ui_actions_enhanced.mdx
index 763363e200c18..c94aa6bb6d19e 100644
--- a/api_docs/ui_actions_enhanced.mdx
+++ b/api_docs/ui_actions_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActionsEnhanced
 title: "uiActionsEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActionsEnhanced plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActionsEnhanced']
 ---
 import uiActionsEnhancedObj from './ui_actions_enhanced.devdocs.json';
diff --git a/api_docs/unified_field_list.mdx b/api_docs/unified_field_list.mdx
index 6f7a154c7cf84..927c393480ae1 100644
--- a/api_docs/unified_field_list.mdx
+++ b/api_docs/unified_field_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedFieldList
 title: "unifiedFieldList"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedFieldList plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedFieldList']
 ---
 import unifiedFieldListObj from './unified_field_list.devdocs.json';
diff --git a/api_docs/unified_histogram.mdx b/api_docs/unified_histogram.mdx
index 0584a881ef4d6..eecbec56ea228 100644
--- a/api_docs/unified_histogram.mdx
+++ b/api_docs/unified_histogram.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedHistogram
 title: "unifiedHistogram"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedHistogram plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedHistogram']
 ---
 import unifiedHistogramObj from './unified_histogram.devdocs.json';
diff --git a/api_docs/unified_search.mdx b/api_docs/unified_search.mdx
index ae2ce4418fe10..669425698a9dd 100644
--- a/api_docs/unified_search.mdx
+++ b/api_docs/unified_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch
 title: "unifiedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch']
 ---
 import unifiedSearchObj from './unified_search.devdocs.json';
diff --git a/api_docs/unified_search_autocomplete.mdx b/api_docs/unified_search_autocomplete.mdx
index 9c5bfde3ca160..ebf92c69d8ada 100644
--- a/api_docs/unified_search_autocomplete.mdx
+++ b/api_docs/unified_search_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch-autocomplete
 title: "unifiedSearch.autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch.autocomplete plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch.autocomplete']
 ---
 import unifiedSearchAutocompleteObj from './unified_search_autocomplete.devdocs.json';
diff --git a/api_docs/url_forwarding.mdx b/api_docs/url_forwarding.mdx
index 8c9218fe7bc61..04ca3c115c656 100644
--- a/api_docs/url_forwarding.mdx
+++ b/api_docs/url_forwarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/urlForwarding
 title: "urlForwarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the urlForwarding plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'urlForwarding']
 ---
 import urlForwardingObj from './url_forwarding.devdocs.json';
diff --git a/api_docs/usage_collection.mdx b/api_docs/usage_collection.mdx
index b7a6bfb2351a5..510eb08b21d64 100644
--- a/api_docs/usage_collection.mdx
+++ b/api_docs/usage_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/usageCollection
 title: "usageCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the usageCollection plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'usageCollection']
 ---
 import usageCollectionObj from './usage_collection.devdocs.json';
diff --git a/api_docs/ux.mdx b/api_docs/ux.mdx
index f1525d92c8b3b..179032e14f600 100644
--- a/api_docs/ux.mdx
+++ b/api_docs/ux.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ux
 title: "ux"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ux plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ux']
 ---
 import uxObj from './ux.devdocs.json';
diff --git a/api_docs/vis_default_editor.mdx b/api_docs/vis_default_editor.mdx
index ea0faa7f2d8fc..d7b4887709063 100644
--- a/api_docs/vis_default_editor.mdx
+++ b/api_docs/vis_default_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visDefaultEditor
 title: "visDefaultEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visDefaultEditor plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visDefaultEditor']
 ---
 import visDefaultEditorObj from './vis_default_editor.devdocs.json';
diff --git a/api_docs/vis_type_gauge.mdx b/api_docs/vis_type_gauge.mdx
index 794f376d146b4..961d21d69ca6f 100644
--- a/api_docs/vis_type_gauge.mdx
+++ b/api_docs/vis_type_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeGauge
 title: "visTypeGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeGauge plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeGauge']
 ---
 import visTypeGaugeObj from './vis_type_gauge.devdocs.json';
diff --git a/api_docs/vis_type_heatmap.mdx b/api_docs/vis_type_heatmap.mdx
index 50f066641d4c4..677e037635458 100644
--- a/api_docs/vis_type_heatmap.mdx
+++ b/api_docs/vis_type_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeHeatmap
 title: "visTypeHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeHeatmap plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeHeatmap']
 ---
 import visTypeHeatmapObj from './vis_type_heatmap.devdocs.json';
diff --git a/api_docs/vis_type_pie.mdx b/api_docs/vis_type_pie.mdx
index 42024a5dd5059..9f1bcb41f5a78 100644
--- a/api_docs/vis_type_pie.mdx
+++ b/api_docs/vis_type_pie.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypePie
 title: "visTypePie"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypePie plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypePie']
 ---
 import visTypePieObj from './vis_type_pie.devdocs.json';
diff --git a/api_docs/vis_type_table.mdx b/api_docs/vis_type_table.mdx
index ffbe9f763bb51..4d666bac893e5 100644
--- a/api_docs/vis_type_table.mdx
+++ b/api_docs/vis_type_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTable
 title: "visTypeTable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTable plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTable']
 ---
 import visTypeTableObj from './vis_type_table.devdocs.json';
diff --git a/api_docs/vis_type_timelion.mdx b/api_docs/vis_type_timelion.mdx
index 93fb35c35748b..d73d4e7a73228 100644
--- a/api_docs/vis_type_timelion.mdx
+++ b/api_docs/vis_type_timelion.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimelion
 title: "visTypeTimelion"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimelion plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimelion']
 ---
 import visTypeTimelionObj from './vis_type_timelion.devdocs.json';
diff --git a/api_docs/vis_type_timeseries.mdx b/api_docs/vis_type_timeseries.mdx
index f8282c310fad2..3bbbf5c0e3727 100644
--- a/api_docs/vis_type_timeseries.mdx
+++ b/api_docs/vis_type_timeseries.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimeseries
 title: "visTypeTimeseries"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimeseries plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimeseries']
 ---
 import visTypeTimeseriesObj from './vis_type_timeseries.devdocs.json';
diff --git a/api_docs/vis_type_vega.mdx b/api_docs/vis_type_vega.mdx
index 713f69371f543..54dc81ca6623b 100644
--- a/api_docs/vis_type_vega.mdx
+++ b/api_docs/vis_type_vega.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVega
 title: "visTypeVega"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVega plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVega']
 ---
 import visTypeVegaObj from './vis_type_vega.devdocs.json';
diff --git a/api_docs/vis_type_vislib.mdx b/api_docs/vis_type_vislib.mdx
index 261d9ffd9826e..44af403e42b17 100644
--- a/api_docs/vis_type_vislib.mdx
+++ b/api_docs/vis_type_vislib.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVislib
 title: "visTypeVislib"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVislib plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVislib']
 ---
 import visTypeVislibObj from './vis_type_vislib.devdocs.json';
diff --git a/api_docs/vis_type_xy.mdx b/api_docs/vis_type_xy.mdx
index abc70d94f5702..3a3e58d4118cf 100644
--- a/api_docs/vis_type_xy.mdx
+++ b/api_docs/vis_type_xy.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeXy
 title: "visTypeXy"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeXy plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeXy']
 ---
 import visTypeXyObj from './vis_type_xy.devdocs.json';
diff --git a/api_docs/visualizations.mdx b/api_docs/visualizations.mdx
index 53dc8f9854f28..2d09aebd2231a 100644
--- a/api_docs/visualizations.mdx
+++ b/api_docs/visualizations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visualizations
 title: "visualizations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visualizations plugin
-date: 2023-02-06
+date: 2023-02-07
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visualizations']
 ---
 import visualizationsObj from './visualizations.devdocs.json';

From 8f0d367ff609c71062601d8aa58474d64efe12e5 Mon Sep 17 00:00:00 2001
From: Oliver Gupte <ogupte@users.noreply.github.com>
Date: Tue, 7 Feb 2023 01:24:39 -0500
Subject: [PATCH 031/134] [APM] Adds KQL filter bar to the service map page
 (#149900)

Closes #146531.

![Screenshot 2023-01-30 at 4 50 42
PM](https://user-images.githubusercontent.com/1967266/215607794-49e019f6-f2ad-46a4-8449-1bef16beece4.png)

- Also adds a link in the trace sample menu to filter the service map by
the `trace.id`:


![apm-service-map-kuery-filter](https://user-images.githubusercontent.com/1967266/215607846-7ca5f87f-e934-4171-9f3c-b09913df63be.gif)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Nathan L Smith <nathan.smith@elastic.co>
---
 .../src/lib/apm/apm_fields.ts                 |   1 +
 .../src/scenarios/service_map.ts              | 123 ++++++++++++++++
 packages/kbn-apm-synthtrace/tsconfig.json     |   3 +-
 .../components/app/service_map/index.tsx      |   5 +-
 .../app/service_map/popover/index.tsx         |  17 +++
 .../components/shared/kuery_bar/index.tsx     |   2 +-
 .../transaction_action_menu/sections.test.ts  |  73 ++++++++--
 .../transaction_action_menu/sections.ts       |  55 ++++++-
 .../transaction_action_menu.test.tsx          |  14 +-
 .../transaction_action_menu.tsx               |   6 +-
 .../server/lib/helpers/transactions/index.ts  |   4 +-
 .../routes/service_map/get_service_map.ts     |   4 +-
 .../routes/service_map/get_service_stats.ts   |   2 +
 .../service_map/get_trace_sample_ids.ts       |  12 +-
 .../apm/server/routes/service_map/route.ts    |   8 +-
 .../service_maps_kuery_filter.spec.ts         | 136 ++++++++++++++++++
 .../tests/traces/find_traces.spec.ts          |  43 +-----
 .../tests/traces/generate_trace.ts            |  53 +++++++
 18 files changed, 480 insertions(+), 81 deletions(-)
 create mode 100644 packages/kbn-apm-synthtrace/src/scenarios/service_map.ts
 create mode 100644 x-pack/test/apm_api_integration/tests/service_maps/service_maps_kuery_filter.spec.ts
 create mode 100644 x-pack/test/apm_api_integration/tests/traces/generate_trace.ts

diff --git a/packages/kbn-apm-synthtrace-client/src/lib/apm/apm_fields.ts b/packages/kbn-apm-synthtrace-client/src/lib/apm/apm_fields.ts
index 8978604fb2f1c..abc916668299c 100644
--- a/packages/kbn-apm-synthtrace-client/src/lib/apm/apm_fields.ts
+++ b/packages/kbn-apm-synthtrace-client/src/lib/apm/apm_fields.ts
@@ -115,6 +115,7 @@ export type ApmFields = Fields<{
     'http.response.status_code': number;
     'kubernetes.pod.name': string;
     'kubernetes.pod.uid': string;
+    'labels.name': string;
     'metricset.name': string;
     'network.carrier.icc': string;
     'network.carrier.mcc': string;
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/service_map.ts b/packages/kbn-apm-synthtrace/src/scenarios/service_map.ts
new file mode 100644
index 0000000000000..41e499320fd50
--- /dev/null
+++ b/packages/kbn-apm-synthtrace/src/scenarios/service_map.ts
@@ -0,0 +1,123 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { apm, ApmFields, Instance } from '@kbn/apm-synthtrace-client';
+import { Transaction } from '@kbn/apm-synthtrace-client/src/lib/apm/transaction';
+import { AgentName } from '@kbn/apm-plugin/typings/es_schemas/ui/fields/agent';
+import { Scenario } from '../cli/scenario';
+import { RunOptions } from '../cli/utils/parse_run_cli_flags';
+import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+
+const ENVIRONMENT = getSynthtraceEnvironment(__filename);
+
+function generateTrace(
+  timestamp: number,
+  transactionName: string,
+  order: Instance[],
+  db?: 'elasticsearch' | 'redis'
+) {
+  return order
+    .concat()
+    .reverse()
+    .reduce<Transaction | undefined>((prev, instance, index) => {
+      const invertedIndex = order.length - index - 1;
+
+      const duration = 50;
+      const time = timestamp + invertedIndex * 10;
+
+      const transaction: Transaction = instance
+        .transaction({ transactionName })
+        .timestamp(time)
+        .duration(duration);
+
+      if (prev) {
+        const next = order[invertedIndex + 1].fields['service.name']!;
+        transaction.children(
+          instance
+            .span({ spanName: `GET ${next}/api`, spanType: 'external', spanSubtype: 'http' })
+            .destination(next)
+            .duration(duration)
+            .timestamp(time + 1)
+            .children(prev)
+        );
+      } else if (db) {
+        transaction.children(
+          instance
+            .span({ spanName: db, spanType: 'db', spanSubtype: db })
+            .destination(db)
+            .duration(duration)
+            .timestamp(time + 1)
+        );
+      }
+
+      return transaction;
+    }, undefined)!;
+}
+
+function service(serviceName: string, agentName: AgentName) {
+  return apm
+    .service({ name: serviceName, environment: ENVIRONMENT, agentName })
+    .instance(serviceName);
+}
+
+const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
+  return {
+    generate: ({ range }) => {
+      const frontendRum = service('frontend-rum', 'rum-js');
+      const frontendNode = service('frontend-node', 'nodejs');
+      const advertService = service('advertService', 'java');
+      const checkoutService = service('checkoutService', 'go');
+      const cartService = service('cartService', 'dotnet');
+      const paymentService = service('paymentService', 'nodejs');
+      const productCatalogService = service('productCatalogService', 'go');
+      return range
+        .interval('1s')
+        .rate(3)
+        .generator((timestamp) => {
+          return [
+            generateTrace(
+              timestamp,
+              'GET /api/adTag',
+              [frontendRum, frontendNode, advertService],
+              'elasticsearch'
+            ),
+            generateTrace(
+              timestamp,
+              'POST /api/addToCart',
+              [frontendRum, frontendNode, cartService],
+              'redis'
+            ),
+            generateTrace(timestamp, 'POST /api/checkout', [
+              frontendRum,
+              frontendNode,
+              checkoutService,
+              paymentService,
+            ]),
+            generateTrace(
+              timestamp,
+              'DELETE /api/clearCart',
+              [checkoutService, cartService],
+              'redis'
+            ),
+            generateTrace(
+              timestamp,
+              'GET /api/products',
+              [frontendRum, frontendNode, productCatalogService],
+              'elasticsearch'
+            ),
+            generateTrace(timestamp, 'PUT /api/updateInventory', [
+              checkoutService,
+              productCatalogService,
+            ]),
+          ];
+        });
+    },
+  };
+};
+
+export default scenario;
diff --git a/packages/kbn-apm-synthtrace/tsconfig.json b/packages/kbn-apm-synthtrace/tsconfig.json
index 1921231fe842c..3db0ec03f6f4d 100644
--- a/packages/kbn-apm-synthtrace/tsconfig.json
+++ b/packages/kbn-apm-synthtrace/tsconfig.json
@@ -7,7 +7,8 @@
   "include": ["**/*.ts"],
   "kbn_references": [
     "@kbn/datemath",
-    "@kbn/apm-synthtrace-client"
+    "@kbn/apm-synthtrace-client",
+    "@kbn/apm-plugin"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/apm/public/components/app/service_map/index.tsx b/x-pack/plugins/apm/public/components/app/service_map/index.tsx
index 44072c4ec88ea..d1be9af798dd7 100644
--- a/x-pack/plugins/apm/public/components/app/service_map/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_map/index.tsx
@@ -137,11 +137,12 @@ export function ServiceMap({
             environment,
             serviceName,
             serviceGroup: serviceGroupId,
+            kuery,
           },
         },
       });
     },
-    [license, serviceName, environment, start, end, serviceGroupId]
+    [license, serviceName, environment, start, end, serviceGroupId, kuery]
   );
 
   const { ref, height } = useRefDimensions();
@@ -186,7 +187,7 @@ export function ServiceMap({
 
   return (
     <>
-      <SearchBar showKueryBar={false} showTimeComparison />
+      <SearchBar showTimeComparison />
       <EuiPanel hasBorder={true} paddingSize="none">
         <div
           data-test-subj="ServiceMap"
diff --git a/x-pack/plugins/apm/public/components/app/service_map/popover/index.tsx b/x-pack/plugins/apm/public/components/app/service_map/popover/index.tsx
index 386b550b7f8b0..aa47d695001ce 100644
--- a/x-pack/plugins/apm/public/components/app/service_map/popover/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_map/popover/index.tsx
@@ -11,6 +11,8 @@ import {
   EuiHorizontalRule,
   EuiPopover,
   EuiTitle,
+  EuiToolTip,
+  EuiIcon,
 } from '@elastic/eui';
 import cytoscape from 'cytoscape';
 import React, {
@@ -22,6 +24,7 @@ import React, {
   useRef,
   useState,
 } from 'react';
+import { i18n } from '@kbn/i18n';
 import { SERVICE_NAME, SPAN_TYPE } from '../../../../../common/es_fields/apm';
 import { Environment } from '../../../../../common/environment_rt';
 import { useTheme } from '../../../../hooks/use_theme';
@@ -207,6 +210,20 @@ export function Popover({
           <EuiTitle size="xxs">
             <h3 style={{ wordBreak: 'break-all' }}>
               {selectedElementData.label ?? selectedElementId}
+              {kuery && (
+                <EuiToolTip
+                  position="bottom"
+                  content={i18n.translate(
+                    'xpack.apm.serviceMap.kqlFilterInfo',
+                    {
+                      defaultMessage:
+                        'The KQL filter is not applied in the displayed stats.',
+                    }
+                  )}
+                >
+                  <EuiIcon tabIndex={0} type="iInCircle" />
+                </EuiToolTip>
+              )}
             </h3>
           </EuiTitle>
           <EuiHorizontalRule margin="xs" />
diff --git a/x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx b/x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx
index c8e9de32c83f3..825fa8e3ef7f4 100644
--- a/x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx
@@ -151,7 +151,7 @@ export function KueryBar(props: {
         return;
       }
 
-      if (typeof props.onSubmit === 'function') {
+      if (props.onSubmit) {
         props.onSubmit(inputValue.trim());
         return;
       }
diff --git a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/sections.test.ts b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/sections.test.ts
index c0b67dfc02e33..0451cda9dafa2 100644
--- a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/sections.test.ts
+++ b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/sections.test.ts
@@ -5,10 +5,20 @@
  * 2.0.
  */
 
-import { Location } from 'history';
+import { createMemoryHistory } from 'history';
 import { IBasePath } from '@kbn/core/public';
 import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
 import { getSections } from './sections';
+import {
+  apmRouter as apmRouterBase,
+  ApmRouter,
+} from '../../routing/apm_route_config';
+
+const apmRouter = {
+  ...apmRouterBase,
+  link: (...args: [any]) =>
+    `some-basepath/app/apm${apmRouterBase.link(...args)}`,
+} as ApmRouter;
 
 describe('Transaction action menu', () => {
   const basePath = {
@@ -19,17 +29,11 @@ describe('Transaction action menu', () => {
   const date = '2020-02-06T11:00:00.000Z';
   const timestamp = { us: new Date(date).getTime() };
 
-  const urlParams = {
-    rangeFrom: 'now-24h',
-    rangeTo: 'now',
-    refreshPaused: true,
-    refreshInterval: 0,
-  };
-
-  const location = {
-    search:
-      '?rangeFrom=now-24h&rangeTo=now&refreshPaused=true&refreshInterval=0',
-  } as unknown as Location;
+  const history = createMemoryHistory();
+  history.replace(
+    '/services/testbeans-go/transactions/view?rangeFrom=now-24h&rangeTo=now&transactionName=GET+%2Ftestbeans-go%2Fapi'
+  );
+  const location = history.location;
 
   it('shows required sections only', () => {
     const transaction = {
@@ -43,7 +47,7 @@ describe('Transaction action menu', () => {
         transaction,
         basePath,
         location,
-        urlParams,
+        apmRouter,
       })
     ).toEqual([
       [
@@ -60,6 +64,19 @@ describe('Transaction action menu', () => {
             },
           ],
         },
+        {
+          key: 'serviceMap',
+          title: 'Service map',
+          subtitle: 'View service map filtered by this trace.',
+          actions: [
+            {
+              key: 'serviceMap',
+              label: 'Show in service map',
+              href: 'some-basepath/app/apm/service-map?comparisonEnabled=false&environment=ENVIRONMENT_ALL&kuery=trace.id%20%3A%20%22123%22&rangeFrom=now-24h&rangeTo=now&serviceGroup=',
+              condition: true,
+            },
+          ],
+        },
       ],
       [
         {
@@ -90,7 +107,7 @@ describe('Transaction action menu', () => {
         transaction,
         basePath,
         location,
-        urlParams,
+        apmRouter,
       })
     ).toEqual([
       [
@@ -127,6 +144,19 @@ describe('Transaction action menu', () => {
             },
           ],
         },
+        {
+          key: 'serviceMap',
+          title: 'Service map',
+          subtitle: 'View service map filtered by this trace.',
+          actions: [
+            {
+              key: 'serviceMap',
+              label: 'Show in service map',
+              href: 'some-basepath/app/apm/service-map?comparisonEnabled=false&environment=ENVIRONMENT_ALL&kuery=trace.id%20%3A%20%22123%22&rangeFrom=now-24h&rangeTo=now&serviceGroup=',
+              condition: true,
+            },
+          ],
+        },
       ],
       [
         {
@@ -157,7 +187,7 @@ describe('Transaction action menu', () => {
         transaction,
         basePath,
         location,
-        urlParams,
+        apmRouter,
       })
     ).toEqual([
       [
@@ -193,6 +223,19 @@ describe('Transaction action menu', () => {
             },
           ],
         },
+        {
+          key: 'serviceMap',
+          title: 'Service map',
+          subtitle: 'View service map filtered by this trace.',
+          actions: [
+            {
+              key: 'serviceMap',
+              label: 'Show in service map',
+              href: 'some-basepath/app/apm/service-map?comparisonEnabled=false&environment=ENVIRONMENT_ALL&kuery=trace.id%20%3A%20%22123%22&rangeFrom=now-24h&rangeTo=now&serviceGroup=',
+              condition: true,
+            },
+          ],
+        },
       ],
       [
         {
diff --git a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/sections.ts b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/sections.ts
index 144658746175f..2ec8a186b3579 100644
--- a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/sections.ts
+++ b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/sections.ts
@@ -12,12 +12,13 @@ import { isEmpty, pickBy } from 'lodash';
 import moment from 'moment';
 import url from 'url';
 import type { Transaction } from '../../../../typings/es_schemas/ui/transaction';
-import type { ApmUrlParams } from '../../../context/url_params_context/types';
 import { getDiscoverHref } from '../links/discover_links/discover_link';
 import { getDiscoverQuery } from '../links/discover_links/discover_transaction_link';
 import { getInfraHref } from '../links/infra_link';
 import { fromQuery } from '../links/url_helpers';
 import { SectionRecord, getNonEmptySections, Action } from './sections_helper';
+import { TRACE_ID } from '../../../../common/es_fields/apm';
+import { ApmRouter } from '../../routing/apm_route_config';
 
 function getInfraMetricsQuery(transaction: Transaction) {
   const timestamp = new Date(transaction['@timestamp']).getTime();
@@ -33,12 +34,12 @@ export const getSections = ({
   transaction,
   basePath,
   location,
-  urlParams,
+  apmRouter,
 }: {
   transaction?: Transaction;
   basePath: IBasePath;
   location: Location;
-  urlParams: ApmUrlParams;
+  apmRouter: ApmRouter;
 }) => {
   if (!transaction) return [];
   const hostName = transaction.host?.hostname;
@@ -48,13 +49,19 @@ export const getSections = ({
   const time = Math.round(transaction.timestamp.us / 1000);
   const infraMetricsQuery = getInfraMetricsQuery(transaction);
 
+  const routeParams = apmRouter.getParams(
+    '/services/{serviceName}/transactions/view',
+    location
+  );
+  const { rangeFrom, rangeTo, environment } = routeParams.query;
+
   const uptimeLink = url.format({
     pathname: basePath.prepend('/app/uptime'),
     search: `?${fromQuery(
       pickBy(
         {
-          dateRangeStart: urlParams.rangeFrom,
-          dateRangeEnd: urlParams.rangeTo,
+          dateRangeStart: rangeFrom,
+          dateRangeEnd: rangeTo,
           search: `url.domain:"${transaction.url?.domain}"`,
         },
         (val) => !isEmpty(val)
@@ -204,6 +211,28 @@ export const getSections = ({
     },
   ];
 
+  const serviceMapHref = apmRouter.link('/service-map', {
+    query: {
+      rangeFrom,
+      rangeTo,
+      environment,
+      kuery: `${TRACE_ID} : "${transaction.trace.id}"`,
+      serviceGroup: '',
+      comparisonEnabled: false,
+    },
+  });
+  const serviceMapActions: Action[] = [
+    {
+      key: 'serviceMap',
+      label: i18n.translate(
+        'xpack.apm.transactionActionMenu.showInServiceMapLinkLabel',
+        { defaultMessage: 'Show in service map' }
+      ),
+      href: serviceMapHref,
+      condition: true,
+    },
+  ];
+
   const sectionRecord: SectionRecord = {
     observability: [
       {
@@ -277,6 +306,22 @@ export const getSections = ({
         ),
         actions: uptimeActions,
       },
+      {
+        key: 'serviceMap',
+        title: i18n.translate(
+          'xpack.apm.transactionActionMenu.serviceMap.title',
+          {
+            defaultMessage: 'Service map',
+          }
+        ),
+        subtitle: i18n.translate(
+          'xpack.apm.transactionActionMenu.serviceMap.subtitle',
+          {
+            defaultMessage: 'View service map filtered by this trace.',
+          }
+        ),
+        actions: serviceMapActions,
+      },
     ],
     kibana: [{ key: 'kibana', actions: kibanaActions }],
   };
diff --git a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/transaction_action_menu.test.tsx b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/transaction_action_menu.test.tsx
index 25e1277ebe0c3..3cd3972eeae94 100644
--- a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/transaction_action_menu.test.tsx
+++ b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/transaction_action_menu.test.tsx
@@ -8,6 +8,8 @@
 import { act, fireEvent, render } from '@testing-library/react';
 import React from 'react';
 import { MemoryRouter } from 'react-router-dom';
+import { createMemoryHistory } from 'history';
+import { RouterProvider } from '@kbn/typed-react-router-config';
 import { License } from '@kbn/licensing-plugin/common/license';
 import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
 import { ApmPluginContextValue } from '../../../context/apm_plugin/apm_plugin_context';
@@ -24,6 +26,7 @@ import {
 } from '../../../utils/test_helpers';
 import { TransactionActionMenu } from './transaction_action_menu';
 import * as Transactions from './__fixtures__/mock_data';
+import { apmRouter } from '../../routing/apm_route_config';
 
 function getMockAPMContext({ canSave }: { canSave: boolean }) {
   return {
@@ -35,11 +38,18 @@ function getMockAPMContext({ canSave }: { canSave: boolean }) {
   } as unknown as ApmPluginContextValue;
 }
 
+const history = createMemoryHistory();
+history.replace(
+  '/services/testbeans-go/transactions/view?rangeFrom=now-24h&rangeTo=now&transactionName=GET+%2Ftestbeans-go%2Fapi'
+);
+
 function Wrapper({ children }: { children?: React.ReactNode }) {
   return (
     <MemoryRouter>
       <MockApmPluginContextWrapper value={getMockAPMContext({ canSave: true })}>
-        {children}
+        <RouterProvider history={history} router={apmRouter as any}>
+          {children}
+        </RouterProvider>
       </MockApmPluginContextWrapper>
     </MemoryRouter>
   );
@@ -249,7 +259,7 @@ describe('TransactionActionMenu component', () => {
       expect(
         (getByText('Status').parentElement as HTMLAnchorElement).href
       ).toEqual(
-        'http://localhost/basepath/app/uptime?search=url.domain:%22example.com%22'
+        'http://localhost/basepath/app/uptime?dateRangeStart=now-24h&dateRangeEnd=now&search=url.domain:%22example.com%22'
       );
     });
   });
diff --git a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/transaction_action_menu.tsx b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/transaction_action_menu.tsx
index 8b010e79fb7b9..0848c5f902c27 100644
--- a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/transaction_action_menu.tsx
+++ b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/transaction_action_menu.tsx
@@ -21,7 +21,7 @@ import {
 import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
 import { useApmPluginContext } from '../../../context/apm_plugin/use_apm_plugin_context';
 import { useLicenseContext } from '../../../context/license/use_license_context';
-import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useApmRouter } from '../../../hooks/use_apm_router';
 import { CustomLinkMenuSection } from './custom_link_menu_section';
 import { getSections } from './sections';
 
@@ -85,13 +85,13 @@ export function TransactionActionMenu({ transaction, isLoading }: Props) {
 function ActionMenuSections({ transaction }: { transaction?: Transaction }) {
   const { core } = useApmPluginContext();
   const location = useLocation();
-  const { urlParams } = useLegacyUrlParams();
+  const apmRouter = useApmRouter();
 
   const sections = getSections({
     transaction,
     basePath: core.http.basePath,
     location,
-    urlParams,
+    apmRouter,
   });
 
   return (
diff --git a/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts b/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
index 0c10603d29062..e4de7dfc9bf74 100644
--- a/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
@@ -30,7 +30,7 @@ export async function getHasTransactionsEvents({
   start?: number;
   end?: number;
   apmEventClient: APMEventClient;
-  kuery: string;
+  kuery?: string;
 }) {
   const response = await apmEventClient.search(
     'get_has_aggregated_transactions',
@@ -69,7 +69,7 @@ export async function getSearchTransactionsEvents({
   start?: number;
   end?: number;
   apmEventClient: APMEventClient;
-  kuery: string;
+  kuery?: string;
 }): Promise<boolean> {
   switch (config.searchAggregatedTransactions) {
     case SearchAggregatedTransactionSetting.always:
diff --git a/x-pack/plugins/apm/server/routes/service_map/get_service_map.ts b/x-pack/plugins/apm/server/routes/service_map/get_service_map.ts
index fb1d0eed0a151..d3314b609f148 100644
--- a/x-pack/plugins/apm/server/routes/service_map/get_service_map.ts
+++ b/x-pack/plugins/apm/server/routes/service_map/get_service_map.ts
@@ -32,6 +32,7 @@ export interface IEnvOptions {
   start: number;
   end: number;
   serviceGroupKuery?: string;
+  kuery?: string;
 }
 
 async function getConnectionData({
@@ -42,6 +43,7 @@ async function getConnectionData({
   start,
   end,
   serviceGroupKuery,
+  kuery,
 }: IEnvOptions) {
   return withApmSpan('get_service_map_connections', async () => {
     const { traceIds } = await getTraceSampleIds({
@@ -52,6 +54,7 @@ async function getConnectionData({
       start,
       end,
       serviceGroupKuery,
+      kuery,
     });
 
     const chunks = chunk(traceIds, config.serviceMapMaxTracesPerRequest);
@@ -114,7 +117,6 @@ export function getServiceMap(
       getServiceStats(options),
       anomaliesPromise,
     ]);
-
     return transformServiceMapResponses({
       ...connectionData,
       services: servicesData,
diff --git a/x-pack/plugins/apm/server/routes/service_map/get_service_stats.ts b/x-pack/plugins/apm/server/routes/service_map/get_service_stats.ts
index 1f43a35d3b1ef..95c62a323205a 100644
--- a/x-pack/plugins/apm/server/routes/service_map/get_service_stats.ts
+++ b/x-pack/plugins/apm/server/routes/service_map/get_service_stats.ts
@@ -30,6 +30,7 @@ export async function getServiceStats({
   maxNumberOfServices,
   serviceGroupKuery,
   serviceName,
+  kuery,
 }: IEnvOptions & { maxNumberOfServices: number }) {
   const params = {
     apm: {
@@ -49,6 +50,7 @@ export async function getServiceStats({
             ...environmentQuery(environment),
             ...termsQuery(SERVICE_NAME, serviceName),
             ...kqlQuery(serviceGroupKuery),
+            ...kqlQuery(kuery),
           ],
         },
       },
diff --git a/x-pack/plugins/apm/server/routes/service_map/get_trace_sample_ids.ts b/x-pack/plugins/apm/server/routes/service_map/get_trace_sample_ids.ts
index 42935dbdcda88..56b29c0b3169a 100644
--- a/x-pack/plugins/apm/server/routes/service_map/get_trace_sample_ids.ts
+++ b/x-pack/plugins/apm/server/routes/service_map/get_trace_sample_ids.ts
@@ -36,6 +36,7 @@ export async function getTraceSampleIds({
   start,
   end,
   serviceGroupKuery,
+  kuery,
 }: {
   serviceName?: string;
   environment: string;
@@ -44,6 +45,7 @@ export async function getTraceSampleIds({
   start: number;
   end: number;
   serviceGroupKuery?: string;
+  kuery?: string;
 }) {
   const query = {
     bool: {
@@ -51,27 +53,29 @@ export async function getTraceSampleIds({
         ...rangeQuery(start, end),
         ...environmentQuery(environment),
         ...kqlQuery(serviceGroupKuery),
+        ...kqlQuery(kuery),
         ...termQuery(SERVICE_NAME, serviceName),
       ],
     },
   };
 
-  const isGlobalServiceMap = !serviceName && !serviceGroupKuery;
+  const isUnfilteredGlobalServiceMap =
+    !serviceName && !serviceGroupKuery && !kuery;
   let events = [ProcessorEvent.span, ProcessorEvent.transaction];
 
   // perf optimization that is only possible on the global service map with no filters
-  if (isGlobalServiceMap) {
+  if (isUnfilteredGlobalServiceMap) {
     events = [ProcessorEvent.span];
     query.bool.filter.push({
       exists: { field: SPAN_DESTINATION_SERVICE_RESOURCE },
     });
   }
 
-  const fingerprintBucketSize = isGlobalServiceMap
+  const fingerprintBucketSize = isUnfilteredGlobalServiceMap
     ? config.serviceMapFingerprintGlobalBucketSize
     : config.serviceMapFingerprintBucketSize;
 
-  const traceIdBucketSize = isGlobalServiceMap
+  const traceIdBucketSize = isUnfilteredGlobalServiceMap
     ? config.serviceMapTraceIdGlobalBucketSize
     : config.serviceMapTraceIdBucketSize;
 
diff --git a/x-pack/plugins/apm/server/routes/service_map/route.ts b/x-pack/plugins/apm/server/routes/service_map/route.ts
index 69f4422ad337a..c65dca01c4385 100644
--- a/x-pack/plugins/apm/server/routes/service_map/route.ts
+++ b/x-pack/plugins/apm/server/routes/service_map/route.ts
@@ -17,7 +17,7 @@ import { getServiceMap } from './get_service_map';
 import { getServiceMapDependencyNodeInfo } from './get_service_map_dependency_node_info';
 import { getServiceMapServiceNodeInfo } from './get_service_map_service_node_info';
 import { createApmServerRoute } from '../apm_routes/create_apm_server_route';
-import { environmentRt, rangeRt } from '../default_api_types';
+import { environmentRt, rangeRt, kueryRt } from '../default_api_types';
 import { getServiceGroup } from '../service_groups/get_service_group';
 import { offsetRt } from '../../../common/comparison_rt';
 import { getApmEventClient } from '../../lib/helpers/get_apm_event_client';
@@ -29,6 +29,7 @@ const serviceMapRoute = createApmServerRoute({
       t.partial({
         serviceName: t.string,
         serviceGroup: t.string,
+        kuery: kueryRt.props.kuery,
       }),
       environmentRt,
       rangeRt,
@@ -108,6 +109,7 @@ const serviceMapRoute = createApmServerRoute({
         environment,
         start,
         end,
+        kuery,
       },
     } = params;
 
@@ -133,7 +135,7 @@ const serviceMapRoute = createApmServerRoute({
       config,
       start,
       end,
-      kuery: '',
+      kuery,
     });
     return getServiceMap({
       mlClient,
@@ -147,6 +149,7 @@ const serviceMapRoute = createApmServerRoute({
       end,
       maxNumberOfServices,
       serviceGroupKuery: serviceGroup?.kuery,
+      kuery,
     });
   },
 });
@@ -190,7 +193,6 @@ const serviceMapServiceNodeRoute = createApmServerRoute({
       config,
       start,
       end,
-      kuery: '',
     });
 
     const commonProps = {
diff --git a/x-pack/test/apm_api_integration/tests/service_maps/service_maps_kuery_filter.spec.ts b/x-pack/test/apm_api_integration/tests/service_maps/service_maps_kuery_filter.spec.ts
new file mode 100644
index 0000000000000..e2dcafc0af815
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/service_maps/service_maps_kuery_filter.spec.ts
@@ -0,0 +1,136 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import expect from '@kbn/expect';
+import { apm, timerange } from '@kbn/apm-synthtrace-client';
+import {
+  APIClientRequestParamsOf,
+  APIReturnType,
+} from '@kbn/apm-plugin/public/services/rest/create_call_apm_api';
+import { RecursivePartial } from '@kbn/apm-plugin/typings/common';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+import { generateTrace } from '../traces/generate_trace';
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const registry = getService('registry');
+  const apmApiClient = getService('apmApiClient');
+  const synthtraceEsClient = getService('synthtraceEsClient');
+
+  const start = new Date('2023-01-01T00:00:00.000Z').getTime();
+  const end = new Date('2023-01-01T00:15:00.000Z').getTime() - 1;
+
+  async function callApi(
+    overrides?: RecursivePartial<
+      APIClientRequestParamsOf<'GET /internal/apm/service-map'>['params']
+    >
+  ) {
+    return await apmApiClient.readUser({
+      endpoint: 'GET /internal/apm/service-map',
+      params: {
+        query: {
+          start: new Date(start).toISOString(),
+          end: new Date(end).toISOString(),
+          environment: 'ENVIRONMENT_ALL',
+          kuery: '',
+          ...overrides?.query,
+        },
+      },
+    });
+  }
+
+  registry.when('Service map', { config: 'trial', archives: [] }, () => {
+    describe('optional kuery param', () => {
+      before(async () => {
+        const go = apm
+          .service({ name: 'synthbeans-go', environment: 'test', agentName: 'go' })
+          .instance('synthbeans-go');
+        const java = apm
+          .service({ name: 'synthbeans-java', environment: 'test', agentName: 'java' })
+          .instance('synthbeans-java');
+        const node = apm
+          .service({ name: 'synthbeans-node', environment: 'test', agentName: 'nodejs' })
+          .instance('synthbeans-node');
+
+        const events = timerange(start, end)
+          .interval('15m')
+          .rate(1)
+          .generator((timestamp) => {
+            return [
+              generateTrace(timestamp, [go, java]),
+              generateTrace(timestamp, [java, go], 'redis'),
+              generateTrace(timestamp, [node], 'redis'),
+              generateTrace(timestamp, [node, java, go], 'elasticsearch').defaults({
+                'labels.name': 'node-java-go-es',
+              }),
+              generateTrace(timestamp, [go, node, java]),
+            ];
+          });
+        await synthtraceEsClient.index(events);
+      });
+
+      after(() => synthtraceEsClient.clean());
+
+      it('returns full service map when no kuery is defined', async () => {
+        const { status, body } = await callApi();
+
+        expect(status).to.be(200);
+
+        const { nodes, edges } = partitionElements(body.elements);
+
+        expect(getIds(nodes)).to.eql([
+          '>elasticsearch',
+          '>redis',
+          'synthbeans-go',
+          'synthbeans-java',
+          'synthbeans-node',
+        ]);
+        expect(getIds(edges)).to.eql([
+          'synthbeans-go~>elasticsearch',
+          'synthbeans-go~>redis',
+          'synthbeans-go~synthbeans-java',
+          'synthbeans-go~synthbeans-node',
+          'synthbeans-java~synthbeans-go',
+          'synthbeans-node~>redis',
+          'synthbeans-node~synthbeans-java',
+        ]);
+      });
+
+      it('returns only service nodes and connections filtered by given kuery', async () => {
+        const { status, body } = await callApi({
+          query: { kuery: `labels.name: "node-java-go-es"` },
+        });
+
+        expect(status).to.be(200);
+
+        const { nodes, edges } = partitionElements(body.elements);
+
+        expect(getIds(nodes)).to.eql([
+          '>elasticsearch',
+          'synthbeans-go',
+          'synthbeans-java',
+          'synthbeans-node',
+        ]);
+        expect(getIds(edges)).to.eql([
+          'synthbeans-go~>elasticsearch',
+          'synthbeans-java~synthbeans-go',
+          'synthbeans-node~synthbeans-java',
+        ]);
+      });
+    });
+  });
+}
+
+type ConnectionElements = APIReturnType<'GET /internal/apm/service-map'>['elements'];
+
+function partitionElements(elements: ConnectionElements) {
+  const edges = elements.filter(({ data }) => 'source' in data && 'target' in data);
+  const nodes = elements.filter((element) => !edges.includes(element));
+  return { edges, nodes };
+}
+
+function getIds(elements: ConnectionElements) {
+  return elements.map(({ data }) => data.id).sort();
+}
diff --git a/x-pack/test/apm_api_integration/tests/traces/find_traces.spec.ts b/x-pack/test/apm_api_integration/tests/traces/find_traces.spec.ts
index 75572644c8417..9009a4872069d 100644
--- a/x-pack/test/apm_api_integration/tests/traces/find_traces.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/traces/find_traces.spec.ts
@@ -12,9 +12,7 @@ import { ENVIRONMENT_ALL } from '@kbn/apm-plugin/common/environment_filter_value
 import { sortBy } from 'lodash';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 import { ApmApiError } from '../../common/apm_api_supertest';
-
-type Instance = ReturnType<ReturnType<typeof apm.service>['instance']>;
-type Transaction = ReturnType<Instance['transaction']>;
+import { generateTrace } from './generate_trace';
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const registry = getService('registry');
@@ -104,45 +102,6 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         .service({ name: 'python', environment: 'production', agentName: 'python' })
         .instance('python');
 
-      function generateTrace(timestamp: number, order: Instance[], db?: 'elasticsearch' | 'redis') {
-        return order
-          .concat()
-          .reverse()
-          .reduce<Transaction | undefined>((prev, instance, index) => {
-            const invertedIndex = order.length - index - 1;
-
-            const duration = 50;
-            const time = timestamp + invertedIndex * 10;
-
-            const transaction: Transaction = instance
-              .transaction({ transactionName: `GET /${instance.fields['service.name']!}/api` })
-              .timestamp(time)
-              .duration(duration);
-
-            if (prev) {
-              const next = order[invertedIndex + 1].fields['service.name']!;
-              transaction.children(
-                instance
-                  .span({ spanName: `GET ${next}/api`, spanType: 'external', spanSubtype: 'http' })
-                  .destination(next)
-                  .duration(duration)
-                  .timestamp(time + 1)
-                  .children(prev)
-              );
-            } else if (db) {
-              transaction.children(
-                instance
-                  .span({ spanName: db, spanType: 'db', spanSubtype: db })
-                  .destination(db)
-                  .duration(duration)
-                  .timestamp(time + 1)
-              );
-            }
-
-            return transaction;
-          }, undefined)!;
-      }
-
       return synthtraceEsClient.index(
         timerange(start, end)
           .interval('15m')
diff --git a/x-pack/test/apm_api_integration/tests/traces/generate_trace.ts b/x-pack/test/apm_api_integration/tests/traces/generate_trace.ts
new file mode 100644
index 0000000000000..17fc908f32895
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/traces/generate_trace.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { apm } from '@kbn/apm-synthtrace-client';
+
+type Instance = ReturnType<ReturnType<typeof apm.service>['instance']>;
+type Transaction = ReturnType<Instance['transaction']>;
+
+export function generateTrace(
+  timestamp: number,
+  order: Instance[],
+  db?: 'elasticsearch' | 'redis'
+) {
+  return order
+    .concat()
+    .reverse()
+    .reduce<Transaction | undefined>((prev, instance, index) => {
+      const invertedIndex = order.length - index - 1;
+
+      const duration = 50;
+      const time = timestamp + invertedIndex * 10;
+
+      const transaction: Transaction = instance
+        .transaction({ transactionName: `GET /${instance.fields['service.name']!}/api` })
+        .timestamp(time)
+        .duration(duration);
+
+      if (prev) {
+        const next = order[invertedIndex + 1].fields['service.name']!;
+        transaction.children(
+          instance
+            .span({ spanName: `GET ${next}/api`, spanType: 'external', spanSubtype: 'http' })
+            .destination(next)
+            .duration(duration)
+            .timestamp(time + 1)
+            .children(prev)
+        );
+      } else if (db) {
+        transaction.children(
+          instance
+            .span({ spanName: db, spanType: 'db', spanSubtype: db })
+            .destination(db)
+            .duration(duration)
+            .timestamp(time + 1)
+        );
+      }
+
+      return transaction;
+    }, undefined)!;
+}

From 07b16a11930b60ad3c260b416fd4ae48d59bf6b6 Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Tue, 7 Feb 2023 08:56:36 +0200
Subject: [PATCH 032/134] [Vega] Stabilize the vega custom expressions tests
 (#150293)

## Summary
Closes https://github.com/elastic/kibana/issues/150208

The problem is that it adds the filter badge twice. I think that it
doesn't remove the previous one so a new is added. I think that waiting
the chart to be rendered after the clearing of the filters will
stabilize it.

Runner 100 times

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 test/functional/apps/visualize/group6/_vega_chart.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/functional/apps/visualize/group6/_vega_chart.ts b/test/functional/apps/visualize/group6/_vega_chart.ts
index 33e21dbcb46e2..d7e17a6a08e91 100644
--- a/test/functional/apps/visualize/group6/_vega_chart.ts
+++ b/test/functional/apps/visualize/group6/_vega_chart.ts
@@ -224,6 +224,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         if (filtersCount > 0) {
           await filterBar.removeAllFilters();
         }
+        await PageObjects.visChart.waitForVisualizationRenderingStabilized();
       });
 
       const fillSpecAndGo = async (newSpec: string) => {

From 9cfae63598dabfcce38a6bd360794bbff4cfef91 Mon Sep 17 00:00:00 2001
From: Maja Grubic <maja.grubic@elastic.co>
Date: Tue, 7 Feb 2023 08:39:52 +0100
Subject: [PATCH 033/134] [Custom Branding] Replace EuiLoadingElastic with
 EuiLoadingSpinner (#150064)

## Summary

When custom branding is set, we'd like to hide EuiLoadingElastic and
replace it with a plain EuiLoadingSpinner. This PR implements this in
places where needed.

Related: https://github.com/elastic/kibana/issues/149186


### Checklist

Delete any items that are not applicable to this PR.

~- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)~
~- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials~
~- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios~
~- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard
accessibility](https://webaim.org/techniques/keyboard/))~
~- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))~
~- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~
~- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))~
~- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)~


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../dashboard_container_renderer.tsx               | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/plugins/dashboard/public/dashboard_container/dashboard_container_renderer.tsx b/src/plugins/dashboard/public/dashboard_container/dashboard_container_renderer.tsx
index 574e93b80871e..c6391abcbd611 100644
--- a/src/plugins/dashboard/public/dashboard_container/dashboard_container_renderer.tsx
+++ b/src/plugins/dashboard/public/dashboard_container/dashboard_container_renderer.tsx
@@ -10,9 +10,10 @@ import './_dashboard_container.scss';
 
 import { v4 as uuidv4 } from 'uuid';
 import classNames from 'classnames';
-import { EuiLoadingElastic } from '@elastic/eui';
+import { EuiLoadingElastic, EuiLoadingSpinner } from '@elastic/eui';
 import React, { useEffect, useMemo, useRef, useState } from 'react';
 
+import useObservable from 'react-use/lib/useObservable';
 import { useReduxEmbeddableContext } from '@kbn/presentation-util-plugin/public';
 
 import {
@@ -41,12 +42,14 @@ export const DashboardContainerRenderer = ({
   const {
     embeddable,
     screenshotMode: { isScreenshotMode },
+    customBranding,
   } = pluginServices.getServices();
 
   const dashboardRoot = useRef(null);
   const [dashboardIdToBuild, setDashboardIdToBuild] = useState<string | undefined>(savedObjectId);
   const [dashboardContainer, setDashboardContainer] = useState<DashboardContainer>();
   const [loading, setLoading] = useState(true);
+  const showPlainSpinner = useObservable(customBranding.hasCustomBranding$, false);
 
   useEffect(() => {
     // check if dashboard container is expecting id change... if not, update dashboardIdToBuild to force it to rebuild the container.
@@ -107,10 +110,13 @@ export const DashboardContainerRenderer = ({
     { 'dashboardViewport--screenshotMode': isScreenshotMode() },
     { 'dashboardViewport--loading': loading }
   );
+  const loadingSpinner = showPlainSpinner ? (
+    <EuiLoadingSpinner size="xxl" />
+  ) : (
+    <EuiLoadingElastic size="xxl" />
+  );
   return (
-    <div className={viewportClasses}>
-      {loading ? <EuiLoadingElastic size="xxl" /> : <div ref={dashboardRoot} />}
-    </div>
+    <div className={viewportClasses}>{loading ? loadingSpinner : <div ref={dashboardRoot} />}</div>
   );
 };
 

From e56bcaeea5178076226ca00a7854b966beedd6e6 Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Tue, 7 Feb 2023 10:04:13 +0200
Subject: [PATCH 034/134] Fix Nested other bucket for empty string (#150321)

## Summary

Closes https://github.com/elastic/kibana/issues/123723

Fixes the bug mentioned in the issue. With this change now the Other for
the empty string bucket is displayed correctly.

<img width="1480" alt="image"
src="https://user-images.githubusercontent.com/17003240/216982740-de97e151-7221-47b0-bbb5-9a23d6548795.png">


### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../_terms_other_bucket_helper.test.ts        | 67 +++++++++++++++++++
 .../buckets/_terms_other_bucket_helper.ts     |  2 +-
 2 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
index be2e969f279b1..3dae2099de9e4 100644
--- a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
@@ -646,6 +646,73 @@ describe('Terms Agg Other bucket helper', () => {
           expect((topAgg['1'] as any).buckets[1]['2'].buckets[3].key).toEqual('__other__');
         }
       });
+
+      test('correctly merges other bucket with nested terms agg with empty string', () => {
+        const response = {
+          ...nestedTermResponse,
+          aggregations: {
+            ...nestedTermResponse.aggregations,
+            '1': {
+              ...nestedTermResponse.aggregations['1'],
+              buckets: [
+                ...nestedTermResponse.aggregations['1'].buckets,
+                {
+                  '2': {
+                    doc_count_error_upper_bound: 0,
+                    sum_other_doc_count: 8325,
+                    buckets: [
+                      { key: 'ios', doc_count: 1850 },
+                      { key: 'win xp', doc_count: 1830 },
+                      { key: '__missing__', doc_count: 130 },
+                    ],
+                  },
+                  key: '',
+                  doc_count: 2830,
+                },
+              ],
+            },
+          },
+        };
+
+        const otherResponse = {
+          took: 3,
+          timed_out: false,
+          _shards: { total: 1, successful: 1, skipped: 0, failed: 0 },
+          hits: { total: 14005, max_score: 0, hits: [] },
+          aggregations: {
+            'other-filter': {
+              buckets: {
+                [`${SEP}US-with-dash`]: { doc_count: 2805 },
+                [`${SEP}IN-with-dash`]: { doc_count: 2804 },
+                [`${SEP}`]: { doc_count: 2804 },
+              },
+            },
+          },
+          status: 200,
+        };
+        const aggConfigs = getAggConfigs(nestedTerm.aggs);
+        const otherAggConfig = buildOtherBucketAgg(
+          aggConfigs,
+          aggConfigs.aggs[1] as IBucketAggConfig,
+          enrichResponseWithSampling(response)
+        );
+
+        expect(otherAggConfig).toBeDefined();
+        if (otherAggConfig) {
+          const mergedResponse = mergeOtherBucketAggResponse(
+            aggConfigs,
+            enrichResponseWithSampling(response),
+            enrichResponseWithSampling(otherResponse),
+            aggConfigs.aggs[1] as IBucketAggConfig,
+            otherAggConfig(),
+            constructSingleTermOtherFilter
+          );
+
+          const topAgg = getTopAggregations(mergedResponse);
+          expect((topAgg['1'] as any).buckets[2].key).toEqual('');
+          expect((topAgg['1'] as any).buckets[2]['2'].buckets[3].key).toEqual('__other__');
+        }
+      });
     });
 
     describe(`updateMissingBucket${getTitlePostfix()}`, () => {
diff --git a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
index 68c64f67ef27f..8f82a2df86e5a 100644
--- a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
@@ -59,7 +59,7 @@ const getAggResultBuckets = (
   const keyParts = key.split(OTHER_BUCKET_SEPARATOR);
   let responseAgg = response;
   for (const i in keyParts) {
-    if (keyParts[i]) {
+    if (keyParts[i] || keyParts[i] === '') {
       const responseAggs: Array<Record<string, any>> = values(responseAgg);
       // If you have multi aggs, we cannot just assume the first one is the `other` bucket,
       // so we need to loop over each agg until we find it.

From 6a19f892122ebc6826947e7d7b49cdb30d947a30 Mon Sep 17 00:00:00 2001
From: Walter Rafelsberger <walter.rafelsberger@elastic.co>
Date: Tue, 7 Feb 2023 09:35:54 +0100
Subject: [PATCH 035/134] [ML] Transforms: Adds "Use full data" button to
 transform creation wizard. (#150030)

Adds the "Use full data" button including the option whether to include
the frozen data tier to the transform creation wizard.
---
 .../plugins/transform/common/types/storage.ts | 21 +++++++++++
 .../step_define/step_define_form.tsx          | 30 +++++++++++++++-
 .../index_pattern/creation_index_pattern.ts   | 35 +++++++++++++++++++
 .../services/transform/date_picker.ts         | 21 ++++++++++-
 4 files changed, 105 insertions(+), 2 deletions(-)
 create mode 100644 x-pack/plugins/transform/common/types/storage.ts

diff --git a/x-pack/plugins/transform/common/types/storage.ts b/x-pack/plugins/transform/common/types/storage.ts
new file mode 100644
index 0000000000000..d5aebdc7bb161
--- /dev/null
+++ b/x-pack/plugins/transform/common/types/storage.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { type FrozenTierPreference } from '@kbn/ml-date-picker';
+
+export const TRANSFORM_FROZEN_TIER_PREFERENCE = 'transform.frozenDataTierPreference';
+
+export type TransformStorage = Partial<{
+  [TRANSFORM_FROZEN_TIER_PREFERENCE]: FrozenTierPreference;
+}> | null;
+
+export type TransformStorageKey = keyof Exclude<TransformStorage, null>;
+
+export type TransformStorageMapped<T extends TransformStorageKey> =
+  T extends typeof TRANSFORM_FROZEN_TIER_PREFERENCE ? FrozenTierPreference | undefined : null;
+
+export const TRANSFORM_STORAGE_KEYS = [TRANSFORM_FROZEN_TIER_PREFERENCE] as const;
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_form.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_form.tsx
index c615e553b8984..e729b45342fb2 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_form.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_form.tsx
@@ -24,12 +24,24 @@ import {
 } from '@elastic/eui';
 
 import { i18n } from '@kbn/i18n';
-import { mlTimefilterRefresh$, useTimefilter, DatePickerWrapper } from '@kbn/ml-date-picker';
+import {
+  mlTimefilterRefresh$,
+  useTimefilter,
+  DatePickerWrapper,
+  FullTimeRangeSelector,
+  FROZEN_TIER_PREFERENCE,
+} from '@kbn/ml-date-picker';
+import { useStorage } from '@kbn/ml-local-storage';
 import { useUrlState } from '@kbn/ml-url-state';
 
 import { PivotAggDict } from '../../../../../../common/types/pivot_aggs';
 import { PivotGroupByDict } from '../../../../../../common/types/pivot_group_by';
 import { TRANSFORM_FUNCTION } from '../../../../../../common/constants';
+import {
+  TRANSFORM_FROZEN_TIER_PREFERENCE,
+  type TransformStorageKey,
+  type TransformStorageMapped,
+} from '../../../../../../common/types/storage';
 
 import {
   getIndexDevConsoleStatement,
@@ -89,6 +101,14 @@ export const StepDefineForm: FC<StepDefineFormProps> = React.memo((props) => {
   const {
     ml: { DataGrid },
   } = useAppDependencies();
+  const [frozenDataPreference, setFrozenDataPreference] = useStorage<
+    TransformStorageKey,
+    TransformStorageMapped<typeof TRANSFORM_FROZEN_TIER_PREFERENCE>
+  >(
+    TRANSFORM_FROZEN_TIER_PREFERENCE,
+    // By default we will exclude frozen data tier
+    FROZEN_TIER_PREFERENCE.EXCLUDE
+  );
   const toastNotifications = useToastNotifications();
   const stepDefineForm = useStepDefineForm(props);
 
@@ -311,6 +331,14 @@ export const StepDefineForm: FC<StepDefineFormProps> = React.memo((props) => {
                     </EuiFlexItem>
                   </EuiFlexGroup>
                 )}
+                <FullTimeRangeSelector
+                  frozenDataPreference={frozenDataPreference}
+                  setFrozenDataPreference={setFrozenDataPreference}
+                  dataView={dataView}
+                  query={undefined}
+                  disabled={false}
+                  timefilter={timefilter}
+                />
               </EuiFlexItem>
             </EuiFlexGroup>
           </EuiFormRow>
diff --git a/x-pack/test/functional/apps/transform/creation/index_pattern/creation_index_pattern.ts b/x-pack/test/functional/apps/transform/creation/index_pattern/creation_index_pattern.ts
index 1cb93ad03efe3..a383d471ceccd 100644
--- a/x-pack/test/functional/apps/transform/creation/index_pattern/creation_index_pattern.ts
+++ b/x-pack/test/functional/apps/transform/creation/index_pattern/creation_index_pattern.ts
@@ -96,6 +96,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         discoverAdjustSuperDatePicker: true,
         numFailureRetries: '7',
         expected: {
+          fullTimeRange: {
+            start: 'Jun 12, 2019 @ 00:04:19.000',
+            end: 'Jul 12, 2019 @ 23:45:36.000',
+          },
           pivotAdvancedEditorValueArr: ['{', '  "group_by": {', '    "category": {'],
           pivotAdvancedEditorValue: {
             group_by: {
@@ -294,6 +298,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         discoverAdjustSuperDatePicker: false,
         numFailureRetries: '-1',
         expected: {
+          fullTimeRange: {
+            start: 'Jun 12, 2019 @ 00:04:19.000',
+            end: 'Jul 12, 2019 @ 23:45:36.000',
+          },
           pivotAdvancedEditorValueArr: ['{', '  "group_by": {', '    "geoip.country_iso_code": {'],
           pivotAdvancedEditorValue: {
             group_by: {
@@ -368,6 +376,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         discoverAdjustSuperDatePicker: false,
         numFailureRetries: '0',
         expected: {
+          fullTimeRange: {
+            start: 'Jun 12, 2019 @ 00:04:19.000',
+            end: 'Jul 12, 2019 @ 23:45:36.000',
+          },
           pivotAdvancedEditorValueArr: ['{', '  "group_by": {', '    "customer_gender": {'],
           pivotAdvancedEditorValue: {
             group_by: {
@@ -428,6 +440,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         discoverAdjustSuperDatePicker: true,
         numFailureRetries: '101',
         expected: {
+          fullTimeRange: {
+            start: 'Jun 12, 2019 @ 00:04:19.000',
+            end: 'Jul 12, 2019 @ 23:45:36.000',
+          },
           latestPreview: {
             column: 0,
             values: [],
@@ -506,6 +522,25 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             testData.expected.indexPreview.rows
           );
 
+          await transform.testExecution.logTestStep(
+            `sets the date picker back to the default '15 minutes ago'`
+          );
+          await transform.datePicker.quickSelect(15, 'm');
+
+          await transform.testExecution.logTestStep('again displays an empty index preview');
+          await transform.wizard.assertIndexPreviewEmpty();
+
+          await transform.testExecution.logTestStep(
+            `clicks the 'Use full data' button to auto-select time range`
+          );
+          await transform.datePicker.clickUseFullDataButton(testData.expected.fullTimeRange);
+
+          await transform.testExecution.logTestStep('again shows the index preview');
+          await transform.wizard.assertIndexPreview(
+            testData.expected.indexPreview.columns,
+            testData.expected.indexPreview.rows
+          );
+
           await transform.testExecution.logTestStep('displays an empty transform preview');
           await transform.wizard.assertTransformPreviewEmpty();
 
diff --git a/x-pack/test/functional/services/transform/date_picker.ts b/x-pack/test/functional/services/transform/date_picker.ts
index 941a506db6109..9758e503ce329 100644
--- a/x-pack/test/functional/services/transform/date_picker.ts
+++ b/x-pack/test/functional/services/transform/date_picker.ts
@@ -11,8 +11,9 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 
 export function TransformDatePickerProvider({ getService, getPageObjects }: FtrProviderContext) {
   const find = getService('find');
-  const testSubjects = getService('testSubjects');
   const pageObjects = getPageObjects(['timePicker']);
+  const retry = getService('retry');
+  const testSubjects = getService('testSubjects');
 
   return {
     async assertSuperDatePickerToggleQuickMenuButtonExists() {
@@ -45,5 +46,23 @@ export function TransformDatePickerProvider({ getService, getPageObjects }: FtrP
     async setTimeRange(fromTime: string, toTime: string) {
       await pageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
     },
+
+    async clickUseFullDataButton(expectedTimeConfig: { start: string; end: string }) {
+      await testSubjects.existOrFail('mlDatePickerButtonUseFullData');
+      await testSubjects.clickWhenNotDisabledWithoutRetry('mlDatePickerButtonUseFullData');
+
+      await retry.try(async () => {
+        const start = await testSubjects.getVisibleText('superDatePickerstartDatePopoverButton');
+        const end = await testSubjects.getVisibleText('superDatePickerendDatePopoverButton');
+        const actualTimeConfig = { start, end };
+
+        expect(actualTimeConfig).to.eql(
+          expectedTimeConfig,
+          `Transform time config should be '${JSON.stringify(
+            expectedTimeConfig
+          )}' (got '${JSON.stringify(actualTimeConfig)}')`
+        );
+      });
+    },
   };
 }

From 5f74c6de1875d15c81eded8217dc9a45071c2603 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yulia=20=C4=8Cech?=
 <6585477+yuliacech@users.noreply.github.com>
Date: Tue, 7 Feb 2023 09:51:44 +0100
Subject: [PATCH 036/134] [Guided onboarding] Landing pages design follow ups
 (#150084)

## Summary
Fixes https://github.com/elastic/kibana/issues/149695
Follow up to https://github.com/elastic/kibana/pull/149528

This PR fixes minor design issues on the new landing page:
- Adds a `document` icon to cards that on click redirect the user to a
Kibana page (not the guide cards)
- Updates the color of the icon for completed guide card to match the
header button (as per @cindychangy's
[comment](https://github.com/elastic/kibana/pull/149528#issuecomment-1403995077))
- Adds linebreaks to prevent one word dangling on the new line (as per
@osmanis's
[comment](https://github.com/elastic/kibana/pull/149528#issuecomment-1408780148))
- Fixes the layout of the completed guide card and all cards on the page
for small screens. See screenshots below

### Screenshots
#### Before (large screens)
<img width="1333" alt="Screenshot 2023-02-01 at 17 58 11"
src="https://user-images.githubusercontent.com/6585477/216111021-32ee8162-5cf8-4948-8f1d-aa3790e6a7f9.png">

#### After (large screens)
<img width="1300" alt="Screenshot 2023-02-01 at 18 01 16"
src="https://user-images.githubusercontent.com/6585477/216111153-d22feadd-1796-4b20-9e97-f7e0b025c42d.png">

#### Before (small screens)
<img width="627" alt="Screenshot 2023-02-01 at 17 58 20"
src="https://user-images.githubusercontent.com/6585477/216111189-08d3cd2b-bd75-4d6b-9f52-8d74623cbe35.png">

#### After (small screens)
<img width="561" alt="Screenshot 2023-02-01 at 18 01 24"
src="https://user-images.githubusercontent.com/6585477/216111209-6dafed8a-d398-4090-a23f-af570b684d33.png">


### Checklist
- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../__snapshots__/guide_cards.test.tsx.snap   | 62 +++++++++++++--
 .../components/landing_page/guide_card.tsx    | 16 +++-
 ...constants.ts => guide_cards.constants.tsx} | 76 ++++++++++++++-----
 .../components/landing_page/guide_cards.tsx   |  2 +-
 4 files changed, 126 insertions(+), 30 deletions(-)
 rename packages/kbn-guided-onboarding/src/components/landing_page/{guide_cards.constants.ts => guide_cards.constants.tsx} (66%)

diff --git a/packages/kbn-guided-onboarding/src/components/landing_page/__snapshots__/guide_cards.test.tsx.snap b/packages/kbn-guided-onboarding/src/components/landing_page/__snapshots__/guide_cards.test.tsx.snap
index 55fa0c49d49a1..dd633872933f4 100644
--- a/packages/kbn-guided-onboarding/src/components/landing_page/__snapshots__/guide_cards.test.tsx.snap
+++ b/packages/kbn-guided-onboarding/src/components/landing_page/__snapshots__/guide_cards.test.tsx.snap
@@ -3,7 +3,7 @@
 exports[`guide cards snapshots should render all cards 1`] = `
 <EuiFlexGroup
   justifyContent="center"
-  responsive={true}
+  responsive={false}
   wrap={true}
 >
   <EuiFlexItem
@@ -19,7 +19,15 @@ exports[`guide cards snapshots should render all cards 1`] = `
           "order": 1,
           "solution": "search",
           "telemetryId": "onboarding--search--application",
-          "title": "Build an application on top of Elasticsearch",
+          "title": <FormattedMessage
+            defaultMessage="Build an application on {lineBreak} top of Elasticsearch"
+            id="guidedOnboardingPackage.gettingStarted.cards.appSearch.title"
+            values={
+              Object {
+                "lineBreak": <br />,
+              }
+            }
+          />,
         }
       }
       guidesState={Array []}
@@ -68,7 +76,15 @@ exports[`guide cards snapshots should render all cards 1`] = `
           "order": 3,
           "solution": "security",
           "telemetryId": "onboarding--security--siem",
-          "title": "Detect threats in my data with SIEM",
+          "title": <FormattedMessage
+            defaultMessage="Detect threats in my {lineBreak} data with SIEM"
+            id="guidedOnboardingPackage.gettingStarted.cards.siemSecurity.title"
+            values={
+              Object {
+                "lineBreak": <br />,
+              }
+            }
+          />,
         }
       }
       guidesState={Array []}
@@ -117,7 +133,15 @@ exports[`guide cards snapshots should render all cards 1`] = `
           "order": 5,
           "solution": "observability",
           "telemetryId": "onboarding--observability--apm",
-          "title": "Monitor my application performance (APM / tracing)",
+          "title": <FormattedMessage
+            defaultMessage="Monitor my application {lineBreak} performance (APM / tracing)"
+            id="guidedOnboardingPackage.gettingStarted.cards.apmObservability.title"
+            values={
+              Object {
+                "lineBreak": <br />,
+              }
+            }
+          />,
         }
       }
       guidesState={Array []}
@@ -143,7 +167,15 @@ exports[`guide cards snapshots should render all cards 1`] = `
           "order": 6,
           "solution": "security",
           "telemetryId": "onboarding--security--hosts",
-          "title": "Secure my hosts with endpoint security",
+          "title": <FormattedMessage
+            defaultMessage="Secure my hosts with {lineBreak} endpoint security"
+            id="guidedOnboardingPackage.gettingStarted.cards.hostsSecurity.title"
+            values={
+              Object {
+                "lineBreak": <br />,
+              }
+            }
+          />,
         }
       }
       guidesState={Array []}
@@ -166,7 +198,15 @@ exports[`guide cards snapshots should render all cards 1`] = `
           "order": 7,
           "solution": "search",
           "telemetryId": "onboarding--search--database",
-          "title": "Search across databases and business systems",
+          "title": <FormattedMessage
+            defaultMessage="Search across databases and {lineBreak} business systems"
+            id="guidedOnboardingPackage.gettingStarted.cards.databaseSearch.title"
+            values={
+              Object {
+                "lineBreak": <br />,
+              }
+            }
+          />,
         }
       }
       guidesState={Array []}
@@ -218,7 +258,15 @@ exports[`guide cards snapshots should render all cards 1`] = `
           "order": 9,
           "solution": "security",
           "telemetryId": "onboarding--security--cloud",
-          "title": "Secure my cloud assets with posture management",
+          "title": <FormattedMessage
+            defaultMessage="Secure my cloud assets with {lineBreak} posture management"
+            id="guidedOnboardingPackage.gettingStarted.cards.cloudSecurity.title"
+            values={
+              Object {
+                "lineBreak": <br />,
+              }
+            }
+          />,
         }
       }
       guidesState={Array []}
diff --git a/packages/kbn-guided-onboarding/src/components/landing_page/guide_card.tsx b/packages/kbn-guided-onboarding/src/components/landing_page/guide_card.tsx
index ca0891a0f2808..559af288c5575 100644
--- a/packages/kbn-guided-onboarding/src/components/landing_page/guide_card.tsx
+++ b/packages/kbn-guided-onboarding/src/components/landing_page/guide_card.tsx
@@ -9,7 +9,15 @@
 import React, { useCallback, useState } from 'react';
 import { css } from '@emotion/react';
 
-import { EuiCard, EuiFlexGroup, EuiFlexItem, EuiIcon, EuiSpacer, EuiTextColor } from '@elastic/eui';
+import {
+  EuiCard,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiSpacer,
+  EuiTextColor,
+  useEuiTheme,
+} from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 import { GuideState } from '../../types';
@@ -55,6 +63,7 @@ export const GuideCard = ({
   activeFilter,
 }: GuideCardsProps & { card: GuideCardConstants }) => {
   const [isLoading, setIsLoading] = useState<boolean>(false);
+  const { euiTheme } = useEuiTheme();
   let guideState: GuideState | undefined;
   if (card.guideId) {
     guideState = guidesState.find((state) => state.guideId === card.guideId);
@@ -102,9 +111,9 @@ export const GuideCard = ({
             </EuiTextColor>
           )}
           {isComplete && (
-            <EuiFlexGroup gutterSize="s" alignItems="center">
+            <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
               <EuiFlexItem grow={false}>
-                <EuiIcon type="checkInCircleFilled" color="success" />
+                <EuiIcon type="checkInCircleFilled" color={euiTheme.colors.success} />
               </EuiFlexItem>
               <EuiFlexItem grow={false}>
                 <small>
@@ -115,6 +124,7 @@ export const GuideCard = ({
               </EuiFlexItem>
             </EuiFlexGroup>
           )}
+          {card.navigateTo && <EuiIcon type="document" />}
         </>
       }
     />
diff --git a/packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.constants.ts b/packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.constants.tsx
similarity index 66%
rename from packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.constants.ts
rename to packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.constants.tsx
index a74f80114a216..5603072b3447b 100644
--- a/packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.constants.ts
+++ b/packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.constants.tsx
@@ -7,12 +7,14 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+import React, { ReactNode } from 'react';
 import { GuideId } from '../../..';
 import { GuideCardSolutions } from './guide_cards';
 
 export interface GuideCardConstants {
   solution: GuideCardSolutions;
-  title: string;
+  title: string | ReactNode;
   // if present, guideId indicates which guide is opened when clicking the card
   guideId?: GuideId;
   // if present, navigateTo indicates where the user will be redirected, when clicking the card
@@ -30,9 +32,15 @@ export interface GuideCardConstants {
 export const guideCards: GuideCardConstants[] = [
   {
     solution: 'search',
-    title: i18n.translate('guidedOnboardingPackage.gettingStarted.cards.appSearch.title', {
-      defaultMessage: 'Build an application on top of Elasticsearch',
-    }),
+    title: (
+      <FormattedMessage
+        id="guidedOnboardingPackage.gettingStarted.cards.appSearch.title"
+        defaultMessage="Build an application on {lineBreak} top of Elasticsearch"
+        values={{
+          lineBreak: <br />,
+        }}
+      />
+    ),
     guideId: 'appSearch',
     telemetryId: 'onboarding--search--application',
     order: 1,
@@ -48,9 +56,15 @@ export const guideCards: GuideCardConstants[] = [
   },
   {
     solution: 'search',
-    title: i18n.translate('guidedOnboardingPackage.gettingStarted.cards.databaseSearch.title', {
-      defaultMessage: 'Search across databases and business systems',
-    }),
+    title: (
+      <FormattedMessage
+        id="guidedOnboardingPackage.gettingStarted.cards.databaseSearch.title"
+        defaultMessage="Search across databases and {lineBreak} business systems"
+        values={{
+          lineBreak: <br />,
+        }}
+      />
+    ),
     guideId: 'databaseSearch',
     telemetryId: 'onboarding--search--database',
     order: 7,
@@ -69,9 +83,15 @@ export const guideCards: GuideCardConstants[] = [
   },
   {
     solution: 'observability',
-    title: i18n.translate('guidedOnboardingPackage.gettingStarted.cards.apmObservability.title', {
-      defaultMessage: 'Monitor my application performance (APM / tracing)',
-    }),
+    title: (
+      <FormattedMessage
+        id="guidedOnboardingPackage.gettingStarted.cards.apmObservability.title"
+        defaultMessage="Monitor my application {lineBreak} performance (APM / tracing)"
+        values={{
+          lineBreak: <br />,
+        }}
+      />
+    ),
     navigateTo: {
       appId: 'home',
       path: '#/tutorial/apm',
@@ -105,18 +125,30 @@ export const guideCards: GuideCardConstants[] = [
   },
   {
     solution: 'security',
-    title: i18n.translate('guidedOnboardingPackage.gettingStarted.cards.siemSecurity.title', {
-      defaultMessage: 'Detect threats in my data with SIEM',
-    }),
+    title: (
+      <FormattedMessage
+        id="guidedOnboardingPackage.gettingStarted.cards.siemSecurity.title"
+        defaultMessage="Detect threats in my {lineBreak} data with SIEM"
+        values={{
+          lineBreak: <br />,
+        }}
+      />
+    ),
     guideId: 'siem',
     telemetryId: 'onboarding--security--siem',
     order: 3,
   },
   {
     solution: 'security',
-    title: i18n.translate('guidedOnboardingPackage.gettingStarted.cards.hostsSecurity.title', {
-      defaultMessage: 'Secure my hosts with endpoint security',
-    }),
+    title: (
+      <FormattedMessage
+        id="guidedOnboardingPackage.gettingStarted.cards.hostsSecurity.title"
+        defaultMessage="Secure my hosts with {lineBreak} endpoint security"
+        values={{
+          lineBreak: <br />,
+        }}
+      />
+    ),
     navigateTo: {
       appId: 'integrations',
       path: '/detail/endpoint/overview',
@@ -126,9 +158,15 @@ export const guideCards: GuideCardConstants[] = [
   },
   {
     solution: 'security',
-    title: i18n.translate('guidedOnboardingPackage.gettingStarted.cards.cloudSecurity.title', {
-      defaultMessage: 'Secure my cloud assets with posture management',
-    }),
+    title: (
+      <FormattedMessage
+        id="guidedOnboardingPackage.gettingStarted.cards.cloudSecurity.title"
+        defaultMessage="Secure my cloud assets with {lineBreak} posture management"
+        values={{
+          lineBreak: <br />,
+        }}
+      />
+    ),
     navigateTo: {
       appId: 'integrations',
       path: '/detail/cloud_security_posture/overview',
diff --git a/packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.tsx b/packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.tsx
index 45d32d8089ef3..1f3269c596503 100644
--- a/packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.tsx
+++ b/packages/kbn-guided-onboarding/src/components/landing_page/guide_cards.tsx
@@ -27,7 +27,7 @@ export interface GuideCardsProps {
 }
 export const GuideCards = (props: GuideCardsProps) => {
   return (
-    <EuiFlexGroup wrap responsive justifyContent="center">
+    <EuiFlexGroup wrap justifyContent="center" responsive={false}>
       {guideCards.map((card, index) => (
         <EuiFlexItem key={index} grow={false}>
           <GuideCard card={card} {...props} />

From dd7ce286780ab9192547e80f6633ff727bedf181 Mon Sep 17 00:00:00 2001
From: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>
Date: Tue, 7 Feb 2023 10:10:28 +0100
Subject: [PATCH 037/134] [Fleet] return uploaded packages that are not in
 registry (#150332)

## Summary

Related to https://github.com/elastic/kibana/issues/148599
Fixes https://github.com/elastic/kibana/issues/81995

Changed `GET /epm/packages` API to list uploaded packages as well that
are not in registry.

Testing steps:
- Built a test package that is not in registry from kibana repo:
```
x-pack/test/fleet_api_integration/apis/fixtures/package_verification/packages/src/verified-1.0.0
elastic-package build --zip -v
```
- Uploaded the resulting zip
[verified-1.0.0.zip](https://github.com/elastic/kibana/files/10664094/verified-1.0.0.zip)
```
curl -XPOST -H 'content-type: application/zip' -H 'kbn-xsrf: true' http://localhost:5601/julia/api/fleet/epm/packages -u elastic:changeme --data-binary @verified-1.0.0.zip
```
- Navigate to `Integrations` page, verify that the `Verified` package is
displayed under `Browse` / `Installed` integrations, and the details are
visible when clicking on the package.

<img width="639" alt="image"
src="https://user-images.githubusercontent.com/90178898/217000305-90c28293-bdfa-42d5-b30b-50f7a63aad11.png">
<img width="757" alt="image"
src="https://user-images.githubusercontent.com/90178898/217000420-208d3b90-5341-4f1f-8ab8-554f78821bbf.png">
<img width="1147" alt="image"
src="https://user-images.githubusercontent.com/90178898/217000541-06324345-4204-43cc-8411-6c961ec37d17.png">


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../server/services/epm/packages/get.test.ts  | 61 ++++++++++++++++++-
 .../fleet/server/services/epm/packages/get.ts | 12 +++-
 2 files changed, 71 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/fleet/server/services/epm/packages/get.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/get.test.ts
index 19ced885822a4..52170f6c302fd 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/get.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/get.test.ts
@@ -24,7 +24,7 @@ import { PackageNotFoundError } from '../../../errors';
 
 import { getSettings } from '../../settings';
 
-import { getPackageInfo, getPackageUsageStats } from './get';
+import { getPackageInfo, getPackages, getPackageUsageStats } from './get';
 
 const MockRegistry = Registry as jest.Mocked<typeof Registry>;
 
@@ -186,6 +186,65 @@ describe('When using EPM `get` services', () => {
     });
   });
 
+  describe('getPackages', () => {
+    beforeEach(() => {
+      const mockContract = createAppContextStartContractMock();
+      appContextService.start(mockContract);
+      jest.clearAllMocks();
+      MockRegistry.fetchList.mockResolvedValue([
+        {
+          name: 'nginx',
+          version: '1.0.0',
+          title: 'Nginx',
+        } as any,
+      ]);
+    });
+
+    it('should return installed package that is not in registry', async () => {
+      const soClient = savedObjectsClientMock.create();
+      soClient.find.mockResolvedValue({
+        saved_objects: [
+          {
+            id: 'elasticsearch',
+            attributes: {
+              name: 'elasticsearch',
+              version: '0.0.1',
+              install_status: 'upload',
+            },
+          },
+        ],
+      } as any);
+
+      await expect(
+        getPackages({
+          savedObjectsClient: soClient,
+        })
+      ).resolves.toMatchObject([
+        {
+          name: 'elasticsearch',
+          version: '0.0.1',
+          title: 'Elasticsearch',
+          status: 'upload',
+          savedObject: {
+            id: 'elasticsearch',
+            attributes: {
+              name: 'elasticsearch',
+              version: '0.0.1',
+              install_status: 'upload',
+            },
+          },
+        },
+        {
+          name: 'nginx',
+          version: '1.0.0',
+          title: 'Nginx',
+          id: 'nginx',
+          status: 'not_installed',
+        },
+      ]);
+    });
+  });
+
   describe('getPackageInfo', () => {
     beforeEach(() => {
       const mockContract = createAppContextStartContractMock();
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/get.ts b/x-pack/plugins/fleet/server/services/epm/packages/get.ts
index 8776ca6014e55..1d048e2cf2d2c 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/get.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/get.ts
@@ -14,7 +14,11 @@ import {
   PACKAGE_POLICY_SAVED_OBJECT_TYPE,
 } from '../../../../common/constants';
 import { isPackageLimited } from '../../../../common/services';
-import type { PackageUsageStats, PackagePolicySOAttributes } from '../../../../common/types';
+import type {
+  PackageUsageStats,
+  PackagePolicySOAttributes,
+  Installable,
+} from '../../../../common/types';
 import { PACKAGES_SAVED_OBJECT_TYPE } from '../../../constants';
 import type {
   ArchivePackage,
@@ -68,6 +72,11 @@ export async function getPackages(
   });
   // get the installed packages
   const packageSavedObjects = await getPackageSavedObjects(savedObjectsClient);
+
+  const packagesNotInRegistry = packageSavedObjects.saved_objects
+    .filter((pkg) => !registryItems.some((item) => item.name === pkg.id))
+    .map((pkg) => createInstallableFrom({ ...pkg.attributes, title: nameAsTitle(pkg.id) }, pkg));
+
   const packageList = registryItems
     .map((item) =>
       createInstallableFrom(
@@ -75,6 +84,7 @@ export async function getPackages(
         packageSavedObjects.saved_objects.find(({ id }) => id === item.name)
       )
     )
+    .concat(packagesNotInRegistry as Installable<any>)
     .sort(sortByName);
 
   if (!excludeInstallStatus) {

From eafa5e7f0536715e26d71c3e104525ddd7551a14 Mon Sep 17 00:00:00 2001
From: Thomas Watson <watson@elastic.co>
Date: Tue, 7 Feb 2023 10:39:10 +0100
Subject: [PATCH 038/134] [@kbn/handlebars] Split index.ts into several files
 (#150230)

An attempt to make the code a little bit easier to parse
---
 packages/kbn-handlebars/index.ts              | 1017 +----------------
 .../kbn-handlebars/src/__jest__/test_bench.ts |   13 +-
 packages/kbn-handlebars/src/handlebars.ts     |   56 +
 packages/kbn-handlebars/src/symbols.ts        |    8 +
 packages/kbn-handlebars/src/types.ts          |  136 +++
 packages/kbn-handlebars/src/utils.ts          |   69 ++
 packages/kbn-handlebars/src/visitor.ts        |  791 +++++++++++++
 .../components/lib/replace_vars.ts            |    2 +-
 8 files changed, 1081 insertions(+), 1011 deletions(-)
 create mode 100644 packages/kbn-handlebars/src/handlebars.ts
 create mode 100644 packages/kbn-handlebars/src/symbols.ts
 create mode 100644 packages/kbn-handlebars/src/types.ts
 create mode 100644 packages/kbn-handlebars/src/utils.ts
 create mode 100644 packages/kbn-handlebars/src/visitor.ts

diff --git a/packages/kbn-handlebars/index.ts b/packages/kbn-handlebars/index.ts
index bd315841582ce..a00dbdbb37a64 100644
--- a/packages/kbn-handlebars/index.ts
+++ b/packages/kbn-handlebars/index.ts
@@ -3,150 +3,8 @@
  * See `packages/kbn-handlebars/LICENSE` for more information.
  */
 
-// The handlebars module uses `export =`, so we should technically use `import Handlebars = require('handlebars')`, but Babel will not allow this.
-import Handlebars from 'handlebars';
-import {
-  createProtoAccessControl,
-  resultIsAllowed,
-  // @ts-expect-error: Could not find a declaration file for module
-} from 'handlebars/dist/cjs/handlebars/internal/proto-access';
-// @ts-expect-error: Could not find a declaration file for module
-import AST from 'handlebars/dist/cjs/handlebars/compiler/ast';
-// @ts-expect-error: Could not find a declaration file for module
-import { indexOf, createFrame } from 'handlebars/dist/cjs/handlebars/utils';
-// @ts-expect-error: Could not find a declaration file for module
-import { moveHelperToHooks } from 'handlebars/dist/cjs/handlebars/helpers';
-
-const originalCreate = Handlebars.create;
-
-/**
- * A custom version of the Handlesbars module with an extra `compileAST` function and fixed typings.
- */
-declare module 'handlebars' {
-  export function compileAST(
-    input: string | hbs.AST.Program,
-    options?: ExtendedCompileOptions
-  ): (context?: any, options?: ExtendedRuntimeOptions) => string;
-
-  // --------------------------------------------------------
-  // Override/Extend inherited types below that are incorrect
-  // --------------------------------------------------------
-
-  export interface TemplateDelegate<T = any> {
-    (context?: T, options?: RuntimeOptions): string; // Override to ensure `context` is optional
-    blockParams?: number; // TODO: Can this really be optional?
-    partials?: any; // TODO: Narrow type to something better than any?
-  }
-
-  export interface HelperOptions {
-    name: string;
-    loc: { start: hbs.AST.SourceLocation['start']; end: hbs.AST.SourceLocation['end'] };
-    lookupProperty: LookupProperty;
-  }
-
-  export interface HelperDelegate {
-    // eslint-disable-next-line @typescript-eslint/prefer-function-type
-    (...params: any[]): any;
-  }
-
-  export function registerPartial(spec: { [name: string]: Handlebars.Template }): void; // Ensure `spec` object values can be strings
-}
-
-const kHelper = Symbol('helper');
-const kAmbiguous = Symbol('ambiguous');
-const kSimple = Symbol('simple');
-type NodeType = typeof kHelper | typeof kAmbiguous | typeof kSimple;
-
-type LookupProperty = <T = any>(parent: { [name: string]: any }, propertyName: string) => T;
-
-type ProcessableStatementNode =
-  | hbs.AST.MustacheStatement
-  | hbs.AST.PartialStatement
-  | hbs.AST.SubExpression;
-type ProcessableBlockStatementNode = hbs.AST.BlockStatement | hbs.AST.PartialBlockStatement;
-type ProcessableNode = ProcessableStatementNode | ProcessableBlockStatementNode;
-type ProcessableNodeWithPathParts = ProcessableNode & { path: hbs.AST.PathExpression };
-type ProcessableNodeWithPathPartsOrLiteral = ProcessableNode & {
-  path: hbs.AST.PathExpression | hbs.AST.Literal;
-};
-
-interface Helper {
-  fn?: Handlebars.HelperDelegate;
-  context: any[];
-  params: any[];
-  options: AmbiguousHelperOptions;
-}
-
-export type NonBlockHelperOptions = Omit<Handlebars.HelperOptions, 'fn' | 'inverse'>;
-export type AmbiguousHelperOptions = Handlebars.HelperOptions | NonBlockHelperOptions;
-
-export interface DecoratorOptions extends Omit<Handlebars.HelperOptions, 'lookupProperties'> {
-  args?: any[];
-}
-
-/**
- * If the `unsafe-eval` CSP is set, this string constant will be `compile`,
- * otherwise `compileAST`.
- *
- * This can be used to call the more optimized `compile` function in
- * environments that support it, or fall back to `compileAST` on environments
- * that don't.
- */
-export const compileFnName: 'compile' | 'compileAST' = allowUnsafeEval() ? 'compile' : 'compileAST';
-
-/**
- * Supported Handlebars compile options.
- *
- * This is a subset of all the compile options supported by the upstream
- * Handlebars module.
- */
-export type ExtendedCompileOptions = Pick<
-  CompileOptions,
-  | 'data'
-  | 'knownHelpers'
-  | 'knownHelpersOnly'
-  | 'noEscape'
-  | 'strict'
-  | 'assumeObjects'
-  | 'preventIndent'
-  | 'explicitPartialContext'
->;
-
-/**
- * Supported Handlebars runtime options
- *
- * This is a subset of all the runtime options supported by the upstream
- * Handlebars module.
- */
-export type ExtendedRuntimeOptions = Pick<
-  RuntimeOptions,
-  'data' | 'helpers' | 'partials' | 'decorators' | 'blockParams'
->;
-
-/**
- * According to the [decorator docs]{@link https://github.com/handlebars-lang/handlebars.js/blob/4.x/docs/decorators-api.md},
- * a decorator will be called with a different set of arugments than what's actually happening in the upstream code.
- * So here I assume that the docs are wrong and that the upstream code is correct. In reality, `context` is the last 4
- * documented arguments rolled into one object.
- */
-export type DecoratorFunction = (
-  prog: Handlebars.TemplateDelegate,
-  props: Record<string, any>,
-  container: Container,
-  options: any
-) => any;
-
-export interface HelpersHash {
-  [name: string]: Handlebars.HelperDelegate;
-}
-
-export interface PartialsHash {
-  [name: string]: HandlebarsTemplateDelegate;
-}
-
-export interface DecoratorsHash {
-  [name: string]: DecoratorFunction;
-}
+import { Handlebars } from './src/handlebars';
+import { allowUnsafeEval } from './src/utils';
 
 // The handlebars module uses `export =`, so it can't be re-exported using `export *`.
 // However, because of Babel, we're not allowed to use `export =` ourselves.
@@ -156,866 +14,17 @@ export interface DecoratorsHash {
 export default Handlebars;
 
 /**
- * Creates an isolated Handlebars environment.
- *
- * Each environment has its own helpers.
- * This is only necessary for use cases that demand distinct helpers.
- * Most use cases can use the root Handlebars environment directly.
- *
- * @returns A sandboxed/scoped version of the @kbn/handlebars module
- */
-export function create(): typeof Handlebars {
-  const SandboxedHandlebars = originalCreate.call(Handlebars) as typeof Handlebars;
-  // When creating new Handlebars environments, ensure the custom compileAST function is present in the new environment as well
-  SandboxedHandlebars.compileAST = Handlebars.compileAST;
-  return SandboxedHandlebars;
-}
-
-Handlebars.create = create;
-
-/**
- * Compiles the given Handlbars template without the use of `eval`.
+ * If the `unsafe-eval` CSP is set, this string constant will be `compile`,
+ * otherwise `compileAST`.
  *
- * @returns A render function with the same API as the return value from the regular Handlebars `compile` function.
+ * This can be used to call the more optimized `compile` function in
+ * environments that support it, or fall back to `compileAST` on environments
+ * that don't.
  */
-Handlebars.compileAST = function (
-  input: string | hbs.AST.Program,
-  options?: ExtendedCompileOptions
-) {
-  if (input == null || (typeof input !== 'string' && input.type !== 'Program')) {
-    throw new Handlebars.Exception(
-      `You must pass a string or Handlebars AST to Handlebars.compileAST. You passed ${input}`
-    );
-  }
-
-  // If `Handlebars.compileAST` is reassigned, `this` will be undefined.
-  const helpers = (this ?? Handlebars).helpers;
-  const partials = (this ?? Handlebars).partials;
-  const decorators = (this ?? Handlebars).decorators as DecoratorsHash;
-
-  const visitor = new ElasticHandlebarsVisitor(this, input, options, helpers, partials, decorators);
-  return (context: any, runtimeOptions?: ExtendedRuntimeOptions) =>
-    visitor.render(context, runtimeOptions);
-};
-
-interface Container {
-  helpers: HelpersHash;
-  partials: PartialsHash;
-  decorators: DecoratorsHash;
-  strict: (obj: { [name: string]: any }, name: string, loc: hbs.AST.SourceLocation) => any;
-  lookupProperty: LookupProperty;
-  lambda: (current: any, context: any) => any;
-  data: (value: any, depth: number) => any;
-  hooks: {
-    helperMissing?: Handlebars.HelperDelegate;
-    blockHelperMissing?: Handlebars.HelperDelegate;
-  };
-}
-
-class ElasticHandlebarsVisitor extends Handlebars.Visitor {
-  private env: typeof Handlebars;
-  private contexts: any[] = [];
-  private output: any[] = [];
-  private template?: string;
-  private compileOptions: ExtendedCompileOptions;
-  private runtimeOptions?: ExtendedRuntimeOptions;
-  private initialHelpers: HelpersHash;
-  private initialPartials: PartialsHash;
-  private initialDecorators: DecoratorsHash;
-  private blockParamNames: any[][] = [];
-  private blockParamValues: any[][] = [];
-  private ast?: hbs.AST.Program;
-  private container: Container;
-  private defaultHelperOptions: Pick<NonBlockHelperOptions, 'lookupProperty'>;
-  private processedRootDecorators = false; // Root decorators should not have access to input arguments. This flag helps us detect them.
-  private processedDecoratorsForProgram = new Set(); // It's important that a given program node only has its decorators run once, we use this Map to keep track of them
-
-  constructor(
-    env: typeof Handlebars,
-    input: string | hbs.AST.Program,
-    options: ExtendedCompileOptions = {},
-    helpers: HelpersHash,
-    partials: PartialsHash,
-    decorators: DecoratorsHash
-  ) {
-    super();
-
-    this.env = env;
-
-    if (typeof input !== 'string' && input.type === 'Program') {
-      this.ast = input;
-    } else {
-      this.template = input as string;
-    }
-
-    this.compileOptions = Object.assign(
-      {
-        data: true,
-      },
-      options
-    );
-
-    this.compileOptions.knownHelpers = Object.assign(
-      Object.create(null),
-      {
-        helperMissing: true,
-        blockHelperMissing: true,
-        each: true,
-        if: true,
-        unless: true,
-        with: true,
-        log: true,
-        lookup: true,
-      },
-      this.compileOptions.knownHelpers
-    );
-
-    this.initialHelpers = Object.assign({}, helpers);
-    this.initialPartials = Object.assign({}, partials);
-    this.initialDecorators = Object.assign({}, decorators);
-
-    const protoAccessControl = createProtoAccessControl({});
-
-    const container: Container = (this.container = {
-      helpers: {},
-      partials: {},
-      decorators: {},
-      strict(obj, name, loc) {
-        if (!obj || !(name in obj)) {
-          throw new Handlebars.Exception('"' + name + '" not defined in ' + obj, {
-            loc,
-          } as hbs.AST.Node);
-        }
-        return container.lookupProperty(obj, name);
-      },
-      // this function is lifted from the handlebars source and slightly modified (lib/handlebars/runtime.js)
-      lookupProperty(parent, propertyName) {
-        const result = parent[propertyName];
-        if (result == null) {
-          return result;
-        }
-        if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
-          return result;
-        }
-
-        if (resultIsAllowed(result, protoAccessControl, propertyName)) {
-          return result;
-        }
-        return undefined;
-      },
-      // this function is lifted from the handlebars source and slightly modified (lib/handlebars/runtime.js)
-      lambda(current, context) {
-        return typeof current === 'function' ? current.call(context) : current;
-      },
-      data(value: any, depth: number) {
-        while (value && depth--) {
-          value = value._parent;
-        }
-        return value;
-      },
-      hooks: {},
-    });
-
-    this.defaultHelperOptions = {
-      lookupProperty: container.lookupProperty,
-    };
-  }
-
-  render(context: any, options: ExtendedRuntimeOptions = {}): string {
-    this.contexts = [context];
-    this.output = [];
-    this.runtimeOptions = Object.assign({}, options);
-    this.container.helpers = Object.assign(this.initialHelpers, options.helpers);
-    this.container.partials = Object.assign(this.initialPartials, options.partials);
-    this.container.decorators = Object.assign(
-      this.initialDecorators,
-      options.decorators as DecoratorsHash
-    );
-    this.container.hooks = {};
-    this.processedRootDecorators = false;
-    this.processedDecoratorsForProgram.clear();
-
-    if (this.compileOptions.data) {
-      this.runtimeOptions.data = initData(context, this.runtimeOptions.data);
-    }
-
-    const keepHelperInHelpers = false;
-    moveHelperToHooks(this.container, 'helperMissing', keepHelperInHelpers);
-    moveHelperToHooks(this.container, 'blockHelperMissing', keepHelperInHelpers);
-
-    if (!this.ast) {
-      this.ast = Handlebars.parse(this.template!);
-    }
-
-    // The `defaultMain` function contains the default behavior:
-    //
-    // Generate a "program" function based on the root `Program` in the AST and
-    // call it. This will start the processing of all the child nodes in the
-    // AST.
-    const defaultMain: Handlebars.TemplateDelegate = (_context) => {
-      const prog = this.generateProgramFunction(this.ast!);
-      return prog(_context, this.runtimeOptions);
-    };
-
-    // Run any decorators that might exist on the root:
-    //
-    // The `defaultMain` function is passed in, and if there are no root
-    // decorators, or if the decorators chooses to do so, the same function is
-    // returned from `processDecorators` and the default behavior is retained.
-    //
-    // Alternatively any of the root decorators might call the `defaultMain`
-    // function themselves, process its return value, and return a completely
-    // different `main` function.
-    const main = this.processDecorators(this.ast, defaultMain);
-    this.processedRootDecorators = true;
-
-    // Call the `main` function and add the result to the final output.
-    const result = main(this.context, options);
-
-    if (main === defaultMain) {
-      this.output.push(result);
-      return this.output.join('');
-    } else {
-      // We normally expect the return value of `main` to be a string. However,
-      // if a decorator is used to override the `defaultMain` function, the
-      // return value can be any type. To match the upstream handlebars project
-      // behavior, we want the result of rendering the template to be the
-      // literal value returned by the decorator.
-      //
-      // Since the output array in this case always will be empty, we just
-      // return that single value instead of attempting to join all the array
-      // elements as strings.
-      return result;
-    }
-  }
-
-  // ********************************************** //
-  // ***    Visitor AST Traversal Functions     *** //
-  // ********************************************** //
-
-  Program(program: hbs.AST.Program) {
-    this.blockParamNames.unshift(program.blockParams);
-    super.Program(program);
-    this.blockParamNames.shift();
-  }
-
-  MustacheStatement(mustache: hbs.AST.MustacheStatement) {
-    this.processStatementOrExpression(mustache);
-  }
-
-  BlockStatement(block: hbs.AST.BlockStatement) {
-    this.processStatementOrExpression(block);
-  }
-
-  PartialStatement(partial: hbs.AST.PartialStatement) {
-    this.invokePartial(partial);
-  }
-
-  PartialBlockStatement(partial: hbs.AST.PartialBlockStatement) {
-    this.invokePartial(partial);
-  }
-
-  // This space is intentionally left blank: We want to override the Visitor
-  // class implementation of this method, but since we handle decorators
-  // separately before traversing the nodes, we just want to make this a no-op.
-  DecoratorBlock(decorator: hbs.AST.DecoratorBlock) {}
-
-  // This space is intentionally left blank: We want to override the Visitor
-  // class implementation of this method, but since we handle decorators
-  // separately before traversing the nodes, we just want to make this a no-op.
-  Decorator(decorator: hbs.AST.Decorator) {}
-
-  SubExpression(sexpr: hbs.AST.SubExpression) {
-    this.processStatementOrExpression(sexpr);
-  }
-
-  PathExpression(path: hbs.AST.PathExpression) {
-    const blockParamId =
-      !path.depth && !AST.helpers.scopedId(path) && this.blockParamIndex(path.parts[0]);
-
-    let result;
-    if (blockParamId) {
-      result = this.lookupBlockParam(blockParamId, path);
-    } else if (path.data) {
-      result = this.lookupData(this.runtimeOptions!.data, path);
-    } else {
-      result = this.resolvePath(this.contexts[path.depth], path);
-    }
-
-    this.output.push(result);
-  }
-
-  ContentStatement(content: hbs.AST.ContentStatement) {
-    this.output.push(content.value);
-  }
-
-  StringLiteral(string: hbs.AST.StringLiteral) {
-    this.output.push(string.value);
-  }
-
-  NumberLiteral(number: hbs.AST.NumberLiteral) {
-    this.output.push(number.value);
-  }
-
-  BooleanLiteral(bool: hbs.AST.BooleanLiteral) {
-    this.output.push(bool.value);
-  }
-
-  UndefinedLiteral() {
-    this.output.push(undefined);
-  }
-
-  NullLiteral() {
-    this.output.push(null);
-  }
-
-  // ********************************************** //
-  // ***      Visitor AST Helper Functions      *** //
-  // ********************************************** //
-
-  /**
-   * Special code for decorators, since they have to be executed ahead of time (before the wrapping program).
-   * So we have to look into the program AST body and see if it contains any decorators that we have to process
-   * before we can finish processing of the wrapping program.
-   */
-  private processDecorators(program: hbs.AST.Program, prog: Handlebars.TemplateDelegate) {
-    if (!this.processedDecoratorsForProgram.has(program)) {
-      this.processedDecoratorsForProgram.add(program);
-      const props = {};
-      for (const node of program.body) {
-        if (isDecorator(node)) {
-          prog = this.processDecorator(node, prog, props);
-        }
-      }
-    }
-
-    return prog;
-  }
-
-  private processDecorator(
-    decorator: hbs.AST.DecoratorBlock | hbs.AST.Decorator,
-    prog: Handlebars.TemplateDelegate,
-    props: Record<string, any>
-  ) {
-    const options = this.setupDecoratorOptions(decorator);
-
-    const result = this.container.lookupProperty<DecoratorFunction>(
-      this.container.decorators,
-      options.name
-    )(prog, props, this.container, options);
-
-    return Object.assign(result || prog, props);
-  }
-
-  private processStatementOrExpression(node: ProcessableNodeWithPathPartsOrLiteral) {
-    // Calling `transformLiteralToPath` has side-effects!
-    // It converts a node from type `ProcessableNodeWithPathPartsOrLiteral` to `ProcessableNodeWithPathParts`
-    transformLiteralToPath(node);
-
-    switch (this.classifyNode(node as ProcessableNodeWithPathParts)) {
-      case kSimple:
-        this.processSimpleNode(node as ProcessableNodeWithPathParts);
-        break;
-      case kHelper:
-        this.processHelperNode(node as ProcessableNodeWithPathParts);
-        break;
-      case kAmbiguous:
-        this.processAmbiguousNode(node as ProcessableNodeWithPathParts);
-        break;
-    }
-  }
-
-  // Liftet from lib/handlebars/compiler/compiler.js (original name: classifySexpr)
-  private classifyNode(node: { path: hbs.AST.PathExpression }): NodeType {
-    const isSimple = AST.helpers.simpleId(node.path);
-    const isBlockParam = isSimple && !!this.blockParamIndex(node.path.parts[0]);
-
-    // a mustache is an eligible helper if:
-    // * its id is simple (a single part, not `this` or `..`)
-    let isHelper = !isBlockParam && AST.helpers.helperExpression(node);
-
-    // if a mustache is an eligible helper but not a definite
-    // helper, it is ambiguous, and will be resolved in a later
-    // pass or at runtime.
-    let isEligible = !isBlockParam && (isHelper || isSimple);
-
-    // if ambiguous, we can possibly resolve the ambiguity now
-    // An eligible helper is one that does not have a complex path, i.e. `this.foo`, `../foo` etc.
-    if (isEligible && !isHelper) {
-      const name = node.path.parts[0];
-      const options = this.compileOptions;
-      if (options.knownHelpers && options.knownHelpers[name]) {
-        isHelper = true;
-      } else if (options.knownHelpersOnly) {
-        isEligible = false;
-      }
-    }
-
-    if (isHelper) {
-      return kHelper;
-    } else if (isEligible) {
-      return kAmbiguous;
-    } else {
-      return kSimple;
-    }
-  }
-
-  // Liftet from lib/handlebars/compiler/compiler.js
-  private blockParamIndex(name: string): [number, any] | undefined {
-    for (let depth = 0, len = this.blockParamNames.length; depth < len; depth++) {
-      const blockParams = this.blockParamNames[depth];
-      const param = blockParams && indexOf(blockParams, name);
-      if (blockParams && param >= 0) {
-        return [depth, param];
-      }
-    }
-  }
-
-  // Looks up the value of `parts` on the given block param and pushes
-  // it onto the stack.
-  private lookupBlockParam(blockParamId: [number, any], path: hbs.AST.PathExpression) {
-    const value = this.blockParamValues[blockParamId[0]][blockParamId[1]];
-    return this.resolvePath(value, path, 1);
-  }
-
-  // Push the data lookup operator
-  private lookupData(data: any, path: hbs.AST.PathExpression) {
-    if (path.depth) {
-      data = this.container.data(data, path.depth);
-    }
-
-    return this.resolvePath(data, path);
-  }
-
-  private processSimpleNode(node: ProcessableNodeWithPathParts) {
-    const path = node.path;
-    // @ts-expect-error strict is not a valid property on PathExpression, but we used in the same way it's also used in the original handlebars
-    path.strict = true;
-    const result = this.resolveNodes(path)[0];
-    const lambdaResult = this.container.lambda(result, this.context);
-
-    if (isBlock(node)) {
-      this.blockValue(node, lambdaResult);
-    } else {
-      this.output.push(lambdaResult);
-    }
-  }
-
-  // The purpose of this opcode is to take a block of the form
-  // `{{#this.foo}}...{{/this.foo}}`, resolve the value of `foo`, and
-  // replace it on the stack with the result of properly
-  // invoking blockHelperMissing.
-  private blockValue(node: hbs.AST.BlockStatement, value: any) {
-    const name = node.path.original;
-    const options = this.setupParams(node, name);
-
-    const result = this.container.hooks.blockHelperMissing!.call(this.context, value, options);
-
-    this.output.push(result);
-  }
-
-  private processHelperNode(node: ProcessableNodeWithPathParts) {
-    const path = node.path;
-    const name = path.parts[0];
-
-    if (this.compileOptions.knownHelpers && this.compileOptions.knownHelpers[name]) {
-      this.invokeKnownHelper(node);
-    } else if (this.compileOptions.knownHelpersOnly) {
-      throw new Handlebars.Exception(
-        'You specified knownHelpersOnly, but used the unknown helper ' + name,
-        node
-      );
-    } else {
-      this.invokeHelper(node);
-    }
-  }
-
-  // This operation is used when the helper is known to exist,
-  // so a `helperMissing` fallback is not required.
-  private invokeKnownHelper(node: ProcessableNodeWithPathParts) {
-    const name = node.path.parts[0];
-    const helper = this.setupHelper(node, name);
-    // TypeScript: `helper.fn` might be `undefined` at this point, but to match the upstream behavior we call it without any guards
-    const result = helper.fn!.call(helper.context, ...helper.params, helper.options);
-    this.output.push(result);
-  }
-
-  // Pops off the helper's parameters, invokes the helper,
-  // and pushes the helper's return value onto the stack.
-  //
-  // If the helper is not found, `helperMissing` is called.
-  private invokeHelper(node: ProcessableNodeWithPathParts) {
-    const path = node.path;
-    const name = path.original;
-    const isSimple = AST.helpers.simpleId(path);
-    const helper = this.setupHelper(node, name);
-
-    const loc = isSimple && helper.fn ? node.loc : path.loc;
-    helper.fn = (isSimple && helper.fn) || this.resolveNodes(path)[0];
-
-    if (!helper.fn) {
-      if (this.compileOptions.strict) {
-        helper.fn = this.container.strict(helper.context, name, loc);
-      } else {
-        helper.fn = this.container.hooks.helperMissing;
-      }
-    }
-
-    // TypeScript: `helper.fn` might be `undefined` at this point, but to match the upstream behavior we call it without any guards
-    const result = helper.fn!.call(helper.context, ...helper.params, helper.options);
-
-    this.output.push(result);
-  }
-
-  private invokePartial(partial: hbs.AST.PartialStatement | hbs.AST.PartialBlockStatement) {
-    const { params } = partial;
-    if (params.length > 1) {
-      throw new Handlebars.Exception(
-        `Unsupported number of partial arguments: ${params.length}`,
-        partial
-      );
-    }
-
-    const isDynamic = partial.name.type === 'SubExpression';
-    const name = isDynamic
-      ? this.resolveNodes(partial.name).join('')
-      : (partial.name as hbs.AST.PathExpression).original;
-
-    const options: AmbiguousHelperOptions & Handlebars.ResolvePartialOptions = this.setupParams(
-      partial,
-      name
-    );
-    options.helpers = this.container.helpers;
-    options.partials = this.container.partials;
-    options.decorators = this.container.decorators;
-
-    let partialBlock;
-    if ('fn' in options && options.fn !== noop) {
-      const { fn } = options;
-      const currentPartialBlock = options.data?.['partial-block'];
-      options.data = createFrame(options.data);
-
-      // Wrapper function to get access to currentPartialBlock from the closure
-      partialBlock = options.data['partial-block'] = function partialBlockWrapper(
-        context: any,
-        wrapperOptions: { data?: Handlebars.HelperOptions['data'] } = {}
-      ) {
-        // Restore the partial-block from the closure for the execution of the block
-        // i.e. the part inside the block of the partial call.
-        wrapperOptions.data = createFrame(wrapperOptions.data);
-        wrapperOptions.data['partial-block'] = currentPartialBlock;
-        return fn(context, wrapperOptions);
-      };
-
-      if (fn.partials) {
-        options.partials = Object.assign({}, options.partials, fn.partials);
-      }
-    }
-
-    let context = {};
-    if (params.length === 0 && !this.compileOptions.explicitPartialContext) {
-      context = this.context;
-    } else if (params.length === 1) {
-      context = this.resolveNodes(params[0])[0];
-    }
-
-    if (Object.keys(options.hash).length > 0) {
-      // TODO: context can be an array, but maybe never when we have a hash???
-      context = Object.assign({}, context, options.hash);
-    }
-
-    const partialTemplate: Handlebars.Template | undefined =
-      this.container.partials[name] ??
-      partialBlock ??
-      Handlebars.VM.resolvePartial(undefined, undefined, options);
-
-    if (partialTemplate === undefined) {
-      throw new Handlebars.Exception(`The partial ${name} could not be found`);
-    }
-
-    let render;
-    if (typeof partialTemplate === 'string') {
-      render = this.env.compileAST(partialTemplate, this.compileOptions);
-      if (name in this.container.partials) {
-        this.container.partials[name] = render;
-      }
-    } else {
-      render = partialTemplate;
-    }
-
-    let result = render(context, options);
-
-    if ('indent' in partial) {
-      result =
-        partial.indent +
-        (this.compileOptions.preventIndent
-          ? result
-          : result.replace(/\n(?!$)/g, `\n${(partial as hbs.AST.PartialStatement).indent}`)); // indent each line, ignoring any trailing linebreak
-    }
-
-    this.output.push(result);
-  }
-
-  private processAmbiguousNode(node: ProcessableNodeWithPathParts) {
-    const name = node.path.parts[0];
-    const helper = this.setupHelper(node, name);
-    let { fn: helperFn } = helper;
-
-    const loc = helperFn ? node.loc : node.path.loc;
-    helperFn = helperFn ?? this.resolveNodes(node.path)[0];
-
-    if (helperFn === undefined) {
-      if (this.compileOptions.strict) {
-        helperFn = this.container.strict(helper.context, name, loc);
-      } else {
-        helperFn =
-          helper.context != null
-            ? this.container.lookupProperty(helper.context, name)
-            : helper.context;
-        if (helperFn == null) helperFn = this.container.hooks.helperMissing;
-      }
-    }
-
-    const helperResult =
-      typeof helperFn === 'function'
-        ? helperFn.call(helper.context, ...helper.params, helper.options)
-        : helperFn;
-
-    if (isBlock(node)) {
-      const result = helper.fn
-        ? helperResult
-        : this.container.hooks.blockHelperMissing!.call(this.context, helperResult, helper.options);
-      if (result != null) {
-        this.output.push(result);
-      }
-    } else {
-      if (
-        (node as hbs.AST.MustacheStatement).escaped === false ||
-        this.compileOptions.noEscape === true ||
-        typeof helperResult !== 'string'
-      ) {
-        this.output.push(helperResult);
-      } else {
-        this.output.push(Handlebars.escapeExpression(helperResult));
-      }
-    }
-  }
-
-  private setupHelper(node: ProcessableNode, helperName: string): Helper {
-    return {
-      fn: this.container.lookupProperty(this.container.helpers, helperName),
-      context: this.context,
-      params: this.resolveNodes(node.params),
-      options: this.setupParams(node, helperName),
-    };
-  }
-
-  private setupDecoratorOptions(decorator: hbs.AST.Decorator | hbs.AST.DecoratorBlock) {
-    // TypeScript: The types indicate that `decorator.path` technically can be an `hbs.AST.Literal`. However, the upstream codebase always treats it as an `hbs.AST.PathExpression`, so we do too.
-    const name = (decorator.path as hbs.AST.PathExpression).original;
-    const options = toDecoratorOptions(this.setupParams(decorator, name));
-
-    if (decorator.params.length > 0) {
-      if (!this.processedRootDecorators) {
-        // When processing the root decorators, temporarily remove the root context so it's not accessible to the decorator
-        const context = this.contexts.shift();
-        options.args = this.resolveNodes(decorator.params);
-        this.contexts.unshift(context);
-      } else {
-        options.args = this.resolveNodes(decorator.params);
-      }
-    } else {
-      options.args = [];
-    }
-
-    return options;
-  }
-
-  private setupParams(node: ProcessableBlockStatementNode, name: string): Handlebars.HelperOptions;
-  private setupParams(node: ProcessableStatementNode, name: string): NonBlockHelperOptions;
-  private setupParams(node: ProcessableNode, name: string): AmbiguousHelperOptions;
-  private setupParams(node: ProcessableNode, name: string): AmbiguousHelperOptions {
-    const options = {
-      name,
-      hash: this.getHash(node),
-      data: this.runtimeOptions!.data,
-      loc: { start: node.loc.start, end: node.loc.end },
-      ...this.defaultHelperOptions,
-    };
-
-    if (isBlock(node)) {
-      (options as Handlebars.HelperOptions).fn = node.program
-        ? this.processDecorators(node.program, this.generateProgramFunction(node.program))
-        : noop;
-      (options as Handlebars.HelperOptions).inverse = node.inverse
-        ? this.processDecorators(node.inverse, this.generateProgramFunction(node.inverse))
-        : noop;
-    }
-
-    return options;
-  }
-
-  private generateProgramFunction(program: hbs.AST.Program) {
-    if (!program) return noop;
-
-    const prog: Handlebars.TemplateDelegate = (
-      nextContext: any,
-      runtimeOptions: ExtendedRuntimeOptions = {}
-    ) => {
-      runtimeOptions = Object.assign({}, runtimeOptions);
-
-      // inherit data in blockParams from parent program
-      runtimeOptions.data = runtimeOptions.data || this.runtimeOptions!.data;
-      if (runtimeOptions.blockParams) {
-        runtimeOptions.blockParams = runtimeOptions.blockParams.concat(
-          this.runtimeOptions!.blockParams
-        );
-      }
-
-      // inherit partials from parent program
-      runtimeOptions.partials = runtimeOptions.partials || this.runtimeOptions!.partials;
-
-      // stash parent program data
-      const tmpRuntimeOptions = this.runtimeOptions;
-      this.runtimeOptions = runtimeOptions;
-      const shiftContext = nextContext !== this.context;
-      if (shiftContext) this.contexts.unshift(nextContext);
-      this.blockParamValues.unshift(runtimeOptions.blockParams || []);
-
-      // execute child program
-      const result = this.resolveNodes(program).join('');
-
-      // unstash parent program data
-      this.blockParamValues.shift();
-      if (shiftContext) this.contexts.shift();
-      this.runtimeOptions = tmpRuntimeOptions;
-
-      // return result of child program
-      return result;
-    };
-
-    prog.blockParams = program.blockParams?.length ?? 0;
-    return prog;
-  }
-
-  private getHash(statement: { hash?: hbs.AST.Hash }) {
-    const result: { [key: string]: any } = {};
-    if (!statement.hash) return result;
-    for (const { key, value } of statement.hash.pairs) {
-      result[key] = this.resolveNodes(value)[0];
-    }
-    return result;
-  }
-
-  private resolvePath(obj: any, path: hbs.AST.PathExpression, index = 0) {
-    if (this.compileOptions.strict || this.compileOptions.assumeObjects) {
-      return this.strictLookup(obj, path);
-    }
-
-    for (; index < path.parts.length; index++) {
-      if (obj == null) return;
-      obj = this.container.lookupProperty(obj, path.parts[index]);
-    }
-
-    return obj;
-  }
-
-  private strictLookup(obj: any, path: hbs.AST.PathExpression) {
-    // @ts-expect-error strict is not a valid property on PathExpression, but we used in the same way it's also used in the original handlebars
-    const requireTerminal = this.compileOptions.strict && path.strict;
-    const len = path.parts.length - (requireTerminal ? 1 : 0);
-
-    for (let i = 0; i < len; i++) {
-      obj = this.container.lookupProperty(obj, path.parts[i]);
-    }
-
-    if (requireTerminal) {
-      return this.container.strict(obj, path.parts[len], path.loc);
-    } else {
-      return obj;
-    }
-  }
-
-  private resolveNodes(nodes: hbs.AST.Node | hbs.AST.Node[]): any[] {
-    const currentOutput = this.output;
-    this.output = [];
-
-    if (Array.isArray(nodes)) {
-      this.acceptArray(nodes);
-    } else {
-      this.accept(nodes);
-    }
-
-    const result = this.output;
-
-    this.output = currentOutput;
-
-    return result;
-  }
-
-  private get context() {
-    return this.contexts[0];
-  }
-}
-
-// ********************************************** //
-// ***            Utilily Functions           *** //
-// ********************************************** //
-
-function isBlock(node: hbs.AST.Node): node is hbs.AST.BlockStatement {
-  return 'program' in node || 'inverse' in node;
-}
-
-function isDecorator(node: hbs.AST.Node): node is hbs.AST.Decorator | hbs.AST.DecoratorBlock {
-  return node.type === 'Decorator' || node.type === 'DecoratorBlock';
-}
-
-function toDecoratorOptions(options: AmbiguousHelperOptions) {
-  // There's really no tests/documentation on this, but to match the upstream codebase we'll remove `lookupProperty` from the decorator context
-  delete (options as any).lookupProperty;
-
-  return options as DecoratorOptions;
-}
-
-function noop() {
-  return '';
-}
-
-// liftet from handlebars lib/handlebars/runtime.js
-function initData(context: any, data: any) {
-  if (!data || !('root' in data)) {
-    data = data ? createFrame(data) : {};
-    data.root = context;
-  }
-  return data;
-}
-
-// liftet from handlebars lib/handlebars/compiler/compiler.js
-function transformLiteralToPath(node: { path: hbs.AST.PathExpression | hbs.AST.Literal }) {
-  const pathIsLiteral = 'parts' in node.path === false;
-
-  if (pathIsLiteral) {
-    const literal = node.path;
-    // @ts-expect-error: Not all `hbs.AST.Literal` sub-types has an `original` property, but that's ok, in that case we just want `undefined`
-    const original = literal.original;
-    // Casting to string here to make false and 0 literal values play nicely with the rest
-    // of the system.
-    node.path = {
-      type: 'PathExpression',
-      data: false,
-      depth: 0,
-      parts: [original + ''],
-      original: original + '',
-      loc: literal.loc,
-    };
-  }
-}
+export const compileFnName: 'compile' | 'compileAST' = allowUnsafeEval() ? 'compile' : 'compileAST';
 
-function allowUnsafeEval() {
-  try {
-    new Function();
-    return true;
-  } catch (e) {
-    return false;
-  }
-}
+export type {
+  DecoratorFunction,
+  ExtendedCompileOptions,
+  ExtendedRuntimeOptions,
+} from './src/types';
diff --git a/packages/kbn-handlebars/src/__jest__/test_bench.ts b/packages/kbn-handlebars/src/__jest__/test_bench.ts
index c1407734f4fbe..9bccae90a86ae 100644
--- a/packages/kbn-handlebars/src/__jest__/test_bench.ts
+++ b/packages/kbn-handlebars/src/__jest__/test_bench.ts
@@ -3,12 +3,13 @@
  * See `packages/kbn-handlebars/LICENSE` for more information.
  */
 
-import Handlebars, {
-  type DecoratorFunction,
-  type DecoratorsHash,
-  type ExtendedCompileOptions,
-  type ExtendedRuntimeOptions,
-} from '../..';
+import Handlebars from '../..';
+import type {
+  DecoratorFunction,
+  DecoratorsHash,
+  ExtendedCompileOptions,
+  ExtendedRuntimeOptions,
+} from '../types';
 
 type CompileFns = 'compile' | 'compileAST';
 const compileFns: CompileFns[] = ['compile', 'compileAST'];
diff --git a/packages/kbn-handlebars/src/handlebars.ts b/packages/kbn-handlebars/src/handlebars.ts
new file mode 100644
index 0000000000000..d2cb1c258d679
--- /dev/null
+++ b/packages/kbn-handlebars/src/handlebars.ts
@@ -0,0 +1,56 @@
+/*
+ * Elasticsearch B.V licenses this file to you under the MIT License.
+ * See `packages/kbn-handlebars/LICENSE` for more information.
+ */
+
+// The handlebars module uses `export =`, so we should technically use `import Handlebars = require('handlebars')`, but Babel will not allow this:
+// https://www.typescriptlang.org/docs/handbook/modules.html#export--and-import--require
+import Handlebars from 'handlebars';
+
+import type { DecoratorsHash, ExtendedCompileOptions, ExtendedRuntimeOptions } from './types';
+import { ElasticHandlebarsVisitor } from './visitor';
+
+const originalCreate = Handlebars.create;
+
+export { Handlebars };
+
+/**
+ * Creates an isolated Handlebars environment.
+ *
+ * Each environment has its own helpers.
+ * This is only necessary for use cases that demand distinct helpers.
+ * Most use cases can use the root Handlebars environment directly.
+ *
+ * @returns A sandboxed/scoped version of the @kbn/handlebars module
+ */
+Handlebars.create = function (): typeof Handlebars {
+  const SandboxedHandlebars = originalCreate.call(Handlebars) as typeof Handlebars;
+  // When creating new Handlebars environments, ensure the custom compileAST function is present in the new environment as well
+  SandboxedHandlebars.compileAST = Handlebars.compileAST;
+  return SandboxedHandlebars;
+};
+
+/**
+ * Compiles the given Handlbars template without the use of `eval`.
+ *
+ * @returns A render function with the same API as the return value from the regular Handlebars `compile` function.
+ */
+Handlebars.compileAST = function (
+  input: string | hbs.AST.Program,
+  options?: ExtendedCompileOptions
+) {
+  if (input == null || (typeof input !== 'string' && input.type !== 'Program')) {
+    throw new Handlebars.Exception(
+      `You must pass a string or Handlebars AST to Handlebars.compileAST. You passed ${input}`
+    );
+  }
+
+  // If `Handlebars.compileAST` is reassigned, `this` will be undefined.
+  const helpers = (this ?? Handlebars).helpers;
+  const partials = (this ?? Handlebars).partials;
+  const decorators = (this ?? Handlebars).decorators as DecoratorsHash;
+
+  const visitor = new ElasticHandlebarsVisitor(this, input, options, helpers, partials, decorators);
+  return (context: any, runtimeOptions?: ExtendedRuntimeOptions) =>
+    visitor.render(context, runtimeOptions);
+};
diff --git a/packages/kbn-handlebars/src/symbols.ts b/packages/kbn-handlebars/src/symbols.ts
new file mode 100644
index 0000000000000..85a8f2f311ab0
--- /dev/null
+++ b/packages/kbn-handlebars/src/symbols.ts
@@ -0,0 +1,8 @@
+/*
+ * Elasticsearch B.V licenses this file to you under the MIT License.
+ * See `packages/kbn-handlebars/LICENSE` for more information.
+ */
+
+export const kHelper = Symbol('helper');
+export const kAmbiguous = Symbol('ambiguous');
+export const kSimple = Symbol('simple');
diff --git a/packages/kbn-handlebars/src/types.ts b/packages/kbn-handlebars/src/types.ts
new file mode 100644
index 0000000000000..fa11a0172e0dc
--- /dev/null
+++ b/packages/kbn-handlebars/src/types.ts
@@ -0,0 +1,136 @@
+/*
+ * Elasticsearch B.V licenses this file to you under the MIT License.
+ * See `packages/kbn-handlebars/LICENSE` for more information.
+ */
+
+import { kHelper, kAmbiguous, kSimple } from './symbols';
+
+/**
+ * A custom version of the Handlesbars module with an extra `compileAST` function and fixed typings.
+ */
+declare module 'handlebars' {
+  export function compileAST(
+    input: string | hbs.AST.Program,
+    options?: ExtendedCompileOptions
+  ): (context?: any, options?: ExtendedRuntimeOptions) => string;
+
+  // --------------------------------------------------------
+  // Override/Extend inherited types below that are incorrect
+  // --------------------------------------------------------
+
+  export interface TemplateDelegate<T = any> {
+    (context?: T, options?: RuntimeOptions): string; // Override to ensure `context` is optional
+    blockParams?: number; // TODO: Can this really be optional?
+    partials?: any; // TODO: Narrow type to something better than any?
+  }
+
+  export interface HelperOptions {
+    name: string;
+    loc: { start: hbs.AST.SourceLocation['start']; end: hbs.AST.SourceLocation['end'] };
+    lookupProperty: LookupProperty;
+  }
+
+  export interface HelperDelegate {
+    // eslint-disable-next-line @typescript-eslint/prefer-function-type
+    (...params: any[]): any;
+  }
+
+  export function registerPartial(spec: { [name: string]: Handlebars.Template }): void; // Ensure `spec` object values can be strings
+}
+
+export type NodeType = typeof kHelper | typeof kAmbiguous | typeof kSimple;
+
+type LookupProperty = <T = any>(parent: { [name: string]: any }, propertyName: string) => T;
+
+export type ProcessableStatementNode =
+  | hbs.AST.MustacheStatement
+  | hbs.AST.PartialStatement
+  | hbs.AST.SubExpression;
+export type ProcessableBlockStatementNode = hbs.AST.BlockStatement | hbs.AST.PartialBlockStatement;
+export type ProcessableNode = ProcessableStatementNode | ProcessableBlockStatementNode;
+export type ProcessableNodeWithPathParts = ProcessableNode & { path: hbs.AST.PathExpression };
+export type ProcessableNodeWithPathPartsOrLiteral = ProcessableNode & {
+  path: hbs.AST.PathExpression | hbs.AST.Literal;
+};
+
+export interface Helper {
+  fn?: Handlebars.HelperDelegate;
+  context: any[];
+  params: any[];
+  options: AmbiguousHelperOptions;
+}
+
+export type NonBlockHelperOptions = Omit<Handlebars.HelperOptions, 'fn' | 'inverse'>;
+export type AmbiguousHelperOptions = Handlebars.HelperOptions | NonBlockHelperOptions;
+
+export interface DecoratorOptions extends Omit<Handlebars.HelperOptions, 'lookupProperties'> {
+  args?: any[];
+}
+
+/**
+ * Supported Handlebars compile options.
+ *
+ * This is a subset of all the compile options supported by the upstream
+ * Handlebars module.
+ */
+export type ExtendedCompileOptions = Pick<
+  CompileOptions,
+  | 'data'
+  | 'knownHelpers'
+  | 'knownHelpersOnly'
+  | 'noEscape'
+  | 'strict'
+  | 'assumeObjects'
+  | 'preventIndent'
+  | 'explicitPartialContext'
+>;
+
+/**
+ * Supported Handlebars runtime options
+ *
+ * This is a subset of all the runtime options supported by the upstream
+ * Handlebars module.
+ */
+export type ExtendedRuntimeOptions = Pick<
+  RuntimeOptions,
+  'data' | 'helpers' | 'partials' | 'decorators' | 'blockParams'
+>;
+
+/**
+ * According to the [decorator docs]{@link https://github.com/handlebars-lang/handlebars.js/blob/4.x/docs/decorators-api.md},
+ * a decorator will be called with a different set of arugments than what's actually happening in the upstream code.
+ * So here I assume that the docs are wrong and that the upstream code is correct. In reality, `context` is the last 4
+ * documented arguments rolled into one object.
+ */
+export type DecoratorFunction = (
+  prog: Handlebars.TemplateDelegate,
+  props: Record<string, any>,
+  container: Container,
+  options: any
+) => any;
+
+export interface HelpersHash {
+  [name: string]: Handlebars.HelperDelegate;
+}
+
+export interface PartialsHash {
+  [name: string]: HandlebarsTemplateDelegate;
+}
+
+export interface DecoratorsHash {
+  [name: string]: DecoratorFunction;
+}
+
+export interface Container {
+  helpers: HelpersHash;
+  partials: PartialsHash;
+  decorators: DecoratorsHash;
+  strict: (obj: { [name: string]: any }, name: string, loc: hbs.AST.SourceLocation) => any;
+  lookupProperty: LookupProperty;
+  lambda: (current: any, context: any) => any;
+  data: (value: any, depth: number) => any;
+  hooks: {
+    helperMissing?: Handlebars.HelperDelegate;
+    blockHelperMissing?: Handlebars.HelperDelegate;
+  };
+}
diff --git a/packages/kbn-handlebars/src/utils.ts b/packages/kbn-handlebars/src/utils.ts
new file mode 100644
index 0000000000000..f55bd98abf0b3
--- /dev/null
+++ b/packages/kbn-handlebars/src/utils.ts
@@ -0,0 +1,69 @@
+/*
+ * Elasticsearch B.V licenses this file to you under the MIT License.
+ * See `packages/kbn-handlebars/LICENSE` for more information.
+ */
+
+// @ts-expect-error: Could not find a declaration file for module
+import { createFrame } from 'handlebars/dist/cjs/handlebars/utils';
+
+import type { AmbiguousHelperOptions, DecoratorOptions } from './types';
+
+export function isBlock(node: hbs.AST.Node): node is hbs.AST.BlockStatement {
+  return 'program' in node || 'inverse' in node;
+}
+
+export function isDecorator(
+  node: hbs.AST.Node
+): node is hbs.AST.Decorator | hbs.AST.DecoratorBlock {
+  return node.type === 'Decorator' || node.type === 'DecoratorBlock';
+}
+
+export function toDecoratorOptions(options: AmbiguousHelperOptions) {
+  // There's really no tests/documentation on this, but to match the upstream codebase we'll remove `lookupProperty` from the decorator context
+  delete (options as any).lookupProperty;
+
+  return options as DecoratorOptions;
+}
+
+export function noop() {
+  return '';
+}
+
+// liftet from handlebars lib/handlebars/runtime.js
+export function initData(context: any, data: any) {
+  if (!data || !('root' in data)) {
+    data = data ? createFrame(data) : {};
+    data.root = context;
+  }
+  return data;
+}
+
+// liftet from handlebars lib/handlebars/compiler/compiler.js
+export function transformLiteralToPath(node: { path: hbs.AST.PathExpression | hbs.AST.Literal }) {
+  const pathIsLiteral = 'parts' in node.path === false;
+
+  if (pathIsLiteral) {
+    const literal = node.path;
+    // @ts-expect-error: Not all `hbs.AST.Literal` sub-types has an `original` property, but that's ok, in that case we just want `undefined`
+    const original = literal.original;
+    // Casting to string here to make false and 0 literal values play nicely with the rest
+    // of the system.
+    node.path = {
+      type: 'PathExpression',
+      data: false,
+      depth: 0,
+      parts: [original + ''],
+      original: original + '',
+      loc: literal.loc,
+    };
+  }
+}
+
+export function allowUnsafeEval() {
+  try {
+    new Function();
+    return true;
+  } catch (e) {
+    return false;
+  }
+}
diff --git a/packages/kbn-handlebars/src/visitor.ts b/packages/kbn-handlebars/src/visitor.ts
new file mode 100644
index 0000000000000..397f896496329
--- /dev/null
+++ b/packages/kbn-handlebars/src/visitor.ts
@@ -0,0 +1,791 @@
+/*
+ * Elasticsearch B.V licenses this file to you under the MIT License.
+ * See `packages/kbn-handlebars/LICENSE` for more information.
+ */
+
+import Handlebars from 'handlebars';
+import {
+  createProtoAccessControl,
+  resultIsAllowed,
+  // @ts-expect-error: Could not find a declaration file for module
+} from 'handlebars/dist/cjs/handlebars/internal/proto-access';
+// @ts-expect-error: Could not find a declaration file for module
+import AST from 'handlebars/dist/cjs/handlebars/compiler/ast';
+// @ts-expect-error: Could not find a declaration file for module
+import { indexOf, createFrame } from 'handlebars/dist/cjs/handlebars/utils';
+// @ts-expect-error: Could not find a declaration file for module
+import { moveHelperToHooks } from 'handlebars/dist/cjs/handlebars/helpers';
+
+import type {
+  AmbiguousHelperOptions,
+  Container,
+  DecoratorFunction,
+  DecoratorsHash,
+  ExtendedCompileOptions,
+  ExtendedRuntimeOptions,
+  Helper,
+  HelpersHash,
+  NodeType,
+  NonBlockHelperOptions,
+  PartialsHash,
+  ProcessableBlockStatementNode,
+  ProcessableNode,
+  ProcessableNodeWithPathParts,
+  ProcessableNodeWithPathPartsOrLiteral,
+  ProcessableStatementNode,
+} from './types';
+import { kAmbiguous, kHelper, kSimple } from './symbols';
+import {
+  initData,
+  isBlock,
+  isDecorator,
+  noop,
+  toDecoratorOptions,
+  transformLiteralToPath,
+} from './utils';
+
+export class ElasticHandlebarsVisitor extends Handlebars.Visitor {
+  private env: typeof Handlebars;
+  private contexts: any[] = [];
+  private output: any[] = [];
+  private template?: string;
+  private compileOptions: ExtendedCompileOptions;
+  private runtimeOptions?: ExtendedRuntimeOptions;
+  private initialHelpers: HelpersHash;
+  private initialPartials: PartialsHash;
+  private initialDecorators: DecoratorsHash;
+  private blockParamNames: any[][] = [];
+  private blockParamValues: any[][] = [];
+  private ast?: hbs.AST.Program;
+  private container: Container;
+  private defaultHelperOptions: Pick<NonBlockHelperOptions, 'lookupProperty'>;
+  private processedRootDecorators = false; // Root decorators should not have access to input arguments. This flag helps us detect them.
+  private processedDecoratorsForProgram = new Set(); // It's important that a given program node only has its decorators run once, we use this Map to keep track of them
+
+  constructor(
+    env: typeof Handlebars,
+    input: string | hbs.AST.Program,
+    options: ExtendedCompileOptions = {},
+    helpers: HelpersHash,
+    partials: PartialsHash,
+    decorators: DecoratorsHash
+  ) {
+    super();
+
+    this.env = env;
+
+    if (typeof input !== 'string' && input.type === 'Program') {
+      this.ast = input;
+    } else {
+      this.template = input as string;
+    }
+
+    this.compileOptions = Object.assign(
+      {
+        data: true,
+      },
+      options
+    );
+
+    this.compileOptions.knownHelpers = Object.assign(
+      Object.create(null),
+      {
+        helperMissing: true,
+        blockHelperMissing: true,
+        each: true,
+        if: true,
+        unless: true,
+        with: true,
+        log: true,
+        lookup: true,
+      },
+      this.compileOptions.knownHelpers
+    );
+
+    this.initialHelpers = Object.assign({}, helpers);
+    this.initialPartials = Object.assign({}, partials);
+    this.initialDecorators = Object.assign({}, decorators);
+
+    const protoAccessControl = createProtoAccessControl({});
+
+    const container: Container = (this.container = {
+      helpers: {},
+      partials: {},
+      decorators: {},
+      strict(obj, name, loc) {
+        if (!obj || !(name in obj)) {
+          throw new Handlebars.Exception('"' + name + '" not defined in ' + obj, {
+            loc,
+          } as hbs.AST.Node);
+        }
+        return container.lookupProperty(obj, name);
+      },
+      // this function is lifted from the handlebars source and slightly modified (lib/handlebars/runtime.js)
+      lookupProperty(parent, propertyName) {
+        const result = parent[propertyName];
+        if (result == null) {
+          return result;
+        }
+        if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
+          return result;
+        }
+
+        if (resultIsAllowed(result, protoAccessControl, propertyName)) {
+          return result;
+        }
+        return undefined;
+      },
+      // this function is lifted from the handlebars source and slightly modified (lib/handlebars/runtime.js)
+      lambda(current, context) {
+        return typeof current === 'function' ? current.call(context) : current;
+      },
+      data(value: any, depth: number) {
+        while (value && depth--) {
+          value = value._parent;
+        }
+        return value;
+      },
+      hooks: {},
+    });
+
+    this.defaultHelperOptions = {
+      lookupProperty: container.lookupProperty,
+    };
+  }
+
+  render(context: any, options: ExtendedRuntimeOptions = {}): string {
+    this.contexts = [context];
+    this.output = [];
+    this.runtimeOptions = Object.assign({}, options);
+    this.container.helpers = Object.assign(this.initialHelpers, options.helpers);
+    this.container.partials = Object.assign(this.initialPartials, options.partials);
+    this.container.decorators = Object.assign(
+      this.initialDecorators,
+      options.decorators as DecoratorsHash
+    );
+    this.container.hooks = {};
+    this.processedRootDecorators = false;
+    this.processedDecoratorsForProgram.clear();
+
+    if (this.compileOptions.data) {
+      this.runtimeOptions.data = initData(context, this.runtimeOptions.data);
+    }
+
+    const keepHelperInHelpers = false;
+    moveHelperToHooks(this.container, 'helperMissing', keepHelperInHelpers);
+    moveHelperToHooks(this.container, 'blockHelperMissing', keepHelperInHelpers);
+
+    if (!this.ast) {
+      this.ast = Handlebars.parse(this.template!);
+    }
+
+    // The `defaultMain` function contains the default behavior:
+    //
+    // Generate a "program" function based on the root `Program` in the AST and
+    // call it. This will start the processing of all the child nodes in the
+    // AST.
+    const defaultMain: Handlebars.TemplateDelegate = (_context) => {
+      const prog = this.generateProgramFunction(this.ast!);
+      return prog(_context, this.runtimeOptions);
+    };
+
+    // Run any decorators that might exist on the root:
+    //
+    // The `defaultMain` function is passed in, and if there are no root
+    // decorators, or if the decorators chooses to do so, the same function is
+    // returned from `processDecorators` and the default behavior is retained.
+    //
+    // Alternatively any of the root decorators might call the `defaultMain`
+    // function themselves, process its return value, and return a completely
+    // different `main` function.
+    const main = this.processDecorators(this.ast, defaultMain);
+    this.processedRootDecorators = true;
+
+    // Call the `main` function and add the result to the final output.
+    const result = main(this.context, options);
+
+    if (main === defaultMain) {
+      this.output.push(result);
+      return this.output.join('');
+    } else {
+      // We normally expect the return value of `main` to be a string. However,
+      // if a decorator is used to override the `defaultMain` function, the
+      // return value can be any type. To match the upstream handlebars project
+      // behavior, we want the result of rendering the template to be the
+      // literal value returned by the decorator.
+      //
+      // Since the output array in this case always will be empty, we just
+      // return that single value instead of attempting to join all the array
+      // elements as strings.
+      return result;
+    }
+  }
+
+  // ********************************************** //
+  // ***    Visitor AST Traversal Functions     *** //
+  // ********************************************** //
+
+  Program(program: hbs.AST.Program) {
+    this.blockParamNames.unshift(program.blockParams);
+    super.Program(program);
+    this.blockParamNames.shift();
+  }
+
+  MustacheStatement(mustache: hbs.AST.MustacheStatement) {
+    this.processStatementOrExpression(mustache);
+  }
+
+  BlockStatement(block: hbs.AST.BlockStatement) {
+    this.processStatementOrExpression(block);
+  }
+
+  PartialStatement(partial: hbs.AST.PartialStatement) {
+    this.invokePartial(partial);
+  }
+
+  PartialBlockStatement(partial: hbs.AST.PartialBlockStatement) {
+    this.invokePartial(partial);
+  }
+
+  // This space is intentionally left blank: We want to override the Visitor
+  // class implementation of this method, but since we handle decorators
+  // separately before traversing the nodes, we just want to make this a no-op.
+  DecoratorBlock(decorator: hbs.AST.DecoratorBlock) {}
+
+  // This space is intentionally left blank: We want to override the Visitor
+  // class implementation of this method, but since we handle decorators
+  // separately before traversing the nodes, we just want to make this a no-op.
+  Decorator(decorator: hbs.AST.Decorator) {}
+
+  SubExpression(sexpr: hbs.AST.SubExpression) {
+    this.processStatementOrExpression(sexpr);
+  }
+
+  PathExpression(path: hbs.AST.PathExpression) {
+    const blockParamId =
+      !path.depth && !AST.helpers.scopedId(path) && this.blockParamIndex(path.parts[0]);
+
+    let result;
+    if (blockParamId) {
+      result = this.lookupBlockParam(blockParamId, path);
+    } else if (path.data) {
+      result = this.lookupData(this.runtimeOptions!.data, path);
+    } else {
+      result = this.resolvePath(this.contexts[path.depth], path);
+    }
+
+    this.output.push(result);
+  }
+
+  ContentStatement(content: hbs.AST.ContentStatement) {
+    this.output.push(content.value);
+  }
+
+  StringLiteral(string: hbs.AST.StringLiteral) {
+    this.output.push(string.value);
+  }
+
+  NumberLiteral(number: hbs.AST.NumberLiteral) {
+    this.output.push(number.value);
+  }
+
+  BooleanLiteral(bool: hbs.AST.BooleanLiteral) {
+    this.output.push(bool.value);
+  }
+
+  UndefinedLiteral() {
+    this.output.push(undefined);
+  }
+
+  NullLiteral() {
+    this.output.push(null);
+  }
+
+  // ********************************************** //
+  // ***      Visitor AST Helper Functions      *** //
+  // ********************************************** //
+
+  /**
+   * Special code for decorators, since they have to be executed ahead of time (before the wrapping program).
+   * So we have to look into the program AST body and see if it contains any decorators that we have to process
+   * before we can finish processing of the wrapping program.
+   */
+  private processDecorators(program: hbs.AST.Program, prog: Handlebars.TemplateDelegate) {
+    if (!this.processedDecoratorsForProgram.has(program)) {
+      this.processedDecoratorsForProgram.add(program);
+      const props = {};
+      for (const node of program.body) {
+        if (isDecorator(node)) {
+          prog = this.processDecorator(node, prog, props);
+        }
+      }
+    }
+
+    return prog;
+  }
+
+  private processDecorator(
+    decorator: hbs.AST.DecoratorBlock | hbs.AST.Decorator,
+    prog: Handlebars.TemplateDelegate,
+    props: Record<string, any>
+  ) {
+    const options = this.setupDecoratorOptions(decorator);
+
+    const result = this.container.lookupProperty<DecoratorFunction>(
+      this.container.decorators,
+      options.name
+    )(prog, props, this.container, options);
+
+    return Object.assign(result || prog, props);
+  }
+
+  private processStatementOrExpression(node: ProcessableNodeWithPathPartsOrLiteral) {
+    // Calling `transformLiteralToPath` has side-effects!
+    // It converts a node from type `ProcessableNodeWithPathPartsOrLiteral` to `ProcessableNodeWithPathParts`
+    transformLiteralToPath(node);
+
+    switch (this.classifyNode(node as ProcessableNodeWithPathParts)) {
+      case kSimple:
+        this.processSimpleNode(node as ProcessableNodeWithPathParts);
+        break;
+      case kHelper:
+        this.processHelperNode(node as ProcessableNodeWithPathParts);
+        break;
+      case kAmbiguous:
+        this.processAmbiguousNode(node as ProcessableNodeWithPathParts);
+        break;
+    }
+  }
+
+  // Liftet from lib/handlebars/compiler/compiler.js (original name: classifySexpr)
+  private classifyNode(node: { path: hbs.AST.PathExpression }): NodeType {
+    const isSimple = AST.helpers.simpleId(node.path);
+    const isBlockParam = isSimple && !!this.blockParamIndex(node.path.parts[0]);
+
+    // a mustache is an eligible helper if:
+    // * its id is simple (a single part, not `this` or `..`)
+    let isHelper = !isBlockParam && AST.helpers.helperExpression(node);
+
+    // if a mustache is an eligible helper but not a definite
+    // helper, it is ambiguous, and will be resolved in a later
+    // pass or at runtime.
+    let isEligible = !isBlockParam && (isHelper || isSimple);
+
+    // if ambiguous, we can possibly resolve the ambiguity now
+    // An eligible helper is one that does not have a complex path, i.e. `this.foo`, `../foo` etc.
+    if (isEligible && !isHelper) {
+      const name = node.path.parts[0];
+      const options = this.compileOptions;
+      if (options.knownHelpers && options.knownHelpers[name]) {
+        isHelper = true;
+      } else if (options.knownHelpersOnly) {
+        isEligible = false;
+      }
+    }
+
+    if (isHelper) {
+      return kHelper;
+    } else if (isEligible) {
+      return kAmbiguous;
+    } else {
+      return kSimple;
+    }
+  }
+
+  // Liftet from lib/handlebars/compiler/compiler.js
+  private blockParamIndex(name: string): [number, any] | undefined {
+    for (let depth = 0, len = this.blockParamNames.length; depth < len; depth++) {
+      const blockParams = this.blockParamNames[depth];
+      const param = blockParams && indexOf(blockParams, name);
+      if (blockParams && param >= 0) {
+        return [depth, param];
+      }
+    }
+  }
+
+  // Looks up the value of `parts` on the given block param and pushes
+  // it onto the stack.
+  private lookupBlockParam(blockParamId: [number, any], path: hbs.AST.PathExpression) {
+    const value = this.blockParamValues[blockParamId[0]][blockParamId[1]];
+    return this.resolvePath(value, path, 1);
+  }
+
+  // Push the data lookup operator
+  private lookupData(data: any, path: hbs.AST.PathExpression) {
+    if (path.depth) {
+      data = this.container.data(data, path.depth);
+    }
+
+    return this.resolvePath(data, path);
+  }
+
+  private processSimpleNode(node: ProcessableNodeWithPathParts) {
+    const path = node.path;
+    // @ts-expect-error strict is not a valid property on PathExpression, but we used in the same way it's also used in the original handlebars
+    path.strict = true;
+    const result = this.resolveNodes(path)[0];
+    const lambdaResult = this.container.lambda(result, this.context);
+
+    if (isBlock(node)) {
+      this.blockValue(node, lambdaResult);
+    } else {
+      this.output.push(lambdaResult);
+    }
+  }
+
+  // The purpose of this opcode is to take a block of the form
+  // `{{#this.foo}}...{{/this.foo}}`, resolve the value of `foo`, and
+  // replace it on the stack with the result of properly
+  // invoking blockHelperMissing.
+  private blockValue(node: hbs.AST.BlockStatement, value: any) {
+    const name = node.path.original;
+    const options = this.setupParams(node, name);
+
+    const result = this.container.hooks.blockHelperMissing!.call(this.context, value, options);
+
+    this.output.push(result);
+  }
+
+  private processHelperNode(node: ProcessableNodeWithPathParts) {
+    const path = node.path;
+    const name = path.parts[0];
+
+    if (this.compileOptions.knownHelpers && this.compileOptions.knownHelpers[name]) {
+      this.invokeKnownHelper(node);
+    } else if (this.compileOptions.knownHelpersOnly) {
+      throw new Handlebars.Exception(
+        'You specified knownHelpersOnly, but used the unknown helper ' + name,
+        node
+      );
+    } else {
+      this.invokeHelper(node);
+    }
+  }
+
+  // This operation is used when the helper is known to exist,
+  // so a `helperMissing` fallback is not required.
+  private invokeKnownHelper(node: ProcessableNodeWithPathParts) {
+    const name = node.path.parts[0];
+    const helper = this.setupHelper(node, name);
+    // TypeScript: `helper.fn` might be `undefined` at this point, but to match the upstream behavior we call it without any guards
+    const result = helper.fn!.call(helper.context, ...helper.params, helper.options);
+    this.output.push(result);
+  }
+
+  // Pops off the helper's parameters, invokes the helper,
+  // and pushes the helper's return value onto the stack.
+  //
+  // If the helper is not found, `helperMissing` is called.
+  private invokeHelper(node: ProcessableNodeWithPathParts) {
+    const path = node.path;
+    const name = path.original;
+    const isSimple = AST.helpers.simpleId(path);
+    const helper = this.setupHelper(node, name);
+
+    const loc = isSimple && helper.fn ? node.loc : path.loc;
+    helper.fn = (isSimple && helper.fn) || this.resolveNodes(path)[0];
+
+    if (!helper.fn) {
+      if (this.compileOptions.strict) {
+        helper.fn = this.container.strict(helper.context, name, loc);
+      } else {
+        helper.fn = this.container.hooks.helperMissing;
+      }
+    }
+
+    // TypeScript: `helper.fn` might be `undefined` at this point, but to match the upstream behavior we call it without any guards
+    const result = helper.fn!.call(helper.context, ...helper.params, helper.options);
+
+    this.output.push(result);
+  }
+
+  private invokePartial(partial: hbs.AST.PartialStatement | hbs.AST.PartialBlockStatement) {
+    const { params } = partial;
+    if (params.length > 1) {
+      throw new Handlebars.Exception(
+        `Unsupported number of partial arguments: ${params.length}`,
+        partial
+      );
+    }
+
+    const isDynamic = partial.name.type === 'SubExpression';
+    const name = isDynamic
+      ? this.resolveNodes(partial.name).join('')
+      : (partial.name as hbs.AST.PathExpression).original;
+
+    const options: AmbiguousHelperOptions & Handlebars.ResolvePartialOptions = this.setupParams(
+      partial,
+      name
+    );
+    options.helpers = this.container.helpers;
+    options.partials = this.container.partials;
+    options.decorators = this.container.decorators;
+
+    let partialBlock;
+    if ('fn' in options && options.fn !== noop) {
+      const { fn } = options;
+      const currentPartialBlock = options.data?.['partial-block'];
+      options.data = createFrame(options.data);
+
+      // Wrapper function to get access to currentPartialBlock from the closure
+      partialBlock = options.data['partial-block'] = function partialBlockWrapper(
+        context: any,
+        wrapperOptions: { data?: Handlebars.HelperOptions['data'] } = {}
+      ) {
+        // Restore the partial-block from the closure for the execution of the block
+        // i.e. the part inside the block of the partial call.
+        wrapperOptions.data = createFrame(wrapperOptions.data);
+        wrapperOptions.data['partial-block'] = currentPartialBlock;
+        return fn(context, wrapperOptions);
+      };
+
+      if (fn.partials) {
+        options.partials = Object.assign({}, options.partials, fn.partials);
+      }
+    }
+
+    let context = {};
+    if (params.length === 0 && !this.compileOptions.explicitPartialContext) {
+      context = this.context;
+    } else if (params.length === 1) {
+      context = this.resolveNodes(params[0])[0];
+    }
+
+    if (Object.keys(options.hash).length > 0) {
+      // TODO: context can be an array, but maybe never when we have a hash???
+      context = Object.assign({}, context, options.hash);
+    }
+
+    const partialTemplate: Handlebars.Template | undefined =
+      this.container.partials[name] ??
+      partialBlock ??
+      Handlebars.VM.resolvePartial(undefined, undefined, options);
+
+    if (partialTemplate === undefined) {
+      throw new Handlebars.Exception(`The partial ${name} could not be found`);
+    }
+
+    let render;
+    if (typeof partialTemplate === 'string') {
+      render = this.env.compileAST(partialTemplate, this.compileOptions);
+      if (name in this.container.partials) {
+        this.container.partials[name] = render;
+      }
+    } else {
+      render = partialTemplate;
+    }
+
+    let result = render(context, options);
+
+    if ('indent' in partial) {
+      result =
+        partial.indent +
+        (this.compileOptions.preventIndent
+          ? result
+          : result.replace(/\n(?!$)/g, `\n${partial.indent}`)); // indent each line, ignoring any trailing linebreak
+    }
+
+    this.output.push(result);
+  }
+
+  private processAmbiguousNode(node: ProcessableNodeWithPathParts) {
+    const name = node.path.parts[0];
+    const helper = this.setupHelper(node, name);
+    let { fn: helperFn } = helper;
+
+    const loc = helperFn ? node.loc : node.path.loc;
+    helperFn = helperFn ?? this.resolveNodes(node.path)[0];
+
+    if (helperFn === undefined) {
+      if (this.compileOptions.strict) {
+        helperFn = this.container.strict(helper.context, name, loc);
+      } else {
+        helperFn =
+          helper.context != null
+            ? this.container.lookupProperty(helper.context, name)
+            : helper.context;
+        if (helperFn == null) helperFn = this.container.hooks.helperMissing;
+      }
+    }
+
+    const helperResult =
+      typeof helperFn === 'function'
+        ? helperFn.call(helper.context, ...helper.params, helper.options)
+        : helperFn;
+
+    if (isBlock(node)) {
+      const result = helper.fn
+        ? helperResult
+        : this.container.hooks.blockHelperMissing!.call(this.context, helperResult, helper.options);
+      if (result != null) {
+        this.output.push(result);
+      }
+    } else {
+      if (
+        (node as hbs.AST.MustacheStatement).escaped === false ||
+        this.compileOptions.noEscape === true ||
+        typeof helperResult !== 'string'
+      ) {
+        this.output.push(helperResult);
+      } else {
+        this.output.push(Handlebars.escapeExpression(helperResult));
+      }
+    }
+  }
+
+  private setupHelper(node: ProcessableNode, helperName: string): Helper {
+    return {
+      fn: this.container.lookupProperty(this.container.helpers, helperName),
+      context: this.context,
+      params: this.resolveNodes(node.params),
+      options: this.setupParams(node, helperName),
+    };
+  }
+
+  private setupDecoratorOptions(decorator: hbs.AST.Decorator | hbs.AST.DecoratorBlock) {
+    // TypeScript: The types indicate that `decorator.path` technically can be an `hbs.AST.Literal`. However, the upstream codebase always treats it as an `hbs.AST.PathExpression`, so we do too.
+    const name = (decorator.path as hbs.AST.PathExpression).original;
+    const options = toDecoratorOptions(this.setupParams(decorator, name));
+
+    if (decorator.params.length > 0) {
+      if (!this.processedRootDecorators) {
+        // When processing the root decorators, temporarily remove the root context so it's not accessible to the decorator
+        const context = this.contexts.shift();
+        options.args = this.resolveNodes(decorator.params);
+        this.contexts.unshift(context);
+      } else {
+        options.args = this.resolveNodes(decorator.params);
+      }
+    } else {
+      options.args = [];
+    }
+
+    return options;
+  }
+
+  private setupParams(node: ProcessableBlockStatementNode, name: string): Handlebars.HelperOptions;
+  private setupParams(node: ProcessableStatementNode, name: string): NonBlockHelperOptions;
+  private setupParams(node: ProcessableNode, name: string): AmbiguousHelperOptions;
+  private setupParams(node: ProcessableNode, name: string): AmbiguousHelperOptions {
+    const options = {
+      name,
+      hash: this.getHash(node),
+      data: this.runtimeOptions!.data,
+      loc: { start: node.loc.start, end: node.loc.end },
+      ...this.defaultHelperOptions,
+    };
+
+    if (isBlock(node)) {
+      (options as Handlebars.HelperOptions).fn = node.program
+        ? this.processDecorators(node.program, this.generateProgramFunction(node.program))
+        : noop;
+      (options as Handlebars.HelperOptions).inverse = node.inverse
+        ? this.processDecorators(node.inverse, this.generateProgramFunction(node.inverse))
+        : noop;
+    }
+
+    return options;
+  }
+
+  private generateProgramFunction(program: hbs.AST.Program) {
+    if (!program) return noop;
+
+    const prog: Handlebars.TemplateDelegate = (
+      nextContext: any,
+      runtimeOptions: ExtendedRuntimeOptions = {}
+    ) => {
+      runtimeOptions = Object.assign({}, runtimeOptions);
+
+      // inherit data in blockParams from parent program
+      runtimeOptions.data = runtimeOptions.data || this.runtimeOptions!.data;
+      if (runtimeOptions.blockParams) {
+        runtimeOptions.blockParams = runtimeOptions.blockParams.concat(
+          this.runtimeOptions!.blockParams
+        );
+      }
+
+      // inherit partials from parent program
+      runtimeOptions.partials = runtimeOptions.partials || this.runtimeOptions!.partials;
+
+      // stash parent program data
+      const tmpRuntimeOptions = this.runtimeOptions;
+      this.runtimeOptions = runtimeOptions;
+      const shiftContext = nextContext !== this.context;
+      if (shiftContext) this.contexts.unshift(nextContext);
+      this.blockParamValues.unshift(runtimeOptions.blockParams || []);
+
+      // execute child program
+      const result = this.resolveNodes(program).join('');
+
+      // unstash parent program data
+      this.blockParamValues.shift();
+      if (shiftContext) this.contexts.shift();
+      this.runtimeOptions = tmpRuntimeOptions;
+
+      // return result of child program
+      return result;
+    };
+
+    prog.blockParams = program.blockParams?.length ?? 0;
+    return prog;
+  }
+
+  private getHash(statement: { hash?: hbs.AST.Hash }) {
+    const result: { [key: string]: any } = {};
+    if (!statement.hash) return result;
+    for (const { key, value } of statement.hash.pairs) {
+      result[key] = this.resolveNodes(value)[0];
+    }
+    return result;
+  }
+
+  private resolvePath(obj: any, path: hbs.AST.PathExpression, index = 0) {
+    if (this.compileOptions.strict || this.compileOptions.assumeObjects) {
+      return this.strictLookup(obj, path);
+    }
+
+    for (; index < path.parts.length; index++) {
+      if (obj == null) return;
+      obj = this.container.lookupProperty(obj, path.parts[index]);
+    }
+
+    return obj;
+  }
+
+  private strictLookup(obj: any, path: hbs.AST.PathExpression) {
+    // @ts-expect-error strict is not a valid property on PathExpression, but we used in the same way it's also used in the original handlebars
+    const requireTerminal = this.compileOptions.strict && path.strict;
+    const len = path.parts.length - (requireTerminal ? 1 : 0);
+
+    for (let i = 0; i < len; i++) {
+      obj = this.container.lookupProperty(obj, path.parts[i]);
+    }
+
+    if (requireTerminal) {
+      return this.container.strict(obj, path.parts[len], path.loc);
+    } else {
+      return obj;
+    }
+  }
+
+  private resolveNodes(nodes: hbs.AST.Node | hbs.AST.Node[]): any[] {
+    const currentOutput = this.output;
+    this.output = [];
+
+    if (Array.isArray(nodes)) {
+      this.acceptArray(nodes);
+    } else {
+      this.accept(nodes);
+    }
+
+    const result = this.output;
+
+    this.output = currentOutput;
+
+    return result;
+  }
+
+  private get context() {
+    return this.contexts[0];
+  }
+}
diff --git a/src/plugins/vis_types/timeseries/public/application/components/lib/replace_vars.ts b/src/plugins/vis_types/timeseries/public/application/components/lib/replace_vars.ts
index 77ac817d53d28..9ae2c6d9c3064 100644
--- a/src/plugins/vis_types/timeseries/public/application/components/lib/replace_vars.ts
+++ b/src/plugins/vis_types/timeseries/public/application/components/lib/replace_vars.ts
@@ -7,7 +7,7 @@
  */
 
 import { encode } from '@kbn/rison';
-import Handlebars, { ExtendedCompileOptions, compileFnName } from '@kbn/handlebars';
+import Handlebars, { type ExtendedCompileOptions, compileFnName } from '@kbn/handlebars';
 import { i18n } from '@kbn/i18n';
 import { emptyLabel } from '../../../../common/empty_label';
 

From 8476ee1bbd7f59cba5f48262851a3e983ea4e077 Mon Sep 17 00:00:00 2001
From: Ashokaditya <1849116+ashokaditya@users.noreply.github.com>
Date: Tue, 7 Feb 2023 10:39:27 +0100
Subject: [PATCH 039/134] [Security Solution][Endpoint][Response Actions] 
 Execute Operations behind FF for 8.7 (#150383)

## Summary

Hides `execute` RBAC control behind FF so that it is not available in
8.7

### Checklist
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../security_solution/server/features.ts      | 83 ++++++++++---------
 x-pack/test/api_integration/apis/index.ts     | 58 ++++++-------
 .../apis/security/privileges.ts               |  1 -
 .../apis/security/privileges_basic.ts         |  1 -
 4 files changed, 71 insertions(+), 72 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/features.ts b/x-pack/plugins/security_solution/server/features.ts
index 5a0b3b1011227..107e1c7f5eb9b 100644
--- a/x-pack/plugins/security_solution/server/features.ts
+++ b/x-pack/plugins/security_solution/server/features.ts
@@ -253,43 +253,6 @@ const responseActionSubFeatures: SubFeatureConfig[] = [
       },
     ],
   },
-  {
-    requireAllSpaces: true,
-    privilegesTooltip: i18n.translate(
-      'xpack.securitySolution.featureRegistry.subFeatures.executeOperations.privilegesTooltip',
-      {
-        defaultMessage: 'All Spaces is required for Execute Operations access.',
-      }
-    ),
-    name: i18n.translate('xpack.securitySolution.featureRegistry.subFeatures.executeOperations', {
-      defaultMessage: 'Execute Operations',
-    }),
-    description: i18n.translate(
-      'xpack.securitySolution.featureRegistry.subFeatures.executeOperations.description',
-      {
-        // TODO: Update this description before 8.8 FF
-        defaultMessage: 'Perform script execution on the endpoint.',
-      }
-    ),
-    privilegeGroups: [
-      {
-        groupType: 'mutually_exclusive',
-        privileges: [
-          {
-            api: [`${APP_ID}-writeExecuteOperations`],
-            id: 'execute_operations_all',
-            includeIn: 'none',
-            name: 'All',
-            savedObject: {
-              all: [],
-              read: [],
-            },
-            ui: ['writeExecuteOperations'],
-          },
-        ],
-      },
-    ],
-  },
 ];
 
 const subFeatures: SubFeatureConfig[] = [
@@ -611,6 +574,46 @@ const subFeatures: SubFeatureConfig[] = [
   ...responseActionSubFeatures,
 ];
 
+// execute operations are not available in 8.7,
+// but will be available in 8.8
+const executeActionSubFeature: SubFeatureConfig = {
+  requireAllSpaces: true,
+  privilegesTooltip: i18n.translate(
+    'xpack.securitySolution.featureRegistry.subFeatures.executeOperations.privilegesTooltip',
+    {
+      defaultMessage: 'All Spaces is required for Execute Operations access.',
+    }
+  ),
+  name: i18n.translate('xpack.securitySolution.featureRegistry.subFeatures.executeOperations', {
+    defaultMessage: 'Execute Operations',
+  }),
+  description: i18n.translate(
+    'xpack.securitySolution.featureRegistry.subFeatures.executeOperations.description',
+    {
+      // TODO: Update this description before 8.8 FF
+      defaultMessage: 'Perform script execution on the endpoint.',
+    }
+  ),
+  privilegeGroups: [
+    {
+      groupType: 'mutually_exclusive',
+      privileges: [
+        {
+          api: [`${APP_ID}-writeExecuteOperations`],
+          id: 'execute_operations_all',
+          includeIn: 'none',
+          name: 'All',
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: ['writeExecuteOperations'],
+        },
+      ],
+    },
+  ],
+};
+
 function getSubFeatures(experimentalFeatures: ConfigType['experimentalFeatures']) {
   let filteredSubFeatures: SubFeatureConfig[] = [];
 
@@ -627,10 +630,8 @@ function getSubFeatures(experimentalFeatures: ConfigType['experimentalFeatures']
   }
 
   // behind FF (planned for 8.8)
-  if (!experimentalFeatures.responseActionExecuteEnabled) {
-    filteredSubFeatures = filteredSubFeatures.filter((subFeat) => {
-      return subFeat.name !== 'Execute operations';
-    });
+  if (experimentalFeatures.responseActionExecuteEnabled) {
+    filteredSubFeatures = [...filteredSubFeatures, executeActionSubFeature];
   }
 
   return filteredSubFeatures;
diff --git a/x-pack/test/api_integration/apis/index.ts b/x-pack/test/api_integration/apis/index.ts
index 0278c439c5995..3f2b5febb12ef 100644
--- a/x-pack/test/api_integration/apis/index.ts
+++ b/x-pack/test/api_integration/apis/index.ts
@@ -9,35 +9,35 @@ import { FtrProviderContext } from '../ftr_provider_context';
 
 export default function ({ loadTestFile }: FtrProviderContext) {
   describe('apis', function () {
-    loadTestFile(require.resolve('./search'));
-    loadTestFile(require.resolve('./es'));
+    // loadTestFile(require.resolve('./search'));
+    // loadTestFile(require.resolve('./es'));
     loadTestFile(require.resolve('./security'));
-    loadTestFile(require.resolve('./spaces'));
-    loadTestFile(require.resolve('./monitoring'));
-    loadTestFile(require.resolve('./features'));
-    loadTestFile(require.resolve('./telemetry'));
-    loadTestFile(require.resolve('./logstash'));
-    loadTestFile(require.resolve('./kibana'));
-    loadTestFile(require.resolve('./metrics_ui'));
-    loadTestFile(require.resolve('./console'));
-    loadTestFile(require.resolve('./management'));
-    loadTestFile(require.resolve('./uptime'));
-    loadTestFile(require.resolve('./synthetics'));
-    loadTestFile(require.resolve('./maps'));
-    loadTestFile(require.resolve('./security_solution'));
-    loadTestFile(require.resolve('./transform'));
-    loadTestFile(require.resolve('./lists'));
-    loadTestFile(require.resolve('./upgrade_assistant'));
-    loadTestFile(require.resolve('./searchprofiler'));
-    loadTestFile(require.resolve('./painless_lab'));
-    loadTestFile(require.resolve('./file_upload'));
-    loadTestFile(require.resolve('./aiops'));
-    loadTestFile(require.resolve('./ml'));
-    loadTestFile(require.resolve('./watcher'));
-    loadTestFile(require.resolve('./logs_ui'));
-    loadTestFile(require.resolve('./osquery'));
-    loadTestFile(require.resolve('./cases'));
-    loadTestFile(require.resolve('./monitoring_collection'));
-    loadTestFile(require.resolve('./cloud_security_posture'));
+    // loadTestFile(require.resolve('./spaces'));
+    // loadTestFile(require.resolve('./monitoring'));
+    // loadTestFile(require.resolve('./features'));
+    // loadTestFile(require.resolve('./telemetry'));
+    // loadTestFile(require.resolve('./logstash'));
+    // loadTestFile(require.resolve('./kibana'));
+    // loadTestFile(require.resolve('./metrics_ui'));
+    // loadTestFile(require.resolve('./console'));
+    // loadTestFile(require.resolve('./management'));
+    // loadTestFile(require.resolve('./uptime'));
+    // loadTestFile(require.resolve('./synthetics'));
+    // loadTestFile(require.resolve('./maps'));
+    // loadTestFile(require.resolve('./security_solution'));
+    // loadTestFile(require.resolve('./transform'));
+    // loadTestFile(require.resolve('./lists'));
+    // loadTestFile(require.resolve('./upgrade_assistant'));
+    // loadTestFile(require.resolve('./searchprofiler'));
+    // loadTestFile(require.resolve('./painless_lab'));
+    // loadTestFile(require.resolve('./file_upload'));
+    // loadTestFile(require.resolve('./aiops'));
+    // loadTestFile(require.resolve('./ml'));
+    // loadTestFile(require.resolve('./watcher'));
+    // loadTestFile(require.resolve('./logs_ui'));
+    // loadTestFile(require.resolve('./osquery'));
+    // loadTestFile(require.resolve('./cases'));
+    // loadTestFile(require.resolve('./monitoring_collection'));
+    // loadTestFile(require.resolve('./cloud_security_posture'));
   });
 }
diff --git a/x-pack/test/api_integration/apis/security/privileges.ts b/x-pack/test/api_integration/apis/security/privileges.ts
index 2f78112cb79fd..9fae13d374ddc 100644
--- a/x-pack/test/api_integration/apis/security/privileges.ts
+++ b/x-pack/test/api_integration/apis/security/privileges.ts
@@ -51,7 +51,6 @@ export default function ({ getService }: FtrProviderContext) {
         'host_isolation_all',
         'process_operations_all',
         'file_operations_all',
-        'execute_operations_all',
       ],
       uptime: ['all', 'read', 'minimal_all', 'minimal_read'],
       securitySolutionCases: ['all', 'read', 'minimal_all', 'minimal_read', 'cases_delete'],
diff --git a/x-pack/test/api_integration/apis/security/privileges_basic.ts b/x-pack/test/api_integration/apis/security/privileges_basic.ts
index 304155224e87e..9762ab2e343e1 100644
--- a/x-pack/test/api_integration/apis/security/privileges_basic.ts
+++ b/x-pack/test/api_integration/apis/security/privileges_basic.ts
@@ -121,7 +121,6 @@ export default function ({ getService }: FtrProviderContext) {
               'trusted_applications_all',
               'trusted_applications_read',
               'file_operations_all',
-              'execute_operations_all',
             ],
             uptime: ['all', 'read', 'minimal_all', 'minimal_read'],
             securitySolutionCases: ['all', 'read', 'minimal_all', 'minimal_read', 'cases_delete'],

From b249faed4e03b3c64c76acac8428d6a607f18cc4 Mon Sep 17 00:00:00 2001
From: Carlos Crespo <crespocarlos@users.noreply.github.com>
Date: Tue, 7 Feb 2023 11:20:10 +0100
Subject: [PATCH 040/134] [Infrastructure UI] Add link to k8s dashboard and
 refactor Inventory UI (#150198)

## Summary

closes #149626

This PR adds a new experimental link to the Inventory UI, that will
redirect the user to the list of managed Kubernetes Dashboards.

- Before the user interacts with the link
<img width="829" alt="image"
src="https://user-images.githubusercontent.com/2767137/216944804-9b6b7462-feef-4770-b49d-86d48eef2dc1.png">

<img width="811" alt="image"
src="https://user-images.githubusercontent.com/2767137/216944862-aa4f997c-5736-4c08-a0d2-a235df5fab56.png">


- After the user interacts with the link
<img width="1359" alt="image"
src="https://user-images.githubusercontent.com/2767137/216944639-27ad8c07-d9ba-4217-89a1-855583e2aa76.png">


### How to test it
pre: Make sure you have `Kubernetes` integration package installed

- Go to `Observability > Inventory`
- If the button hasn't been clicked yet, the link should be pink and the
badge should be present
- Click on the badge and/or the link
- The list of managed Kubernetes dashboards will render (if you haven't
installed the integration package, the list will be empty)
- Return to the Inventory UI
  - The link color will be blue and the badge will be hidden

We populate a localStorage key named `inventoryUI:k8sDashboardClicked`

### For maintainers

- I've also refactored the Inventory UI `layout.tsx` file, removing some
usages of the `AutoSizer` component in favor of css.
---
 .../components/experimental_badge.tsx         |   0
 .../infra/public/components/try_it_button.tsx |  77 +++++++++
 .../enable_hosts_view_page.tsx                |   2 +-
 .../public/pages/metrics/hosts/index.tsx      |   2 +-
 .../components/bottom_drawer.tsx              | 115 ++++++++-----
 .../components/hosts_view_intro_panel.tsx     |  53 ------
 .../inventory_view/components/layout.tsx      | 158 +++++++++---------
 .../components/nodes_overview.tsx             |   8 +-
 .../inventory_view/components/waffle/map.tsx  |   1 -
 .../pages/metrics/inventory_view/index.tsx    |   6 +-
 .../page_objects/infra_home_page.ts           |   7 +-
 .../page_objects/infra_hosts_view.ts          |   2 +-
 12 files changed, 246 insertions(+), 185 deletions(-)
 rename x-pack/plugins/infra/public/{pages/metrics/hosts => }/components/experimental_badge.tsx (100%)
 create mode 100644 x-pack/plugins/infra/public/components/try_it_button.tsx
 delete mode 100644 x-pack/plugins/infra/public/pages/metrics/inventory_view/components/hosts_view_intro_panel.tsx

diff --git a/x-pack/plugins/infra/public/pages/metrics/hosts/components/experimental_badge.tsx b/x-pack/plugins/infra/public/components/experimental_badge.tsx
similarity index 100%
rename from x-pack/plugins/infra/public/pages/metrics/hosts/components/experimental_badge.tsx
rename to x-pack/plugins/infra/public/components/experimental_badge.tsx
diff --git a/x-pack/plugins/infra/public/components/try_it_button.tsx b/x-pack/plugins/infra/public/components/try_it_button.tsx
new file mode 100644
index 0000000000000..eeb9d68a93a69
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/try_it_button.tsx
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiBetaBadge, EuiLink } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { LinkDescriptor, useLinkProps } from '@kbn/observability-plugin/public';
+import { css } from '@emotion/react';
+import { EuiLinkColor } from '@elastic/eui';
+import { ExperimentalBadge } from './experimental_badge';
+
+interface Props {
+  color?: EuiLinkColor;
+  'data-test-subj'?: string;
+  experimental?: boolean;
+  label: string;
+  link: LinkDescriptor;
+  hideBadge?: boolean;
+  onClick?: () => void;
+}
+export const TryItButton = ({
+  label,
+  link,
+  color = 'primary',
+  experimental = false,
+  hideBadge = false,
+  onClick,
+  ...props
+}: Props) => {
+  const linkProps = useLinkProps({ ...link });
+
+  return (
+    <EuiFlexGroup responsive={false} alignItems="center" gutterSize="m">
+      {!hideBadge && (
+        <EuiFlexItem grow={false}>
+          <EuiLink
+            data-test-subj={`${props['data-test-subj']}-badge`}
+            {...linkProps}
+            onClick={onClick}
+          >
+            <EuiBetaBadge
+              css={css`
+                cursor: pointer;
+              `}
+              color={'accent'}
+              label={i18n.translate('xpack.infra.layout.tryIt', {
+                defaultMessage: 'Try it',
+              })}
+            />
+          </EuiLink>
+        </EuiFlexItem>
+      )}
+
+      <EuiFlexItem grow={false}>
+        <EuiLink
+          data-test-subj={props['data-test-subj']}
+          {...linkProps}
+          color={color}
+          onClick={onClick}
+        >
+          <EuiFlexGroup wrap={false} responsive={false} gutterSize="m" alignItems="center">
+            {experimental && (
+              <EuiFlexItem grow={false}>
+                <ExperimentalBadge iconType="beaker" tooltipPosition="top" />
+              </EuiFlexItem>
+            )}
+            <EuiFlexItem>{label}</EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiLink>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/enable_hosts_view_page.tsx b/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/enable_hosts_view_page.tsx
index 07f73d5c5c360..886de82f1e9b8 100644
--- a/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/enable_hosts_view_page.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/enable_hosts_view_page.tsx
@@ -13,7 +13,7 @@ import { i18n } from '@kbn/i18n';
 import { useTrackPageview } from '@kbn/observability-plugin/public';
 import { MetricsPageTemplate } from '../../../page_template';
 import hostsLandingBeta from './hosts_landing_beta.svg';
-import { ExperimentalBadge } from '../experimental_badge';
+import { ExperimentalBadge } from '../../../../../components/experimental_badge';
 
 interface Props {
   actions?: ReactNode;
diff --git a/x-pack/plugins/infra/public/pages/metrics/hosts/index.tsx b/x-pack/plugins/infra/public/pages/metrics/hosts/index.tsx
index fcee32404d9d3..bd2594fe28d96 100644
--- a/x-pack/plugins/infra/public/pages/metrics/hosts/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/hosts/index.tsx
@@ -21,7 +21,7 @@ import { MetricsDataViewProvider } from './hooks/use_data_view';
 import { fullHeightContentStyles } from '../../../page_template.styles';
 import { UnifiedSearchProvider } from './hooks/use_unified_search';
 import { HostContainer } from './components/hosts_container';
-import { ExperimentalBadge } from './components/experimental_badge';
+import { ExperimentalBadge } from '../../../components/experimental_badge';
 
 const HOSTS_FEEDBACK_LINK = 'https://ela.st/host-feedback';
 
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/bottom_drawer.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/bottom_drawer.tsx
index 87c63cef36428..4ebaeb0d874b7 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/bottom_drawer.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/bottom_drawer.tsx
@@ -5,11 +5,13 @@
  * 2.0.
  */
 
-import React, { useCallback, useState, useEffect } from 'react';
+import React, { useCallback, useState, useEffect, useRef } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty, EuiPanel } from '@elastic/eui';
 import { euiStyled } from '@kbn/kibana-react-plugin/common';
 import { useUiTracker } from '@kbn/observability-plugin/public';
+import useLocalStorage from 'react-use/lib/useLocalStorage';
+import { TryItButton } from '../../../../components/try_it_button';
 import { useWaffleOptionsContext } from '../hooks/use_waffle_options';
 import { InfraFormatter } from '../../../../lib/lib';
 import { Timeline } from './timeline/timeline';
@@ -21,14 +23,41 @@ const hideHistory = i18n.translate('xpack.infra.hideHistory', {
   defaultMessage: 'Hide history',
 });
 
-const TRANSITION_MS = 300;
-
-export const BottomDrawer: React.FC<{
-  measureRef: (instance: HTMLElement | null) => void;
+interface Props {
   interval: string;
   formatter: InfraFormatter;
-  width: number;
-}> = ({ measureRef, width, interval, formatter, children }) => {
+  view: string;
+}
+
+const LOCAL_STORAGE_KEY = 'inventoryUI:k8sDashboardClicked';
+const KubernetesButton = () => {
+  const [clicked, setClicked] = useLocalStorage<boolean>(LOCAL_STORAGE_KEY, false);
+  const clickedRef = useRef<boolean | undefined>(clicked);
+  return (
+    <TryItButton
+      color={clickedRef.current ? 'primary' : 'accent'}
+      label={i18n.translate('xpack.infra.bottomDrawer.kubernetesDashboardsLink', {
+        defaultMessage: 'Kubernetes dashboards',
+      })}
+      data-test-subj="inventory-kubernetesDashboard-link"
+      link={{
+        app: 'dashboards',
+        hash: '/list',
+        search: {
+          _g: '()',
+          s: 'kubernetes tag:(Managed)',
+        },
+      }}
+      onClick={() => {
+        if (!clickedRef.current) {
+          setClicked(true);
+        }
+      }}
+      hideBadge={clickedRef.current}
+    />
+  );
+};
+export const BottomDrawer = ({ interval, formatter, view }: Props) => {
   const { timelineOpen, changeTimelineOpen } = useWaffleOptionsContext();
 
   const [isOpen, setIsOpen] = useState(Boolean(timelineOpen));
@@ -44,45 +73,55 @@ export const BottomDrawer: React.FC<{
     changeTimelineOpen(!isOpen);
   }, [isOpen, trackDrawerOpen, changeTimelineOpen]);
 
-  return (
-    <BottomActionContainer ref={isOpen ? measureRef : null} isOpen={isOpen} outerWidth={width}>
-      <BottomActionTopBar ref={isOpen ? null : measureRef}>
-        <EuiFlexItem grow={false}>
-          <ShowHideButton
-            aria-expanded={isOpen}
-            iconType={isOpen ? 'arrowDown' : 'arrowRight'}
-            onClick={onClick}
-            data-test-subj="toggleTimelineButton"
-          >
-            {isOpen ? hideHistory : showHistory}
-          </ShowHideButton>
-        </EuiFlexItem>
-      </BottomActionTopBar>
-      <EuiFlexGroup style={{ marginTop: 0 }}>
+  return view === 'table' ? (
+    <BottomPanel hasBorder={false} hasShadow={false} borderRadius="none" paddingSize="s">
+      <KubernetesButton />
+    </BottomPanel>
+  ) : (
+    <BottomActionContainer>
+      <StickyPanel borderRadius="none" paddingSize="s">
+        <EuiFlexGroup responsive={false} justifyContent="flexStart" alignItems="center">
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              aria-expanded={isOpen}
+              iconType={isOpen ? 'arrowDown' : 'arrowRight'}
+              onClick={onClick}
+              data-test-subj="toggleTimelineButton"
+            >
+              {isOpen ? hideHistory : showHistory}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <KubernetesButton />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </StickyPanel>
+      <EuiFlexGroup
+        style={{
+          maxHeight: isOpen ? '224px' : 0,
+          transition: 'max-height 0.15s ease',
+          overflow: 'hidden',
+        }}
+      >
         <Timeline isVisible={isOpen} interval={interval} yAxisFormatter={formatter} />
       </EuiFlexGroup>
     </BottomActionContainer>
   );
 };
 
-const BottomActionContainer = euiStyled.div<{ isOpen: boolean; outerWidth: number }>`
-  padding: ${(props) => props.theme.eui.euiSizeM} 0;
-  position: fixed;
+const BottomActionContainer = euiStyled.div`
+  position: sticky;
   bottom: 0;
-  right: 0;
-  transition: transform ${TRANSITION_MS}ms;
-  transform: translateY(${(props) => (props.isOpen ? 0 : '224px')});
-  width: ${(props) => props.outerWidth + 34}px;
+  left: 0;
+  background: ${(props) => props.theme.eui.euiColorGhost};
+  width: calc(100% + ${(props) => props.theme.eui.euiSizeL} * 2);
+  margin-left: -${(props) => props.theme.eui.euiSizeL};
 `; // Additional width comes from the padding on the EuiPageBody and inner nodes container
 
-const BottomActionTopBar = euiStyled(EuiFlexGroup).attrs({
-  justifyContent: 'spaceBetween',
-  alignItems: 'center',
-})`
- margin-bottom: 0;
- height: 48px;
+const BottomPanel = euiStyled(EuiPanel)`
+  padding: ${(props) => props.theme.eui.euiSizeL} 0;
 `;
 
-const ShowHideButton = euiStyled(EuiButtonEmpty).attrs({ size: 's' })`
-  width: 140px;
+const StickyPanel = euiStyled(EuiPanel)`
+  padding: 0 ${(props) => props.theme.eui.euiSizeL};
 `;
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/hosts_view_intro_panel.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/hosts_view_intro_panel.tsx
deleted file mode 100644
index 9fad879ecad96..0000000000000
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/hosts_view_intro_panel.tsx
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiBetaBadge, EuiLink } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { useLinkProps } from '@kbn/observability-plugin/public';
-import { css } from '@emotion/react';
-import { ExperimentalBadge } from '../../hosts/components/experimental_badge';
-
-export const HostViewIntroPanel = () => {
-  const link = useLinkProps({
-    app: 'metrics',
-    pathname: '/hosts',
-  });
-
-  return (
-    <EuiFlexGroup
-      responsive={false}
-      alignItems="center"
-      gutterSize="m"
-      css={css`
-        position: relative;
-        z-index: 100;
-      `}
-    >
-      <EuiFlexItem grow={false}>
-        <EuiBetaBadge
-          color={'accent'}
-          href={link.href ?? ''}
-          data-test-subj="inventory-hostsView-badge"
-          label={i18n.translate('xpack.infra.layout.tryIt', {
-            defaultMessage: 'Try it',
-          })}
-        />
-      </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <ExperimentalBadge iconType="beaker" tooltipPosition="top" />
-      </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <EuiLink data-test-subj="inventory-hostsView-link" {...link}>
-          {i18n.translate('xpack.infra.layout.hostsLandingPageLink', {
-            defaultMessage: 'Introducing a new Hosts analysis experience',
-          })}
-        </EuiLink>
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-};
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx
index 4bcf2c192d436..8938e1960d3d9 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx
@@ -7,9 +7,10 @@
 
 import React, { useCallback, useEffect, useState } from 'react';
 import useInterval from 'react-use/lib/useInterval';
-
+import { css } from '@emotion/react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { euiStyled } from '@kbn/kibana-react-plugin/common';
+import { i18n } from '@kbn/i18n';
 import { SnapshotNode } from '../../../../../common/http_api';
 import { SavedView } from '../../../../containers/saved_view/saved_view';
 import { AutoSizer } from '../../../../components/auto_sizer';
@@ -31,7 +32,7 @@ import { createLegend } from '../lib/create_legend';
 import { useWaffleViewState } from '../hooks/use_waffle_view_state';
 import { BottomDrawer } from './bottom_drawer';
 import { LegendControls } from './waffle/legend_controls';
-import { HostViewIntroPanel } from './hosts_view_intro_panel';
+import { TryItButton } from '../../../../components/try_it_button';
 
 interface Props {
   shouldLoadDefault: boolean;
@@ -141,92 +142,83 @@ export const Layout = React.memo(
     return (
       <>
         <PageContent>
-          <AutoSizer bounds>
-            {({ measureRef: pageMeasureRef, bounds: { width = 0 } }) => (
-              <MainContainer ref={pageMeasureRef}>
-                <AutoSizer bounds>
-                  {({
-                    measureRef: topActionMeasureRef,
-                    bounds: { height: topActionHeight = 0 },
-                  }) => (
-                    <>
-                      <TopActionContainer ref={topActionMeasureRef}>
-                        <EuiFlexGroup
-                          justifyContent="spaceBetween"
-                          alignItems="center"
-                          gutterSize="m"
-                        >
-                          <Toolbar nodeType={nodeType} currentTime={currentTime} />
-                          <EuiFlexGroup
-                            responsive={false}
-                            style={{ margin: 0, justifyContent: 'end' }}
-                          >
-                            {view === 'map' && (
-                              <EuiFlexItem grow={false}>
-                                <LegendControls
-                                  options={legend != null ? legend : DEFAULT_LEGEND}
-                                  dataBounds={dataBounds}
-                                  bounds={bounds}
-                                  autoBounds={autoBounds}
-                                  boundsOverride={boundsOverride}
-                                  onChange={handleLegendControlChange}
-                                />
-                              </EuiFlexItem>
-                            )}
-                            <EuiFlexItem grow={false}>
-                              <ViewSwitcher view={view} onChange={changeView} />
-                            </EuiFlexItem>
-                          </EuiFlexGroup>
-                        </EuiFlexGroup>
-                      </TopActionContainer>
-                      <HostViewIntroPanel />
-                      <AutoSizer bounds>
-                        {({ measureRef, bounds: { height = 0 } }) => (
-                          <>
-                            <NodesOverview
-                              nodes={nodes}
-                              options={options}
-                              nodeType={nodeType}
-                              loading={loading}
-                              showLoading={showLoading}
-                              reload={reload}
-                              onDrilldown={applyFilterQuery}
-                              currentTime={currentTime}
-                              view={view}
-                              autoBounds={autoBounds}
-                              boundsOverride={boundsOverride}
-                              formatter={formatter}
-                              bottomMargin={height}
-                              topMargin={topActionHeight}
-                            />
-                            {view === 'map' && (
-                              <BottomDrawer
-                                measureRef={measureRef}
-                                interval={interval}
-                                formatter={formatter}
-                                width={width}
-                              />
-                            )}
-                          </>
-                        )}
-                      </AutoSizer>
-                    </>
+          <EuiFlexGroup direction="column" gutterSize="s">
+            <TopActionContainer grow={false}>
+              <EuiFlexGroup justifyContent="spaceBetween" alignItems="center" gutterSize="m">
+                <Toolbar nodeType={nodeType} currentTime={currentTime} />
+                <EuiFlexGroup
+                  responsive={false}
+                  css={css`
+                    margin: 0;
+                    justifycontent: 'end';
+                  `}
+                >
+                  {view === 'map' && (
+                    <EuiFlexItem grow={false}>
+                      <LegendControls
+                        options={legend != null ? legend : DEFAULT_LEGEND}
+                        dataBounds={dataBounds}
+                        bounds={bounds}
+                        autoBounds={autoBounds}
+                        boundsOverride={boundsOverride}
+                        onChange={handleLegendControlChange}
+                      />
+                    </EuiFlexItem>
                   )}
-                </AutoSizer>
-              </MainContainer>
-            )}
-          </AutoSizer>
+                  <EuiFlexItem grow={false}>
+                    <ViewSwitcher view={view} onChange={changeView} />
+                  </EuiFlexItem>
+                </EuiFlexGroup>
+              </EuiFlexGroup>
+            </TopActionContainer>
+            <EuiFlexItem grow={false}>
+              <TryItButton
+                data-test-subj="inventory-hostsView-link"
+                label={i18n.translate('xpack.infra.layout.hostsLandingPageLink', {
+                  defaultMessage: 'Introducing a new Hosts analysis experience',
+                })}
+                link={{
+                  app: 'metrics',
+                  pathname: '/hosts',
+                }}
+                experimental
+              />
+            </EuiFlexItem>
+            <EuiFlexItem
+              grow={false}
+              css={css`
+                position: relative;
+                flex: 1 1 auto;
+              `}
+            >
+              <AutoSizer bounds>
+                {({ bounds: { height = 0 } }) => (
+                  <NodesOverview
+                    nodes={nodes}
+                    options={options}
+                    nodeType={nodeType}
+                    loading={loading}
+                    showLoading={showLoading}
+                    reload={reload}
+                    onDrilldown={applyFilterQuery}
+                    currentTime={currentTime}
+                    view={view}
+                    autoBounds={autoBounds}
+                    boundsOverride={boundsOverride}
+                    formatter={formatter}
+                    bottomMargin={height}
+                  />
+                )}
+              </AutoSizer>
+            </EuiFlexItem>
+          </EuiFlexGroup>
         </PageContent>
+        <BottomDrawer interval={interval} formatter={formatter} view={view} />
       </>
     );
   }
 );
 
-const MainContainer = euiStyled.div`
-  position: relative;
-  flex: 1 1 auto;
-`;
-
-const TopActionContainer = euiStyled.div`
-  padding: ${(props) => `12px ${props.theme.eui.euiSizeM}`};
+const TopActionContainer = euiStyled(EuiFlexItem)`
+  padding: ${(props) => `${props.theme.eui.euiSizeM} 0`};
 `;
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/nodes_overview.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/nodes_overview.tsx
index 0e6a47b2417c7..c7d5e425efbab 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/nodes_overview.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/nodes_overview.tsx
@@ -38,7 +38,6 @@ interface Props {
   autoBounds: boolean;
   formatter: InfraFormatter;
   bottomMargin: number;
-  topMargin: number;
   showLoading: boolean;
 }
 
@@ -55,7 +54,6 @@ export const NodesOverview = ({
   formatter,
   onDrilldown,
   bottomMargin,
-  topMargin,
   showLoading,
 }: Props) => {
   const currentBreakpoint = useCurrentEuiBreakpoint();
@@ -121,7 +119,7 @@ export const NodesOverview = ({
     );
   }
   return (
-    <MapContainer top={topMargin} positionStatic={isStatic}>
+    <MapContainer positionStatic={isStatic}>
       <Map
         nodeType={nodeType}
         nodes={nodes}
@@ -148,10 +146,10 @@ const TableContainer = euiStyled.div`
   padding: ${(props) => props.theme.eui.euiSizeL};
 `;
 
-const MapContainer = euiStyled.div<{ top: number; positionStatic: boolean }>`
+const MapContainer = euiStyled.div<{ positionStatic: boolean }>`
   position: ${(props) => (props.positionStatic ? 'static' : 'absolute')};
   display: flex;
-  top: ${(props) => props.top}px;
+  top: 0;
   right: 0;
   bottom: 0;
   left: 0;
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/map.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/map.tsx
index a4558d6a7e9b0..6a0a6dad79eab 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/map.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/map.tsx
@@ -115,5 +115,4 @@ const WaffleMapInnerContainer = euiStyled.div`
   flex-wrap: wrap;
   justify-content: center;
   align-content: flex-start;
-  padding: 10px;
 `;
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/index.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/index.tsx
index fde2a4923441d..d0f7e56cf17c8 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/index.tsx
@@ -9,6 +9,7 @@ import { EuiErrorBoundary } from '@elastic/eui';
 import React from 'react';
 import { useTrackPageview } from '@kbn/observability-plugin/public';
 import { APP_WRAPPER_CLASS } from '@kbn/core/public';
+import { css } from '@emotion/react';
 import { FilterBar } from './components/filter_bar';
 import { SourceErrorPage } from '../../../components/source_error_page';
 import { SourceLoadingPage } from '../../../components/source_loading_page';
@@ -64,7 +65,10 @@ export const SnapshotPage = () => {
                 }}
                 pageSectionProps={{
                   contentProps: {
-                    css: fullHeightContentStyles,
+                    css: css`
+                      ${fullHeightContentStyles};
+                      padding-bottom: 0;
+                    `,
                   },
                 }}
               >
diff --git a/x-pack/test/functional/page_objects/infra_home_page.ts b/x-pack/test/functional/page_objects/infra_home_page.ts
index a13c9a89ae0cb..68d69832caf3b 100644
--- a/x-pack/test/functional/page_objects/infra_home_page.ts
+++ b/x-pack/test/functional/page_objects/infra_home_page.ts
@@ -163,7 +163,12 @@ export function InfraHomePageProvider({ getService, getPageObjects }: FtrProvide
 
     async closeTimeline() {
       await testSubjects.click('toggleTimelineButton');
-      await testSubjects.existOrFail('timelineContainerClosed');
+      const timelineSelectorsVisible = await Promise.all([
+        testSubjects.exists('timelineContainerClosed'),
+        testSubjects.exists('timelineContainerOpen'),
+      ]);
+
+      return timelineSelectorsVisible.every((visible) => !visible);
     },
 
     async openInvenotrySwitcher() {
diff --git a/x-pack/test/functional/page_objects/infra_hosts_view.ts b/x-pack/test/functional/page_objects/infra_hosts_view.ts
index e5c30934146d6..ddc7f24029d46 100644
--- a/x-pack/test/functional/page_objects/infra_hosts_view.ts
+++ b/x-pack/test/functional/page_objects/infra_hosts_view.ts
@@ -16,7 +16,7 @@ export function InfraHostsViewProvider({ getService }: FtrProviderContext) {
     },
 
     async clickTryHostViewBadge() {
-      return await testSubjects.click('inventory-hostsView-badge');
+      return await testSubjects.click('inventory-hostsView-link-badge');
     },
 
     async getHostsLandingPageDisabled() {

From b31b18d93d8a4dd1bcb0235cd47ce14aa04cbc99 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 7 Feb 2023 11:21:03 +0100
Subject: [PATCH 041/134] Update react-query to ^4.24.4 (main) (#150348)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [@tanstack/react-query](https://tanstack.com/query)
([source](https://togithub.com/tanstack/query)) | [`^4.24.2` ->
`^4.24.4`](https://renovatebot.com/diffs/npm/@tanstack%2freact-query/4.24.4/4.24.4)
|
[![age](https://badges.renovateapi.com/packages/npm/@tanstack%2freact-query/4.24.4/age-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://badges.renovateapi.com/packages/npm/@tanstack%2freact-query/4.24.4/adoption-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://badges.renovateapi.com/packages/npm/@tanstack%2freact-query/4.24.4/compatibility-slim/4.24.4)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://badges.renovateapi.com/packages/npm/@tanstack%2freact-query/4.24.4/confidence-slim/4.24.4)](https://docs.renovatebot.com/merge-confidence/)
|
| [@tanstack/react-query-devtools](https://tanstack.com/query)
([source](https://togithub.com/tanstack/query)) | [`^4.24.2` ->
`^4.24.4`](https://renovatebot.com/diffs/npm/@tanstack%2freact-query-devtools/4.24.4/4.24.4)
|
[![age](https://badges.renovateapi.com/packages/npm/@tanstack%2freact-query-devtools/4.24.4/age-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://badges.renovateapi.com/packages/npm/@tanstack%2freact-query-devtools/4.24.4/adoption-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://badges.renovateapi.com/packages/npm/@tanstack%2freact-query-devtools/4.24.4/compatibility-slim/4.24.4)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://badges.renovateapi.com/packages/npm/@tanstack%2freact-query-devtools/4.24.4/confidence-slim/4.24.4)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/elastic/kibana).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC4xMjQuMiIsInVwZGF0ZWRJblZlciI6IjM0LjEyNC4yIn0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package.json | 4 ++--
 yarn.lock    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 23fd401733c3c..04f0e1035325b 100644
--- a/package.json
+++ b/package.json
@@ -424,8 +424,8 @@
     "@opentelemetry/semantic-conventions": "^1.4.0",
     "@reduxjs/toolkit": "1.7.2",
     "@slack/webhook": "^5.0.4",
-    "@tanstack/react-query": "^4.24.2",
-    "@tanstack/react-query-devtools": "^4.24.2",
+    "@tanstack/react-query": "^4.24.4",
+    "@tanstack/react-query-devtools": "^4.24.4",
     "@turf/along": "6.0.1",
     "@turf/area": "6.0.1",
     "@turf/bbox": "6.0.1",
diff --git a/yarn.lock b/yarn.lock
index 8019abe753c62..4613bc8853a69 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6278,7 +6278,7 @@
   resolved "https://registry.yarnpkg.com/@tanstack/query-core/-/query-core-4.24.4.tgz#6fe78777286fdd805ac319c7c743df4935e18ee2"
   integrity sha512-9dqjv9eeB6VHN7lD3cLo16ZAjfjCsdXetSAD5+VyKqLUvcKTL0CklGQRJu+bWzdrS69R6Ea4UZo8obHYZnG6aA==
 
-"@tanstack/react-query-devtools@^4.24.2":
+"@tanstack/react-query-devtools@^4.24.4":
   version "4.24.4"
   resolved "https://registry.yarnpkg.com/@tanstack/react-query-devtools/-/react-query-devtools-4.24.4.tgz#5f0bd45f929950ff2b56a1a3ed18a006780e3495"
   integrity sha512-4mldcR99QDX8k94I+STM9gPsYF+FDAD2EQJvHtxR2HrDNegbfmY474xuW0QUZaNW/vJi09Gak6b6Vy2INWhL6w==
@@ -6287,7 +6287,7 @@
     superjson "^1.10.0"
     use-sync-external-store "^1.2.0"
 
-"@tanstack/react-query@^4.24.2":
+"@tanstack/react-query@^4.24.4":
   version "4.24.4"
   resolved "https://registry.yarnpkg.com/@tanstack/react-query/-/react-query-4.24.4.tgz#79e892edac33d8aa394795390c0f79e4a8c9be4d"
   integrity sha512-RpaS/3T/a3pHuZJbIAzAYRu+1nkp+/enr9hfRXDS/mojwx567UiMksoqW4wUFWlwIvWTXyhot2nbIipTKEg55Q==

From c25da5920dac3233f7327d373b75ed1061ff7429 Mon Sep 17 00:00:00 2001
From: Sander Philipse <94373878+sphilipse@users.noreply.github.com>
Date: Tue, 7 Feb 2023 11:26:35 +0100
Subject: [PATCH 042/134] [Enterprise Search] Check in progress syncs for
 connector (#150362)

## Summary

This adds a warning about in-progress syncs, and cancels any that exist
when deleting a connector.
---
 .../api/connector/cancel_syncs_api_logic.ts   |  4 +-
 .../api/index/fetch_index_api_logic.ts        | 10 ++-
 .../search_index/index_view_logic.ts          |  9 +--
 .../search_indices/delete_index_modal.tsx     | 71 +++++++++++++++++--
 .../search_indices/indices_logic.test.ts      | 16 ++++-
 .../search_indices/indices_logic.ts           | 56 ++++++++++++---
 .../lib/connectors/add_connector.test.ts      |  8 +--
 .../lib/connectors/delete_connector.test.ts   | 16 +++--
 .../server/lib/connectors/delete_connector.ts | 10 ++-
 .../lib/connectors/post_cancel_syncs.test.ts  |  4 +-
 .../lib/connectors/post_cancel_syncs.ts       |  4 +-
 .../server/lib/indices/fetch_index.test.ts    |  9 ++-
 .../server/lib/indices/fetch_index.ts         | 29 +++++++-
 13 files changed, 205 insertions(+), 41 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/connector/cancel_syncs_api_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/connector/cancel_syncs_api_logic.ts
index 53324ceb9f635..b4f1b349f44f5 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/connector/cancel_syncs_api_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/connector/cancel_syncs_api_logic.ts
@@ -7,7 +7,7 @@
 
 import { i18n } from '@kbn/i18n';
 
-import { createApiLogic } from '../../../shared/api_logic/create_api_logic';
+import { Actions, createApiLogic } from '../../../shared/api_logic/create_api_logic';
 import { HttpLogic } from '../../../shared/http';
 
 export interface CancelSyncsApiArgs {
@@ -25,3 +25,5 @@ export const CancelSyncsApiLogic = createApiLogic(['cancel_syncs_api_logic'], ca
       defaultMessage: 'Successfully canceled syncs',
     }),
 });
+
+export type CancelSyncsActions = Actions<CancelSyncsApiArgs, {}>;
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/index/fetch_index_api_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/index/fetch_index_api_logic.ts
index 9ba818bc6c57a..e8d67f6228889 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/index/fetch_index_api_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/api/index/fetch_index_api_logic.ts
@@ -6,24 +6,28 @@
  */
 
 import { ElasticsearchIndexWithIngestion } from '../../../../../common/types/indices';
-import { createApiLogic } from '../../../shared/api_logic/create_api_logic';
+import { Actions, createApiLogic } from '../../../shared/api_logic/create_api_logic';
 import { HttpLogic } from '../../../shared/http';
 
 export interface FetchIndexApiParams {
   indexName: string;
 }
 
-export type FetchIndexApiResponse = ElasticsearchIndexWithIngestion;
+export type FetchIndexApiResponse = ElasticsearchIndexWithIngestion & {
+  has_in_progress_syncs?: boolean;
+};
 
 export const fetchIndex = async ({
   indexName,
 }: FetchIndexApiParams): Promise<FetchIndexApiResponse> => {
   const route = `/internal/enterprise_search/indices/${indexName}`;
 
-  return await HttpLogic.values.http.get<ElasticsearchIndexWithIngestion>(route);
+  return await HttpLogic.values.http.get<FetchIndexApiResponse>(route);
 };
 
 export const FetchIndexApiLogic = createApiLogic(['fetch_index_api_logic'], fetchIndex, {
   clearFlashMessagesOnMakeRequest: false,
   showErrorFlash: false,
 });
+
+export type FetchIndexActions = Actions<FetchIndexApiParams, FetchIndexApiResponse>;
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/index_view_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/index_view_logic.ts
index 4ed5b7cef1b41..b89e122f03c7f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/index_view_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/index_view_logic.ts
@@ -16,7 +16,6 @@ import {
   IngestPipelineParams,
   SyncStatus,
 } from '../../../../../common/types/connectors';
-import { ElasticsearchIndexWithIngestion } from '../../../../../common/types/indices';
 import { Actions } from '../../../shared/api_logic/create_api_logic';
 import { flashSuccessToast } from '../../../shared/flash_messages';
 
@@ -26,6 +25,7 @@ import {
   CachedFetchIndexApiLogicActions,
 } from '../../api/index/cached_fetch_index_api_logic';
 
+import { FetchIndexApiResponse } from '../../api/index/fetch_index_api_logic';
 import { ElasticsearchViewIndex, IngestionMethod, IngestionStatus } from '../../types';
 import {
   getIngestionMethod,
@@ -232,11 +232,12 @@ export const IndexViewLogic = kea<MakeLogicType<IndexViewValues, IndexViewAction
     ],
     isConnectorIndex: [
       () => [selectors.indexData],
-      (data: ElasticsearchIndexWithIngestion | undefined) => isConnectorIndex(data),
+      (data: FetchIndexApiResponse | undefined) => isConnectorIndex(data),
     ],
     isSyncing: [
-      () => [selectors.syncStatus],
-      (syncStatus: SyncStatus) => syncStatus === SyncStatus.IN_PROGRESS,
+      () => [selectors.indexData, selectors.syncStatus],
+      (indexData: FetchIndexApiResponse | null, syncStatus: SyncStatus) =>
+        indexData?.has_in_progress_syncs || syncStatus === SyncStatus.IN_PROGRESS,
     ],
     isWaitingForSync: [
       () => [selectors.fetchIndexApiData, selectors.localSyncNowValue],
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/delete_index_modal.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/delete_index_modal.tsx
index c7b5ebaf66617..085aacbd59b03 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/delete_index_modal.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/delete_index_modal.tsx
@@ -5,11 +5,19 @@
  * 2.0.
  */
 
-import React from 'react';
+import React, { useState } from 'react';
 
 import { useActions, useValues } from 'kea';
 
-import { EuiConfirmModal } from '@elastic/eui';
+import {
+  EuiCallOut,
+  EuiConfirmModal,
+  EuiFieldText,
+  EuiForm,
+  EuiFormRow,
+  EuiSpacer,
+} from '@elastic/eui';
+
 import { i18n } from '@kbn/i18n';
 
 import { ingestionMethodToText } from '../../utils/indices';
@@ -20,10 +28,15 @@ export const DeleteIndexModal: React.FC = () => {
   const { closeDeleteModal, deleteIndex } = useActions(IndicesLogic);
   const {
     deleteModalIndexName: indexName,
+    deleteModalIndexHasInProgressSyncs,
     deleteModalIngestionMethod: ingestionMethod,
     isDeleteModalVisible,
     isDeleteLoading,
+    isFetchIndexDetailsLoading,
   } = useValues(IndicesLogic);
+
+  const [inputIndexName, setInputIndexName] = useState('');
+
   return isDeleteModalVisible ? (
     <EuiConfirmModal
       title={i18n.translate('xpack.enterpriseSearch.content.searchIndices.deleteModal.title', {
@@ -59,20 +72,70 @@ export const DeleteIndexModal: React.FC = () => {
       )}
       defaultFocusedButton="confirm"
       buttonColor="danger"
-      isLoading={isDeleteLoading}
+      confirmButtonDisabled={inputIndexName.trim() !== indexName}
+      isLoading={isDeleteLoading || isFetchIndexDetailsLoading}
     >
       <p>
         {i18n.translate(
           'xpack.enterpriseSearch.content.searchIndices.deleteModal.delete.description',
           {
             defaultMessage:
-              'Deleting this index will also delete all of its data and its {ingestionMethod} configuration. Any associated search engines will no longer be able to access any data stored in this index.This can not be undone.',
+              'Deleting this index will also delete all of its data and its {ingestionMethod} configuration. Any associated search engines will no longer be able to access any data stored in this index.',
             values: {
               ingestionMethod: ingestionMethodToText(ingestionMethod),
             },
           }
         )}
       </p>
+      {deleteModalIndexHasInProgressSyncs && (
+        <>
+          <EuiCallOut
+            color="warning"
+            iconType="alert"
+            title={i18n.translate(
+              'xpack.enterpriseSearch.content.searchIndices.deleteModal.syncsWarning.title',
+              {
+                defaultMessage: 'Syncs in progress',
+              }
+            )}
+          >
+            <p>
+              {i18n.translate(
+                'xpack.enterpriseSearch.content.searchIndices.deleteModal.syncsWarning.description',
+                {
+                  defaultMessage:
+                    'This index has in-progress syncs. Deleting the index without stopping these syncs may result in dangling sync job records or the index being re-created.',
+                }
+              )}
+            </p>
+          </EuiCallOut>
+          <EuiSpacer />
+        </>
+      )}
+      <p>
+        {i18n.translate(
+          'xpack.enterpriseSearch.content.searchIndices.deleteModal.syncsWarning.indexNameDescription',
+          {
+            defaultMessage: 'This action cannot be undone. Please type {indexName} to confirm.',
+            values: { indexName },
+          }
+        )}
+      </p>
+      <EuiForm>
+        <EuiFormRow
+          label={i18n.translate(
+            'xpack.enterpriseSearch.content.searchIndices.deleteModal.indexNameInput.label',
+            {
+              defaultMessage: 'Index name',
+            }
+          )}
+        >
+          <EuiFieldText
+            onChange={(e) => setInputIndexName(e.target.value)}
+            value={inputIndexName}
+          />
+        </EuiFormRow>
+      </EuiForm>
     </EuiConfirmModal>
   ) : (
     <></>
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_logic.test.ts
index acf1eaa9f8331..16ee5faff914a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_logic.test.ts
@@ -29,13 +29,17 @@ import { IndicesLogic } from './indices_logic';
 const DEFAULT_VALUES = {
   data: undefined,
   deleteModalIndex: null,
+  deleteModalIndexHasInProgressSyncs: false,
   deleteModalIndexName: '',
   deleteModalIngestionMethod: IngestionMethod.API,
   deleteStatus: Status.IDLE,
   hasNoIndices: false,
+  indexDetails: undefined,
+  indexDetailsStatus: 0,
   indices: [],
   isDeleteLoading: false,
   isDeleteModalVisible: false,
+  isFetchIndexDetailsLoading: true,
   isFirstRequest: true,
   isLoading: true,
   meta: DEFAULT_META,
@@ -80,21 +84,27 @@ describe('IndicesLogic', () => {
     });
     describe('openDeleteModal', () => {
       it('should set deleteIndexName and set isDeleteModalVisible to true', () => {
+        IndicesLogic.actions.fetchIndexDetails = jest.fn();
         IndicesLogic.actions.openDeleteModal(connectorIndex);
         expect(IndicesLogic.values).toEqual({
           ...DEFAULT_VALUES,
-          deleteModalIndex: connectorIndex,
           deleteModalIndexName: 'connector',
-          deleteModalIngestionMethod: IngestionMethod.CONNECTOR,
           isDeleteModalVisible: true,
         });
+        expect(IndicesLogic.actions.fetchIndexDetails).toHaveBeenCalledWith({
+          indexName: 'connector',
+        });
       });
     });
     describe('closeDeleteModal', () => {
       it('should set deleteIndexName to empty and set isDeleteModalVisible to false', () => {
         IndicesLogic.actions.openDeleteModal(connectorIndex);
+        IndicesLogic.actions.fetchIndexDetails = jest.fn();
         IndicesLogic.actions.closeDeleteModal();
-        expect(IndicesLogic.values).toEqual(DEFAULT_VALUES);
+        expect(IndicesLogic.values).toEqual({
+          ...DEFAULT_VALUES,
+          indexDetailsStatus: Status.LOADING,
+        });
       });
     });
   });
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_logic.ts
index 282566637e103..953fce853904b 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_logic.ts
@@ -13,11 +13,20 @@ import { ElasticsearchIndexWithIngestion } from '../../../../../common/types/ind
 import { Actions } from '../../../shared/api_logic/create_api_logic';
 import { DEFAULT_META } from '../../../shared/constants';
 import { updateMetaPageIndex } from '../../../shared/table_pagination';
+import {
+  CancelSyncsActions,
+  CancelSyncsApiLogic,
+} from '../../api/connector/cancel_syncs_api_logic';
 import {
   DeleteIndexApiLogic,
   DeleteIndexApiLogicArgs,
   DeleteIndexApiLogicValues,
 } from '../../api/index/delete_index_api_logic';
+import {
+  FetchIndexActions,
+  FetchIndexApiLogic,
+  FetchIndexApiResponse,
+} from '../../api/index/fetch_index_api_logic';
 import { FetchIndicesAPILogic } from '../../api/index/fetch_indices_api_logic';
 import { ElasticsearchViewIndex, IngestionMethod } from '../../types';
 import { getIngestionMethod, indexToViewIndex } from '../../utils/indices';
@@ -43,10 +52,12 @@ export interface IndicesActions {
     returnHiddenIndices: boolean;
     searchQuery?: string;
   };
+  cancelSuccess: CancelSyncsActions['apiSuccess'];
   closeDeleteModal(): void;
   deleteError: Actions<DeleteIndexApiLogicArgs, DeleteIndexApiLogicValues>['apiError'];
   deleteIndex: Actions<DeleteIndexApiLogicArgs, DeleteIndexApiLogicValues>['makeRequest'];
   deleteSuccess: Actions<DeleteIndexApiLogicArgs, DeleteIndexApiLogicValues>['apiSuccess'];
+  fetchIndexDetails: FetchIndexActions['makeRequest'];
   fetchIndices({
     meta,
     returnHiddenIndices,
@@ -63,14 +74,18 @@ export interface IndicesActions {
 }
 export interface IndicesValues {
   data: typeof FetchIndicesAPILogic.values.data;
-  deleteModalIndex: ElasticsearchViewIndex | null;
+  deleteModalIndex: FetchIndexApiResponse | null;
+  deleteModalIndexHasInProgressSyncs: boolean;
   deleteModalIndexName: string;
   deleteModalIngestionMethod: IngestionMethod;
   deleteStatus: typeof DeleteIndexApiLogic.values.status;
   hasNoIndices: boolean;
+  indexDetails: FetchIndexApiResponse | null;
+  indexDetailsStatus: Status;
   indices: ElasticsearchViewIndex[];
   isDeleteLoading: boolean;
   isDeleteModalVisible: boolean;
+  isFetchIndexDetailsLoading: boolean;
   isFirstRequest: boolean;
   isLoading: boolean;
   meta: Meta;
@@ -92,12 +107,18 @@ export const IndicesLogic = kea<MakeLogicType<IndicesValues, IndicesActions>>({
   },
   connect: {
     actions: [
+      CancelSyncsApiLogic,
+      ['apiSuccess as cancelSuccess'],
+      FetchIndexApiLogic,
+      ['makeRequest as fetchIndexDetails'],
       FetchIndicesAPILogic,
       ['makeRequest', 'apiSuccess', 'apiError'],
       DeleteIndexApiLogic,
       ['apiError as deleteError', 'apiSuccess as deleteSuccess', 'makeRequest as deleteIndex'],
     ],
     values: [
+      FetchIndexApiLogic,
+      ['data as indexDetails', 'status as indexDetailsStatus'],
       FetchIndicesAPILogic,
       ['data', 'status'],
       DeleteIndexApiLogic,
@@ -105,6 +126,9 @@ export const IndicesLogic = kea<MakeLogicType<IndicesValues, IndicesActions>>({
     ],
   },
   listeners: ({ actions, values }) => ({
+    cancelSuccess: async () => {
+      actions.fetchIndexDetails({ indexName: values.deleteModalIndexName });
+    },
     deleteSuccess: () => {
       actions.closeDeleteModal();
       actions.fetchIndices(values.searchParams);
@@ -113,14 +137,17 @@ export const IndicesLogic = kea<MakeLogicType<IndicesValues, IndicesActions>>({
       await breakpoint(150);
       actions.makeRequest(input);
     },
+    openDeleteModal: ({ index }) => {
+      actions.fetchIndexDetails({ indexName: index.name });
+    },
   }),
   path: ['enterprise_search', 'content', 'indices_logic'],
   reducers: () => ({
-    deleteModalIndex: [
-      null,
+    deleteModalIndexName: [
+      '',
       {
-        closeDeleteModal: () => null,
-        openDeleteModal: (_, { index }) => index,
+        closeDeleteModal: () => '',
+        openDeleteModal: (_, { index: { name } }) => name,
       },
     ],
     isDeleteModalVisible: [
@@ -154,10 +181,18 @@ export const IndicesLogic = kea<MakeLogicType<IndicesValues, IndicesActions>>({
     ],
   }),
   selectors: ({ selectors }) => ({
-    deleteModalIndexName: [() => [selectors.deleteModalIndex], (index) => index?.name ?? ''],
-    deleteModalIngestionMethod: [
+    deleteModalIndex: [
+      () => [selectors.deleteModalIndexName, selectors.indexDetails],
+      (indexName: string, indexDetails: FetchIndexApiResponse | null) =>
+        indexName === indexDetails?.name ? indexDetails : null,
+    ],
+    deleteModalIndexHasInProgressSyncs: [
       () => [selectors.deleteModalIndex],
-      (index: ElasticsearchViewIndex | null) =>
+      (index: FetchIndexApiResponse | null) => (index ? index.has_in_progress_syncs : false),
+    ],
+    deleteModalIngestionMethod: [
+      () => [selectors.indexDetails],
+      (index: FetchIndexApiResponse | null) =>
         index ? getIngestionMethod(index) : IngestionMethod.API,
     ],
     hasNoIndices: [
@@ -174,6 +209,11 @@ export const IndicesLogic = kea<MakeLogicType<IndicesValues, IndicesActions>>({
       () => [selectors.deleteStatus],
       (status: IndicesValues['deleteStatus']) => [Status.LOADING].includes(status),
     ],
+    isFetchIndexDetailsLoading: [
+      () => [selectors.indexDetailsStatus],
+      (status: IndicesValues['indexDetailsStatus']) =>
+        [Status.IDLE, Status.LOADING].includes(status),
+    ],
     isLoading: [
       () => [selectors.status, selectors.isFirstRequest],
       (status, isFirstRequest) => [Status.LOADING, Status.IDLE].includes(status) && isFirstRequest,
diff --git a/x-pack/plugins/enterprise_search/server/lib/connectors/add_connector.test.ts b/x-pack/plugins/enterprise_search/server/lib/connectors/add_connector.test.ts
index e6584c0a8b205..d51db7398d146 100644
--- a/x-pack/plugins/enterprise_search/server/lib/connectors/add_connector.test.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/connectors/add_connector.test.ts
@@ -17,6 +17,7 @@ import { fetchCrawlerByIndexName } from '../crawler/fetch_crawlers';
 import { textAnalysisSettings } from '../indices/text_analysis';
 
 import { addConnector } from './add_connector';
+import { deleteConnectorById } from './delete_connector';
 import { fetchConnectorByIndexName } from './fetch_connectors';
 
 jest.mock('../../index_management/setup_indices', () => ({
@@ -24,12 +25,12 @@ jest.mock('../../index_management/setup_indices', () => ({
 }));
 
 jest.mock('./fetch_connectors', () => ({ fetchConnectorByIndexName: jest.fn() }));
+jest.mock('./delete_connector', () => ({ deleteConnectorById: jest.fn() }));
 jest.mock('../crawler/fetch_crawlers', () => ({ fetchCrawlerByIndexName: jest.fn() }));
 
 describe('addConnector lib function', () => {
   const mockClient = {
     asCurrentUser: {
-      delete: jest.fn(),
       index: jest.fn(),
       indices: {
         create: jest.fn(),
@@ -262,10 +263,7 @@ describe('addConnector lib function', () => {
         language: null,
       })
     ).resolves.toEqual({ id: 'fakeId', index_name: 'index_name' });
-    expect(mockClient.asCurrentUser.delete).toHaveBeenCalledWith({
-      id: 'connectorId',
-      index: CONNECTORS_INDEX,
-    });
+    expect(deleteConnectorById).toHaveBeenCalledWith(mockClient, 'connectorId');
     expect(mockClient.asCurrentUser.index).toHaveBeenCalledWith({
       document: {
         api_key_id: null,
diff --git a/x-pack/plugins/enterprise_search/server/lib/connectors/delete_connector.test.ts b/x-pack/plugins/enterprise_search/server/lib/connectors/delete_connector.test.ts
index 4e43667c4063b..0ce9e53632835 100644
--- a/x-pack/plugins/enterprise_search/server/lib/connectors/delete_connector.test.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/connectors/delete_connector.test.ts
@@ -11,6 +11,11 @@ import { CONNECTORS_INDEX } from '../..';
 
 import { deleteConnectorById } from './delete_connector';
 
+jest.mock('./post_cancel_syncs', () => ({
+  cancelSyncs: jest.fn(),
+}));
+import { cancelSyncs } from './post_cancel_syncs';
+
 describe('deleteConnector lib function', () => {
   const mockClient = {
     asCurrentUser: {
@@ -21,16 +26,19 @@ describe('deleteConnector lib function', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    jest.useFakeTimers();
   });
 
-  it('should delete connector', async () => {
+  it('should delete connector and cancel syncs', async () => {
     mockClient.asCurrentUser.delete.mockImplementation(() => true);
-    await expect(
-      deleteConnectorById(mockClient as unknown as IScopedClusterClient, 'connectorId')
-    ).resolves.toEqual(true);
+
+    await deleteConnectorById(mockClient as unknown as IScopedClusterClient, 'connectorId');
+    expect(cancelSyncs as jest.Mock).toHaveBeenCalledWith(mockClient, 'connectorId');
     expect(mockClient.asCurrentUser.delete).toHaveBeenCalledWith({
       id: 'connectorId',
       index: CONNECTORS_INDEX,
+      refresh: 'wait_for',
     });
+    jest.useRealTimers();
   });
 });
diff --git a/x-pack/plugins/enterprise_search/server/lib/connectors/delete_connector.ts b/x-pack/plugins/enterprise_search/server/lib/connectors/delete_connector.ts
index 1ea6af4dd74d3..cd935f32c2c15 100644
--- a/x-pack/plugins/enterprise_search/server/lib/connectors/delete_connector.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/connectors/delete_connector.ts
@@ -9,6 +9,14 @@ import { IScopedClusterClient } from '@kbn/core/server';
 
 import { CONNECTORS_INDEX } from '../..';
 
+import { cancelSyncs } from './post_cancel_syncs';
+
 export const deleteConnectorById = async (client: IScopedClusterClient, id: string) => {
-  return await client.asCurrentUser.delete({ id, index: CONNECTORS_INDEX });
+  // timeout function to mitigate race condition with external connector running job and recreating index
+  const timeout = async () => {
+    const promise = new Promise((resolve) => setTimeout(resolve, 500));
+    return promise;
+  };
+  await Promise.all([cancelSyncs(client, id), timeout]);
+  return await client.asCurrentUser.delete({ id, index: CONNECTORS_INDEX, refresh: 'wait_for' });
 };
diff --git a/x-pack/plugins/enterprise_search/server/lib/connectors/post_cancel_syncs.test.ts b/x-pack/plugins/enterprise_search/server/lib/connectors/post_cancel_syncs.test.ts
index adac70f88276c..be8a295398bbb 100644
--- a/x-pack/plugins/enterprise_search/server/lib/connectors/post_cancel_syncs.test.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/connectors/post_cancel_syncs.test.ts
@@ -52,7 +52,6 @@ describe('addConnector lib function', () => {
           ],
         },
       },
-      refresh: true,
       script: {
         lang: 'painless',
         source: `ctx._source['status'] = '${SyncStatus.CANCELED}';
@@ -79,7 +78,6 @@ ctx._source['completed_at'] = '${new Date(Date.now()).toISOString()}';`,
           ],
         },
       },
-      refresh: true,
       script: {
         lang: 'painless',
         source: `ctx._source['status'] = '${SyncStatus.CANCELING}';
@@ -90,7 +88,7 @@ ctx._source['cancelation_requested_at'] = '${new Date(Date.now()).toISOString()}
       doc: { last_sync_status: SyncStatus.CANCELED, sync_now: false },
       id: 'connectorId',
       index: CONNECTORS_INDEX,
-      refresh: true,
+      refresh: 'wait_for',
     });
   });
 });
diff --git a/x-pack/plugins/enterprise_search/server/lib/connectors/post_cancel_syncs.ts b/x-pack/plugins/enterprise_search/server/lib/connectors/post_cancel_syncs.ts
index d76a1df08ec50..eb9eefebb3c48 100644
--- a/x-pack/plugins/enterprise_search/server/lib/connectors/post_cancel_syncs.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/connectors/post_cancel_syncs.ts
@@ -32,7 +32,6 @@ export const cancelSyncs = async (
         ],
       },
     },
-    refresh: true,
     script: {
       lang: 'painless',
       source: `ctx._source['status'] = '${SyncStatus.CANCELED}';
@@ -59,7 +58,6 @@ ctx._source['completed_at'] = '${new Date(Date.now()).toISOString()}';`,
         ],
       },
     },
-    refresh: true,
     script: {
       lang: 'painless',
       source: `ctx._source['status'] = '${SyncStatus.CANCELING}';
@@ -70,6 +68,6 @@ ctx._source['cancelation_requested_at'] = '${new Date(Date.now()).toISOString()}
     doc: { last_sync_status: SyncStatus.CANCELED, sync_now: false },
     id: connectorId,
     index: CONNECTORS_INDEX,
-    refresh: true,
+    refresh: 'wait_for',
   });
 };
diff --git a/x-pack/plugins/enterprise_search/server/lib/indices/fetch_index.test.ts b/x-pack/plugins/enterprise_search/server/lib/indices/fetch_index.test.ts
index c9b4979d79a84..56831b5f651ec 100644
--- a/x-pack/plugins/enterprise_search/server/lib/indices/fetch_index.test.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/indices/fetch_index.test.ts
@@ -65,6 +65,7 @@ describe('fetchIndex lib function', () => {
   const result = {
     aliases: [],
     count: 100,
+    has_in_progress_syncs: false,
     health: 'green',
     hidden: false,
     name: 'index_name',
@@ -114,7 +115,11 @@ describe('fetchIndex lib function', () => {
 
     await expect(
       fetchIndex(mockClient as unknown as IScopedClusterClient, 'index_name')
-    ).resolves.toEqual({ ...result, connector: { doc: 'doc', service_type: 'some-service-type' } });
+    ).resolves.toEqual({
+      ...result,
+      connector: { doc: 'doc', service_type: 'some-service-type' },
+      has_in_progress_syncs: true,
+    });
   });
 
   it('should return data and stats for index and crawler if crawler is present', async () => {
@@ -144,6 +149,7 @@ describe('fetchIndex lib function', () => {
   });
 
   it('should return data and stats for index and crawler if a crawler registered as a connector is present', async () => {
+    mockClient.asCurrentUser.count.mockReturnValue({ count: 0 });
     mockClient.asCurrentUser.indices.get.mockImplementation(() =>
       Promise.resolve({
         index_name: { aliases: [], data: 'full index' },
@@ -167,6 +173,7 @@ describe('fetchIndex lib function', () => {
     ).resolves.toEqual({
       ...result,
       connector: { doc: 'doc', service_type: ENTERPRISE_SEARCH_CONNECTOR_CRAWLER_SERVICE_TYPE },
+      count: 0,
       crawler: { id: '1234' },
     });
   });
diff --git a/x-pack/plugins/enterprise_search/server/lib/indices/fetch_index.ts b/x-pack/plugins/enterprise_search/server/lib/indices/fetch_index.ts
index 140a1180360ed..7549d59da6ffc 100644
--- a/x-pack/plugins/enterprise_search/server/lib/indices/fetch_index.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/indices/fetch_index.ts
@@ -7,13 +7,34 @@
 
 import { IScopedClusterClient } from '@kbn/core/server';
 
+import { CONNECTORS_JOBS_INDEX } from '../..';
+
 import { ENTERPRISE_SEARCH_CONNECTOR_CRAWLER_SERVICE_TYPE } from '../../../common/constants';
+import { SyncStatus } from '../../../common/types/connectors';
 import { ElasticsearchIndexWithIngestion } from '../../../common/types/indices';
 import { fetchConnectorByIndexName } from '../connectors/fetch_connectors';
 import { fetchCrawlerByIndexName } from '../crawler/fetch_crawlers';
 
 import { mapIndexStats } from './utils/map_index_stats';
 
+const hasInProgressSyncs = async (
+  client: IScopedClusterClient,
+  connectorId: string
+): Promise<boolean> => {
+  const inProgressCount = await client.asCurrentUser.count({
+    index: CONNECTORS_JOBS_INDEX,
+    query: {
+      bool: {
+        filter: [
+          { term: { 'connector.id': connectorId } },
+          { term: { status: SyncStatus.IN_PROGRESS } },
+        ],
+      },
+    },
+  });
+  return inProgressCount.count > 0;
+};
+
 export const fetchIndex = async (
   client: IScopedClusterClient,
   index: string
@@ -28,12 +49,18 @@ export const fetchIndex = async (
     throw new Error('404');
   }
   const indexStats = indices[index];
+
+  const connector = await fetchConnectorByIndexName(client, index);
+  const hasInProgressSyncsResult = connector
+    ? await hasInProgressSyncs(client, connector.id)
+    : false;
+
   const indexResult = {
     count,
     ...mapIndexStats(indexData, indexStats, index),
+    has_in_progress_syncs: hasInProgressSyncsResult,
   };
 
-  const connector = await fetchConnectorByIndexName(client, index);
   if (connector && connector.service_type !== ENTERPRISE_SEARCH_CONNECTOR_CRAWLER_SERVICE_TYPE) {
     return {
       ...indexResult,

From ec192acac2298b467861df929e0b7bec3227956b Mon Sep 17 00:00:00 2001
From: James Gowdy <jgowdy@elastic.co>
Date: Tue, 7 Feb 2023 10:53:36 +0000
Subject: [PATCH 043/134] [ML] Add a new memory usage by job and by model view
 (#149419)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a new Memory usage page to the ML app.
This contains the page which was originally called Nodes, under the
Model Management section, and introduces a new tree map chart to display
memory usage of jobs and trained models.


![image](https://user-images.githubusercontent.com/22172091/217040806-bf1b2d51-32ce-4801-8d8f-e27c3d7a9f62.png)


If kibana is running in a serverless environment, the Memory usage page
will only show the overall memory usage chart. There will be no
reference made to "nodes".

**Refactoring**
Organises related server side code under a `model_management` section.
Moves routes to a new `model_management` file.
Adds a new `isServerless` function to the client side to spoof
information we should son get from kibana to tell whether we are running
in a serverless environment.

---------

Co-authored-by: István Zoltán Szabó <istvan.szabo@elastic.co>
---
 x-pack/plugins/ml/common/constants/locator.ts |   2 +-
 x-pack/plugins/ml/common/types/locator.ts     |  10 +-
 .../plugins/ml/common/types/trained_models.ts |  45 +++
 x-pack/plugins/ml/public/application/app.tsx  |   7 +
 .../components/ml_page/ml_page.tsx            |   2 +-
 .../components/ml_page/side_nav.tsx           |  18 +-
 .../contexts/kibana/use_is_serverless.ts      |  14 +
 .../analytics_id_selector.tsx                 |   2 +-
 .../space_management/columns.tsx              |   2 +-
 .../public/application/memory_usage/index.ts  |   8 +
 .../memory_usage/memory_item_colors.ts        |  34 +++
 .../memory_usage/memory_tree_map/index.ts     |   9 +
 .../memory_tree_map/memory_page.tsx           |  26 ++
 .../memory_usage/memory_tree_map/tree_map.tsx | 201 +++++++++++++
 .../memory_usage/memory_usage_page.tsx        |  72 +++++
 .../nodes_overview/allocated_models.tsx       |   0
 .../nodes_overview/expanded_row.tsx           | 151 ++++++++++
 .../nodes_overview/index.ts                   |   0
 .../nodes_overview/memory_preview_chart.tsx   |  19 +-
 .../nodes_overview/nodes_list.tsx             |   4 +-
 .../delete_models_modal.tsx                   |   6 +-
 .../deployment_setup.tsx                      |   4 +-
 .../expanded_row.tsx                          |  37 ++-
 .../force_stop_dialog.tsx                     |   0
 .../index.ts                                  |   0
 .../model_actions.tsx                         |  16 +-
 .../model_link.tsx                            |   4 +-
 .../models_list.tsx                           |  26 +-
 .../pipelines/expanded_row.tsx                |   4 +-
 .../pipelines/index.ts                        |   0
 .../pipelines/pipelines.tsx                   |   2 +-
 .../test_models/index.ts                      |   0
 .../test_models/inference_error.tsx           |   0
 .../test_models/models/index.ts               |   0
 .../test_models/models/index_input.tsx        |   2 +-
 .../test_models/models/inference_base.ts      |   6 +-
 .../test_models/models/inference_info.tsx     |   0
 .../models/inference_input_form/index.tsx     |   0
 .../inference_input_form/index_input.tsx      |   2 +-
 .../inference_input_form.tsx                  |   0
 .../inference_input_form/text_input.tsx       |   2 +-
 .../test_models/models/ner/index.ts           |   0
 .../test_models/models/ner/ner_inference.ts   |   4 +-
 .../test_models/models/ner/ner_output.tsx     |   2 +-
 .../models/question_answering/index.ts        |   0
 .../question_answering_inference.ts           |   4 +-
 .../question_answering_input.tsx              |   0
 .../question_answering_output.tsx             |   2 +-
 .../test_models/models/raw_output.tsx         |   2 +-
 .../models/text_classification/common.ts      |   0
 .../fill_mask_inference.ts                    |   4 +-
 .../text_classification/fill_mask_output.tsx  |   0
 .../models/text_classification/index.ts       |   0
 .../models/text_classification/lang_codes.ts  |   0
 .../lang_ident_inference.ts                   |   2 +-
 .../text_classification/lang_ident_output.tsx |   0
 .../text_classification_inference.ts          |   4 +-
 .../text_classification_output.tsx            |   0
 .../zero_shot_classification_inference.ts     |   4 +-
 .../zero_shot_classification_input.tsx        |   0
 .../models/text_embedding/index.ts            |   0
 .../text_embedding_inference.ts               |   4 +-
 .../text_embedding/text_embedding_output.tsx  |   0
 .../test_models/models/text_input.tsx         |   0
 .../test_models/output_loading.tsx            |   0
 .../test_models/selected_model.tsx            |   4 +-
 .../test_models/test_flyout.tsx               |   2 +-
 .../test_models/utils.ts                      |   4 +-
 .../application/overview/overview_page.tsx    |   6 +-
 .../application/routing/routes/index.ts       |   1 +
 .../routing/routes/memory_usage.tsx           |  53 ++++
 .../routing/routes/trained_models/index.ts    |   1 -
 .../routes/trained_models/models_list.tsx     |   4 +-
 .../routes/trained_models/nodes_list.tsx      |  68 -----
 .../services/ml_api_service/trained_models.ts |  12 +-
 .../nodes_overview/expanded_row.tsx           | 113 -------
 .../locator/formatters/trained_models.ts      |  13 +-
 .../plugins/ml/public/locator/ml_locator.ts   |   6 +-
 .../search_deep_links.ts                      |   8 +-
 .../models/data_frame_analytics/index.ts      |   1 -
 .../data_frame_analytics/models_provider.ts   | 220 --------------
 .../__mocks__/mock_deployment_response.json   |   0
 .../server/models/model_management/index.ts   |   9 +
 .../memory_usage.test.ts}                     |  14 +-
 .../models/model_management/memory_usage.ts   | 277 ++++++++++++++++++
 .../model_management/models_provider.ts       |  55 ++++
 x-pack/plugins/ml/server/plugin.ts            |   2 +
 x-pack/plugins/ml/server/routes/apidoc.json   |   7 +-
 .../ml/server/routes/model_management.ts      |  98 +++++++
 .../ml/server/routes/schemas/saved_objects.ts |   1 +
 .../ml/server/routes/trained_models.ts        |  41 +--
 .../translations/translations/fr-FR.json      |   4 -
 .../translations/translations/ja-JP.json      |   4 -
 .../translations/translations/zh-CN.json      |   4 -
 94 files changed, 1215 insertions(+), 586 deletions(-)
 create mode 100644 x-pack/plugins/ml/public/application/contexts/kibana/use_is_serverless.ts
 create mode 100644 x-pack/plugins/ml/public/application/memory_usage/index.ts
 create mode 100644 x-pack/plugins/ml/public/application/memory_usage/memory_item_colors.ts
 create mode 100644 x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/index.ts
 create mode 100644 x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/memory_page.tsx
 create mode 100644 x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/tree_map.tsx
 create mode 100644 x-pack/plugins/ml/public/application/memory_usage/memory_usage_page.tsx
 rename x-pack/plugins/ml/public/application/{trained_models => memory_usage}/nodes_overview/allocated_models.tsx (100%)
 create mode 100644 x-pack/plugins/ml/public/application/memory_usage/nodes_overview/expanded_row.tsx
 rename x-pack/plugins/ml/public/application/{trained_models => memory_usage}/nodes_overview/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models => memory_usage}/nodes_overview/memory_preview_chart.tsx (90%)
 rename x-pack/plugins/ml/public/application/{trained_models => memory_usage}/nodes_overview/nodes_list.tsx (98%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/delete_models_modal.tsx (92%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/deployment_setup.tsx (98%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/expanded_row.tsx (94%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/force_stop_dialog.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/model_actions.tsx (95%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/model_link.tsx (85%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/models_list.tsx (94%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/pipelines/expanded_row.tsx (97%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/pipelines/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/pipelines/pipelines.tsx (98%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/inference_error.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/index_input.tsx (99%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/inference_base.ts (97%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/inference_info.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/inference_input_form/index.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/inference_input_form/index_input.tsx (98%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/inference_input_form/inference_input_form.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/inference_input_form/text_input.tsx (98%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/ner/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/ner/ner_inference.ts (95%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/ner/ner_output.tsx (98%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/question_answering/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/question_answering/question_answering_inference.ts (96%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/question_answering/question_answering_input.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/question_answering/question_answering_output.tsx (95%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/raw_output.tsx (96%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/common.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/fill_mask_inference.ts (93%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/fill_mask_output.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/lang_codes.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/lang_ident_inference.ts (96%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/lang_ident_output.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/text_classification_inference.ts (93%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/text_classification_output.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/zero_shot_classification_inference.ts (95%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_classification/zero_shot_classification_input.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_embedding/index.ts (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_embedding/text_embedding_inference.ts (94%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_embedding/text_embedding_output.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/models/text_input.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/output_loading.tsx (100%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/selected_model.tsx (95%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/test_flyout.tsx (96%)
 rename x-pack/plugins/ml/public/application/{trained_models/models_management => model_management}/test_models/utils.ts (85%)
 create mode 100644 x-pack/plugins/ml/public/application/routing/routes/memory_usage.tsx
 delete mode 100644 x-pack/plugins/ml/public/application/routing/routes/trained_models/nodes_list.tsx
 delete mode 100644 x-pack/plugins/ml/public/application/trained_models/nodes_overview/expanded_row.tsx
 delete mode 100644 x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.ts
 rename x-pack/plugins/ml/server/models/{data_frame_analytics => model_management}/__mocks__/mock_deployment_response.json (100%)
 create mode 100644 x-pack/plugins/ml/server/models/model_management/index.ts
 rename x-pack/plugins/ml/server/models/{data_frame_analytics/models_provider.test.ts => model_management/memory_usage.test.ts} (97%)
 create mode 100644 x-pack/plugins/ml/server/models/model_management/memory_usage.ts
 create mode 100644 x-pack/plugins/ml/server/models/model_management/models_provider.ts
 create mode 100644 x-pack/plugins/ml/server/routes/model_management.ts

diff --git a/x-pack/plugins/ml/common/constants/locator.ts b/x-pack/plugins/ml/common/constants/locator.ts
index 6ef9d2c27c40d..8e11a93f059ec 100644
--- a/x-pack/plugins/ml/common/constants/locator.ts
+++ b/x-pack/plugins/ml/common/constants/locator.ts
@@ -15,7 +15,7 @@ export const ML_PAGES = {
   DATA_FRAME_ANALYTICS_SOURCE_SELECTION: 'data_frame_analytics/source_selection',
   DATA_FRAME_ANALYTICS_CREATE_JOB: 'data_frame_analytics/new_job',
   TRAINED_MODELS_MANAGE: 'trained_models',
-  TRAINED_MODELS_NODES: 'trained_models/nodes',
+  MEMORY_USAGE: 'memory_usage',
   DATA_FRAME_ANALYTICS_EXPLORATION: 'data_frame_analytics/exploration',
   DATA_FRAME_ANALYTICS_MAP: 'data_frame_analytics/map',
   /**
diff --git a/x-pack/plugins/ml/common/types/locator.ts b/x-pack/plugins/ml/common/types/locator.ts
index a86fb70d9c315..9ee32765b5daa 100644
--- a/x-pack/plugins/ml/common/types/locator.ts
+++ b/x-pack/plugins/ml/common/types/locator.ts
@@ -203,7 +203,7 @@ export interface TrainedModelsQueryState {
   modelId?: string;
 }
 
-export interface TrainedModelsNodesQueryState {
+export interface MemoryUsageNodesQueryState {
   nodeId?: string;
 }
 
@@ -276,7 +276,7 @@ export type MlLocatorState =
   | MlGenericUrlState
   | NotificationsUrlState
   | TrainedModelsUrlState
-  | TrainedModelsNodesUrlState;
+  | MemoryUsageUrlState;
 
 export type MlLocatorParams = MlLocatorState & SerializableRecord;
 
@@ -287,9 +287,9 @@ export type TrainedModelsUrlState = MLPageState<
   TrainedModelsQueryState | undefined
 >;
 
-export type TrainedModelsNodesUrlState = MLPageState<
-  typeof ML_PAGES.TRAINED_MODELS_NODES,
-  TrainedModelsNodesQueryState | undefined
+export type MemoryUsageUrlState = MLPageState<
+  typeof ML_PAGES.MEMORY_USAGE,
+  MemoryUsageNodesQueryState | undefined
 >;
 
 export interface NotificationsQueryState {
diff --git a/x-pack/plugins/ml/common/types/trained_models.ts b/x-pack/plugins/ml/common/types/trained_models.ts
index 2dea2eecd5e5a..e68e89a6ac93a 100644
--- a/x-pack/plugins/ml/common/types/trained_models.ts
+++ b/x-pack/plugins/ml/common/types/trained_models.ts
@@ -9,6 +9,7 @@ import type { DataFrameAnalyticsConfig } from './data_frame_analytics';
 import type { FeatureImportanceBaseline, TotalFeatureImportance } from './feature_importance';
 import type { XOR } from './common';
 import type { DeploymentState, TrainedModelType } from '../constants/trained_models';
+import type { MlSavedObjectType } from './saved_objects';
 
 export interface IngestStats {
   count: number;
@@ -236,3 +237,47 @@ export interface NodesOverviewResponse {
   _nodes: { total: number; failed: number; successful: number };
   nodes: NodeDeploymentStatsResponse[];
 }
+
+export interface MemoryUsageInfo {
+  id: string;
+  type: MlSavedObjectType;
+  size: number;
+  nodeNames: string[];
+}
+
+export interface MemoryStatsResponse {
+  _nodes: { total: number; failed: number; successful: number };
+  cluster_name: string;
+  nodes: Record<
+    string,
+    {
+      jvm: {
+        heap_max_in_bytes: number;
+        java_inference_in_bytes: number;
+        java_inference_max_in_bytes: number;
+      };
+      mem: {
+        adjusted_total_in_bytes: number;
+        total_in_bytes: number;
+        ml: {
+          data_frame_analytics_in_bytes: number;
+          native_code_overhead_in_bytes: number;
+          max_in_bytes: number;
+          anomaly_detectors_in_bytes: number;
+          native_inference_in_bytes: number;
+        };
+      };
+      transport_address: string;
+      roles: string[];
+      name: string;
+      attributes: Record<`${'ml.'}${string}`, string>;
+      ephemeral_id: string;
+    }
+  >;
+}
+
+// @ts-expect-error TrainedModelDeploymentStatsResponse missing properties from MlTrainedModelDeploymentStats
+export interface TrainedModelStatsResponse extends estypes.MlTrainedModelStats {
+  deployment_stats?: Omit<TrainedModelDeploymentStatsResponse, 'model_id'>;
+  model_size_stats?: TrainedModelModelSizeStats;
+}
diff --git a/x-pack/plugins/ml/public/application/app.tsx b/x-pack/plugins/ml/public/application/app.tsx
index 5e5099937c7e1..ffd3fa9e8d654 100644
--- a/x-pack/plugins/ml/public/application/app.tsx
+++ b/x-pack/plugins/ml/public/application/app.tsx
@@ -45,6 +45,12 @@ interface AppProps {
 
 const localStorage = new Storage(window.localStorage);
 
+// temporary function to hardcode the serverless state
+// this will be replaced by the true serverless information from kibana
+export function isServerless() {
+  return false;
+}
+
 /**
  * Provides global services available across the entire ML app.
  */
@@ -54,6 +60,7 @@ export function getMlGlobalServices(httpStart: HttpStart, usageCollection?: Usag
     httpService,
     mlApiServices: mlApiServicesProvider(httpService),
     mlUsageCollection: mlUsageCollectionProvider(usageCollection),
+    isServerless,
   };
 }
 
diff --git a/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx b/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx
index ba4c034cda581..2498aa280fa9b 100644
--- a/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx
+++ b/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx
@@ -169,7 +169,7 @@ const CommonPageWrapper: FC<CommonPageWrapperProps> = React.memo(({ pageDeps, ro
           {routeList.map((route) => {
             return (
               <Route
-                key={route.id}
+                key={route.path}
                 path={route.path}
                 exact
                 render={(props) => {
diff --git a/x-pack/plugins/ml/public/application/components/ml_page/side_nav.tsx b/x-pack/plugins/ml/public/application/components/ml_page/side_nav.tsx
index 6a928b2a365a8..f3270068740d0 100644
--- a/x-pack/plugins/ml/public/application/components/ml_page/side_nav.tsx
+++ b/x-pack/plugins/ml/public/application/components/ml_page/side_nav.tsx
@@ -96,6 +96,15 @@ export function useSideNavItems(activeRoute: MlRoute | undefined) {
             disabled: disableLinks,
             testSubj: 'mlMainTab notifications',
           },
+          {
+            id: 'memory_usage',
+            pathId: ML_PAGES.MEMORY_USAGE,
+            name: i18n.translate('xpack.ml.navMenu.memoryUsageText', {
+              defaultMessage: 'Memory Usage',
+            }),
+            disabled: disableLinks || !canViewMlNodes,
+            testSubj: 'mlMainTab nodesOverview',
+          },
         ],
       },
       {
@@ -196,15 +205,6 @@ export function useSideNavItems(activeRoute: MlRoute | undefined) {
             disabled: disableLinks,
             testSubj: 'mlMainTab trainedModels',
           },
-          {
-            id: 'nodes_overview',
-            pathId: ML_PAGES.TRAINED_MODELS_NODES,
-            name: i18n.translate('xpack.ml.navMenu.nodesOverviewText', {
-              defaultMessage: 'Nodes',
-            }),
-            disabled: disableLinks || !canViewMlNodes,
-            testSubj: 'mlMainTab nodesOverview',
-          },
         ],
       },
       {
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/use_is_serverless.ts b/x-pack/plugins/ml/public/application/contexts/kibana/use_is_serverless.ts
new file mode 100644
index 0000000000000..120ae02b8d466
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/use_is_serverless.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import { useMlKibana } from './kibana_context';
+
+export const useIsServerless = () => {
+  const isServerless = useMlKibana().services.mlServices.isServerless;
+  return useMemo(() => isServerless(), [isServerless]);
+};
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/components/analytics_selector/analytics_id_selector.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/components/analytics_selector/analytics_id_selector.tsx
index 15836fb276a46..9528c54758bc0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/components/analytics_selector/analytics_id_selector.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/components/analytics_selector/analytics_id_selector.tsx
@@ -27,7 +27,7 @@ import { BUILT_IN_MODEL_TAG } from '../../../../../../common/constants/data_fram
 import { useTrainedModelsApiService } from '../../../../services/ml_api_service/trained_models';
 import { GetDataFrameAnalyticsResponse } from '../../../../services/ml_api_service/data_frame_analytics';
 import { useToastNotificationService } from '../../../../services/toast_notification_service';
-import { ModelsTableToConfigMapping } from '../../../../trained_models/models_management';
+import { ModelsTableToConfigMapping } from '../../../../model_management';
 import { DataFrameAnalyticsConfig } from '../../../common';
 import { useMlApiContext } from '../../../../contexts/kibana';
 import { TrainedModelConfigResponse } from '../../../../../../common/types/trained_models';
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/space_management/columns.tsx b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/space_management/columns.tsx
index 90191c4f22dca..221c028603fd0 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/space_management/columns.tsx
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/space_management/columns.tsx
@@ -7,7 +7,7 @@
 import React from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiBasicTableColumn } from '@elastic/eui';
-import { TrainedModelLink } from '../../../../../trained_models/models_management';
+import { TrainedModelLink } from '../../../../../model_management';
 import type { MlSavedObjectType } from '../../../../../../../common/types/saved_objects';
 import type {
   AnalyticsManagementItems,
diff --git a/x-pack/plugins/ml/public/application/memory_usage/index.ts b/x-pack/plugins/ml/public/application/memory_usage/index.ts
new file mode 100644
index 0000000000000..eddabe8bf4b02
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/memory_usage/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { MemoryUsagePage } from './memory_usage_page';
diff --git a/x-pack/plugins/ml/public/application/memory_usage/memory_item_colors.ts b/x-pack/plugins/ml/public/application/memory_usage/memory_item_colors.ts
new file mode 100644
index 0000000000000..b03658aae77a1
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/memory_usage/memory_item_colors.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  euiPaletteComplimentary,
+  euiPaletteForTemperature,
+  euiPaletteGray,
+  euiPalettePositive,
+  euiPaletteWarm,
+} from '@elastic/eui';
+import { MlSavedObjectType } from '../../../common/types/saved_objects';
+
+type MemoryItem = MlSavedObjectType | 'jvm-heap-size' | 'estimated-available-memory';
+
+export function getMemoryItemColor(typeIn: MemoryItem) {
+  switch (typeIn) {
+    case 'anomaly-detector':
+      return euiPaletteWarm(5)[1];
+    case 'data-frame-analytics':
+      return euiPalettePositive(5)[2];
+    case 'trained-model':
+      return euiPaletteForTemperature(5)[1];
+    case 'estimated-available-memory':
+      return euiPaletteGray(5)[0];
+    case 'jvm-heap-size':
+      return euiPaletteComplimentary(5)[4];
+    default:
+      return euiPaletteGray(5)[4];
+  }
+}
diff --git a/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/index.ts b/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/index.ts
new file mode 100644
index 0000000000000..2065b170529a7
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { JobMemoryTreeMap } from './tree_map';
+export { MemoryPage } from './memory_page';
diff --git a/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/memory_page.tsx b/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/memory_page.tsx
new file mode 100644
index 0000000000000..82a3b2cdedd94
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/memory_page.tsx
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCallOut, EuiSpacer } from '@elastic/eui';
+import React, { FC } from 'react';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { JobMemoryTreeMap } from './tree_map';
+
+export const MemoryPage: FC = () => {
+  return (
+    <>
+      <EuiSpacer size="s" />
+      <EuiCallOut color="primary">
+        <FormattedMessage
+          id="xpack.ml.memoryUsage.treeMap.infoCallout"
+          defaultMessage="Memory usage for active machine learning jobs and trained models."
+        />
+      </EuiCallOut>
+      <JobMemoryTreeMap />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/tree_map.tsx b/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/tree_map.tsx
new file mode 100644
index 0000000000000..35d9b216d6f24
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/memory_usage/memory_tree_map/tree_map.tsx
@@ -0,0 +1,201 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useEffect, useState, useCallback, useMemo } from 'react';
+import {
+  Chart,
+  Settings,
+  Partition,
+  PartitionLayout,
+  ShapeTreeNode,
+  LIGHT_THEME,
+  DARK_THEME,
+} from '@elastic/charts';
+import { EUI_CHARTS_THEME_DARK, EUI_CHARTS_THEME_LIGHT } from '@elastic/eui/dist/eui_charts_theme';
+import { FIELD_FORMAT_IDS } from '@kbn/field-formats-plugin/common';
+import { EuiComboBox, EuiComboBoxOptionOption, EuiEmptyPrompt, EuiSpacer } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { MemoryUsageInfo } from '../../../../common/types/trained_models';
+import { JobType, MlSavedObjectType } from '../../../../common/types/saved_objects';
+import { useTrainedModelsApiService } from '../../services/ml_api_service/trained_models';
+import { LoadingWrapper } from '../../jobs/new_job/pages/components/charts/loading_wrapper';
+import { useFieldFormatter, useUiSettings } from '../../contexts/kibana';
+
+import { useRefresh } from '../../routing/use_refresh';
+import { getMemoryItemColor } from '../memory_item_colors';
+import { useToastNotificationService } from '../../services/toast_notification_service';
+
+interface Props {
+  node?: string;
+  type?: MlSavedObjectType;
+  height?: string;
+}
+
+const DEFAULT_CHART_HEIGHT = '400px';
+
+const TYPE_LABELS: Record<string, MlSavedObjectType> = {
+  [i18n.translate('xpack.ml.memoryUsage.treeMap.adLabel', {
+    defaultMessage: 'Anomaly detection jobs',
+  })]: 'anomaly-detector',
+  [i18n.translate('xpack.ml.memoryUsage.treeMap.dfaLabel', {
+    defaultMessage: 'Data frame analytics jobs',
+  })]: 'data-frame-analytics',
+  [i18n.translate('xpack.ml.memoryUsage.treeMap.modelsLabel', {
+    defaultMessage: 'Trained models',
+  })]: 'trained-model',
+} as const;
+
+const TYPE_LABELS_INVERTED = Object.entries(TYPE_LABELS).reduce<Record<MlSavedObjectType, string>>(
+  (acc, [label, type]) => {
+    acc[type] = label;
+    return acc;
+  },
+  {} as Record<MlSavedObjectType, string>
+);
+
+const TYPE_OPTIONS: EuiComboBoxOptionOption[] = Object.entries(TYPE_LABELS).map(
+  ([label, type]) => ({
+    label,
+    color: getMemoryItemColor(type),
+  })
+);
+
+export const JobMemoryTreeMap: FC<Props> = ({ node, type, height }) => {
+  const isDarkTheme = useUiSettings().get('theme:darkMode');
+  const { theme, baseTheme } = useMemo(
+    () =>
+      isDarkTheme
+        ? { theme: EUI_CHARTS_THEME_DARK, baseTheme: DARK_THEME }
+        : { theme: EUI_CHARTS_THEME_LIGHT, baseTheme: LIGHT_THEME },
+    [isDarkTheme]
+  );
+
+  const bytesFormatter = useFieldFormatter(FIELD_FORMAT_IDS.BYTES);
+  const { displayErrorToast } = useToastNotificationService();
+  const refresh = useRefresh();
+  const chartHeight = height ?? DEFAULT_CHART_HEIGHT;
+
+  const trainedModelsApiService = useTrainedModelsApiService();
+  const [allData, setAllData] = useState<MemoryUsageInfo[]>([]);
+  const [data, setData] = useState<MemoryUsageInfo[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [selectedOptions, setSelectedOptions] = useState(TYPE_OPTIONS);
+
+  const filterData = useCallback(
+    (dataIn: MemoryUsageInfo[]) => {
+      const types = selectedOptions.map((o) => TYPE_LABELS[o.label]);
+      return dataIn.filter((d) => types.includes(d.type));
+    },
+    [selectedOptions]
+  );
+
+  const loadJobMemorySize = useCallback(async () => {
+    setLoading(true);
+    try {
+      const resp = await trainedModelsApiService.memoryUsage(type, node);
+      setAllData(resp);
+    } catch (error) {
+      displayErrorToast(
+        error,
+        i18n.translate('xpack.ml.memoryUsage.treeMap.fetchFailedErrorMessage', {
+          defaultMessage: 'Models memory usage fetch failed',
+        })
+      );
+    }
+    setLoading(false);
+  }, [trainedModelsApiService, type, node, displayErrorToast]);
+
+  useEffect(
+    function redrawOnFilterChange() {
+      setData(filterData(allData));
+    },
+    [selectedOptions, allData, filterData]
+  );
+
+  useEffect(
+    function updateOnTimerRefresh() {
+      loadJobMemorySize();
+    },
+    [loadJobMemorySize, refresh]
+  );
+
+  return (
+    <div
+      style={{ height: chartHeight }}
+      data-test-subj={`mlJobTreeMap ${data.length ? 'withData' : 'empty'}`}
+    >
+      <EuiSpacer size="s" />
+      <LoadingWrapper height={chartHeight} hasData={data.length > 0} loading={loading}>
+        <EuiComboBox
+          fullWidth
+          options={TYPE_OPTIONS}
+          selectedOptions={selectedOptions}
+          onChange={setSelectedOptions}
+          isClearable={false}
+        />
+
+        <EuiSpacer size="s" />
+
+        {data.length ? (
+          <Chart>
+            <Settings baseTheme={baseTheme} theme={theme.theme} />
+            <Partition<MemoryUsageInfo>
+              id="memoryUsageTreeMap"
+              data={data}
+              layout={PartitionLayout.treemap}
+              valueAccessor={(d) => d.size}
+              valueFormatter={(size: number) => bytesFormatter(size)}
+              layers={[
+                {
+                  groupByRollup: (d: MemoryUsageInfo) => d.type,
+                  nodeLabel: (d) => TYPE_LABELS_INVERTED[d as MlSavedObjectType],
+                  fillLabel: {
+                    valueFormatter: (size: number) => bytesFormatter(size),
+                  },
+                  shape: {
+                    fillColor: (d: ShapeTreeNode) => getMemoryItemColor(d.dataName as JobType),
+                  },
+                },
+                {
+                  groupByRollup: (d: MemoryUsageInfo) => d.id,
+                  nodeLabel: (d) => `${d}`,
+                  fillLabel: {
+                    valueFont: {
+                      fontWeight: 100,
+                    },
+                  },
+                  shape: {
+                    fillColor: (d: ShapeTreeNode) => {
+                      // color the shape the same as its parent.
+                      const parentId = d.parent.path[d.parent.path.length - 1].value as JobType;
+                      return getMemoryItemColor(parentId);
+                    },
+                  },
+                },
+              ]}
+            />
+          </Chart>
+        ) : (
+          <EuiEmptyPrompt
+            titleSize="xs"
+            iconType="alert"
+            data-test-subj="mlEmptyMemoryUsageTreeMap"
+            title={
+              <h2>
+                <FormattedMessage
+                  id="xpack.ml.memoryUsage.treeMap.emptyPrompt"
+                  defaultMessage="No open jobs or trained models match the current selection. "
+                />
+              </h2>
+            }
+          />
+        )}
+      </LoadingWrapper>
+    </div>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/memory_usage/memory_usage_page.tsx b/x-pack/plugins/ml/public/application/memory_usage/memory_usage_page.tsx
new file mode 100644
index 0000000000000..24e3dbab771b5
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/memory_usage/memory_usage_page.tsx
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useCallback, useState } from 'react';
+import { mlTimefilterRefresh$, useTimefilter } from '@kbn/ml-date-picker';
+import { EuiFlexGroup, EuiFlexItem, EuiTabs, EuiTab } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { NodesList } from './nodes_overview';
+import { MlPageHeader } from '../components/page_header';
+import { MemoryPage, JobMemoryTreeMap } from './memory_tree_map';
+import { useIsServerless } from '../contexts/kibana/use_is_serverless';
+import { SavedObjectsWarning } from '../components/saved_objects_warning';
+
+enum TAB {
+  NODES,
+  MEMORY_USAGE,
+}
+
+export const MemoryUsagePage: FC = () => {
+  const serverless = useIsServerless();
+  const [selectedTab, setSelectedTab] = useState<TAB>(TAB.NODES);
+  useTimefilter({ timeRangeSelector: false, autoRefreshSelector: true });
+
+  const refresh = useCallback(() => {
+    mlTimefilterRefresh$.next({
+      lastRefresh: Date.now(),
+    });
+  }, []);
+
+  return (
+    <>
+      <MlPageHeader>
+        <EuiFlexGroup responsive={false} wrap={false} alignItems={'center'} gutterSize={'m'}>
+          <EuiFlexItem grow={false}>
+            <FormattedMessage
+              id="xpack.ml.memoryUsage.memoryUsageHeader"
+              defaultMessage="Memory Usage"
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </MlPageHeader>
+
+      <SavedObjectsWarning onCloseFlyout={refresh} />
+
+      {serverless ? (
+        <JobMemoryTreeMap />
+      ) : (
+        <>
+          <EuiTabs>
+            <EuiTab
+              isSelected={selectedTab === TAB.NODES}
+              onClick={() => setSelectedTab(TAB.NODES)}
+            >
+              <FormattedMessage id="xpack.ml.memoryUsage.nodesTab" defaultMessage="Nodes" />
+            </EuiTab>
+            <EuiTab
+              isSelected={selectedTab === TAB.MEMORY_USAGE}
+              onClick={() => setSelectedTab(TAB.MEMORY_USAGE)}
+            >
+              <FormattedMessage id="xpack.ml.memoryUsage.memoryTab" defaultMessage="Memory usage" />
+            </EuiTab>
+          </EuiTabs>
+          {selectedTab === TAB.NODES ? <NodesList /> : <MemoryPage />}
+        </>
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/trained_models/nodes_overview/allocated_models.tsx b/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/allocated_models.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/nodes_overview/allocated_models.tsx
rename to x-pack/plugins/ml/public/application/memory_usage/nodes_overview/allocated_models.tsx
diff --git a/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/expanded_row.tsx b/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/expanded_row.tsx
new file mode 100644
index 0000000000000..cf44b275a0f5d
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/expanded_row.tsx
@@ -0,0 +1,151 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useState } from 'react';
+import {
+  EuiDescriptionList,
+  EuiFlexGrid,
+  EuiFlexItem,
+  EuiPanel,
+  EuiSpacer,
+  EuiTab,
+  EuiTabs,
+  EuiTitle,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { cloneDeep } from 'lodash';
+import { FIELD_FORMAT_IDS } from '@kbn/field-formats-plugin/common';
+import { css } from '@emotion/react';
+import { NodeItem } from './nodes_list';
+import { useListItemsFormatter } from '../../model_management/expanded_row';
+import { AllocatedModels } from './allocated_models';
+import { useFieldFormatter } from '../../contexts/kibana/use_field_formatter';
+import { JobMemoryTreeMap } from '../memory_tree_map';
+
+interface ExpandedRowProps {
+  item: NodeItem;
+}
+
+enum TAB {
+  DETAILS,
+  MEMORY_USAGE,
+}
+
+export const ExpandedRow: FC<ExpandedRowProps> = ({ item }) => {
+  const bytesFormatter = useFieldFormatter(FIELD_FORMAT_IDS.BYTES);
+  const [selectedTab, setSelectedTab] = useState<TAB>(TAB.DETAILS);
+
+  const formatToListItems = useListItemsFormatter();
+
+  const {
+    allocated_models: allocatedModels,
+    attributes,
+    memory_overview: memoryOverview,
+    id,
+    ...details
+  } = cloneDeep(item);
+
+  // Process node attributes
+  attributes['ml.machine_memory'] = bytesFormatter(attributes['ml.machine_memory']);
+  attributes['ml.max_jvm_size'] = bytesFormatter(attributes['ml.max_jvm_size']);
+
+  return (
+    <div
+      css={css`
+        width: 100%;
+      `}
+    >
+      <EuiTabs>
+        <EuiTab
+          isSelected={selectedTab === TAB.DETAILS}
+          onClick={() => setSelectedTab(TAB.DETAILS)}
+        >
+          <FormattedMessage
+            id="xpack.ml.trainedModels.nodesList.expandedRow.detailsTabTitle"
+            defaultMessage="Details"
+          />
+        </EuiTab>
+        <EuiTab
+          isSelected={selectedTab === TAB.MEMORY_USAGE}
+          onClick={() => setSelectedTab(TAB.MEMORY_USAGE)}
+        >
+          <FormattedMessage
+            id="xpack.ml.trainedModels.nodesList.expandedRow.memoryTabTitle"
+            defaultMessage="Memory usage"
+          />
+        </EuiTab>
+      </EuiTabs>
+
+      {selectedTab === TAB.DETAILS ? (
+        <>
+          <EuiSpacer size="s" />
+          <EuiFlexGrid columns={2} gutterSize={'s'}>
+            <EuiFlexItem>
+              <EuiPanel hasShadow={false}>
+                <EuiTitle size={'xs'}>
+                  <h5>
+                    <FormattedMessage
+                      id="xpack.ml.trainedModels.nodesList.expandedRow.detailsTitle"
+                      defaultMessage="Details"
+                    />
+                  </h5>
+                </EuiTitle>
+                <EuiSpacer size={'m'} />
+                <EuiDescriptionList
+                  compressed={true}
+                  type="column"
+                  listItems={formatToListItems(details)}
+                />
+              </EuiPanel>
+            </EuiFlexItem>
+
+            <EuiFlexItem>
+              <EuiPanel hasShadow={false}>
+                <EuiTitle size={'xs'}>
+                  <h5>
+                    <FormattedMessage
+                      id="xpack.ml.trainedModels.nodesList.expandedRow.attributesTitle"
+                      defaultMessage="Attributes"
+                    />
+                  </h5>
+                </EuiTitle>
+                <EuiSpacer size={'m'} />
+                <EuiDescriptionList
+                  compressed={true}
+                  type="column"
+                  listItems={formatToListItems(attributes)}
+                />
+              </EuiPanel>
+            </EuiFlexItem>
+          </EuiFlexGrid>
+          {allocatedModels.length > 0 ? (
+            <>
+              <EuiSpacer size={'s'} />
+              <EuiPanel hasShadow={false}>
+                <EuiTitle size={'xs'}>
+                  <h5>
+                    <FormattedMessage
+                      id="xpack.ml.trainedModels.nodesList.expandedRow.allocatedModelsTitle"
+                      defaultMessage="Allocated trained models"
+                    />
+                  </h5>
+                </EuiTitle>
+                <EuiSpacer size={'m'} />
+
+                <AllocatedModels models={allocatedModels} />
+              </EuiPanel>
+            </>
+          ) : null}
+        </>
+      ) : (
+        <>
+          <JobMemoryTreeMap node={item.name} />
+        </>
+      )}
+    </div>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/trained_models/nodes_overview/index.ts b/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/nodes_overview/index.ts
rename to x-pack/plugins/ml/public/application/memory_usage/nodes_overview/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/nodes_overview/memory_preview_chart.tsx b/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/memory_preview_chart.tsx
similarity index 90%
rename from x-pack/plugins/ml/public/application/trained_models/nodes_overview/memory_preview_chart.tsx
rename to x-pack/plugins/ml/public/application/memory_usage/nodes_overview/memory_preview_chart.tsx
index 2decf3c1d2b1b..f57fa18dc4286 100644
--- a/x-pack/plugins/ml/public/application/trained_models/nodes_overview/memory_preview_chart.tsx
+++ b/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/memory_preview_chart.tsx
@@ -18,11 +18,11 @@ import {
   LineAnnotation,
   AnnotationDomainType,
 } from '@elastic/charts';
-import { EuiIcon, euiPaletteGray } from '@elastic/eui';
+import { EuiIcon } from '@elastic/eui';
 import { FIELD_FORMAT_IDS } from '@kbn/field-formats-plugin/common';
 import { NodeDeploymentStatsResponse } from '../../../../common/types/trained_models';
 import { useFieldFormatter } from '../../contexts/kibana/use_field_formatter';
-import { useCurrentEuiTheme } from '../../components/color_range_legend';
+import { getMemoryItemColor } from '../memory_item_colors';
 
 interface MemoryPreviewChartProps {
   memoryOverview: NodeDeploymentStatsResponse['memory_overview'];
@@ -31,42 +31,39 @@ interface MemoryPreviewChartProps {
 export const MemoryPreviewChart: FC<MemoryPreviewChartProps> = ({ memoryOverview }) => {
   const bytesFormatter = useFieldFormatter(FIELD_FORMAT_IDS.BYTES);
 
-  const { euiTheme } = useCurrentEuiTheme();
-
   const groups = useMemo(
     () => ({
       jvm: {
         name: i18n.translate('xpack.ml.trainedModels.nodesList.jvmHeapSIze', {
           defaultMessage: 'JVM heap size',
         }),
-        colour: euiTheme.euiColorVis1,
+        color: getMemoryItemColor('jvm-heap-size'),
       },
       trained_models: {
         name: i18n.translate('xpack.ml.trainedModels.nodesList.modelsMemoryUsage', {
           defaultMessage: 'Trained models',
         }),
-        colour: euiTheme.euiColorVis2,
+        color: getMemoryItemColor('trained-model'),
       },
       anomaly_detection: {
         name: i18n.translate('xpack.ml.trainedModels.nodesList.adMemoryUsage', {
           defaultMessage: 'Anomaly detection jobs',
         }),
-        colour: euiTheme.euiColorVis6,
+        color: getMemoryItemColor('anomaly-detector'),
       },
       dfa_training: {
         name: i18n.translate('xpack.ml.trainedModels.nodesList.dfaMemoryUsage', {
           defaultMessage: 'Data frame analytics jobs',
         }),
-        colour: euiTheme.euiColorVis4,
+        color: getMemoryItemColor('data-frame-analytics'),
       },
       available: {
         name: i18n.translate('xpack.ml.trainedModels.nodesList.availableMemory', {
           defaultMessage: 'Estimated available memory',
         }),
-        colour: euiPaletteGray(5)[0],
+        color: getMemoryItemColor('estimated-available-memory'),
       },
     }),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
     []
   );
 
@@ -106,7 +103,7 @@ export const MemoryPreviewChart: FC<MemoryPreviewChartProps> = ({ memoryOverview
   const barSeriesColorAccessor: SeriesColorAccessor = ({ specId, yAccessor, splitAccessors }) => {
     const group = splitAccessors.get('g');
 
-    return Object.values(groups).find((v) => v.name === group)!.colour;
+    return Object.values(groups).find((v) => v.name === group)!.color;
   };
 
   return (
diff --git a/x-pack/plugins/ml/public/application/trained_models/nodes_overview/nodes_list.tsx b/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/nodes_list.tsx
similarity index 98%
rename from x-pack/plugins/ml/public/application/trained_models/nodes_overview/nodes_list.tsx
rename to x-pack/plugins/ml/public/application/memory_usage/nodes_overview/nodes_list.tsx
index 9ec06645d8e29..a615e40c9e3ea 100644
--- a/x-pack/plugins/ml/public/application/trained_models/nodes_overview/nodes_list.tsx
+++ b/x-pack/plugins/ml/public/application/memory_usage/nodes_overview/nodes_list.tsx
@@ -33,7 +33,7 @@ import { useRefresh } from '../../routing/use_refresh';
 export type NodeItem = NodeDeploymentStatsResponse;
 
 interface PageUrlState {
-  pageKey: typeof ML_PAGES.TRAINED_MODELS_NODES;
+  pageKey: typeof ML_PAGES.MEMORY_USAGE;
   pageUrlState: ListingPageUrlState;
 }
 
@@ -61,7 +61,7 @@ export const NodesList: FC<NodesListProps> = ({ compactView = false }) => {
     {}
   );
   const [pageState, updatePageState] = usePageUrlState<PageUrlState>(
-    ML_PAGES.TRAINED_MODELS_NODES,
+    ML_PAGES.MEMORY_USAGE,
     getDefaultNodesListState()
   );
 
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/delete_models_modal.tsx b/x-pack/plugins/ml/public/application/model_management/delete_models_modal.tsx
similarity index 92%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/delete_models_modal.tsx
rename to x-pack/plugins/ml/public/application/model_management/delete_models_modal.tsx
index b4f0bc0ec505e..e730dad0c36aa 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/delete_models_modal.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/delete_models_modal.tsx
@@ -16,9 +16,9 @@ import {
   EuiButton,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { useTrainedModelsApiService } from '../../services/ml_api_service/trained_models';
-import { useToastNotificationService } from '../../services/toast_notification_service';
-import { DeleteSpaceAwareItemCheckModal } from '../../components/delete_space_aware_item_check_modal';
+import { useTrainedModelsApiService } from '../services/ml_api_service/trained_models';
+import { useToastNotificationService } from '../services/toast_notification_service';
+import { DeleteSpaceAwareItemCheckModal } from '../components/delete_space_aware_item_check_modal';
 
 interface DeleteModelsModalProps {
   modelIds: string[];
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/deployment_setup.tsx b/x-pack/plugins/ml/public/application/model_management/deployment_setup.tsx
similarity index 98%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/deployment_setup.tsx
rename to x-pack/plugins/ml/public/application/model_management/deployment_setup.tsx
index 4c4bd6293bc8a..9068f679cf261 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/deployment_setup.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/deployment_setup.tsx
@@ -30,8 +30,8 @@ import type { Observable } from 'rxjs';
 import type { CoreTheme, OverlayStart } from '@kbn/core/public';
 import { css } from '@emotion/react';
 import { numberValidator } from '@kbn/ml-agg-utils';
-import { isCloudTrial } from '../../services/ml_server_info';
-import { composeValidators, requiredValidator } from '../../../../common/util/validators';
+import { isCloudTrial } from '../services/ml_server_info';
+import { composeValidators, requiredValidator } from '../../../common/util/validators';
 
 interface DeploymentSetupProps {
   config: ThreadingParams;
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/expanded_row.tsx b/x-pack/plugins/ml/public/application/model_management/expanded_row.tsx
similarity index 94%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/expanded_row.tsx
rename to x-pack/plugins/ml/public/application/model_management/expanded_row.tsx
index daa813fe4e1e6..99dc3f687a7e0 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/expanded_row.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/expanded_row.tsx
@@ -20,6 +20,7 @@ import {
   EuiTabbedContent,
   EuiTabbedContentTab,
   EuiTitle,
+  useEuiPaddingSize,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { FIELD_FORMAT_IDS } from '@kbn/field-formats-plugin/common';
@@ -27,30 +28,38 @@ import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import { isDefined } from '@kbn/ml-is-defined';
 import type { ModelItemFull } from './models_list';
 import { ModelPipelines } from './pipelines';
-import { AllocatedModels } from '../nodes_overview/allocated_models';
-import type { AllocatedModel } from '../../../../common/types/trained_models';
-import { useFieldFormatter } from '../../contexts/kibana/use_field_formatter';
+import { AllocatedModels } from '../memory_usage/nodes_overview/allocated_models';
+import type { AllocatedModel } from '../../../common/types/trained_models';
+import { useFieldFormatter } from '../contexts/kibana/use_field_formatter';
 
 interface ExpandedRowProps {
   item: ModelItemFull;
 }
 
-const badgeFormatter = (items: string[]) => {
-  if (items.length === 0) return;
-  return (
-    <div>
-      {items.map((item) => (
-        <EuiBadge key={item} color="hollow">
-          {item}
-        </EuiBadge>
-      ))}
-    </div>
-  );
+const useBadgeFormatter = () => {
+  const xs = useEuiPaddingSize('xs');
+
+  function badgeFormatter(items: string[]) {
+    if (items.length === 0) return;
+    return (
+      <div>
+        {items.map((item) => (
+          <span css={{ marginRight: xs! }} key={item}>
+            <EuiBadge color="hollow" css={{ marginRight: xs! }}>
+              {item}
+            </EuiBadge>
+          </span>
+        ))}
+      </div>
+    );
+  }
+  return { badgeFormatter };
 };
 
 export function useListItemsFormatter() {
   const bytesFormatter = useFieldFormatter(FIELD_FORMAT_IDS.BYTES);
   const dateFormatter = useFieldFormatter(FIELD_FORMAT_IDS.DATE);
+  const { badgeFormatter } = useBadgeFormatter();
 
   const formatterDictionary: Record<string, (value: any) => JSX.Element | string | undefined> =
     useMemo(
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/force_stop_dialog.tsx b/x-pack/plugins/ml/public/application/model_management/force_stop_dialog.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/force_stop_dialog.tsx
rename to x-pack/plugins/ml/public/application/model_management/force_stop_dialog.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/index.ts b/x-pack/plugins/ml/public/application/model_management/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/index.ts
rename to x-pack/plugins/ml/public/application/model_management/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/model_actions.tsx b/x-pack/plugins/ml/public/application/model_management/model_actions.tsx
similarity index 95%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/model_actions.tsx
rename to x-pack/plugins/ml/public/application/model_management/model_actions.tsx
index a8258e537c60e..5545fa6c7d5fe 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/model_actions.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/model_actions.tsx
@@ -10,16 +10,16 @@ import { i18n } from '@kbn/i18n';
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import { EuiToolTip } from '@elastic/eui';
 import React, { useCallback, useMemo } from 'react';
-import { BUILT_IN_MODEL_TAG } from '../../../../common/constants/data_frame_analytics';
-import { useTrainedModelsApiService } from '../../services/ml_api_service/trained_models';
+import { BUILT_IN_MODEL_TAG } from '../../../common/constants/data_frame_analytics';
+import { useTrainedModelsApiService } from '../services/ml_api_service/trained_models';
 import { getUserConfirmationProvider } from './force_stop_dialog';
-import { useToastNotificationService } from '../../services/toast_notification_service';
+import { useToastNotificationService } from '../services/toast_notification_service';
 import { getUserInputThreadingParamsProvider } from './deployment_setup';
-import { useMlKibana, useMlLocator, useNavigateToPath } from '../../contexts/kibana';
-import { getAnalysisType } from '../../../../common/util/analytics_utils';
-import { DataFrameAnalysisConfigType } from '../../../../common/types/data_frame_analytics';
-import { ML_PAGES } from '../../../../common/constants/locator';
-import { DEPLOYMENT_STATE, TRAINED_MODEL_TYPE } from '../../../../common/constants/trained_models';
+import { useMlKibana, useMlLocator, useNavigateToPath } from '../contexts/kibana';
+import { getAnalysisType } from '../../../common/util/analytics_utils';
+import { DataFrameAnalysisConfigType } from '../../../common/types/data_frame_analytics';
+import { ML_PAGES } from '../../../common/constants/locator';
+import { DEPLOYMENT_STATE, TRAINED_MODEL_TYPE } from '../../../common/constants/trained_models';
 import { isTestable } from './test_models';
 import { ModelItem } from './models_list';
 
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/model_link.tsx b/x-pack/plugins/ml/public/application/model_management/model_link.tsx
similarity index 85%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/model_link.tsx
rename to x-pack/plugins/ml/public/application/model_management/model_link.tsx
index 82a122cbaeb90..2acf8951dcd15 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/model_link.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/model_link.tsx
@@ -7,8 +7,8 @@
 
 import { EuiLink } from '@elastic/eui';
 import React, { FC } from 'react';
-import { useMlLink } from '../../contexts/kibana';
-import { ML_PAGES } from '../../../../common/constants/locator';
+import { useMlLink } from '../contexts/kibana';
+import { ML_PAGES } from '../../../common/constants/locator';
 
 export interface TrainedModelLinkProps {
   id: string;
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/models_list.tsx b/x-pack/plugins/ml/public/application/model_management/models_list.tsx
similarity index 94%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/models_list.tsx
rename to x-pack/plugins/ml/public/application/model_management/models_list.tsx
index 9fbd05d978eae..4d04e4b814254 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/models_list.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/models_list.tsx
@@ -29,25 +29,25 @@ import { usePageUrlState } from '@kbn/ml-url-state';
 import { useTimefilter } from '@kbn/ml-date-picker';
 import { useModelActions } from './model_actions';
 import { ModelsTableToConfigMapping } from '.';
-import { ModelsBarStats, StatsBar } from '../../components/stats_bar';
-import { useMlKibana } from '../../contexts/kibana';
-import { useTrainedModelsApiService } from '../../services/ml_api_service/trained_models';
+import { ModelsBarStats, StatsBar } from '../components/stats_bar';
+import { useMlKibana } from '../contexts/kibana';
+import { useTrainedModelsApiService } from '../services/ml_api_service/trained_models';
 import {
   ModelPipelines,
   TrainedModelConfigResponse,
   TrainedModelStat,
-} from '../../../../common/types/trained_models';
-import { BUILT_IN_MODEL_TAG } from '../../../../common/constants/data_frame_analytics';
+} from '../../../common/types/trained_models';
+import { BUILT_IN_MODEL_TAG } from '../../../common/constants/data_frame_analytics';
 import { DeleteModelsModal } from './delete_models_modal';
-import { ML_PAGES } from '../../../../common/constants/locator';
-import { ListingPageUrlState } from '../../../../common/types/common';
+import { ML_PAGES } from '../../../common/constants/locator';
+import { ListingPageUrlState } from '../../../common/types/common';
 import { ExpandedRow } from './expanded_row';
-import { useTableSettings } from '../../data_frame_analytics/pages/analytics_management/components/analytics_list/use_table_settings';
-import { useToastNotificationService } from '../../services/toast_notification_service';
-import { useFieldFormatter } from '../../contexts/kibana/use_field_formatter';
-import { useRefresh } from '../../routing/use_refresh';
-import { BUILT_IN_MODEL_TYPE } from '../../../../common/constants/trained_models';
-import { SavedObjectsWarning } from '../../components/saved_objects_warning';
+import { useTableSettings } from '../data_frame_analytics/pages/analytics_management/components/analytics_list/use_table_settings';
+import { useToastNotificationService } from '../services/toast_notification_service';
+import { useFieldFormatter } from '../contexts/kibana/use_field_formatter';
+import { useRefresh } from '../routing/use_refresh';
+import { BUILT_IN_MODEL_TYPE } from '../../../common/constants/trained_models';
+import { SavedObjectsWarning } from '../components/saved_objects_warning';
 import { TestTrainedModelFlyout } from './test_models';
 
 type Stats = Omit<TrainedModelStat, 'model_id'>;
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/pipelines/expanded_row.tsx b/x-pack/plugins/ml/public/application/model_management/pipelines/expanded_row.tsx
similarity index 97%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/pipelines/expanded_row.tsx
rename to x-pack/plugins/ml/public/application/model_management/pipelines/expanded_row.tsx
index 86284bd23796b..24b45659938e7 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/pipelines/expanded_row.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/pipelines/expanded_row.tsx
@@ -12,9 +12,9 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { EuiBasicTableColumn } from '@elastic/eui/src/components/basic_table/basic_table';
 import { i18n } from '@kbn/i18n';
 import { FIELD_FORMAT_IDS } from '@kbn/field-formats-plugin/common';
-import { useFieldFormatter } from '../../../contexts/kibana/use_field_formatter';
+import { useFieldFormatter } from '../../contexts/kibana/use_field_formatter';
 import { IngestStatsResponse } from './pipelines';
-import { HelpIcon } from '../../../components/help_icon';
+import { HelpIcon } from '../../components/help_icon';
 
 interface ProcessorsStatsProps {
   stats: Exclude<IngestStatsResponse, undefined>['pipelines'][string]['processors'];
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/pipelines/index.ts b/x-pack/plugins/ml/public/application/model_management/pipelines/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/pipelines/index.ts
rename to x-pack/plugins/ml/public/application/model_management/pipelines/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/pipelines/pipelines.tsx b/x-pack/plugins/ml/public/application/model_management/pipelines/pipelines.tsx
similarity index 98%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/pipelines/pipelines.tsx
rename to x-pack/plugins/ml/public/application/model_management/pipelines/pipelines.tsx
index 6ea883ed84706..ac8156ae0053b 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/pipelines/pipelines.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/pipelines/pipelines.tsx
@@ -16,7 +16,7 @@ import {
   EuiAccordion,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { useMlKibana } from '../../../contexts/kibana';
+import { useMlKibana } from '../../contexts/kibana';
 import { ModelItem } from '../models_list';
 import { ProcessorsStats } from './expanded_row';
 
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/index.ts b/x-pack/plugins/ml/public/application/model_management/test_models/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/index.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/inference_error.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/inference_error.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/inference_error.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/inference_error.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/index.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/index.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/index_input.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/index_input.tsx
similarity index 99%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/index_input.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/index_input.tsx
index 484515f4a59cf..c80a84c5e1f4a 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/index_input.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/index_input.tsx
@@ -14,7 +14,7 @@ import { EuiSpacer, EuiSelect, EuiFormRow, EuiAccordion, EuiCodeBlock } from '@e
 
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import { i18n } from '@kbn/i18n';
-import { useMlKibana } from '../../../../contexts/kibana';
+import { useMlKibana } from '../../../contexts/kibana';
 import { RUNNING_STATE } from './inference_base';
 import type { InferrerType } from '.';
 
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_base.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_base.ts
similarity index 97%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_base.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/inference_base.ts
index 28b3073cfbb14..355137faeb1af 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_base.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_base.ts
@@ -10,9 +10,9 @@ import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { i18n } from '@kbn/i18n';
 
 import { map } from 'rxjs/operators';
-import { MLHttpFetchError } from '../../../../../../common/util/errors';
-import { SupportedPytorchTasksType } from '../../../../../../common/constants/trained_models';
-import { trainedModelsApiProvider } from '../../../../services/ml_api_service/trained_models';
+import { MLHttpFetchError } from '../../../../../common/util/errors';
+import { SupportedPytorchTasksType } from '../../../../../common/constants/trained_models';
+import { trainedModelsApiProvider } from '../../../services/ml_api_service/trained_models';
 import { getInferenceInfoComponent } from './inference_info';
 
 export type InferenceType =
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_info.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_info.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_info.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/inference_info.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/index.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/index.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/index.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/index.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/index_input.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/index_input.tsx
similarity index 98%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/index_input.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/index_input.tsx
index 02a9a217f547a..5060f0033fd6c 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/index_input.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/index_input.tsx
@@ -22,7 +22,7 @@ import {
 } from '@elastic/eui';
 
 import { ErrorMessage } from '../../inference_error';
-import { extractErrorMessage } from '../../../../../../../common';
+import { extractErrorMessage } from '../../../../../../common';
 import type { InferrerType } from '..';
 import { useIndexInput, InferenceInputFormIndexControls } from '../index_input';
 import { RUNNING_STATE } from '../inference_base';
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/inference_input_form.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/inference_input_form.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/inference_input_form.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/inference_input_form.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/text_input.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/text_input.tsx
similarity index 98%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/text_input.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/text_input.tsx
index eda62469515ee..3446bda477b4a 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/inference_input_form/text_input.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/inference_input_form/text_input.tsx
@@ -12,7 +12,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { EuiSpacer, EuiButton, EuiTabs, EuiTab, EuiForm } from '@elastic/eui';
 
 import { ErrorMessage } from '../../inference_error';
-import { extractErrorMessage } from '../../../../../../../common';
+import { extractErrorMessage } from '../../../../../../common';
 import type { InferrerType } from '..';
 import { OutputLoadingContent } from '../../output_loading';
 import { RUNNING_STATE } from '../inference_base';
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/ner/index.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/ner/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/ner/index.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/ner/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/ner/ner_inference.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/ner/ner_inference.ts
similarity index 95%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/ner/ner_inference.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/ner/ner_inference.ts
index 94ec27ce0c4aa..4330684086909 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/ner/ner_inference.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/ner/ner_inference.ts
@@ -7,12 +7,12 @@
 
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { i18n } from '@kbn/i18n';
-import { trainedModelsApiProvider } from '../../../../../services/ml_api_service/trained_models';
+import { trainedModelsApiProvider } from '../../../../services/ml_api_service/trained_models';
 import { InferenceBase, INPUT_TYPE } from '../inference_base';
 import type { InferResponse } from '../inference_base';
 import { getGeneralInputComponent } from '../text_input';
 import { getNerOutputComponent } from './ner_output';
-import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../../common/constants/trained_models';
+import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../common/constants/trained_models';
 
 export type FormattedNerResponse = Array<{
   value: string;
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/ner/ner_output.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/ner/ner_output.tsx
similarity index 98%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/ner/ner_output.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/ner/ner_output.tsx
index 9baeb3d0afb6b..90b416b817b87 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/ner/ner_output.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/ner/ner_output.tsx
@@ -21,7 +21,7 @@ import {
 import {
   useCurrentEuiTheme,
   EuiThemeType,
-} from '../../../../../components/color_range_legend/use_color_range';
+} from '../../../../components/color_range_legend/use_color_range';
 import type { NerInference, NerResponse } from './ner_inference';
 import { INPUT_TYPE } from '../inference_base';
 
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/index.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/index.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/question_answering_inference.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/question_answering_inference.ts
similarity index 96%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/question_answering_inference.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/question_answering_inference.ts
index eb132ce2e3fdd..0555b5779900b 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/question_answering_inference.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/question_answering_inference.ts
@@ -13,8 +13,8 @@ import { InferenceBase, INPUT_TYPE } from '../inference_base';
 import type { InferResponse } from '../inference_base';
 import { getQuestionAnsweringInput } from './question_answering_input';
 import { getQuestionAnsweringOutputComponent } from './question_answering_output';
-import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../../common/constants/trained_models';
-import { trainedModelsApiProvider } from '../../../../../services/ml_api_service/trained_models';
+import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../common/constants/trained_models';
+import { trainedModelsApiProvider } from '../../../../services/ml_api_service/trained_models';
 
 export interface RawQuestionAnsweringResponse {
   inference_results: Array<{
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/question_answering_input.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/question_answering_input.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/question_answering_input.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/question_answering_input.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/question_answering_output.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/question_answering_output.tsx
similarity index 95%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/question_answering_output.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/question_answering_output.tsx
index 03bb94646635d..54a2a61855758 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/question_answering/question_answering_output.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/question_answering/question_answering_output.tsx
@@ -10,7 +10,7 @@ import useObservable from 'react-use/lib/useObservable';
 
 import { EuiBadge, EuiHorizontalRule } from '@elastic/eui';
 
-import { useCurrentEuiTheme } from '../../../../../components/color_range_legend/use_color_range';
+import { useCurrentEuiTheme } from '../../../../components/color_range_legend/use_color_range';
 
 import type {
   QuestionAnsweringInference,
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/raw_output.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/raw_output.tsx
similarity index 96%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/raw_output.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/raw_output.tsx
index 6656333f259f8..59ffa21e9945a 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/raw_output.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/raw_output.tsx
@@ -9,7 +9,7 @@ import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import React, { FC } from 'react';
 import { Observable } from 'rxjs';
 import useObservable from 'react-use/lib/useObservable';
-import { MLJobEditor } from '../../../../jobs/jobs_list/components/ml_job_editor';
+import { MLJobEditor } from '../../../jobs/jobs_list/components/ml_job_editor';
 
 import type { InferrerType } from '.';
 import { NerResponse } from './ner';
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/common.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/common.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/common.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/common.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/fill_mask_inference.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/fill_mask_inference.ts
similarity index 93%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/fill_mask_inference.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/fill_mask_inference.ts
index 2dd72529e7b7d..de3ac2528df5e 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/fill_mask_inference.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/fill_mask_inference.ts
@@ -13,8 +13,8 @@ import type { TextClassificationResponse, RawTextClassificationResponse } from '
 import { processResponse, processInferenceResult } from './common';
 import { getGeneralInputComponent } from '../text_input';
 import { getFillMaskOutputComponent } from './fill_mask_output';
-import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../../common/constants/trained_models';
-import { trainedModelsApiProvider } from '../../../../../services/ml_api_service/trained_models';
+import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../common/constants/trained_models';
+import { trainedModelsApiProvider } from '../../../../services/ml_api_service/trained_models';
 
 const MASK = '[MASK]';
 
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/fill_mask_output.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/fill_mask_output.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/fill_mask_output.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/fill_mask_output.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/index.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/index.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/lang_codes.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/lang_codes.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/lang_codes.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/lang_codes.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/lang_ident_inference.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/lang_ident_inference.ts
similarity index 96%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/lang_ident_inference.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/lang_ident_inference.ts
index 2309a8885e989..ff6565de32b19 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/lang_ident_inference.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/lang_ident_inference.ts
@@ -13,7 +13,7 @@ import { processInferenceResult, processResponse } from './common';
 import { getGeneralInputComponent } from '../text_input';
 import { getLangIdentOutputComponent } from './lang_ident_output';
 import type { TextClassificationResponse, RawTextClassificationResponse } from './common';
-import { trainedModelsApiProvider } from '../../../../../services/ml_api_service/trained_models';
+import { trainedModelsApiProvider } from '../../../../services/ml_api_service/trained_models';
 
 export class LangIdentInference extends InferenceBase<TextClassificationResponse> {
   protected inferenceType: InferenceType = 'classification';
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/lang_ident_output.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/lang_ident_output.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/lang_ident_output.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/lang_ident_output.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/text_classification_inference.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/text_classification_inference.ts
similarity index 93%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/text_classification_inference.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/text_classification_inference.ts
index 783483c161d2e..0bb9640327548 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/text_classification_inference.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/text_classification_inference.ts
@@ -12,8 +12,8 @@ import { processInferenceResult, processResponse } from './common';
 import type { TextClassificationResponse, RawTextClassificationResponse } from './common';
 import { getGeneralInputComponent } from '../text_input';
 import { getTextClassificationOutputComponent } from './text_classification_output';
-import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../../common/constants/trained_models';
-import { trainedModelsApiProvider } from '../../../../../services/ml_api_service/trained_models';
+import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../common/constants/trained_models';
+import { trainedModelsApiProvider } from '../../../../services/ml_api_service/trained_models';
 
 export class TextClassificationInference extends InferenceBase<TextClassificationResponse> {
   protected inferenceType = SUPPORTED_PYTORCH_TASKS.TEXT_CLASSIFICATION;
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/text_classification_output.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/text_classification_output.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/text_classification_output.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/text_classification_output.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/zero_shot_classification_inference.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/zero_shot_classification_inference.ts
similarity index 95%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/zero_shot_classification_inference.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/zero_shot_classification_inference.ts
index de8ccbf99cbf5..8b04bb1ec8155 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/zero_shot_classification_inference.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/zero_shot_classification_inference.ts
@@ -9,14 +9,14 @@ import { i18n } from '@kbn/i18n';
 import { BehaviorSubject } from 'rxjs';
 import { map } from 'rxjs/operators';
 import { estypes } from '@elastic/elasticsearch';
-import { trainedModelsApiProvider } from '../../../../../services/ml_api_service/trained_models';
+import { trainedModelsApiProvider } from '../../../../services/ml_api_service/trained_models';
 import { InferenceBase, INPUT_TYPE } from '../inference_base';
 import { processInferenceResult, processResponse } from './common';
 import type { TextClassificationResponse, RawTextClassificationResponse } from './common';
 
 import { getZeroShotClassificationInput } from './zero_shot_classification_input';
 import { getTextClassificationOutputComponent } from './text_classification_output';
-import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../../common/constants/trained_models';
+import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../common/constants/trained_models';
 
 export class ZeroShotClassificationInference extends InferenceBase<TextClassificationResponse> {
   protected inferenceType = SUPPORTED_PYTORCH_TASKS.ZERO_SHOT_CLASSIFICATION;
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/zero_shot_classification_input.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/zero_shot_classification_input.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_classification/zero_shot_classification_input.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_classification/zero_shot_classification_input.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_embedding/index.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_embedding/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_embedding/index.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_embedding/index.ts
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_embedding/text_embedding_inference.ts b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_embedding/text_embedding_inference.ts
similarity index 94%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_embedding/text_embedding_inference.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_embedding/text_embedding_inference.ts
index 961d71fdc452a..cbc6fd8edca68 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_embedding/text_embedding_inference.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_embedding/text_embedding_inference.ts
@@ -11,8 +11,8 @@ import { InferenceBase, INPUT_TYPE } from '../inference_base';
 import type { InferResponse } from '../inference_base';
 import { getGeneralInputComponent } from '../text_input';
 import { getTextEmbeddingOutputComponent } from './text_embedding_output';
-import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../../common/constants/trained_models';
-import { trainedModelsApiProvider } from '../../../../../services/ml_api_service/trained_models';
+import { SUPPORTED_PYTORCH_TASKS } from '../../../../../../common/constants/trained_models';
+import { trainedModelsApiProvider } from '../../../../services/ml_api_service/trained_models';
 
 export interface RawTextEmbeddingResponse {
   inference_results: Array<{ predicted_value: number[] }>;
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_embedding/text_embedding_output.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_embedding/text_embedding_output.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_embedding/text_embedding_output.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_embedding/text_embedding_output.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_input.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/models/text_input.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/models/text_input.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/models/text_input.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/output_loading.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/output_loading.tsx
similarity index 100%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/output_loading.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/output_loading.tsx
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/selected_model.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/selected_model.tsx
similarity index 95%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/selected_model.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/selected_model.tsx
index 3f992b9d4aa28..d0dee3e32a1b3 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/selected_model.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/selected_model.tsx
@@ -23,8 +23,8 @@ import { TextEmbeddingInference } from './models/text_embedding';
 import {
   TRAINED_MODEL_TYPE,
   SUPPORTED_PYTORCH_TASKS,
-} from '../../../../../common/constants/trained_models';
-import { useMlApiContext } from '../../../contexts/kibana';
+} from '../../../../common/constants/trained_models';
+import { useMlApiContext } from '../../contexts/kibana';
 import { InferenceInputForm } from './models/inference_input_form';
 import { InferrerType } from './models';
 import { INPUT_TYPE } from './models/inference_base';
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/test_flyout.tsx b/x-pack/plugins/ml/public/application/model_management/test_models/test_flyout.tsx
similarity index 96%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/test_flyout.tsx
rename to x-pack/plugins/ml/public/application/model_management/test_models/test_flyout.tsx
index 6804a654711cf..1ee8a853bb477 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/test_flyout.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/test_flyout.tsx
@@ -22,7 +22,7 @@ import {
 
 import { SelectedModel } from './selected_model';
 import { INPUT_TYPE } from './models/inference_base';
-import { useTrainedModelsApiService } from '../../../services/ml_api_service/trained_models';
+import { useTrainedModelsApiService } from '../../services/ml_api_service/trained_models';
 
 interface Props {
   modelId: string;
diff --git a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/utils.ts b/x-pack/plugins/ml/public/application/model_management/test_models/utils.ts
similarity index 85%
rename from x-pack/plugins/ml/public/application/trained_models/models_management/test_models/utils.ts
rename to x-pack/plugins/ml/public/application/model_management/test_models/utils.ts
index de38ac9b86c39..431845d9c74e3 100644
--- a/x-pack/plugins/ml/public/application/trained_models/models_management/test_models/utils.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/utils.ts
@@ -9,8 +9,8 @@ import {
   TRAINED_MODEL_TYPE,
   DEPLOYMENT_STATE,
   SUPPORTED_PYTORCH_TASKS,
-} from '../../../../../common/constants/trained_models';
-import type { SupportedPytorchTasksType } from '../../../../../common/constants/trained_models';
+} from '../../../../common/constants/trained_models';
+import type { SupportedPytorchTasksType } from '../../../../common/constants/trained_models';
 import type { ModelItem } from '../models_list';
 
 const PYTORCH_TYPES = Object.values(SUPPORTED_PYTORCH_TASKS);
diff --git a/x-pack/plugins/ml/public/application/overview/overview_page.tsx b/x-pack/plugins/ml/public/application/overview/overview_page.tsx
index b6cd342eb11e9..b524bbe27f080 100644
--- a/x-pack/plugins/ml/public/application/overview/overview_page.tsx
+++ b/x-pack/plugins/ml/public/application/overview/overview_page.tsx
@@ -19,11 +19,13 @@ import { SavedObjectsWarning } from '../components/saved_objects_warning';
 import { UpgradeWarning } from '../components/upgrade';
 import { HelpMenu } from '../components/help_menu';
 import { useMlKibana } from '../contexts/kibana';
-import { NodesList } from '../trained_models/nodes_overview';
+import { NodesList } from '../memory_usage/nodes_overview';
 import { MlPageHeader } from '../components/page_header';
 import { PageTitle } from '../components/page_title';
+import { useIsServerless } from '../contexts/kibana/use_is_serverless';
 
 export const OverviewPage: FC = () => {
+  const serverless = useIsServerless();
   const canViewMlNodes = checkPermission('canViewMlNodes');
 
   const disableCreateAnomalyDetectionJob = !checkPermission('canCreateJob') || !mlNodesAvailable();
@@ -62,7 +64,7 @@ export const OverviewPage: FC = () => {
 
       <GettingStartedCallout />
 
-      {canViewMlNodes ? (
+      {canViewMlNodes && serverless === false ? (
         <>
           <EuiPanel hasShadow={false} hasBorder>
             <NodesList compactView />
diff --git a/x-pack/plugins/ml/public/application/routing/routes/index.ts b/x-pack/plugins/ml/public/application/routing/routes/index.ts
index 3b481ab6cde59..c25fa9a01a1dd 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/index.ts
+++ b/x-pack/plugins/ml/public/application/routing/routes/index.ts
@@ -17,3 +17,4 @@ export * from './explorer';
 export * from './access_denied';
 export * from './trained_models';
 export * from './notifications';
+export * from './memory_usage';
diff --git a/x-pack/plugins/ml/public/application/routing/routes/memory_usage.tsx b/x-pack/plugins/ml/public/application/routing/routes/memory_usage.tsx
new file mode 100644
index 0000000000000..a10eb9610667b
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/routing/routes/memory_usage.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC } from 'react';
+import { i18n } from '@kbn/i18n';
+import { ML_PAGES } from '../../../locator';
+import { NavigateToPath } from '../../contexts/kibana';
+import { MlRoute, PageLoader, PageProps, createPath } from '../router';
+import { useResolver } from '../use_resolver';
+import { basicResolvers } from '../resolvers';
+import { getBreadcrumbWithUrlForApp } from '../breadcrumbs';
+import { MemoryUsagePage } from '../../memory_usage';
+
+export const nodesListRouteFactory = (
+  navigateToPath: NavigateToPath,
+  basePath: string
+): MlRoute => ({
+  path: createPath(ML_PAGES.MEMORY_USAGE),
+  render: (props, deps) => <PageWrapper {...props} deps={deps} />,
+  title: i18n.translate('xpack.ml.modelManagement.memoryUsage.docTitle', {
+    defaultMessage: 'Memory Usage',
+  }),
+  breadcrumbs: [
+    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
+    {
+      text: i18n.translate('xpack.ml.trainedModelsBreadcrumbs.nodeOverviewLabel', {
+        defaultMessage: 'Memory Usage',
+      }),
+    },
+  ],
+  enableDatePicker: true,
+});
+
+const PageWrapper: FC<PageProps> = ({ location, deps }) => {
+  const { context } = useResolver(
+    undefined,
+    undefined,
+    deps.config,
+    deps.dataViewsContract,
+    deps.getSavedSearchDeps,
+    basicResolvers(deps)
+  );
+
+  return (
+    <PageLoader context={context}>
+      <MemoryUsagePage />
+    </PageLoader>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/routing/routes/trained_models/index.ts b/x-pack/plugins/ml/public/application/routing/routes/trained_models/index.ts
index 53b9ffd0ee87e..d69a2256335e3 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/trained_models/index.ts
+++ b/x-pack/plugins/ml/public/application/routing/routes/trained_models/index.ts
@@ -6,4 +6,3 @@
  */
 
 export * from './models_list';
-export * from './nodes_list';
diff --git a/x-pack/plugins/ml/public/application/routing/routes/trained_models/models_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/trained_models/models_list.tsx
index 46fd368829344..e1d093f9003e7 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/trained_models/models_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/trained_models/models_list.tsx
@@ -15,7 +15,7 @@ import { createPath, MlRoute, PageLoader, PageProps } from '../../router';
 import { useResolver } from '../../use_resolver';
 import { basicResolvers } from '../../resolvers';
 import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
-import { ModelsList } from '../../../trained_models/models_management';
+import { ModelsList } from '../../../model_management';
 import { MlPageHeader } from '../../../components/page_header';
 
 export const modelsListRouteFactory = (
@@ -52,7 +52,6 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
   );
   return (
     <PageLoader context={context}>
-      <ModelsList />
       <MlPageHeader>
         <EuiFlexGroup responsive={false} wrap={false} alignItems={'center'} gutterSize={'m'}>
           <EuiFlexItem grow={false}>
@@ -63,6 +62,7 @@ const PageWrapper: FC<PageProps> = ({ location, deps }) => {
           </EuiFlexItem>
         </EuiFlexGroup>
       </MlPageHeader>
+      <ModelsList />
     </PageLoader>
   );
 };
diff --git a/x-pack/plugins/ml/public/application/routing/routes/trained_models/nodes_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/trained_models/nodes_list.tsx
deleted file mode 100644
index 78d99daf0d2d7..0000000000000
--- a/x-pack/plugins/ml/public/application/routing/routes/trained_models/nodes_list.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { FC } from 'react';
-import { FormattedMessage } from '@kbn/i18n-react';
-import { i18n } from '@kbn/i18n';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import { useTimefilter } from '@kbn/ml-date-picker';
-import { ML_PAGES } from '../../../../locator';
-import { NavigateToPath } from '../../../contexts/kibana';
-import { createPath, MlRoute, PageLoader, PageProps } from '../../router';
-import { useResolver } from '../../use_resolver';
-import { basicResolvers } from '../../resolvers';
-import { getBreadcrumbWithUrlForApp } from '../../breadcrumbs';
-import { NodesList } from '../../../trained_models/nodes_overview';
-import { MlPageHeader } from '../../../components/page_header';
-
-export const nodesListRouteFactory = (
-  navigateToPath: NavigateToPath,
-  basePath: string
-): MlRoute => ({
-  path: createPath(ML_PAGES.TRAINED_MODELS_NODES),
-  render: (props, deps) => <PageWrapper {...props} deps={deps} />,
-  title: i18n.translate('xpack.ml.modelManagement.nodesOverview.docTitle', {
-    defaultMessage: 'Nodes',
-  }),
-  breadcrumbs: [
-    getBreadcrumbWithUrlForApp('ML_BREADCRUMB', navigateToPath, basePath),
-    getBreadcrumbWithUrlForApp('TRAINED_MODELS', navigateToPath, basePath),
-    {
-      text: i18n.translate('xpack.ml.trainedModelsBreadcrumbs.nodeOverviewLabel', {
-        defaultMessage: 'Nodes',
-      }),
-    },
-  ],
-  enableDatePicker: true,
-});
-
-const PageWrapper: FC<PageProps> = ({ location, deps }) => {
-  const { context } = useResolver(
-    undefined,
-    undefined,
-    deps.config,
-    deps.dataViewsContract,
-    deps.getSavedSearchDeps,
-    basicResolvers(deps)
-  );
-  useTimefilter({ timeRangeSelector: false, autoRefreshSelector: true });
-  return (
-    <PageLoader context={context}>
-      <MlPageHeader>
-        <EuiFlexGroup responsive={false} wrap={false} alignItems={'center'} gutterSize={'m'}>
-          <EuiFlexItem grow={false}>
-            <FormattedMessage
-              id="xpack.ml.modelManagement.nodesOverviewHeader"
-              defaultMessage="Nodes"
-            />
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </MlPageHeader>
-      <NodesList />
-    </PageLoader>
-  );
-};
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/trained_models.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/trained_models.ts
index 2d8864d755f3b..1548a298acd18 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/trained_models.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/trained_models.ts
@@ -9,6 +9,7 @@ import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import { useMemo } from 'react';
 import { HttpFetchQuery } from '@kbn/core/public';
+import { MlSavedObjectType } from '../../../../common/types/saved_objects';
 import { HttpService } from '../http_service';
 import { basePath } from '.';
 import { useMlKibana } from '../../contexts/kibana';
@@ -17,6 +18,7 @@ import type {
   ModelPipelines,
   TrainedModelStat,
   NodesOverviewResponse,
+  MemoryUsageInfo,
 } from '../../../../common/types/trained_models';
 
 export interface InferenceQueryParams {
@@ -119,7 +121,7 @@ export function trainedModelsApiProvider(httpService: HttpService) {
 
     getTrainedModelsNodesOverview() {
       return httpService.http<NodesOverviewResponse>({
-        path: `${apiBasePath}/trained_models/nodes_overview`,
+        path: `${apiBasePath}/model_management/nodes_overview`,
         method: 'GET',
       });
     },
@@ -185,6 +187,14 @@ export function trainedModelsApiProvider(httpService: HttpService) {
         body,
       });
     },
+
+    memoryUsage(type?: MlSavedObjectType, node?: string, showClosedJobs = false) {
+      return httpService.http<MemoryUsageInfo[]>({
+        path: `${apiBasePath}/model_management/memory_usage`,
+        method: 'GET',
+        query: { type, node, showClosedJobs },
+      });
+    },
   };
 }
 
diff --git a/x-pack/plugins/ml/public/application/trained_models/nodes_overview/expanded_row.tsx b/x-pack/plugins/ml/public/application/trained_models/nodes_overview/expanded_row.tsx
deleted file mode 100644
index a6b6adc4fbc20..0000000000000
--- a/x-pack/plugins/ml/public/application/trained_models/nodes_overview/expanded_row.tsx
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { FC } from 'react';
-import {
-  EuiDescriptionList,
-  EuiFlexGrid,
-  EuiFlexItem,
-  EuiPanel,
-  EuiSpacer,
-  EuiTitle,
-} from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n-react';
-import { cloneDeep } from 'lodash';
-import { FIELD_FORMAT_IDS } from '@kbn/field-formats-plugin/common';
-import { css } from '@emotion/react';
-import { NodeItem } from './nodes_list';
-import { useListItemsFormatter } from '../models_management/expanded_row';
-import { AllocatedModels } from './allocated_models';
-import { useFieldFormatter } from '../../contexts/kibana/use_field_formatter';
-
-interface ExpandedRowProps {
-  item: NodeItem;
-}
-
-export const ExpandedRow: FC<ExpandedRowProps> = ({ item }) => {
-  const bytesFormatter = useFieldFormatter(FIELD_FORMAT_IDS.BYTES);
-
-  const formatToListItems = useListItemsFormatter();
-
-  const {
-    allocated_models: allocatedModels,
-    attributes,
-    memory_overview: memoryOverview,
-    id,
-    ...details
-  } = cloneDeep(item);
-
-  // Process node attributes
-  attributes['ml.machine_memory'] = bytesFormatter(attributes['ml.machine_memory']);
-  attributes['ml.max_jvm_size'] = bytesFormatter(attributes['ml.max_jvm_size']);
-
-  return (
-    <div
-      css={css`
-        width: 100%;
-      `}
-    >
-      <EuiFlexGrid columns={2} gutterSize={'s'}>
-        <EuiFlexItem>
-          <EuiPanel>
-            <EuiTitle size={'xs'}>
-              <h5>
-                <FormattedMessage
-                  id="xpack.ml.trainedModels.nodesList.expandedRow.detailsTitle"
-                  defaultMessage="Details"
-                />
-              </h5>
-            </EuiTitle>
-            <EuiSpacer size={'m'} />
-            <EuiDescriptionList
-              compressed={true}
-              type="column"
-              listItems={formatToListItems(details)}
-            />
-          </EuiPanel>
-        </EuiFlexItem>
-
-        <EuiFlexItem>
-          <EuiPanel>
-            <EuiTitle size={'xs'}>
-              <h5>
-                <FormattedMessage
-                  id="xpack.ml.trainedModels.nodesList.expandedRow.attributesTitle"
-                  defaultMessage="Attributes"
-                />
-              </h5>
-            </EuiTitle>
-            <EuiSpacer size={'m'} />
-            <EuiDescriptionList
-              compressed={true}
-              type="column"
-              listItems={formatToListItems(attributes)}
-            />
-          </EuiPanel>
-        </EuiFlexItem>
-      </EuiFlexGrid>
-
-      {allocatedModels.length > 0 ? (
-        <>
-          <EuiSpacer size={'s'} />
-          <EuiPanel>
-            <EuiTitle size={'xs'}>
-              <h5>
-                <FormattedMessage
-                  id="xpack.ml.trainedModels.nodesList.expandedRow.allocatedModelsTitle"
-                  defaultMessage="Allocated models"
-                />
-              </h5>
-            </EuiTitle>
-            <EuiSpacer size={'m'} />
-
-            <AllocatedModels models={allocatedModels} />
-          </EuiPanel>
-        </>
-      ) : null}
-    </div>
-  );
-};
diff --git a/x-pack/plugins/ml/public/locator/formatters/trained_models.ts b/x-pack/plugins/ml/public/locator/formatters/trained_models.ts
index e2526480bbfab..ddf4782005b42 100644
--- a/x-pack/plugins/ml/public/locator/formatters/trained_models.ts
+++ b/x-pack/plugins/ml/public/locator/formatters/trained_models.ts
@@ -6,10 +6,7 @@
  */
 
 import { setStateToKbnUrl } from '@kbn/kibana-utils-plugin/public';
-import type {
-  TrainedModelsNodesUrlState,
-  TrainedModelsUrlState,
-} from '../../../common/types/locator';
+import type { MemoryUsageUrlState, TrainedModelsUrlState } from '../../../common/types/locator';
 import { ML_PAGES } from '../../../common/constants/locator';
 import type { AppPageState, ListingPageUrlState } from '../../../common/types/common';
 
@@ -41,11 +38,11 @@ export function formatTrainedModelsManagementUrl(
   return url;
 }
 
-export function formatTrainedModelsNodesManagementUrl(
+export function formatMemoryUsageUrl(
   appBasePath: string,
-  mlUrlGeneratorState: TrainedModelsNodesUrlState['pageState']
+  mlUrlGeneratorState: MemoryUsageUrlState['pageState']
 ): string {
-  let url = `${appBasePath}/${ML_PAGES.TRAINED_MODELS_NODES}`;
+  let url = `${appBasePath}/${ML_PAGES.MEMORY_USAGE}`;
   if (mlUrlGeneratorState) {
     const { nodeId } = mlUrlGeneratorState;
     if (nodeId) {
@@ -54,7 +51,7 @@ export function formatTrainedModelsNodesManagementUrl(
       };
 
       const queryState: AppPageState<ListingPageUrlState> = {
-        [ML_PAGES.TRAINED_MODELS_NODES]: nodesListState,
+        [ML_PAGES.MEMORY_USAGE]: nodesListState,
       };
 
       url = setStateToKbnUrl<AppPageState<ListingPageUrlState>>(
diff --git a/x-pack/plugins/ml/public/locator/ml_locator.ts b/x-pack/plugins/ml/public/locator/ml_locator.ts
index 8f9e83fa12034..765af5da1cf9d 100644
--- a/x-pack/plugins/ml/public/locator/ml_locator.ts
+++ b/x-pack/plugins/ml/public/locator/ml_locator.ts
@@ -29,7 +29,7 @@ import {
 } from './formatters';
 import {
   formatTrainedModelsManagementUrl,
-  formatTrainedModelsNodesManagementUrl,
+  formatMemoryUsageUrl,
 } from './formatters/trained_models';
 
 export type { MlLocatorParams, MlLocator };
@@ -74,8 +74,8 @@ export class MlLocatorDefinition implements LocatorDefinition<MlLocatorParams> {
       case ML_PAGES.TRAINED_MODELS_MANAGE:
         path = formatTrainedModelsManagementUrl('', params.pageState);
         break;
-      case ML_PAGES.TRAINED_MODELS_NODES:
-        path = formatTrainedModelsNodesManagementUrl('', params.pageState);
+      case ML_PAGES.MEMORY_USAGE:
+        path = formatMemoryUsageUrl('', params.pageState);
         break;
       case ML_PAGES.ANOMALY_DETECTION_CREATE_JOB:
       case ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_RECOGNIZER:
diff --git a/x-pack/plugins/ml/public/register_helper/register_search_links/search_deep_links.ts b/x-pack/plugins/ml/public/register_helper/register_search_links/search_deep_links.ts
index 979027ba30f55..ab8b15c94e260 100644
--- a/x-pack/plugins/ml/public/register_helper/register_search_links/search_deep_links.ts
+++ b/x-pack/plugins/ml/public/register_helper/register_search_links/search_deep_links.ts
@@ -49,11 +49,11 @@ const MODEL_MANAGEMENT_DEEP_LINK: AppDeepLink = {
       path: `/${ML_PAGES.TRAINED_MODELS_MANAGE}`,
     },
     {
-      id: 'mlNodesOverviewDeepLink',
-      title: i18n.translate('xpack.ml.deepLink.nodesOverview', {
-        defaultMessage: 'Nodes',
+      id: 'mlMemoryUsageDeepLink',
+      title: i18n.translate('xpack.ml.deepLink.memoryUsage', {
+        defaultMessage: 'Memory usage',
       }),
-      path: `/${ML_PAGES.TRAINED_MODELS_NODES}`,
+      path: `/${ML_PAGES.MEMORY_USAGE}`,
     },
   ],
 };
diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/index.ts b/x-pack/plugins/ml/server/models/data_frame_analytics/index.ts
index 75c98bed17b8e..7385ba566269c 100644
--- a/x-pack/plugins/ml/server/models/data_frame_analytics/index.ts
+++ b/x-pack/plugins/ml/server/models/data_frame_analytics/index.ts
@@ -6,5 +6,4 @@
  */
 
 export { analyticsAuditMessagesProvider } from './analytics_audit_messages';
-export { modelsProvider } from './models_provider';
 export { AnalyticsManager } from './analytics_manager';
diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.ts b/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.ts
deleted file mode 100644
index ccb60e6379e48..0000000000000
--- a/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.ts
+++ /dev/null
@@ -1,220 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { IScopedClusterClient } from '@kbn/core/server';
-import { pick } from 'lodash';
-import {
-  MlTrainedModelStats,
-  NodesInfoNodeInfo,
-} from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
-import { isDefined } from '@kbn/ml-is-defined';
-import type {
-  NodeDeploymentStatsResponse,
-  PipelineDefinition,
-  NodesOverviewResponse,
-} from '../../../common/types/trained_models';
-import type { MlClient } from '../../lib/ml_client';
-import {
-  TrainedModelDeploymentStatsResponse,
-  TrainedModelModelSizeStats,
-} from '../../../common/types/trained_models';
-
-export type ModelService = ReturnType<typeof modelsProvider>;
-
-const NODE_FIELDS = ['attributes', 'name', 'roles'] as const;
-
-export type RequiredNodeFields = Pick<NodesInfoNodeInfo, typeof NODE_FIELDS[number]>;
-
-// @ts-expect-error TrainedModelDeploymentStatsResponse missing properties from MlTrainedModelDeploymentStats
-interface TrainedModelStatsResponse extends MlTrainedModelStats {
-  deployment_stats?: Omit<TrainedModelDeploymentStatsResponse, 'model_id'>;
-  model_size_stats?: TrainedModelModelSizeStats;
-}
-
-export interface MemoryStatsResponse {
-  _nodes: { total: number; failed: number; successful: number };
-  cluster_name: string;
-  nodes: Record<
-    string,
-    {
-      jvm: {
-        heap_max_in_bytes: number;
-        java_inference_in_bytes: number;
-        java_inference_max_in_bytes: number;
-      };
-      mem: {
-        adjusted_total_in_bytes: number;
-        total_in_bytes: number;
-        ml: {
-          data_frame_analytics_in_bytes: number;
-          native_code_overhead_in_bytes: number;
-          max_in_bytes: number;
-          anomaly_detectors_in_bytes: number;
-          native_inference_in_bytes: number;
-        };
-      };
-      transport_address: string;
-      roles: string[];
-      name: string;
-      attributes: Record<`${'ml.'}${string}`, string>;
-      ephemeral_id: string;
-    }
-  >;
-}
-
-export function modelsProvider(client: IScopedClusterClient, mlClient: MlClient) {
-  return {
-    /**
-     * Retrieves the map of model ids and aliases with associated pipelines.
-     * @param modelIds - Array of models ids and model aliases.
-     */
-    async getModelsPipelines(modelIds: string[]) {
-      const modelIdsMap = new Map<string, Record<string, PipelineDefinition> | null>(
-        modelIds.map((id: string) => [id, null])
-      );
-
-      try {
-        const body = await client.asCurrentUser.ingest.getPipeline();
-
-        for (const [pipelineName, pipelineDefinition] of Object.entries(body)) {
-          const { processors } = pipelineDefinition as { processors: Array<Record<string, any>> };
-
-          for (const processor of processors) {
-            const id = processor.inference?.model_id;
-            if (modelIdsMap.has(id)) {
-              const obj = modelIdsMap.get(id);
-              if (obj === null) {
-                modelIdsMap.set(id, { [pipelineName]: pipelineDefinition });
-              } else {
-                obj![pipelineName] = pipelineDefinition;
-              }
-            }
-          }
-        }
-      } catch (error) {
-        if (error.statusCode === 404) {
-          // ES returns 404 when there are no pipelines
-          // Instead, we should return the modelIdsMap and a 200
-          return modelIdsMap;
-        }
-        throw error;
-      }
-
-      return modelIdsMap;
-    },
-
-    /**
-     * Provides the ML nodes overview with allocated models.
-     */
-    async getNodesOverview(): Promise<NodesOverviewResponse> {
-      // TODO set node_id to ml:true when elasticsearch client is updated.
-      const response = (await mlClient.getMemoryStats()) as MemoryStatsResponse;
-
-      const { trained_model_stats: trainedModelStats } = await mlClient.getTrainedModelsStats({
-        size: 10000,
-      });
-
-      const mlNodes = Object.entries(response.nodes).filter(([, node]) =>
-        node.roles.includes('ml')
-      );
-
-      const nodeDeploymentStatsResponses: NodeDeploymentStatsResponse[] = mlNodes.map(
-        ([nodeId, node]) => {
-          const nodeFields = pick(node, NODE_FIELDS) as RequiredNodeFields;
-
-          nodeFields.attributes = nodeFields.attributes;
-
-          const allocatedModels = (trainedModelStats as TrainedModelStatsResponse[])
-            .filter(
-              (d) =>
-                isDefined(d.deployment_stats) &&
-                isDefined(d.deployment_stats.nodes) &&
-                d.deployment_stats.nodes.some((n) => Object.keys(n.node)[0] === nodeId)
-            )
-            .map((d) => {
-              const modelSizeState = d.model_size_stats;
-              const deploymentStats = d.deployment_stats;
-
-              if (!deploymentStats || !modelSizeState) {
-                throw new Error('deploymentStats or modelSizeState not defined');
-              }
-
-              const { nodes, ...rest } = deploymentStats;
-
-              const { node: tempNode, ...nodeRest } = nodes.find(
-                (v) => Object.keys(v.node)[0] === nodeId
-              )!;
-              return {
-                model_id: d.model_id,
-                ...rest,
-                ...modelSizeState,
-                node: nodeRest,
-              };
-            });
-
-          const modelsMemoryUsage = allocatedModels.map((v) => {
-            return {
-              model_id: v.model_id,
-              model_size: v.required_native_memory_bytes,
-            };
-          });
-
-          const memoryRes = {
-            adTotalMemory: node.mem.ml.anomaly_detectors_in_bytes,
-            dfaTotalMemory: node.mem.ml.data_frame_analytics_in_bytes,
-            trainedModelsTotalMemory: node.mem.ml.native_inference_in_bytes,
-          };
-
-          for (const key of Object.keys(memoryRes)) {
-            if (memoryRes[key as keyof typeof memoryRes] > 0) {
-              /**
-               * The amount of memory needed to load the ML native code shared libraries. The assumption is that the first
-               * ML job to run on a given node will do this, and then subsequent ML jobs on the same node will reuse the
-               * same already-loaded code.
-               */
-              memoryRes[key as keyof typeof memoryRes] += node.mem.ml.native_code_overhead_in_bytes;
-              break;
-            }
-          }
-
-          return {
-            id: nodeId,
-            ...nodeFields,
-            allocated_models: allocatedModels,
-            memory_overview: {
-              machine_memory: {
-                total: node.mem.adjusted_total_in_bytes,
-                jvm: node.jvm.heap_max_in_bytes,
-              },
-              anomaly_detection: {
-                total: memoryRes.adTotalMemory,
-              },
-              dfa_training: {
-                total: memoryRes.dfaTotalMemory,
-              },
-              trained_models: {
-                total: memoryRes.trainedModelsTotalMemory,
-                by_model: modelsMemoryUsage,
-              },
-              ml_max_in_bytes: node.mem.ml.max_in_bytes,
-            },
-          };
-        }
-      );
-
-      return {
-        // TODO preserve _nodes from the response when getMemoryStats method is updated to support ml:true filter
-        _nodes: {
-          ...response._nodes,
-          total: mlNodes.length,
-          successful: mlNodes.length,
-        },
-        nodes: nodeDeploymentStatsResponses,
-      };
-    },
-  };
-}
diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/__mocks__/mock_deployment_response.json b/x-pack/plugins/ml/server/models/model_management/__mocks__/mock_deployment_response.json
similarity index 100%
rename from x-pack/plugins/ml/server/models/data_frame_analytics/__mocks__/mock_deployment_response.json
rename to x-pack/plugins/ml/server/models/model_management/__mocks__/mock_deployment_response.json
diff --git a/x-pack/plugins/ml/server/models/model_management/index.ts b/x-pack/plugins/ml/server/models/model_management/index.ts
new file mode 100644
index 0000000000000..191d806ade22d
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/model_management/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { modelsProvider } from './models_provider';
+export { MemoryUsageService } from './memory_usage';
diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.test.ts b/x-pack/plugins/ml/server/models/model_management/memory_usage.test.ts
similarity index 97%
rename from x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.test.ts
rename to x-pack/plugins/ml/server/models/model_management/memory_usage.test.ts
index cf4ef22b44016..e08a94e4d951c 100644
--- a/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.test.ts
+++ b/x-pack/plugins/ml/server/models/model_management/memory_usage.test.ts
@@ -5,16 +5,12 @@
  * 2.0.
  */
 
-import { MemoryStatsResponse, ModelService, modelsProvider } from './models_provider';
-import { IScopedClusterClient } from '@kbn/core/server';
-import { MlClient } from '../../lib/ml_client';
+import { MemoryUsageService } from './memory_usage';
+import type { MlClient } from '../../lib/ml_client';
 import mockResponse from './__mocks__/mock_deployment_response.json';
+import type { MemoryStatsResponse } from '../../../common/types/trained_models';
 
 describe('Model service', () => {
-  const client = {
-    asInternalUser: {},
-  } as unknown as jest.Mocked<IScopedClusterClient>;
-
   const mlClient = {
     getTrainedModelsStats: jest.fn(() => {
       return Promise.resolve({
@@ -137,10 +133,10 @@ describe('Model service', () => {
     }),
   } as unknown as jest.Mocked<MlClient>;
 
-  let service: ModelService;
+  let service: MemoryUsageService;
 
   beforeEach(() => {
-    service = modelsProvider(client, mlClient);
+    service = new MemoryUsageService(mlClient);
   });
 
   afterEach(() => {});
diff --git a/x-pack/plugins/ml/server/models/model_management/memory_usage.ts b/x-pack/plugins/ml/server/models/model_management/memory_usage.ts
new file mode 100644
index 0000000000000..29c51055efe5b
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/model_management/memory_usage.ts
@@ -0,0 +1,277 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import numeral from '@elastic/numeral';
+import { pick } from 'lodash';
+import { isDefined } from '@kbn/ml-is-defined';
+import type {
+  MemoryUsageInfo,
+  TrainedModelStatsResponse,
+  MemoryStatsResponse,
+} from '../../../common/types/trained_models';
+
+import type { JobStats } from '../../../common/types/anomaly_detection_jobs';
+import type { MlSavedObjectType } from '../../../common/types/saved_objects';
+import type { MlClient } from '../../lib/ml_client';
+import type {
+  NodeDeploymentStatsResponse,
+  NodesOverviewResponse,
+} from '../../../common/types/trained_models';
+
+// @ts-expect-error numeral missing value
+const AD_EXTRA_MEMORY = numeral('10MB').value();
+// @ts-expect-error numeral missing value
+const DFA_EXTRA_MEMORY = numeral('5MB').value();
+
+const NODE_FIELDS = ['attributes', 'name', 'roles'] as const;
+
+export type RequiredNodeFields = Pick<estypes.NodesInfoNodeInfo, typeof NODE_FIELDS[number]>;
+
+export class MemoryUsageService {
+  constructor(private readonly mlClient: MlClient) {}
+
+  public async getMemorySizes(itemType?: MlSavedObjectType, node?: string, showClosedJobs = false) {
+    let memories: MemoryUsageInfo[] = [];
+
+    switch (itemType) {
+      case 'anomaly-detector':
+        memories = await this.getADJobsSizes();
+        break;
+      case 'data-frame-analytics':
+        memories = await this.getDFAJobsSizes();
+        break;
+      case 'trained-model':
+        memories = await this.getTrainedModelsSizes();
+        break;
+      default:
+        memories = [
+          ...(await this.getADJobsSizes()),
+          ...(await this.getDFAJobsSizes()),
+          ...(await this.getTrainedModelsSizes()),
+        ];
+        break;
+    }
+    return memories.filter((m) => nodeFilter(m, node, showClosedJobs));
+  }
+
+  private async getADJobsSizes() {
+    const jobs = await this.mlClient.getJobStats();
+    return jobs.jobs.map(this.getADJobMemorySize);
+  }
+
+  private async getTrainedModelsSizes() {
+    const [models, stats] = await Promise.all([
+      this.mlClient.getTrainedModels(),
+      this.mlClient.getTrainedModelsStats(),
+    ]);
+    const statsMap = stats.trained_model_stats.reduce<Record<string, estypes.MlTrainedModelStats>>(
+      (acc, cur) => {
+        acc[cur.model_id] = cur;
+        return acc;
+      },
+      {}
+    );
+
+    return models.trained_model_configs.map((m) =>
+      this.getTrainedModelMemorySize(m, statsMap[m.model_id])
+    );
+  }
+
+  private async getDFAJobsSizes() {
+    const [jobs, jobsStats] = await Promise.all([
+      this.mlClient.getDataFrameAnalytics(),
+      this.mlClient.getDataFrameAnalyticsStats(),
+    ]);
+    const statsMap = jobsStats.data_frame_analytics.reduce<
+      Record<string, estypes.MlDataframeAnalytics>
+    >((acc, cur) => {
+      acc[cur.id] = cur;
+      return acc;
+    }, {});
+
+    return jobs.data_frame_analytics.map((j) => this.getDFAJobMemorySize(j, statsMap[j.id]));
+  }
+
+  private getADJobMemorySize(jobStats: JobStats): MemoryUsageInfo {
+    let memory = 0;
+    switch (jobStats.model_size_stats.assignment_memory_basis) {
+      case 'model_memory_limit':
+        memory = (jobStats.model_size_stats.model_bytes_memory_limit as number) ?? 0;
+        break;
+      case 'current_model_bytes':
+        memory = jobStats.model_size_stats.model_bytes as number;
+        break;
+      case 'peak_model_bytes':
+        memory = (jobStats.model_size_stats.peak_model_bytes as number) ?? 0;
+        break;
+    }
+
+    const size = memory + AD_EXTRA_MEMORY;
+    const nodeName = jobStats.node?.name;
+    return {
+      id: jobStats.job_id,
+      type: 'anomaly-detector',
+      size,
+      nodeNames: nodeName ? [nodeName] : [],
+    };
+  }
+
+  private getDFAJobMemorySize(
+    job: estypes.MlDataframeAnalyticsSummary,
+    jobStats: estypes.MlDataframeAnalytics
+  ): MemoryUsageInfo {
+    const mml = job.model_memory_limit ?? '0mb';
+    // @ts-expect-error numeral missing value
+    const memory = numeral(mml.toUpperCase()).value();
+    const size = memory + DFA_EXTRA_MEMORY;
+    const nodeName = jobStats.node?.name;
+    return {
+      id: jobStats.id,
+      type: 'data-frame-analytics',
+      size,
+      nodeNames: nodeName ? [nodeName] : [],
+    };
+  }
+
+  private getTrainedModelMemorySize(
+    trainedModel: estypes.MlTrainedModelConfig,
+    trainedModelStats: estypes.MlTrainedModelStats
+  ): MemoryUsageInfo {
+    const memory = trainedModelStats.model_size_stats.required_native_memory_bytes;
+
+    const size = memory + AD_EXTRA_MEMORY;
+    const nodes = (trainedModelStats.deployment_stats?.nodes ??
+      []) as estypes.MlTrainedModelDeploymentNodesStats[];
+    return {
+      id: trainedModelStats.model_id,
+      type: 'trained-model',
+      size,
+      nodeNames: nodes.map((n) => Object.values(n.node)[0].name),
+    };
+  }
+
+  /**
+   * Provides the ML nodes overview with allocated models.
+   */
+  async getNodesOverview(): Promise<NodesOverviewResponse> {
+    // TODO set node_id to ml:true when elasticsearch client is updated.
+    const response = (await this.mlClient.getMemoryStats()) as MemoryStatsResponse;
+
+    const { trained_model_stats: trainedModelStats } = await this.mlClient.getTrainedModelsStats({
+      size: 10000,
+    });
+
+    const mlNodes = Object.entries(response.nodes).filter(([, node]) => node.roles.includes('ml'));
+
+    const nodeDeploymentStatsResponses: NodeDeploymentStatsResponse[] = mlNodes.map(
+      ([nodeId, node]) => {
+        const nodeFields = pick(node, NODE_FIELDS) as RequiredNodeFields;
+
+        nodeFields.attributes = nodeFields.attributes;
+
+        const allocatedModels = (trainedModelStats as TrainedModelStatsResponse[])
+          .filter(
+            (d) =>
+              isDefined(d.deployment_stats) &&
+              isDefined(d.deployment_stats.nodes) &&
+              d.deployment_stats.nodes.some((n) => Object.keys(n.node)[0] === nodeId)
+          )
+          .map((d) => {
+            const modelSizeState = d.model_size_stats;
+            const deploymentStats = d.deployment_stats;
+
+            if (!deploymentStats || !modelSizeState) {
+              throw new Error('deploymentStats or modelSizeState not defined');
+            }
+
+            const { nodes, ...rest } = deploymentStats;
+
+            const { node: tempNode, ...nodeRest } = nodes.find(
+              (v) => Object.keys(v.node)[0] === nodeId
+            )!;
+            return {
+              model_id: d.model_id,
+              ...rest,
+              ...modelSizeState,
+              node: nodeRest,
+            };
+          });
+
+        const modelsMemoryUsage = allocatedModels.map((v) => {
+          return {
+            model_id: v.model_id,
+            model_size: v.required_native_memory_bytes,
+          };
+        });
+
+        const memoryRes = {
+          adTotalMemory: node.mem.ml.anomaly_detectors_in_bytes,
+          dfaTotalMemory: node.mem.ml.data_frame_analytics_in_bytes,
+          trainedModelsTotalMemory: node.mem.ml.native_inference_in_bytes,
+        };
+
+        for (const key of Object.keys(memoryRes)) {
+          if (memoryRes[key as keyof typeof memoryRes] > 0) {
+            /**
+             * The amount of memory needed to load the ML native code shared libraries. The assumption is that the first
+             * ML job to run on a given node will do this, and then subsequent ML jobs on the same node will reuse the
+             * same already-loaded code.
+             */
+            memoryRes[key as keyof typeof memoryRes] += node.mem.ml.native_code_overhead_in_bytes;
+            break;
+          }
+        }
+
+        return {
+          id: nodeId,
+          ...nodeFields,
+          allocated_models: allocatedModels,
+          memory_overview: {
+            machine_memory: {
+              total: node.mem.adjusted_total_in_bytes,
+              jvm: node.jvm.heap_max_in_bytes,
+            },
+            anomaly_detection: {
+              total: memoryRes.adTotalMemory,
+            },
+            dfa_training: {
+              total: memoryRes.dfaTotalMemory,
+            },
+            trained_models: {
+              total: memoryRes.trainedModelsTotalMemory,
+              by_model: modelsMemoryUsage,
+            },
+            ml_max_in_bytes: node.mem.ml.max_in_bytes,
+          },
+        };
+      }
+    );
+
+    return {
+      // TODO preserve _nodes from the response when getMemoryStats method is updated to support ml:true filter
+      _nodes: {
+        ...response._nodes,
+        total: mlNodes.length,
+        successful: mlNodes.length,
+      },
+      nodes: nodeDeploymentStatsResponses,
+    };
+  }
+}
+
+function nodeFilter(m: MemoryUsageInfo, node?: string, showClosedJobs = false) {
+  if (m.nodeNames.length === 0) {
+    return showClosedJobs;
+  }
+
+  if (node === undefined) {
+    return true;
+  }
+
+  return m.nodeNames.includes(node);
+}
diff --git a/x-pack/plugins/ml/server/models/model_management/models_provider.ts b/x-pack/plugins/ml/server/models/model_management/models_provider.ts
new file mode 100644
index 0000000000000..e4ba7e2df04a9
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/model_management/models_provider.ts
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IScopedClusterClient } from '@kbn/core/server';
+
+import type { PipelineDefinition } from '../../../common/types/trained_models';
+
+export type ModelService = ReturnType<typeof modelsProvider>;
+
+export function modelsProvider(client: IScopedClusterClient) {
+  return {
+    /**
+     * Retrieves the map of model ids and aliases with associated pipelines.
+     * @param modelIds - Array of models ids and model aliases.
+     */
+    async getModelsPipelines(modelIds: string[]) {
+      const modelIdsMap = new Map<string, Record<string, PipelineDefinition> | null>(
+        modelIds.map((id: string) => [id, null])
+      );
+
+      try {
+        const body = await client.asCurrentUser.ingest.getPipeline();
+
+        for (const [pipelineName, pipelineDefinition] of Object.entries(body)) {
+          const { processors } = pipelineDefinition as { processors: Array<Record<string, any>> };
+
+          for (const processor of processors) {
+            const id = processor.inference?.model_id;
+            if (modelIdsMap.has(id)) {
+              const obj = modelIdsMap.get(id);
+              if (obj === null) {
+                modelIdsMap.set(id, { [pipelineName]: pipelineDefinition });
+              } else {
+                obj![pipelineName] = pipelineDefinition;
+              }
+            }
+          }
+        }
+      } catch (error) {
+        if (error.statusCode === 404) {
+          // ES returns 404 when there are no pipelines
+          // Instead, we should return the modelIdsMap and a 200
+          return modelIdsMap;
+        }
+        throw error;
+      }
+
+      return modelIdsMap;
+    },
+  };
+}
diff --git a/x-pack/plugins/ml/server/plugin.ts b/x-pack/plugins/ml/server/plugin.ts
index fc12a261031ef..f9b69c1c6ab2c 100644
--- a/x-pack/plugins/ml/server/plugin.ts
+++ b/x-pack/plugins/ml/server/plugin.ts
@@ -47,6 +47,7 @@ import { jobServiceRoutes } from './routes/job_service';
 import { savedObjectsRoutes } from './routes/saved_objects';
 import { jobValidationRoutes } from './routes/job_validation';
 import { resultsServiceRoutes } from './routes/results_service';
+import { modelManagementRoutes } from './routes/model_management';
 import { systemRoutes } from './routes/system';
 import { MlLicense } from '../common/license';
 import { createSharedServices, SharedServices } from './shared_services';
@@ -217,6 +218,7 @@ export class MlServerPlugin
     jobRoutes(routeInit);
     jobServiceRoutes(routeInit);
     managementRoutes(routeInit);
+    modelManagementRoutes(routeInit);
     resultsServiceRoutes(routeInit);
     jobValidationRoutes(routeInit);
     savedObjectsRoutes(routeInit, {
diff --git a/x-pack/plugins/ml/server/routes/apidoc.json b/x-pack/plugins/ml/server/routes/apidoc.json
index e265f2c828f09..573080a1d187a 100644
--- a/x-pack/plugins/ml/server/routes/apidoc.json
+++ b/x-pack/plugins/ml/server/routes/apidoc.json
@@ -170,7 +170,6 @@
     "GetTrainedModel",
     "GetTrainedModelStats",
     "GetTrainedModelStatsById",
-    "GetTrainedModelsNodesOverview",
     "GetTrainedModelPipelines",
     "StartTrainedModelDeployment",
     "UpdateTrainedModelDeployment",
@@ -184,6 +183,10 @@
     "PreviewAlert",
 
     "Management",
-    "ManagementList"
+    "ManagementList",
+
+    "ModelManagement",
+    "GetModelManagementNodesOverview",
+    "GetModelManagementMemoryUsage"
   ]
 }
diff --git a/x-pack/plugins/ml/server/routes/model_management.ts b/x-pack/plugins/ml/server/routes/model_management.ts
new file mode 100644
index 0000000000000..a72e515a6dd9d
--- /dev/null
+++ b/x-pack/plugins/ml/server/routes/model_management.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RouteInitialization } from '../types';
+import { wrapError } from '../client/error_wrapper';
+
+import { MemoryUsageService } from '../models/model_management';
+import { itemTypeLiterals } from './schemas/saved_objects';
+
+export function modelManagementRoutes({ router, routeGuard }: RouteInitialization) {
+  /**
+   * @apiGroup ModelManagement
+   *
+   * @api {get} /api/ml/model_management/nodes_overview Get node overview about the models allocation
+   * @apiName GetModelManagementNodesOverview
+   * @apiDescription Retrieves the list of ML nodes with memory breakdown and allocated models info
+   */
+  router.get(
+    {
+      path: '/api/ml/model_management/nodes_overview',
+      validate: {},
+      options: {
+        tags: [
+          'access:ml:canViewMlNodes',
+          'access:ml:canGetDataFrameAnalytics',
+          'access:ml:canGetJobs',
+          'access:ml:canGetTrainedModels',
+        ],
+      },
+    },
+    routeGuard.fullLicenseAPIGuard(async ({ client, mlClient, response }) => {
+      try {
+        const memoryUsageService = new MemoryUsageService(mlClient);
+        const result = await memoryUsageService.getNodesOverview();
+        return response.ok({
+          body: result,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup ModelManagement
+   *
+   * @api {get} /api/ml/model_management/memory_usage Memory usage for jobs and trained models
+   * @apiName GetModelManagementMemoryUsage
+   * @apiDescription Returns the memory usage for jobs and trained models
+   */
+  router.get(
+    {
+      path: '/api/ml/model_management/memory_usage',
+      validate: {
+        query: schema.object({
+          type: schema.maybe(itemTypeLiterals),
+          node: schema.maybe(schema.string()),
+          showClosedJobs: schema.maybe(schema.boolean()),
+        }),
+      },
+      options: {
+        tags: [
+          'access:ml:canViewMlNodes',
+          'access:ml:canGetDataFrameAnalytics',
+          'access:ml:canGetJobs',
+          'access:ml:canGetTrainedModels',
+        ],
+      },
+    },
+
+    routeGuard.fullLicenseAPIGuard(async ({ mlClient, response, request }) => {
+      try {
+        const memoryUsageService = new MemoryUsageService(mlClient);
+        return response.ok({
+          body: await memoryUsageService.getMemorySizes(
+            request.query.type,
+            request.query.node,
+            request.query.showClosedJobs
+          ),
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+}
diff --git a/x-pack/plugins/ml/server/routes/schemas/saved_objects.ts b/x-pack/plugins/ml/server/routes/schemas/saved_objects.ts
index ef5c81a08a516..fb133fb8955cc 100644
--- a/x-pack/plugins/ml/server/routes/schemas/saved_objects.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/saved_objects.ts
@@ -19,6 +19,7 @@ export const itemTypeLiterals = schema.oneOf([
 ]);
 
 export const itemTypeSchema = schema.object({ jobType: itemTypeLiterals });
+export const jobTypeSchema = schema.object({ jobType: jobTypeLiterals });
 
 export const updateJobsSpaces = schema.object({
   jobType: jobTypeLiterals,
diff --git a/x-pack/plugins/ml/server/routes/trained_models.ts b/x-pack/plugins/ml/server/routes/trained_models.ts
index a234163dbde99..c09b46f7c23cb 100644
--- a/x-pack/plugins/ml/server/routes/trained_models.ts
+++ b/x-pack/plugins/ml/server/routes/trained_models.ts
@@ -19,10 +19,11 @@ import {
   pipelineSimulateBody,
   updateDeploymentParamsSchema,
 } from './schemas/inference_schema';
-import { modelsProvider } from '../models/data_frame_analytics';
+
 import { TrainedModelConfigResponse } from '../../common/types/trained_models';
 import { mlLog } from '../lib/log';
 import { forceQuerySchema } from './schemas/anomaly_detectors_schema';
+import { modelsProvider } from '../models/model_management';
 
 export function trainedModelsRoutes({ router, routeGuard }: RouteInitialization) {
   /**
@@ -68,7 +69,7 @@ export function trainedModelsRoutes({ router, routeGuard }: RouteInitialization)
               )
             );
 
-            const pipelinesResponse = await modelsProvider(client, mlClient).getModelsPipelines(
+            const pipelinesResponse = await modelsProvider(client).getModelsPipelines(
               modelIdsAndAliases
             );
             for (const model of result) {
@@ -178,9 +179,7 @@ export function trainedModelsRoutes({ router, routeGuard }: RouteInitialization)
     routeGuard.fullLicenseAPIGuard(async ({ client, request, mlClient, response }) => {
       try {
         const { modelId } = request.params;
-        const result = await modelsProvider(client, mlClient).getModelsPipelines(
-          modelId.split(',')
-        );
+        const result = await modelsProvider(client).getModelsPipelines(modelId.split(','));
         return response.ok({
           body: [...result].map(([id, pipelines]) => ({ model_id: id, pipelines })),
         });
@@ -260,38 +259,6 @@ export function trainedModelsRoutes({ router, routeGuard }: RouteInitialization)
     })
   );
 
-  /**
-   * @apiGroup TrainedModels
-   *
-   * @api {get} /api/ml/trained_models/nodes_overview Get node overview about the models allocation
-   * @apiName GetTrainedModelsNodesOverview
-   * @apiDescription Retrieves the list of ML nodes with memory breakdown and allocated models info
-   */
-  router.get(
-    {
-      path: '/api/ml/trained_models/nodes_overview',
-      validate: {},
-      options: {
-        tags: [
-          'access:ml:canViewMlNodes',
-          'access:ml:canGetDataFrameAnalytics',
-          'access:ml:canGetJobs',
-          'access:ml:canGetTrainedModels',
-        ],
-      },
-    },
-    routeGuard.fullLicenseAPIGuard(async ({ client, mlClient, request, response }) => {
-      try {
-        const result = await modelsProvider(client, mlClient).getNodesOverview();
-        return response.ok({
-          body: result,
-        });
-      } catch (e) {
-        return response.customError(wrapError(e));
-      }
-    })
-  );
-
   /**
    * @apiGroup TrainedModels
    *
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index 69a2dfeda1909..a45a8a7dab559 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -21232,7 +21232,6 @@
     "xpack.ml.deepLink.filterListsSettings": "Listes de filtres",
     "xpack.ml.deepLink.indexDataVisualizer": "Index Data Visualizer (Visualiseur de données pour les index)",
     "xpack.ml.deepLink.modelManagement": "Gestion des modèles",
-    "xpack.ml.deepLink.nodesOverview": "Nœuds",
     "xpack.ml.deepLink.overview": "Aperçu",
     "xpack.ml.deepLink.settings": "Paramètres",
     "xpack.ml.deepLink.trainedModels": "Modèles entraînés",
@@ -21772,8 +21771,6 @@
     "xpack.ml.mlEntitySelector.dfaOptionsLabel": "Analyse du cadre de données",
     "xpack.ml.mlEntitySelector.fetchError": "Impossible de récupérer les entités de ML",
     "xpack.ml.mlEntitySelector.trainedModelsLabel": "Modèles entraînés",
-    "xpack.ml.modelManagement.nodesOverview.docTitle": "Nœuds",
-    "xpack.ml.modelManagement.nodesOverviewHeader": "Nœuds",
     "xpack.ml.modelManagement.trainedModels.docTitle": "Modèles entraînés",
     "xpack.ml.modelManagement.trainedModelsHeader": "Modèles entraînés",
     "xpack.ml.modelManagementLabel": "Gestion des modèles",
@@ -21884,7 +21881,6 @@
     "xpack.ml.navMenu.logCategorizationLinkText": "Analyse du modèle de log",
     "xpack.ml.navMenu.mlAppNameText": "Machine Learning",
     "xpack.ml.navMenu.modelManagementText": "Gestion des modèles",
-    "xpack.ml.navMenu.nodesOverviewText": "Nœuds",
     "xpack.ml.navMenu.notificationsTabLinkText": "Notifications",
     "xpack.ml.navMenu.overviewTabLinkText": "Aperçu",
     "xpack.ml.navMenu.settingsTabLinkText": "Paramètres",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index aafb384cf9400..2dd00ba312030 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -21212,7 +21212,6 @@
     "xpack.ml.deepLink.filterListsSettings": "フィルターリスト",
     "xpack.ml.deepLink.indexDataVisualizer": "インデックスデータビジュアライザー",
     "xpack.ml.deepLink.modelManagement": "モデル管理",
-    "xpack.ml.deepLink.nodesOverview": "ノード",
     "xpack.ml.deepLink.overview": "概要",
     "xpack.ml.deepLink.settings": "設定",
     "xpack.ml.deepLink.trainedModels": "学習済みモデル",
@@ -21752,8 +21751,6 @@
     "xpack.ml.mlEntitySelector.dfaOptionsLabel": "データフレーム分析",
     "xpack.ml.mlEntitySelector.fetchError": "MLエンティティを取得できませんでした",
     "xpack.ml.mlEntitySelector.trainedModelsLabel": "学習済みモデル",
-    "xpack.ml.modelManagement.nodesOverview.docTitle": "ノード",
-    "xpack.ml.modelManagement.nodesOverviewHeader": "ノード",
     "xpack.ml.modelManagement.trainedModels.docTitle": "学習済みモデル",
     "xpack.ml.modelManagement.trainedModelsHeader": "学習済みモデル",
     "xpack.ml.modelManagementLabel": "モデル管理",
@@ -21864,7 +21861,6 @@
     "xpack.ml.navMenu.logCategorizationLinkText": "ログパターン分析",
     "xpack.ml.navMenu.mlAppNameText": "機械学習",
     "xpack.ml.navMenu.modelManagementText": "モデル管理",
-    "xpack.ml.navMenu.nodesOverviewText": "ノード",
     "xpack.ml.navMenu.notificationsTabLinkText": "通知",
     "xpack.ml.navMenu.overviewTabLinkText": "概要",
     "xpack.ml.navMenu.settingsTabLinkText": "設定",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index ea907ebb37ab9..9bfbda1558039 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -21242,7 +21242,6 @@
     "xpack.ml.deepLink.filterListsSettings": "筛选列表",
     "xpack.ml.deepLink.indexDataVisualizer": "索引数据可视化工具",
     "xpack.ml.deepLink.modelManagement": "模型管理",
-    "xpack.ml.deepLink.nodesOverview": "节点",
     "xpack.ml.deepLink.overview": "概览",
     "xpack.ml.deepLink.settings": "设置",
     "xpack.ml.deepLink.trainedModels": "已训练模型",
@@ -21782,8 +21781,6 @@
     "xpack.ml.mlEntitySelector.dfaOptionsLabel": "数据帧分析",
     "xpack.ml.mlEntitySelector.fetchError": "无法提取 ML 实体",
     "xpack.ml.mlEntitySelector.trainedModelsLabel": "已训练模型",
-    "xpack.ml.modelManagement.nodesOverview.docTitle": "节点",
-    "xpack.ml.modelManagement.nodesOverviewHeader": "节点",
     "xpack.ml.modelManagement.trainedModels.docTitle": "已训练模型",
     "xpack.ml.modelManagement.trainedModelsHeader": "已训练模型",
     "xpack.ml.modelManagementLabel": "模型管理",
@@ -21894,7 +21891,6 @@
     "xpack.ml.navMenu.logCategorizationLinkText": "日志模式分析",
     "xpack.ml.navMenu.mlAppNameText": "Machine Learning",
     "xpack.ml.navMenu.modelManagementText": "模型管理",
-    "xpack.ml.navMenu.nodesOverviewText": "节点",
     "xpack.ml.navMenu.notificationsTabLinkText": "通知",
     "xpack.ml.navMenu.overviewTabLinkText": "概览",
     "xpack.ml.navMenu.settingsTabLinkText": "设置",

From a496623003e4a3f51d582b8a0447a8a9b10d94a3 Mon Sep 17 00:00:00 2001
From: Sander Philipse <94373878+sphilipse@users.noreply.github.com>
Date: Tue, 7 Feb 2023 12:59:48 +0100
Subject: [PATCH 044/134] [Enterprise Search] Add integration tiles for new
 connectors (#150369)

## Summary

This adds a bunch of integration tiles for our new connectors: Azure
Cloud, Google Cloud, Amazon S3, MS SQL, PostgreSQL and Oracle.
---
 .../apis/custom_integration/integrations.ts   |   2 +-
 .../public/assets/source_icons/amazon_s3.svg  |  14 ++
 .../assets/source_icons/azure_cloud.svg       |  13 ++
 .../assets/source_icons/google_cloud.svg      |  16 ++
 .../assets/source_icons/microsoft_sql.svg     |  19 ++
 .../public/assets/source_icons/oracle.svg     |   3 +
 .../public/assets/source_icons/postgresql.svg |  13 ++
 .../enterprise_search/server/integrations.ts  | 167 ++++++++++++++++++
 8 files changed, 246 insertions(+), 1 deletion(-)
 create mode 100644 x-pack/plugins/enterprise_search/public/assets/source_icons/amazon_s3.svg
 create mode 100644 x-pack/plugins/enterprise_search/public/assets/source_icons/azure_cloud.svg
 create mode 100644 x-pack/plugins/enterprise_search/public/assets/source_icons/google_cloud.svg
 create mode 100644 x-pack/plugins/enterprise_search/public/assets/source_icons/microsoft_sql.svg
 create mode 100644 x-pack/plugins/enterprise_search/public/assets/source_icons/oracle.svg
 create mode 100644 x-pack/plugins/enterprise_search/public/assets/source_icons/postgresql.svg

diff --git a/test/api_integration/apis/custom_integration/integrations.ts b/test/api_integration/apis/custom_integration/integrations.ts
index c1b6518f6684a..a924b416f30c8 100644
--- a/test/api_integration/apis/custom_integration/integrations.ts
+++ b/test/api_integration/apis/custom_integration/integrations.ts
@@ -22,7 +22,7 @@ export default function ({ getService }: FtrProviderContext) {
 
         expect(resp.body).to.be.an('array');
 
-        expect(resp.body.length).to.be(43);
+        expect(resp.body.length).to.be(49);
 
         // Test for sample data card
         expect(resp.body.findIndex((c: { id: string }) => c.id === 'sample_data_all')).to.be.above(
diff --git a/x-pack/plugins/enterprise_search/public/assets/source_icons/amazon_s3.svg b/x-pack/plugins/enterprise_search/public/assets/source_icons/amazon_s3.svg
new file mode 100644
index 0000000000000..d7f6497c26c95
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/assets/source_icons/amazon_s3.svg
@@ -0,0 +1,14 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M32.4738 47.4258L54.6809 52.7991V11.104L32.4738 16.4809V47.4258Z" fill="#8C3123"/>
+<path d="M54.6818 11.104L58.9493 13.2373V50.6782L54.6818 52.8107V11.104Z" fill="#E05243"/>
+<path d="M42.16 18.5387L32.4738 16.1422V0L42.16 4.84267V18.5387Z" fill="#E05243"/>
+<path d="M32.4738 64L42.1591 59.1591V45.4631L32.4738 47.8587V64Z" fill="#E05243"/>
+<path d="M42.16 38.8569L32.4738 40.0898V23.9467L42.16 25.1618V38.8569Z" fill="#E05243"/>
+<path d="M32.4738 47.4258L10.2658 52.7991V11.104L32.4738 16.4809V47.4258Z" fill="#E05243"/>
+<path d="M10.2658 11.104L5.99998 13.2373V50.6782L10.2658 52.8107V11.104Z" fill="#8C3123"/>
+<path d="M22.7902 18.5387L32.4738 16.1422V0L22.7902 4.84267V18.5387Z" fill="#8C3123"/>
+<path d="M32.4738 64L22.7893 59.1591V45.4631L32.4738 47.8587V64Z" fill="#8C3123"/>
+<path d="M22.7902 38.8569L32.4738 40.0898V23.9467L22.7902 25.1618V38.8569Z" fill="#8C3123"/>
+<path d="M42.16 18.5387L32.4738 20.304L22.7902 18.5387L32.4738 16.1422L42.16 18.5387Z" fill="#5E1F18"/>
+<path d="M42.16 45.4622L32.4738 43.6853L22.7902 45.4622L32.4738 47.8738L42.16 45.4622Z" fill="#F2B0A9"/>
+</svg>
diff --git a/x-pack/plugins/enterprise_search/public/assets/source_icons/azure_cloud.svg b/x-pack/plugins/enterprise_search/public/assets/source_icons/azure_cloud.svg
new file mode 100644
index 0000000000000..2a32f39698611
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/assets/source_icons/azure_cloud.svg
@@ -0,0 +1,13 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_857_78974)">
+<path d="M46.3439 3.99999H17.6561C16.4718 3.99999 15.3787 4.63106 14.7874 5.65633L0.443484 30.5014C-0.147828 31.5266 -0.147828 32.7888 0.443484 33.814L14.7874 58.6591C15.3787 59.6844 16.4735 60.3154 17.6561 60.3154H46.3439C47.5282 60.3154 48.6213 59.6844 49.2126 58.6591L63.5565 33.814C64.1478 32.7888 64.1478 31.5266 63.5565 30.5014L49.2126 5.65633C48.6213 4.63106 47.5282 3.99999 46.3439 3.99999Z" fill="#2979FF"/>
+<path d="M45.2507 50.3774H18.7493C17.835 50.3774 17.093 49.6354 17.093 48.7211V15.5944C17.093 14.6801 17.835 13.938 18.7493 13.938H40.2817L46.9071 20.5634V48.7211C46.9071 49.6354 46.165 50.3774 45.2507 50.3774Z" fill="white"/>
+<path d="M40.2817 13.938V18.907C40.2817 19.8213 41.0237 20.5634 41.938 20.5634H46.9071L40.2817 13.938Z" fill="#B1CFFF"/>
+<path d="M29.1263 31.8778H26.9151V24.8367L24.7419 25.4711V23.7965L28.9225 22.3505H29.1246L29.1263 31.8778ZM39.7881 27.9837C39.7881 28.6728 39.7069 29.2691 39.5463 29.7742C39.3856 30.2761 39.1587 30.6952 38.8655 31.0264C38.574 31.3577 38.2245 31.6045 37.8187 31.7652C37.4129 31.9258 36.9657 32.007 36.4771 32.007C35.9835 32.007 35.533 31.9258 35.1255 31.7652C34.7181 31.6045 34.3686 31.3577 34.0771 31.0264C33.7855 30.6952 33.5553 30.2761 33.393 29.7742C33.229 29.2691 33.1495 28.6728 33.1495 27.9837V26.2429C33.1495 25.5589 33.2307 24.9626 33.3913 24.4574C33.552 23.9522 33.7789 23.5332 34.0721 23.2019C34.3636 22.8706 34.7131 22.6238 35.1189 22.4632C35.5214 22.3009 35.9702 22.2197 36.4638 22.2197C36.9525 22.2197 37.3997 22.3009 37.8071 22.4615C38.2146 22.6222 38.5657 22.869 38.8589 23.2002C39.1504 23.5315 39.3773 23.9506 39.5413 24.4558C39.7053 24.9609 39.7881 25.5572 39.7881 26.2413V27.9837ZM37.5819 25.963C37.5819 25.5837 37.5554 25.2657 37.504 25.004C37.451 24.7473 37.3781 24.5353 37.2821 24.3729C37.186 24.2123 37.0684 24.0963 36.9309 24.0268C36.7934 23.9572 36.6394 23.9224 36.4638 23.9224C36.2899 23.9224 36.1326 23.9572 35.9951 24.0268C35.8576 24.0963 35.7417 24.2123 35.6489 24.3729C35.5545 24.5336 35.4833 24.7456 35.4336 25.004C35.3839 25.2657 35.3591 25.5837 35.3591 25.963V28.2537C35.3591 28.6413 35.3822 28.9676 35.4336 29.2293C35.4833 29.491 35.5578 29.703 35.6539 29.8604C35.75 30.021 35.8676 30.1353 36.0067 30.2049C36.1458 30.2745 36.3032 30.3092 36.4771 30.3092C36.6477 30.3092 36.8001 30.2745 36.9375 30.2049C37.075 30.1353 37.1926 30.021 37.2887 29.8604C37.3848 29.703 37.456 29.491 37.5073 29.2293C37.557 28.9676 37.5835 28.643 37.5835 28.2537L37.5819 25.963ZM30.8538 41.3852C30.8538 42.0742 30.7727 42.6705 30.612 43.1757C30.4513 43.6775 30.2244 44.0966 29.9312 44.4279C29.6397 44.7591 29.2902 45.0059 28.8844 45.1666C28.4786 45.3272 28.0314 45.4084 27.5428 45.4084C27.0492 45.4084 26.5987 45.3272 26.1912 45.1666C25.7838 45.0059 25.4343 44.7591 25.1428 44.4279C24.8513 44.0966 24.621 43.6775 24.4587 43.1757C24.2947 42.6705 24.2152 42.0742 24.2152 41.3852V39.6444C24.2152 38.9603 24.2964 38.364 24.4571 37.8588C24.6177 37.3536 24.8446 36.9346 25.1378 36.6033C25.4293 36.2721 25.7788 36.0253 26.1846 35.8646C26.5904 35.7039 27.0393 35.6228 27.5329 35.6228C28.0215 35.6228 28.4687 35.7039 28.8762 35.8646C29.2836 36.0253 29.6348 36.2721 29.9279 36.6033C30.2194 36.9346 30.4464 37.3536 30.6103 37.8588C30.7743 38.364 30.8571 38.9603 30.8571 39.6444V41.3852H30.8538ZM28.6492 39.3628C28.6492 38.9835 28.6227 38.6655 28.5714 38.4038C28.5184 38.147 28.4455 37.935 28.3494 37.7727C28.2534 37.612 28.1358 37.4961 27.9983 37.4265C27.8608 37.357 27.7068 37.3222 27.5312 37.3222C27.3556 37.3222 27.1999 37.357 27.0625 37.4265C26.925 37.4961 26.809 37.612 26.7163 37.7727C26.6219 37.9334 26.5507 38.1454 26.501 38.4038C26.4513 38.6655 26.4264 38.9835 26.4264 39.3628V41.6535C26.4264 42.0411 26.4496 42.3674 26.501 42.6291C26.5507 42.8908 26.6252 43.1028 26.7213 43.2601C26.8173 43.4208 26.9349 43.5351 27.0741 43.6047C27.2132 43.6742 27.3705 43.709 27.5445 43.709C27.7151 43.709 27.8674 43.6742 28.0049 43.6047C28.1424 43.5351 28.26 43.4208 28.3561 43.2601C28.4521 43.1028 28.5234 42.8908 28.5747 42.6291C28.6244 42.3674 28.6509 42.0427 28.6509 41.6535V39.3628H28.6492ZM38.0605 45.2776H35.8493V38.2365L33.6762 38.8708V37.1963L37.8568 35.7503H38.0589L38.0605 45.2776Z" fill="#03A9F4"/>
+</g>
+<defs>
+<clipPath id="clip0_857_78974">
+<rect width="64" height="64" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/x-pack/plugins/enterprise_search/public/assets/source_icons/google_cloud.svg b/x-pack/plugins/enterprise_search/public/assets/source_icons/google_cloud.svg
new file mode 100644
index 0000000000000..937f8382a0cac
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/assets/source_icons/google_cloud.svg
@@ -0,0 +1,16 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M45.1514 59.971L33.644 59.9691C34.6977 59.9691 35.618 59.4063 36.1103 58.5701L51.7293 31.9856L41.8651 15.1944L53.3708 15.195C54.354 15.1958 55.31 15.6977 55.8368 16.5946L63.237 29.1878C64.2184 30.8621 64.2899 32.9911 63.2362 34.7848L50.0839 57.1731C49.0992 58.8457 47.259 59.971 45.1514 59.971ZM43.7277 54.3743C43.7277 55.1469 44.3652 55.7735 45.1514 55.7735C45.9377 55.7735 46.5751 55.1469 46.5751 54.3743C46.5751 53.6015 45.9377 52.9751 45.1514 52.9751C44.3652 52.9751 43.7277 53.6015 43.7277 54.3743ZM57.5928 33.198C58.2735 33.5842 59.1442 33.355 59.5373 32.6859C59.9303 32.0169 59.697 31.1614 59.0163 30.775C58.3353 30.3888 57.4649 30.6178 57.0717 31.2871C56.6787 31.9561 56.912 32.8118 57.5928 33.198Z" fill="#DB4437"/>
+<path d="M50.0849 6.79945L55.8368 16.5946C55.31 15.6975 54.3542 15.1958 53.371 15.195L22.1355 15.1935L12.2713 31.9846L6.51896 22.1917C6.02807 21.3545 5.99233 20.2899 6.51917 19.3928L13.9161 6.79803C14.901 5.1253 16.7412 4 18.8488 4L45.153 4.0002C47.1193 4.00203 49.031 5.0055 50.0849 6.79945ZM20.2723 9.59687C20.2723 8.82406 19.6349 8.19765 18.8486 8.19765C18.0624 8.19765 17.4249 8.82406 17.4249 9.59687C17.4249 10.3697 18.0624 10.9961 18.8486 10.9961C19.6349 10.9961 20.2723 10.3697 20.2723 9.59687ZM45.865 10.8095C46.5457 10.4231 46.7788 9.56763 46.3856 8.89838C45.9927 8.22933 45.122 8.00009 44.4413 8.38649C43.7603 8.77269 43.5272 9.62835 43.9202 10.2974C44.3134 10.9664 45.1838 11.1957 45.865 10.8095Z" fill="#4285F4"/>
+<path d="M0.763973 29.1861L6.51919 19.393C5.99213 20.2899 6.02788 21.3545 6.51877 22.1917L22.1355 48.7774H41.8637L36.1105 58.5699C35.618 59.4063 34.698 59.9691 33.6441 59.9691L18.8469 59.9708C16.8809 59.9691 14.9692 58.9655 13.9153 57.1715L0.76294 34.7832C-0.218438 33.1089 -0.289924 30.9801 0.763973 29.1861ZM6.40741 30.7732C5.72644 30.3868 4.85601 30.616 4.46284 31.2851C4.06987 31.9543 4.30313 32.8098 4.9839 33.1962C5.66466 33.5826 6.5353 33.3533 6.92827 32.6841C7.32144 32.015 7.08818 31.1594 6.40741 30.7732ZM18.1354 53.1619C17.4546 53.5481 17.2212 54.4037 17.6143 55.0728C18.0073 55.742 18.8779 55.9713 19.5589 55.5849C20.2397 55.1987 20.4729 54.343 20.0798 53.674C19.6868 53.0049 18.8162 52.7757 18.1354 53.1619Z" fill="#F4B400"/>
+<path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M36.1114 58.5702L41.8647 48.7779H35.9229L33.6449 59.9695C34.6988 59.9695 35.619 59.4066 36.1114 58.5702Z" fill="black"/>
+<path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M53.3715 15.1955L41.8659 15.1951L44.8367 20.2521L55.8376 16.5952C55.3105 15.6983 54.3548 15.1964 53.3715 15.1955Z" fill="black"/>
+<g opacity="0.1">
+<mask id="mask0_857_78975" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="6" y="19" width="10" height="13">
+<path d="M15.2436 19.3942H6.13879V31.9856H15.2436V19.3942Z" fill="black"/>
+</mask>
+<g mask="url(#mask0_857_78975)">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M6.51989 22.1923L12.272 31.9852L15.243 26.9282L6.51989 19.3936C5.99325 20.2905 6.029 21.3551 6.51989 22.1923Z" fill="black"/>
+</g>
+</g>
+<path d="M22.1355 48.7776L12.2707 31.9856L22.1355 15.1935H41.8647L51.7293 31.9856L41.8647 48.7776H22.1355ZM40.5422 31.9856C40.5422 27.3489 36.7177 23.5905 32.0001 23.5905C27.2824 23.5905 23.458 27.3489 23.458 31.9856C23.458 36.622 27.2824 40.3807 32.0001 40.3807C36.7177 40.3807 40.5422 36.622 40.5422 31.9856Z" fill="#CCCCCC"/>
+</svg>
diff --git a/x-pack/plugins/enterprise_search/public/assets/source_icons/microsoft_sql.svg b/x-pack/plugins/enterprise_search/public/assets/source_icons/microsoft_sql.svg
new file mode 100644
index 0000000000000..7eabdd8e3e9d8
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/assets/source_icons/microsoft_sql.svg
@@ -0,0 +1,19 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M39.7612 29.8197L26.9658 33.9925L15.842 38.9057L12.7257 39.7293C11.9021 40.5113 11.0614 41.275 10.2042 42.0201C9.22281 42.8741 8.29979 43.6482 7.59788 44.2076C6.8163 44.8305 5.65428 45.9836 5.06027 46.7229C4.1766 47.8229 3.48562 48.9959 3.18852 49.898C2.65387 51.5209 2.91433 53.1646 3.94524 54.6818C5.26224 56.6197 7.88386 58.5886 10.9328 59.929C12.488 60.6126 15.1126 61.4941 17.0805 61.991C20.3601 62.8192 26.6986 63.719 30.1894 63.8527C30.8974 63.8798 31.8398 63.8773 31.8832 63.8487C31.9598 63.7981 32.5033 62.7691 33.1337 61.481C35.2791 57.0984 36.8313 52.99 37.6667 49.4811C38.1724 47.3564 38.5668 44.5232 38.8221 41.164C38.8936 40.223 38.9196 37.0847 38.8646 36.0181C38.7751 34.2822 38.6222 32.8675 38.377 31.479C38.3409 31.2756 38.3277 31.0967 38.3466 31.0804C38.3822 31.0499 38.503 31.0111 40.0747 30.5543L39.7611 29.8197H39.7612ZM36.8369 31.5358C36.9532 31.5358 37.2624 34.501 37.3429 36.3823C37.36 36.782 37.3565 37.038 37.3327 37.038C37.2563 37.038 35.6941 36.1205 34.5868 35.4251C33.6197 34.8178 31.7844 33.5982 31.4927 33.3692C31.4005 33.2969 31.4103 33.2933 32.2008 33.0211C33.5461 32.5578 36.7353 31.5357 36.8369 31.5357V31.5358ZM30.3189 33.6747C30.4016 33.6745 30.6267 33.7987 31.1587 34.132C33.1544 35.3823 35.857 36.8865 37.015 37.3921C37.3741 37.5488 37.4151 37.4881 36.5881 38.0497C34.8252 39.2468 32.6334 40.4239 29.9426 41.6194C29.4736 41.8277 29.0763 41.9978 29.0602 41.9978C29.0442 41.9978 29.0966 41.7599 29.1756 41.4676C29.8275 39.0563 30.1953 36.6223 30.2056 34.6703C30.2108 33.7049 30.2109 33.6998 30.3027 33.6767C30.308 33.6755 30.3135 33.6748 30.3189 33.6748V33.6747ZM28.9773 34.1867C29.035 34.2447 28.9932 36.408 28.9227 36.9974C28.7534 38.4116 28.4767 39.7195 28.0343 41.2066C27.9286 41.5619 27.8295 41.8682 27.8137 41.8864C27.7752 41.931 26.4524 40.6421 26.0127 40.1321C25.2613 39.2605 24.6669 38.3947 24.234 37.5418C24.0138 37.1083 23.6629 36.2522 23.6957 36.2284C23.8443 36.1205 28.9409 34.1502 28.9773 34.1867ZM22.6576 36.6777C22.6695 36.6789 22.6787 36.6822 22.6839 36.6879C22.7029 36.7089 22.7703 36.866 22.8337 37.0379C23.1418 37.8748 23.8346 39.1182 24.4363 39.9135C25.0932 40.7818 25.9497 41.707 26.6663 42.3216C26.8964 42.5188 27.111 42.703 27.1419 42.7303C27.2033 42.7847 27.2239 42.7755 25.6464 43.3738C23.8182 44.0673 21.8272 44.7617 19.5413 45.5006C18.6702 45.7822 17.9328 46.0202 17.9041 46.0308C17.8171 46.0631 17.8437 46.0095 18.0985 45.612C19.2343 43.8386 20.9549 40.3697 21.9169 37.9161C22.0838 37.4907 22.2425 37.0643 22.2711 36.9691C22.3129 36.8291 22.3542 36.7816 22.4856 36.7223C22.5583 36.6894 22.6219 36.6741 22.6576 36.6778V36.6777ZM20.7211 37.4771C20.7467 37.4997 20.2563 38.5353 19.774 39.4765C18.8383 41.3017 17.8067 43.098 16.437 45.2902C16.2007 45.6684 15.9829 46.0143 15.9534 46.0571C15.9047 46.1277 15.8848 46.1045 15.7349 45.8062C15.407 45.1541 15.1322 44.3312 14.9902 43.5661C14.8495 42.8088 14.8735 41.4977 15.0428 40.6845C15.1685 40.0802 15.163 40.0937 15.4475 39.9478C16.6774 39.3175 20.6808 37.4418 20.721 37.4771H20.7211ZM37.4016 38.1549V38.5658C37.3995 40.7234 37.1691 43.6772 36.835 45.8325C36.7763 46.2107 36.7255 46.5228 36.7216 46.5267C36.7177 46.5304 36.4451 46.4505 36.1166 46.3485C34.6648 45.8979 33.0907 45.2245 31.6707 44.4464C30.7303 43.9311 29.3702 43.0963 29.4084 43.0581C29.4186 43.0478 29.8193 42.8355 30.2987 42.5866C32.1976 41.601 34.0115 40.5384 35.5884 39.4845C36.1801 39.0891 37.0654 38.449 37.2619 38.2764L37.4016 38.1549ZM13.4177 41.0143C13.4572 41.0123 13.4472 41.0873 13.3854 41.4434C13.3424 41.691 13.2939 42.1588 13.2762 42.4814C13.1984 43.8957 13.4277 44.9391 14.1301 46.3668C14.3254 46.7636 14.4781 47.0946 14.47 47.1014C14.3997 47.1601 8.00394 49.0318 5.99315 49.5822C5.39711 49.7454 4.87619 49.8892 4.83365 49.902C4.76385 49.923 4.75766 49.9078 4.78309 49.7442C5.00333 48.3253 6.08568 46.463 7.59788 44.8996C8.60337 43.8603 9.40824 43.2446 10.777 42.4632C11.7592 41.9025 13.2849 41.0608 13.3975 41.0183C13.404 41.0159 13.4109 41.0146 13.4178 41.0143H13.4177ZM28.5037 43.7159C28.5098 43.7085 28.7468 43.8354 29.0299 43.9991C31.0958 45.1938 33.9785 46.3145 36.4363 46.8767L36.6588 46.9273L36.3533 47.0973C35.0694 47.8097 30.8412 49.569 26.5227 51.189C25.8922 51.4255 25.2771 51.6574 25.1567 51.705C25.0364 51.7526 24.9382 51.7853 24.9382 51.7758C24.9382 51.7663 25.1163 51.4235 25.3348 51.0149C26.5472 48.7481 27.7573 45.9935 28.3783 44.0821C28.4416 43.8873 28.4977 43.7231 28.5037 43.7159ZM26.9658 44.2197C26.9725 44.2263 26.8969 44.4295 26.7979 44.6689C25.955 46.707 24.8507 48.9303 23.4427 51.4278C23.0844 52.0634 22.7824 52.5822 22.7708 52.5812C22.7594 52.5802 22.468 52.4077 22.1233 52.1968C20.0724 50.9412 18.2578 49.3956 17.0663 47.8925L16.8963 47.6801L17.7807 47.4372C20.9349 46.5731 23.6099 45.649 26.2697 44.5029C26.6463 44.3407 26.9592 44.2131 26.9658 44.2197ZM36.5192 47.5546C36.5238 47.5556 36.5253 47.5588 36.5253 47.5627C36.5253 47.7776 36.0374 49.7673 35.6309 51.2072C35.2899 52.4151 35.0037 53.3598 34.4734 55.0339C34.2392 55.7732 34.0382 56.3766 34.0262 56.3735C33.9845 56.3646 33.9427 56.3565 33.9007 56.3491C31.0273 55.8292 28.4539 55.1041 26.0431 54.1353C25.3685 53.8643 24.3947 53.4329 24.3432 53.3826C24.3258 53.3656 24.9082 53.0912 25.6364 52.7735C30.0393 50.8524 34.6014 48.6647 36.1611 47.7267C36.3487 47.6138 36.4875 47.548 36.5192 47.5546ZM14.466 48.3094C14.4896 48.3317 13.258 50.0948 11.5378 52.5023C10.94 53.3391 10.2377 54.3253 9.9777 54.6939C9.6783 55.1213 9.38618 55.5537 9.10147 55.991L8.69473 56.6183L8.2616 56.2541C7.75353 55.8275 6.86406 54.9216 6.46061 54.4187C5.6304 53.3837 5.06781 52.2946 4.84583 51.2942C4.74335 50.8324 4.74026 50.5972 4.83771 50.5678C4.97848 50.5253 7.56143 49.9173 9.98369 49.3556C11.3292 49.0436 12.8848 48.6784 13.442 48.5441C13.9993 48.4098 14.4605 48.3043 14.466 48.3094ZM15.7045 48.7829L16.016 49.131C17.4093 50.683 18.8263 51.8412 20.5551 52.8403C20.8603 53.0166 21.0929 53.17 21.0731 53.1822C21.0011 53.2267 15.095 55.3266 12.3635 56.2784C10.8231 56.8151 9.55761 57.2527 9.55065 57.2517C9.54369 57.2507 9.45639 57.1937 9.35845 57.1242L9.18036 56.9966L9.45958 56.594C10.3659 55.2812 11.5046 53.8376 13.9966 50.8388L15.7044 48.7828L15.7045 48.7829ZM23.4224 54.2993C23.4293 54.2908 23.8611 54.4438 24.3837 54.6392C25.6433 55.1103 26.6319 55.4174 27.9696 55.7522C29.6125 56.1634 31.9867 56.5747 33.3928 56.6932C33.6086 56.7114 33.7188 56.7361 33.6842 56.758C33.6189 56.7993 32.1953 57.2748 31.1487 57.6038C29.4872 58.1261 24.4098 59.6261 20.2698 60.8173C19.5017 61.0383 18.845 61.225 18.8107 61.2322C18.7179 61.2515 18.3938 61.1664 18.3938 61.1229C18.3938 61.1022 18.626 60.8084 18.9078 60.4713C20.2993 58.8068 21.6818 56.9477 22.8357 55.1896C23.1513 54.7088 23.4157 54.3078 23.4225 54.2992L23.4224 54.2993ZM21.7125 54.3478C21.725 54.3603 21.039 55.4587 19.8327 57.359C19.4034 58.035 18.9751 58.7115 18.5477 59.3886C18.3497 59.7026 18.0596 60.1797 17.9041 60.4511L17.6209 60.9448L17.4771 60.9063C17.1305 60.8126 14.6849 59.9486 14.0391 59.6922C13.2384 59.3744 12.404 58.9906 11.7887 58.6581C11.0199 58.2427 10.0449 57.626 10.1214 57.6018C10.1433 57.5948 11.4663 57.2327 13.0595 56.7984C17.298 55.6431 19.6426 54.9794 21.1803 54.4996C21.4676 54.41 21.707 54.3423 21.7125 54.3478ZM33.7509 57.1708C33.7601 57.1688 33.7643 57.1688 33.7652 57.1708C33.8052 57.271 32.2361 61.617 31.6626 62.9948C31.5341 63.3033 31.4867 63.3781 31.4198 63.3751C31.2574 63.368 28.9823 63.05 27.6053 62.8409C25.1947 62.475 21.1571 61.7699 20.1382 61.5377L19.9014 61.4851L21.3463 61.1593C24.4432 60.4615 25.9305 60.0873 27.4394 59.6254C29.3423 59.0429 31.2266 58.3165 33.1298 57.4318C33.4306 57.292 33.687 57.1847 33.7509 57.1708Z" fill="url(#paint0_linear_857_78973)"/>
+<path d="M26.5744 0.000371277C26.3605 -0.0245726 22.9265 1.21266 20.7202 2.109C17.7306 3.32361 15.4095 4.48737 13.9776 5.49247C13.4445 5.86663 12.7743 6.53953 12.6763 6.79767C12.6397 6.89435 12.6225 7.00728 12.6217 7.12349L13.9208 8.3498L17.0028 9.33325L24.3445 10.6445L32.7364 12.0874L32.8213 11.3669C32.7959 11.3631 32.7719 11.3588 32.7464 11.3549L31.6415 11.1808L31.4169 10.7862C30.2764 8.77365 29.016 6.28323 28.2845 4.59807C27.7179 3.29287 27.1738 1.78946 26.8719 0.700539C26.6927 0.0539318 26.674 0.0120698 26.5744 0.000371277ZM26.4126 0.498281C26.4211 0.496638 26.4254 0.496638 26.4267 0.498281C26.4335 0.506306 26.4725 0.776242 26.5118 1.09722C26.6769 2.44883 26.9793 3.75984 27.4527 5.17071C27.8095 6.23392 27.8145 6.17146 27.39 6.05303C26.4031 5.77758 21.9819 5.01863 18.7835 4.57573C18.2682 4.50438 17.8393 4.44096 17.8325 4.4341C17.7919 4.39349 20.139 3.1637 21.1796 2.67961C22.514 2.05872 26.148 0.545848 26.4126 0.498184V0.498281ZM17.0938 4.82672L17.4682 4.95415C19.5216 5.65315 24.6685 6.63631 27.5134 6.8726C27.8344 6.89919 28.1041 6.9278 28.1124 6.93525C28.1206 6.94279 27.8479 7.08849 27.5073 7.25913C26.1349 7.94654 24.6244 8.78448 23.5795 9.43853C23.2727 9.63054 22.9912 9.78543 22.9542 9.78253C22.9172 9.77962 22.7148 9.74704 22.503 9.71166L22.1165 9.64891L21.1451 8.70597C19.4399 7.05562 18.1086 5.77874 17.5937 5.29621L17.0938 4.82672ZM16.7134 5.1303L18.0733 6.82803C18.8219 7.76197 19.5722 8.68867 19.7387 8.88812C19.9052 9.08748 20.0341 9.25648 20.0261 9.26247C19.9874 9.2907 18.0551 8.91442 17.0311 8.67968C15.9799 8.43855 15.5451 8.32321 14.8942 8.11506L14.364 7.94509L14.366 7.8136C14.3727 7.16139 15.1948 6.19941 16.5899 5.21519L16.7134 5.1302V5.1303ZM28.2945 7.44321C28.3353 7.4464 28.3783 7.52926 28.4989 7.7933C28.8288 8.5159 29.8553 10.4742 30.1036 10.853C30.1853 10.9777 30.315 10.9861 28.9521 10.766C25.6771 10.2369 24.6176 10.0599 24.6176 10.0395C24.6176 10.027 24.7158 9.96274 24.8361 9.89584C25.8503 9.3318 26.8737 8.62196 27.7846 7.85402C28.0023 7.67032 28.2117 7.49552 28.25 7.46342C28.2658 7.45027 28.281 7.44215 28.2945 7.44321Z" fill="url(#paint1_linear_857_78973)"/>
+<path d="M12.7344 6.66705C12.7344 6.66705 12.5219 7.00399 12.7223 7.5049C12.8462 7.81476 13.2186 8.18708 13.6289 8.58145C13.6289 8.58145 17.9266 12.7737 18.4531 13.3814C20.8344 16.1297 21.8686 18.8352 21.9641 22.5706C22.0254 24.9676 21.5631 27.0747 20.4403 29.5237C18.4279 33.913 14.1877 38.7536 7.63896 44.1361L8.60017 43.8184C9.21797 43.3556 10.0571 42.8613 12.0362 41.7786C16.5943 39.2855 21.7128 36.9921 28.0005 34.6292C37.0468 31.2296 51.9273 27.2408 60.3944 25.9439L61.2766 25.8084L61.1411 25.5959C60.3668 24.3925 59.8384 23.6504 59.2025 22.864C57.3453 20.5675 55.0971 18.6936 52.3424 17.1514C48.5571 15.0321 43.6473 13.3851 37.4406 12.151C36.2672 11.9177 33.6976 11.4773 31.6065 11.1513C27.1772 10.461 24.3203 9.99503 21.1647 9.44549C20.0334 9.24923 18.3441 8.96547 17.2227 8.72309C16.6385 8.59672 15.5279 8.33414 14.6649 8.03703C13.9524 7.75656 12.949 7.48537 12.7344 6.66705ZM15.2255 9.08526C15.2315 9.07984 15.3929 9.12973 15.5897 9.19663C15.9524 9.31971 16.431 9.46386 16.988 9.61952C17.4117 9.73751 17.8367 9.85083 18.2629 9.95945C18.8444 10.1081 19.3252 10.236 19.3314 10.2427C19.3957 10.3152 20.3723 13.4321 20.7054 14.6279C20.8325 15.0844 20.929 15.4647 20.9199 15.4739C20.9107 15.4829 20.8025 15.3148 20.6811 15.1015C19.5513 13.1146 17.762 11.094 15.6929 9.46783C15.435 9.26508 15.2255 9.09299 15.2255 9.08526ZM19.987 10.4006C20.0367 10.3972 20.2513 10.4331 20.5071 10.4897C22.1547 10.854 25.0967 11.4221 26.9886 11.7402C27.3038 11.7933 27.5634 11.8504 27.5634 11.8678C27.5634 11.8852 27.4457 11.9596 27.3024 12.0316C26.9849 12.1913 25.7004 12.9602 25.2706 13.2479C24.1977 13.9659 23.2331 14.7346 22.5306 15.4334C22.2483 15.7141 22.0121 15.9433 22.0045 15.9433C21.997 15.9433 21.9476 15.7796 21.8953 15.5791C21.544 14.2328 20.8179 12.2449 20.1671 10.8458C20.0624 10.6207 19.9769 10.4222 19.9769 10.4047C19.9769 10.4024 19.9798 10.4011 19.987 10.4007V10.4006ZM28.3627 11.9932C28.4178 12.0116 28.522 12.3369 28.7067 13.0678C29.0603 14.4673 29.2249 16.0392 29.1702 17.4934C29.1549 17.8981 29.1293 18.2739 29.1134 18.3291L29.0831 18.4303L28.5833 18.2684C27.5529 17.9391 25.8695 17.4434 24.4268 17.0441C23.6072 16.8173 22.9354 16.6148 22.9354 16.5949C22.9354 16.535 24.1313 15.3394 24.6454 14.8849C25.6273 14.0169 28.269 11.962 28.3628 11.9932L28.3627 11.9932ZM29.0284 12.0883C29.0583 12.0605 33.031 12.7484 34.8362 13.0941C36.1818 13.3516 38.1287 13.7593 38.246 13.8083C38.3026 13.832 38.1011 13.9418 37.4547 14.2334C34.898 15.3864 33.0038 16.4155 31.1209 17.6755C30.6249 18.0074 30.2128 18.2785 30.2042 18.2785C30.1956 18.2785 30.1882 18.0015 30.188 17.6633C30.1867 15.8272 29.8202 13.9739 29.1478 12.408C29.0755 12.2395 29.0212 12.0951 29.0284 12.0883ZM39.3003 14.1201C39.331 14.1508 39.2007 14.9341 39.0878 15.3969C38.7363 16.8372 37.8048 18.9748 36.6555 20.9842C36.4529 21.3381 36.2717 21.6334 36.2507 21.6397C36.2297 21.6461 35.9679 21.5085 35.67 21.3341C34.546 20.6767 33.2732 20.0549 31.8757 19.4785C31.486 19.3178 31.1541 19.1748 31.1371 19.1588C31.0732 19.099 34.1791 17.0427 35.8257 16.0546C37.1428 15.2643 39.2633 14.083 39.3003 14.12V14.1201ZM40.0349 14.2354C40.1243 14.2354 41.8861 14.7157 42.7971 14.9882C45.0662 15.6669 47.6838 16.623 49.3819 17.3942L50.0881 17.7139L49.5903 17.8292C45.4354 18.7838 41.8742 19.8853 38.4444 21.2775C38.1593 21.3932 37.9113 21.488 37.8938 21.488C37.8764 21.488 37.9674 21.2675 38.0942 20.9983C39.1253 18.8077 39.7911 16.509 39.964 14.5571C39.9798 14.3794 40.0119 14.2354 40.0349 14.2354ZM22.5226 18.2602C22.5507 18.2325 23.8916 18.5467 24.6231 18.7521C25.7224 19.0607 28.0617 19.8435 28.0633 19.9035C28.0633 19.9151 27.8054 20.1399 27.4905 20.4034C26.2258 21.4614 25.0058 22.5677 23.5445 23.9791C23.1113 24.3974 22.7432 24.7379 22.725 24.7379C22.7067 24.7379 22.6987 24.6768 22.7087 24.6023C22.9288 22.9777 22.8815 20.8916 22.5752 18.7682C22.5364 18.4991 22.5129 18.2699 22.5226 18.2603V18.2602ZM50.76 18.2866C50.7801 18.3068 50.1378 19.3105 49.738 19.8832C49.1547 20.7189 48.3092 21.8159 46.3829 24.2381C45.5356 25.3033 44.6897 26.3697 43.8453 27.4373C43.4609 27.9245 43.1382 28.3237 43.1289 28.3237C43.1197 28.3237 42.9956 28.1492 42.8537 27.9372C41.7679 26.3149 40.4793 24.89 38.9421 23.6107C38.6552 23.3719 38.3316 23.1102 38.2237 23.0299C38.1158 22.9497 38.0279 22.8754 38.0275 22.864C38.0265 22.8375 39.6681 22.1334 40.9211 21.6236C43.1027 20.7359 46.0842 19.6729 48.3154 18.9888C49.492 18.6281 50.7421 18.2688 50.76 18.2866ZM51.5005 18.481C51.5358 18.4737 51.77 18.587 52.051 18.748C54.4009 20.0941 56.7036 21.8228 58.5144 23.6007C59.0295 24.1063 60.2896 25.4171 60.2709 25.4279C60.2661 25.4307 59.8309 25.4652 59.3036 25.5048C55.2315 25.8111 50.0253 26.6774 45.0129 27.8826C44.6726 27.9644 44.3782 28.0323 44.3593 28.0323C44.3404 28.0323 44.713 27.6583 45.1869 27.2026C48.1305 24.3728 49.4734 22.5859 51.0534 19.3935C51.2887 18.9181 51.4883 18.5079 51.4966 18.4829C51.4971 18.4814 51.4981 18.4814 51.5005 18.481ZM29.9776 20.6866C30.1119 20.7168 31.3673 21.3009 32.3148 21.7753C33.1812 22.2091 34.4936 22.9078 34.559 22.9693C34.5672 22.977 34.1049 23.2184 33.531 23.5055C31.714 24.4145 30.1577 25.2731 28.5326 26.2658C28.0693 26.5488 27.6809 26.7817 27.6686 26.7817C27.628 26.7817 27.644 26.7467 27.9033 26.2718C28.7686 24.6869 29.4667 22.7947 29.8683 20.9456C29.9041 20.7806 29.9472 20.6798 29.9776 20.6866ZM28.7128 20.9133C28.739 20.9394 28.4132 22.136 28.2069 22.775C27.8111 24.0005 27.142 25.5412 26.4989 26.7008C26.3326 26.9991 26.1613 27.2946 25.985 27.5871L25.7462 27.9777L25.2038 27.4535C24.5736 26.8426 24.0603 26.4632 23.4048 26.1261C23.1473 25.9936 22.9378 25.8708 22.9374 25.8529C22.9362 25.7732 24.5861 24.2727 25.8595 23.1958C26.771 22.4251 28.6895 20.89 28.7128 20.9132V20.9133ZM36.3985 24.0741L36.87 24.3796C37.9516 25.082 39.2323 26.0267 40.2089 26.8404C40.7561 27.2964 41.8196 28.2487 42.0382 28.4795L42.1556 28.603L41.3725 28.8215C36.9432 30.0504 33.5211 31.1444 29.5283 32.6117C29.0852 32.7746 28.7026 32.9092 28.6763 32.9092C28.6212 32.9092 28.5666 32.9598 29.5627 32.0431C32.1165 29.6928 34.3726 27.1033 36.0584 24.5841L36.3985 24.0741ZM34.3788 24.58C34.402 24.6032 33.0699 26.4688 32.2784 27.5224C31.3314 28.7828 29.6447 30.8899 28.4841 32.2617C27.9993 32.8347 27.5838 33.3103 27.5614 33.3179C27.5367 33.3263 27.5214 33.186 27.5209 32.9638C27.5186 31.7934 27.2225 30.5425 26.6993 29.4832C26.4784 29.0358 26.4413 28.9275 26.4869 28.8862C26.6689 28.7212 29.4864 27.1146 31.2625 26.1625C32.4826 25.5085 34.3557 24.5568 34.3789 24.58H34.3788ZM22.1644 27.5729C22.1886 27.5729 22.4146 27.6865 22.6662 27.8259C23.2829 28.1675 23.8369 28.5433 24.3256 28.951C24.3445 28.9668 24.0914 29.1735 23.763 29.4104C22.8465 30.0717 21.451 31.1249 20.6426 31.7678C19.7899 32.4463 19.7616 32.467 19.8575 32.3203C20.4962 31.3436 20.8173 30.7906 21.1526 30.0842C21.4507 29.4564 21.7478 28.7111 21.9599 28.0626C22.0482 27.7933 22.1402 27.5729 22.1644 27.5729ZM25.4183 30.1268C25.4624 30.1213 25.5251 30.2032 25.7867 30.5942C26.338 31.4179 26.7603 32.5166 26.8692 33.411L26.8915 33.6032L25.5701 34.1153C23.1981 35.0357 21.0147 35.943 19.5398 36.6185C18.9972 36.8691 18.4582 37.1275 17.9229 37.3935C17.4472 37.6315 17.0589 37.8186 17.0589 37.8083C17.0589 37.7981 17.3576 37.5735 17.7226 37.3085C20.6172 35.207 23.1131 32.9064 24.9934 30.6063C25.1945 30.3603 25.3771 30.1471 25.4002 30.1329C25.4057 30.1295 25.4119 30.1274 25.4183 30.1268ZM23.9169 30.499C23.9552 30.5374 22.8488 31.7885 22.1037 32.549C20.2388 34.4523 18.39 35.9446 16.0997 37.3976C15.8131 37.5794 15.5512 37.7437 15.5169 37.7638C15.454 37.8006 15.5372 37.706 16.5429 36.6104C17.1765 35.9199 17.6616 35.3468 18.2123 34.6314C18.575 34.1601 18.6442 34.094 19.1755 33.7106C20.6067 32.6775 23.8788 30.4611 23.9168 30.4991L23.9169 30.499Z" fill="url(#paint2_radial_857_78973)"/>
+<defs>
+<linearGradient id="paint0_linear_857_78973" x1="14.9704" y1="61.6794" x2="40.0748" y2="46.8456" gradientUnits="userSpaceOnUse">
+<stop stop-color="#909CA9"/>
+<stop offset="1" stop-color="#EDEDEE"/>
+</linearGradient>
+<linearGradient id="paint1_linear_857_78973" x1="12.6217" y1="6.04363" x2="32.8214" y2="6.04363" gradientUnits="userSpaceOnUse">
+<stop stop-color="#939FAB"/>
+<stop offset="1" stop-color="#DCDEE1"/>
+</linearGradient>
+<radialGradient id="paint2_radial_857_78973" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(31.6759 23.1761) rotate(-171.401) scale(26.0607 52.049)">
+<stop stop-color="#EE352C"/>
+<stop offset="1" stop-color="#A91D22"/>
+</radialGradient>
+</defs>
+</svg>
diff --git a/x-pack/plugins/enterprise_search/public/assets/source_icons/oracle.svg b/x-pack/plugins/enterprise_search/public/assets/source_icons/oracle.svg
new file mode 100644
index 0000000000000..29028d24fdf63
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/assets/source_icons/oracle.svg
@@ -0,0 +1,3 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M27.6898 33.4076H31.9107L29.6812 29.807L25.5821 36.3102H23.7181L28.7035 28.5081C28.8122 28.3524 28.9566 28.225 29.1246 28.1366C29.2926 28.0482 29.4794 28.0014 29.6693 28C29.8591 27.9987 30.0466 28.0428 30.2159 28.1288C30.3851 28.2148 30.5313 28.3401 30.6422 28.4942L35.6415 36.3102H33.7775L32.8995 34.8561H28.6287L27.6981 33.4076M47.0663 34.8561V28.0788H45.4821V35.5236C45.4818 35.6271 45.5025 35.7295 45.543 35.8247C45.5834 35.9199 45.6428 36.006 45.7175 36.0776C45.7925 36.1543 45.8821 36.2151 45.9811 36.2565C46.08 36.2979 46.1863 36.319 46.2936 36.3185H53.4947L54.4336 34.8644H47.058M20.8737 33.6458C21.6119 33.6458 22.3199 33.3525 22.8419 32.8305C23.3639 32.3085 23.6572 31.6005 23.6572 30.8623C23.6572 30.1241 23.3639 29.4161 22.8419 28.8941C22.3199 28.372 21.6119 28.0788 20.8737 28.0788H13.9495V36.3102H15.531V29.5356H20.7767C21.13 29.5356 21.4689 29.676 21.7187 29.9258C21.9686 30.1757 22.1089 30.5145 22.1089 30.8678C22.1089 31.2211 21.9686 31.56 21.7187 31.8098C21.4689 32.0597 21.13 32.2 20.7767 32.2H16.3148L21.0398 36.3102H23.3359L20.1619 33.6458H20.8737ZM4.22247 36.3102H9.00567C10.0784 36.2824 11.0978 35.8367 11.8467 35.0681C12.5955 34.2996 13.0146 33.2689 13.0146 32.1959C13.0146 31.1228 12.5955 30.0922 11.8467 29.3236C11.0978 28.5551 10.0784 28.1094 9.00567 28.0816H4.22247C3.67319 28.0673 3.12661 28.1632 2.61497 28.3635C2.10333 28.5639 1.637 28.8647 1.24346 29.2481C0.849917 29.6316 0.537145 30.09 0.323585 30.5962C0.110024 31.1025 0 31.6464 0 32.1959C0 32.7453 0.110024 33.2893 0.323585 33.7955C0.537145 34.3018 0.849917 34.7602 1.24346 35.1436C1.637 35.5271 2.10333 35.8279 2.61497 36.0282C3.12661 36.2286 3.67319 36.3245 4.22247 36.3102ZM8.89765 34.8617H4.32772C3.6363 34.8394 2.98067 34.549 2.49946 34.0521C2.01825 33.5551 1.7492 32.8904 1.7492 32.1986C1.7492 31.5069 2.01825 30.8422 2.49946 30.3452C2.98067 29.8483 3.6363 29.5579 4.32772 29.5356H8.89765C9.25459 29.5241 9.6102 29.5845 9.94335 29.7131C10.2765 29.8418 10.5804 30.0361 10.837 30.2845C11.0935 30.5329 11.2975 30.8304 11.4368 31.1592C11.5762 31.488 11.648 31.8415 11.648 32.1986C11.648 32.5558 11.5762 32.9093 11.4368 33.2381C11.2975 33.5669 11.0935 33.8644 10.837 34.1128C10.5804 34.3612 10.2765 34.5555 9.94335 34.6842C9.6102 34.8128 9.25459 34.8732 8.89765 34.8617ZM38.9457 36.3102H43.8286L44.7536 34.8617H39.0537C38.6967 34.8732 38.3411 34.8128 38.008 34.6842C37.6748 34.5555 37.371 34.3612 37.1144 34.1128C36.8578 33.8644 36.6538 33.5669 36.5145 33.2381C36.3752 32.9093 36.3034 32.5558 36.3034 32.1986C36.3034 31.8415 36.3752 31.488 36.5145 31.1592C36.6538 30.8304 36.8578 30.5329 37.1144 30.2845C37.371 30.0361 37.6748 29.8418 38.008 29.7131C38.3411 29.5845 38.6967 29.5241 39.0537 29.5356H43.6929L44.629 28.0816H38.9457C38.3964 28.0673 37.8498 28.1632 37.3382 28.3635C36.8265 28.5639 36.3602 28.8647 35.9667 29.2481C35.5731 29.6316 35.2603 30.09 35.0468 30.5962C34.8332 31.1025 34.7232 31.6464 34.7232 32.1959C34.7232 32.7453 34.8332 33.2893 35.0468 33.7955C35.2603 34.3018 35.5731 34.7602 35.9667 35.1436C36.3602 35.5271 36.8265 35.8279 37.3382 36.0282C37.8498 36.2286 38.3964 36.3245 38.9457 36.3102ZM58.2973 34.8617C57.717 34.8619 57.1525 34.6727 56.6895 34.3227C56.2266 33.9728 55.8906 33.4813 55.7326 32.9229H62.4961L63.4267 31.4716H55.7326C55.8902 30.913 56.2261 30.4213 56.6891 30.0712C57.1521 29.7212 57.7169 29.5322 58.2973 29.5329H62.9392L63.8671 28.0788H58.1893C57.1165 28.1066 56.0971 28.5523 55.3483 29.3209C54.5994 30.0894 54.1803 31.12 54.1803 32.1931C54.1803 33.2662 54.5994 34.2968 55.3483 35.0654C56.0971 35.8339 57.1165 36.2796 58.1893 36.3074H63.0722L64 34.8589H58.2945" fill="#C74634"/>
+</svg>
diff --git a/x-pack/plugins/enterprise_search/public/assets/source_icons/postgresql.svg b/x-pack/plugins/enterprise_search/public/assets/source_icons/postgresql.svg
new file mode 100644
index 0000000000000..28ff5332e9ceb
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/assets/source_icons/postgresql.svg
@@ -0,0 +1,13 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_857_78972)">
+<path d="M63.752 38.3239C63.3682 37.1969 62.363 36.4119 61.063 36.2235C60.45 36.1348 59.748 36.1726 58.9172 36.3387C57.4692 36.6284 56.395 36.7387 55.611 36.76C58.5702 31.9152 60.9765 26.3903 62.3617 21.1896C64.6017 12.7801 63.4047 8.9491 62.006 7.21625C58.3042 2.62958 52.9035 0.165583 46.388 0.090189C42.9122 0.0489769 39.861 0.714431 38.2692 1.19298C36.7872 0.939401 35.1937 0.797825 33.5217 0.771644C30.3875 0.723159 27.6182 1.3857 25.252 2.7474C23.942 2.31783 21.8395 1.71225 19.4115 1.32583C13.701 0.416734 9.0985 1.1251 5.732 3.43128C1.6555 6.22352 -0.234252 11.0749 0.115248 17.8507C0.226248 20.0019 1.46725 26.5474 3.42125 32.7549C4.54425 36.3229 5.74175 39.2858 6.9805 41.5622C8.73725 44.7901 10.617 46.6909 12.7272 47.3736C13.91 47.7556 16.059 48.0233 18.3192 46.1978C18.6057 46.5343 18.988 46.8686 19.4952 47.1792C20.1395 47.5731 20.9272 47.895 21.714 48.0858C24.5492 48.7731 27.205 48.6012 29.4707 47.6378C29.4847 48.0286 29.4955 48.4019 29.5045 48.7244C29.5195 49.2473 29.5345 49.76 29.5542 50.2395C29.6885 53.4817 29.916 56.0027 30.59 57.7666C30.627 57.8635 30.6767 58.0114 30.7292 58.1683C31.0655 59.1666 31.6277 60.8378 33.0582 62.1467C34.5395 63.5026 36.3312 63.9183 37.9722 63.9183C38.7952 63.9183 39.5805 63.8136 40.2692 63.6706C42.7242 63.1602 45.5125 62.383 47.5295 59.5981C49.4365 56.9653 50.3635 53 50.5312 46.752C50.553 46.5753 50.573 46.4066 50.5922 46.2458L50.6322 45.9156L51.0815 45.9539L51.1972 45.9615C53.6977 46.072 56.7552 45.5578 58.633 44.712C60.1167 44.0444 64.8715 41.6102 63.752 38.3239Z" fill="black"/>
+<path d="M59.4765 38.9629C52.0415 40.4502 51.5302 38.0092 51.5302 38.0092C59.3802 26.7139 62.662 12.3762 59.8302 8.86716C52.1042 -0.704965 38.7305 3.82207 38.5072 3.9394L38.4355 3.95201C36.9665 3.65625 35.3227 3.48025 33.475 3.45091C30.111 3.39758 27.559 4.30619 25.6225 5.73019C25.6225 5.73019 1.76499 -3.80048 2.87474 17.7166C3.11074 22.2941 9.64074 52.3525 17.4292 43.2735C20.276 39.9535 23.0267 37.1464 23.0267 37.1464C24.3927 38.0264 26.0282 38.4754 27.7427 38.3142L27.876 38.2046C27.8345 38.6167 27.8535 39.0199 27.9292 39.4972C25.9227 41.671 26.5125 42.0526 22.5015 42.8533C18.4427 43.6645 20.827 45.1084 22.3837 45.4861C24.271 45.9435 28.637 46.5918 31.587 42.5872L31.4695 43.0441C32.2555 43.6548 32.8075 47.0158 32.715 50.0628C32.6225 53.1096 32.5607 55.2015 33.18 56.8354C33.7997 58.4693 34.417 62.1457 39.69 61.0502C44.0957 60.1346 46.379 57.7619 46.6967 53.8041C46.922 50.9906 47.4322 51.4066 47.4642 48.8909L47.8735 47.7001C48.3452 43.8861 47.9485 42.6555 50.6627 43.2279L51.3227 43.2841C53.3202 43.3721 55.9352 42.9724 57.47 42.2807C60.7745 40.7937 62.735 38.3106 59.4765 38.9629Z" fill="#336791"/>
+<path d="M27.019 19.7636C26.349 19.6732 25.7422 19.7569 25.4352 19.9823C25.2627 20.1091 25.2092 20.256 25.1947 20.3571C25.1562 20.625 25.3497 20.9212 25.4687 21.0739C25.8052 21.5064 26.2967 21.8036 26.7832 21.8691C26.8537 21.8788 26.924 21.8832 26.9937 21.8832C27.805 21.8832 28.5427 21.2705 28.6077 20.8184C28.689 20.2521 27.8412 19.8744 27.019 19.7636ZM49.215 19.7816C49.151 19.3377 48.3365 19.2112 47.5635 19.3154C46.7915 19.4196 46.043 19.7576 46.1055 20.2024C46.1555 20.5484 46.7997 21.1389 47.5622 21.1389C47.6267 21.1389 47.6917 21.1348 47.7572 21.1258C48.2662 21.0575 48.6397 20.744 48.8172 20.5634C49.0872 20.288 49.2437 19.9811 49.215 19.7816Z" fill="white"/>
+<path d="M61.9505 38.7939C61.667 37.9627 60.7545 37.6953 59.2385 37.9988C54.7372 38.8996 53.1252 38.2757 52.596 37.8977C56.0947 32.7292 58.973 26.4815 60.5257 20.6524C61.2612 17.8912 61.6675 15.3268 61.7007 13.2366C61.7375 10.9426 61.3345 9.25674 60.5035 8.22692C57.153 4.0754 52.2355 1.8485 46.283 1.7874C42.1907 1.7428 38.7332 2.75831 38.063 3.04389C36.6515 2.70353 35.1127 2.49456 33.4375 2.46789C30.3655 2.41965 27.71 3.13286 25.5115 4.58668C24.5565 4.24195 22.0885 3.42037 19.0702 2.94886C13.8522 2.13431 9.70573 2.75153 6.74673 4.78425C3.21598 7.20995 1.58598 11.5459 1.90173 17.6715C2.00798 19.7324 3.21898 26.0723 5.12998 32.1438C7.64548 40.135 10.38 44.6589 13.257 45.5896C13.5937 45.6984 13.982 45.7746 14.4102 45.7746C15.4597 45.7746 16.7465 45.3159 18.0852 43.7552C19.7181 41.8557 21.4072 40.0023 23.1505 38.1973C24.2815 38.786 25.524 39.1147 26.7947 39.1476C26.7972 39.1799 26.8005 39.2121 26.8035 39.2441C26.5847 39.4971 26.3705 39.7537 26.161 40.0138C25.2805 41.0977 25.0972 41.3234 22.263 41.8892C21.4567 42.0507 19.3155 42.4786 19.284 43.9341C19.25 45.5244 21.8152 46.1923 22.1075 46.263C23.126 46.5103 24.1072 46.6323 25.043 46.6323C27.3187 46.6323 29.3215 45.9069 30.922 44.5035C30.8727 50.1729 31.1165 55.7593 31.8185 57.4613C32.3935 58.8548 33.798 62.2601 38.2345 62.2599C38.8855 62.2599 39.602 62.1864 40.3902 62.0226C45.0205 61.0601 47.0312 59.0756 47.809 54.7006C48.2252 52.3624 48.9395 46.7792 49.2755 43.7843C49.9845 43.9988 50.8972 44.097 51.884 44.0967C53.942 44.0967 56.3167 43.6727 57.806 43.0024C59.479 42.249 62.498 40.4003 61.9505 38.7939ZM50.924 18.5564C50.9087 19.4405 50.7832 20.2432 50.6502 21.081C50.507 21.9821 50.359 22.9137 50.3217 24.0446C50.285 25.1452 50.4267 26.2895 50.5637 27.3961C50.8407 29.6313 51.125 31.9324 50.0247 34.2029C49.842 33.8889 49.6792 33.5643 49.5372 33.231C49.4005 32.9096 49.1035 32.3932 48.6922 31.6786C47.0925 28.8965 43.3462 22.3816 45.264 19.7232C45.8352 18.9319 47.285 18.1183 50.924 18.5564ZM46.513 3.57771C51.8465 3.69189 56.0655 5.62668 59.0525 9.32801C61.3435 12.167 58.8207 25.0851 51.5175 36.2296C51.444 36.139 51.3702 36.0488 51.296 35.9588L51.2035 35.8468C53.0907 32.8245 52.7217 29.8342 52.3932 27.183C52.2582 26.095 52.1307 25.0674 52.1632 24.1021C52.1967 23.079 52.3362 22.2015 52.4712 21.353C52.637 20.3074 52.8057 19.2255 52.7592 17.9501C52.794 17.8163 52.808 17.6582 52.7897 17.4706C52.671 16.2475 51.231 12.5872 48.296 9.27419C46.6905 7.46207 44.3492 5.43419 41.1525 4.06644C42.5275 3.79007 44.4077 3.53237 46.513 3.57771ZM16.6685 42.6129C15.1935 44.3326 14.175 44.0029 13.84 43.8948C11.6575 43.1889 9.12498 38.7156 6.89223 31.6223C4.96023 25.4846 3.83123 19.3127 3.74173 17.5821C3.45973 12.1086 4.82798 8.29407 7.80873 6.24413C12.6597 2.90837 20.6352 4.90498 23.84 5.91759C23.794 5.96171 23.746 6.00292 23.7005 6.04777C18.4415 11.1978 18.5662 19.9969 18.5792 20.5348C18.5787 20.7423 18.5967 21.0361 18.6212 21.4403C18.7117 22.9203 18.8802 25.6747 18.4302 28.794C18.0122 31.6926 18.9337 34.5297 20.958 36.5779C21.1657 36.7878 21.3841 36.9874 21.6122 37.1763C20.7112 38.112 18.753 40.1813 16.6685 42.6129ZM22.2882 35.3418C20.6567 33.6909 19.9157 31.3947 20.255 29.0412C20.73 25.7462 20.5547 22.8764 20.4605 21.3346C20.4472 21.1188 20.4355 20.9297 20.4287 20.7806C21.197 20.12 24.7572 18.2703 27.2962 18.8344C28.4547 19.0916 29.1607 19.8567 29.4542 21.1726C30.9732 27.9855 29.6552 30.825 28.5962 33.1069C28.378 33.577 28.1717 34.0213 27.9957 34.481L27.8592 34.8364C27.5137 35.7348 27.1922 36.5702 26.993 37.3634C25.2585 37.3586 23.5712 36.6403 22.2882 35.3418ZM22.5545 44.5297C22.048 44.407 21.5925 44.194 21.3252 44.0172C21.5485 43.9154 21.9457 43.7767 22.6347 43.639C25.969 42.9736 26.484 42.5038 27.6085 41.1193C27.8662 40.8017 28.1585 40.4419 28.5632 40.0036C29.166 39.3491 29.4422 39.4596 29.9422 39.6609C30.3475 39.8233 30.7422 40.3159 30.9022 40.858C30.978 41.114 31.063 41.5998 30.7847 41.978C28.4357 45.1673 25.0127 45.1263 22.5545 44.5297ZM40.0042 60.2756C35.9252 61.1232 34.481 59.105 33.5292 56.7978C32.915 55.3084 32.613 48.5918 32.8272 41.1743C32.83 41.0756 32.8155 40.9804 32.7875 40.8907C32.7624 40.7136 32.7243 40.5384 32.6735 40.3666C32.355 39.2873 31.5787 38.3845 30.6475 38.0102C30.2775 37.8616 29.5985 37.5889 28.7825 37.7913C28.9565 37.096 29.2582 36.3108 29.5855 35.4606L29.7227 35.103C29.8772 34.6999 30.0712 34.2822 30.2762 33.84C31.3845 31.4526 32.9022 28.1826 31.255 20.7952C30.638 18.0281 28.5775 16.6769 25.454 16.9908C23.5815 17.1787 21.8682 17.9113 21.0137 18.3314C20.83 18.4216 20.662 18.5089 20.505 18.5937C20.7435 15.8058 21.6445 10.5956 25.015 7.29916C27.1372 5.22401 29.9635 4.19904 33.407 4.25431C40.192 4.36195 44.543 7.73844 46.9985 10.5523C49.1145 12.9767 50.2602 15.4192 50.7175 16.7365C47.2787 16.3973 44.94 17.0555 43.7545 18.6992C41.1752 22.2744 45.1655 29.2136 47.0832 32.5486C47.435 33.1598 47.7385 33.688 47.834 33.9125C48.4585 35.3801 49.267 36.36 49.8572 37.0752C50.0382 37.2943 50.2137 37.5069 50.3472 37.6926C49.3057 37.9838 47.435 38.6565 47.6055 42.0192C47.468 43.7064 46.4902 51.6061 45.9935 54.3971C45.3377 58.0844 43.9385 59.4575 40.0042 60.2756ZM57.0302 41.3821C55.9652 41.8613 54.183 42.2209 52.49 42.2982C50.62 42.383 49.668 42.095 49.444 41.9178C49.339 39.8223 50.1432 39.6034 50.9945 39.3716C51.1282 39.3353 51.2587 39.2996 51.3847 39.257C51.463 39.3188 51.5487 39.3801 51.6427 39.4403C53.1457 40.4022 55.8265 40.506 59.6112 39.7484L59.6527 39.7404C59.1422 40.2032 58.2687 40.8243 57.0302 41.3821Z" fill="white"/>
+</g>
+<defs>
+<clipPath id="clip0_857_78972">
+<rect width="64" height="64" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/x-pack/plugins/enterprise_search/server/integrations.ts b/x-pack/plugins/enterprise_search/server/integrations.ts
index 6a147552c24d6..b7d1516764187 100644
--- a/x-pack/plugins/enterprise_search/server/integrations.ts
+++ b/x-pack/plugins/enterprise_search/server/integrations.ts
@@ -471,4 +471,171 @@ export const registerEnterpriseSearchIntegrations = (
     shipper: 'enterprise_search',
     isBeta: false,
   });
+
+  customIntegrations.registerCustomIntegration({
+    id: 'postgresql',
+    title: i18n.translate('xpack.enterpriseSearch.workplaceSearch.integrations.postgresqlName', {
+      defaultMessage: 'PostgreSQL',
+    }),
+    description: i18n.translate(
+      'xpack.enterpriseSearch.workplaceSearch.integrations.postgreSQLDescription',
+      {
+        defaultMessage: 'Search over your content on PostgreSQL with Enterprise Search.',
+      }
+    ),
+    categories: ['enterprise_search', 'elastic_stack', 'custom', 'datastore'],
+    uiInternalPath: '/app/enterprise_search/content/search_indices/new_index?method=connector',
+    icons: [
+      {
+        type: 'svg',
+        src: http.basePath.prepend('/plugins/enterpriseSearch/assets/source_icons/postgresql.svg'),
+      },
+    ],
+    shipper: 'enterprise_search',
+    isBeta: false,
+  });
+
+  customIntegrations.registerCustomIntegration({
+    id: 'oracle',
+    title: i18n.translate('xpack.enterpriseSearch.workplaceSearch.integrations.oracleName', {
+      defaultMessage: 'Oracle',
+    }),
+    description: i18n.translate(
+      'xpack.enterpriseSearch.workplaceSearch.integrations.oracleDescription',
+      {
+        defaultMessage: 'Search over your content on Oracle with Enterprise Search.',
+      }
+    ),
+    categories: ['enterprise_search', 'elastic_stack', 'custom', 'datastore'],
+    uiInternalPath: '/app/enterprise_search/content/search_indices/new_index?method=connector',
+    icons: [
+      {
+        type: 'svg',
+        src: http.basePath.prepend('/plugins/enterpriseSearch/assets/source_icons/oracle.svg'),
+      },
+    ],
+    shipper: 'enterprise_search',
+    isBeta: false,
+  });
+
+  customIntegrations.registerCustomIntegration({
+    id: 'ms_sql',
+    title: i18n.translate('xpack.enterpriseSearch.workplaceSearch.integrations.msSqlName', {
+      defaultMessage: 'Microsoft SQL',
+    }),
+    description: i18n.translate(
+      'xpack.enterpriseSearch.workplaceSearch.integrations.msSqlDescription',
+      {
+        defaultMessage: 'Search over your content on Microsoft SQL Server with Enterprise Search.',
+      }
+    ),
+    categories: ['enterprise_search', 'custom', 'elastic_stack', 'datastore'],
+    uiInternalPath: '/app/enterprise_search/content/search_indices/new_index?method=connector',
+    icons: [
+      {
+        type: 'svg',
+        src: http.basePath.prepend(
+          '/plugins/enterpriseSearch/assets/source_icons/microsoft_sql.svg'
+        ),
+      },
+    ],
+    shipper: 'enterprise_search',
+    isBeta: false,
+  });
+
+  customIntegrations.registerCustomIntegration({
+    id: 'ms_sql',
+    title: i18n.translate('xpack.enterpriseSearch.workplaceSearch.integrations.networkDriveName', {
+      defaultMessage: 'Network Drive',
+    }),
+    description: i18n.translate(
+      'xpack.enterpriseSearch.workplaceSearch.integrations.netowkrDriveDescription',
+      {
+        defaultMessage: 'Search over your Network Drive content with Enterprise Search.',
+      }
+    ),
+    categories: ['enterprise_search', 'custom', 'elastic_stack', 'file_storage'],
+    uiInternalPath: '/app/enterprise_search/content/search_indices/new_index?method=connector',
+    icons: [
+      {
+        type: 'svg',
+        src: http.basePath.prepend(
+          '/plugins/enterpriseSearch/assets/source_icons/network_drive.svg'
+        ),
+      },
+    ],
+    shipper: 'enterprise_search',
+    isBeta: false,
+  });
+
+  customIntegrations.registerCustomIntegration({
+    id: 'amazon_s3',
+    title: i18n.translate('xpack.enterpriseSearch.workplaceSearch.integrations.s3', {
+      defaultMessage: 'Amazon S3',
+    }),
+    description: i18n.translate(
+      'xpack.enterpriseSearch.workplaceSearch.integrations.s3Description',
+      {
+        defaultMessage: 'Search over your content on Amazon S3 with Enterprise Search.',
+      }
+    ),
+    categories: ['enterprise_search', 'datastore', 'elastic_stack'],
+    uiInternalPath: '/app/enterprise_search/content/search_indices/new_index?method=connector',
+    icons: [
+      {
+        type: 'svg',
+        src: http.basePath.prepend('/plugins/enterpriseSearch/assets/source_icons/amazon_s3.svg'),
+      },
+    ],
+    shipper: 'enterprise_search',
+    isBeta: false,
+  });
+
+  customIntegrations.registerCustomIntegration({
+    id: 'google_cloud_storage',
+    title: i18n.translate('xpack.enterpriseSearch.workplaceSearch.integrations.googleCloud', {
+      defaultMessage: 'Google Cloud Storage',
+    }),
+    description: i18n.translate(
+      'xpack.enterpriseSearch.workplaceSearch.integrations.googleCloudDescription',
+      {
+        defaultMessage: 'Search over your content on Google Cloud Storage with Enterprise Search.',
+      }
+    ),
+    categories: ['enterprise_search', 'elastic_stack', 'custom'],
+    uiInternalPath: '/app/enterprise_search/content/search_indices/new_index?method=connector',
+    icons: [
+      {
+        type: 'svg',
+        src: http.basePath.prepend(
+          '/plugins/enterpriseSearch/assets/source_icons/google_cloud.svg'
+        ),
+      },
+    ],
+    shipper: 'enterprise_search',
+    isBeta: false,
+  });
+
+  customIntegrations.registerCustomIntegration({
+    id: 'azure_cloud_storage',
+    title: i18n.translate('xpack.enterpriseSearch.workplaceSearch.integrations.azureCloud', {
+      defaultMessage: 'Azure Cloud Storage',
+    }),
+    description: i18n.translate(
+      'xpack.enterpriseSearch.workplaceSearch.integrations.azureCloudDescription',
+      {
+        defaultMessage: 'Search over your content on Azure Cloud Storage with Enterprise Search.',
+      }
+    ),
+    categories: ['enterprise_search', 'elastic_stack', 'custom'],
+    uiInternalPath: '/app/enterprise_search/content/search_indices/new_index?method=connector',
+    icons: [
+      {
+        type: 'svg',
+        src: http.basePath.prepend('/plugins/enterpriseSearch/assets/source_icons/azure_cloud.svg'),
+      },
+    ],
+    shipper: 'enterprise_search',
+    isBeta: false,
+  });
 };

From 50444bbd598d8304eb2d99092266435266c744c5 Mon Sep 17 00:00:00 2001
From: Thomas Watson <watson@elastic.co>
Date: Tue, 7 Feb 2023 13:07:13 +0100
Subject: [PATCH 045/134] Change default value of csp.disableUnsafeEval to
 'true' (#150157)

This change ensures that the `unsafe-eval` source expression isn't included in
the Kibana Content Security Policy (CSP) by default.

Users can set `csp.disableUnsafeEval: false` to reintroduce `unsafe-eval`.
However, since this config option is deprecated as of this commit, it's
recommended to instead set `csp.script_src: ['unsafe-eval']`.

Closes #150156
---
 docs/setup/settings.asciidoc                  |  6 ++---
 .../src/csp/config.ts                         |  8 +-----
 .../src/csp/csp_config.test.mocks.ts          | 25 -----------------
 .../src/csp/csp_config.test.ts                | 27 +++----------------
 .../src/csp/csp_config.ts                     |  2 ++
 .../collectors/csp/csp_collector.test.ts      |  1 -
 test/common/config.js                         |  1 -
 7 files changed, 9 insertions(+), 61 deletions(-)
 delete mode 100644 packages/core/http/core-http-server-internal/src/csp/csp_config.test.mocks.ts

diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index 3914dfabaf137..3c45338c4da90 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -26,11 +26,11 @@ Set to `false` to disable Console. *Default: `true`*
 Add sources for the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src[Content Security Policy `script-src` directive].
 
 `csp.disableUnsafeEval`::
-experimental[] Set this to `true` to remove the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_eval_expressions[`unsafe-eval`] source expression from the `script-src` directive. *Default: `false`*
+deprecated:[8.7.0,Use `csp.script_src: ['unsafe-eval']` instead if you wish to enable `unsafe-eval`. This config option will have no effect in a future version.] Set this to `false` to add the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_eval_expressions[`unsafe-eval`] source expression to the `script-src` directive. *Default: `true`*
 +
-By enabling `csp.disableUnsafeEval`, Kibana will use a custom version of the Handlebars template library.
+When `csp.disableUnsafeEval` is set to `true`, Kibana will use a custom version of the Handlebars template library.
 Handlebars is used in various locations in the Kibana frontend where custom templates can be supplied by the user when for instance setting up a visualisation.
-If you experience any issues rendering Handlebars templates after turning on `csp.disableUnsafeEval`, please revert this setting to `false` and https://github.com/elastic/kibana/issues/new/choose[open an issue] in the Kibana GitHub repository.
+If you experience any issues rendering Handlebars templates, please set this setting to `false` and https://github.com/elastic/kibana/issues/new/choose[open an issue] in the Kibana GitHub repository.
 
 `csp.worker_src`::
 Add sources for the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src[Content Security Policy `worker-src` directive].
diff --git a/packages/core/http/core-http-server-internal/src/csp/config.ts b/packages/core/http/core-http-server-internal/src/csp/config.ts
index 2bd145abd8581..d192ddda9a108 100644
--- a/packages/core/http/core-http-server-internal/src/csp/config.ts
+++ b/packages/core/http/core-http-server-internal/src/csp/config.ts
@@ -39,13 +39,7 @@ const getDirectiveValueValidator = ({ allowNone, allowNonce }: DirectiveValidati
 
 const configSchema = schema.object(
   {
-    disableUnsafeEval: schema.conditional(
-      // Default disableUnsafeEval to false if it's not a distributable release
-      schema.contextRef('dist'),
-      true,
-      schema.boolean({ defaultValue: false }),
-      schema.boolean({ defaultValue: true })
-    ),
+    disableUnsafeEval: schema.boolean({ defaultValue: true }),
     script_src: schema.arrayOf(schema.string(), {
       defaultValue: [],
       validate: getDirectiveValidator({ allowNone: false, allowNonce: false }),
diff --git a/packages/core/http/core-http-server-internal/src/csp/csp_config.test.mocks.ts b/packages/core/http/core-http-server-internal/src/csp/csp_config.test.mocks.ts
deleted file mode 100644
index d1c7303648e16..0000000000000
--- a/packages/core/http/core-http-server-internal/src/csp/csp_config.test.mocks.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { schema } from '@kbn/config-schema';
-import { cspConfig } from './config';
-
-const origSchema = cspConfig.schema;
-
-export const mockConfig = {
-  create(defaultDisableUnsafeEval: boolean) {
-    // @ts-expect-error: Property 'extends' does not exist on type??
-    cspConfig.schema = cspConfig.schema.extends({
-      disableUnsafeEval: schema.boolean({ defaultValue: defaultDisableUnsafeEval }),
-    });
-    return cspConfig;
-  },
-  reset() {
-    cspConfig.schema = origSchema;
-  },
-};
diff --git a/packages/core/http/core-http-server-internal/src/csp/csp_config.test.ts b/packages/core/http/core-http-server-internal/src/csp/csp_config.test.ts
index b7c3d4b77ebad..da3a21e5816af 100644
--- a/packages/core/http/core-http-server-internal/src/csp/csp_config.test.ts
+++ b/packages/core/http/core-http-server-internal/src/csp/csp_config.test.ts
@@ -8,7 +8,6 @@
 
 import { CspConfig } from './csp_config';
 import { cspConfig, CspConfigType } from './config';
-import { mockConfig } from './csp_config.test.mocks';
 
 // CSP rules aren't strictly additive, so any change can potentially expand or
 // restrict the policy in a way we consider a breaking change. For that reason,
@@ -34,6 +33,7 @@ describe('CspConfig', () => {
     expect(CspConfig.DEFAULT).toMatchInlineSnapshot(`
       CspConfig {
         "disableEmbedding": false,
+        "disableUnsafeEval": true,
         "header": "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
         "strict": true,
         "warnLegacyBrowsers": true,
@@ -140,36 +140,15 @@ describe('CspConfig', () => {
         );
       });
 
-      test('when "disableUnsafeEval" is not set, and the default value is "false", the `unsafe-eval` CSP should be set', () => {
-        // The default value for `disableUnsafeEval` depends on whether Kibana is a distributable or not. To test both scenarios, we mock the config.
-        const mockedConfig = mockConfig.create(false).schema.validate({});
-
-        const config = new CspConfig({
-          ...mockedConfig,
-          script_src: ['foo', 'bar'],
-        });
-
-        expect(config.header).toEqual(
-          `script-src 'self' 'unsafe-eval' foo bar; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
-        );
-
-        mockConfig.reset();
-      });
-
-      test('when "disableUnsafeEval" is not set, and the default value is "true", the `unsafe-eval` CSP should not be set', () => {
-        // The default value for `disableUnsafeEval` depends on whether Kibana is a distributable or not. To test both scenarios, we mock the config.
-        const mockedConfig = mockConfig.create(true).schema.validate({});
-
+      test('when "disableUnsafeEval" is not set, the `unsafe-eval` CSP should not be set', () => {
         const config = new CspConfig({
-          ...mockedConfig,
+          ...defaultConfig,
           script_src: ['foo', 'bar'],
         });
 
         expect(config.header).toEqual(
           `script-src 'self' foo bar; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
         );
-
-        mockConfig.reset();
       });
     });
 
diff --git a/packages/core/http/core-http-server-internal/src/csp/csp_config.ts b/packages/core/http/core-http-server-internal/src/csp/csp_config.ts
index 3d0a6e292b61d..049d6c02ed472 100644
--- a/packages/core/http/core-http-server-internal/src/csp/csp_config.ts
+++ b/packages/core/http/core-http-server-internal/src/csp/csp_config.ts
@@ -21,6 +21,7 @@ export class CspConfig implements ICspConfig {
 
   readonly #directives: CspDirectives;
   public readonly strict: boolean;
+  public readonly disableUnsafeEval: boolean;
   public readonly warnLegacyBrowsers: boolean;
   public readonly disableEmbedding: boolean;
   public readonly header: string;
@@ -37,6 +38,7 @@ export class CspConfig implements ICspConfig {
     }
     this.header = this.#directives.getCspHeader();
     this.strict = rawCspConfig.strict;
+    this.disableUnsafeEval = rawCspConfig.disableUnsafeEval;
     this.warnLegacyBrowsers = rawCspConfig.warnLegacyBrowsers;
     this.disableEmbedding = rawCspConfig.disableEmbedding;
   }
diff --git a/src/plugins/kibana_usage_collection/server/collectors/csp/csp_collector.test.ts b/src/plugins/kibana_usage_collection/server/collectors/csp/csp_collector.test.ts
index 7cc95fe1470e4..e8ada00137da4 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/csp/csp_collector.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/csp/csp_collector.test.ts
@@ -24,7 +24,6 @@ describe('csp collector', () => {
   function updateCsp(config: Partial<ICspConfig>) {
     httpMock.csp = new CspConfig({
       ...CspConfig.DEFAULT,
-      disableUnsafeEval: false,
       style_src: [],
       worker_src: [],
       script_src: [],
diff --git a/test/common/config.js b/test/common/config.js
index b0a7072930b5c..297890aa5869b 100644
--- a/test/common/config.js
+++ b/test/common/config.js
@@ -43,7 +43,6 @@ export default function () {
         // Needed for async search functional tests to introduce a delay
         `--data.search.aggs.shardDelay.enabled=true`,
         `--security.showInsecureClusterWarning=false`,
-        '--csp.disableUnsafeEval=true',
         '--telemetry.banner=false',
         '--telemetry.optIn=false',
         // These are *very* important to have them pointing to staging

From 7403df89481a0607b99d6a1f2056a2db38c48e8b Mon Sep 17 00:00:00 2001
From: Angela Chuang <6295984+angorayc@users.noreply.github.com>
Date: Tue, 7 Feb 2023 12:14:14 +0000
Subject: [PATCH 046/134] [SecuritySolution] Missing reset button when there is
 no data to display (#149835)

## Summary
issue: https://github.com/elastic/kibana/issues/149828

Please enable feature flag: chartEmbeddablesEnabled

Steps to verify:
1. Go to alerts trend or table chart
2. Delete one or more group by fields
3. You should see chart actions available when there is no data to
display
4. Clicking on the reset group by field action, the group by fields
should be reset


https://user-images.githubusercontent.com/6295984/215500707-4b7f8076-3e63-4664-beb4-8e5b8fde9f1c.mov



### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../show_top_n/show_top_n_component.test.tsx  |   2 +-
 .../common/components/charts/areachart.tsx    |   2 +-
 .../common/components/charts/barchart.tsx     |   2 +-
 .../events_tab/events_query_tab_body.test.tsx |   2 +-
 .../hover_actions/actions/show_top_n.test.tsx |   4 +-
 .../matrix_histogram/index.test.tsx           |  10 +-
 .../components/matrix_histogram/index.tsx     |   2 +-
 .../common/components/top_n/index.test.tsx    |   4 +-
 .../common/components/top_n/top_n.test.tsx    |   4 +-
 .../__mocks__/actions.tsx                     |  17 +++
 .../visualization_actions/__mocks__/index.tsx |   9 --
 .../{index.test.tsx => actions.test.tsx}      |  43 +++++-
 .../{index.tsx => actions.tsx}                | 127 +++++++++++-------
 .../visualization_actions/lens_embeddable.tsx |  35 +++--
 .../components/visualization_actions/types.ts |   2 +
 .../components/stat_items/metric.test.tsx     |   6 +-
 .../explore/components/stat_items/metric.tsx  |   2 +-
 .../stat_items/metric_embeddable.test.tsx     |   6 +-
 .../components/stat_items/stat_items.test.tsx |   6 +-
 .../hosts/pages/details/details_tabs.test.tsx |   4 +-
 .../public/explore/hosts/pages/hosts.test.tsx |   4 +-
 .../explore/network/pages/network.test.tsx    |   4 +-
 .../authentications_query_tab_body.test.tsx   |   2 +-
 .../explore/users/pages/users_tabs.test.tsx   |   4 +-
 .../public/overview/pages/overview.test.tsx   |   5 +-
 25 files changed, 185 insertions(+), 123 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/common/components/visualization_actions/__mocks__/actions.tsx
 delete mode 100644 x-pack/plugins/security_solution/public/common/components/visualization_actions/__mocks__/index.tsx
 rename x-pack/plugins/security_solution/public/common/components/visualization_actions/{index.test.tsx => actions.test.tsx} (85%)
 rename x-pack/plugins/security_solution/public/common/components/visualization_actions/{index.tsx => actions.tsx} (66%)

diff --git a/x-pack/plugins/security_solution/public/actions/show_top_n/show_top_n_component.test.tsx b/x-pack/plugins/security_solution/public/actions/show_top_n/show_top_n_component.test.tsx
index 6c702bb20fd90..49ddc83563fd7 100644
--- a/x-pack/plugins/security_solution/public/actions/show_top_n/show_top_n_component.test.tsx
+++ b/x-pack/plugins/security_solution/public/actions/show_top_n/show_top_n_component.test.tsx
@@ -20,7 +20,7 @@ jest.mock('react-router-dom', () => {
     useLocation: jest.fn().mockReturnValue({ pathname: '/test' }),
   };
 });
-jest.mock('../../common/components/visualization_actions');
+jest.mock('../../common/components/visualization_actions/actions');
 
 const casesService = {
   ui: { getCasesContext: () => mockCasesContext },
diff --git a/x-pack/plugins/security_solution/public/common/components/charts/areachart.tsx b/x-pack/plugins/security_solution/public/common/components/charts/areachart.tsx
index d458c00558aa6..e0a2f623ebe74 100644
--- a/x-pack/plugins/security_solution/public/common/components/charts/areachart.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/charts/areachart.tsx
@@ -25,7 +25,7 @@ import {
   Wrapper,
   ChartWrapper,
 } from './common';
-import { VisualizationActions } from '../visualization_actions';
+import { VisualizationActions } from '../visualization_actions/actions';
 import type { VisualizationActionsProps } from '../visualization_actions/types';
 
 import { HoverVisibilityContainer } from '../hover_visibility_container';
diff --git a/x-pack/plugins/security_solution/public/common/components/charts/barchart.tsx b/x-pack/plugins/security_solution/public/common/components/charts/barchart.tsx
index 7e9b6b3bd01dc..9390c2edeee9a 100644
--- a/x-pack/plugins/security_solution/public/common/components/charts/barchart.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/charts/barchart.tsx
@@ -35,7 +35,7 @@ import {
 import { DraggableLegend } from './draggable_legend';
 import type { LegendItem } from './draggable_legend_item';
 import type { ChartData, ChartSeriesConfigs, ChartSeriesData } from './common';
-import { VisualizationActions } from '../visualization_actions';
+import { VisualizationActions } from '../visualization_actions/actions';
 import type { VisualizationActionsProps } from '../visualization_actions/types';
 import { HoverVisibilityContainer } from '../hover_visibility_container';
 import { VISUALIZATION_ACTIONS_BUTTON_CLASS } from '../visualization_actions/utils';
diff --git a/x-pack/plugins/security_solution/public/common/components/events_tab/events_query_tab_body.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_tab/events_query_tab_body.test.tsx
index 1387784d82860..a1f69bbda6587 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_tab/events_query_tab_body.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_tab/events_query_tab_body.test.tsx
@@ -47,7 +47,7 @@ jest.mock('../../lib/kibana', () => {
   };
 });
 
-jest.mock('../visualization_actions');
+jest.mock('../visualization_actions/actions');
 jest.mock('../visualization_actions/lens_embeddable');
 
 jest.mock('react-router-dom', () => ({
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.test.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.test.tsx
index e7f80e613fab3..46731ffe17e63 100644
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.test.tsx
@@ -12,9 +12,7 @@ import { TestProviders } from '../../../mock';
 import { ShowTopNButton } from './show_top_n';
 import { TimelineId } from '../../../../../common/types';
 
-jest.mock('../../visualization_actions', () => ({
-  VisualizationActions: jest.fn(() => <div data-test-subj="mock-viz-actions" />),
-}));
+jest.mock('../../visualization_actions/actions');
 
 jest.mock('../../../lib/kibana', () => {
   const original = jest.requireActual('../../../lib/kibana');
diff --git a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.test.tsx
index ec4a25039e912..5591927b35f35 100644
--- a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.test.tsx
@@ -29,11 +29,7 @@ jest.mock('../charts/barchart', () => ({
 
 jest.mock('../../containers/matrix_histogram');
 
-jest.mock('../visualization_actions', () => ({
-  VisualizationActions: jest.fn(({ className }: { className: string }) => (
-    <div data-test-subj="mock-viz-actions" className={className} />
-  )),
-}));
+jest.mock('../visualization_actions/actions');
 
 jest.mock('./utils', () => ({
   getBarchartConfigs: jest.fn(),
@@ -197,8 +193,8 @@ describe('Matrix Histogram Component', () => {
       wrapper = mount(<MatrixHistogram {...testProps} />, {
         wrappingComponent: TestProviders,
       });
-      expect(wrapper.find('[data-test-subj="mock-viz-actions"]').exists()).toBe(true);
-      expect(wrapper.find('[data-test-subj="mock-viz-actions"]').prop('className')).toEqual(
+      expect(wrapper.find('[data-test-subj="visualizationActions"]').exists()).toBe(true);
+      expect(wrapper.find('[data-test-subj="visualizationActions"]').prop('className')).toEqual(
         'histogram-viz-actions'
       );
     });
diff --git a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
index 48e812ff2afa3..426c2a16f8cf9 100644
--- a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
@@ -29,7 +29,7 @@ import type { GlobalTimeArgs } from '../../containers/use_global_time';
 import { setAbsoluteRangeDatePicker } from '../../store/inputs/actions';
 import { InputsModelId } from '../../store/inputs/constants';
 import { HoverVisibilityContainer } from '../hover_visibility_container';
-import { VisualizationActions } from '../visualization_actions';
+import { VisualizationActions } from '../visualization_actions/actions';
 import type { GetLensAttributes, LensAttributes } from '../visualization_actions/types';
 import { useQueryToggle } from '../../containers/query_toggle';
 import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
index 180063d1786e5..05207caa9ffab 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
@@ -43,9 +43,7 @@ jest.mock('react-router-dom', () => {
 jest.mock('../link_to');
 jest.mock('../../lib/kibana');
 jest.mock('../../../timelines/store/timeline/actions');
-jest.mock('../visualization_actions', () => ({
-  VisualizationActions: jest.fn(() => <div data-test-subj="mock-viz-actions" />),
-}));
+jest.mock('../visualization_actions/actions');
 const field = 'process.name';
 const value = 'nice';
 
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/top_n.test.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/top_n.test.tsx
index b52746ad14c57..191a2c0201646 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/top_n.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/top_n.test.tsx
@@ -32,9 +32,7 @@ jest.mock('react-router-dom', () => {
 
 jest.mock('../../lib/kibana');
 jest.mock('../link_to');
-jest.mock('../visualization_actions', () => ({
-  VisualizationActions: jest.fn(() => <div data-test-subj="mock-viz-actions" />),
-}));
+jest.mock('../visualization_actions/actions');
 
 jest.mock('uuid', () => {
   return {
diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/__mocks__/actions.tsx b/x-pack/plugins/security_solution/public/common/components/visualization_actions/__mocks__/actions.tsx
new file mode 100644
index 0000000000000..bd8b81e053a1e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/__mocks__/actions.tsx
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import type { VisualizationActionsProps } from '../types';
+
+export const VisualizationActions = (props: VisualizationActionsProps) => {
+  const { title, ...testProps } = props;
+  return (
+    <div data-test-subj="visualizationActions" {...testProps}>
+      {title}
+    </div>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/__mocks__/index.tsx b/x-pack/plugins/security_solution/public/common/components/visualization_actions/__mocks__/index.tsx
deleted file mode 100644
index b222b3a2a8be7..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/__mocks__/index.tsx
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import React from 'react';
-
-export const VisualizationActions = () => <div data-test-subj="visualizationActions" />;
diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/visualization_actions/actions.test.tsx
similarity index 85%
rename from x-pack/plugins/security_solution/public/common/components/visualization_actions/index.test.tsx
rename to x-pack/plugins/security_solution/public/common/components/visualization_actions/actions.test.tsx
index 526e78aa65cba..51bcef5b17051 100644
--- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/actions.test.tsx
@@ -6,8 +6,10 @@
  */
 import React from 'react';
 import { fireEvent, render, screen } from '@testing-library/react';
+import type { Action } from '@kbn/ui-actions-plugin/public';
+
 import { dnsTopDomainsLensAttributes } from './lens_attributes/network/dns_top_domains';
-import { VisualizationActions } from '.';
+import { VisualizationActions } from './actions';
 import {
   createSecuritySolutionStorageMock,
   kibanaObservable,
@@ -247,4 +249,43 @@ describe('VisualizationActions', () => {
 
     expect(mockGetAllCasesSelectorModalOpen).toBeCalled();
   });
+
+  test('Should not render default actions when withDefaultActions = false', () => {
+    const testProps = { ...props, withDefaultActions: false };
+    render(
+      <TestProviders store={store}>
+        <VisualizationActions {...testProps} />
+      </TestProviders>
+    );
+
+    expect(
+      screen.queryByTestId(`[data-test-subj="stat-networkDnsHistogramQuery"]`)
+    ).not.toBeInTheDocument();
+    expect(screen.queryByText('Inspect')).not.toBeInTheDocument();
+    expect(screen.queryByText('Add to new case')).not.toBeInTheDocument();
+    expect(screen.queryByText('Add to existing case')).not.toBeInTheDocument();
+    expect(screen.queryByText('Open in Lens')).not.toBeInTheDocument();
+  });
+
+  test('Should render extra actions when extraAction is provided', () => {
+    const testProps = {
+      ...props,
+      extraActions: [
+        {
+          getIconType: () => 'reset',
+          id: 'resetField',
+          execute: jest.fn(),
+          getDisplayName: () => 'Reset Field',
+        } as unknown as Action<object>,
+      ],
+    };
+    const { container } = render(
+      <TestProviders store={store}>
+        <VisualizationActions {...testProps} />
+      </TestProviders>
+    );
+
+    fireEvent.click(container.querySelector(`[data-test-subj="stat-networkDnsHistogramQuery"]`)!);
+    expect(screen.getByText('Reset Field')).toBeInTheDocument();
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/index.tsx b/x-pack/plugins/security_solution/public/common/components/visualization_actions/actions.tsx
similarity index 66%
rename from x-pack/plugins/security_solution/public/common/components/visualization_actions/index.tsx
rename to x-pack/plugins/security_solution/public/common/components/visualization_actions/actions.tsx
index 16336bbded826..029f7545d3a42 100644
--- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/actions.tsx
@@ -5,6 +5,8 @@
  * 2.0.
  */
 import { EuiButtonIcon, EuiContextMenuItem, EuiContextMenuPanel, EuiPopover } from '@elastic/eui';
+import type { Action, ActionExecutionContext } from '@kbn/ui-actions-plugin/public';
+
 import React, { useCallback, useMemo, useState } from 'react';
 import styled from 'styled-components';
 
@@ -40,6 +42,7 @@ const Wrapper = styled.div`
 
 const VisualizationActionsComponent: React.FC<VisualizationActionsProps> = ({
   className,
+  extraActions,
   getLensAttributes,
   inputId = InputsModelId.global,
   inspectIndex = 0,
@@ -51,6 +54,7 @@ const VisualizationActionsComponent: React.FC<VisualizationActionsProps> = ({
   timerange,
   title,
   stackByField,
+  withDefaultActions = true,
 }) => {
   const { lens } = useKibana().services;
 
@@ -139,56 +143,76 @@ const VisualizationActionsComponent: React.FC<VisualizationActionsProps> = ({
     [attributes, canUseEditor]
   );
 
-  const items = useMemo(
-    () => [
-      <EuiContextMenuItem
-        icon="inspect"
-        key="visualizationActionsInspect"
-        onClick={handleInspectButtonClick}
-        disabled={disableInspectButton}
-        data-test-subj="viz-actions-inspect"
-      >
-        {INSPECT}
-      </EuiContextMenuItem>,
-      <EuiContextMenuItem
-        icon="visArea"
-        key="visualizationActionsOpenInLens"
-        data-test-subj="viz-actions-open-in-lens"
-        disabled={disabledOpenInLens}
-        onClick={onOpenInLens}
-      >
-        {OPEN_IN_LENS}
-      </EuiContextMenuItem>,
-      <EuiContextMenuItem
-        disabled={isAddToNewCaseDisabled}
-        icon="plusInCircle"
-        key="visualizationActionsAddToNewCase"
-        onClick={onAddToNewCaseClicked}
-        data-test-subj="viz-actions-add-to-new-case"
-      >
-        {ADD_TO_NEW_CASE}
-      </EuiContextMenuItem>,
-      <EuiContextMenuItem
-        disabled={isAddToExistingCaseDisabled}
-        data-test-subj="viz-actions-add-to-existing-case"
-        icon="plusInCircle"
-        key="visualizationActionsAddToExistingCase"
-        onClick={onAddToExistingCaseClicked}
-      >
-        {ADD_TO_EXISTING_CASE}
-      </EuiContextMenuItem>,
-    ],
-    [
-      disableInspectButton,
-      disabledOpenInLens,
-      handleInspectButtonClick,
-      isAddToExistingCaseDisabled,
-      isAddToNewCaseDisabled,
-      onAddToExistingCaseClicked,
-      onAddToNewCaseClicked,
-      onOpenInLens,
-    ]
-  );
+  const items = useMemo(() => {
+    const context = {} as ActionExecutionContext<object>;
+    const extraActionsItems =
+      extraActions?.map((item: Action) => {
+        return (
+          <EuiContextMenuItem
+            icon={item?.getIconType(context)}
+            key={item.id}
+            onClick={() => item.execute(context)}
+            data-test-subj={`viz-actions-${item.id}`}
+          >
+            {item.getDisplayName(context)}
+          </EuiContextMenuItem>
+        );
+      }) ?? [];
+    return [
+      ...(extraActionsItems ? extraActionsItems : []),
+      ...(withDefaultActions
+        ? [
+            <EuiContextMenuItem
+              icon="inspect"
+              key="visualizationActionsInspect"
+              onClick={handleInspectButtonClick}
+              disabled={disableInspectButton}
+              data-test-subj="viz-actions-inspect"
+            >
+              {INSPECT}
+            </EuiContextMenuItem>,
+            <EuiContextMenuItem
+              disabled={isAddToNewCaseDisabled}
+              icon="plusInCircle"
+              key="visualizationActionsAddToNewCase"
+              onClick={onAddToNewCaseClicked}
+              data-test-subj="viz-actions-add-to-new-case"
+            >
+              {ADD_TO_NEW_CASE}
+            </EuiContextMenuItem>,
+            <EuiContextMenuItem
+              disabled={isAddToExistingCaseDisabled}
+              data-test-subj="viz-actions-add-to-existing-case"
+              icon="plusInCircle"
+              key="visualizationActionsAddToExistingCase"
+              onClick={onAddToExistingCaseClicked}
+            >
+              {ADD_TO_EXISTING_CASE}
+            </EuiContextMenuItem>,
+            <EuiContextMenuItem
+              icon="visArea"
+              key="visualizationActionsOpenInLens"
+              data-test-subj="viz-actions-open-in-lens"
+              disabled={disabledOpenInLens}
+              onClick={onOpenInLens}
+            >
+              {OPEN_IN_LENS}
+            </EuiContextMenuItem>,
+          ]
+        : []),
+    ];
+  }, [
+    disableInspectButton,
+    disabledOpenInLens,
+    extraActions,
+    handleInspectButtonClick,
+    isAddToExistingCaseDisabled,
+    isAddToNewCaseDisabled,
+    onAddToExistingCaseClicked,
+    onAddToNewCaseClicked,
+    onOpenInLens,
+    withDefaultActions,
+  ]);
 
   const button = useMemo(
     () => (
@@ -205,7 +229,7 @@ const VisualizationActionsComponent: React.FC<VisualizationActionsProps> = ({
 
   return (
     <Wrapper className={className}>
-      {request !== null && response !== null && (
+      {items.length > 0 && (
         <EuiPopover
           button={button}
           isOpen={isPopoverOpen}
@@ -213,6 +237,7 @@ const VisualizationActionsComponent: React.FC<VisualizationActionsProps> = ({
           panelPaddingSize="none"
           anchorPosition="downLeft"
           panelClassName="withHoverActions__popover"
+          data-test-subj="viz-actions-popover"
         >
           <EuiContextMenuPanel data-test-subj="viz-actions-panel" size="s" items={items} />
         </EuiPopover>
diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_embeddable.tsx b/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_embeddable.tsx
index 19805b8ce96f3..a2d80d8ab4568 100644
--- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_embeddable.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_embeddable.tsx
@@ -11,7 +11,7 @@ import { useDispatch } from 'react-redux';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { ViewMode } from '@kbn/embeddable-plugin/public';
 import styled from 'styled-components';
-import { EuiEmptyPrompt } from '@elastic/eui';
+import { EuiEmptyPrompt, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { setAbsoluteRangeDatePicker } from '../../store/inputs/actions';
 import { useKibana } from '../../lib/kibana';
 import { useLensAttributes } from './use_lens_attributes';
@@ -23,6 +23,7 @@ import { ModalInspectQuery } from '../inspect/modal';
 import { InputsModelId } from '../../store/inputs/constants';
 import { getRequestsAndResponses } from './utils';
 import { SourcererScopeName } from '../../store/sourcerer/model';
+import { VisualizationActions } from './actions';
 
 const LensComponentWrapper = styled.div<{ height?: string; width?: string }>`
   height: ${({ height }) => height ?? 'auto'};
@@ -180,14 +181,32 @@ const LensEmbeddableComponent: React.FC<LensEmbeddableComponentProps> = ({
     (visualizationData?.responses != null && visualizationData?.responses?.length === 0)
   ) {
     return (
-      <EuiEmptyPrompt
-        body={
-          <FormattedMessage
-            id="xpack.securitySolution.lensEmbeddable.NoDataToDisplay.title"
-            defaultMessage="No data to display"
+      <EuiFlexGroup>
+        <EuiFlexItem grow={1}>
+          <EuiEmptyPrompt
+            body={
+              <FormattedMessage
+                id="xpack.securitySolution.lensEmbeddable.NoDataToDisplay.title"
+                defaultMessage="No data to display"
+              />
+            }
+          />
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <VisualizationActions
+            extraActions={extraActions}
+            getLensAttributes={getLensAttributes}
+            inputId={inputsModelId}
+            isInspectButtonDisabled={true}
+            lensAttributes={attributes}
+            queryId={id}
+            stackByField={stackByField}
+            timerange={timerange}
+            title={inspectTitle}
+            withDefaultActions={false}
           />
-        }
-      />
+        </EuiFlexItem>
+      </EuiFlexGroup>
     );
   }
 
diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/types.ts b/x-pack/plugins/security_solution/public/common/components/visualization_actions/types.ts
index b761aba812100..d323d0b7ccbfd 100644
--- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/types.ts
@@ -21,6 +21,7 @@ export type GetLensAttributes = (
 
 export interface VisualizationActionsProps {
   className?: string;
+  extraActions?: Action[];
   getLensAttributes?: GetLensAttributes;
   inputId?: InputsModelId.global | InputsModelId.timeline;
   inspectIndex?: number;
@@ -32,6 +33,7 @@ export interface VisualizationActionsProps {
   stackByField?: string;
   timerange: { from: string; to: string };
   title: React.ReactNode;
+  withDefaultActions?: boolean;
 }
 
 export interface EmbeddableData {
diff --git a/x-pack/plugins/security_solution/public/explore/components/stat_items/metric.test.tsx b/x-pack/plugins/security_solution/public/explore/components/stat_items/metric.test.tsx
index 6582ffba002a6..30627023c91cf 100644
--- a/x-pack/plugins/security_solution/public/explore/components/stat_items/metric.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/components/stat_items/metric.test.tsx
@@ -13,11 +13,7 @@ import React from 'react';
 import { TestProviders } from '../../../common/mock';
 import type { LensAttributes } from '../../../common/components/visualization_actions/types';
 
-jest.mock('../../../common/components/visualization_actions', () => {
-  return {
-    VisualizationActions: () => <div data-test-subj="visualizationActions" />,
-  };
-});
+jest.mock('../../../common/components/visualization_actions/actions');
 
 describe('Metric', () => {
   const testProps = {
diff --git a/x-pack/plugins/security_solution/public/explore/components/stat_items/metric.tsx b/x-pack/plugins/security_solution/public/explore/components/stat_items/metric.tsx
index af659d1d07633..1dd14b262108c 100644
--- a/x-pack/plugins/security_solution/public/explore/components/stat_items/metric.tsx
+++ b/x-pack/plugins/security_solution/public/explore/components/stat_items/metric.tsx
@@ -8,7 +8,7 @@ import { EuiFlexGroup, EuiIcon } from '@elastic/eui';
 import React from 'react';
 import type { StatItem } from './types';
 import { HoverVisibilityContainer } from '../../../common/components/hover_visibility_container';
-import { VisualizationActions } from '../../../common/components/visualization_actions';
+import { VisualizationActions } from '../../../common/components/visualization_actions/actions';
 import { FlexItem, StatValue } from './utils';
 import { getEmptyTagValue } from '../../../common/components/empty_value';
 import { VISUALIZATION_ACTIONS_BUTTON_CLASS } from '../../../common/components/visualization_actions/utils';
diff --git a/x-pack/plugins/security_solution/public/explore/components/stat_items/metric_embeddable.test.tsx b/x-pack/plugins/security_solution/public/explore/components/stat_items/metric_embeddable.test.tsx
index b801102b6739a..87760cc856e7d 100644
--- a/x-pack/plugins/security_solution/public/explore/components/stat_items/metric_embeddable.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/components/stat_items/metric_embeddable.test.tsx
@@ -13,11 +13,7 @@ import React from 'react';
 import { TestProviders } from '../../../common/mock';
 import type { LensAttributes } from '../../../common/components/visualization_actions/types';
 
-jest.mock('../../../common/components/visualization_actions', () => {
-  return {
-    VisualizationActions: () => <div data-test-subj="visualizationActions" />,
-  };
-});
+jest.mock('../../../common/components/visualization_actions/actions');
 
 jest.mock('../../../common/components/visualization_actions/lens_embeddable', () => {
   return {
diff --git a/x-pack/plugins/security_solution/public/explore/components/stat_items/stat_items.test.tsx b/x-pack/plugins/security_solution/public/explore/components/stat_items/stat_items.test.tsx
index 39682dc3301aa..c4a714887c377 100644
--- a/x-pack/plugins/security_solution/public/explore/components/stat_items/stat_items.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/components/stat_items/stat_items.test.tsx
@@ -40,11 +40,7 @@ jest.mock('../../../common/components/charts/barchart', () => {
   return { BarChart: () => <div className="barchart" /> };
 });
 
-jest.mock('../../../common/components/visualization_actions', () => {
-  return {
-    VisualizationActions: () => <div className="visualizationActions" />,
-  };
-});
+jest.mock('../../../common/components/visualization_actions/actions');
 
 const mockSetToggle = jest.fn();
 
diff --git a/x-pack/plugins/security_solution/public/explore/hosts/pages/details/details_tabs.test.tsx b/x-pack/plugins/security_solution/public/explore/hosts/pages/details/details_tabs.test.tsx
index 3d6dd5c6c4658..41b9564d2c9be 100644
--- a/x-pack/plugins/security_solution/public/explore/hosts/pages/details/details_tabs.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/hosts/pages/details/details_tabs.test.tsx
@@ -71,9 +71,7 @@ jest.mock('../../../../common/components/query_bar', () => ({
 const mockUseResizeObserver: jest.Mock = useResizeObserver as jest.Mock;
 jest.mock('use-resize-observer/polyfilled');
 mockUseResizeObserver.mockImplementation(() => ({}));
-jest.mock('../../../../common/components/visualization_actions', () => ({
-  VisualizationActions: jest.fn(() => <div data-test-subj="mock-viz-actions" />),
-}));
+jest.mock('../../../../common/components/visualization_actions/actions');
 
 const myState: State = mockGlobalState;
 const { storage } = createSecuritySolutionStorageMock();
diff --git a/x-pack/plugins/security_solution/public/explore/hosts/pages/hosts.test.tsx b/x-pack/plugins/security_solution/public/explore/hosts/pages/hosts.test.tsx
index 3462bae20afc4..887e38cffaf53 100644
--- a/x-pack/plugins/security_solution/public/explore/hosts/pages/hosts.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/hosts/pages/hosts.test.tsx
@@ -39,9 +39,7 @@ jest.mock('../../../common/components/search_bar', () => ({
 jest.mock('../../../common/components/query_bar', () => ({
   QueryBar: () => null,
 }));
-jest.mock('../../../common/components/visualization_actions', () => ({
-  VisualizationActions: jest.fn(() => <div data-test-subj="mock-viz-actions" />),
-}));
+jest.mock('../../../common/components/visualization_actions/actions');
 jest.mock('../../../common/components/visualization_actions/lens_embeddable', () => ({
   LensEmbeddable: jest.fn(() => <div data-test-subj="mock-lens-embeddable" />),
 }));
diff --git a/x-pack/plugins/security_solution/public/explore/network/pages/network.test.tsx b/x-pack/plugins/security_solution/public/explore/network/pages/network.test.tsx
index 61b279d6ac2f5..a0a6c873c8979 100644
--- a/x-pack/plugins/security_solution/public/explore/network/pages/network.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/network/pages/network.test.tsx
@@ -39,9 +39,7 @@ jest.mock('../../../common/components/search_bar', () => ({
 jest.mock('../../../common/components/query_bar', () => ({
   QueryBar: () => null,
 }));
-jest.mock('../../../common/components/visualization_actions', () => ({
-  VisualizationActions: jest.fn(() => <div data-test-subj="mock-viz-actions" />),
-}));
+jest.mock('../../../common/components/visualization_actions/actions');
 
 type Action = 'PUSH' | 'POP' | 'REPLACE';
 const pop: Action = 'POP';
diff --git a/x-pack/plugins/security_solution/public/explore/users/pages/navigation/authentications_query_tab_body.test.tsx b/x-pack/plugins/security_solution/public/explore/users/pages/navigation/authentications_query_tab_body.test.tsx
index 7d860e5a99611..c627120bdf634 100644
--- a/x-pack/plugins/security_solution/public/explore/users/pages/navigation/authentications_query_tab_body.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/users/pages/navigation/authentications_query_tab_body.test.tsx
@@ -17,7 +17,7 @@ jest.mock('../../../containers/authentications');
 jest.mock('../../../../common/containers/query_toggle');
 jest.mock('../../../../common/lib/kibana');
 
-jest.mock('../../../../common/components/visualization_actions');
+jest.mock('../../../../common/components/visualization_actions/actions');
 jest.mock('../../../../common/components/visualization_actions/lens_embeddable');
 
 describe('Authentications query tab body', () => {
diff --git a/x-pack/plugins/security_solution/public/explore/users/pages/users_tabs.test.tsx b/x-pack/plugins/security_solution/public/explore/users/pages/users_tabs.test.tsx
index 402118e2543f5..b8a7a2450e46b 100644
--- a/x-pack/plugins/security_solution/public/explore/users/pages/users_tabs.test.tsx
+++ b/x-pack/plugins/security_solution/public/explore/users/pages/users_tabs.test.tsx
@@ -24,9 +24,7 @@ jest.mock('../../../common/components/search_bar', () => ({
 jest.mock('../../../common/components/query_bar', () => ({
   QueryBar: () => null,
 }));
-jest.mock('../../../common/components/visualization_actions', () => ({
-  VisualizationActions: jest.fn(() => <div data-test-subj="mock-viz-actions" />),
-}));
+jest.mock('../../../common/components/visualization_actions/actions');
 const mockNavigateToApp = jest.fn();
 jest.mock('../../../common/lib/kibana', () => {
   const original = jest.requireActual('../../../common/lib/kibana');
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
index 3197066aeab49..c18f2b3a91684 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
@@ -50,7 +50,6 @@ jest.mock('../../common/lib/kibana', () => {
 });
 jest.mock('../../common/containers/source');
 jest.mock('../../common/containers/sourcerer');
-jest.mock('../../common/components/visualization_actions');
 jest.mock('../../common/components/visualization_actions/lens_embeddable');
 jest.mock('../../common/containers/use_global_time', () => ({
   useGlobalTime: jest.fn().mockReturnValue({
@@ -89,9 +88,7 @@ jest.mock('../../common/containers/local_storage/use_messages_storage');
 
 jest.mock('../containers/overview_cti_links');
 
-jest.mock('../../common/components/visualization_actions', () => ({
-  VisualizationActions: jest.fn(() => <div data-test-subj="mock-viz-actions" />),
-}));
+jest.mock('../../common/components/visualization_actions/actions');
 
 const useCtiDashboardLinksMock = useCtiDashboardLinks as jest.Mock;
 useCtiDashboardLinksMock.mockReturnValue(mockCtiLinksResponse);

From 56d53675d164dd5110b627744fcdbe21e07188f7 Mon Sep 17 00:00:00 2001
From: Kevin Logan <56395104+kevinlog@users.noreply.github.com>
Date: Tue, 7 Feb 2023 07:17:01 -0500
Subject: [PATCH 047/134] [Security Solution] Add File operation RBAC switch
 description text to role creation (#150386)

## Summary

Adds description text for the file operations RBAC switch

<img width="1728" alt="image"
src="https://user-images.githubusercontent.com/56395104/217087523-3d9fa27d-e582-4be2-90a2-7522bc96e6b7.png">

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
---
 x-pack/plugins/security_solution/server/features.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/x-pack/plugins/security_solution/server/features.ts b/x-pack/plugins/security_solution/server/features.ts
index 107e1c7f5eb9b..197b9fc926cc7 100644
--- a/x-pack/plugins/security_solution/server/features.ts
+++ b/x-pack/plugins/security_solution/server/features.ts
@@ -234,6 +234,12 @@ const responseActionSubFeatures: SubFeatureConfig[] = [
     name: i18n.translate('xpack.securitySolution.featureRegistry.subFeatures.fileOperations', {
       defaultMessage: 'File Operations',
     }),
+    description: i18n.translate(
+      'xpack.securitySolution.featureRegistry.subFeatures.fileOperations.description',
+      {
+        defaultMessage: 'Perform file-related response actions in the response console.',
+      }
+    ),
     privilegeGroups: [
       {
         groupType: 'mutually_exclusive',

From b42bb18119962e60a05eb10c6a6989b0ecea56b6 Mon Sep 17 00:00:00 2001
From: Joseph Crail <joseph.crail@elastic.co>
Date: Tue, 7 Feb 2023 04:22:59 -0800
Subject: [PATCH 048/134] [Profiling] Prepare for inline stackframes (#150401)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR adds initial support for initial stackframes as described in
elastic/prodfiler#2918.

It also adds tests and a minor refactor to account for the removal of
synthetic source from stackframes (see elastic/prodfiler#2850).

For stackframes, the profiling stack is composed of multiple write paths
into Elasticsearch and multiple read paths out of Elasticsearch:
* there are three services that can write into Elasticsearch (`APM
agent`, `pf-elastic-collector`, and `pf-elastic-symbolizer`).
* there are also two ways to read from Elasticsearch (the profiling
plugin in Elasticsearch, and a combination of `search` and `mget`
calls).

This PR was written to handle all permutations of these paths. For those
reviewers that wish to try the PR, please keep this in mind. I also
wrote tests to handle these permutations.

Note: Future PRs will add full support for inline stackframes. At this
time, we only read the first inlined stackframe since the UI does not
support inline stackframes.

---------

Co-authored-by: Tim Rühsen <tim.ruhsen@elastic.co>
---
 .../plugins/profiling/common/stack_traces.ts  |  10 +-
 .../server/routes/search_stacktraces.test.ts  |  16 +--
 .../server/routes/search_stacktraces.ts       |  13 +-
 .../server/routes/stacktrace.test.ts          | 111 +++++++++++++++++-
 .../profiling/server/routes/stacktrace.ts     |  87 ++++++++++----
 5 files changed, 194 insertions(+), 43 deletions(-)

diff --git a/x-pack/plugins/profiling/common/stack_traces.ts b/x-pack/plugins/profiling/common/stack_traces.ts
index 7ad6fe2f32113..d1f041ee2e6ea 100644
--- a/x-pack/plugins/profiling/common/stack_traces.ts
+++ b/x-pack/plugins/profiling/common/stack_traces.ts
@@ -22,11 +22,11 @@ interface ProfilingStackTraces {
   [key: string]: ProfilingStackTrace;
 }
 
-interface ProfilingStackFrame {
-  ['file_name']: string | undefined;
-  ['function_name']: string;
-  ['function_offset']: number | undefined;
-  ['line_number']: number | undefined;
+export interface ProfilingStackFrame {
+  ['file_name']: string[];
+  ['function_name']: string[];
+  ['function_offset']: number[];
+  ['line_number']: number[];
 }
 
 interface ProfilingStackFrames {
diff --git a/x-pack/plugins/profiling/server/routes/search_stacktraces.test.ts b/x-pack/plugins/profiling/server/routes/search_stacktraces.test.ts
index a689fb837a9af..e9d30215e72b1 100644
--- a/x-pack/plugins/profiling/server/routes/search_stacktraces.test.ts
+++ b/x-pack/plugins/profiling/server/routes/search_stacktraces.test.ts
@@ -55,10 +55,10 @@ describe('Stack trace response operations', () => {
       },
       stack_frames: {
         abc: {
-          file_name: 'pthread.c',
-          function_name: 'pthread_create',
-          function_offset: 0,
-          line_number: 0,
+          file_name: ['pthread.c'],
+          function_name: ['pthread_create'],
+          function_offset: [0],
+          line_number: [0],
         },
       },
       executables: {
@@ -128,10 +128,10 @@ describe('Stack trace response operations', () => {
       },
       stack_frames: {
         abc: {
-          file_name: undefined,
-          function_name: 'pthread_create',
-          function_offset: undefined,
-          line_number: undefined,
+          file_name: [],
+          function_name: ['pthread_create'],
+          function_offset: [],
+          line_number: [],
         },
       },
       executables: {
diff --git a/x-pack/plugins/profiling/server/routes/search_stacktraces.ts b/x-pack/plugins/profiling/server/routes/search_stacktraces.ts
index 082ff1124f5d7..a1211bfc72edb 100644
--- a/x-pack/plugins/profiling/server/routes/search_stacktraces.ts
+++ b/x-pack/plugins/profiling/server/routes/search_stacktraces.ts
@@ -35,11 +35,16 @@ export function decodeStackTraceResponse(response: StackTraceResponse) {
 
   const stackFrames: Map<StackFrameID, StackFrame> = new Map();
   for (const [key, value] of Object.entries(response.stack_frames ?? {})) {
+    // Each field in a stackframe is represented by an array. This is
+    // necessary to support inline frames.
+    //
+    // We only take the first available inline stackframe until the UI
+    // can support all of them.
     stackFrames.set(key, {
-      FileName: value.file_name ? value.file_name[0] : [],
-      FunctionName: value.function_name ? value.function_name[0] : [],
-      FunctionOffset: value.function_offset,
-      LineNumber: value.line_number,
+      FileName: value.file_name[0],
+      FunctionName: value.function_name[0],
+      FunctionOffset: value.function_offset[0],
+      LineNumber: value.line_number[0],
     } as StackFrame);
   }
 
diff --git a/x-pack/plugins/profiling/server/routes/stacktrace.test.ts b/x-pack/plugins/profiling/server/routes/stacktrace.test.ts
index 91b55312928c3..4fff2d9c84e63 100644
--- a/x-pack/plugins/profiling/server/routes/stacktrace.test.ts
+++ b/x-pack/plugins/profiling/server/routes/stacktrace.test.ts
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
-import { createStackFrameID, StackTrace } from '../../common/profiling';
+import LRUCache from 'lru-cache';
+import { createStackFrameID, StackFrame, StackFrameID, StackTrace } from '../../common/profiling';
 import { runLengthEncode } from '../../common/run_length_encoding';
-import { decodeStackTrace, EncodedStackTrace } from './stacktrace';
+import { decodeStackTrace, EncodedStackTrace, updateStackFrameMap } from './stacktrace';
 
 enum fileID {
   A = 'aQpJmTLWydNvOapSFZOwKg',
@@ -86,3 +87,109 @@ describe('Stack trace operations', () => {
     }
   });
 });
+
+describe('Stack frame operations', () => {
+  test('updateStackFrameMap with no frames', () => {
+    const stackFrameMap = new Map<StackFrameID, StackFrame>();
+    const stackFrameCache = new LRUCache<StackFrameID, StackFrame>();
+
+    const hits = updateStackFrameMap([], stackFrameMap, stackFrameCache);
+
+    expect(hits).toEqual(0);
+    expect(stackFrameMap.size).toEqual(0);
+    expect(stackFrameCache.length).toEqual(0);
+  });
+
+  test('updateStackFrameMap with missing frames', () => {
+    const stackFrameMap = new Map<StackFrameID, StackFrame>();
+    const stackFrameCache = new LRUCache<StackFrameID, StackFrame>();
+
+    const stackFrames = [
+      {
+        _index: 'profiling-stackframes',
+        _id: 'stackframe-001',
+        found: false,
+      },
+    ];
+
+    const hits = updateStackFrameMap(stackFrames, stackFrameMap, stackFrameCache);
+
+    expect(hits).toEqual(0);
+    expect(stackFrameMap.size).toEqual(1);
+    expect(stackFrameCache.length).toEqual(1);
+  });
+
+  test('updateStackFrameMap with one partial non-inlined frame', () => {
+    const stackFrameMap = new Map<StackFrameID, StackFrame>();
+    const stackFrameCache = new LRUCache<StackFrameID, StackFrame>();
+
+    const id = 'stackframe-001';
+    const source = {
+      'ecs.version': '1.0.0',
+      'Stackframe.function.name': 'calloc',
+    };
+    const expected = {
+      FileName: undefined,
+      FunctionName: 'calloc',
+      FunctionOffset: undefined,
+      LineNumber: undefined,
+      SourceType: undefined,
+    };
+
+    const stackFrames = [
+      {
+        _index: 'profiling-stackframes',
+        _id: id,
+        _version: 1,
+        _seq_no: 1,
+        _primary_term: 1,
+        found: true,
+        _source: source,
+      },
+    ];
+
+    const hits = updateStackFrameMap(stackFrames, stackFrameMap, stackFrameCache);
+
+    expect(hits).toEqual(1);
+    expect(stackFrameMap.size).toEqual(1);
+    expect(stackFrameCache.length).toEqual(1);
+    expect(stackFrameMap.get(id)).toEqual(expected);
+  });
+
+  test('updateStackFrameMap with one partial inlined frame', () => {
+    const stackFrameMap = new Map<StackFrameID, StackFrame>();
+    const stackFrameCache = new LRUCache<StackFrameID, StackFrame>();
+
+    const id = 'stackframe-001';
+    const source = {
+      'ecs.version': '1.0.0',
+      'Stackframe.function.name': ['calloc', 'memset'],
+    };
+    const expected = {
+      FileName: undefined,
+      FunctionName: 'calloc',
+      FunctionOffset: undefined,
+      LineNumber: undefined,
+      SourceType: undefined,
+    };
+
+    const stackFrames = [
+      {
+        _index: 'profiling-stackframes',
+        _id: id,
+        _version: 1,
+        _seq_no: 1,
+        _primary_term: 1,
+        found: true,
+        _source: source,
+      },
+    ];
+
+    const hits = updateStackFrameMap(stackFrames, stackFrameMap, stackFrameCache);
+
+    expect(hits).toEqual(1);
+    expect(stackFrameMap.size).toEqual(1);
+    expect(stackFrameCache.length).toEqual(1);
+    expect(stackFrameMap.get(id)).toEqual(expected);
+  });
+});
diff --git a/x-pack/plugins/profiling/server/routes/stacktrace.ts b/x-pack/plugins/profiling/server/routes/stacktrace.ts
index c0fb39de2151f..4d26851b7781f 100644
--- a/x-pack/plugins/profiling/server/routes/stacktrace.ts
+++ b/x-pack/plugins/profiling/server/routes/stacktrace.ts
@@ -285,6 +285,68 @@ export function clearStackFrameCache(): number {
   return numDeleted;
 }
 
+export function updateStackFrameMap(
+  stackFrames: any,
+  stackFrameMap: Map<StackFrameID, StackFrame>,
+  stackFrameCache: LRUCache<StackFrameID, StackFrame>
+): number {
+  let found = 0;
+  for (const frame of stackFrames) {
+    if ('error' in frame) {
+      continue;
+    }
+    if (frame.found) {
+      found++;
+
+      const fileName = frame._source[ProfilingESField.StackframeFileName];
+      const functionName = frame._source[ProfilingESField.StackframeFunctionName];
+      const functionOffset = frame._source[ProfilingESField.StackframeFunctionOffset];
+      const lineNumber = frame._source[ProfilingESField.StackframeLineNumber];
+
+      let stackFrame;
+      if (Array.isArray(functionName)) {
+        // Each field in a stackframe is represented by an array. This is
+        // necessary to support inline frames.
+        //
+        // We only take the first available inline stackframe until the UI
+        // can support all of them.
+        stackFrame = {
+          FileName: fileName && fileName[0],
+          FunctionName: functionName && functionName[0],
+          FunctionOffset: functionOffset && functionOffset[0],
+          LineNumber: lineNumber && lineNumber[0],
+        };
+      } else {
+        if (fileName || functionName) {
+          stackFrame = {
+            FileName: fileName,
+            FunctionName: functionName,
+            FunctionOffset: functionOffset,
+            LineNumber: lineNumber,
+          };
+        } else {
+          // pre 8.7 format with synthetic source
+          const sf = frame._source.Stackframe;
+          stackFrame = {
+            FileName: sf?.file?.name,
+            FunctionName: sf?.function?.name,
+            FunctionOffset: sf?.function?.offset,
+            LineNumber: sf?.line?.number,
+          };
+        }
+      }
+
+      stackFrameMap.set(frame._id, stackFrame);
+      stackFrameCache.set(frame._id, stackFrame);
+      continue;
+    }
+
+    stackFrameMap.set(frame._id, emptyStackFrame);
+    stackFrameCache.set(frame._id, emptyStackFrame);
+  }
+  return found;
+}
+
 export async function mgetStackFrames({
   logger,
   client,
@@ -319,31 +381,8 @@ export async function mgetStackFrames({
     realtime: true,
   });
 
-  // Create a lookup map StackFrameID -> StackFrame.
-  let queryHits = 0;
   const t0 = Date.now();
-  const docs = resStackFrames.docs;
-  for (const frame of docs) {
-    if ('error' in frame) {
-      continue;
-    }
-    if (frame.found) {
-      queryHits++;
-      const stackFrame = {
-        FileName: frame._source!.Stackframe.file?.name,
-        FunctionName: frame._source!.Stackframe.function?.name,
-        FunctionOffset: frame._source!.Stackframe.function?.offset,
-        LineNumber: frame._source!.Stackframe.line?.number,
-      };
-      stackFrames.set(frame._id, stackFrame);
-      frameLRU.set(frame._id, stackFrame);
-      continue;
-    }
-
-    stackFrames.set(frame._id, emptyStackFrame);
-    frameLRU.set(frame._id, emptyStackFrame);
-  }
-
+  const queryHits = updateStackFrameMap(resStackFrames.docs, stackFrames, frameLRU);
   logger.info(`processing data took ${Date.now() - t0} ms`);
 
   summarizeCacheAndQuery(logger, 'frames', cacheHits, cacheTotal, queryHits, stackFrameIDs.size);

From ce6bde172b605133a01055f8498a09e34ad70ce1 Mon Sep 17 00:00:00 2001
From: Christos Nasikas <christos.nasikas@elastic.co>
Date: Tue, 7 Feb 2023 14:26:56 +0200
Subject: [PATCH 049/134] [Cases] Break long titles in toaster (#150257)

## Summary

In some toasters, the title of the toaster is set from user input. It is
possible for long titles to overflow the toaster. This PR fixes this
issue by forcing long titles to break. Uses the EUI CSS utility class
`eui-textBreakWord`.

Fixes: https://github.com/elastic/kibana/issues/149485

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../cases/public/common/use_cases_toast.test.tsx   |  5 ++++-
 .../cases/public/common/use_cases_toast.tsx        |  2 +-
 .../assignees/use_assignees_action.test.tsx        | 14 ++++++++------
 .../actions/copy_id/use_copy_id_action.test.tsx    |  7 ++++---
 .../actions/delete/use_delete_action.test.tsx      | 14 ++++++++------
 .../actions/severity/use_severity_action.test.tsx  | 14 ++++++++------
 .../actions/status/use_status_action.test.tsx      | 14 ++++++++------
 .../actions/tags/use_tags_action.test.tsx          | 14 ++++++++------
 .../components/actions/use_items_action.test.tsx   |  7 ++++---
 .../containers/use_bulk_update_case.test.tsx       |  5 ++++-
 .../public/containers/use_delete_cases.test.tsx    |  5 ++++-
 .../public/containers/use_post_push_to_service.tsx |  5 ++++-
 .../plugins/cases/public/containers/utils.test.ts  |  7 +++++++
 x-pack/plugins/cases/public/containers/utils.ts    |  1 +
 14 files changed, 73 insertions(+), 41 deletions(-)

diff --git a/x-pack/plugins/cases/public/common/use_cases_toast.test.tsx b/x-pack/plugins/cases/public/common/use_cases_toast.test.tsx
index cabca3ea69f7a..6c33c86d29d51 100644
--- a/x-pack/plugins/cases/public/common/use_cases_toast.test.tsx
+++ b/x-pack/plugins/cases/public/common/use_cases_toast.test.tsx
@@ -346,7 +346,10 @@ describe('Use cases toast hook', () => {
 
       result.current.showSuccessToast('my title');
 
-      expect(successMock).toHaveBeenCalledWith('my title');
+      expect(successMock).toHaveBeenCalledWith({
+        className: 'eui-textBreakWord',
+        title: 'my title',
+      });
     });
   });
 });
diff --git a/x-pack/plugins/cases/public/common/use_cases_toast.tsx b/x-pack/plugins/cases/public/common/use_cases_toast.tsx
index d866f9791fc2d..3d90005546464 100644
--- a/x-pack/plugins/cases/public/common/use_cases_toast.tsx
+++ b/x-pack/plugins/cases/public/common/use_cases_toast.tsx
@@ -167,7 +167,7 @@ export const useCasesToast = () => {
       }
     },
     showSuccessToast: (title: string) => {
-      toasts.addSuccess(title);
+      toasts.addSuccess({ title, className: 'eui-textBreakWord' });
     },
   };
 };
diff --git a/x-pack/plugins/cases/public/components/actions/assignees/use_assignees_action.test.tsx b/x-pack/plugins/cases/public/components/actions/assignees/use_assignees_action.test.tsx
index 91c47edc276c7..11b91c483d151 100644
--- a/x-pack/plugins/cases/public/components/actions/assignees/use_assignees_action.test.tsx
+++ b/x-pack/plugins/cases/public/components/actions/assignees/use_assignees_action.test.tsx
@@ -111,9 +111,10 @@ describe('useAssigneesAction', () => {
     });
 
     await waitFor(() => {
-      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-        'Edited case'
-      );
+      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+        title: 'Edited case',
+        className: 'eui-textBreakWord',
+      });
     });
   });
 
@@ -136,9 +137,10 @@ describe('useAssigneesAction', () => {
     });
 
     await waitFor(() => {
-      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-        'Edited 2 cases'
-      );
+      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+        title: 'Edited 2 cases',
+        className: 'eui-textBreakWord',
+      });
     });
   });
 });
diff --git a/x-pack/plugins/cases/public/components/actions/copy_id/use_copy_id_action.test.tsx b/x-pack/plugins/cases/public/components/actions/copy_id/use_copy_id_action.test.tsx
index 7cc4f7677286b..0c33980b3ab63 100644
--- a/x-pack/plugins/cases/public/components/actions/copy_id/use_copy_id_action.test.tsx
+++ b/x-pack/plugins/cases/public/components/actions/copy_id/use_copy_id_action.test.tsx
@@ -83,9 +83,10 @@ describe('useCopyIDAction', () => {
 
     await waitFor(() => {
       expect(onActionSuccess).toHaveBeenCalled();
-      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-        'Copied Case ID to clipboard'
-      );
+      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+        title: 'Copied Case ID to clipboard',
+        className: 'eui-textBreakWord',
+      });
     });
   });
 });
diff --git a/x-pack/plugins/cases/public/components/actions/delete/use_delete_action.test.tsx b/x-pack/plugins/cases/public/components/actions/delete/use_delete_action.test.tsx
index 3e89fc83ca92b..8859267208817 100644
--- a/x-pack/plugins/cases/public/components/actions/delete/use_delete_action.test.tsx
+++ b/x-pack/plugins/cases/public/components/actions/delete/use_delete_action.test.tsx
@@ -155,9 +155,10 @@ describe('useDeleteAction', () => {
     });
 
     await waitFor(() => {
-      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-        'Deleted case'
-      );
+      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+        title: 'Deleted case',
+        className: 'eui-textBreakWord',
+      });
     });
   });
 
@@ -180,9 +181,10 @@ describe('useDeleteAction', () => {
     });
 
     await waitFor(() => {
-      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-        'Deleted 2 cases'
-      );
+      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+        title: 'Deleted 2 cases',
+        className: 'eui-textBreakWord',
+      });
     });
   });
 });
diff --git a/x-pack/plugins/cases/public/components/actions/severity/use_severity_action.test.tsx b/x-pack/plugins/cases/public/components/actions/severity/use_severity_action.test.tsx
index 42fea8e679608..695b90624fdd6 100644
--- a/x-pack/plugins/cases/public/components/actions/severity/use_severity_action.test.tsx
+++ b/x-pack/plugins/cases/public/components/actions/severity/use_severity_action.test.tsx
@@ -136,9 +136,10 @@ describe('useSeverityAction', () => {
       });
 
       await waitFor(() => {
-        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-          expectedMessage
-        );
+        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+          title: expectedMessage,
+          className: 'eui-textBreakWord',
+        });
       });
     }
   );
@@ -168,9 +169,10 @@ describe('useSeverityAction', () => {
       });
 
       await waitFor(() => {
-        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-          expectedMessage
-        );
+        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+          title: expectedMessage,
+          className: 'eui-textBreakWord',
+        });
       });
     }
   );
diff --git a/x-pack/plugins/cases/public/components/actions/status/use_status_action.test.tsx b/x-pack/plugins/cases/public/components/actions/status/use_status_action.test.tsx
index 03d3da5101d38..201783db6bd95 100644
--- a/x-pack/plugins/cases/public/components/actions/status/use_status_action.test.tsx
+++ b/x-pack/plugins/cases/public/components/actions/status/use_status_action.test.tsx
@@ -126,9 +126,10 @@ describe('useStatusAction', () => {
       });
 
       await waitFor(() => {
-        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-          expectedMessage
-        );
+        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+          title: expectedMessage,
+          className: 'eui-textBreakWord',
+        });
       });
     }
   );
@@ -157,9 +158,10 @@ describe('useStatusAction', () => {
       });
 
       await waitFor(() => {
-        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-          expectedMessage
-        );
+        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+          title: expectedMessage,
+          className: 'eui-textBreakWord',
+        });
       });
     }
   );
diff --git a/x-pack/plugins/cases/public/components/actions/tags/use_tags_action.test.tsx b/x-pack/plugins/cases/public/components/actions/tags/use_tags_action.test.tsx
index 1c4af4705bf38..c4aa68a578f2d 100644
--- a/x-pack/plugins/cases/public/components/actions/tags/use_tags_action.test.tsx
+++ b/x-pack/plugins/cases/public/components/actions/tags/use_tags_action.test.tsx
@@ -105,9 +105,10 @@ describe('useTagsAction', () => {
     });
 
     await waitFor(() => {
-      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-        'Edited case'
-      );
+      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+        title: 'Edited case',
+        className: 'eui-textBreakWord',
+      });
     });
   });
 
@@ -130,9 +131,10 @@ describe('useTagsAction', () => {
     });
 
     await waitFor(() => {
-      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-        'Edited 2 cases'
-      );
+      expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+        title: 'Edited 2 cases',
+        className: 'eui-textBreakWord',
+      });
     });
   });
 });
diff --git a/x-pack/plugins/cases/public/components/actions/use_items_action.test.tsx b/x-pack/plugins/cases/public/components/actions/use_items_action.test.tsx
index a53eca39562e8..1ce613b9ded83 100644
--- a/x-pack/plugins/cases/public/components/actions/use_items_action.test.tsx
+++ b/x-pack/plugins/cases/public/components/actions/use_items_action.test.tsx
@@ -221,9 +221,10 @@ describe('useItemsAction', () => {
       });
 
       await waitFor(() => {
-        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith(
-          'My toaster title'
-        );
+        expect(appMockRender.coreStart.notifications.toasts.addSuccess).toHaveBeenCalledWith({
+          title: 'My toaster title',
+          className: 'eui-textBreakWord',
+        });
       });
     });
 
diff --git a/x-pack/plugins/cases/public/containers/use_bulk_update_case.test.tsx b/x-pack/plugins/cases/public/containers/use_bulk_update_case.test.tsx
index be89dc92f9d06..06d641e753dce 100644
--- a/x-pack/plugins/cases/public/containers/use_bulk_update_case.test.tsx
+++ b/x-pack/plugins/cases/public/containers/use_bulk_update_case.test.tsx
@@ -74,7 +74,10 @@ describe('useUpdateCases', () => {
 
     await waitForNextUpdate();
 
-    expect(addSuccess).toHaveBeenCalledWith('Success title');
+    expect(addSuccess).toHaveBeenCalledWith({
+      title: 'Success title',
+      className: 'eui-textBreakWord',
+    });
   });
 
   it('shows a toast error when the api return an error', async () => {
diff --git a/x-pack/plugins/cases/public/containers/use_delete_cases.test.tsx b/x-pack/plugins/cases/public/containers/use_delete_cases.test.tsx
index 2059b7331e298..6df1c886f146e 100644
--- a/x-pack/plugins/cases/public/containers/use_delete_cases.test.tsx
+++ b/x-pack/plugins/cases/public/containers/use_delete_cases.test.tsx
@@ -74,7 +74,10 @@ describe('useDeleteCases', () => {
 
     await waitForNextUpdate();
 
-    expect(addSuccess).toHaveBeenCalledWith('Success title');
+    expect(addSuccess).toHaveBeenCalledWith({
+      title: 'Success title',
+      className: 'eui-textBreakWord',
+    });
   });
 
   it('shows a toast error when the api return an error', async () => {
diff --git a/x-pack/plugins/cases/public/containers/use_post_push_to_service.tsx b/x-pack/plugins/cases/public/containers/use_post_push_to_service.tsx
index 3a5e8bddcea63..d13500dcbc5fa 100644
--- a/x-pack/plugins/cases/public/containers/use_post_push_to_service.tsx
+++ b/x-pack/plugins/cases/public/containers/use_post_push_to_service.tsx
@@ -77,7 +77,10 @@ export const usePostPushToService = (): UsePostPushToService => {
 
         if (!cancel.current) {
           dispatch({ type: 'FETCH_SUCCESS' });
-          toasts.addSuccess(i18n.SUCCESS_SEND_TO_EXTERNAL_SERVICE(connector.name));
+          toasts.addSuccess({
+            title: i18n.SUCCESS_SEND_TO_EXTERNAL_SERVICE(connector.name),
+            className: 'eui-textBreakWord',
+          });
         }
 
         return response;
diff --git a/x-pack/plugins/cases/public/containers/utils.test.ts b/x-pack/plugins/cases/public/containers/utils.test.ts
index fbb9f7a72d1d0..c87c81a02f818 100644
--- a/x-pack/plugins/cases/public/containers/utils.test.ts
+++ b/x-pack/plugins/cases/public/containers/utils.test.ts
@@ -58,6 +58,7 @@ describe('utils', () => {
 
       expect(toast).toEqual({
         title: 'Alerts in "My case" have been synced',
+        className: 'eui-textBreakWord',
       });
     });
 
@@ -74,6 +75,7 @@ describe('utils', () => {
 
       expect(toast).toEqual({
         title: 'Updated "My case"',
+        className: 'eui-textBreakWord',
       });
     });
 
@@ -85,6 +87,7 @@ describe('utils', () => {
 
       expect(toast).toEqual({
         title: 'Updated "My case"',
+        className: 'eui-textBreakWord',
       });
     });
 
@@ -100,6 +103,7 @@ describe('utils', () => {
       expect(toast).toEqual({
         title: 'Updated "My case"',
         text: 'Updated the statuses of attached alerts.',
+        className: 'eui-textBreakWord',
       });
     });
 
@@ -114,6 +118,7 @@ describe('utils', () => {
 
       expect(toast).toEqual({
         title: 'Updated "My case"',
+        className: 'eui-textBreakWord',
       });
     });
 
@@ -128,6 +133,7 @@ describe('utils', () => {
 
       expect(toast).toEqual({
         title: 'Updated "My case"',
+        className: 'eui-textBreakWord',
       });
     });
 
@@ -142,6 +148,7 @@ describe('utils', () => {
 
       expect(toast).toEqual({
         title: 'Updated "My case"',
+        className: 'eui-textBreakWord',
       });
     });
   });
diff --git a/x-pack/plugins/cases/public/containers/utils.ts b/x-pack/plugins/cases/public/containers/utils.ts
index f0c37ddb9e424..a2d5c91417ec1 100644
--- a/x-pack/plugins/cases/public/containers/utils.ts
+++ b/x-pack/plugins/cases/public/containers/utils.ts
@@ -115,6 +115,7 @@ export const createUpdateSuccessToaster = (
 
   const toast: ToastInputFields = {
     title: i18n.UPDATED_CASE(caseAfterUpdate.title),
+    className: 'eui-textBreakWord',
   };
 
   if (valueToUpdateIsSettings(key, value) && value?.syncAlerts && caseHasAlerts) {

From 36cce21ad7bf1a70531c9831008c306dcd5fb552 Mon Sep 17 00:00:00 2001
From: Christos Nasikas <christos.nasikas@elastic.co>
Date: Tue, 7 Feb 2023 14:27:21 +0200
Subject: [PATCH 050/134] [Cases] Improve assignees layout in the create case
 page (#150255)

## Summary

Improves the assignees' list in the create case page to match the list
in the single case page.

Fixes: https://github.com/elastic/kibana/issues/149190

## Before

<img width="2220" alt="Screenshot 2023-02-03 at 8 10 32 PM"
src="https://user-images.githubusercontent.com/7871006/216677329-61e8cb1f-9621-4146-af38-e4c7e89a5bf6.png">

## After

<img width="1151" alt="Screenshot 2023-02-03 at 8 10 17 PM"
src="https://user-images.githubusercontent.com/7871006/216677335-bce4bd1e-9081-48da-a048-d70a6194be8a.png">


### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../public/components/create/assignees.tsx    | 47 +++++++++++++++----
 1 file changed, 37 insertions(+), 10 deletions(-)

diff --git a/x-pack/plugins/cases/public/components/create/assignees.tsx b/x-pack/plugins/cases/public/components/create/assignees.tsx
index 8634d60d70e85..3c5b0bc9b119d 100644
--- a/x-pack/plugins/cases/public/components/create/assignees.tsx
+++ b/x-pack/plugins/cases/public/components/create/assignees.tsx
@@ -9,10 +9,12 @@ import { isEmpty } from 'lodash';
 import React, { memo, useCallback, useState } from 'react';
 import type { EuiComboBoxOptionOption } from '@elastic/eui';
 import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiHighlight,
   EuiComboBox,
   EuiFormRow,
   EuiLink,
-  EuiSelectableListItem,
   EuiTextColor,
 } from '@elastic/eui';
 import type { UserProfileWithAvatar, UserProfile } from '@kbn/user-profile-components';
@@ -113,18 +115,42 @@ const AssigneesFieldComponent: React.FC<FieldProps> = React.memo(
 
     const renderOption = useCallback(
       (option: EuiComboBoxOptionOption, searchValue: string, contentClassName: string) => {
-        const { user, data, value } = option as EuiComboBoxOptionOption<string> &
-          UserProfileWithAvatar;
+        const { user, data } = option as EuiComboBoxOptionOption<string> & UserProfileWithAvatar;
+
+        const displayName = getUserDisplayName(user);
 
         return (
-          <EuiSelectableListItem
-            key={value}
-            prepend={<UserAvatar user={user} avatar={data.avatar} size="s" />}
-            className={contentClassName}
-            append={<EuiTextColor color="subdued">{user.email}</EuiTextColor>}
+          <EuiFlexGroup
+            alignItems="center"
+            justifyContent="flexStart"
+            gutterSize="s"
+            responsive={false}
           >
-            {getUserDisplayName(user)}
-          </EuiSelectableListItem>
+            <EuiFlexItem grow={false}>
+              <UserAvatar user={user} avatar={data.avatar} size="s" />
+            </EuiFlexItem>
+            <EuiFlexGroup
+              alignItems="center"
+              justifyContent="spaceBetween"
+              gutterSize="none"
+              responsive={false}
+            >
+              <EuiFlexItem>
+                <EuiHighlight search={searchValue} className={contentClassName}>
+                  {displayName}
+                </EuiHighlight>
+              </EuiFlexItem>
+              {user.email && user.email !== displayName ? (
+                <EuiFlexItem grow={false}>
+                  <EuiTextColor color={'subdued'}>
+                    <EuiHighlight search={searchValue} className={contentClassName}>
+                      {user.email}
+                    </EuiHighlight>
+                  </EuiTextColor>
+                </EuiFlexItem>
+              ) : null}
+            </EuiFlexGroup>
+          </EuiFlexGroup>
         );
       },
       []
@@ -165,6 +191,7 @@ const AssigneesFieldComponent: React.FC<FieldProps> = React.memo(
           onChange={onComboChange}
           onSearchChange={onSearchComboChange}
           renderOption={renderOption}
+          rowHeight={35}
         />
       </EuiFormRow>
     );

From 418f7dff9ae0599871c3b539afd68320c3f9bc08 Mon Sep 17 00:00:00 2001
From: Sander Philipse <94373878+sphilipse@users.noreply.github.com>
Date: Tue, 7 Feb 2023 14:00:00 +0100
Subject: [PATCH 051/134] [Enterprise Search] Show password input for password
 fields (#150415)

## Summary

This adds an actual password fields for fields that are (likely)
passwords in the connector configuration.
<img width="783" alt="Screenshot 2023-02-07 at 10 47 21"
src="https://user-images.githubusercontent.com/94373878/217224399-d399d040-5f3f-4960-8ebf-92a73727f409.png">
---
 .../connector_configuration_form.tsx          | 36 +++++++++++++------
 .../connector_configuration_logic.test.ts     | 17 ++++-----
 .../connector_configuration_logic.ts          |  3 ++
 3 files changed, 37 insertions(+), 19 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_form.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_form.tsx
index 29df3ccc5212b..5f24dc3fec76b 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_form.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_form.tsx
@@ -17,6 +17,7 @@ import {
   EuiFlexItem,
   EuiButton,
   EuiButtonEmpty,
+  EuiFieldPassword,
 } from '@elastic/eui';
 
 import { i18n } from '@kbn/i18n';
@@ -41,17 +42,30 @@ export const ConnectorConfigurationForm = () => {
       }}
       component="form"
     >
-      {localConfigView.map(({ key, label, value }) => (
-        <EuiFormRow label={label ?? ''} key={key}>
-          <EuiFieldText
-            value={value}
-            disabled={status === Status.LOADING}
-            onChange={(event) => {
-              setLocalConfigEntry({ key, label, value: event.target.value });
-            }}
-          />
-        </EuiFormRow>
-      ))}
+      {localConfigView.map((configEntry) => {
+        const { key, isPasswordField, label, value } = configEntry;
+        return (
+          <EuiFormRow label={label ?? ''} key={key}>
+            {isPasswordField ? (
+              <EuiFieldPassword
+                value={value}
+                disabled={status === Status.LOADING}
+                onChange={(event) => {
+                  setLocalConfigEntry({ ...configEntry, value: event.target.value });
+                }}
+              />
+            ) : (
+              <EuiFieldText
+                value={value}
+                disabled={status === Status.LOADING}
+                onChange={(event) => {
+                  setLocalConfigEntry({ ...configEntry, value: event.target.value });
+                }}
+              />
+            )}
+          </EuiFormRow>
+        );
+      })}
       <EuiFormRow>
         <EuiFlexGroup>
           <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_logic.test.ts
index 632d60fac3cad..5faf6206a565a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_logic.test.ts
@@ -73,13 +73,14 @@ describe('ConnectorConfigurationLogic', () => {
       it('should set local config entry and sort keys', () => {
         ConnectorConfigurationLogic.actions.setConfigState({
           bar: { label: 'foo', value: 'foofoo' },
-          foo: { label: 'thirdBar', value: 'fourthBar' },
+          password: { label: 'thirdBar', value: 'fourthBar' },
         });
         ConnectorConfigurationLogic.actions.setLocalConfigState({
           bar: { label: 'foo', value: 'foofoo' },
-          foo: { label: 'thirdBar', value: 'fourthBar' },
+          password: { label: 'thirdBar', value: 'fourthBar' },
         });
         ConnectorConfigurationLogic.actions.setLocalConfigEntry({
+          isPasswordField: false,
           key: 'bar',
           label: 'foo',
           value: 'fafa',
@@ -88,19 +89,19 @@ describe('ConnectorConfigurationLogic', () => {
           ...DEFAULT_VALUES,
           configState: {
             bar: { label: 'foo', value: 'foofoo' },
-            foo: { label: 'thirdBar', value: 'fourthBar' },
+            password: { label: 'thirdBar', value: 'fourthBar' },
           },
           configView: [
             { key: 'bar', label: 'foo', value: 'foofoo' },
-            { key: 'foo', label: 'thirdBar', value: 'fourthBar' },
+            { key: 'password', label: 'thirdBar', value: 'fourthBar' },
           ],
           localConfigState: {
             bar: { label: 'foo', value: 'fafa' },
-            foo: { label: 'thirdBar', value: 'fourthBar' },
+            password: { label: 'thirdBar', value: 'fourthBar' },
           },
           localConfigView: [
-            { key: 'bar', label: 'foo', value: 'fafa' },
-            { key: 'foo', label: 'thirdBar', value: 'fourthBar' },
+            { isPasswordField: false, key: 'bar', label: 'foo', value: 'fafa' },
+            { isPasswordField: true, key: 'password', label: 'thirdBar', value: 'fourthBar' },
           ],
         });
       });
@@ -140,7 +141,7 @@ describe('ConnectorConfigurationLogic', () => {
           },
           isEditing: true,
           localConfigState: connectorIndex.connector.configuration,
-          localConfigView: [{ key: 'foo', label: 'bar', value: 'barbar' }],
+          localConfigView: [{ isPasswordField: false, key: 'foo', label: 'bar', value: 'barbar' }],
           shouldStartInEditMode: true,
         });
       });
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_logic.ts
index bc705db85ed81..dec8044c5c447 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/connector_configuration_logic.ts
@@ -50,6 +50,7 @@ interface ConnectorConfigurationValues {
 }
 
 interface ConfigEntry {
+  isPasswordField: boolean;
   key: string;
   label: string;
   value: string;
@@ -179,6 +180,8 @@ export const ConnectorConfigurationLogic = kea<
       (configState) =>
         Object.keys(configState)
           .map((key) => ({
+            isPasswordField:
+              key.includes('password') || configState[key].label.toLowerCase().includes('password'),
             key,
             label: configState[key].label,
             value: configState[key].value,

From 969f7b575df30f95fd9835939bdd655d42e81312 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Istv=C3=A1n=20Zolt=C3=A1n=20Szab=C3=B3?=
 <szabosteve@gmail.com>
Date: Tue, 7 Feb 2023 14:03:45 +0100
Subject: [PATCH 052/134] [ML] Reviews data frame analytics UI text (#150060)

## Summary

This PR edits the DFA UI text to be in line with the EUI guidelines and
the AD UI text.

* Removes the getting started callout box from the Overview page.
* Changes the third-person singular form of verbs in helper texts.
* Makes the DFA job descriptions shorter on the job creation page.
---
 .../advanced_step/advanced_step_form.tsx      |  4 +-
 .../advanced_step/hyper_parameters.tsx        |  2 +-
 .../outlier_hyper_parameters.tsx              |  4 +-
 .../configuration_step/job_type.tsx           |  6 +-
 .../details_step/details_step_form.tsx        |  6 +-
 .../components/getting_started_callout.tsx    | 92 -------------------
 .../application/overview/overview_page.tsx    |  3 -
 .../translations/translations/fr-FR.json      |  6 --
 .../translations/translations/ja-JP.json      |  6 --
 .../translations/translations/zh-CN.json      |  6 --
 .../apps/ml/permissions/full_ml_access.ts     |  3 -
 .../apps/ml/permissions/read_ml_access.ts     |  2 -
 .../functional/services/ml/overview_page.ts   | 14 ---
 13 files changed, 11 insertions(+), 143 deletions(-)
 delete mode 100644 x-pack/plugins/ml/public/application/overview/components/getting_started_callout.tsx

diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_form.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_form.tsx
index a566aa685b7bc..f926890424545 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_form.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/advanced_step_form.tsx
@@ -264,7 +264,7 @@ export const AdvancedStepForm: FC<CreateAnalyticsStepProps> = ({
             'xpack.ml.dataframe.analytics.create.computeFeatureInfluenceLabelHelpText',
             {
               defaultMessage:
-                'Specifies whether the feature influence calculation is enabled. Defaults to true.',
+                'Specify whether the feature influence calculation is enabled. Defaults to true.',
             }
           )}
         >
@@ -399,7 +399,7 @@ export const AdvancedStepForm: FC<CreateAnalyticsStepProps> = ({
             'xpack.ml.dataframe.analytics.create.predictionFieldNameHelpText',
             {
               defaultMessage:
-                'Defines the name of the prediction field in the results. Defaults to <dependent_variable>_prediction.',
+                'Define the name of the prediction field in the results. The default is <dependent_variable>_prediction.',
             }
           )}
         >
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/hyper_parameters.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/hyper_parameters.tsx
index 704b2cc77a7f9..35b408213ab70 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/hyper_parameters.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/hyper_parameters.tsx
@@ -366,7 +366,7 @@ export const HyperParameters: FC<Props> = ({ actions, state, advancedParamErrors
             'xpack.ml.dataframe.analytics.create.softTreeDepthToleranceText',
             {
               defaultMessage:
-                'Controls how quickly the loss increases when tree depths exceed soft limits. The smaller the value, the faster the loss increases. Must be greater than or equal to 0.01. ',
+                'Control how quickly the loss increases when tree depths exceed soft limits. The smaller the value, the faster the loss increases. Must be greater than or equal to 0.01. ',
             }
           )}
           isInvalid={
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/outlier_hyper_parameters.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/outlier_hyper_parameters.tsx
index d347a8147469d..a47b28fd150e9 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/outlier_hyper_parameters.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/advanced_step/outlier_hyper_parameters.tsx
@@ -30,7 +30,7 @@ export const OutlierHyperParameters: FC<Props> = ({ actions, state, advancedPara
           })}
           helpText={i18n.translate('xpack.ml.dataframe.analytics.create.methodHelpText', {
             defaultMessage:
-              'Sets the method that outlier detection uses. If not set, uses an ensemble of different methods, normalizes and combines their individual outlier scores to obtain the overall outlier score. It is recommended to use the ensemble method.',
+              'Set the method that outlier detection uses. If not set, uses an ensemble of different methods, normalizes and combines their individual outlier scores to obtain the overall outlier score. It is recommended to use the ensemble method.',
           })}
           isInvalid={advancedParamErrors[ANALYSIS_ADVANCED_FIELDS.METHOD] !== undefined}
           error={advancedParamErrors[ANALYSIS_ADVANCED_FIELDS.METHOD]}
@@ -86,7 +86,7 @@ export const OutlierHyperParameters: FC<Props> = ({ actions, state, advancedPara
           })}
           helpText={i18n.translate('xpack.ml.dataframe.analytics.create.outlierFractionHelpText', {
             defaultMessage:
-              'Sets the proportion of the data set that is assumed to be outlying prior to outlier detection.',
+              'Set the proportion of the data set that is assumed to be outlying prior to outlier detection.',
           })}
           isInvalid={advancedParamErrors[ANALYSIS_ADVANCED_FIELDS.OUTLIER_FRACTION] !== undefined}
           error={advancedParamErrors[ANALYSIS_ADVANCED_FIELDS.OUTLIER_FRACTION]}
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
index 5f54ba3c2bb7c..d66421e41d62e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/job_type.tsx
@@ -30,7 +30,7 @@ type JobDetails = Record<DataFrameAnalysisConfigType, Details>;
 const jobDetails: JobDetails = {
   [ANALYSIS_CONFIG_TYPE.OUTLIER_DETECTION]: {
     helpText: i18n.translate('xpack.ml.dataframe.analytics.create.outlierDetectionHelpText', {
-      defaultMessage: 'Outlier detection identifies unusual data points in the data set.',
+      defaultMessage: 'Identify unusual data points in the data set.',
     }),
     icon: 'outlierDetectionJob',
     title: i18n.translate('xpack.ml.dataframe.analytics.create.outlierDetectionTitle', {
@@ -39,7 +39,7 @@ const jobDetails: JobDetails = {
   },
   [ANALYSIS_CONFIG_TYPE.REGRESSION]: {
     helpText: i18n.translate('xpack.ml.dataframe.analytics.create.regressionHelpText', {
-      defaultMessage: 'Regression predicts numerical values in the data set.',
+      defaultMessage: 'Predict numerical values in the data set.',
     }),
     icon: 'regressionJob',
     title: i18n.translate('xpack.ml.dataframe.analytics.create.regressionTitle', {
@@ -48,7 +48,7 @@ const jobDetails: JobDetails = {
   },
   [ANALYSIS_CONFIG_TYPE.CLASSIFICATION]: {
     helpText: i18n.translate('xpack.ml.dataframe.analytics.create.classificationHelpText', {
-      defaultMessage: 'Classification predicts classes of data points in the data set.',
+      defaultMessage: 'Predict classes of data points in the data set.',
     }),
     icon: 'classificationJob',
     title: i18n.translate('xpack.ml.dataframe.analytics.create.classificationTitle', {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_form.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_form.tsx
index a033137413ef4..265018ec23f9f 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_form.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/details_step/details_step_form.tsx
@@ -297,7 +297,7 @@ export const DetailsStepForm: FC<CreateAnalyticsStepProps> = ({
           disabled={isJobCreated}
           name="mlDataFrameAnalyticsUseResultsFieldDefault"
           label={i18n.translate('xpack.ml.dataframe.analytics.create.UseResultsFieldDefaultLabel', {
-            defaultMessage: 'Use results field default value "{defaultValue}"',
+            defaultMessage: 'Use results field default value: "{defaultValue}"',
             values: { defaultValue: DEFAULT_RESULTS_FIELD },
           })}
           checked={useResultsFieldDefault === true}
@@ -318,12 +318,12 @@ export const DetailsStepForm: FC<CreateAnalyticsStepProps> = ({
           })}
           helpText={i18n.translate('xpack.ml.dataframe.analytics.create.resultsFieldHelpText', {
             defaultMessage:
-              'Defines the name of the field in which to store the results of the analysis. Defaults to ml.',
+              'Define the name of the field in which to store the results of the analysis. Defaults to ml.',
           })}
         >
           <EuiFieldText
             disabled={isJobCreated}
-            placeholder="results field"
+            placeholder="Results field"
             value={resultsField}
             onChange={(e) => setFormState({ resultsField: e.target.value })}
             aria-label={i18n.translate(
diff --git a/x-pack/plugins/ml/public/application/overview/components/getting_started_callout.tsx b/x-pack/plugins/ml/public/application/overview/components/getting_started_callout.tsx
deleted file mode 100644
index d7a0370b4aeac..0000000000000
--- a/x-pack/plugins/ml/public/application/overview/components/getting_started_callout.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { FC } from 'react';
-import { EuiButton, EuiCallOut, EuiLink, EuiSpacer } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n-react';
-import { useStorage } from '@kbn/ml-local-storage';
-import { useMlKibana } from '../../contexts/kibana';
-import { ML_GETTING_STARTED_CALLOUT_DISMISSED } from '../../../../common/types/storage';
-
-const feedbackLink = 'https://www.elastic.co/community/';
-
-export const GettingStartedCallout: FC = () => {
-  const {
-    services: { docLinks },
-  } = useMlKibana();
-
-  const docsLink = docLinks.links.ml.guide;
-
-  const [isCalloutDismissed, setIsCalloutDismissed] = useStorage(
-    ML_GETTING_STARTED_CALLOUT_DISMISSED,
-    false
-  );
-
-  if (isCalloutDismissed) return null;
-
-  return (
-    <>
-      <EuiCallOut
-        data-test-subj={'mlGettingStartedCallout'}
-        title={
-          <FormattedMessage
-            id="xpack.ml.overview.gettingStartedSectionTitle"
-            defaultMessage="Getting started"
-          />
-        }
-        iconType="iInCircle"
-      >
-        <p>
-          <FormattedMessage
-            id="xpack.ml.overview.gettingStartedSectionText"
-            defaultMessage="Welcome to Machine Learning. Get started by reviewing our {docs} or creating a new job."
-            values={{
-              docs: (
-                <EuiLink href={docsLink} target="blank">
-                  <FormattedMessage
-                    id="xpack.ml.overview.gettingStartedSectionDocs"
-                    defaultMessage="documentation"
-                  />
-                </EuiLink>
-              ),
-            }}
-          />
-        </p>
-        <p>
-          <FormattedMessage
-            id="xpack.ml.overview.feedbackSectionText"
-            defaultMessage="If you have input or suggestions regarding your experience, please submit {feedbackLink}."
-            values={{
-              feedbackLink: (
-                <EuiLink href={feedbackLink} target="blank">
-                  <FormattedMessage
-                    id="xpack.ml.overview.feedbackSectionLink"
-                    defaultMessage="feedback online"
-                  />
-                </EuiLink>
-              ),
-            }}
-          />
-        </p>
-        <p>
-          <EuiButton
-            color="primary"
-            onClick={setIsCalloutDismissed.bind(null, true)}
-            data-test-subj={'mlDismissGettingStartedCallout'}
-          >
-            <FormattedMessage
-              id="xpack.ml.overview.gettingStartedSectionDismiss"
-              defaultMessage="Dismiss"
-            />
-          </EuiButton>
-        </p>
-      </EuiCallOut>
-
-      <EuiSpacer size="m" />
-    </>
-  );
-};
diff --git a/x-pack/plugins/ml/public/application/overview/overview_page.tsx b/x-pack/plugins/ml/public/application/overview/overview_page.tsx
index b524bbe27f080..3a37e5bd623cc 100644
--- a/x-pack/plugins/ml/public/application/overview/overview_page.tsx
+++ b/x-pack/plugins/ml/public/application/overview/overview_page.tsx
@@ -11,7 +11,6 @@ import { i18n } from '@kbn/i18n';
 import { mlTimefilterRefresh$, useTimefilter } from '@kbn/ml-date-picker';
 import { checkPermission } from '../capabilities/check_capabilities';
 import { mlNodesAvailable } from '../ml_nodes_check';
-import { GettingStartedCallout } from './components/getting_started_callout';
 import { OverviewContent } from './components/content';
 import { NodeAvailableWarning } from '../components/node_available_warning';
 import { JobsAwaitingNodeWarning } from '../components/jobs_awaiting_node_warning';
@@ -62,8 +61,6 @@ export const OverviewPage: FC = () => {
       />
       <UpgradeWarning />
 
-      <GettingStartedCallout />
-
       {canViewMlNodes && serverless === false ? (
         <>
           <EuiPanel hasShadow={false} hasBorder>
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index a45a8a7dab559..b06153172685e 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -20357,8 +20357,6 @@
     "xpack.ml.notificationsIndicator.errorsAndWarningLabel": "Il y a {count, plural, one {# notification} other {# notifications}} avec un niveau d'erreur ou d'avertissement depuis {lastCheckedAt}",
     "xpack.ml.notificationsIndicator.unreadLabel": "Vous avez des notifications non lues depuis {lastCheckedAt}",
     "xpack.ml.overview.analyticsList.emptyPromptHelperText": "Avant de créer une tâche d'analyse du cadre de données, utilisez des {transforms} pour créer une {sourcedata}.",
-    "xpack.ml.overview.feedbackSectionText": "Si vous avez un avis ou des suggestions concernant votre expérience, envoyez des {feedbackLink}.",
-    "xpack.ml.overview.gettingStartedSectionText": "Bienvenue dans Machine Learning. Commencez en passant en revue nos {docs} ou en créant une nouvelle tâche.",
     "xpack.ml.previewAlert.otherValuesLabel": "et {count, plural, one {# autre} other {# autres}}",
     "xpack.ml.previewAlert.previewMessage": "Trouvé {alertsCount, plural, one {# anomalie} other {# anomalies}} dans le dernier {interval}.",
     "xpack.ml.privilege.pleaseContactAdministratorTooltip": "{message} Veuillez contacter votre administrateur.",
@@ -22273,11 +22271,7 @@
     "xpack.ml.overview.anomalyDetection.tableTypicalTooltip": "Valeurs typiques dans les résultats d'enregistrement des anomalies.",
     "xpack.ml.overview.anomalyDetection.viewJobsActionName": "Afficher les tâches",
     "xpack.ml.overview.anomalyDetection.viewResultsActionName": "Afficher dans l’Explorateur d'anomalies",
-    "xpack.ml.overview.feedbackSectionLink": "commentaires en ligne",
-    "xpack.ml.overview.gettingStartedSectionDismiss": "Rejeter",
-    "xpack.ml.overview.gettingStartedSectionDocs": "documentation",
     "xpack.ml.overview.gettingStartedSectionSourceData": "ensemble de données source centré sur les entités",
-    "xpack.ml.overview.gettingStartedSectionTitle": "Premiers pas",
     "xpack.ml.overview.gettingStartedSectionTransforms": "transformations",
     "xpack.ml.overview.notificationsLabel": "Notifications",
     "xpack.ml.overview.overviewLabel": "Aperçu",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 2dd00ba312030..42ffa67a86fd6 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -20339,8 +20339,6 @@
     "xpack.ml.notificationsIndicator.errorsAndWarningLabel": "{lastCheckedAt}以降に、エラーまたは警告レベルの{count, plural, other {# 通知があります}}",
     "xpack.ml.notificationsIndicator.unreadLabel": "{lastCheckedAt}以降に未読の通知があります",
     "xpack.ml.overview.analyticsList.emptyPromptHelperText": "データフレーム分析ジョブを構築する前に、{transforms}を使用して{sourcedata}を作成してください。",
-    "xpack.ml.overview.feedbackSectionText": "ご利用に際し、ご意見やご提案がありましたら、{feedbackLink}までお送りください。",
-    "xpack.ml.overview.gettingStartedSectionText": "機械学習へようこそ。はじめに{docs}をご覧になるか、新しいジョブを作成してください。",
     "xpack.ml.previewAlert.otherValuesLabel": "および{count, plural, other  {#その他}}",
     "xpack.ml.previewAlert.previewMessage": "過去{interval}に{alertsCount, plural, other  {# 件の異常}}が見つかりました。",
     "xpack.ml.privilege.pleaseContactAdministratorTooltip": "{message} 管理者にお問い合わせください。",
@@ -22253,11 +22251,7 @@
     "xpack.ml.overview.anomalyDetection.tableTypicalTooltip": "異常レコード結果の標準的な値。",
     "xpack.ml.overview.anomalyDetection.viewJobsActionName": "ジョブを表示",
     "xpack.ml.overview.anomalyDetection.viewResultsActionName": "異常エクスプローラーで表示",
-    "xpack.ml.overview.feedbackSectionLink": "オンラインでのフィードバック",
-    "xpack.ml.overview.gettingStartedSectionDismiss": "閉じる",
-    "xpack.ml.overview.gettingStartedSectionDocs": "ドキュメンテーション",
     "xpack.ml.overview.gettingStartedSectionSourceData": "エンティティ中心のソースデータセット",
-    "xpack.ml.overview.gettingStartedSectionTitle": "はじめて使う",
     "xpack.ml.overview.gettingStartedSectionTransforms": "変換",
     "xpack.ml.overview.notificationsLabel": "通知",
     "xpack.ml.overview.overviewLabel": "概要",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 9bfbda1558039..e41ae9b029458 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -20367,8 +20367,6 @@
     "xpack.ml.notificationsIndicator.errorsAndWarningLabel": "自 {lastCheckedAt} 以来有 {count, plural, other {# 个通知}}包含错误或警告级别",
     "xpack.ml.notificationsIndicator.unreadLabel": "自 {lastCheckedAt} 以来您有未读通知",
     "xpack.ml.overview.analyticsList.emptyPromptHelperText": "构建数据帧分析作业之前，请使用 {transforms} 构造一个 {sourcedata}。",
-    "xpack.ml.overview.feedbackSectionText": "如果您在体验方面有任何意见或建议，请提交{feedbackLink}。",
-    "xpack.ml.overview.gettingStartedSectionText": "欢迎使用 Machine Learning。首先查看我们的{docs}或创建新作业。",
     "xpack.ml.previewAlert.otherValuesLabel": "及另外 {count, plural, other {# 个}}",
     "xpack.ml.previewAlert.previewMessage": "在过去 {interval} 找到 {alertsCount, plural, other {# 个异常}}。",
     "xpack.ml.privilege.pleaseContactAdministratorTooltip": "{message}请联系您的管理员。",
@@ -22283,11 +22281,7 @@
     "xpack.ml.overview.anomalyDetection.tableTypicalTooltip": "异常记录结果中的典型值。",
     "xpack.ml.overview.anomalyDetection.viewJobsActionName": "查看作业",
     "xpack.ml.overview.anomalyDetection.viewResultsActionName": "在 Anomaly Explorer 中查看",
-    "xpack.ml.overview.feedbackSectionLink": "在线反馈",
-    "xpack.ml.overview.gettingStartedSectionDismiss": "关闭",
-    "xpack.ml.overview.gettingStartedSectionDocs": "文档",
     "xpack.ml.overview.gettingStartedSectionSourceData": "实体中心型源数据集",
-    "xpack.ml.overview.gettingStartedSectionTitle": "入门",
     "xpack.ml.overview.gettingStartedSectionTransforms": "转换",
     "xpack.ml.overview.notificationsLabel": "通知",
     "xpack.ml.overview.overviewLabel": "概览",
diff --git a/x-pack/test/functional/apps/ml/permissions/full_ml_access.ts b/x-pack/test/functional/apps/ml/permissions/full_ml_access.ts
index 1745694e30831..1c289dd66f0e7 100644
--- a/x-pack/test/functional/apps/ml/permissions/full_ml_access.ts
+++ b/x-pack/test/functional/apps/ml/permissions/full_ml_access.ts
@@ -87,8 +87,6 @@ export default function ({ getService }: FtrProviderContext) {
             await ml.commonUI.waitForDatePickerIndicatorLoaded();
 
             await ml.testExecution.logTestStep('should display a welcome callout');
-            await ml.overviewPage.assertGettingStartedCalloutVisible(true);
-            await ml.overviewPage.dismissGettingStartedCallout();
 
             await ml.testExecution.logTestStep('should display ML Nodes panel');
             await ml.mlNodesPanel.assertNodeOverviewPanel();
@@ -107,7 +105,6 @@ export default function ({ getService }: FtrProviderContext) {
               'should persist the getting started callout state after refresh'
             );
             await browser.refresh();
-            await ml.overviewPage.assertGettingStartedCalloutVisible(false);
           });
         });
       }
diff --git a/x-pack/test/functional/apps/ml/permissions/read_ml_access.ts b/x-pack/test/functional/apps/ml/permissions/read_ml_access.ts
index 6d32e399493fe..960c3a6a4b0b8 100644
--- a/x-pack/test/functional/apps/ml/permissions/read_ml_access.ts
+++ b/x-pack/test/functional/apps/ml/permissions/read_ml_access.ts
@@ -88,8 +88,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await ml.commonUI.waitForDatePickerIndicatorLoaded();
 
             await ml.testExecution.logTestStep('should display a welcome callout');
-            await ml.overviewPage.assertGettingStartedCalloutVisible(true);
-            await ml.overviewPage.dismissGettingStartedCallout();
 
             await ml.testExecution.logTestStep('should not display ML Nodes panel');
             await ml.mlNodesPanel.assertNodesOverviewPanelExists(false);
diff --git a/x-pack/test/functional/services/ml/overview_page.ts b/x-pack/test/functional/services/ml/overview_page.ts
index ac860382f7b67..851a3dac4014e 100644
--- a/x-pack/test/functional/services/ml/overview_page.ts
+++ b/x-pack/test/functional/services/ml/overview_page.ts
@@ -13,20 +13,6 @@ export function MachineLearningOverviewPageProvider({ getService }: FtrProviderC
   const testSubjects = getService('testSubjects');
 
   return {
-    async assertGettingStartedCalloutVisible(expectVisible: boolean = true) {
-      if (expectVisible) {
-        await testSubjects.existOrFail('mlGettingStartedCallout');
-      } else {
-        await testSubjects.missingOrFail('mlGettingStartedCallout');
-      }
-    },
-
-    async dismissGettingStartedCallout() {
-      await this.assertGettingStartedCalloutVisible(true);
-      await testSubjects.click('mlDismissGettingStartedCallout');
-      await this.assertGettingStartedCalloutVisible(false);
-    },
-
     async assertADEmptyStateExists() {
       await testSubjects.existOrFail('mlAnomalyDetectionEmptyState');
     },

From 807b402f0b3c9c4ff68662c44cd512950aa41db4 Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Tue, 7 Feb 2023 14:10:30 +0100
Subject: [PATCH 053/134] [Profling] Single-click setup from Kibana (#148959)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: inge4pres <francesco.gualazzi@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Tim Rühsen <tim.ruehsen@gmx.de>
Co-authored-by: Francesco Gualazzi <inge4pres@users.noreply.github.com>
Closes https://github.com/elastic/prodfiler/issues/2884
---
 .eslintrc.js                                  |   5 +-
 x-pack/plugins/profiling/common/index.ts      |   3 +
 x-pack/plugins/profiling/kibana.json          |   5 +-
 x-pack/plugins/profiling/public/app.tsx       |  47 ++-
 .../public/components/check_setup.tsx         | 145 ++++++++
 .../components/flame_graphs_view/index.tsx    |   2 +-
 .../public/components/no_data_page.tsx        | 327 ++++++++++++++++++
 .../profiling_app_page_template/index.tsx     |  17 +-
 .../primary_profiling_search_bar.tsx          |  12 +-
 .../profiling_header_action_menu.tsx          |  30 ++
 .../profiling/public/hooks/use_async.ts       |  69 +---
 .../hooks/use_auto_aborted_http_client.ts     |  70 ++++
 x-pack/plugins/profiling/public/plugin.tsx    |   5 +-
 .../profiling/public/routing/index.tsx        |  10 +
 x-pack/plugins/profiling/public/services.ts   |  81 +++--
 .../lib/setup/get_setup_instructions.ts       |  40 +++
 .../server/lib/setup/has_profiling_data.ts    |  23 ++
 .../server/lib/setup/mappings/README.md       |  53 +++
 ...catch_resource_already_exists_exception.ts |  16 +
 .../component_template_profiling_events.json  |  76 ++++
 ...ponent_template_profiling_executables.json |  35 ++
 .../component_template_profiling_ilm.json     |   9 +
 ...ponent_template_profiling_stackframes.json |  43 +++
 ...ponent_template_profiling_stacktraces.json |  27 ++
 .../lib/setup/steps/get_apm_package_step.ts   |  44 +++
 .../server/lib/setup/steps/get_apm_policy.ts  |  21 ++
 .../setup/steps/get_cluster_settings_step.ts  |  32 ++
 .../steps/get_component_templates_step.ts     |  86 +++++
 .../steps/get_create_events_data_streams.ts   |  63 ++++
 .../setup/steps/get_create_indices_step.ts    | 321 +++++++++++++++++
 .../lib/setup/steps/get_fleet_policy_step.ts  | 106 ++++++
 .../server/lib/setup/steps/get_ilm_step.ts    |  43 +++
 .../setup/steps/get_index_templates_step.ts   |  80 +++++
 .../setup/steps/get_is_cloud_enabled_step.ts  |  24 ++
 .../lib/setup/steps/get_security_step.ts      |  49 +++
 .../server/lib/setup/steps/ilm_profiling.json |  35 ++
 .../profiling/server/lib/setup/steps/index.ts |  35 ++
 .../profiling/server/lib/setup/types.ts       |  26 ++
 x-pack/plugins/profiling/server/plugin.ts     |  13 +-
 .../plugins/profiling/server/routes/index.ts  |  12 +-
 .../plugins/profiling/server/routes/setup.ts  | 165 +++++++++
 .../profiling/server/routes/topn.test.ts      |   1 +
 x-pack/plugins/profiling/server/types.ts      |  23 +-
 .../utils/create_profiling_es_client.ts       |   4 +
 x-pack/plugins/profiling/tsconfig.json        |  10 +-
 45 files changed, 2213 insertions(+), 130 deletions(-)
 create mode 100644 x-pack/plugins/profiling/public/components/check_setup.tsx
 create mode 100644 x-pack/plugins/profiling/public/components/no_data_page.tsx
 create mode 100644 x-pack/plugins/profiling/public/components/profiling_header_action_menu.tsx
 create mode 100644 x-pack/plugins/profiling/public/hooks/use_auto_aborted_http_client.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/get_setup_instructions.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/has_profiling_data.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/mappings/README.md
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/catch_resource_already_exists_exception.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_events.json
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_executables.json
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_ilm.json
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_stackframes.json
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_stacktraces.json
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_apm_package_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_apm_policy.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_cluster_settings_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_component_templates_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_create_events_data_streams.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_create_indices_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_fleet_policy_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_ilm_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_index_templates_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_is_cloud_enabled_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/get_security_step.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/ilm_profiling.json
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/steps/index.ts
 create mode 100644 x-pack/plugins/profiling/server/lib/setup/types.ts
 create mode 100644 x-pack/plugins/profiling/server/routes/setup.ts

diff --git a/.eslintrc.js b/.eslintrc.js
index 2ce780c297a7d..57c880a3c790b 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -902,7 +902,10 @@ module.exports = {
       files: ['x-pack/plugins/profiling/**/*.{js,mjs,ts,tsx}'],
       rules: {
         'react-hooks/rules-of-hooks': 'error', // Checks rules of Hooks
-        'react-hooks/exhaustive-deps': ['error', { additionalHooks: '^(useAsync)$' }],
+        'react-hooks/exhaustive-deps': [
+          'error',
+          { additionalHooks: '^(useAsync|useTimeRangeAsync|useAutoAbortedHttpClient)$' },
+        ],
       },
     },
     {
diff --git a/x-pack/plugins/profiling/common/index.ts b/x-pack/plugins/profiling/common/index.ts
index 5c0e469585d53..3f29a4398eb47 100644
--- a/x-pack/plugins/profiling/common/index.ts
+++ b/x-pack/plugins/profiling/common/index.ts
@@ -29,6 +29,9 @@ export function getRoutePaths() {
     Flamechart: `${BASE_ROUTE_PATH}/flamechart`,
     CacheExecutables: `${BASE_ROUTE_PATH}/cache/executables`,
     CacheStackFrames: `${BASE_ROUTE_PATH}/cache/stackframes`,
+    HasSetupESResources: `${BASE_ROUTE_PATH}/setup/es_resources`,
+    HasSetupDataCollection: `${BASE_ROUTE_PATH}/setup/has_data`,
+    SetupDataCollectionInstructions: `${BASE_ROUTE_PATH}/setup/instructions`,
   };
 }
 
diff --git a/x-pack/plugins/profiling/kibana.json b/x-pack/plugins/profiling/kibana.json
index 0ead3e39f83f6..b72686a37c19e 100644
--- a/x-pack/plugins/profiling/kibana.json
+++ b/x-pack/plugins/profiling/kibana.json
@@ -19,7 +19,10 @@
     "kibanaReact",
     "unifiedSearch",
     "dataViews",
-    "charts"
+    "charts",
+    "spaces",
+    "cloud",
+    "fleet"
   ],
   "optionalPlugins": [],
   "configPath": [
diff --git a/x-pack/plugins/profiling/public/app.tsx b/x-pack/plugins/profiling/public/app.tsx
index da92e839d05d4..bf3a35d060f05 100644
--- a/x-pack/plugins/profiling/public/app.tsx
+++ b/x-pack/plugins/profiling/public/app.tsx
@@ -6,21 +6,22 @@
  */
 
 import { AppMountParameters, CoreSetup, CoreStart } from '@kbn/core/public';
-import React, { useMemo } from 'react';
-import ReactDOM from 'react-dom';
-
 import { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
-import { RouteRenderer, RouterProvider } from '@kbn/typed-react-router-config';
-
 import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
+import { RouteRenderer, RouterProvider } from '@kbn/typed-react-router-config';
+import React, { useMemo } from 'react';
+import ReactDOM from 'react-dom';
+import { HeaderMenuPortal } from '@kbn/observability-plugin/public';
+import { CheckSetup } from './components/check_setup';
 import { ProfilingDependenciesContextProvider } from './components/contexts/profiling_dependencies/profiling_dependencies_context';
+import { RouteBreadcrumbsContextProvider } from './components/contexts/route_breadcrumbs_context';
+import { TimeRangeContextProvider } from './components/contexts/time_range_context';
 import { RedirectWithDefaultDateRange } from './components/redirect_with_default_date_range';
 import { profilingRouter } from './routing';
 import { Services } from './services';
 import { ProfilingPluginPublicSetupDeps, ProfilingPluginPublicStartDeps } from './types';
-import { RouteBreadcrumbsContextProvider } from './components/contexts/route_breadcrumbs_context';
-import { TimeRangeContextProvider } from './components/contexts/time_range_context';
+import { ProfilingHeaderActionMenu } from './components/profiling_header_action_menu';
 
 interface Props {
   profilingFetchServices: Services;
@@ -30,10 +31,25 @@ interface Props {
   pluginsSetup: ProfilingPluginPublicSetupDeps;
   theme$: AppMountParameters['theme$'];
   history: AppMountParameters['history'];
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
 }
 
 const storage = new Storage(localStorage);
 
+function MountProfilingActionMenu({
+  theme$,
+  setHeaderActionMenu,
+}: {
+  theme$: AppMountParameters['theme$'];
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
+}) {
+  return (
+    <HeaderMenuPortal setHeaderActionMenu={setHeaderActionMenu} theme$={theme$}>
+      <ProfilingHeaderActionMenu />
+    </HeaderMenuPortal>
+  );
+}
+
 function App({
   coreStart,
   coreSetup,
@@ -42,6 +58,7 @@ function App({
   profilingFetchServices,
   theme$,
   history,
+  setHeaderActionMenu,
 }: Props) {
   const i18nCore = coreStart.i18n;
 
@@ -67,11 +84,17 @@ function App({
             <RouterProvider router={profilingRouter as any} history={history}>
               <TimeRangeContextProvider>
                 <ProfilingDependenciesContextProvider value={profilingDependencies}>
-                  <RedirectWithDefaultDateRange>
-                    <RouteBreadcrumbsContextProvider>
-                      <RouteRenderer />
-                    </RouteBreadcrumbsContextProvider>
-                  </RedirectWithDefaultDateRange>
+                  <CheckSetup>
+                    <RedirectWithDefaultDateRange>
+                      <RouteBreadcrumbsContextProvider>
+                        <RouteRenderer />
+                      </RouteBreadcrumbsContextProvider>
+                    </RedirectWithDefaultDateRange>
+                  </CheckSetup>
+                  <MountProfilingActionMenu
+                    setHeaderActionMenu={setHeaderActionMenu}
+                    theme$={theme$}
+                  />
                 </ProfilingDependenciesContextProvider>
               </TimeRangeContextProvider>
             </RouterProvider>
diff --git a/x-pack/plugins/profiling/public/components/check_setup.tsx b/x-pack/plugins/profiling/public/components/check_setup.tsx
new file mode 100644
index 0000000000000..566ff7382aacf
--- /dev/null
+++ b/x-pack/plugins/profiling/public/components/check_setup.tsx
@@ -0,0 +1,145 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner, EuiText } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { useState } from 'react';
+import { AsyncStatus, useAsync } from '../hooks/use_async';
+import { useAutoAbortedHttpClient } from '../hooks/use_auto_aborted_http_client';
+import { useProfilingDependencies } from './contexts/profiling_dependencies/use_profiling_dependencies';
+import { NoDataPage } from './no_data_page';
+import { ProfilingAppPageTemplate } from './profiling_app_page_template';
+
+export function CheckSetup({ children }: { children: React.ReactElement }) {
+  const {
+    start: { core },
+    services: { fetchHasSetup, postSetupResources },
+  } = useProfilingDependencies();
+
+  const [postSetupLoading, setPostSetupLoading] = useState(false);
+
+  const { status, data, error, refresh } = useAsync(
+    ({ http }) => {
+      return fetchHasSetup({ http });
+    },
+    [fetchHasSetup]
+  );
+
+  const http = useAutoAbortedHttpClient([]);
+
+  const displaySetupScreen =
+    (status === AsyncStatus.Settled && data?.has_setup !== true) || !!error;
+
+  const displayNoDataScreen =
+    status === AsyncStatus.Settled && data?.has_setup === true && data?.has_data === false;
+
+  const displayUi = data?.has_data === true;
+
+  const docsLink = `https://elastic.github.io/universal-profiling-documentation`;
+
+  const displayLoadingScreen = status !== AsyncStatus.Settled;
+
+  if (displayLoadingScreen) {
+    return (
+      <ProfilingAppPageTemplate hideSearchBar tabs={[]}>
+        <EuiFlexGroup alignItems="center" justifyContent="center">
+          <EuiFlexItem grow={false}>
+            <EuiLoadingSpinner size="xxl" />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </ProfilingAppPageTemplate>
+    );
+  }
+
+  if (displayUi) {
+    return children;
+  }
+
+  if (displayNoDataScreen) {
+    return (
+      <NoDataPage
+        subTitle={i18n.translate('xpack.profiling.noDataPage.introduction', {
+          defaultMessage: `You're almost there! Follow the instructions below to add data.`,
+        })}
+      />
+    );
+  }
+
+  if (displaySetupScreen) {
+    return (
+      <ProfilingAppPageTemplate
+        tabs={[]}
+        noDataConfig={{
+          docsLink,
+          logo: 'logoObservability',
+          pageTitle: i18n.translate('xpack.profiling.noDataConfig.pageTitle', {
+            defaultMessage: 'Universal Profiling (now in Beta)',
+          }),
+          action: {
+            elasticAgent: {
+              description: (
+                <EuiText>
+                  {i18n.translate('xpack.profiling.noDataConfig.action.title', {
+                    defaultMessage: `Universal Profiling provides fleet-wide, whole-system, continuous profiling with zero instrumentation.
+              Understand what lines of code are consuming compute resources, at all times, and across your entire infrastructure.`,
+                  })}
+                </EuiText>
+              ),
+              onClick: (event: React.MouseEvent<HTMLElement, MouseEvent>) => {
+                event.preventDefault();
+              },
+              button: (
+                <EuiButton
+                  disabled={postSetupLoading}
+                  onClick={(event) => {
+                    event.preventDefault();
+
+                    setPostSetupLoading(true);
+
+                    postSetupResources({ http })
+                      .then(() => refresh())
+                      .catch((err) => {
+                        const message = err?.body?.message ?? err.message ?? String(err);
+
+                        core.notifications.toasts.addError(err, {
+                          title: i18n.translate(
+                            'xpack.profiling.checkSetup.setupFailureToastTitle',
+                            { defaultMessage: 'Failed to complete setup' }
+                          ),
+                          toastMessage: message,
+                        });
+                      })
+                      .finally(() => {
+                        setPostSetupLoading(false);
+                      });
+                  }}
+                  fill
+                  isLoading={postSetupLoading}
+                >
+                  {!postSetupLoading
+                    ? i18n.translate('xpack.profiling.noDataConfig.action.buttonLabel', {
+                        defaultMessage: 'Setup Universal Profiling',
+                      })
+                    : i18n.translate('xpack.profiling.noDataConfig.action.buttonLoadingLabel', {
+                        defaultMessage: 'Setting up Universal Profiling...',
+                      })}
+                </EuiButton>
+              ),
+            },
+          },
+          solution: i18n.translate('xpack.profiling.noDataConfig.solutionName', {
+            defaultMessage: 'Universal Profiling',
+          }),
+        }}
+        hideSearchBar
+      >
+        <></>
+      </ProfilingAppPageTemplate>
+    );
+  }
+
+  throw new Error('Invalid state');
+}
diff --git a/x-pack/plugins/profiling/public/components/flame_graphs_view/index.tsx b/x-pack/plugins/profiling/public/components/flame_graphs_view/index.tsx
index dab912902ba46..18abf1f3e66ae 100644
--- a/x-pack/plugins/profiling/public/components/flame_graphs_view/index.tsx
+++ b/x-pack/plugins/profiling/public/components/flame_graphs_view/index.tsx
@@ -116,7 +116,7 @@ export function FlameGraphsView({ children }: { children: React.ReactElement })
   }
 
   return (
-    <ProfilingAppPageTemplate tabs={tabs} hideSearchBar={isDifferentialView} fullHeight>
+    <ProfilingAppPageTemplate tabs={tabs} hideSearchBar={isDifferentialView}>
       <EuiFlexGroup direction="column">
         {isDifferentialView ? (
           <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/profiling/public/components/no_data_page.tsx b/x-pack/plugins/profiling/public/components/no_data_page.tsx
new file mode 100644
index 0000000000000..d045b4146dd9c
--- /dev/null
+++ b/x-pack/plugins/profiling/public/components/no_data_page.tsx
@@ -0,0 +1,327 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import {
+  EuiCodeBlock,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiLink,
+  EuiLoadingSpinner,
+  EuiPanel,
+  EuiSpacer,
+  EuiSplitPanel,
+  EuiSteps,
+  EuiTab,
+  EuiTabs,
+  EuiText,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { useState } from 'react';
+import { AsyncStatus, useAsync } from '../hooks/use_async';
+import { useProfilingDependencies } from './contexts/profiling_dependencies/use_profiling_dependencies';
+import { ProfilingAppPageTemplate } from './profiling_app_page_template';
+
+export function NoDataPage({ subTitle }: { subTitle: string }) {
+  const {
+    services: { setupDataCollectionInstructions },
+  } = useProfilingDependencies();
+
+  const { data, status } = useAsync(
+    ({ http }) => {
+      return setupDataCollectionInstructions({ http });
+    },
+    [setupDataCollectionInstructions]
+  );
+
+  const secretToken = data?.variables.secretToken;
+  const collectionAgentHostPort = data?.variables.apmServerUrl.replace('https://', '');
+
+  const tabs = [
+    {
+      key: 'kubernetes',
+      title: i18n.translate('xpack.profiling.tabs.kubernetesTitle', {
+        defaultMessage: 'Kubernetes',
+      }),
+      steps: [
+        {
+          title: i18n.translate('xpack.profiling.tabs.kubernetesRepositoryStep', {
+            defaultMessage: 'Configure the Universal Profiling host-agent Helm repository:',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              helm repo add optimyze https://optimyze.cloud/helm-charts
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.kubernetesInstallStep', {
+            defaultMessage: 'Install host-agent via Helm:',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`helm install --create-namespace -n=universal-profiling universal-profiling-agent \\
+--set "projectID=1,secretToken=${secretToken}" \\
+--set "collectionAgentHostPort=${collectionAgentHostPort}" \\
+--set "image.baseUrl=docker.elastic.co,image.repository=observability,image.name=profiling-agent" \\
+optimyze/pf-host-agent`}
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.kubernetesValidationStep', {
+            defaultMessage: 'Validate the host-agent pods are running:',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              kubectl -n universal-profiling get pods
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.postValidationStep', {
+            defaultMessage:
+              'Use the Helm install output to get host-agent logs and spot potential errors',
+          }),
+          content: <></>,
+        },
+      ],
+    },
+    {
+      key: 'docker',
+      title: i18n.translate('xpack.profiling.tabs.dockerTitle', {
+        defaultMessage: 'Docker',
+      }),
+      steps: [
+        {
+          title: i18n.translate('xpack.profiling.tabs.dockerRunContainerStep', {
+            defaultMessage: 'Run the Universal Profiling container:',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`docker run --name host-agent --privileged --pid=host -v /etc/machine-id:/etc/machine-id:ro \\
+-v /var/run/docker.sock:/var/run/docker.sock -v /sys/kernel/debug:/sys/kernel/debug:ro \\
+docker.elastic.co/observability/profiling-agent:stable /root/pf-host-agent \\
+-project-id=1 -secret-token=${secretToken} \\
+-collection-agent=${collectionAgentHostPort}`}
+            </EuiCodeBlock>
+          ),
+        },
+      ],
+    },
+    {
+      key: 'binary',
+      title: i18n.translate('xpack.profiling.tabs.binaryTitle', {
+        defaultMessage: 'Binary',
+      }),
+      steps: [
+        {
+          title: i18n.translate('xpack.profiling.tabs.binaryDownloadStep', {
+            defaultMessage: 'Download the latest binary:',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              wget -O- https://releases.prodfiler.com/stable/pf-host-agent_linux_amd64.tgz | tar xz
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.binaryGrantPermissionStep', {
+            defaultMessage: 'Grant executable permissions:',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              chmod +x pf-host-agent/pf-host-agent
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.binaryRunHostAgentStep', {
+            defaultMessage: 'Run the Universal Profiling host-agent (requires root privileges):',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`sudo pf-host-agent/pf-host-agent -project-id=1 -secret-token=${secretToken} -collection-agent=${collectionAgentHostPort}`}
+            </EuiCodeBlock>
+          ),
+        },
+      ],
+    },
+    {
+      key: 'deb',
+      title: i18n.translate('xpack.profiling.tabs.debTitle', {
+        defaultMessage: 'DEB Package',
+      }),
+      steps: [
+        {
+          title: i18n.translate('xpack.profiling.tabs.debDownloadPackageStep', {
+            defaultMessage:
+              'Open the URL below and download the right DEB package for your CPU architecture:',
+          }),
+          content: (
+            <EuiLink target="_blank" href={`https://releases.prodfiler.com/stable/index.html`}>
+              https://releases.prodfiler.com/stable/index.html
+            </EuiLink>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.debInstallPackageStep', {
+            defaultMessage: 'Install the DEB package (requires root privileges):',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`sudo dpkg -i pf-host-agent*.deb`}
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.debEditConfigStep', {
+            defaultMessage: 'Edit the configuration (requires root privileges):',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`echo -e "project-id 1\nsecret-token ${secretToken}\ncollection-agent ${collectionAgentHostPort}" | sudo tee -a /etc/prodfiler/prodfiler.conf`}
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.debStartSystemdServiceStep', {
+            defaultMessage:
+              'Start the Universal Profiling systemd service (requires root privileges):',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`sudo systemctl enable pf-host-agent && sudo systemctl restart pf-host-agent`}
+            </EuiCodeBlock>
+          ),
+        },
+      ],
+    },
+    {
+      key: 'rpm',
+      title: i18n.translate('xpack.profiling.tabs.rpmTitle', {
+        defaultMessage: 'RPM Package',
+      }),
+      steps: [
+        {
+          title: i18n.translate('xpack.profiling.tabs.rpmDownloadPackageStep', {
+            defaultMessage:
+              'Open the URL below and download the right RPM package for your CPU architecture:',
+          }),
+          content: (
+            <EuiLink target="_blank" href={`https://releases.prodfiler.com/stable/index.html`}>
+              https://releases.prodfiler.com/stable/index.html
+            </EuiLink>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.rpmInstallPackageStep', {
+            defaultMessage: 'Install the RPM package (requires root privileges):',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`sudo rpm -i pf-host-agent*.rpm`}
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.rpmEditConfigStep', {
+            defaultMessage: 'Edit the configuration (requires root privileges):',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`echo -e "project-id 1\nsecret-token ${secretToken}\ncollection-agent ${collectionAgentHostPort}" | sudo tee -a /etc/prodfiler/prodfiler.conf`}
+            </EuiCodeBlock>
+          ),
+        },
+        {
+          title: i18n.translate('xpack.profiling.tabs.rpmStartSystemdServiceStep', {
+            defaultMessage:
+              'Start the Universal Profiling systemd service (requires root privileges):',
+          }),
+          content: (
+            <EuiCodeBlock paddingSize="s" isCopyable>
+              {`sudo systemctl enable pf-host-agent && sudo systemctl restart pf-host-agent`}
+            </EuiCodeBlock>
+          ),
+        },
+      ],
+    },
+  ];
+
+  const [selectedTab, setSelectedTab] = useState(tabs[0].key);
+
+  const displayedTab = tabs.find((tab) => tab.key === selectedTab)!;
+
+  const displayedSteps = displayedTab.steps ?? [];
+
+  const isLoading = status === AsyncStatus.Loading;
+
+  return (
+    <ProfilingAppPageTemplate
+      tabs={[]}
+      restrictWidth
+      hideSearchBar
+      pageTitle={
+        <EuiFlexGroup direction="row" alignItems="center">
+          <EuiFlexItem grow={false}>
+            <EuiIcon type="logoObservability" size="m" />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            {i18n.translate('xpack.profiling.noDataPage.pageTitle', {
+              defaultMessage: 'Add profiling data',
+            })}
+          </EuiFlexItem>
+          {isLoading ? (
+            <EuiFlexItem>
+              <EuiLoadingSpinner />
+            </EuiFlexItem>
+          ) : null}
+        </EuiFlexGroup>
+      }
+    >
+      {isLoading ? (
+        <></>
+      ) : (
+        <>
+          <EuiText>{subTitle}</EuiText>
+          <EuiSpacer />
+          <EuiSplitPanel.Outer>
+            <EuiPanel hasBorder={false} hasShadow={false} grow={false} paddingSize="none">
+              <EuiSplitPanel.Inner color="subdued" paddingSize="none">
+                <EuiTabs style={{ padding: '0 24px' }}>
+                  {tabs.map((tab) => {
+                    return (
+                      <EuiTab
+                        key={tab.key}
+                        onClick={() => setSelectedTab(tab.key)}
+                        isSelected={tab.key === selectedTab}
+                      >
+                        {tab.title}
+                      </EuiTab>
+                    );
+                  })}
+                </EuiTabs>
+              </EuiSplitPanel.Inner>
+              <EuiSplitPanel.Inner style={{ padding: '0 24px' }}>
+                <EuiSpacer size="xxl" />
+                <EuiSteps
+                  steps={displayedSteps.map((step) => {
+                    return {
+                      title: step.title,
+                      children: step.content,
+                      status: 'incomplete',
+                    };
+                  })}
+                />
+              </EuiSplitPanel.Inner>
+            </EuiPanel>
+          </EuiSplitPanel.Outer>
+        </>
+      )}
+    </ProfilingAppPageTemplate>
+  );
+}
diff --git a/x-pack/plugins/profiling/public/components/profiling_app_page_template/index.tsx b/x-pack/plugins/profiling/public/components/profiling_app_page_template/index.tsx
index 03a04b6a3a8e0..0e635aba6bb5a 100644
--- a/x-pack/plugins/profiling/public/components/profiling_app_page_template/index.tsx
+++ b/x-pack/plugins/profiling/public/components/profiling_app_page_template/index.tsx
@@ -9,6 +9,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiPageHeaderContentProps } from '@elastic/e
 import { i18n } from '@kbn/i18n';
 import React, { useEffect } from 'react';
 import { useHistory } from 'react-router-dom';
+import { NoDataPageProps } from '@kbn/shared-ux-page-no-data-types';
 import { useProfilingDependencies } from '../contexts/profiling_dependencies/use_profiling_dependencies';
 import { PrimaryProfilingSearchBar } from './primary_profiling_search_bar';
 
@@ -16,12 +17,18 @@ export function ProfilingAppPageTemplate({
   children,
   tabs,
   hideSearchBar = false,
-  fullHeight = false,
+  noDataConfig,
+  restrictWidth = false,
+  pageTitle = i18n.translate('xpack.profiling.appPageTemplate.pageTitle', {
+    defaultMessage: 'Universal Profiling',
+  }),
 }: {
   children: React.ReactElement;
   tabs: EuiPageHeaderContentProps['tabs'];
   hideSearchBar?: boolean;
-  fullHeight?: boolean;
+  noDataConfig?: NoDataPageProps;
+  restrictWidth?: boolean;
+  pageTitle?: React.ReactNode;
 }) {
   const {
     start: { observability },
@@ -37,12 +44,12 @@ export function ProfilingAppPageTemplate({
 
   return (
     <ObservabilityPageTemplate
+      noDataConfig={noDataConfig}
       pageHeader={{
-        pageTitle: i18n.translate('xpack.profiling.appPageTemplate.pageTitle', {
-          defaultMessage: 'Universal Profiling',
-        }),
+        pageTitle,
         tabs,
       }}
+      restrictWidth={restrictWidth}
       pageSectionProps={{
         contentProps: {
           style: {
diff --git a/x-pack/plugins/profiling/public/components/profiling_app_page_template/primary_profiling_search_bar.tsx b/x-pack/plugins/profiling/public/components/profiling_app_page_template/primary_profiling_search_bar.tsx
index fb4ee5d780f65..07918241d3261 100644
--- a/x-pack/plugins/profiling/public/components/profiling_app_page_template/primary_profiling_search_bar.tsx
+++ b/x-pack/plugins/profiling/public/components/profiling_app_page_template/primary_profiling_search_bar.tsx
@@ -21,11 +21,13 @@ export function PrimaryProfilingSearchBar({ showSubmitButton }: { showSubmitButt
   const profilingRouter = useProfilingRouter();
   const routePath = useProfilingRoutePath();
 
-  const {
-    path,
-    query,
-    query: { rangeFrom, rangeTo, kuery },
-  } = useProfilingParams('/*');
+  const { path, query } = useProfilingParams('/*');
+
+  if (!('rangeFrom' in query)) {
+    throw new Error('Range query parameters are missing');
+  }
+
+  const { rangeFrom, rangeTo, kuery } = query;
 
   const { refresh } = useTimeRangeContext();
 
diff --git a/x-pack/plugins/profiling/public/components/profiling_header_action_menu.tsx b/x-pack/plugins/profiling/public/components/profiling_header_action_menu.tsx
new file mode 100644
index 0000000000000..86d2ce4b28b1a
--- /dev/null
+++ b/x-pack/plugins/profiling/public/components/profiling_header_action_menu.tsx
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { EuiFlexGroup, EuiFlexItem, EuiHeaderLink, EuiHeaderLinks, EuiIcon } from '@elastic/eui';
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { useProfilingRouter } from '../hooks/use_profiling_router';
+
+export function ProfilingHeaderActionMenu() {
+  const router = useProfilingRouter();
+  return (
+    <EuiHeaderLinks gutterSize="xs">
+      <EuiHeaderLink href={router.link('/add-data-instructions')} color="primary">
+        <EuiFlexGroup direction="row" gutterSize="s" alignItems="center">
+          <EuiFlexItem grow={false}>
+            <EuiIcon type="listAdd" />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            {i18n.translate('xpack.profiling.headerActionMenu.addData', {
+              defaultMessage: 'Add data',
+            })}
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiHeaderLink>
+    </EuiHeaderLinks>
+  );
+}
diff --git a/x-pack/plugins/profiling/public/hooks/use_async.ts b/x-pack/plugins/profiling/public/hooks/use_async.ts
index 7156b4e8bfffd..585e2882e493d 100644
--- a/x-pack/plugins/profiling/public/hooks/use_async.ts
+++ b/x-pack/plugins/profiling/public/hooks/use_async.ts
@@ -4,11 +4,9 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { HttpFetchOptions, HttpHandler, HttpStart } from '@kbn/core-http-browser';
 import { AbortError } from '@kbn/kibana-utils-plugin/common';
-import { useEffect, useRef, useState } from 'react';
-import { Overwrite, ValuesType } from 'utility-types';
-import { useProfilingDependencies } from '../components/contexts/profiling_dependencies/use_profiling_dependencies';
+import { useCallback, useEffect, useState } from 'react';
+import { AutoAbortedHttpService, useAutoAbortedHttpClient } from './use_auto_aborted_http_client';
 
 export enum AsyncStatus {
   Loading = 'loading',
@@ -20,69 +18,39 @@ export interface AsyncState<T> {
   data?: T;
   error?: Error;
   status: AsyncStatus;
+  refresh: () => void;
 }
 
-const HTTP_METHODS = ['fetch', 'get', 'post', 'put', 'delete', 'patch'] as const;
-
-type HttpMethod = ValuesType<typeof HTTP_METHODS>;
-
-type AutoAbortedHttpMethod = (
-  path: string,
-  options: Omit<HttpFetchOptions, 'signal'>
-) => ReturnType<HttpHandler>;
-
-export type AutoAbortedHttpService = Overwrite<
-  HttpStart,
-  Record<HttpMethod, AutoAbortedHttpMethod>
->;
-
 export type UseAsync = <T>(
   fn: ({ http }: { http: AutoAbortedHttpService }) => Promise<T> | undefined,
   dependencies: any[]
 ) => AsyncState<T>;
 
 export const useAsync: UseAsync = (fn, dependencies) => {
-  const {
-    start: {
-      core: { http },
-    },
-  } = useProfilingDependencies();
+  const [refreshId, setRefreshId] = useState(0);
+
+  const refresh = useCallback(() => {
+    setRefreshId((id) => id + 1);
+  }, []);
+
   const [asyncState, setAsyncState] = useState<AsyncState<any>>({
     status: AsyncStatus.Init,
+    refresh,
   });
 
   const { data, error } = asyncState;
 
-  const controllerRef = useRef(new AbortController());
+  const httpClient = useAutoAbortedHttpClient(dependencies);
 
   useEffect(() => {
-    controllerRef.current.abort();
-
-    controllerRef.current = new AbortController();
-
-    const autoAbortedMethods = {} as Record<HttpMethod, AutoAbortedHttpMethod>;
-
-    for (const key of HTTP_METHODS) {
-      autoAbortedMethods[key] = (path, options) => {
-        return http[key](path, { ...options, signal: controllerRef.current.signal }).catch(
-          (err) => {
-            if (err.name === 'AbortError') {
-              // return never-resolving promise
-              return new Promise(() => {});
-            }
-            throw err;
-          }
-        );
-      };
-    }
-
-    const returnValue = fn({ http: { ...http, ...autoAbortedMethods } });
+    const returnValue = fn({ http: httpClient });
 
     if (returnValue === undefined) {
       setAsyncState({
         status: AsyncStatus.Init,
         data: undefined,
         error: undefined,
+        refresh,
       });
       return;
     }
@@ -91,12 +59,14 @@ export const useAsync: UseAsync = (fn, dependencies) => {
       status: AsyncStatus.Loading,
       data,
       error,
+      refresh,
     });
 
     returnValue.then((nextData) => {
       setAsyncState({
         status: AsyncStatus.Settled,
         data: nextData,
+        refresh,
       });
     });
 
@@ -107,17 +77,12 @@ export const useAsync: UseAsync = (fn, dependencies) => {
       setAsyncState({
         status: AsyncStatus.Settled,
         error: nextError,
+        refresh,
       });
       throw nextError;
     });
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [http, ...dependencies]);
-
-  useEffect(() => {
-    return () => {
-      controllerRef.current.abort();
-    };
-  }, []);
+  }, [httpClient, refreshId, ...dependencies]);
 
   return asyncState;
 };
diff --git a/x-pack/plugins/profiling/public/hooks/use_auto_aborted_http_client.ts b/x-pack/plugins/profiling/public/hooks/use_auto_aborted_http_client.ts
new file mode 100644
index 0000000000000..f88ca2f0f0b8b
--- /dev/null
+++ b/x-pack/plugins/profiling/public/hooks/use_auto_aborted_http_client.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useEffect, useMemo, useRef } from 'react';
+import { Overwrite, ValuesType } from 'utility-types';
+import { HttpFetchOptions, HttpHandler, HttpStart } from '@kbn/core/public';
+import { useProfilingDependencies } from '../components/contexts/profiling_dependencies/use_profiling_dependencies';
+
+const HTTP_METHODS = ['fetch', 'get', 'post', 'put', 'delete', 'patch'] as const;
+
+type HttpMethod = ValuesType<typeof HTTP_METHODS>;
+
+type AutoAbortedHttpMethod = (
+  path: string,
+  options: Omit<HttpFetchOptions, 'signal'>
+) => ReturnType<HttpHandler>;
+
+export type AutoAbortedHttpService = Overwrite<
+  HttpStart,
+  Record<HttpMethod, AutoAbortedHttpMethod>
+>;
+
+export function useAutoAbortedHttpClient(dependencies: any[]): AutoAbortedHttpService {
+  const controller = useRef(new AbortController());
+
+  const {
+    start: {
+      core: { http },
+    },
+  } = useProfilingDependencies();
+
+  const httpClient = useMemo(() => {
+    controller.current.abort();
+
+    controller.current = new AbortController();
+
+    const autoAbortedMethods = {} as Record<HttpMethod, AutoAbortedHttpMethod>;
+
+    for (const key of HTTP_METHODS) {
+      autoAbortedMethods[key] = (path, options) => {
+        return http[key](path, { ...options, signal: controller.current.signal }).catch((err) => {
+          if (err.name === 'AbortError') {
+            // return never-resolving promise
+            return new Promise(() => {});
+          }
+          throw err;
+        });
+      };
+    }
+
+    return {
+      ...http,
+      ...autoAbortedMethods,
+    };
+
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [http, ...dependencies]);
+
+  useEffect(() => {
+    return () => {
+      controller.current.abort();
+    };
+  }, []);
+
+  return httpClient;
+}
diff --git a/x-pack/plugins/profiling/public/plugin.tsx b/x-pack/plugins/profiling/public/plugin.tsx
index ead023a079e29..4875af624fb9b 100644
--- a/x-pack/plugins/profiling/public/plugin.tsx
+++ b/x-pack/plugins/profiling/public/plugin.tsx
@@ -53,10 +53,10 @@ export class ProfilingPlugin implements Plugin {
       map(([_, kuery]) => {
         const sections: NavigationSection[] = [
           {
-            // TODO: add beta badge to section label, needs support in Observability plugin
             label: i18n.translate('xpack.profiling.navigation.sectionLabel', {
               defaultMessage: 'Universal Profiling',
             }),
+            isBetaFeature: true,
             entries: links.map((link) => {
               return {
                 app: 'profiling',
@@ -83,7 +83,7 @@ export class ProfilingPlugin implements Plugin {
       appRoute: '/app/profiling',
       category: DEFAULT_APP_CATEGORIES.observability,
       deepLinks: links,
-      async mount({ element, history, theme$ }: AppMountParameters) {
+      async mount({ element, history, theme$, setHeaderActionMenu }: AppMountParameters) {
         const [coreStart, pluginsStart] = (await coreSetup.getStartServices()) as [
           CoreStart,
           ProfilingPluginPublicStartDeps,
@@ -111,6 +111,7 @@ export class ProfilingPlugin implements Plugin {
             pluginsSetup,
             history,
             theme$,
+            setHeaderActionMenu,
           },
           element
         );
diff --git a/x-pack/plugins/profiling/public/routing/index.tsx b/x-pack/plugins/profiling/public/routing/index.tsx
index d7b79abc0a9a7..1ca3a597e4782 100644
--- a/x-pack/plugins/profiling/public/routing/index.tsx
+++ b/x-pack/plugins/profiling/public/routing/index.tsx
@@ -17,6 +17,7 @@ import { FunctionsView } from '../components/functions_view';
 import { RedirectTo } from '../components/redirect_to';
 import { RouteBreadcrumb } from '../components/route_breadcrumb';
 import { StackTracesView } from '../components/stack_traces_view';
+import { NoDataPage } from '../components/no_data_page';
 
 const routes = {
   '/': {
@@ -31,6 +32,15 @@ const routes = {
       </RouteBreadcrumb>
     ),
     children: {
+      '/add-data-instructions': {
+        element: (
+          <NoDataPage
+            subTitle={i18n.translate('xpack.profiling.addDataTitle', {
+              defaultMessage: 'Select an option below to deploy the host-agent.',
+            })}
+          />
+        ),
+      },
       '/': {
         children: {
           '/stacktraces/{topNType}': {
diff --git a/x-pack/plugins/profiling/public/services.ts b/x-pack/plugins/profiling/public/services.ts
index 4dcad550d0bbb..edd8922ddd3b0 100644
--- a/x-pack/plugins/profiling/public/services.ts
+++ b/x-pack/plugins/profiling/public/services.ts
@@ -9,7 +9,8 @@ import { getRoutePaths } from '../common';
 import { BaseFlameGraph, createFlameGraph, ElasticFlameGraph } from '../common/flamegraph';
 import { TopNFunctions } from '../common/functions';
 import { TopNResponse } from '../common/topn';
-import { AutoAbortedHttpService } from './hooks/use_async';
+import type { SetupDataCollectionInstructions } from '../server/lib/setup/get_setup_instructions';
+import { AutoAbortedHttpService } from './hooks/use_auto_aborted_http_client';
 
 export interface Services {
   fetchTopN: (params: {
@@ -33,6 +34,13 @@ export interface Services {
     timeTo: number;
     kuery: string;
   }) => Promise<ElasticFlameGraph>;
+  fetchHasSetup: (params: {
+    http: AutoAbortedHttpService;
+  }) => Promise<{ has_setup: boolean; has_data: boolean }>;
+  postSetupResources: (params: { http: AutoAbortedHttpService }) => Promise<void>;
+  setupDataCollectionInstructions: (params: {
+    http: AutoAbortedHttpService;
+  }) => Promise<SetupDataCollectionInstructions>;
 }
 
 export function getServices(): Services {
@@ -40,45 +48,50 @@ export function getServices(): Services {
 
   return {
     fetchTopN: async ({ http, type, timeFrom, timeTo, kuery }) => {
-      try {
-        const query: HttpFetchQuery = {
-          timeFrom,
-          timeTo,
-          kuery,
-        };
-        return await http.get(`${paths.TopN}/${type}`, { query });
-      } catch (e) {
-        return e;
-      }
+      const query: HttpFetchQuery = {
+        timeFrom,
+        timeTo,
+        kuery,
+      };
+      return (await http.get(`${paths.TopN}/${type}`, { query })) as Promise<TopNResponse>;
     },
 
     fetchTopNFunctions: async ({ http, timeFrom, timeTo, startIndex, endIndex, kuery }) => {
-      try {
-        const query: HttpFetchQuery = {
-          timeFrom,
-          timeTo,
-          startIndex,
-          endIndex,
-          kuery,
-        };
-        return await http.get(paths.TopNFunctions, { query });
-      } catch (e) {
-        return e;
-      }
+      const query: HttpFetchQuery = {
+        timeFrom,
+        timeTo,
+        startIndex,
+        endIndex,
+        kuery,
+      };
+      return (await http.get(paths.TopNFunctions, { query })) as Promise<TopNFunctions>;
     },
 
     fetchElasticFlamechart: async ({ http, timeFrom, timeTo, kuery }) => {
-      try {
-        const query: HttpFetchQuery = {
-          timeFrom,
-          timeTo,
-          kuery,
-        };
-        const baseFlamegraph = (await http.get(paths.Flamechart, { query })) as BaseFlameGraph;
-        return createFlameGraph(baseFlamegraph);
-      } catch (e) {
-        return e;
-      }
+      const query: HttpFetchQuery = {
+        timeFrom,
+        timeTo,
+        kuery,
+      };
+      const baseFlamegraph = (await http.get(paths.Flamechart, { query })) as BaseFlameGraph;
+      return createFlameGraph(baseFlamegraph);
+    },
+    fetchHasSetup: async ({ http }) => {
+      const hasSetup = (await http.get(paths.HasSetupESResources, {})) as {
+        has_setup: boolean;
+        has_data: boolean;
+      };
+      return hasSetup;
+    },
+    postSetupResources: async ({ http }) => {
+      await http.post(paths.HasSetupESResources, {});
+    },
+    setupDataCollectionInstructions: async ({ http }) => {
+      const instructions = (await http.get(
+        paths.SetupDataCollectionInstructions,
+        {}
+      )) as SetupDataCollectionInstructions;
+      return instructions;
     },
   };
 }
diff --git a/x-pack/plugins/profiling/server/lib/setup/get_setup_instructions.ts b/x-pack/plugins/profiling/server/lib/setup/get_setup_instructions.ts
new file mode 100644
index 0000000000000..8a9540e1fd583
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/get_setup_instructions.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SavedObjectsClientContract } from '@kbn/core/server';
+import { PackagePolicyClient } from '@kbn/fleet-plugin/server';
+import { getApmPolicy } from './steps/get_apm_policy';
+
+export interface SetupDataCollectionInstructions {
+  variables: {
+    apmServerUrl: string;
+    secretToken: string;
+  };
+}
+
+export async function getSetupInstructions({
+  packagePolicyClient,
+  soClient,
+}: {
+  packagePolicyClient: PackagePolicyClient;
+  soClient: SavedObjectsClientContract;
+}): Promise<SetupDataCollectionInstructions> {
+  const apmPolicy = await getApmPolicy({ packagePolicyClient, soClient });
+
+  if (!apmPolicy) {
+    throw new Error('Could not find APM policy');
+  }
+
+  const apmServerVars = apmPolicy.inputs[0].vars;
+
+  return {
+    variables: {
+      apmServerUrl: apmServerVars!.url.value!,
+      secretToken: apmServerVars!.secret_token.value!,
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/has_profiling_data.ts b/x-pack/plugins/profiling/server/lib/setup/has_profiling_data.ts
new file mode 100644
index 0000000000000..d4478ee6c70ed
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/has_profiling_data.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ProfilingESClient } from '../../utils/create_profiling_es_client';
+
+export async function hasProfilingData({
+  client,
+}: {
+  client: ProfilingESClient;
+}): Promise<boolean> {
+  const hasProfilingDataResponse = await client.search('has_any_profiling_data', {
+    index: 'profiling*',
+    size: 0,
+    track_total_hits: 1,
+    terminate_after: 1,
+  });
+
+  return hasProfilingDataResponse.hits.total.value > 0;
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/mappings/README.md b/x-pack/plugins/profiling/server/lib/setup/mappings/README.md
new file mode 100644
index 0000000000000..cf72b0ec7c650
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/mappings/README.md
@@ -0,0 +1,53 @@
+## Universal Profiling mappings
+
+### Server routes
+
+* Check if ES setup is done
+
+      curl -H "content-type: application/json" -u <user:pass> \
+        -XGET "http://localhost:5601/api/profiling/v1/setup/es_resources"
+
+* Apply the ES setup (mappings + Fleet policy)
+
+      curl -H "content-type: application/json" -u <user:pass> -H "kbn-xsrf: reporting" \
+        -XPOST "http://localhost:5601/api/profiling/v1/setup/es_resources"
+
+* check data has been ingested
+
+      curl -H "content-type: application/json" -u <user:pass> \
+         -XGET "http://localhost:5601/api/profiling/v1/setup/has_data"
+    
+
+### Testing in Cloud
+
+Be sure to have configured `EC_API_KEY` env var with an API key for Cloud (ESS).
+
+Build and push a Kibana image with the latest changes.
+Choose a unique identifier for the build, then:
+
+```
+node scripts/build --docker-images --skip-docker-ubi --skip-docker-ubuntu
+docker tag docker.elastic.co/kibana-ci/kibana-cloud:8.7.0-SNAPSHOT docker.elastic.co/observability-ci/kibana:<UNIQUE_IDENTIFIER>
+docker push docker.elastic.co/observability-ci/kibana:<UNIQUE_IDENTIFIER>
+```
+
+Then, within `apm-server` repo:
+
+```
+cd testing/cloud
+make
+vim docker_image.auto.tfvars
+```
+
+Replace the `"kibana"` key in `docker_image_tag_override=` map with your unique identifier tag from previous step.
+Now you can run:
+
+```
+terraform init
+terraform apply -var-file docker_image.auto.tfvars
+```
+
+and once completed, you'll see the output with information on how to access the deployment.
+
+When changing code in Kibana, you don't need to tear down the Terraform deployment, simply update the `docker_image.auto.tfvars`
+with the new tag and run `terraform apply ...` as above: this will update Kibana.
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/catch_resource_already_exists_exception.ts b/x-pack/plugins/profiling/server/lib/setup/steps/catch_resource_already_exists_exception.ts
new file mode 100644
index 0000000000000..eaea6c2708342
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/catch_resource_already_exists_exception.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isResponseError } from '@kbn/es-errors';
+
+export function catchResourceAlreadyExistsException(error: any) {
+  if (isResponseError(error) && error.body?.error?.type === 'resource_already_exists_exception') {
+    return Promise.resolve();
+  }
+
+  return Promise.reject(error);
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_events.json b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_events.json
new file mode 100644
index 0000000000000..d1df1d206b60f
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_events.json
@@ -0,0 +1,76 @@
+{
+  "settings": {
+    "index": {
+      "number_of_shards": "4",
+      "max_result_window": 150000,
+      "refresh_interval": "10s",
+      "sort": {
+        "field": [
+          "service.name",
+          "@timestamp",
+          "orchestrator.resource.name",
+          "container.name",
+          "process.thread.name",
+          "host.id"
+        ]
+      }
+    },
+    "codec": "best_compression"
+  },
+  "mappings": {
+    "_source": {
+      "enabled": false
+    },
+    "properties": {
+      "ecs.version": {
+        "type": "keyword",
+        "index": true
+      },
+      "service.name": {
+        "type": "keyword"
+      },
+      "@timestamp": {
+        "type": "date",
+        "format": "epoch_second"
+      },
+      "host.id": {
+        "type": "keyword"
+      },
+      "Stacktrace.id": {
+        "type": "keyword",
+        "index": false
+      },
+      "orchestrator.resource.name": {
+        "type": "keyword"
+      },
+      "container.name": {
+        "type": "keyword"
+      },
+      "process.thread.name": {
+        "type": "keyword"
+      },
+      "Stacktrace.count": {
+        "type": "short",
+        "index": false
+      },
+      "agent.version": {
+        "type": "keyword"
+      },
+      "host.ip": {
+        "type": "ip"
+      },
+      "host.ipstring": {
+        "type": "keyword"
+      },
+      "host.name": {
+        "type": "keyword"
+      },
+      "os.kernel": {
+        "type": "keyword"
+      },
+      "tags": {
+        "type": "keyword"
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_executables.json b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_executables.json
new file mode 100644
index 0000000000000..f80cf8a92a26f
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_executables.json
@@ -0,0 +1,35 @@
+{
+  "settings": {
+    "index": {
+      "refresh_interval": "10s"
+    }
+  },
+  "mappings": {
+    "_source": {
+      "mode": "synthetic"
+    },
+    "properties": {
+      "ecs.version": {
+        "type": "keyword",
+        "index": true
+      },
+      "Executable.build.id": {
+        "type": "keyword",
+        "index": true
+      },
+      "Executable.file.name": {
+        "type": "keyword",
+        "index": true
+      },
+      "@timestamp": {
+        "type": "date",
+        "format": "epoch_second"
+      },
+      "Symbolization.lastprocessed": {
+        "type": "date",
+        "format": "epoch_second",
+        "index": false
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_ilm.json b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_ilm.json
new file mode 100644
index 0000000000000..36741bc9310a0
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_ilm.json
@@ -0,0 +1,9 @@
+{
+  "settings": {
+    "index": {
+      "lifecycle": {
+        "name": "profiling"
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_stackframes.json b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_stackframes.json
new file mode 100644
index 0000000000000..67fcf4a80820a
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_stackframes.json
@@ -0,0 +1,43 @@
+{
+  "settings": {
+    "index": {
+      "number_of_shards": 16,
+      "refresh_interval": "10s"
+    }
+  },
+  "mappings": {
+    "_source": {
+      "enabled": true
+    },
+    "properties": {
+      "ecs.version": {
+        "type": "keyword",
+        "index": true,
+        "doc_values": false,
+        "store": false
+      },
+      "Stackframe.line.number": {
+        "type": "integer",
+        "index": false,
+        "doc_values": false,
+        "store": false
+      },
+      "Stackframe.file.name": {
+        "type": "keyword",
+        "index": false,
+        "doc_values": false,
+        "store": false
+      },
+      "Stackframe.function.name": {
+        "type": "keyword",
+        "index": false
+      },
+      "Stackframe.function.offset": {
+        "type": "integer",
+        "index": false,
+        "doc_values": false,
+        "store": false
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_stacktraces.json b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_stacktraces.json
new file mode 100644
index 0000000000000..a72db59a9cf6c
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/component_template_profiling_stacktraces.json
@@ -0,0 +1,27 @@
+{
+  "settings": {
+    "index": {
+      "number_of_shards": 16,
+      "refresh_interval": "10s"
+    }
+  },
+  "mappings": {
+    "_source": {
+      "mode": "synthetic"
+    },
+    "properties": {
+      "ecs.version": {
+        "type": "keyword",
+        "index": true
+      },
+      "Stacktrace.frame.ids": {
+        "type": "keyword",
+        "index": false
+      },
+      "Stacktrace.frame.types": {
+        "type": "keyword",
+        "index": false
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_apm_package_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_apm_package_step.ts
new file mode 100644
index 0000000000000..ad31b85baef19
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_apm_package_step.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { installPackage, getInstallation } from '@kbn/fleet-plugin/server/services/epm/packages';
+import {
+  fetchFindLatestPackageOrThrow,
+  pkgToPkgKey,
+} from '@kbn/fleet-plugin/server/services/epm/registry';
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+
+export function getApmPackageStep({
+  client,
+  soClient,
+  spaceId,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  const esClient = client.getEsClient();
+  return {
+    name: 'apm_package',
+    hasCompleted: async () => {
+      const installation = await getInstallation({
+        pkgName: 'apm',
+        savedObjectsClient: soClient,
+      });
+
+      return !!installation;
+    },
+    init: async () => {
+      const { name, version } = await fetchFindLatestPackageOrThrow('apm');
+
+      await installPackage({
+        installSource: 'registry',
+        esClient,
+        savedObjectsClient: soClient,
+        pkgkey: pkgToPkgKey({ name, version }),
+        spaceId,
+        force: true,
+      });
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_apm_policy.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_apm_policy.ts
new file mode 100644
index 0000000000000..ee7a5913e1a57
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_apm_policy.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SavedObjectsClientContract } from '@kbn/core/server';
+import { PackagePolicyClient } from '@kbn/fleet-plugin/server';
+
+export const ELASTIC_CLOUD_APM_POLICY = 'elastic-cloud-apm';
+
+export async function getApmPolicy({
+  packagePolicyClient,
+  soClient,
+}: {
+  packagePolicyClient: PackagePolicyClient;
+  soClient: SavedObjectsClientContract;
+}) {
+  return await packagePolicyClient.get(soClient, ELASTIC_CLOUD_APM_POLICY);
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_cluster_settings_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_cluster_settings_step.ts
new file mode 100644
index 0000000000000..b281745552eb2
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_cluster_settings_step.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+
+const MAX_BUCKETS = 150000;
+
+export function getClusterSettingsStep({
+  client,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  return {
+    name: 'cluster_settings',
+    hasCompleted: async () => {
+      const settings = await client.getEsClient().cluster.getSettings({});
+
+      return settings.persistent.search?.max_buckets === MAX_BUCKETS.toString();
+    },
+    init: async () => {
+      await client.getEsClient().cluster.putSettings({
+        persistent: {
+          search: {
+            max_buckets: MAX_BUCKETS,
+          },
+        },
+      });
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_component_templates_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_component_templates_step.ts
new file mode 100644
index 0000000000000..3a37e3e3970d2
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_component_templates_step.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { IndicesIndexState } from '@elastic/elasticsearch/lib/api/types';
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+import componentTemplateProfilingIlm from './component_template_profiling_ilm.json';
+import componentTemplateProfilingEvents from './component_template_profiling_events.json';
+import componentTemplateProfilingExecutables from './component_template_profiling_executables.json';
+import componentTemplateProfilingStackframes from './component_template_profiling_stackframes.json';
+import componentTemplateProfilingStacktraces from './component_template_profiling_stacktraces.json';
+
+export enum ProfilingComponentTemplateName {
+  Ilm = 'profiling-ilm',
+  Events = 'profiling-events',
+  Executables = 'profiling-executables',
+  Stackframes = 'profiling-stackframes',
+  Stacktraces = 'profiling-stacktraces',
+}
+
+export function getComponentTemplatesStep({
+  client,
+  logger,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  const esClient = client.getEsClient();
+
+  return {
+    name: 'component_templates',
+    hasCompleted: async () => {
+      return Promise.all(
+        [
+          ProfilingComponentTemplateName.Ilm,
+          ProfilingComponentTemplateName.Events,
+          ProfilingComponentTemplateName.Executables,
+          ProfilingComponentTemplateName.Stackframes,
+          ProfilingComponentTemplateName.Stacktraces,
+        ].map((componentTemplateName) =>
+          esClient.cluster.getComponentTemplate({
+            name: componentTemplateName,
+          })
+        )
+      ).then(
+        () => Promise.resolve(true),
+        (error) => {
+          logger.debug('Some component templates could not be fetched');
+          logger.debug(error);
+          return Promise.resolve(false);
+        }
+      );
+    },
+    init: async () => {
+      await Promise.all([
+        esClient.cluster.putComponentTemplate({
+          name: ProfilingComponentTemplateName.Ilm,
+          create: false,
+          template: componentTemplateProfilingIlm,
+        }),
+        esClient.cluster.putComponentTemplate({
+          name: ProfilingComponentTemplateName.Events,
+          create: false,
+          template: componentTemplateProfilingEvents as IndicesIndexState,
+          _meta: {
+            description: 'Mappings for profiling events data stream',
+          },
+        }),
+        esClient.cluster.putComponentTemplate({
+          name: ProfilingComponentTemplateName.Executables,
+          create: false,
+          template: componentTemplateProfilingExecutables as IndicesIndexState,
+        }),
+        esClient.cluster.putComponentTemplate({
+          name: ProfilingComponentTemplateName.Stackframes,
+          create: false,
+          template: componentTemplateProfilingStackframes as IndicesIndexState,
+        }),
+        esClient.cluster.putComponentTemplate({
+          name: ProfilingComponentTemplateName.Stacktraces,
+          create: false,
+          template: componentTemplateProfilingStacktraces as IndicesIndexState,
+        }),
+      ]);
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_create_events_data_streams.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_create_events_data_streams.ts
new file mode 100644
index 0000000000000..16cdee47f000d
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_create_events_data_streams.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+import { catchResourceAlreadyExistsException } from './catch_resource_already_exists_exception';
+
+function getEventDataStreamNames() {
+  const subSampledIndicesIdx = Array.from(Array(11).keys(), (item: number) => item + 1);
+  const subSampledIndexName = (pow: number): string => {
+    return `profiling-events-5pow${String(pow).padStart(2, '0')}`;
+  };
+  // Generate all the possible index template names
+  const eventsIndices = ['profiling-events-all'].concat(
+    subSampledIndicesIdx.map((pow) => subSampledIndexName(pow))
+  );
+
+  return eventsIndices;
+}
+
+export function getCreateEventsDataStreamsStep({
+  client,
+  logger,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  const esClient = client.getEsClient();
+
+  const dataStreamNames = getEventDataStreamNames();
+
+  return {
+    name: 'create_events_data_streams',
+    hasCompleted: async () => {
+      const dataStreams = await esClient.indices.getDataStream({
+        name: 'profiling-events*',
+      });
+
+      const allDataStreams = dataStreams.data_streams.map((dataStream) => dataStream.name);
+
+      const missingDataStreams = dataStreamNames.filter(
+        (eventIndex) => !allDataStreams.includes(eventIndex)
+      );
+
+      if (missingDataStreams.length > 0) {
+        logger.debug(`Missing event indices: ${missingDataStreams.join(', ')}`);
+      }
+
+      return missingDataStreams.length === 0;
+    },
+    init: async () => {
+      await Promise.all(
+        dataStreamNames.map((dataStreamName) =>
+          esClient.indices
+            .createDataStream({
+              name: dataStreamName,
+            })
+            .catch(catchResourceAlreadyExistsException)
+        )
+      );
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_create_indices_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_create_indices_step.ts
new file mode 100644
index 0000000000000..6bfca0fbe3a51
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_create_indices_step.ts
@@ -0,0 +1,321 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { MappingSourceField } from '@elastic/elasticsearch/lib/api/types';
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+import { catchResourceAlreadyExistsException } from './catch_resource_already_exists_exception';
+
+const SQ_EXECUTABLES_INDEX = 'profiling-sq-executables';
+const LEAFFRAMES_INDEX = 'profiling-sq-leafframes';
+const SYMBOLS_INDEX = 'profiling-symbols';
+const ILM_LOCK_INDEX = '.profiling-ilm-lock';
+
+const getKeyValueIndices = () => {
+  const kvIndices = ['profiling-stacktraces', 'profiling-stackframes', 'profiling-executables'];
+
+  const pairs: Array<{ index: string; alias: string }> = kvIndices.flatMap((index) => {
+    return [
+      { index: `${index}-000001`, alias: index },
+      { index: `${index}-000002`, alias: `${index}-next` },
+    ];
+  });
+
+  return pairs;
+};
+
+export function getCreateIndicesStep({
+  client,
+  logger,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  const esClient = client.getEsClient();
+  const keyValueIndices = getKeyValueIndices();
+
+  return {
+    name: 'create_indices',
+    hasCompleted: async () => {
+      const nonKvIndices = [SQ_EXECUTABLES_INDEX, LEAFFRAMES_INDEX, SYMBOLS_INDEX, ILM_LOCK_INDEX];
+
+      const results = await Promise.all([
+        esClient.cat
+          .indices({
+            index: keyValueIndices
+              .map(({ index }) => index)
+              .concat(nonKvIndices)
+              .map((index) => index + '*')
+              .join(','),
+            format: 'json',
+          })
+          .then((response) => {
+            const allIndices = response.map((index) => index.index!);
+
+            const missingIndices = keyValueIndices
+              .map(({ index }) => index)
+              .concat(nonKvIndices)
+              .filter((index) => !allIndices.includes(index));
+
+            if (missingIndices.length) {
+              logger.debug(`Missing indices: ${missingIndices.join(',')}`);
+            }
+
+            return missingIndices.length === 0;
+          })
+          .catch((error) => {
+            logger.debug(`Failed fetching indices: ${error}`);
+            return Promise.resolve(false);
+          }),
+        esClient.cat
+          .aliases({
+            name: keyValueIndices.map(({ alias }) => alias + '*').join(','),
+            format: 'json',
+          })
+          .then((response) => {
+            const allAliases = response.map((index) => index.alias!);
+
+            const missingAliases = keyValueIndices
+              .map(({ alias }) => alias)
+              .filter((alias) => !allAliases.includes(alias));
+
+            if (missingAliases.length) {
+              logger.debug(`Missing aliases: ${missingAliases.join(',')}`);
+            }
+
+            return missingAliases.length === 0;
+          })
+          .catch((error) => {
+            logger.debug(`Failed fetching aliases: ${error}`);
+            return Promise.resolve(false);
+          }),
+      ]);
+
+      return results.every(Boolean);
+    },
+    init: async () => {
+      await Promise.all([
+        ...keyValueIndices.map(({ index, alias }) => {
+          return esClient.indices
+            .create({
+              index,
+              aliases: {
+                [alias]: {
+                  is_write_index: true,
+                },
+              },
+            })
+            .catch(catchResourceAlreadyExistsException);
+        }),
+        esClient.indices
+          .create({
+            index: SQ_EXECUTABLES_INDEX,
+            settings: {
+              index: {
+                refresh_interval: '10s',
+              },
+            },
+            mappings: {
+              _source: {
+                mode: 'synthetic',
+              } as MappingSourceField,
+              properties: {
+                'ecs.version': {
+                  type: 'keyword',
+                  index: true,
+                },
+                'Executable.file.id': {
+                  type: 'keyword',
+                  index: false,
+                },
+                'Time.created': {
+                  type: 'date',
+                  index: true,
+                },
+                'Symbolization.time.next': {
+                  type: 'date',
+                  index: true,
+                },
+                'Symbolization.retries': {
+                  type: 'short',
+                  index: true,
+                },
+              },
+            },
+          })
+          .catch(catchResourceAlreadyExistsException),
+        esClient.indices
+          .create({
+            index: LEAFFRAMES_INDEX,
+            settings: {
+              index: {
+                refresh_interval: '10s',
+              },
+            },
+            mappings: {
+              _source: {
+                mode: 'synthetic',
+              } as MappingSourceField,
+              properties: {
+                'ecs.version': {
+                  type: 'keyword',
+                  index: true,
+                },
+                'Stacktrace.frame.id': {
+                  type: 'keyword',
+                  index: false,
+                },
+                'Time.created': {
+                  type: 'date',
+                  index: true,
+                },
+                'Symbolization.time.next': {
+                  type: 'date',
+                  index: true,
+                },
+                'Symbolization.retries': {
+                  type: 'short',
+                  index: true,
+                },
+              },
+            },
+          })
+          .catch(catchResourceAlreadyExistsException),
+        esClient.indices
+          .create({
+            index: SYMBOLS_INDEX,
+            settings: {
+              index: {
+                number_of_shards: '16',
+                refresh_interval: '10s',
+              },
+            },
+            mappings: {
+              _source: {
+                enabled: true,
+              } as MappingSourceField,
+              properties: {
+                'ecs.version': {
+                  type: 'keyword',
+                  index: true,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.function.name': {
+                  // name of the function
+                  type: 'keyword',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.file.name': {
+                  // file path
+                  type: 'keyword',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.call.file.name': {
+                  // (for inlined functions) file path where inline function was called
+                  type: 'keyword',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.call.line': {
+                  // (for inlined functions) line where inline function was called
+                  type: 'integer',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.function.line': {
+                  // function start line (only available from DWARF). Currently unused.
+                  type: 'integer',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.depth': {
+                  // inline depth
+                  type: 'integer',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                // pairs of (32bit PC offset, 32bit line number) followed by 64bit PC range base at the end.
+                // To find line number for a given PC: find lowest offset such as offsetBase+PC >= offset, then read corresponding line number.
+                // offsetBase could seemingly be available from exec_pc_range (it's the first value of the pair), but it's not the case.
+                // Ranges are stored as points, which cannot be retrieve when disabling _source.
+                // See https://www.elastic.co/guide/en/elasticsearch/reference/current/point.html .
+                'Symbol.linetable.base': {
+                  // Linetable: base for offsets (64bit PC range base)
+                  type: 'unsigned_long',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.linetable.length': {
+                  // Linetable: length of range (PC range is [base, base+length))
+                  type: 'unsigned_long',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.linetable.offsets': {
+                  // Linetable: concatenated offsets (each value is ULEB128encoded)
+                  type: 'keyword',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.linetable.lines': {
+                  // Linetable: concatenated lines (each value is ULEB128 encoded)
+                  type: 'keyword',
+                  index: false,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.file.id': {
+                  // fileID. used for deletion and Symbol.exec.pcrange collision handling on symbolization
+                  type: 'keyword',
+                  index: true,
+                  doc_values: false,
+                  store: false,
+                },
+                'Symbol.exec.pcrange': {
+                  // PC ranges [begin, end)
+                  type: 'ip_range',
+                  index: true,
+                  doc_values: false,
+                  store: false,
+                },
+              },
+            },
+          })
+          .catch(catchResourceAlreadyExistsException),
+        esClient.indices
+          .create({
+            index: ILM_LOCK_INDEX,
+            settings: {
+              index: {
+                hidden: true,
+              },
+            },
+            mappings: {
+              properties: {
+                '@timestamp': {
+                  type: 'date',
+                  format: 'epoch_second',
+                },
+                phase: {
+                  type: 'keyword',
+                },
+              },
+            },
+          })
+          .catch(catchResourceAlreadyExistsException),
+      ]);
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_fleet_policy_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_fleet_policy_step.ts
new file mode 100644
index 0000000000000..7f7222a8a6e9d
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_fleet_policy_step.ts
@@ -0,0 +1,106 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ElasticsearchClient } from '@kbn/core/server';
+import { merge, omit } from 'lodash';
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+import { getApmPolicy } from './get_apm_policy';
+
+async function createIngestAPIKey(esClient: ElasticsearchClient) {
+  const apiKeyResponse = await esClient.security.createApiKey({
+    name: 'profiling-manager',
+    role_descriptors: {
+      profiling_manager: {
+        indices: [
+          {
+            names: ['profiling-*', '.profiling-*'],
+            privileges: [
+              'read',
+              'create_doc',
+              'create',
+              'write',
+              'index',
+              'create_index',
+              'view_index_metadata',
+              'manage',
+            ],
+          },
+        ],
+        cluster: ['monitor'],
+      },
+    },
+  });
+
+  return atob(apiKeyResponse.encoded);
+}
+
+export function getFleetPolicyStep({
+  client,
+  soClient,
+  logger,
+  packagePolicyClient,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  const esClient = client.getEsClient();
+  return {
+    name: 'fleet_policy',
+    hasCompleted: async () => {
+      try {
+        const apmPolicy = await getApmPolicy({ packagePolicyClient, soClient });
+
+        return apmPolicy && apmPolicy?.inputs[0].config?.['apm-server'].value.profiling;
+      } catch (error) {
+        logger.debug('Could not fetch fleet policy');
+        logger.debug(error);
+        return false;
+      }
+    },
+    init: async () => {
+      const apmPolicyApiKey = await createIngestAPIKey(client.getEsClient());
+
+      const profilingApmConfig = {
+        profiling: {
+          enabled: true,
+          elasticsearch: {
+            api_key: apmPolicyApiKey,
+          },
+          metrics: {
+            elasticsearch: {
+              hosts: [
+                'https://1b6c02856ea642a6ac14499b01507233.us-east-2.aws.elastic-cloud.com:443',
+              ],
+              api_key: 'woq-IoMBRbbiEbPugtWW:_iBmc1PdSout7sf5FCkEpA',
+            },
+          },
+          keyvalue_retention: {
+            // 60 days
+            age: '1440h',
+            // 200 Gib
+            size_bytes: 200 * 1024 * 1024 * 1024,
+            execution_interval: '12h',
+          },
+        },
+      };
+
+      const apmPolicy = await getApmPolicy({ packagePolicyClient, soClient });
+
+      if (!apmPolicy) {
+        throw new Error(`Could not find APM policy`);
+      }
+
+      const modifiedPolicyInputs = apmPolicy.inputs.map((input) => {
+        return input.type === 'apm'
+          ? merge({}, input, { config: { 'apm-server': { value: profilingApmConfig } } })
+          : input;
+      });
+
+      await packagePolicyClient.update(soClient, esClient, apmPolicy.id, {
+        ...omit(apmPolicy, 'id', 'revision', 'updated_at', 'updated_by'),
+        inputs: modifiedPolicyInputs,
+      });
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_ilm_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_ilm_step.ts
new file mode 100644
index 0000000000000..04d57b3c11d15
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_ilm_step.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+import { catchResourceAlreadyExistsException } from './catch_resource_already_exists_exception';
+import ilmProfiling from './ilm_profiling.json';
+
+const LIFECYCLE_POLICY_NAME = 'profiling';
+
+export function getIlmStep({
+  client,
+  logger,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  const esClient = client.getEsClient();
+
+  return {
+    name: 'ilm',
+    hasCompleted: () => {
+      return esClient.ilm.getLifecycle({ name: LIFECYCLE_POLICY_NAME }).then(
+        () => {
+          return Promise.resolve(true);
+        },
+        (error) => {
+          logger.debug('ILM policy not installed');
+          logger.debug(error);
+          return Promise.resolve(false);
+        }
+      );
+    },
+    init: async () => {
+      await esClient.ilm
+        .putLifecycle({
+          name: LIFECYCLE_POLICY_NAME,
+          policy: ilmProfiling,
+        })
+        .catch(catchResourceAlreadyExistsException);
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_index_templates_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_index_templates_step.ts
new file mode 100644
index 0000000000000..2e6fd0bec1f56
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_index_templates_step.ts
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+import { ProfilingComponentTemplateName } from './get_component_templates_step';
+
+enum ProfilingIndexTemplate {
+  Events = 'profiling-events',
+  Executables = 'profiling-executables',
+  Stacktraces = 'profiling-stacktraces',
+  Stackframes = 'profiling-stackframes',
+}
+
+export function getIndexTemplatesStep({
+  client,
+  logger,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  const esClient = client.getEsClient();
+
+  return {
+    name: 'index_templates',
+    hasCompleted: async () => {
+      return Promise.all(
+        [
+          ProfilingIndexTemplate.Events,
+          ProfilingIndexTemplate.Executables,
+          ProfilingIndexTemplate.Stacktraces,
+          ProfilingIndexTemplate.Stackframes,
+        ].map((indexTemplateName) =>
+          esClient.indices.getIndexTemplate({
+            name: indexTemplateName,
+          })
+        )
+      ).then(
+        () => Promise.resolve(true),
+        (error) => {
+          logger.debug('Some index templates could not be fetched');
+          logger.debug(error);
+          return Promise.resolve(false);
+        }
+      );
+    },
+    init: async () => {
+      await Promise.all([
+        esClient.indices.putIndexTemplate({
+          name: ProfilingIndexTemplate.Events,
+          create: false,
+          index_patterns: [ProfilingIndexTemplate.Events + '*'],
+          data_stream: {
+            hidden: false,
+          },
+          composed_of: [ProfilingComponentTemplateName.Events, ProfilingComponentTemplateName.Ilm],
+          priority: 100,
+          _meta: {
+            description: `Index template for ${ProfilingIndexTemplate.Events}`,
+          },
+        }),
+        ...[
+          ProfilingIndexTemplate.Executables,
+          ProfilingIndexTemplate.Stacktraces,
+          ProfilingIndexTemplate.Stackframes,
+        ].map((indexTemplateName) => {
+          return esClient.indices.putIndexTemplate({
+            name: indexTemplateName,
+            // Don't fail if the index template already exists, simply overwrite the format
+            create: false,
+            index_patterns: [indexTemplateName + '*'],
+            composed_of: [indexTemplateName],
+            _meta: {
+              description: `Index template for ${indexTemplateName}`,
+            },
+          });
+        }),
+      ]);
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_is_cloud_enabled_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_is_cloud_enabled_step.ts
new file mode 100644
index 0000000000000..920317eb47974
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_is_cloud_enabled_step.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+
+export function getIsCloudEnabledStep({
+  isCloudEnabled,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  return {
+    name: 'is_cloud',
+    hasCompleted: async () => {
+      return isCloudEnabled;
+    },
+    init: async () => {
+      if (!isCloudEnabled) {
+        throw new Error(`Universal Profiling is only available on Elastic Cloud.`);
+      }
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/get_security_step.ts b/x-pack/plugins/profiling/server/lib/setup/steps/get_security_step.ts
new file mode 100644
index 0000000000000..c3ae1a41488a6
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/get_security_step.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+
+const PROFILING_READER_ROLE_NAME = 'profiling-reader';
+
+export function getSecurityStep({
+  client,
+  logger,
+}: ProfilingSetupStepFactoryOptions): ProfilingSetupStep {
+  const esClient = client.getEsClient();
+
+  return {
+    name: 'security',
+    hasCompleted: () => {
+      return esClient.security
+        .getRole({
+          name: PROFILING_READER_ROLE_NAME,
+        })
+        .then(
+          () => {
+            return Promise.resolve(true);
+          },
+          (error) => {
+            logger.debug('Could not fetch profiling-reader role');
+            logger.debug(error);
+            return Promise.resolve(false);
+          }
+        );
+    },
+    init: async () => {
+      await esClient.security.putRole({
+        name: PROFILING_READER_ROLE_NAME,
+        indices: [
+          {
+            names: ['profiling-*'],
+            privileges: ['read', 'view_index_metadata'],
+          },
+        ],
+        cluster: ['monitor'],
+      });
+    },
+  };
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/ilm_profiling.json b/x-pack/plugins/profiling/server/lib/setup/steps/ilm_profiling.json
new file mode 100644
index 0000000000000..0d39bf08b0a02
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/ilm_profiling.json
@@ -0,0 +1,35 @@
+{
+  "phases": {
+    "hot": {
+      "min_age": "0ms",
+      "actions": {
+        "rollover": {
+          "max_primary_shard_size": "50gb",
+          "max_age": "7d"
+        },
+        "set_priority": {
+          "priority": 100
+        }
+      }
+    },
+    "warm": {
+      "min_age": "30d",
+      "actions": {
+        "set_priority": {
+          "priority": 50
+        },
+        "shrink": {
+          "number_of_shards": 2
+        }
+      }
+    },
+    "delete": {
+      "min_age": "60d",
+      "actions": {
+        "delete": {
+          "delete_searchable_snapshot": true
+        }
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/steps/index.ts b/x-pack/plugins/profiling/server/lib/setup/steps/index.ts
new file mode 100644
index 0000000000000..b0c5bbf0a50e7
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/steps/index.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getClusterSettingsStep } from './get_cluster_settings_step';
+import { ProfilingSetupStep, ProfilingSetupStepFactoryOptions } from '../types';
+import { getComponentTemplatesStep } from './get_component_templates_step';
+import { getIlmStep } from './get_ilm_step';
+import { getIndexTemplatesStep } from './get_index_templates_step';
+import { getFleetPolicyStep } from './get_fleet_policy_step';
+import { getSecurityStep } from './get_security_step';
+import { getApmPackageStep } from './get_apm_package_step';
+import { getCreateEventsDataStreamsStep } from './get_create_events_data_streams';
+import { getCreateIndicesStep } from './get_create_indices_step';
+import { getIsCloudEnabledStep } from './get_is_cloud_enabled_step';
+
+export function getProfilingSetupSteps(
+  options: ProfilingSetupStepFactoryOptions
+): ProfilingSetupStep[] {
+  return [
+    getIsCloudEnabledStep(options),
+    getApmPackageStep(options),
+    getClusterSettingsStep(options),
+    getIlmStep(options),
+    getComponentTemplatesStep(options),
+    getIndexTemplatesStep(options),
+    getCreateEventsDataStreamsStep(options),
+    getCreateIndicesStep(options),
+    getSecurityStep(options),
+    getFleetPolicyStep(options),
+  ];
+}
diff --git a/x-pack/plugins/profiling/server/lib/setup/types.ts b/x-pack/plugins/profiling/server/lib/setup/types.ts
new file mode 100644
index 0000000000000..65a0ae684052b
--- /dev/null
+++ b/x-pack/plugins/profiling/server/lib/setup/types.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SavedObjectsClientContract } from '@kbn/core/server';
+import { PackagePolicyClient } from '@kbn/fleet-plugin/server';
+import { Logger } from '@kbn/logging';
+import { ProfilingESClient } from '../../utils/create_profiling_es_client';
+
+export interface ProfilingSetupStep {
+  name: string;
+  init: () => Promise<void>;
+  hasCompleted: () => Promise<boolean>;
+}
+
+export interface ProfilingSetupStepFactoryOptions {
+  client: ProfilingESClient;
+  soClient: SavedObjectsClientContract;
+  packagePolicyClient: PackagePolicyClient;
+  logger: Logger;
+  spaceId: string;
+  isCloudEnabled: boolean;
+}
diff --git a/x-pack/plugins/profiling/server/plugin.ts b/x-pack/plugins/profiling/server/plugin.ts
index 923f87a87267d..6807f48fdd5d0 100644
--- a/x-pack/plugins/profiling/server/plugin.ts
+++ b/x-pack/plugins/profiling/server/plugin.ts
@@ -59,10 +59,15 @@ export class ProfilingPlugin
           setup: deps,
         },
         services: {
-          createProfilingEsClient: ({ request, esClient: defaultEsClient }) => {
-            const esClient = profilingSpecificEsClient
-              ? profilingSpecificEsClient.asScoped(request).asInternalUser
-              : defaultEsClient;
+          createProfilingEsClient: ({
+            request,
+            esClient: defaultEsClient,
+            useDefaultAuth = false,
+          }) => {
+            const esClient =
+              profilingSpecificEsClient && !useDefaultAuth
+                ? profilingSpecificEsClient.asScoped(request).asInternalUser
+                : defaultEsClient;
 
             return createProfilingEsClient({ request, esClient });
           },
diff --git a/x-pack/plugins/profiling/server/routes/index.ts b/x-pack/plugins/profiling/server/routes/index.ts
index a9bd74a7e9bf5..245a0e5925365 100644
--- a/x-pack/plugins/profiling/server/routes/index.ts
+++ b/x-pack/plugins/profiling/server/routes/index.ts
@@ -5,21 +5,19 @@
  * 2.0.
  */
 
-import type { IRouter, Logger } from '@kbn/core/server';
-import type { KibanaRequest } from '@kbn/core-http-server';
 import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
+import type { KibanaRequest } from '@kbn/core-http-server';
+import type { IRouter, Logger } from '@kbn/core/server';
 import {
   ProfilingPluginSetupDeps,
   ProfilingPluginStartDeps,
   ProfilingRequestHandlerContext,
 } from '../types';
 import { ProfilingESClient } from '../utils/create_profiling_es_client';
-
 import { registerCacheExecutablesRoute, registerCacheStackFramesRoute } from './cache';
-
 import { registerFlameChartSearchRoute } from './flamechart';
 import { registerTopNFunctionsSearchRoute } from './functions';
-
+import { registerSetupRoute } from './setup';
 import {
   registerTraceEventsTopNContainersSearchRoute,
   registerTraceEventsTopNDeploymentsSearchRoute,
@@ -39,6 +37,7 @@ export interface RouteRegisterParameters {
     createProfilingEsClient: (params: {
       request: KibanaRequest;
       esClient: ElasticsearchClient;
+      useDefaultAuth?: boolean;
     }) => ProfilingESClient;
   };
 }
@@ -53,4 +52,7 @@ export function registerRoutes(params: RouteRegisterParameters) {
   registerTraceEventsTopNHostsSearchRoute(params);
   registerTraceEventsTopNStackTracesSearchRoute(params);
   registerTraceEventsTopNThreadsSearchRoute(params);
+  // Setup of Profiling resources, automates the configuration of Universal Profiling
+  // and will show instructions on how to add data
+  registerSetupRoute(params);
 }
diff --git a/x-pack/plugins/profiling/server/routes/setup.ts b/x-pack/plugins/profiling/server/routes/setup.ts
new file mode 100644
index 0000000000000..4f97497b6ab96
--- /dev/null
+++ b/x-pack/plugins/profiling/server/routes/setup.ts
@@ -0,0 +1,165 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { eachSeries } from 'async';
+import { Logger } from '@kbn/logging';
+import { RouteRegisterParameters } from '.';
+import { getRoutePaths } from '../../common';
+import { getSetupInstructions } from '../lib/setup/get_setup_instructions';
+import { getProfilingSetupSteps } from '../lib/setup/steps';
+import { handleRouteHandlerError } from '../utils/handle_route_error_handler';
+import { hasProfilingData } from '../lib/setup/has_profiling_data';
+import { getClient } from './compat';
+import { ProfilingSetupStep } from '../lib/setup/types';
+
+function checkSteps({ steps, logger }: { steps: ProfilingSetupStep[]; logger: Logger }) {
+  return Promise.all(
+    steps.map(async (step) => {
+      try {
+        return { name: step.name, completed: await step.hasCompleted() };
+      } catch (error) {
+        logger.error(error);
+        return { name: step.name, completed: false, error: error.toString() };
+      }
+    })
+  );
+}
+
+export function registerSetupRoute({
+  router,
+  logger,
+  services: { createProfilingEsClient },
+  dependencies,
+}: RouteRegisterParameters) {
+  const paths = getRoutePaths();
+  // Check if ES resources needed for Universal Profiling to work exist
+  router.get(
+    {
+      path: paths.HasSetupESResources,
+      validate: false,
+    },
+    async (context, request, response) => {
+      try {
+        const esClient = await getClient(context);
+        logger.debug('checking if profiling ES configurations are installed');
+        const core = await context.core;
+
+        const steps = getProfilingSetupSteps({
+          client: createProfilingEsClient({
+            esClient,
+            request,
+            useDefaultAuth: true,
+          }),
+          logger,
+          packagePolicyClient: dependencies.start.fleet.packagePolicyService,
+          soClient: core.savedObjects.client,
+          spaceId: dependencies.setup.spaces.spacesService.getSpaceId(request),
+          isCloudEnabled: dependencies.setup.cloud.isCloudEnabled,
+        });
+
+        const hasDataPromise = hasProfilingData({
+          client: createProfilingEsClient({
+            esClient,
+            request,
+          }),
+        });
+
+        const stepCompletionResultsPromises = checkSteps({ steps, logger });
+
+        const hasData = await hasDataPromise;
+
+        if (hasData) {
+          return response.ok({
+            body: {
+              has_data: true,
+              has_setup: true,
+              steps: [],
+            },
+          });
+        }
+
+        const stepCompletionResults = await stepCompletionResultsPromises;
+
+        // Reply to clients if we have already created all 12 events template indices.
+        // This is kind of simplistic but can be a good first step to ensure
+        // Profiling resources will be created.
+        return response.ok({
+          body: {
+            has_setup: stepCompletionResults.every((step) => step.completed),
+            has_data: false,
+            steps: stepCompletionResults,
+          },
+        });
+      } catch (error) {
+        return handleRouteHandlerError({ error, logger, response });
+      }
+    }
+  );
+  // Configure ES resources needed by Universal Profiling using the mappings
+  router.post(
+    {
+      path: paths.HasSetupESResources,
+      validate: {},
+    },
+    async (context, request, response) => {
+      try {
+        const esClient = await getClient(context);
+        logger.info('Applying initial setup of Elasticsearch resources');
+        const steps = getProfilingSetupSteps({
+          client: createProfilingEsClient({ esClient, request, useDefaultAuth: true }),
+          logger,
+          packagePolicyClient: dependencies.start.fleet.packagePolicyService,
+          soClient: (await context.core).savedObjects.client,
+          spaceId: dependencies.setup.spaces.spacesService.getSpaceId(request),
+          isCloudEnabled: dependencies.setup.cloud.isCloudEnabled,
+        });
+
+        await eachSeries(steps, (step, cb) => {
+          logger.debug(`Executing step ${step.name}`);
+          step
+            .init()
+            .then(() => cb())
+            .catch(cb);
+        });
+
+        const checkedSteps = await checkSteps({ steps, logger });
+
+        if (checkedSteps.every((step) => step.completed)) {
+          return response.ok();
+        }
+
+        return response.custom({
+          statusCode: 500,
+          body: {
+            message: `Failed to complete all steps`,
+            steps: checkedSteps,
+          },
+        });
+      } catch (error) {
+        return handleRouteHandlerError({ error, logger, response });
+      }
+    }
+  );
+  // Show users the instructions on how to setup Universal Profiling agents
+  router.get(
+    {
+      path: paths.SetupDataCollectionInstructions,
+      validate: false,
+    },
+    async (context, request, response) => {
+      try {
+        const setupInstructions = await getSetupInstructions({
+          packagePolicyClient: dependencies.start.fleet.packagePolicyService,
+          soClient: (await context.core).savedObjects.client,
+        });
+
+        return response.ok({ body: setupInstructions });
+      } catch (error) {
+        return handleRouteHandlerError({ error, logger, response });
+      }
+    }
+  );
+}
diff --git a/x-pack/plugins/profiling/server/routes/topn.test.ts b/x-pack/plugins/profiling/server/routes/topn.test.ts
index f6eca43680194..c6fb4c7aa4d78 100644
--- a/x-pack/plugins/profiling/server/routes/topn.test.ts
+++ b/x-pack/plugins/profiling/server/routes/topn.test.ts
@@ -53,6 +53,7 @@ describe('TopN data from Elasticsearch', () => {
           },
         }) as Promise<any>
     ),
+    getEsClient: jest.fn(() => context.elasticsearch.client.asCurrentUser),
   };
   const logger = loggerMock.create();
 
diff --git a/x-pack/plugins/profiling/server/types.ts b/x-pack/plugins/profiling/server/types.ts
index 8432085ef1022..6112c2e9790cf 100644
--- a/x-pack/plugins/profiling/server/types.ts
+++ b/x-pack/plugins/profiling/server/types.ts
@@ -5,21 +5,32 @@
  * 2.0.
  */
 
-import { RequestHandlerContext } from '@kbn/core/server';
-import { PluginSetupContract as FeaturesPluginSetup } from '@kbn/features-plugin/server';
-import { ObservabilityPluginSetup } from '@kbn/observability-plugin/server';
+import { CustomRequestHandlerContext } from '@kbn/core-http-request-handler-context-server';
+import type { PluginSetupContract as FeaturesPluginSetup } from '@kbn/features-plugin/server';
+import type { ObservabilityPluginSetup } from '@kbn/observability-plugin/server';
+import { SpacesPluginStart, SpacesPluginSetup } from '@kbn/spaces-plugin/server';
+import { CloudSetup, CloudStart } from '@kbn/cloud-plugin/server';
+import { FleetSetupContract, FleetStartContract } from '@kbn/fleet-plugin/server';
 
 export interface ProfilingPluginSetupDeps {
   observability: ObservabilityPluginSetup;
   features: FeaturesPluginSetup;
+  spaces: SpacesPluginSetup;
+  cloud: CloudSetup;
+  fleet: FleetSetupContract;
 }
 
-// eslint-disable-next-line @typescript-eslint/no-empty-interface
-export interface ProfilingPluginStartDeps {}
+export interface ProfilingPluginStartDeps {
+  observability: {};
+  features: {};
+  spaces: SpacesPluginStart;
+  cloud: CloudStart;
+  fleet: FleetStartContract;
+}
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface ProfilingPluginSetup {}
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface ProfilingPluginStart {}
 
-export type ProfilingRequestHandlerContext = RequestHandlerContext;
+export type ProfilingRequestHandlerContext = CustomRequestHandlerContext<{}>;
diff --git a/x-pack/plugins/profiling/server/utils/create_profiling_es_client.ts b/x-pack/plugins/profiling/server/utils/create_profiling_es_client.ts
index 4aa132ab7a031..05df1e9d37fde 100644
--- a/x-pack/plugins/profiling/server/utils/create_profiling_es_client.ts
+++ b/x-pack/plugins/profiling/server/utils/create_profiling_es_client.ts
@@ -40,6 +40,7 @@ export interface ProfilingESClient {
     query: QueryDslQueryContainer;
     sampleSize: number;
   }): Promise<StackTraceResponse>;
+  getEsClient(): ElasticsearchClient;
 }
 
 export function createProfilingEsClient({
@@ -116,5 +117,8 @@ export function createProfilingEsClient({
 
       return unwrapEsResponse(promise) as Promise<StackTraceResponse>;
     },
+    getEsClient() {
+      return esClient;
+    },
   };
 }
diff --git a/x-pack/plugins/profiling/tsconfig.json b/x-pack/plugins/profiling/tsconfig.json
index 18bd0ec6bf481..b1044792b3209 100644
--- a/x-pack/plugins/profiling/tsconfig.json
+++ b/x-pack/plugins/profiling/tsconfig.json
@@ -9,7 +9,8 @@
     "common/**/*.ts",
     "public/**/*.ts",
     "public/**/*.tsx",
-    "server/**/*.ts"
+    "server/**/*.ts",
+    "server/**/*.json"
   ],
   "kbn_references": [
     "@kbn/core",
@@ -19,7 +20,6 @@
     "@kbn/observability-plugin",
     "@kbn/i18n",
     "@kbn/es-types",
-    "@kbn/core-http-browser",
     "@kbn/data-views-plugin",
     "@kbn/charts-plugin",
     "@kbn/typed-react-router-config",
@@ -34,6 +34,12 @@
     "@kbn/core-http-server",
     "@kbn/apm-utils",
     "@kbn/core-elasticsearch-server",
+    "@kbn/fleet-plugin",
+    "@kbn/shared-ux-page-no-data-types",
+    "@kbn/es-errors",
+    "@kbn/core-http-request-handler-context-server",
+    "@kbn/spaces-plugin",
+    "@kbn/cloud-plugin",
     // add references to other TypeScript projects the plugin depends on
 
     // requiredPlugins from ./kibana.json

From eabeb3f1765c3b16421825f99d0e56ef830cc17b Mon Sep 17 00:00:00 2001
From: Tomasz Ciecierski <tomasz.ciecierski@elastic.co>
Date: Tue, 7 Feb 2023 14:15:34 +0100
Subject: [PATCH 054/134] [Defend Workflows] [Osquery] Update field schemas
 (#150279)

---
 .../osquery/public/common/schemas/ecs/v8.5.0.json     |  1 -
 .../osquery/public/common/schemas/ecs/v8.7.0.json     |  1 +
 .../osquery/public/common/schemas/osquery/v5.5.1.json |  1 -
 .../osquery/public/common/schemas/osquery/v5.7.0.json |  1 +
 .../plugins/osquery/public/editor/osquery_tables.ts   |  2 +-
 .../public/packs/queries/ecs_mapping_editor_field.tsx |  4 ++--
 .../osquery/scripts/schema_formatter/ecs_formatter.ts | 11 +++++++++--
 7 files changed, 14 insertions(+), 7 deletions(-)
 delete mode 100644 x-pack/plugins/osquery/public/common/schemas/ecs/v8.5.0.json
 create mode 100644 x-pack/plugins/osquery/public/common/schemas/ecs/v8.7.0.json
 delete mode 100644 x-pack/plugins/osquery/public/common/schemas/osquery/v5.5.1.json
 create mode 100644 x-pack/plugins/osquery/public/common/schemas/osquery/v5.7.0.json

diff --git a/x-pack/plugins/osquery/public/common/schemas/ecs/v8.5.0.json b/x-pack/plugins/osquery/public/common/schemas/ecs/v8.5.0.json
deleted file mode 100644
index 5fe03a8130fd0..0000000000000
--- a/x-pack/plugins/osquery/public/common/schemas/ecs/v8.5.0.json
+++ /dev/null
@@ -1 +0,0 @@
-[{"field":"labels","type":"object","normalization":"","example":{"application":"foo-bar","env":"production"},"description":"Custom key/value pairs."},{"field":"message","type":"match_only_text","normalization":"","example":"Hello World","description":"Log message optimized for viewing in a log viewer."},{"field":"tags","type":"keyword","normalization":"array","example":["production","env2"],"description":"List of keywords used to tag each event."},{"field":"agent.build.original","type":"keyword","normalization":"","example":"metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]","description":"Extended build information for the agent."},{"field":"client.address","type":"keyword","normalization":"","example":"","description":"Client network address."},{"field":"client.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"client.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"client.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"client.bytes","type":"long","normalization":"","example":184,"description":"Bytes sent from the client to the server."},{"field":"client.domain","type":"keyword","normalization":"","example":"foo.example.com","description":"The domain name of the client."},{"field":"client.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"client.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"client.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"client.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"client.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"client.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"client.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"client.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"client.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"client.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"client.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"client.ip","type":"ip","normalization":"","example":"","description":"IP address of the client."},{"field":"client.mac","type":"keyword","normalization":"","example":"00-00-5E-00-53-23","description":"MAC address of the client."},{"field":"client.nat.ip","type":"ip","normalization":"","example":"","description":"Client NAT ip address"},{"field":"client.nat.port","type":"long","normalization":"","example":"","description":"Client NAT port"},{"field":"client.packets","type":"long","normalization":"","example":12,"description":"Packets sent from the client to the server."},{"field":"client.port","type":"long","normalization":"","example":"","description":"Port of the client."},{"field":"client.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered client domain, stripped of the subdomain."},{"field":"client.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"client.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"client.user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"client.user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"client.user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"client.user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"client.user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"client.user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"client.user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"client.user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"client.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"client.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"client.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"client.user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"cloud.account.id","type":"keyword","normalization":"","example":666777888999,"description":"The cloud account or organization id."},{"field":"cloud.account.name","type":"keyword","normalization":"","example":"elastic-dev","description":"The cloud account name."},{"field":"cloud.availability_zone","type":"keyword","normalization":"","example":"us-east-1c","description":"Availability zone in which this host, resource, or service is located."},{"field":"cloud.instance.id","type":"keyword","normalization":"","example":"i-1234567890abcdef0","description":"Instance ID of the host machine."},{"field":"cloud.instance.name","type":"keyword","normalization":"","example":"","description":"Instance name of the host machine."},{"field":"cloud.machine.type","type":"keyword","normalization":"","example":"t2.medium","description":"Machine type of the host machine."},{"field":"cloud.origin.account.id","type":"keyword","normalization":"","example":666777888999,"description":"The cloud account or organization id."},{"field":"cloud.origin.account.name","type":"keyword","normalization":"","example":"elastic-dev","description":"The cloud account name."},{"field":"cloud.origin.availability_zone","type":"keyword","normalization":"","example":"us-east-1c","description":"Availability zone in which this host, resource, or service is located."},{"field":"cloud.origin.instance.id","type":"keyword","normalization":"","example":"i-1234567890abcdef0","description":"Instance ID of the host machine."},{"field":"cloud.origin.instance.name","type":"keyword","normalization":"","example":"","description":"Instance name of the host machine."},{"field":"cloud.origin.machine.type","type":"keyword","normalization":"","example":"t2.medium","description":"Machine type of the host machine."},{"field":"cloud.origin.project.id","type":"keyword","normalization":"","example":"my-project","description":"The cloud project id."},{"field":"cloud.origin.project.name","type":"keyword","normalization":"","example":"my project","description":"The cloud project name."},{"field":"cloud.origin.provider","type":"keyword","normalization":"","example":"aws","description":"Name of the cloud provider."},{"field":"cloud.origin.region","type":"keyword","normalization":"","example":"us-east-1","description":"Region in which this host, resource, or service is located."},{"field":"cloud.origin.service.name","type":"keyword","normalization":"","example":"lambda","description":"The cloud service name."},{"field":"cloud.project.id","type":"keyword","normalization":"","example":"my-project","description":"The cloud project id."},{"field":"cloud.project.name","type":"keyword","normalization":"","example":"my project","description":"The cloud project name."},{"field":"cloud.provider","type":"keyword","normalization":"","example":"aws","description":"Name of the cloud provider."},{"field":"cloud.region","type":"keyword","normalization":"","example":"us-east-1","description":"Region in which this host, resource, or service is located."},{"field":"cloud.service.name","type":"keyword","normalization":"","example":"lambda","description":"The cloud service name."},{"field":"cloud.target.account.id","type":"keyword","normalization":"","example":666777888999,"description":"The cloud account or organization id."},{"field":"cloud.target.account.name","type":"keyword","normalization":"","example":"elastic-dev","description":"The cloud account name."},{"field":"cloud.target.availability_zone","type":"keyword","normalization":"","example":"us-east-1c","description":"Availability zone in which this host, resource, or service is located."},{"field":"cloud.target.instance.id","type":"keyword","normalization":"","example":"i-1234567890abcdef0","description":"Instance ID of the host machine."},{"field":"cloud.target.instance.name","type":"keyword","normalization":"","example":"","description":"Instance name of the host machine."},{"field":"cloud.target.machine.type","type":"keyword","normalization":"","example":"t2.medium","description":"Machine type of the host machine."},{"field":"cloud.target.project.id","type":"keyword","normalization":"","example":"my-project","description":"The cloud project id."},{"field":"cloud.target.project.name","type":"keyword","normalization":"","example":"my project","description":"The cloud project name."},{"field":"cloud.target.provider","type":"keyword","normalization":"","example":"aws","description":"Name of the cloud provider."},{"field":"cloud.target.region","type":"keyword","normalization":"","example":"us-east-1","description":"Region in which this host, resource, or service is located."},{"field":"cloud.target.service.name","type":"keyword","normalization":"","example":"lambda","description":"The cloud service name."},{"field":"container.cpu.usage","type":"scaled_float","normalization":"","example":"","description":"Percent CPU used, between 0 and 1."},{"field":"container.disk.read.bytes","type":"long","normalization":"","example":"","description":"The number of bytes read by all disks."},{"field":"container.disk.write.bytes","type":"long","normalization":"","example":"","description":"The number of bytes written on all disks."},{"field":"container.id","type":"keyword","normalization":"","example":"","description":"Unique container id."},{"field":"container.image.hash.all","type":"keyword","normalization":"array","example":"[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]","description":"An array of digests of the image the container was built on."},{"field":"container.image.name","type":"keyword","normalization":"","example":"","description":"Name of the image the container was built on."},{"field":"container.image.tag","type":"keyword","normalization":"array","example":"","description":"Container image tags."},{"field":"container.labels","type":"object","normalization":"","example":"","description":"Image labels."},{"field":"container.memory.usage","type":"scaled_float","normalization":"","example":"","description":"Percent memory used, between 0 and 1."},{"field":"container.name","type":"keyword","normalization":"","example":"","description":"Container name."},{"field":"container.network.egress.bytes","type":"long","normalization":"","example":"","description":"The number of bytes sent on all network interfaces."},{"field":"container.network.ingress.bytes","type":"long","normalization":"","example":"","description":"The number of bytes received on all network interfaces."},{"field":"container.runtime","type":"keyword","normalization":"","example":"docker","description":"Runtime managing this container."},{"field":"data_stream.dataset","type":"constant_keyword","normalization":"","example":"nginx.access","description":"The field can contain anything that makes sense to signify the source of the data."},{"field":"data_stream.namespace","type":"constant_keyword","normalization":"","example":"production","description":"A user defined namespace. Namespaces are useful to allow grouping of data."},{"field":"data_stream.type","type":"constant_keyword","normalization":"","example":"logs","description":"An overarching type for the data stream."},{"field":"destination.address","type":"keyword","normalization":"","example":"","description":"Destination network address."},{"field":"destination.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"destination.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"destination.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"destination.bytes","type":"long","normalization":"","example":184,"description":"Bytes sent from the destination to the source."},{"field":"destination.domain","type":"keyword","normalization":"","example":"foo.example.com","description":"The domain name of the destination."},{"field":"destination.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"destination.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"destination.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"destination.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"destination.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"destination.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"destination.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"destination.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"destination.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"destination.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"destination.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"destination.ip","type":"ip","normalization":"","example":"","description":"IP address of the destination."},{"field":"destination.mac","type":"keyword","normalization":"","example":"00-00-5E-00-53-23","description":"MAC address of the destination."},{"field":"destination.nat.ip","type":"ip","normalization":"","example":"","description":"Destination NAT ip"},{"field":"destination.nat.port","type":"long","normalization":"","example":"","description":"Destination NAT Port"},{"field":"destination.packets","type":"long","normalization":"","example":12,"description":"Packets sent from the destination to the source."},{"field":"destination.port","type":"long","normalization":"","example":"","description":"Port of the destination."},{"field":"destination.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered destination domain, stripped of the subdomain."},{"field":"destination.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"destination.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"destination.user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"destination.user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"destination.user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"destination.user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"destination.user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"destination.user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"destination.user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"destination.user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"destination.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"destination.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"destination.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"destination.user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"dll.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"dll.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"dll.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"dll.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"dll.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"dll.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"dll.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"dll.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"dll.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"dll.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"dll.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"dll.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"dll.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"dll.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"dll.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"dll.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"dll.name","type":"keyword","normalization":"","example":"kernel32.dll","description":"Name of the library."},{"field":"dll.path","type":"keyword","normalization":"","example":"C:\\Windows\\System32\\kernel32.dll","description":"Full file path of the library."},{"field":"dll.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"dll.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"dll.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"dll.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"dll.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"dll.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"dll.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"dll.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"dns.answers","type":"object","normalization":"array","example":"","description":"Array of DNS answers."},{"field":"dns.answers.class","type":"keyword","normalization":"","example":"IN","description":"The class of DNS data contained in this resource record."},{"field":"dns.answers.data","type":"keyword","normalization":"","example":"10.10.10.10","description":"The data describing the resource."},{"field":"dns.answers.name","type":"keyword","normalization":"","example":"www.example.com","description":"The domain name to which this resource record pertains."},{"field":"dns.answers.ttl","type":"long","normalization":"","example":180,"description":"The time interval in seconds that this resource record may be cached before it should be discarded."},{"field":"dns.answers.type","type":"keyword","normalization":"","example":"CNAME","description":"The type of data contained in this resource record."},{"field":"dns.header_flags","type":"keyword","normalization":"array","example":["RD","RA"],"description":"Array of DNS header flags."},{"field":"dns.id","type":"keyword","normalization":"","example":62111,"description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response."},{"field":"dns.op_code","type":"keyword","normalization":"","example":"QUERY","description":"The DNS operation code that specifies the kind of query in the message."},{"field":"dns.question.class","type":"keyword","normalization":"","example":"IN","description":"The class of records being queried."},{"field":"dns.question.name","type":"keyword","normalization":"","example":"www.example.com","description":"The name being queried."},{"field":"dns.question.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered domain, stripped of the subdomain."},{"field":"dns.question.subdomain","type":"keyword","normalization":"","example":"www","description":"The subdomain of the domain."},{"field":"dns.question.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"dns.question.type","type":"keyword","normalization":"","example":"AAAA","description":"The type of record being queried."},{"field":"dns.resolved_ip","type":"ip","normalization":"array","example":["10.10.10.10","10.10.10.11"],"description":"Array containing all IPs seen in answers.data"},{"field":"dns.response_code","type":"keyword","normalization":"","example":"NOERROR","description":"The DNS response code."},{"field":"dns.type","type":"keyword","normalization":"","example":"answer","description":"The type of DNS event captured, query or answer."},{"field":"email.attachments","type":"nested","normalization":"array","example":"","description":"List of objects describing the attachments."},{"field":"email.attachments.file.extension","type":"keyword","normalization":"","example":"txt","description":"Attachment file extension."},{"field":"email.attachments.file.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"email.attachments.file.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"email.attachments.file.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"email.attachments.file.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"email.attachments.file.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"email.attachments.file.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"email.attachments.file.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"email.attachments.file.mime_type","type":"keyword","normalization":"","example":"text/plain","description":"MIME type of the attachment file."},{"field":"email.attachments.file.name","type":"keyword","normalization":"","example":"attachment.txt","description":"Name of the attachment file."},{"field":"email.attachments.file.size","type":"long","normalization":"","example":64329,"description":"Attachment file size."},{"field":"email.bcc.address","type":"keyword","normalization":"array","example":"bcc.user1@example.com","description":"Email address of BCC recipient"},{"field":"email.cc.address","type":"keyword","normalization":"array","example":"cc.user1@example.com","description":"Email address of CC recipient"},{"field":"email.content_type","type":"keyword","normalization":"","example":"text/plain","description":"MIME type of the email message."},{"field":"email.delivery_timestamp","type":"date","normalization":"","example":"2020-11-10T22:12:34.8196921Z","description":"Date and time when message was delivered."},{"field":"email.direction","type":"keyword","normalization":"","example":"inbound","description":"Direction of the message."},{"field":"email.from.address","type":"keyword","normalization":"array","example":"sender@example.com","description":"The sender's email address."},{"field":"email.local_id","type":"keyword","normalization":"","example":"c26dbea0-80d5-463b-b93c-4e8b708219ce","description":"Unique identifier given by the source."},{"field":"email.message_id","type":"wildcard","normalization":"","example":"81ce15$8r2j59@mail01.example.com","description":"Value from the Message-ID header."},{"field":"email.origination_timestamp","type":"date","normalization":"","example":"2020-11-10T22:12:34.8196921Z","description":"Date and time the email was composed."},{"field":"email.reply_to.address","type":"keyword","normalization":"array","example":"reply.here@example.com","description":"Address replies should be delivered to."},{"field":"email.sender.address","type":"keyword","normalization":"","example":"","description":"Address of the message sender."},{"field":"email.subject","type":"keyword","normalization":"","example":"Please see this important message.","description":"The subject of the email message."},{"field":"email.subject.text","type":"match_only_text","normalization":"","example":"Please see this important message.","description":"The subject of the email message."},{"field":"email.to.address","type":"keyword","normalization":"array","example":"user1@example.com","description":"Email address of recipient"},{"field":"email.x_mailer","type":"keyword","normalization":"","example":"Spambot v2.5","description":"Application that drafted email."},{"field":"error.code","type":"keyword","normalization":"","example":"","description":"Error code describing the error."},{"field":"error.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the error."},{"field":"error.message","type":"match_only_text","normalization":"","example":"","description":"Error message."},{"field":"error.stack_trace","type":"wildcard","normalization":"","example":"","description":"The stack trace of this error in plain text."},{"field":"error.stack_trace.text","type":"match_only_text","normalization":"","example":"","description":"The stack trace of this error in plain text."},{"field":"error.type","type":"keyword","normalization":"","example":"java.lang.NullPointerException","description":"The type of the error, for example the class name of the exception."},{"field":"event.action","type":"keyword","normalization":"","example":"user-password-change","description":"The action captured by the event."},{"field":"event.category","type":"keyword","normalization":"array","example":"authentication","description":"Event category. The second categorization field in the hierarchy."},{"field":"event.code","type":"keyword","normalization":"","example":4648,"description":"Identification code for this event."},{"field":"event.created","type":"date","normalization":"","example":"2016-05-23T08:05:34.857Z","description":"Time when the event was first read by an agent or by your pipeline."},{"field":"event.dataset","type":"keyword","normalization":"","example":"apache.access","description":"Name of the dataset."},{"field":"event.duration","type":"long","normalization":"","example":"","description":"Duration of the event in nanoseconds."},{"field":"event.end","type":"date","normalization":"","example":"","description":"event.end contains the date when the event ended or when the activity was last observed."},{"field":"event.hash","type":"keyword","normalization":"","example":"123456789012345678901234567890ABCD","description":"Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity."},{"field":"event.id","type":"keyword","normalization":"","example":"8a4f500d","description":"Unique ID to describe the event."},{"field":"event.kind","type":"keyword","normalization":"","example":"alert","description":"The kind of the event. The highest categorization field in the hierarchy."},{"field":"event.original","type":"keyword","normalization":"","example":"Sep 19 08:26:10 host CEF:0&#124;Security&#124; threatmanager&#124;1.0&#124;100&#124; worm successfully stopped&#124;10&#124;src=10.0.0.1 dst=2.1.2.2spt=1232","description":"Raw text message of entire event."},{"field":"event.outcome","type":"keyword","normalization":"","example":"success","description":"The outcome of the event. The lowest level categorization field in the hierarchy."},{"field":"event.provider","type":"keyword","normalization":"","example":"kernel","description":"Source of the event."},{"field":"event.reason","type":"keyword","normalization":"","example":"Terminated an unexpected process","description":"Reason why this event happened, according to the source"},{"field":"event.reference","type":"keyword","normalization":"","example":"https://system.example.com/event/#0001234","description":"Event reference URL"},{"field":"event.risk_score","type":"float","normalization":"","example":"","description":"Risk score or priority of the event (e.g. security solutions). Use your system's original value here."},{"field":"event.risk_score_norm","type":"float","normalization":"","example":"","description":"Normalized risk score or priority of the event (0-100)."},{"field":"event.sequence","type":"long","normalization":"","example":"","description":"Sequence number of the event."},{"field":"event.severity","type":"long","normalization":"","example":7,"description":"Numeric severity of the event."},{"field":"event.start","type":"date","normalization":"","example":"","description":"event.start contains the date when the event started or when the activity was first observed."},{"field":"event.timezone","type":"keyword","normalization":"","example":"","description":"Event time zone."},{"field":"event.type","type":"keyword","normalization":"array","example":"","description":"Event type. The third categorization field in the hierarchy."},{"field":"event.url","type":"keyword","normalization":"","example":"https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe","description":"Event investigation URL"},{"field":"faas.coldstart","type":"boolean","normalization":"","example":"","description":"Boolean value indicating a cold start of a function."},{"field":"faas.execution","type":"keyword","normalization":"","example":"af9d5aa4-a685-4c5f-a22b-444f80b3cc28","description":"The execution ID of the current function execution."},{"field":"faas.id","type":"keyword","normalization":"","example":"arn:aws:lambda:us-west-2:123456789012:function:my-function","description":"The unique identifier of a serverless function."},{"field":"faas.name","type":"keyword","normalization":"","example":"my-function","description":"The name of a serverless function."},{"field":"faas.trigger","type":"nested","normalization":"","example":"","description":"Details about the function trigger."},{"field":"faas.trigger.request_id","type":"keyword","normalization":"","example":123456789,"description":"The ID of the trigger request , message, event, etc."},{"field":"faas.trigger.type","type":"keyword","normalization":"","example":"http","description":"The trigger for the function execution."},{"field":"faas.version","type":"keyword","normalization":"","example":123,"description":"The version of a serverless function."},{"field":"file.accessed","type":"date","normalization":"","example":"","description":"Last time the file was accessed."},{"field":"file.attributes","type":"keyword","normalization":"array","example":["readonly","system"],"description":"Array of file attributes."},{"field":"file.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"file.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"file.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"file.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"file.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"file.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"file.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"file.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"file.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"file.created","type":"date","normalization":"","example":"","description":"File creation time."},{"field":"file.ctime","type":"date","normalization":"","example":"","description":"Last time the file attributes or metadata changed."},{"field":"file.device","type":"keyword","normalization":"","example":"sda","description":"Device that is the source of the file."},{"field":"file.directory","type":"keyword","normalization":"","example":"/home/alice","description":"Directory where the file is located."},{"field":"file.drive_letter","type":"keyword","normalization":"","example":"C","description":"Drive letter where the file is located."},{"field":"file.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"file.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"file.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"file.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"file.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"file.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"file.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"file.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"file.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"file.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"file.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"file.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"file.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"file.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"file.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"file.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"file.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"file.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"file.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"file.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"file.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"file.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"file.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"file.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"file.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"file.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"file.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"file.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"file.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"file.extension","type":"keyword","normalization":"","example":"png","description":"File extension, excluding the leading dot."},{"field":"file.fork_name","type":"keyword","normalization":"","example":"Zone.Identifer","description":"A fork is additional data associated with a filesystem object."},{"field":"file.gid","type":"keyword","normalization":"","example":1001,"description":"Primary group ID (GID) of the file."},{"field":"file.group","type":"keyword","normalization":"","example":"alice","description":"Primary group name of the file."},{"field":"file.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"file.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"file.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"file.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"file.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"file.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"file.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"file.inode","type":"keyword","normalization":"","example":256383,"description":"Inode representing the file in the filesystem."},{"field":"file.mime_type","type":"keyword","normalization":"","example":"","description":"Media type of file, document, or arrangement of bytes."},{"field":"file.mode","type":"keyword","normalization":"","example":"0640","description":"Mode of the file in octal representation."},{"field":"file.mtime","type":"date","normalization":"","example":"","description":"Last time the file content was modified."},{"field":"file.name","type":"keyword","normalization":"","example":"example.png","description":"Name of the file including the extension, without the directory."},{"field":"file.owner","type":"keyword","normalization":"","example":"alice","description":"File owner's username."},{"field":"file.path","type":"keyword","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"file.path.text","type":"match_only_text","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"file.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"file.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"file.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"file.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"file.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"file.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"file.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"file.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"file.size","type":"long","normalization":"","example":16384,"description":"File size in bytes."},{"field":"file.target_path","type":"keyword","normalization":"","example":"","description":"Target path for symlinks."},{"field":"file.target_path.text","type":"match_only_text","normalization":"","example":"","description":"Target path for symlinks."},{"field":"file.type","type":"keyword","normalization":"","example":"file","description":"File type (file, dir, or symlink)."},{"field":"file.uid","type":"keyword","normalization":"","example":1001,"description":"The user ID (UID) or security identifier (SID) of the file owner."},{"field":"file.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"file.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"file.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"file.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"file.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"file.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"file.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"file.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"file.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"file.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"file.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"file.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"file.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"file.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"file.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"file.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"file.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"file.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"file.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"file.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"file.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"file.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"file.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"file.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"host.boot.id","type":"keyword","normalization":"","example":"88a1f0ed-5ae5-41ee-af6b-41921c311872","description":"Linux boot uuid taken from /proc/sys/kernel/random/boot_id"},{"field":"host.cpu.usage","type":"scaled_float","normalization":"","example":"","description":"Percent CPU used, between 0 and 1."},{"field":"host.disk.read.bytes","type":"long","normalization":"","example":"","description":"The number of bytes read by all disks."},{"field":"host.disk.write.bytes","type":"long","normalization":"","example":"","description":"The number of bytes written on all disks."},{"field":"host.domain","type":"keyword","normalization":"","example":"CONTOSO","description":"Name of the directory the group is a member of."},{"field":"host.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"host.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"host.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"host.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"host.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"host.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"host.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"host.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"host.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"host.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"host.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"host.name","type":"keyword","normalization":"","example":"","description":"Name of the host."},{"field":"host.network.egress.bytes","type":"long","normalization":"","example":"","description":"The number of bytes sent on all network interfaces."},{"field":"host.network.egress.packets","type":"long","normalization":"","example":"","description":"The number of packets sent on all network interfaces."},{"field":"host.network.ingress.bytes","type":"long","normalization":"","example":"","description":"The number of bytes received on all network interfaces."},{"field":"host.network.ingress.packets","type":"long","normalization":"","example":"","description":"The number of packets received on all network interfaces."},{"field":"host.os.full","type":"keyword","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"host.os.full.text","type":"match_only_text","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"host.os.name.text","type":"match_only_text","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"host.os.platform","type":"keyword","normalization":"","example":"darwin","description":"Operating system platform (such centos, ubuntu, windows)."},{"field":"host.pid_ns_ino","type":"keyword","normalization":"","example":256383,"description":"Pid namespace inode"},{"field":"host.risk.calculated_level","type":"keyword","normalization":"","example":"High","description":"A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring."},{"field":"host.risk.calculated_score","type":"float","normalization":"","example":880.73,"description":"A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring."},{"field":"host.risk.calculated_score_norm","type":"float","normalization":"","example":88.73,"description":"A normalized risk score calculated by an internal system."},{"field":"host.risk.static_level","type":"keyword","normalization":"","example":"High","description":"A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform."},{"field":"host.risk.static_score","type":"float","normalization":"","example":830,"description":"A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform."},{"field":"host.risk.static_score_norm","type":"float","normalization":"","example":83,"description":"A normalized risk score calculated by an external system."},{"field":"host.type","type":"keyword","normalization":"","example":"","description":"Type of host."},{"field":"host.uptime","type":"long","normalization":"","example":1325,"description":"Seconds the host has been up."},{"field":"http.request.body.bytes","type":"long","normalization":"","example":887,"description":"Size in bytes of the request body."},{"field":"http.request.body.content","type":"wildcard","normalization":"","example":"Hello world","description":"The full HTTP request body."},{"field":"http.request.body.content.text","type":"match_only_text","normalization":"","example":"Hello world","description":"The full HTTP request body."},{"field":"http.request.bytes","type":"long","normalization":"","example":1437,"description":"Total size in bytes of the request (body and headers)."},{"field":"http.request.id","type":"keyword","normalization":"","example":"123e4567-e89b-12d3-a456-426614174000","description":"HTTP request ID."},{"field":"http.request.method","type":"keyword","normalization":"","example":"POST","description":"HTTP request method."},{"field":"http.request.mime_type","type":"keyword","normalization":"","example":"image/gif","description":"Mime type of the body of the request."},{"field":"http.request.referrer","type":"keyword","normalization":"","example":"https://blog.example.com/","description":"Referrer for this HTTP request."},{"field":"http.response.body.bytes","type":"long","normalization":"","example":887,"description":"Size in bytes of the response body."},{"field":"http.response.body.content","type":"wildcard","normalization":"","example":"Hello world","description":"The full HTTP response body."},{"field":"http.response.body.content.text","type":"match_only_text","normalization":"","example":"Hello world","description":"The full HTTP response body."},{"field":"http.response.bytes","type":"long","normalization":"","example":1437,"description":"Total size in bytes of the response (body and headers)."},{"field":"http.response.mime_type","type":"keyword","normalization":"","example":"image/gif","description":"Mime type of the body of the response."},{"field":"http.response.status_code","type":"long","normalization":"","example":404,"description":"HTTP response status code."},{"field":"http.version","type":"keyword","normalization":"","example":1.1,"description":"HTTP version."},{"field":"log.file.path","type":"keyword","normalization":"","example":"/var/log/fun-times.log","description":"Full path to the log file this event came from."},{"field":"log.level","type":"keyword","normalization":"","example":"error","description":"Log level of the log event."},{"field":"log.logger","type":"keyword","normalization":"","example":"org.elasticsearch.bootstrap.Bootstrap","description":"Name of the logger."},{"field":"log.origin.file.line","type":"long","normalization":"","example":42,"description":"The line number of the file which originated the log event."},{"field":"log.origin.file.name","type":"keyword","normalization":"","example":"Bootstrap.java","description":"The code file which originated the log event."},{"field":"log.origin.function","type":"keyword","normalization":"","example":"init","description":"The function which originated the log event."},{"field":"log.syslog","type":"object","normalization":"","example":"","description":"Syslog metadata"},{"field":"log.syslog.appname","type":"keyword","normalization":"","example":"sshd","description":"The device or application that originated the Syslog message."},{"field":"log.syslog.facility.code","type":"long","normalization":"","example":23,"description":"Syslog numeric facility of the event."},{"field":"log.syslog.facility.name","type":"keyword","normalization":"","example":"local7","description":"Syslog text-based facility of the event."},{"field":"log.syslog.hostname","type":"keyword","normalization":"","example":"example-host","description":"The host that originated the Syslog message."},{"field":"log.syslog.msgid","type":"keyword","normalization":"","example":"ID47","description":"An identifier for the type of Syslog message."},{"field":"log.syslog.priority","type":"long","normalization":"","example":135,"description":"Syslog priority of the event."},{"field":"log.syslog.procid","type":"keyword","normalization":"","example":12345,"description":"The process name or ID that originated the Syslog message."},{"field":"log.syslog.severity.code","type":"long","normalization":"","example":3,"description":"Syslog numeric severity of the event."},{"field":"log.syslog.severity.name","type":"keyword","normalization":"","example":"Error","description":"Syslog text-based severity of the event."},{"field":"log.syslog.structured_data","type":"flattened","normalization":"","example":"","description":"Structured data expressed in RFC 5424 messages."},{"field":"log.syslog.version","type":"keyword","normalization":"","example":1,"description":"Syslog protocol version."},{"field":"network.application","type":"keyword","normalization":"","example":"aim","description":"Application level protocol name."},{"field":"network.bytes","type":"long","normalization":"","example":368,"description":"Total bytes transferred in both directions."},{"field":"network.community_id","type":"keyword","normalization":"","example":"1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=","description":"A hash of source and destination IPs and ports."},{"field":"network.direction","type":"keyword","normalization":"","example":"inbound","description":"Direction of the network traffic."},{"field":"network.forwarded_ip","type":"ip","normalization":"","example":"192.1.1.2","description":"Host IP address when the source IP address is the proxy."},{"field":"network.iana_number","type":"keyword","normalization":"","example":6,"description":"IANA Protocol Number."},{"field":"network.inner","type":"object","normalization":"","example":"","description":"Inner VLAN tag information"},{"field":"network.inner.vlan.id","type":"keyword","normalization":"","example":10,"description":"VLAN ID as reported by the observer."},{"field":"network.inner.vlan.name","type":"keyword","normalization":"","example":"outside","description":"Optional VLAN name as reported by the observer."},{"field":"network.name","type":"keyword","normalization":"","example":"Guest Wifi","description":"Name given by operators to sections of their network."},{"field":"network.packets","type":"long","normalization":"","example":24,"description":"Total packets transferred in both directions."},{"field":"network.protocol","type":"keyword","normalization":"","example":"http","description":"Application protocol name."},{"field":"network.transport","type":"keyword","normalization":"","example":"tcp","description":"Protocol Name corresponding to the field `iana_number`."},{"field":"network.type","type":"keyword","normalization":"","example":"ipv4","description":"In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc"},{"field":"network.vlan.id","type":"keyword","normalization":"","example":10,"description":"VLAN ID as reported by the observer."},{"field":"network.vlan.name","type":"keyword","normalization":"","example":"outside","description":"Optional VLAN name as reported by the observer."},{"field":"observer.egress","type":"object","normalization":"","example":"","description":"Object field for egress information"},{"field":"observer.egress.interface.alias","type":"keyword","normalization":"","example":"outside","description":"Interface alias"},{"field":"observer.egress.interface.id","type":"keyword","normalization":"","example":10,"description":"Interface ID"},{"field":"observer.egress.interface.name","type":"keyword","normalization":"","example":"eth0","description":"Interface name"},{"field":"observer.egress.vlan.id","type":"keyword","normalization":"","example":10,"description":"VLAN ID as reported by the observer."},{"field":"observer.egress.vlan.name","type":"keyword","normalization":"","example":"outside","description":"Optional VLAN name as reported by the observer."},{"field":"observer.egress.zone","type":"keyword","normalization":"","example":"Public_Internet","description":"Observer Egress zone"},{"field":"observer.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"observer.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"observer.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"observer.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"observer.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"observer.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"observer.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"observer.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"observer.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"observer.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"observer.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"observer.hostname","type":"keyword","normalization":"","example":"","description":"Hostname of the observer."},{"field":"observer.ingress","type":"object","normalization":"","example":"","description":"Object field for ingress information"},{"field":"observer.ingress.interface.alias","type":"keyword","normalization":"","example":"outside","description":"Interface alias"},{"field":"observer.ingress.interface.id","type":"keyword","normalization":"","example":10,"description":"Interface ID"},{"field":"observer.ingress.interface.name","type":"keyword","normalization":"","example":"eth0","description":"Interface name"},{"field":"observer.ingress.vlan.id","type":"keyword","normalization":"","example":10,"description":"VLAN ID as reported by the observer."},{"field":"observer.ingress.vlan.name","type":"keyword","normalization":"","example":"outside","description":"Optional VLAN name as reported by the observer."},{"field":"observer.ingress.zone","type":"keyword","normalization":"","example":"DMZ","description":"Observer ingress zone"},{"field":"observer.ip","type":"ip","normalization":"array","example":"","description":"IP addresses of the observer."},{"field":"observer.mac","type":"keyword","normalization":"array","example":["00-00-5E-00-53-23","00-00-5E-00-53-24"],"description":"MAC addresses of the observer."},{"field":"observer.name","type":"keyword","normalization":"","example":"1_proxySG","description":"Custom name of the observer."},{"field":"observer.os.family","type":"keyword","normalization":"","example":"debian","description":"OS family (such as redhat, debian, freebsd, windows)."},{"field":"observer.os.full","type":"keyword","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"observer.os.full.text","type":"match_only_text","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"observer.os.kernel","type":"keyword","normalization":"","example":"4.4.0-112-generic","description":"Operating system kernel version as a raw string."},{"field":"observer.os.name","type":"keyword","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"observer.os.name.text","type":"match_only_text","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"observer.os.platform","type":"keyword","normalization":"","example":"darwin","description":"Operating system platform (such centos, ubuntu, windows)."},{"field":"observer.os.type","type":"keyword","normalization":"","example":"macos","description":"Which commercial OS family (one of: linux, macos, unix, windows, ios or android)."},{"field":"observer.os.version","type":"keyword","normalization":"","example":"10.14.1","description":"Operating system version as a raw string."},{"field":"observer.product","type":"keyword","normalization":"","example":"s200","description":"The product name of the observer."},{"field":"observer.serial_number","type":"keyword","normalization":"","example":"","description":"Observer serial number."},{"field":"observer.type","type":"keyword","normalization":"","example":"firewall","description":"The type of the observer the data is coming from."},{"field":"observer.vendor","type":"keyword","normalization":"","example":"Symantec","description":"Vendor name of the observer."},{"field":"observer.version","type":"keyword","normalization":"","example":"","description":"Observer version."},{"field":"orchestrator.api_version","type":"keyword","normalization":"","example":"v1beta1","description":"API version being used to carry out the action"},{"field":"orchestrator.cluster.id","type":"keyword","normalization":"","example":"","description":"Unique ID of the cluster."},{"field":"orchestrator.cluster.name","type":"keyword","normalization":"","example":"","description":"Name of the cluster."},{"field":"orchestrator.cluster.url","type":"keyword","normalization":"","example":"","description":"URL of the API used to manage the cluster."},{"field":"orchestrator.cluster.version","type":"keyword","normalization":"","example":"","description":"The version of the cluster."},{"field":"orchestrator.namespace","type":"keyword","normalization":"","example":"kube-system","description":"Namespace in which the action is taking place."},{"field":"orchestrator.organization","type":"keyword","normalization":"","example":"elastic","description":"Organization affected by the event (for multi-tenant orchestrator setups)."},{"field":"orchestrator.resource.id","type":"keyword","normalization":"","example":"","description":"Unique ID of the resource being acted upon."},{"field":"orchestrator.resource.ip","type":"ip","normalization":"array","example":"","description":"IP address assigned to the resource associated with the event being observed."},{"field":"orchestrator.resource.name","type":"keyword","normalization":"","example":"test-pod-cdcws","description":"Name of the resource being acted upon."},{"field":"orchestrator.resource.parent.type","type":"keyword","normalization":"","example":"DaemonSet","description":"Type or kind of the parent resource associated with the event being observed."},{"field":"orchestrator.resource.type","type":"keyword","normalization":"","example":"service","description":"Type of resource being acted upon."},{"field":"orchestrator.type","type":"keyword","normalization":"","example":"kubernetes","description":"Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry)."},{"field":"organization.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the organization."},{"field":"organization.name","type":"keyword","normalization":"","example":"","description":"Organization name."},{"field":"organization.name.text","type":"match_only_text","normalization":"","example":"","description":"Organization name."},{"field":"package.architecture","type":"keyword","normalization":"","example":"x86_64","description":"Package architecture."},{"field":"package.build_version","type":"keyword","normalization":"","example":"36f4f7e89dd61b0988b12ee000b98966867710cd","description":"Build version information"},{"field":"package.checksum","type":"keyword","normalization":"","example":"68b329da9893e34099c7d8ad5cb9c940","description":"Checksum of the installed package for verification."},{"field":"package.description","type":"keyword","normalization":"","example":"Open source programming language to build simple/reliable/efficient software.","description":"Description of the package."},{"field":"package.install_scope","type":"keyword","normalization":"","example":"global","description":"Indicating how the package was installed, e.g. user-local, global."},{"field":"package.installed","type":"date","normalization":"","example":"","description":"Time when package was installed."},{"field":"package.license","type":"keyword","normalization":"","example":"Apache License 2.0","description":"Package license"},{"field":"package.name","type":"keyword","normalization":"","example":"go","description":"Package name"},{"field":"package.path","type":"keyword","normalization":"","example":"/usr/local/Cellar/go/1.12.9/","description":"Path where the package is installed."},{"field":"package.reference","type":"keyword","normalization":"","example":"https://golang.org","description":"Package home page or reference URL"},{"field":"package.size","type":"long","normalization":"","example":62231,"description":"Package size in bytes."},{"field":"package.type","type":"keyword","normalization":"","example":"rpm","description":"Package type"},{"field":"package.version","type":"keyword","normalization":"","example":"1.12.9","description":"Package version"},{"field":"process.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"process.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"process.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"process.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"process.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"process.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"process.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"process.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"process.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"process.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"process.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"process.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"process.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"process.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"process.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"process.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"process.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"process.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"process.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"process.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"process.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"process.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"process.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"process.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"process.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"process.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"process.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"process.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"process.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"process.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"process.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"process.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"process.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"process.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"process.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"process.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"process.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"process.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"process.end","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process ended."},{"field":"process.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.entry_leader.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.entry_leader.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.entry_leader.attested_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.attested_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.entry_leader.attested_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.attested_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.entry_leader.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.entry_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.entry_leader.entry_meta.source.ip","type":"ip","normalization":"","example":"","description":"IP address of the source."},{"field":"process.entry_leader.entry_meta.type","type":"keyword","normalization":"","example":"","description":"The entry type for the entry session leader."},{"field":"process.entry_leader.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.entry_leader.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.entry_leader.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.entry_leader.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.entry_leader.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.entry_leader.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.entry_leader.parent.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.entry_leader.parent.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.entry_leader.parent.session_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.entry_leader.parent.session_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.entry_leader.parent.session_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.entry_leader.parent.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.entry_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.entry_leader.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.entry_leader.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.entry_leader.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.same_as_process","type":"boolean","normalization":"","example":"True","description":"This boolean is used to identify if a leader process is the same as the top level process."},{"field":"process.entry_leader.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.entry_leader.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.entry_leader.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.entry_leader.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.entry_leader.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.entry_leader.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.entry_leader.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.entry_leader.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.entry_leader.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.entry_leader.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.env_vars","type":"keyword","normalization":"array","example":["PATH=/usr/local/bin:/usr/bin","USER=ubuntu"],"description":"Array of environment variable bindings."},{"field":"process.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.exit_code","type":"long","normalization":"","example":137,"description":"The exit code of the process."},{"field":"process.group_leader.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.group_leader.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.group_leader.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.group_leader.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.group_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.group_leader.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.group_leader.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.group_leader.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.group_leader.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.group_leader.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.group_leader.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.group_leader.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.group_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.group_leader.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.group_leader.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.group_leader.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.group_leader.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.same_as_process","type":"boolean","normalization":"","example":"True","description":"This boolean is used to identify if a leader process is the same as the top level process."},{"field":"process.group_leader.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.group_leader.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.group_leader.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.group_leader.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.group_leader.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.group_leader.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.group_leader.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.group_leader.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.group_leader.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.group_leader.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.group_leader.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.group_leader.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"process.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"process.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"process.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"process.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"process.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"process.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"process.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.parent.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.parent.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.parent.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"process.parent.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"process.parent.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"process.parent.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"process.parent.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"process.parent.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"process.parent.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"process.parent.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"process.parent.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"process.parent.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.parent.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.parent.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"process.parent.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"process.parent.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"process.parent.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"process.parent.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"process.parent.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"process.parent.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"process.parent.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"process.parent.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"process.parent.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"process.parent.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"process.parent.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"process.parent.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"process.parent.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"process.parent.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"process.parent.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"process.parent.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"process.parent.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"process.parent.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"process.parent.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"process.parent.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"process.parent.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"process.parent.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"process.parent.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"process.parent.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"process.parent.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"process.parent.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"process.parent.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"process.parent.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"process.parent.end","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process ended."},{"field":"process.parent.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.parent.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.parent.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.parent.exit_code","type":"long","normalization":"","example":137,"description":"The exit code of the process."},{"field":"process.parent.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.parent.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.parent.group_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.parent.group_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.parent.group_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.parent.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"process.parent.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"process.parent.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"process.parent.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"process.parent.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"process.parent.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"process.parent.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"process.parent.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.parent.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.parent.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.parent.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"process.parent.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"process.parent.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"process.parent.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"process.parent.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"process.parent.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"process.parent.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"process.parent.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"process.parent.pgid","type":"long","normalization":"","example":"","description":"Deprecated identifier of the group of processes the process belongs to."},{"field":"process.parent.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.parent.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.parent.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.parent.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.parent.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.parent.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.parent.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.parent.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.parent.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.parent.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.parent.thread.id","type":"long","normalization":"","example":4242,"description":"Thread ID."},{"field":"process.parent.thread.name","type":"keyword","normalization":"","example":"thread-0","description":"Thread name."},{"field":"process.parent.title","type":"keyword","normalization":"","example":"","description":"Process title."},{"field":"process.parent.title.text","type":"match_only_text","normalization":"","example":"","description":"Process title."},{"field":"process.parent.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.parent.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.parent.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.parent.uptime","type":"long","normalization":"","example":1325,"description":"Seconds the process has been up."},{"field":"process.parent.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.parent.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.parent.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"process.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"process.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"process.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"process.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"process.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"process.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"process.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"process.pgid","type":"long","normalization":"","example":"","description":"Deprecated identifier of the group of processes the process belongs to."},{"field":"process.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.previous.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.previous.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.previous.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.previous.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.session_leader.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.session_leader.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.session_leader.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.session_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.session_leader.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.session_leader.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.session_leader.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.session_leader.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.session_leader.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.session_leader.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.session_leader.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.session_leader.parent.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.session_leader.parent.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.session_leader.parent.session_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.session_leader.parent.session_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.session_leader.parent.session_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.session_leader.parent.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.session_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.session_leader.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.session_leader.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.session_leader.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.session_leader.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.same_as_process","type":"boolean","normalization":"","example":"True","description":"This boolean is used to identify if a leader process is the same as the top level process."},{"field":"process.session_leader.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.session_leader.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.session_leader.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.session_leader.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.session_leader.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.session_leader.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.session_leader.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.session_leader.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.session_leader.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.session_leader.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.session_leader.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.session_leader.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.thread.id","type":"long","normalization":"","example":4242,"description":"Thread ID."},{"field":"process.thread.name","type":"keyword","normalization":"","example":"thread-0","description":"Thread name."},{"field":"process.title","type":"keyword","normalization":"","example":"","description":"Process title."},{"field":"process.title.text","type":"match_only_text","normalization":"","example":"","description":"Process title."},{"field":"process.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.tty.columns","type":"long","normalization":"","example":80,"description":"The number of character columns per line. e.g terminal width"},{"field":"process.tty.rows","type":"long","normalization":"","example":24,"description":"The number of character rows in the terminal. e.g terminal height"},{"field":"process.uptime","type":"long","normalization":"","example":1325,"description":"Seconds the process has been up."},{"field":"process.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"registry.data.bytes","type":"keyword","normalization":"","example":"ZQBuAC0AVQBTAAAAZQBuAAAAAAA=","description":"Original bytes written with base64 encoding."},{"field":"registry.data.strings","type":"wildcard","normalization":"array","example":"[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]","description":"List of strings representing what was written to the registry."},{"field":"registry.data.type","type":"keyword","normalization":"","example":"REG_SZ","description":"Standard registry type for encoding contents"},{"field":"registry.hive","type":"keyword","normalization":"","example":"HKLM","description":"Abbreviated name for the hive."},{"field":"registry.key","type":"keyword","normalization":"","example":"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe","description":"Hive-relative path of keys."},{"field":"registry.path","type":"keyword","normalization":"","example":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger","description":"Full path, including hive, key and value"},{"field":"registry.value","type":"keyword","normalization":"","example":"Debugger","description":"Name of the value written."},{"field":"related.hash","type":"keyword","normalization":"array","example":"","description":"All the hashes seen on your event."},{"field":"related.hosts","type":"keyword","normalization":"array","example":"","description":"All the host identifiers seen on your event."},{"field":"related.ip","type":"ip","normalization":"array","example":"","description":"All of the IPs seen on your event."},{"field":"related.user","type":"keyword","normalization":"array","example":"","description":"All the user names or other user identifiers seen on the event."},{"field":"rule.author","type":"keyword","normalization":"array","example":["Star-Lord"],"description":"Rule author"},{"field":"rule.category","type":"keyword","normalization":"","example":"Attempted Information Leak","description":"Rule category"},{"field":"rule.description","type":"keyword","normalization":"","example":"Block requests to public DNS over HTTPS / TLS protocols","description":"Rule description"},{"field":"rule.id","type":"keyword","normalization":"","example":101,"description":"Rule ID"},{"field":"rule.license","type":"keyword","normalization":"","example":"Apache 2.0","description":"Rule license"},{"field":"rule.name","type":"keyword","normalization":"","example":"BLOCK_DNS_over_TLS","description":"Rule name"},{"field":"rule.reference","type":"keyword","normalization":"","example":"https://en.wikipedia.org/wiki/DNS_over_TLS","description":"Rule reference URL"},{"field":"rule.ruleset","type":"keyword","normalization":"","example":"Standard_Protocol_Filters","description":"Rule ruleset"},{"field":"rule.uuid","type":"keyword","normalization":"","example":1100110011,"description":"Rule UUID"},{"field":"rule.version","type":"keyword","normalization":"","example":1.1,"description":"Rule version"},{"field":"server.address","type":"keyword","normalization":"","example":"","description":"Server network address."},{"field":"server.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"server.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"server.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"server.bytes","type":"long","normalization":"","example":184,"description":"Bytes sent from the server to the client."},{"field":"server.domain","type":"keyword","normalization":"","example":"foo.example.com","description":"The domain name of the server."},{"field":"server.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"server.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"server.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"server.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"server.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"server.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"server.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"server.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"server.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"server.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"server.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"server.ip","type":"ip","normalization":"","example":"","description":"IP address of the server."},{"field":"server.mac","type":"keyword","normalization":"","example":"00-00-5E-00-53-23","description":"MAC address of the server."},{"field":"server.nat.ip","type":"ip","normalization":"","example":"","description":"Server NAT ip"},{"field":"server.nat.port","type":"long","normalization":"","example":"","description":"Server NAT port"},{"field":"server.packets","type":"long","normalization":"","example":12,"description":"Packets sent from the server to the client."},{"field":"server.port","type":"long","normalization":"","example":"","description":"Port of the server."},{"field":"server.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered server domain, stripped of the subdomain."},{"field":"server.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"server.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"server.user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"server.user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"server.user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"server.user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"server.user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"server.user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"server.user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"server.user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"server.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"server.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"server.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"server.user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"service.address","type":"keyword","normalization":"","example":"172.26.0.2:5432","description":"Address of this service."},{"field":"service.environment","type":"keyword","normalization":"","example":"production","description":"Environment of the service."},{"field":"service.ephemeral_id","type":"keyword","normalization":"","example":"8a4f500f","description":"Ephemeral identifier of this service."},{"field":"service.id","type":"keyword","normalization":"","example":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","description":"Unique identifier of the running service."},{"field":"service.name","type":"keyword","normalization":"","example":"elasticsearch-metrics","description":"Name of the service."},{"field":"service.node.name","type":"keyword","normalization":"","example":"instance-0000000016","description":"Name of the service node."},{"field":"service.node.role","type":"keyword","normalization":"","example":"background_tasks","description":"Deprecated role (singular) of the service node."},{"field":"service.node.roles","type":"keyword","normalization":"array","example":["ui","background_tasks"],"description":"Roles of the service node."},{"field":"service.origin.address","type":"keyword","normalization":"","example":"172.26.0.2:5432","description":"Address of this service."},{"field":"service.origin.environment","type":"keyword","normalization":"","example":"production","description":"Environment of the service."},{"field":"service.origin.ephemeral_id","type":"keyword","normalization":"","example":"8a4f500f","description":"Ephemeral identifier of this service."},{"field":"service.origin.id","type":"keyword","normalization":"","example":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","description":"Unique identifier of the running service."},{"field":"service.origin.name","type":"keyword","normalization":"","example":"elasticsearch-metrics","description":"Name of the service."},{"field":"service.origin.node.name","type":"keyword","normalization":"","example":"instance-0000000016","description":"Name of the service node."},{"field":"service.origin.node.role","type":"keyword","normalization":"","example":"background_tasks","description":"Deprecated role (singular) of the service node."},{"field":"service.origin.node.roles","type":"keyword","normalization":"array","example":["ui","background_tasks"],"description":"Roles of the service node."},{"field":"service.origin.state","type":"keyword","normalization":"","example":"","description":"Current state of the service."},{"field":"service.origin.type","type":"keyword","normalization":"","example":"elasticsearch","description":"The type of the service."},{"field":"service.origin.version","type":"keyword","normalization":"","example":"3.2.4","description":"Version of the service."},{"field":"service.state","type":"keyword","normalization":"","example":"","description":"Current state of the service."},{"field":"service.target.address","type":"keyword","normalization":"","example":"172.26.0.2:5432","description":"Address of this service."},{"field":"service.target.environment","type":"keyword","normalization":"","example":"production","description":"Environment of the service."},{"field":"service.target.ephemeral_id","type":"keyword","normalization":"","example":"8a4f500f","description":"Ephemeral identifier of this service."},{"field":"service.target.id","type":"keyword","normalization":"","example":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","description":"Unique identifier of the running service."},{"field":"service.target.name","type":"keyword","normalization":"","example":"elasticsearch-metrics","description":"Name of the service."},{"field":"service.target.node.name","type":"keyword","normalization":"","example":"instance-0000000016","description":"Name of the service node."},{"field":"service.target.node.role","type":"keyword","normalization":"","example":"background_tasks","description":"Deprecated role (singular) of the service node."},{"field":"service.target.node.roles","type":"keyword","normalization":"array","example":["ui","background_tasks"],"description":"Roles of the service node."},{"field":"service.target.state","type":"keyword","normalization":"","example":"","description":"Current state of the service."},{"field":"service.target.type","type":"keyword","normalization":"","example":"elasticsearch","description":"The type of the service."},{"field":"service.target.version","type":"keyword","normalization":"","example":"3.2.4","description":"Version of the service."},{"field":"service.type","type":"keyword","normalization":"","example":"elasticsearch","description":"The type of the service."},{"field":"service.version","type":"keyword","normalization":"","example":"3.2.4","description":"Version of the service."},{"field":"source.address","type":"keyword","normalization":"","example":"","description":"Source network address."},{"field":"source.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"source.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"source.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"source.bytes","type":"long","normalization":"","example":184,"description":"Bytes sent from the source to the destination."},{"field":"source.domain","type":"keyword","normalization":"","example":"foo.example.com","description":"The domain name of the source."},{"field":"source.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"source.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"source.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"source.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"source.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"source.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"source.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"source.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"source.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"source.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"source.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"source.ip","type":"ip","normalization":"","example":"","description":"IP address of the source."},{"field":"source.mac","type":"keyword","normalization":"","example":"00-00-5E-00-53-23","description":"MAC address of the source."},{"field":"source.nat.ip","type":"ip","normalization":"","example":"","description":"Source NAT ip"},{"field":"source.nat.port","type":"long","normalization":"","example":"","description":"Source NAT port"},{"field":"source.packets","type":"long","normalization":"","example":12,"description":"Packets sent from the source to the destination."},{"field":"source.port","type":"long","normalization":"","example":"","description":"Port of the source."},{"field":"source.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered source domain, stripped of the subdomain."},{"field":"source.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"source.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"source.user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"source.user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"source.user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"source.user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"source.user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"source.user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"source.user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"source.user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"source.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"source.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"source.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"source.user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"span.id","type":"keyword","normalization":"","example":"3ff9a8981b7ccd5a","description":"Unique identifier of the span within the scope of its trace."},{"field":"threat.enrichments","type":"nested","normalization":"array","example":"","description":"List of objects containing indicators enriching the event."},{"field":"threat.enrichments.indicator","type":"object","normalization":"","example":"","description":"Object containing indicators enriching the event."},{"field":"threat.enrichments.indicator.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"threat.enrichments.indicator.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"threat.enrichments.indicator.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"threat.enrichments.indicator.confidence","type":"keyword","normalization":"","example":"Medium","description":"Indicator confidence rating"},{"field":"threat.enrichments.indicator.description","type":"keyword","normalization":"","example":"IP x.x.x.x was observed delivering the Angler EK.","description":"Indicator description"},{"field":"threat.enrichments.indicator.email.address","type":"keyword","normalization":"","example":"phish@example.com","description":"Indicator email address"},{"field":"threat.enrichments.indicator.file.accessed","type":"date","normalization":"","example":"","description":"Last time the file was accessed."},{"field":"threat.enrichments.indicator.file.attributes","type":"keyword","normalization":"array","example":["readonly","system"],"description":"Array of file attributes."},{"field":"threat.enrichments.indicator.file.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"threat.enrichments.indicator.file.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"threat.enrichments.indicator.file.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"threat.enrichments.indicator.file.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"threat.enrichments.indicator.file.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"threat.enrichments.indicator.file.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"threat.enrichments.indicator.file.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"threat.enrichments.indicator.file.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"threat.enrichments.indicator.file.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"threat.enrichments.indicator.file.created","type":"date","normalization":"","example":"","description":"File creation time."},{"field":"threat.enrichments.indicator.file.ctime","type":"date","normalization":"","example":"","description":"Last time the file attributes or metadata changed."},{"field":"threat.enrichments.indicator.file.device","type":"keyword","normalization":"","example":"sda","description":"Device that is the source of the file."},{"field":"threat.enrichments.indicator.file.directory","type":"keyword","normalization":"","example":"/home/alice","description":"Directory where the file is located."},{"field":"threat.enrichments.indicator.file.drive_letter","type":"keyword","normalization":"","example":"C","description":"Drive letter where the file is located."},{"field":"threat.enrichments.indicator.file.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"threat.enrichments.indicator.file.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"threat.enrichments.indicator.file.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"threat.enrichments.indicator.file.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"threat.enrichments.indicator.file.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"threat.enrichments.indicator.file.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"threat.enrichments.indicator.file.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"threat.enrichments.indicator.file.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"threat.enrichments.indicator.file.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"threat.enrichments.indicator.file.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"threat.enrichments.indicator.file.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"threat.enrichments.indicator.file.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"threat.enrichments.indicator.file.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"threat.enrichments.indicator.file.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"threat.enrichments.indicator.file.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"threat.enrichments.indicator.file.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"threat.enrichments.indicator.file.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"threat.enrichments.indicator.file.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"threat.enrichments.indicator.file.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"threat.enrichments.indicator.file.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"threat.enrichments.indicator.file.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"threat.enrichments.indicator.file.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"threat.enrichments.indicator.file.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"threat.enrichments.indicator.file.extension","type":"keyword","normalization":"","example":"png","description":"File extension, excluding the leading dot."},{"field":"threat.enrichments.indicator.file.fork_name","type":"keyword","normalization":"","example":"Zone.Identifer","description":"A fork is additional data associated with a filesystem object."},{"field":"threat.enrichments.indicator.file.gid","type":"keyword","normalization":"","example":1001,"description":"Primary group ID (GID) of the file."},{"field":"threat.enrichments.indicator.file.group","type":"keyword","normalization":"","example":"alice","description":"Primary group name of the file."},{"field":"threat.enrichments.indicator.file.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"threat.enrichments.indicator.file.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"threat.enrichments.indicator.file.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"threat.enrichments.indicator.file.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"threat.enrichments.indicator.file.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"threat.enrichments.indicator.file.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"threat.enrichments.indicator.file.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"threat.enrichments.indicator.file.inode","type":"keyword","normalization":"","example":256383,"description":"Inode representing the file in the filesystem."},{"field":"threat.enrichments.indicator.file.mime_type","type":"keyword","normalization":"","example":"","description":"Media type of file, document, or arrangement of bytes."},{"field":"threat.enrichments.indicator.file.mode","type":"keyword","normalization":"","example":"0640","description":"Mode of the file in octal representation."},{"field":"threat.enrichments.indicator.file.mtime","type":"date","normalization":"","example":"","description":"Last time the file content was modified."},{"field":"threat.enrichments.indicator.file.name","type":"keyword","normalization":"","example":"example.png","description":"Name of the file including the extension, without the directory."},{"field":"threat.enrichments.indicator.file.owner","type":"keyword","normalization":"","example":"alice","description":"File owner's username."},{"field":"threat.enrichments.indicator.file.path","type":"keyword","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"threat.enrichments.indicator.file.path.text","type":"match_only_text","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"threat.enrichments.indicator.file.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"threat.enrichments.indicator.file.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"threat.enrichments.indicator.file.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"threat.enrichments.indicator.file.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"threat.enrichments.indicator.file.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"threat.enrichments.indicator.file.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"threat.enrichments.indicator.file.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"threat.enrichments.indicator.file.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"threat.enrichments.indicator.file.size","type":"long","normalization":"","example":16384,"description":"File size in bytes."},{"field":"threat.enrichments.indicator.file.target_path","type":"keyword","normalization":"","example":"","description":"Target path for symlinks."},{"field":"threat.enrichments.indicator.file.target_path.text","type":"match_only_text","normalization":"","example":"","description":"Target path for symlinks."},{"field":"threat.enrichments.indicator.file.type","type":"keyword","normalization":"","example":"file","description":"File type (file, dir, or symlink)."},{"field":"threat.enrichments.indicator.file.uid","type":"keyword","normalization":"","example":1001,"description":"The user ID (UID) or security identifier (SID) of the file owner."},{"field":"threat.enrichments.indicator.file.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"threat.enrichments.indicator.file.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"threat.enrichments.indicator.file.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"threat.enrichments.indicator.file.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"threat.enrichments.indicator.file.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"threat.enrichments.indicator.file.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"threat.enrichments.indicator.file.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"threat.enrichments.indicator.file.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.enrichments.indicator.file.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"threat.enrichments.indicator.file.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"threat.enrichments.indicator.file.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"threat.enrichments.indicator.file.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"threat.enrichments.indicator.file.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"threat.enrichments.indicator.file.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"threat.enrichments.indicator.file.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"threat.enrichments.indicator.file.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"threat.enrichments.indicator.file.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"threat.enrichments.indicator.file.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"threat.enrichments.indicator.file.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"threat.enrichments.indicator.file.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"threat.enrichments.indicator.file.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"threat.enrichments.indicator.file.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"threat.enrichments.indicator.file.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.enrichments.indicator.file.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"threat.enrichments.indicator.first_seen","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was first reported."},{"field":"threat.enrichments.indicator.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"threat.enrichments.indicator.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"threat.enrichments.indicator.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"threat.enrichments.indicator.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"threat.enrichments.indicator.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"threat.enrichments.indicator.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"threat.enrichments.indicator.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"threat.enrichments.indicator.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"threat.enrichments.indicator.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"threat.enrichments.indicator.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"threat.enrichments.indicator.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"threat.enrichments.indicator.ip","type":"ip","normalization":"","example":"1.2.3.4","description":"Indicator IP address"},{"field":"threat.enrichments.indicator.last_seen","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was last reported."},{"field":"threat.enrichments.indicator.marking.tlp","type":"keyword","normalization":"","example":"WHITE","description":"Indicator TLP marking"},{"field":"threat.enrichments.indicator.modified_at","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was last updated."},{"field":"threat.enrichments.indicator.port","type":"long","normalization":"","example":443,"description":"Indicator port"},{"field":"threat.enrichments.indicator.provider","type":"keyword","normalization":"","example":"lrz_urlhaus","description":"Indicator provider"},{"field":"threat.enrichments.indicator.reference","type":"keyword","normalization":"","example":"https://system.example.com/indicator/0001234","description":"Indicator reference URL"},{"field":"threat.enrichments.indicator.registry.data.bytes","type":"keyword","normalization":"","example":"ZQBuAC0AVQBTAAAAZQBuAAAAAAA=","description":"Original bytes written with base64 encoding."},{"field":"threat.enrichments.indicator.registry.data.strings","type":"wildcard","normalization":"array","example":"[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]","description":"List of strings representing what was written to the registry."},{"field":"threat.enrichments.indicator.registry.data.type","type":"keyword","normalization":"","example":"REG_SZ","description":"Standard registry type for encoding contents"},{"field":"threat.enrichments.indicator.registry.hive","type":"keyword","normalization":"","example":"HKLM","description":"Abbreviated name for the hive."},{"field":"threat.enrichments.indicator.registry.key","type":"keyword","normalization":"","example":"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe","description":"Hive-relative path of keys."},{"field":"threat.enrichments.indicator.registry.path","type":"keyword","normalization":"","example":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger","description":"Full path, including hive, key and value"},{"field":"threat.enrichments.indicator.registry.value","type":"keyword","normalization":"","example":"Debugger","description":"Name of the value written."},{"field":"threat.enrichments.indicator.scanner_stats","type":"long","normalization":"","example":4,"description":"Scanner statistics"},{"field":"threat.enrichments.indicator.sightings","type":"long","normalization":"","example":20,"description":"Number of times indicator observed"},{"field":"threat.enrichments.indicator.type","type":"keyword","normalization":"","example":"ipv4-addr","description":"Type of indicator"},{"field":"threat.enrichments.indicator.url.domain","type":"keyword","normalization":"","example":"www.elastic.co","description":"Domain of the url."},{"field":"threat.enrichments.indicator.url.extension","type":"keyword","normalization":"","example":"png","description":"File extension from the request url, excluding the leading dot."},{"field":"threat.enrichments.indicator.url.fragment","type":"keyword","normalization":"","example":"","description":"Portion of the url after the `#`."},{"field":"threat.enrichments.indicator.url.full","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"threat.enrichments.indicator.url.full.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"threat.enrichments.indicator.url.original","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"threat.enrichments.indicator.url.original.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"threat.enrichments.indicator.url.password","type":"keyword","normalization":"","example":"","description":"Password of the request."},{"field":"threat.enrichments.indicator.url.path","type":"wildcard","normalization":"","example":"","description":"Path of the request, such as \"/search\"."},{"field":"threat.enrichments.indicator.url.port","type":"long","normalization":"","example":443,"description":"Port of the request, such as 443."},{"field":"threat.enrichments.indicator.url.query","type":"keyword","normalization":"","example":"","description":"Query string of the request."},{"field":"threat.enrichments.indicator.url.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered url domain, stripped of the subdomain."},{"field":"threat.enrichments.indicator.url.scheme","type":"keyword","normalization":"","example":"https","description":"Scheme of the url."},{"field":"threat.enrichments.indicator.url.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"threat.enrichments.indicator.url.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"threat.enrichments.indicator.url.username","type":"keyword","normalization":"","example":"","description":"Username of the request."},{"field":"threat.enrichments.indicator.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"threat.enrichments.indicator.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"threat.enrichments.indicator.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"threat.enrichments.indicator.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"threat.enrichments.indicator.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"threat.enrichments.indicator.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"threat.enrichments.indicator.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"threat.enrichments.indicator.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.enrichments.indicator.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"threat.enrichments.indicator.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"threat.enrichments.indicator.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"threat.enrichments.indicator.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"threat.enrichments.indicator.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"threat.enrichments.indicator.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"threat.enrichments.indicator.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"threat.enrichments.indicator.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"threat.enrichments.indicator.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"threat.enrichments.indicator.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"threat.enrichments.indicator.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"threat.enrichments.indicator.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"threat.enrichments.indicator.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"threat.enrichments.indicator.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"threat.enrichments.indicator.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.enrichments.indicator.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"threat.enrichments.matched.atomic","type":"keyword","normalization":"","example":"bad-domain.com","description":"Matched indicator value"},{"field":"threat.enrichments.matched.field","type":"keyword","normalization":"","example":"file.hash.sha256","description":"Matched indicator field"},{"field":"threat.enrichments.matched.id","type":"keyword","normalization":"","example":"ff93aee5-86a1-4a61-b0e6-0cdc313d01b5","description":"Matched indicator identifier"},{"field":"threat.enrichments.matched.index","type":"keyword","normalization":"","example":"filebeat-8.0.0-2021.05.23-000011","description":"Matched indicator index"},{"field":"threat.enrichments.matched.occurred","type":"date","normalization":"","example":"2021-10-05T17:00:58.326Z","description":"Date of match"},{"field":"threat.enrichments.matched.type","type":"keyword","normalization":"","example":"indicator_match_rule","description":"Type of indicator match"},{"field":"threat.feed.dashboard_id","type":"keyword","normalization":"","example":"5ba16340-72e6-11eb-a3e3-b3cc7c78a70f","description":"Feed dashboard ID."},{"field":"threat.feed.description","type":"keyword","normalization":"","example":"Threat feed from the AlienVault Open Threat eXchange network.","description":"Description of the threat feed."},{"field":"threat.feed.name","type":"keyword","normalization":"","example":"AlienVault OTX","description":"Name of the threat feed."},{"field":"threat.feed.reference","type":"keyword","normalization":"","example":"https://otx.alienvault.com","description":"Reference for the threat feed."},{"field":"threat.framework","type":"keyword","normalization":"","example":"MITRE ATT&CK","description":"Threat classification framework."},{"field":"threat.group.alias","type":"keyword","normalization":"array","example":["Magecart Group 6"],"description":"Alias of the group."},{"field":"threat.group.id","type":"keyword","normalization":"","example":"G0037","description":"ID of the group."},{"field":"threat.group.name","type":"keyword","normalization":"","example":"FIN6","description":"Name of the group."},{"field":"threat.group.reference","type":"keyword","normalization":"","example":"https://attack.mitre.org/groups/G0037/","description":"Reference URL of the group."},{"field":"threat.indicator.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"threat.indicator.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"threat.indicator.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"threat.indicator.confidence","type":"keyword","normalization":"","example":"Medium","description":"Indicator confidence rating"},{"field":"threat.indicator.description","type":"keyword","normalization":"","example":"IP x.x.x.x was observed delivering the Angler EK.","description":"Indicator description"},{"field":"threat.indicator.email.address","type":"keyword","normalization":"","example":"phish@example.com","description":"Indicator email address"},{"field":"threat.indicator.file.accessed","type":"date","normalization":"","example":"","description":"Last time the file was accessed."},{"field":"threat.indicator.file.attributes","type":"keyword","normalization":"array","example":["readonly","system"],"description":"Array of file attributes."},{"field":"threat.indicator.file.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"threat.indicator.file.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"threat.indicator.file.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"threat.indicator.file.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"threat.indicator.file.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"threat.indicator.file.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"threat.indicator.file.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"threat.indicator.file.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"threat.indicator.file.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"threat.indicator.file.created","type":"date","normalization":"","example":"","description":"File creation time."},{"field":"threat.indicator.file.ctime","type":"date","normalization":"","example":"","description":"Last time the file attributes or metadata changed."},{"field":"threat.indicator.file.device","type":"keyword","normalization":"","example":"sda","description":"Device that is the source of the file."},{"field":"threat.indicator.file.directory","type":"keyword","normalization":"","example":"/home/alice","description":"Directory where the file is located."},{"field":"threat.indicator.file.drive_letter","type":"keyword","normalization":"","example":"C","description":"Drive letter where the file is located."},{"field":"threat.indicator.file.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"threat.indicator.file.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"threat.indicator.file.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"threat.indicator.file.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"threat.indicator.file.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"threat.indicator.file.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"threat.indicator.file.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"threat.indicator.file.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"threat.indicator.file.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"threat.indicator.file.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"threat.indicator.file.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"threat.indicator.file.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"threat.indicator.file.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"threat.indicator.file.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"threat.indicator.file.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"threat.indicator.file.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"threat.indicator.file.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"threat.indicator.file.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"threat.indicator.file.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"threat.indicator.file.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"threat.indicator.file.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"threat.indicator.file.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"threat.indicator.file.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"threat.indicator.file.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"threat.indicator.file.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"threat.indicator.file.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"threat.indicator.file.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"threat.indicator.file.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"threat.indicator.file.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"threat.indicator.file.extension","type":"keyword","normalization":"","example":"png","description":"File extension, excluding the leading dot."},{"field":"threat.indicator.file.fork_name","type":"keyword","normalization":"","example":"Zone.Identifer","description":"A fork is additional data associated with a filesystem object."},{"field":"threat.indicator.file.gid","type":"keyword","normalization":"","example":1001,"description":"Primary group ID (GID) of the file."},{"field":"threat.indicator.file.group","type":"keyword","normalization":"","example":"alice","description":"Primary group name of the file."},{"field":"threat.indicator.file.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"threat.indicator.file.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"threat.indicator.file.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"threat.indicator.file.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"threat.indicator.file.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"threat.indicator.file.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"threat.indicator.file.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"threat.indicator.file.inode","type":"keyword","normalization":"","example":256383,"description":"Inode representing the file in the filesystem."},{"field":"threat.indicator.file.mime_type","type":"keyword","normalization":"","example":"","description":"Media type of file, document, or arrangement of bytes."},{"field":"threat.indicator.file.mode","type":"keyword","normalization":"","example":"0640","description":"Mode of the file in octal representation."},{"field":"threat.indicator.file.mtime","type":"date","normalization":"","example":"","description":"Last time the file content was modified."},{"field":"threat.indicator.file.name","type":"keyword","normalization":"","example":"example.png","description":"Name of the file including the extension, without the directory."},{"field":"threat.indicator.file.owner","type":"keyword","normalization":"","example":"alice","description":"File owner's username."},{"field":"threat.indicator.file.path","type":"keyword","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"threat.indicator.file.path.text","type":"match_only_text","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"threat.indicator.file.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"threat.indicator.file.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"threat.indicator.file.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"threat.indicator.file.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"threat.indicator.file.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"threat.indicator.file.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"threat.indicator.file.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"threat.indicator.file.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"threat.indicator.file.size","type":"long","normalization":"","example":16384,"description":"File size in bytes."},{"field":"threat.indicator.file.target_path","type":"keyword","normalization":"","example":"","description":"Target path for symlinks."},{"field":"threat.indicator.file.target_path.text","type":"match_only_text","normalization":"","example":"","description":"Target path for symlinks."},{"field":"threat.indicator.file.type","type":"keyword","normalization":"","example":"file","description":"File type (file, dir, or symlink)."},{"field":"threat.indicator.file.uid","type":"keyword","normalization":"","example":1001,"description":"The user ID (UID) or security identifier (SID) of the file owner."},{"field":"threat.indicator.file.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"threat.indicator.file.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"threat.indicator.file.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"threat.indicator.file.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"threat.indicator.file.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"threat.indicator.file.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"threat.indicator.file.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"threat.indicator.file.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.indicator.file.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"threat.indicator.file.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"threat.indicator.file.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"threat.indicator.file.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"threat.indicator.file.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"threat.indicator.file.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"threat.indicator.file.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"threat.indicator.file.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"threat.indicator.file.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"threat.indicator.file.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"threat.indicator.file.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"threat.indicator.file.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"threat.indicator.file.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"threat.indicator.file.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"threat.indicator.file.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.indicator.file.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"threat.indicator.first_seen","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was first reported."},{"field":"threat.indicator.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"threat.indicator.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"threat.indicator.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"threat.indicator.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"threat.indicator.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"threat.indicator.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"threat.indicator.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"threat.indicator.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"threat.indicator.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"threat.indicator.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"threat.indicator.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"threat.indicator.ip","type":"ip","normalization":"","example":"1.2.3.4","description":"Indicator IP address"},{"field":"threat.indicator.last_seen","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was last reported."},{"field":"threat.indicator.marking.tlp","type":"keyword","normalization":"","example":"WHITE","description":"Indicator TLP marking"},{"field":"threat.indicator.modified_at","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was last updated."},{"field":"threat.indicator.port","type":"long","normalization":"","example":443,"description":"Indicator port"},{"field":"threat.indicator.provider","type":"keyword","normalization":"","example":"lrz_urlhaus","description":"Indicator provider"},{"field":"threat.indicator.reference","type":"keyword","normalization":"","example":"https://system.example.com/indicator/0001234","description":"Indicator reference URL"},{"field":"threat.indicator.registry.data.bytes","type":"keyword","normalization":"","example":"ZQBuAC0AVQBTAAAAZQBuAAAAAAA=","description":"Original bytes written with base64 encoding."},{"field":"threat.indicator.registry.data.strings","type":"wildcard","normalization":"array","example":"[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]","description":"List of strings representing what was written to the registry."},{"field":"threat.indicator.registry.data.type","type":"keyword","normalization":"","example":"REG_SZ","description":"Standard registry type for encoding contents"},{"field":"threat.indicator.registry.hive","type":"keyword","normalization":"","example":"HKLM","description":"Abbreviated name for the hive."},{"field":"threat.indicator.registry.key","type":"keyword","normalization":"","example":"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe","description":"Hive-relative path of keys."},{"field":"threat.indicator.registry.path","type":"keyword","normalization":"","example":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger","description":"Full path, including hive, key and value"},{"field":"threat.indicator.registry.value","type":"keyword","normalization":"","example":"Debugger","description":"Name of the value written."},{"field":"threat.indicator.scanner_stats","type":"long","normalization":"","example":4,"description":"Scanner statistics"},{"field":"threat.indicator.sightings","type":"long","normalization":"","example":20,"description":"Number of times indicator observed"},{"field":"threat.indicator.type","type":"keyword","normalization":"","example":"ipv4-addr","description":"Type of indicator"},{"field":"threat.indicator.url.domain","type":"keyword","normalization":"","example":"www.elastic.co","description":"Domain of the url."},{"field":"threat.indicator.url.extension","type":"keyword","normalization":"","example":"png","description":"File extension from the request url, excluding the leading dot."},{"field":"threat.indicator.url.fragment","type":"keyword","normalization":"","example":"","description":"Portion of the url after the `#`."},{"field":"threat.indicator.url.full","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"threat.indicator.url.full.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"threat.indicator.url.original","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"threat.indicator.url.original.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"threat.indicator.url.password","type":"keyword","normalization":"","example":"","description":"Password of the request."},{"field":"threat.indicator.url.path","type":"wildcard","normalization":"","example":"","description":"Path of the request, such as \"/search\"."},{"field":"threat.indicator.url.port","type":"long","normalization":"","example":443,"description":"Port of the request, such as 443."},{"field":"threat.indicator.url.query","type":"keyword","normalization":"","example":"","description":"Query string of the request."},{"field":"threat.indicator.url.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered url domain, stripped of the subdomain."},{"field":"threat.indicator.url.scheme","type":"keyword","normalization":"","example":"https","description":"Scheme of the url."},{"field":"threat.indicator.url.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"threat.indicator.url.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"threat.indicator.url.username","type":"keyword","normalization":"","example":"","description":"Username of the request."},{"field":"threat.indicator.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"threat.indicator.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"threat.indicator.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"threat.indicator.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"threat.indicator.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"threat.indicator.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"threat.indicator.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"threat.indicator.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.indicator.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"threat.indicator.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"threat.indicator.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"threat.indicator.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"threat.indicator.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"threat.indicator.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"threat.indicator.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"threat.indicator.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"threat.indicator.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"threat.indicator.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"threat.indicator.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"threat.indicator.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"threat.indicator.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"threat.indicator.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"threat.indicator.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.indicator.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"threat.software.alias","type":"keyword","normalization":"array","example":["X-Agent"],"description":"Alias of the software"},{"field":"threat.software.id","type":"keyword","normalization":"","example":"S0552","description":"ID of the software"},{"field":"threat.software.name","type":"keyword","normalization":"","example":"AdFind","description":"Name of the software."},{"field":"threat.software.platforms","type":"keyword","normalization":"array","example":["Windows"],"description":"Platforms of the software."},{"field":"threat.software.reference","type":"keyword","normalization":"","example":"https://attack.mitre.org/software/S0552/","description":"Software reference URL."},{"field":"threat.software.type","type":"keyword","normalization":"","example":"Tool","description":"Software type."},{"field":"threat.tactic.id","type":"keyword","normalization":"array","example":"TA0002","description":"Threat tactic id."},{"field":"threat.tactic.name","type":"keyword","normalization":"array","example":"Execution","description":"Threat tactic."},{"field":"threat.tactic.reference","type":"keyword","normalization":"array","example":"https://attack.mitre.org/tactics/TA0002/","description":"Threat tactic URL reference."},{"field":"threat.technique.id","type":"keyword","normalization":"array","example":"T1059","description":"Threat technique id."},{"field":"threat.technique.name","type":"keyword","normalization":"array","example":"Command and Scripting Interpreter","description":"Threat technique name."},{"field":"threat.technique.name.text","type":"match_only_text","normalization":"","example":"Command and Scripting Interpreter","description":"Threat technique name."},{"field":"threat.technique.reference","type":"keyword","normalization":"array","example":"https://attack.mitre.org/techniques/T1059/","description":"Threat technique URL reference."},{"field":"threat.technique.subtechnique.id","type":"keyword","normalization":"array","example":"T1059.001","description":"Threat subtechnique id."},{"field":"threat.technique.subtechnique.name","type":"keyword","normalization":"array","example":"PowerShell","description":"Threat subtechnique name."},{"field":"threat.technique.subtechnique.name.text","type":"match_only_text","normalization":"","example":"PowerShell","description":"Threat subtechnique name."},{"field":"threat.technique.subtechnique.reference","type":"keyword","normalization":"array","example":"https://attack.mitre.org/techniques/T1059/001/","description":"Threat subtechnique URL reference."},{"field":"tls.cipher","type":"keyword","normalization":"","example":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","description":"String indicating the cipher used during the current connection."},{"field":"tls.client.certificate","type":"keyword","normalization":"","example":"MII...","description":"PEM-encoded stand-alone certificate offered by the client."},{"field":"tls.client.certificate_chain","type":"keyword","normalization":"array","example":["MII...","MII..."],"description":"Array of PEM-encoded certificates that make up the certificate chain offered by the client."},{"field":"tls.client.hash.md5","type":"keyword","normalization":"","example":"0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC","description":"Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client."},{"field":"tls.client.hash.sha1","type":"keyword","normalization":"","example":"9E393D93138888D288266C2D915214D1D1CCEB2A","description":"Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client."},{"field":"tls.client.hash.sha256","type":"keyword","normalization":"","example":"0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0","description":"Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client."},{"field":"tls.client.issuer","type":"keyword","normalization":"","example":"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com","description":"Distinguished name of subject of the issuer of the x.509 certificate presented by the client."},{"field":"tls.client.ja3","type":"keyword","normalization":"","example":"d4e5b18d6b55c71272893221c96ba240","description":"A hash that identifies clients based on how they perform an SSL/TLS handshake."},{"field":"tls.client.not_after","type":"date","normalization":"","example":"2021-01-01T00:00:00.000Z","description":"Date/Time indicating when client certificate is no longer considered valid."},{"field":"tls.client.not_before","type":"date","normalization":"","example":"1970-01-01T00:00:00.000Z","description":"Date/Time indicating when client certificate is first considered valid."},{"field":"tls.client.server_name","type":"keyword","normalization":"","example":"www.elastic.co","description":"Hostname the client is trying to connect to. Also called the SNI."},{"field":"tls.client.subject","type":"keyword","normalization":"","example":"CN=myclient, OU=Documentation Team, DC=example, DC=com","description":"Distinguished name of subject of the x.509 certificate presented by the client."},{"field":"tls.client.supported_ciphers","type":"keyword","normalization":"array","example":["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","..."],"description":"Array of ciphers offered by the client during the client hello."},{"field":"tls.client.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"tls.client.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"tls.client.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"tls.client.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"tls.client.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"tls.client.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"tls.client.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"tls.client.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"tls.client.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"tls.client.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"tls.client.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"tls.client.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"tls.client.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"tls.client.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"tls.client.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"tls.client.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"tls.client.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"tls.client.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"tls.client.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"tls.client.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"tls.client.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"tls.client.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"tls.client.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"tls.client.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"tls.curve","type":"keyword","normalization":"","example":"secp256r1","description":"String indicating the curve used for the given cipher, when applicable."},{"field":"tls.established","type":"boolean","normalization":"","example":"","description":"Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel."},{"field":"tls.next_protocol","type":"keyword","normalization":"","example":"http/1.1","description":"String indicating the protocol being tunneled."},{"field":"tls.resumed","type":"boolean","normalization":"","example":"","description":"Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation."},{"field":"tls.server.certificate","type":"keyword","normalization":"","example":"MII...","description":"PEM-encoded stand-alone certificate offered by the server."},{"field":"tls.server.certificate_chain","type":"keyword","normalization":"array","example":["MII...","MII..."],"description":"Array of PEM-encoded certificates that make up the certificate chain offered by the server."},{"field":"tls.server.hash.md5","type":"keyword","normalization":"","example":"0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC","description":"Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server."},{"field":"tls.server.hash.sha1","type":"keyword","normalization":"","example":"9E393D93138888D288266C2D915214D1D1CCEB2A","description":"Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server."},{"field":"tls.server.hash.sha256","type":"keyword","normalization":"","example":"0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0","description":"Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server."},{"field":"tls.server.issuer","type":"keyword","normalization":"","example":"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com","description":"Subject of the issuer of the x.509 certificate presented by the server."},{"field":"tls.server.ja3s","type":"keyword","normalization":"","example":"394441ab65754e2207b1e1b457b3641d","description":"A hash that identifies servers based on how they perform an SSL/TLS handshake."},{"field":"tls.server.not_after","type":"date","normalization":"","example":"2021-01-01T00:00:00.000Z","description":"Timestamp indicating when server certificate is no longer considered valid."},{"field":"tls.server.not_before","type":"date","normalization":"","example":"1970-01-01T00:00:00.000Z","description":"Timestamp indicating when server certificate is first considered valid."},{"field":"tls.server.subject","type":"keyword","normalization":"","example":"CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com","description":"Subject of the x.509 certificate presented by the server."},{"field":"tls.server.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"tls.server.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"tls.server.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"tls.server.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"tls.server.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"tls.server.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"tls.server.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"tls.server.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"tls.server.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"tls.server.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"tls.server.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"tls.server.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"tls.server.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"tls.server.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"tls.server.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"tls.server.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"tls.server.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"tls.server.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"tls.server.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"tls.server.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"tls.server.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"tls.server.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"tls.server.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"tls.server.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"tls.version","type":"keyword","normalization":"","example":1.2,"description":"Numeric part of the version parsed from the original string."},{"field":"tls.version_protocol","type":"keyword","normalization":"","example":"tls","description":"Normalized lowercase protocol name parsed from original string."},{"field":"trace.id","type":"keyword","normalization":"","example":"4bf92f3577b34da6a3ce929d0e0e4736","description":"Unique identifier of the trace."},{"field":"transaction.id","type":"keyword","normalization":"","example":"00f067aa0ba902b7","description":"Unique identifier of the transaction within the scope of its trace."},{"field":"url.domain","type":"keyword","normalization":"","example":"www.elastic.co","description":"Domain of the url."},{"field":"url.extension","type":"keyword","normalization":"","example":"png","description":"File extension from the request url, excluding the leading dot."},{"field":"url.fragment","type":"keyword","normalization":"","example":"","description":"Portion of the url after the `#`."},{"field":"url.full","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"url.full.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"url.original","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"url.original.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"url.password","type":"keyword","normalization":"","example":"","description":"Password of the request."},{"field":"url.path","type":"wildcard","normalization":"","example":"","description":"Path of the request, such as \"/search\"."},{"field":"url.port","type":"long","normalization":"","example":443,"description":"Port of the request, such as 443."},{"field":"url.query","type":"keyword","normalization":"","example":"","description":"Query string of the request."},{"field":"url.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered url domain, stripped of the subdomain."},{"field":"url.scheme","type":"keyword","normalization":"","example":"https","description":"Scheme of the url."},{"field":"url.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"url.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"url.username","type":"keyword","normalization":"","example":"","description":"Username of the request."},{"field":"user.changes.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"user.changes.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"user.changes.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.changes.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.changes.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"user.changes.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"user.changes.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"user.changes.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"user.changes.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"user.changes.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.changes.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.changes.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"user.effective.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"user.effective.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"user.effective.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.effective.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.effective.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"user.effective.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"user.effective.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"user.effective.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"user.effective.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"user.effective.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.effective.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.effective.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.risk.calculated_level","type":"keyword","normalization":"","example":"High","description":"A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring."},{"field":"user.risk.calculated_score","type":"float","normalization":"","example":880.73,"description":"A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring."},{"field":"user.risk.calculated_score_norm","type":"float","normalization":"","example":88.73,"description":"A normalized risk score calculated by an internal system."},{"field":"user.risk.static_level","type":"keyword","normalization":"","example":"High","description":"A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform."},{"field":"user.risk.static_score","type":"float","normalization":"","example":830,"description":"A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform."},{"field":"user.risk.static_score_norm","type":"float","normalization":"","example":83,"description":"A normalized risk score calculated by an external system."},{"field":"user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"user.target.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"user.target.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"user.target.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.target.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.target.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"user.target.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"user.target.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"user.target.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"user.target.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"user.target.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.target.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.target.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"user_agent.device.name","type":"keyword","normalization":"","example":"iPhone","description":"Name of the device."},{"field":"user_agent.name","type":"keyword","normalization":"","example":"Safari","description":"Name of the user agent."},{"field":"user_agent.original","type":"keyword","normalization":"","example":"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1","description":"Unparsed user_agent string."},{"field":"user_agent.original.text","type":"match_only_text","normalization":"","example":"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1","description":"Unparsed user_agent string."},{"field":"user_agent.os.family","type":"keyword","normalization":"","example":"debian","description":"OS family (such as redhat, debian, freebsd, windows)."},{"field":"user_agent.os.full","type":"keyword","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"user_agent.os.full.text","type":"match_only_text","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"user_agent.os.kernel","type":"keyword","normalization":"","example":"4.4.0-112-generic","description":"Operating system kernel version as a raw string."},{"field":"user_agent.os.name","type":"keyword","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"user_agent.os.name.text","type":"match_only_text","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"user_agent.os.platform","type":"keyword","normalization":"","example":"darwin","description":"Operating system platform (such centos, ubuntu, windows)."},{"field":"user_agent.os.type","type":"keyword","normalization":"","example":"macos","description":"Which commercial OS family (one of: linux, macos, unix, windows, ios or android)."},{"field":"user_agent.os.version","type":"keyword","normalization":"","example":"10.14.1","description":"Operating system version as a raw string."},{"field":"user_agent.version","type":"keyword","normalization":"","example":12,"description":"Version of the user agent."},{"field":"vulnerability.category","type":"keyword","normalization":"array","example":["Firewall"],"description":"Category of a vulnerability."},{"field":"vulnerability.classification","type":"keyword","normalization":"","example":"CVSS","description":"Classification of the vulnerability."},{"field":"vulnerability.description","type":"keyword","normalization":"","example":"In macOS before 2.12.6, there is a vulnerability in the RPC...","description":"Description of the vulnerability."},{"field":"vulnerability.description.text","type":"match_only_text","normalization":"","example":"In macOS before 2.12.6, there is a vulnerability in the RPC...","description":"Description of the vulnerability."},{"field":"vulnerability.enumeration","type":"keyword","normalization":"","example":"CVE","description":"Identifier of the vulnerability."},{"field":"vulnerability.id","type":"keyword","normalization":"","example":"CVE-2019-00001","description":"ID of the vulnerability."},{"field":"vulnerability.reference","type":"keyword","normalization":"","example":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111","description":"Reference of the vulnerability."},{"field":"vulnerability.report_id","type":"keyword","normalization":"","example":20191018.0001,"description":"Scan identification number."},{"field":"vulnerability.scanner.vendor","type":"keyword","normalization":"","example":"Tenable","description":"Name of the scanner vendor."},{"field":"vulnerability.score.base","type":"float","normalization":"","example":5.5,"description":"Vulnerability Base score."},{"field":"vulnerability.score.environmental","type":"float","normalization":"","example":5.5,"description":"Vulnerability Environmental score."},{"field":"vulnerability.score.temporal","type":"float","normalization":"","example":"","description":"Vulnerability Temporal score."},{"field":"vulnerability.score.version","type":"keyword","normalization":"","example":2,"description":"CVSS version."},{"field":"vulnerability.severity","type":"keyword","normalization":"","example":"Critical","description":"Severity of the vulnerability."}]
\ No newline at end of file
diff --git a/x-pack/plugins/osquery/public/common/schemas/ecs/v8.7.0.json b/x-pack/plugins/osquery/public/common/schemas/ecs/v8.7.0.json
new file mode 100644
index 0000000000000..0961ad25572a4
--- /dev/null
+++ b/x-pack/plugins/osquery/public/common/schemas/ecs/v8.7.0.json
@@ -0,0 +1 @@
+[{"field":"labels","type":"object","normalization":"","example":{"application":"foo-bar","env":"production"},"description":"Custom key/value pairs."},{"field":"message","type":"match_only_text","normalization":"","example":"Hello World","description":"Log message optimized for viewing in a log viewer."},{"field":"tags","type":"keyword","normalization":"array","example":["production","env2"],"description":"List of keywords used to tag each event."},{"field":"agent.build.original","type":"keyword","normalization":"","example":"metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]","description":"Extended build information for the agent."},{"field":"client.address","type":"keyword","normalization":"","example":"","description":"Client network address."},{"field":"client.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"client.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"client.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"client.bytes","type":"long","normalization":"","example":184,"description":"Bytes sent from the client to the server."},{"field":"client.domain","type":"keyword","normalization":"","example":"foo.example.com","description":"The domain name of the client."},{"field":"client.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"client.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"client.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"client.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"client.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"client.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"client.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"client.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"client.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"client.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"client.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"client.ip","type":"ip","normalization":"","example":"","description":"IP address of the client."},{"field":"client.mac","type":"keyword","normalization":"","example":"00-00-5E-00-53-23","description":"MAC address of the client."},{"field":"client.nat.ip","type":"ip","normalization":"","example":"","description":"Client NAT ip address"},{"field":"client.nat.port","type":"long","normalization":"","example":"","description":"Client NAT port"},{"field":"client.packets","type":"long","normalization":"","example":12,"description":"Packets sent from the client to the server."},{"field":"client.port","type":"long","normalization":"","example":"","description":"Port of the client."},{"field":"client.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered client domain, stripped of the subdomain."},{"field":"client.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"client.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"client.user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"client.user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"client.user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"client.user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"client.user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"client.user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"client.user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"client.user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"client.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"client.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"client.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"client.user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"cloud.account.id","type":"keyword","normalization":"","example":666777888999,"description":"The cloud account or organization id."},{"field":"cloud.account.name","type":"keyword","normalization":"","example":"elastic-dev","description":"The cloud account name."},{"field":"cloud.availability_zone","type":"keyword","normalization":"","example":"us-east-1c","description":"Availability zone in which this host, resource, or service is located."},{"field":"cloud.instance.id","type":"keyword","normalization":"","example":"i-1234567890abcdef0","description":"Instance ID of the host machine."},{"field":"cloud.instance.name","type":"keyword","normalization":"","example":"","description":"Instance name of the host machine."},{"field":"cloud.machine.type","type":"keyword","normalization":"","example":"t2.medium","description":"Machine type of the host machine."},{"field":"cloud.origin.account.id","type":"keyword","normalization":"","example":666777888999,"description":"The cloud account or organization id."},{"field":"cloud.origin.account.name","type":"keyword","normalization":"","example":"elastic-dev","description":"The cloud account name."},{"field":"cloud.origin.availability_zone","type":"keyword","normalization":"","example":"us-east-1c","description":"Availability zone in which this host, resource, or service is located."},{"field":"cloud.origin.instance.id","type":"keyword","normalization":"","example":"i-1234567890abcdef0","description":"Instance ID of the host machine."},{"field":"cloud.origin.instance.name","type":"keyword","normalization":"","example":"","description":"Instance name of the host machine."},{"field":"cloud.origin.machine.type","type":"keyword","normalization":"","example":"t2.medium","description":"Machine type of the host machine."},{"field":"cloud.origin.project.id","type":"keyword","normalization":"","example":"my-project","description":"The cloud project id."},{"field":"cloud.origin.project.name","type":"keyword","normalization":"","example":"my project","description":"The cloud project name."},{"field":"cloud.origin.provider","type":"keyword","normalization":"","example":"aws","description":"Name of the cloud provider."},{"field":"cloud.origin.region","type":"keyword","normalization":"","example":"us-east-1","description":"Region in which this host, resource, or service is located."},{"field":"cloud.origin.service.name","type":"keyword","normalization":"","example":"lambda","description":"The cloud service name."},{"field":"cloud.project.id","type":"keyword","normalization":"","example":"my-project","description":"The cloud project id."},{"field":"cloud.project.name","type":"keyword","normalization":"","example":"my project","description":"The cloud project name."},{"field":"cloud.provider","type":"keyword","normalization":"","example":"aws","description":"Name of the cloud provider."},{"field":"cloud.region","type":"keyword","normalization":"","example":"us-east-1","description":"Region in which this host, resource, or service is located."},{"field":"cloud.service.name","type":"keyword","normalization":"","example":"lambda","description":"The cloud service name."},{"field":"cloud.target.account.id","type":"keyword","normalization":"","example":666777888999,"description":"The cloud account or organization id."},{"field":"cloud.target.account.name","type":"keyword","normalization":"","example":"elastic-dev","description":"The cloud account name."},{"field":"cloud.target.availability_zone","type":"keyword","normalization":"","example":"us-east-1c","description":"Availability zone in which this host, resource, or service is located."},{"field":"cloud.target.instance.id","type":"keyword","normalization":"","example":"i-1234567890abcdef0","description":"Instance ID of the host machine."},{"field":"cloud.target.instance.name","type":"keyword","normalization":"","example":"","description":"Instance name of the host machine."},{"field":"cloud.target.machine.type","type":"keyword","normalization":"","example":"t2.medium","description":"Machine type of the host machine."},{"field":"cloud.target.project.id","type":"keyword","normalization":"","example":"my-project","description":"The cloud project id."},{"field":"cloud.target.project.name","type":"keyword","normalization":"","example":"my project","description":"The cloud project name."},{"field":"cloud.target.provider","type":"keyword","normalization":"","example":"aws","description":"Name of the cloud provider."},{"field":"cloud.target.region","type":"keyword","normalization":"","example":"us-east-1","description":"Region in which this host, resource, or service is located."},{"field":"cloud.target.service.name","type":"keyword","normalization":"","example":"lambda","description":"The cloud service name."},{"field":"container.cpu.usage","type":"scaled_float","normalization":"","example":"","description":"Percent CPU used, between 0 and 1."},{"field":"container.disk.read.bytes","type":"long","normalization":"","example":"","description":"The number of bytes read by all disks."},{"field":"container.disk.write.bytes","type":"long","normalization":"","example":"","description":"The number of bytes written on all disks."},{"field":"container.id","type":"keyword","normalization":"","example":"","description":"Unique container id."},{"field":"container.image.hash.all","type":"keyword","normalization":"array","example":"[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]","description":"An array of digests of the image the container was built on."},{"field":"container.image.name","type":"keyword","normalization":"","example":"","description":"Name of the image the container was built on."},{"field":"container.image.tag","type":"keyword","normalization":"array","example":"","description":"Container image tags."},{"field":"container.labels","type":"object","normalization":"","example":"","description":"Image labels."},{"field":"container.memory.usage","type":"scaled_float","normalization":"","example":"","description":"Percent memory used, between 0 and 1."},{"field":"container.name","type":"keyword","normalization":"","example":"","description":"Container name."},{"field":"container.network.egress.bytes","type":"long","normalization":"","example":"","description":"The number of bytes sent on all network interfaces."},{"field":"container.network.ingress.bytes","type":"long","normalization":"","example":"","description":"The number of bytes received on all network interfaces."},{"field":"container.runtime","type":"keyword","normalization":"","example":"docker","description":"Runtime managing this container."},{"field":"data_stream.dataset","type":"constant_keyword","normalization":"","example":"nginx.access","description":"The field can contain anything that makes sense to signify the source of the data."},{"field":"data_stream.namespace","type":"constant_keyword","normalization":"","example":"production","description":"A user defined namespace. Namespaces are useful to allow grouping of data."},{"field":"data_stream.type","type":"constant_keyword","normalization":"","example":"logs","description":"An overarching type for the data stream."},{"field":"destination.address","type":"keyword","normalization":"","example":"","description":"Destination network address."},{"field":"destination.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"destination.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"destination.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"destination.bytes","type":"long","normalization":"","example":184,"description":"Bytes sent from the destination to the source."},{"field":"destination.domain","type":"keyword","normalization":"","example":"foo.example.com","description":"The domain name of the destination."},{"field":"destination.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"destination.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"destination.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"destination.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"destination.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"destination.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"destination.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"destination.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"destination.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"destination.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"destination.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"destination.ip","type":"ip","normalization":"","example":"","description":"IP address of the destination."},{"field":"destination.mac","type":"keyword","normalization":"","example":"00-00-5E-00-53-23","description":"MAC address of the destination."},{"field":"destination.nat.ip","type":"ip","normalization":"","example":"","description":"Destination NAT ip"},{"field":"destination.nat.port","type":"long","normalization":"","example":"","description":"Destination NAT Port"},{"field":"destination.packets","type":"long","normalization":"","example":12,"description":"Packets sent from the destination to the source."},{"field":"destination.port","type":"long","normalization":"","example":"","description":"Port of the destination."},{"field":"destination.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered destination domain, stripped of the subdomain."},{"field":"destination.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"destination.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"destination.user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"destination.user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"destination.user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"destination.user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"destination.user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"destination.user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"destination.user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"destination.user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"destination.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"destination.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"destination.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"destination.user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"device.id","type":"keyword","normalization":"","example":"00000000-54b3-e7c7-0000-000046bffd97","description":"The unique identifier of a device."},{"field":"device.manufacturer","type":"keyword","normalization":"","example":"Samsung","description":"The vendor name of the device manufacturer."},{"field":"device.model.identifier","type":"keyword","normalization":"","example":"SM-G920F","description":"The machine readable identifier of the device model."},{"field":"device.model.name","type":"keyword","normalization":"","example":"Samsung Galaxy S6","description":"The human readable marketing name of the device model."},{"field":"dll.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"dll.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"dll.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"dll.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"dll.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"dll.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"dll.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"dll.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"dll.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"dll.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"dll.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"dll.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"dll.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"dll.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"dll.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"dll.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"dll.name","type":"keyword","normalization":"","example":"kernel32.dll","description":"Name of the library."},{"field":"dll.path","type":"keyword","normalization":"","example":"C:\\Windows\\System32\\kernel32.dll","description":"Full file path of the library."},{"field":"dll.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"dll.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"dll.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"dll.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"dll.pe.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a PE file."},{"field":"dll.pe.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"dll.pe.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"dll.pe.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"dll.pe.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"dll.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"dll.pe.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a PE file."},{"field":"dll.pe.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"dll.pe.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"dll.pe.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"dll.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"dll.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"dll.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"dll.pe.sections","type":"nested","normalization":"array","example":"","description":"Section information of the PE file."},{"field":"dll.pe.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"dll.pe.sections.name","type":"keyword","normalization":"","example":"","description":"PE Section List name."},{"field":"dll.pe.sections.physical_size","type":"long","normalization":"","example":"","description":"PE Section List physical size."},{"field":"dll.pe.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"dll.pe.sections.virtual_size","type":"long","normalization":"","example":"","description":"PE Section List virtual size. This is always the same as `physical_size`."},{"field":"dns.answers","type":"object","normalization":"array","example":"","description":"Array of DNS answers."},{"field":"dns.answers.class","type":"keyword","normalization":"","example":"IN","description":"The class of DNS data contained in this resource record."},{"field":"dns.answers.data","type":"keyword","normalization":"","example":"10.10.10.10","description":"The data describing the resource."},{"field":"dns.answers.name","type":"keyword","normalization":"","example":"www.example.com","description":"The domain name to which this resource record pertains."},{"field":"dns.answers.ttl","type":"long","normalization":"","example":180,"description":"The time interval in seconds that this resource record may be cached before it should be discarded."},{"field":"dns.answers.type","type":"keyword","normalization":"","example":"CNAME","description":"The type of data contained in this resource record."},{"field":"dns.header_flags","type":"keyword","normalization":"array","example":["RD","RA"],"description":"Array of DNS header flags."},{"field":"dns.id","type":"keyword","normalization":"","example":62111,"description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response."},{"field":"dns.op_code","type":"keyword","normalization":"","example":"QUERY","description":"The DNS operation code that specifies the kind of query in the message."},{"field":"dns.question.class","type":"keyword","normalization":"","example":"IN","description":"The class of records being queried."},{"field":"dns.question.name","type":"keyword","normalization":"","example":"www.example.com","description":"The name being queried."},{"field":"dns.question.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered domain, stripped of the subdomain."},{"field":"dns.question.subdomain","type":"keyword","normalization":"","example":"www","description":"The subdomain of the domain."},{"field":"dns.question.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"dns.question.type","type":"keyword","normalization":"","example":"AAAA","description":"The type of record being queried."},{"field":"dns.resolved_ip","type":"ip","normalization":"array","example":["10.10.10.10","10.10.10.11"],"description":"Array containing all IPs seen in answers.data"},{"field":"dns.response_code","type":"keyword","normalization":"","example":"NOERROR","description":"The DNS response code."},{"field":"dns.type","type":"keyword","normalization":"","example":"answer","description":"The type of DNS event captured, query or answer."},{"field":"email.attachments","type":"nested","normalization":"array","example":"","description":"List of objects describing the attachments."},{"field":"email.attachments.file.extension","type":"keyword","normalization":"","example":"txt","description":"Attachment file extension."},{"field":"email.attachments.file.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"email.attachments.file.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"email.attachments.file.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"email.attachments.file.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"email.attachments.file.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"email.attachments.file.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"email.attachments.file.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"email.attachments.file.mime_type","type":"keyword","normalization":"","example":"text/plain","description":"MIME type of the attachment file."},{"field":"email.attachments.file.name","type":"keyword","normalization":"","example":"attachment.txt","description":"Name of the attachment file."},{"field":"email.attachments.file.size","type":"long","normalization":"","example":64329,"description":"Attachment file size."},{"field":"email.bcc.address","type":"keyword","normalization":"array","example":"bcc.user1@example.com","description":"Email address of BCC recipient"},{"field":"email.cc.address","type":"keyword","normalization":"array","example":"cc.user1@example.com","description":"Email address of CC recipient"},{"field":"email.content_type","type":"keyword","normalization":"","example":"text/plain","description":"MIME type of the email message."},{"field":"email.delivery_timestamp","type":"date","normalization":"","example":"2020-11-10T22:12:34.8196921Z","description":"Date and time when message was delivered."},{"field":"email.direction","type":"keyword","normalization":"","example":"inbound","description":"Direction of the message."},{"field":"email.from.address","type":"keyword","normalization":"array","example":"sender@example.com","description":"The sender's email address."},{"field":"email.local_id","type":"keyword","normalization":"","example":"c26dbea0-80d5-463b-b93c-4e8b708219ce","description":"Unique identifier given by the source."},{"field":"email.message_id","type":"wildcard","normalization":"","example":"81ce15$8r2j59@mail01.example.com","description":"Value from the Message-ID header."},{"field":"email.origination_timestamp","type":"date","normalization":"","example":"2020-11-10T22:12:34.8196921Z","description":"Date and time the email was composed."},{"field":"email.reply_to.address","type":"keyword","normalization":"array","example":"reply.here@example.com","description":"Address replies should be delivered to."},{"field":"email.sender.address","type":"keyword","normalization":"","example":"","description":"Address of the message sender."},{"field":"email.subject","type":"keyword","normalization":"","example":"Please see this important message.","description":"The subject of the email message."},{"field":"email.subject.text","type":"match_only_text","normalization":"","example":"Please see this important message.","description":"The subject of the email message."},{"field":"email.to.address","type":"keyword","normalization":"array","example":"user1@example.com","description":"Email address of recipient"},{"field":"email.x_mailer","type":"keyword","normalization":"","example":"Spambot v2.5","description":"Application that drafted email."},{"field":"error.code","type":"keyword","normalization":"","example":"","description":"Error code describing the error."},{"field":"error.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the error."},{"field":"error.message","type":"match_only_text","normalization":"","example":"","description":"Error message."},{"field":"error.stack_trace","type":"wildcard","normalization":"","example":"","description":"The stack trace of this error in plain text."},{"field":"error.stack_trace.text","type":"match_only_text","normalization":"","example":"","description":"The stack trace of this error in plain text."},{"field":"error.type","type":"keyword","normalization":"","example":"java.lang.NullPointerException","description":"The type of the error, for example the class name of the exception."},{"field":"event.action","type":"keyword","normalization":"","example":"user-password-change","description":"The action captured by the event."},{"field":"event.category","type":"keyword","normalization":"array","example":"authentication","description":"Event category. The second categorization field in the hierarchy."},{"field":"event.code","type":"keyword","normalization":"","example":4648,"description":"Identification code for this event."},{"field":"event.created","type":"date","normalization":"","example":"2016-05-23T08:05:34.857Z","description":"Time when the event was first read by an agent or by your pipeline."},{"field":"event.dataset","type":"keyword","normalization":"","example":"apache.access","description":"Name of the dataset."},{"field":"event.duration","type":"long","normalization":"","example":"","description":"Duration of the event in nanoseconds."},{"field":"event.end","type":"date","normalization":"","example":"","description":"event.end contains the date when the event ended or when the activity was last observed."},{"field":"event.hash","type":"keyword","normalization":"","example":"123456789012345678901234567890ABCD","description":"Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity."},{"field":"event.id","type":"keyword","normalization":"","example":"8a4f500d","description":"Unique ID to describe the event."},{"field":"event.kind","type":"keyword","normalization":"","example":"alert","description":"The kind of the event. The highest categorization field in the hierarchy."},{"field":"event.original","type":"keyword","normalization":"","example":"Sep 19 08:26:10 host CEF:0&#124;Security&#124; threatmanager&#124;1.0&#124;100&#124; worm successfully stopped&#124;10&#124;src=10.0.0.1 dst=2.1.2.2spt=1232","description":"Raw text message of entire event."},{"field":"event.outcome","type":"keyword","normalization":"","example":"success","description":"The outcome of the event. The lowest level categorization field in the hierarchy."},{"field":"event.provider","type":"keyword","normalization":"","example":"kernel","description":"Source of the event."},{"field":"event.reason","type":"keyword","normalization":"","example":"Terminated an unexpected process","description":"Reason why this event happened, according to the source"},{"field":"event.reference","type":"keyword","normalization":"","example":"https://system.example.com/event/#0001234","description":"Event reference URL"},{"field":"event.risk_score","type":"float","normalization":"","example":"","description":"Risk score or priority of the event (e.g. security solutions). Use your system's original value here."},{"field":"event.risk_score_norm","type":"float","normalization":"","example":"","description":"Normalized risk score or priority of the event (0-100)."},{"field":"event.sequence","type":"long","normalization":"","example":"","description":"Sequence number of the event."},{"field":"event.severity","type":"long","normalization":"","example":7,"description":"Numeric severity of the event."},{"field":"event.start","type":"date","normalization":"","example":"","description":"event.start contains the date when the event started or when the activity was first observed."},{"field":"event.timezone","type":"keyword","normalization":"","example":"","description":"Event time zone."},{"field":"event.type","type":"keyword","normalization":"array","example":"","description":"Event type. The third categorization field in the hierarchy."},{"field":"event.url","type":"keyword","normalization":"","example":"https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe","description":"Event investigation URL"},{"field":"faas.coldstart","type":"boolean","normalization":"","example":"","description":"Boolean value indicating a cold start of a function."},{"field":"faas.execution","type":"keyword","normalization":"","example":"af9d5aa4-a685-4c5f-a22b-444f80b3cc28","description":"The execution ID of the current function execution."},{"field":"faas.id","type":"keyword","normalization":"","example":"arn:aws:lambda:us-west-2:123456789012:function:my-function","description":"The unique identifier of a serverless function."},{"field":"faas.name","type":"keyword","normalization":"","example":"my-function","description":"The name of a serverless function."},{"field":"faas.trigger","type":"nested","normalization":"","example":"","description":"Details about the function trigger."},{"field":"faas.trigger.request_id","type":"keyword","normalization":"","example":123456789,"description":"The ID of the trigger request , message, event, etc."},{"field":"faas.trigger.type","type":"keyword","normalization":"","example":"http","description":"The trigger for the function execution."},{"field":"faas.version","type":"keyword","normalization":"","example":123,"description":"The version of a serverless function."},{"field":"file.accessed","type":"date","normalization":"","example":"","description":"Last time the file was accessed."},{"field":"file.attributes","type":"keyword","normalization":"array","example":["readonly","system"],"description":"Array of file attributes."},{"field":"file.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"file.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"file.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"file.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"file.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"file.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"file.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"file.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"file.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"file.created","type":"date","normalization":"","example":"","description":"File creation time."},{"field":"file.ctime","type":"date","normalization":"","example":"","description":"Last time the file attributes or metadata changed."},{"field":"file.device","type":"keyword","normalization":"","example":"sda","description":"Device that is the source of the file."},{"field":"file.directory","type":"keyword","normalization":"","example":"/home/alice","description":"Directory where the file is located."},{"field":"file.drive_letter","type":"keyword","normalization":"","example":"C","description":"Drive letter where the file is located."},{"field":"file.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"file.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"file.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"file.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"file.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"file.elf.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in an ELF file."},{"field":"file.elf.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"file.elf.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"file.elf.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"file.elf.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"file.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"file.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"file.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"file.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"file.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"file.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"file.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"file.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"file.elf.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in an ELF file."},{"field":"file.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"file.elf.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"file.elf.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"file.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"file.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"file.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"file.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"file.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"file.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"file.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"file.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"file.elf.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"file.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"file.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"file.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"file.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"file.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"file.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"file.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"file.extension","type":"keyword","normalization":"","example":"png","description":"File extension, excluding the leading dot."},{"field":"file.fork_name","type":"keyword","normalization":"","example":"Zone.Identifer","description":"A fork is additional data associated with a filesystem object."},{"field":"file.gid","type":"keyword","normalization":"","example":1001,"description":"Primary group ID (GID) of the file."},{"field":"file.group","type":"keyword","normalization":"","example":"alice","description":"Primary group name of the file."},{"field":"file.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"file.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"file.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"file.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"file.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"file.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"file.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"file.inode","type":"keyword","normalization":"","example":256383,"description":"Inode representing the file in the filesystem."},{"field":"file.macho.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a Mach-O file."},{"field":"file.macho.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"file.macho.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"file.macho.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"file.macho.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"file.macho.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a Mach-O file."},{"field":"file.macho.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"file.macho.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"file.macho.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"file.macho.sections","type":"nested","normalization":"array","example":"","description":"Section information of the Mach-O file."},{"field":"file.macho.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"file.macho.sections.name","type":"keyword","normalization":"","example":"","description":"Mach-O Section List name."},{"field":"file.macho.sections.physical_size","type":"long","normalization":"","example":"","description":"Mach-O Section List physical size."},{"field":"file.macho.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"file.macho.sections.virtual_size","type":"long","normalization":"","example":"","description":"Mach-O Section List virtual size. This is always the same as `physical_size`."},{"field":"file.macho.symhash","type":"keyword","normalization":"","example":"d3ccf195b62a9279c3c19af1080497ec","description":"A hash of the imports in a Mach-O file."},{"field":"file.mime_type","type":"keyword","normalization":"","example":"","description":"Media type of file, document, or arrangement of bytes."},{"field":"file.mode","type":"keyword","normalization":"","example":"0640","description":"Mode of the file in octal representation."},{"field":"file.mtime","type":"date","normalization":"","example":"","description":"Last time the file content was modified."},{"field":"file.name","type":"keyword","normalization":"","example":"example.png","description":"Name of the file including the extension, without the directory."},{"field":"file.owner","type":"keyword","normalization":"","example":"alice","description":"File owner's username."},{"field":"file.path","type":"keyword","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"file.path.text","type":"match_only_text","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"file.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"file.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"file.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"file.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"file.pe.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a PE file."},{"field":"file.pe.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"file.pe.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"file.pe.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"file.pe.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"file.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"file.pe.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a PE file."},{"field":"file.pe.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"file.pe.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"file.pe.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"file.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"file.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"file.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"file.pe.sections","type":"nested","normalization":"array","example":"","description":"Section information of the PE file."},{"field":"file.pe.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"file.pe.sections.name","type":"keyword","normalization":"","example":"","description":"PE Section List name."},{"field":"file.pe.sections.physical_size","type":"long","normalization":"","example":"","description":"PE Section List physical size."},{"field":"file.pe.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"file.pe.sections.virtual_size","type":"long","normalization":"","example":"","description":"PE Section List virtual size. This is always the same as `physical_size`."},{"field":"file.size","type":"long","normalization":"","example":16384,"description":"File size in bytes."},{"field":"file.target_path","type":"keyword","normalization":"","example":"","description":"Target path for symlinks."},{"field":"file.target_path.text","type":"match_only_text","normalization":"","example":"","description":"Target path for symlinks."},{"field":"file.type","type":"keyword","normalization":"","example":"file","description":"File type (file, dir, or symlink)."},{"field":"file.uid","type":"keyword","normalization":"","example":1001,"description":"The user ID (UID) or security identifier (SID) of the file owner."},{"field":"file.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"file.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"file.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"file.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"file.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"file.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"file.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"file.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"file.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"file.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"file.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"file.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"file.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"file.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"file.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"file.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"file.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"file.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"file.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"file.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"file.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"file.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"file.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"file.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"host.boot.id","type":"keyword","normalization":"","example":"88a1f0ed-5ae5-41ee-af6b-41921c311872","description":"Linux boot uuid taken from /proc/sys/kernel/random/boot_id"},{"field":"host.cpu.usage","type":"scaled_float","normalization":"","example":"","description":"Percent CPU used, between 0 and 1."},{"field":"host.disk.read.bytes","type":"long","normalization":"","example":"","description":"The number of bytes read by all disks."},{"field":"host.disk.write.bytes","type":"long","normalization":"","example":"","description":"The number of bytes written on all disks."},{"field":"host.domain","type":"keyword","normalization":"","example":"CONTOSO","description":"Name of the directory the group is a member of."},{"field":"host.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"host.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"host.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"host.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"host.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"host.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"host.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"host.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"host.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"host.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"host.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"host.name","type":"keyword","normalization":"","example":"","description":"Name of the host."},{"field":"host.network.egress.bytes","type":"long","normalization":"","example":"","description":"The number of bytes sent on all network interfaces."},{"field":"host.network.egress.packets","type":"long","normalization":"","example":"","description":"The number of packets sent on all network interfaces."},{"field":"host.network.ingress.bytes","type":"long","normalization":"","example":"","description":"The number of bytes received on all network interfaces."},{"field":"host.network.ingress.packets","type":"long","normalization":"","example":"","description":"The number of packets received on all network interfaces."},{"field":"host.os.full","type":"keyword","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"host.os.full.text","type":"match_only_text","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"host.os.name.text","type":"match_only_text","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"host.os.platform","type":"keyword","normalization":"","example":"darwin","description":"Operating system platform (such centos, ubuntu, windows)."},{"field":"host.pid_ns_ino","type":"keyword","normalization":"","example":256383,"description":"Pid namespace inode"},{"field":"host.risk.calculated_level","type":"keyword","normalization":"","example":"High","description":"A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring."},{"field":"host.risk.calculated_score","type":"float","normalization":"","example":880.73,"description":"A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring."},{"field":"host.risk.calculated_score_norm","type":"float","normalization":"","example":88.73,"description":"A normalized risk score calculated by an internal system."},{"field":"host.risk.static_level","type":"keyword","normalization":"","example":"High","description":"A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform."},{"field":"host.risk.static_score","type":"float","normalization":"","example":830,"description":"A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform."},{"field":"host.risk.static_score_norm","type":"float","normalization":"","example":83,"description":"A normalized risk score calculated by an external system."},{"field":"host.type","type":"keyword","normalization":"","example":"","description":"Type of host."},{"field":"host.uptime","type":"long","normalization":"","example":1325,"description":"Seconds the host has been up."},{"field":"http.request.body.bytes","type":"long","normalization":"","example":887,"description":"Size in bytes of the request body."},{"field":"http.request.body.content","type":"wildcard","normalization":"","example":"Hello world","description":"The full HTTP request body."},{"field":"http.request.body.content.text","type":"match_only_text","normalization":"","example":"Hello world","description":"The full HTTP request body."},{"field":"http.request.bytes","type":"long","normalization":"","example":1437,"description":"Total size in bytes of the request (body and headers)."},{"field":"http.request.id","type":"keyword","normalization":"","example":"123e4567-e89b-12d3-a456-426614174000","description":"HTTP request ID."},{"field":"http.request.method","type":"keyword","normalization":"","example":"POST","description":"HTTP request method."},{"field":"http.request.mime_type","type":"keyword","normalization":"","example":"image/gif","description":"Mime type of the body of the request."},{"field":"http.request.referrer","type":"keyword","normalization":"","example":"https://blog.example.com/","description":"Referrer for this HTTP request."},{"field":"http.response.body.bytes","type":"long","normalization":"","example":887,"description":"Size in bytes of the response body."},{"field":"http.response.body.content","type":"wildcard","normalization":"","example":"Hello world","description":"The full HTTP response body."},{"field":"http.response.body.content.text","type":"match_only_text","normalization":"","example":"Hello world","description":"The full HTTP response body."},{"field":"http.response.bytes","type":"long","normalization":"","example":1437,"description":"Total size in bytes of the response (body and headers)."},{"field":"http.response.mime_type","type":"keyword","normalization":"","example":"image/gif","description":"Mime type of the body of the response."},{"field":"http.response.status_code","type":"long","normalization":"","example":404,"description":"HTTP response status code."},{"field":"http.version","type":"keyword","normalization":"","example":1.1,"description":"HTTP version."},{"field":"log.file.path","type":"keyword","normalization":"","example":"/var/log/fun-times.log","description":"Full path to the log file this event came from."},{"field":"log.level","type":"keyword","normalization":"","example":"error","description":"Log level of the log event."},{"field":"log.logger","type":"keyword","normalization":"","example":"org.elasticsearch.bootstrap.Bootstrap","description":"Name of the logger."},{"field":"log.origin.file.line","type":"long","normalization":"","example":42,"description":"The line number of the file which originated the log event."},{"field":"log.origin.file.name","type":"keyword","normalization":"","example":"Bootstrap.java","description":"The code file which originated the log event."},{"field":"log.origin.function","type":"keyword","normalization":"","example":"init","description":"The function which originated the log event."},{"field":"log.syslog","type":"object","normalization":"","example":"","description":"Syslog metadata"},{"field":"log.syslog.appname","type":"keyword","normalization":"","example":"sshd","description":"The device or application that originated the Syslog message."},{"field":"log.syslog.facility.code","type":"long","normalization":"","example":23,"description":"Syslog numeric facility of the event."},{"field":"log.syslog.facility.name","type":"keyword","normalization":"","example":"local7","description":"Syslog text-based facility of the event."},{"field":"log.syslog.hostname","type":"keyword","normalization":"","example":"example-host","description":"The host that originated the Syslog message."},{"field":"log.syslog.msgid","type":"keyword","normalization":"","example":"ID47","description":"An identifier for the type of Syslog message."},{"field":"log.syslog.priority","type":"long","normalization":"","example":135,"description":"Syslog priority of the event."},{"field":"log.syslog.procid","type":"keyword","normalization":"","example":12345,"description":"The process name or ID that originated the Syslog message."},{"field":"log.syslog.severity.code","type":"long","normalization":"","example":3,"description":"Syslog numeric severity of the event."},{"field":"log.syslog.severity.name","type":"keyword","normalization":"","example":"Error","description":"Syslog text-based severity of the event."},{"field":"log.syslog.structured_data","type":"flattened","normalization":"","example":"","description":"Structured data expressed in RFC 5424 messages."},{"field":"log.syslog.version","type":"keyword","normalization":"","example":1,"description":"Syslog protocol version."},{"field":"network.application","type":"keyword","normalization":"","example":"aim","description":"Application level protocol name."},{"field":"network.bytes","type":"long","normalization":"","example":368,"description":"Total bytes transferred in both directions."},{"field":"network.community_id","type":"keyword","normalization":"","example":"1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=","description":"A hash of source and destination IPs and ports."},{"field":"network.direction","type":"keyword","normalization":"","example":"inbound","description":"Direction of the network traffic."},{"field":"network.forwarded_ip","type":"ip","normalization":"","example":"192.1.1.2","description":"Host IP address when the source IP address is the proxy."},{"field":"network.iana_number","type":"keyword","normalization":"","example":6,"description":"IANA Protocol Number."},{"field":"network.inner","type":"object","normalization":"","example":"","description":"Inner VLAN tag information"},{"field":"network.inner.vlan.id","type":"keyword","normalization":"","example":10,"description":"VLAN ID as reported by the observer."},{"field":"network.inner.vlan.name","type":"keyword","normalization":"","example":"outside","description":"Optional VLAN name as reported by the observer."},{"field":"network.name","type":"keyword","normalization":"","example":"Guest Wifi","description":"Name given by operators to sections of their network."},{"field":"network.packets","type":"long","normalization":"","example":24,"description":"Total packets transferred in both directions."},{"field":"network.protocol","type":"keyword","normalization":"","example":"http","description":"Application protocol name."},{"field":"network.transport","type":"keyword","normalization":"","example":"tcp","description":"Protocol Name corresponding to the field `iana_number`."},{"field":"network.type","type":"keyword","normalization":"","example":"ipv4","description":"In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc"},{"field":"network.vlan.id","type":"keyword","normalization":"","example":10,"description":"VLAN ID as reported by the observer."},{"field":"network.vlan.name","type":"keyword","normalization":"","example":"outside","description":"Optional VLAN name as reported by the observer."},{"field":"observer.egress","type":"object","normalization":"","example":"","description":"Object field for egress information"},{"field":"observer.egress.interface.alias","type":"keyword","normalization":"","example":"outside","description":"Interface alias"},{"field":"observer.egress.interface.id","type":"keyword","normalization":"","example":10,"description":"Interface ID"},{"field":"observer.egress.interface.name","type":"keyword","normalization":"","example":"eth0","description":"Interface name"},{"field":"observer.egress.vlan.id","type":"keyword","normalization":"","example":10,"description":"VLAN ID as reported by the observer."},{"field":"observer.egress.vlan.name","type":"keyword","normalization":"","example":"outside","description":"Optional VLAN name as reported by the observer."},{"field":"observer.egress.zone","type":"keyword","normalization":"","example":"Public_Internet","description":"Observer Egress zone"},{"field":"observer.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"observer.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"observer.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"observer.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"observer.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"observer.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"observer.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"observer.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"observer.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"observer.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"observer.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"observer.hostname","type":"keyword","normalization":"","example":"","description":"Hostname of the observer."},{"field":"observer.ingress","type":"object","normalization":"","example":"","description":"Object field for ingress information"},{"field":"observer.ingress.interface.alias","type":"keyword","normalization":"","example":"outside","description":"Interface alias"},{"field":"observer.ingress.interface.id","type":"keyword","normalization":"","example":10,"description":"Interface ID"},{"field":"observer.ingress.interface.name","type":"keyword","normalization":"","example":"eth0","description":"Interface name"},{"field":"observer.ingress.vlan.id","type":"keyword","normalization":"","example":10,"description":"VLAN ID as reported by the observer."},{"field":"observer.ingress.vlan.name","type":"keyword","normalization":"","example":"outside","description":"Optional VLAN name as reported by the observer."},{"field":"observer.ingress.zone","type":"keyword","normalization":"","example":"DMZ","description":"Observer ingress zone"},{"field":"observer.ip","type":"ip","normalization":"array","example":"","description":"IP addresses of the observer."},{"field":"observer.mac","type":"keyword","normalization":"array","example":["00-00-5E-00-53-23","00-00-5E-00-53-24"],"description":"MAC addresses of the observer."},{"field":"observer.name","type":"keyword","normalization":"","example":"1_proxySG","description":"Custom name of the observer."},{"field":"observer.os.family","type":"keyword","normalization":"","example":"debian","description":"OS family (such as redhat, debian, freebsd, windows)."},{"field":"observer.os.full","type":"keyword","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"observer.os.full.text","type":"match_only_text","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"observer.os.kernel","type":"keyword","normalization":"","example":"4.4.0-112-generic","description":"Operating system kernel version as a raw string."},{"field":"observer.os.name","type":"keyword","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"observer.os.name.text","type":"match_only_text","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"observer.os.platform","type":"keyword","normalization":"","example":"darwin","description":"Operating system platform (such centos, ubuntu, windows)."},{"field":"observer.os.type","type":"keyword","normalization":"","example":"macos","description":"Which commercial OS family (one of: linux, macos, unix, windows, ios or android)."},{"field":"observer.os.version","type":"keyword","normalization":"","example":"10.14.1","description":"Operating system version as a raw string."},{"field":"observer.product","type":"keyword","normalization":"","example":"s200","description":"The product name of the observer."},{"field":"observer.serial_number","type":"keyword","normalization":"","example":"","description":"Observer serial number."},{"field":"observer.type","type":"keyword","normalization":"","example":"firewall","description":"The type of the observer the data is coming from."},{"field":"observer.vendor","type":"keyword","normalization":"","example":"Symantec","description":"Vendor name of the observer."},{"field":"observer.version","type":"keyword","normalization":"","example":"","description":"Observer version."},{"field":"orchestrator.api_version","type":"keyword","normalization":"","example":"v1beta1","description":"API version being used to carry out the action"},{"field":"orchestrator.cluster.id","type":"keyword","normalization":"","example":"","description":"Unique ID of the cluster."},{"field":"orchestrator.cluster.name","type":"keyword","normalization":"","example":"","description":"Name of the cluster."},{"field":"orchestrator.cluster.url","type":"keyword","normalization":"","example":"","description":"URL of the API used to manage the cluster."},{"field":"orchestrator.cluster.version","type":"keyword","normalization":"","example":"","description":"The version of the cluster."},{"field":"orchestrator.namespace","type":"keyword","normalization":"","example":"kube-system","description":"Namespace in which the action is taking place."},{"field":"orchestrator.organization","type":"keyword","normalization":"","example":"elastic","description":"Organization affected by the event (for multi-tenant orchestrator setups)."},{"field":"orchestrator.resource.id","type":"keyword","normalization":"","example":"","description":"Unique ID of the resource being acted upon."},{"field":"orchestrator.resource.ip","type":"ip","normalization":"array","example":"","description":"IP address assigned to the resource associated with the event being observed."},{"field":"orchestrator.resource.name","type":"keyword","normalization":"","example":"test-pod-cdcws","description":"Name of the resource being acted upon."},{"field":"orchestrator.resource.parent.type","type":"keyword","normalization":"","example":"DaemonSet","description":"Type or kind of the parent resource associated with the event being observed."},{"field":"orchestrator.resource.type","type":"keyword","normalization":"","example":"service","description":"Type of resource being acted upon."},{"field":"orchestrator.type","type":"keyword","normalization":"","example":"kubernetes","description":"Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry)."},{"field":"organization.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the organization."},{"field":"organization.name","type":"keyword","normalization":"","example":"","description":"Organization name."},{"field":"organization.name.text","type":"match_only_text","normalization":"","example":"","description":"Organization name."},{"field":"package.architecture","type":"keyword","normalization":"","example":"x86_64","description":"Package architecture."},{"field":"package.build_version","type":"keyword","normalization":"","example":"36f4f7e89dd61b0988b12ee000b98966867710cd","description":"Build version information"},{"field":"package.checksum","type":"keyword","normalization":"","example":"68b329da9893e34099c7d8ad5cb9c940","description":"Checksum of the installed package for verification."},{"field":"package.description","type":"keyword","normalization":"","example":"Open source programming language to build simple/reliable/efficient software.","description":"Description of the package."},{"field":"package.install_scope","type":"keyword","normalization":"","example":"global","description":"Indicating how the package was installed, e.g. user-local, global."},{"field":"package.installed","type":"date","normalization":"","example":"","description":"Time when package was installed."},{"field":"package.license","type":"keyword","normalization":"","example":"Apache License 2.0","description":"Package license"},{"field":"package.name","type":"keyword","normalization":"","example":"go","description":"Package name"},{"field":"package.path","type":"keyword","normalization":"","example":"/usr/local/Cellar/go/1.12.9/","description":"Path where the package is installed."},{"field":"package.reference","type":"keyword","normalization":"","example":"https://golang.org","description":"Package home page or reference URL"},{"field":"package.size","type":"long","normalization":"","example":62231,"description":"Package size in bytes."},{"field":"package.type","type":"keyword","normalization":"","example":"rpm","description":"Package type"},{"field":"package.version","type":"keyword","normalization":"","example":"1.12.9","description":"Package version"},{"field":"process.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"process.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"process.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"process.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"process.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"process.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"process.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"process.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"process.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"process.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"process.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"process.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"process.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"process.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"process.elf.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in an ELF file."},{"field":"process.elf.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"process.elf.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"process.elf.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"process.elf.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"process.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"process.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"process.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"process.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"process.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"process.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"process.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"process.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"process.elf.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in an ELF file."},{"field":"process.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"process.elf.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"process.elf.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"process.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"process.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"process.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"process.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"process.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"process.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"process.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"process.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"process.elf.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"process.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"process.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"process.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"process.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"process.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"process.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"process.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"process.end","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process ended."},{"field":"process.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.entry_leader.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.entry_leader.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.entry_leader.attested_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.attested_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.entry_leader.attested_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.attested_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.entry_leader.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.entry_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.entry_leader.entry_meta.source.ip","type":"ip","normalization":"","example":"","description":"IP address of the source."},{"field":"process.entry_leader.entry_meta.type","type":"keyword","normalization":"","example":"","description":"The entry type for the entry session leader."},{"field":"process.entry_leader.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.entry_leader.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.entry_leader.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.entry_leader.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.entry_leader.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.entry_leader.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.entry_leader.parent.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.entry_leader.parent.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.entry_leader.parent.session_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.entry_leader.parent.session_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.entry_leader.parent.session_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.entry_leader.parent.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.entry_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.entry_leader.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.entry_leader.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.entry_leader.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.same_as_process","type":"boolean","normalization":"","example":"True","description":"This boolean is used to identify if a leader process is the same as the top level process."},{"field":"process.entry_leader.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.entry_leader.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.entry_leader.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.entry_leader.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.entry_leader.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.entry_leader.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.entry_leader.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.entry_leader.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.entry_leader.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.entry_leader.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.entry_leader.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.entry_leader.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.env_vars","type":"keyword","normalization":"array","example":["PATH=/usr/local/bin:/usr/bin","USER=ubuntu"],"description":"Array of environment variable bindings."},{"field":"process.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.exit_code","type":"long","normalization":"","example":137,"description":"The exit code of the process."},{"field":"process.group_leader.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.group_leader.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.group_leader.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.group_leader.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.group_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.group_leader.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.group_leader.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.group_leader.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.group_leader.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.group_leader.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.group_leader.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.group_leader.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.group_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.group_leader.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.group_leader.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.group_leader.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.group_leader.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.same_as_process","type":"boolean","normalization":"","example":"True","description":"This boolean is used to identify if a leader process is the same as the top level process."},{"field":"process.group_leader.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.group_leader.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.group_leader.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.group_leader.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.group_leader.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.group_leader.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.group_leader.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.group_leader.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.group_leader.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.group_leader.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.group_leader.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.group_leader.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.group_leader.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"process.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"process.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"process.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"process.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"process.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"process.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"process.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.io","type":"object","normalization":"","example":"","description":"A chunk of input or output (IO) from a single process."},{"field":"process.io.bytes_skipped","type":"object","normalization":"array","example":"","description":"An array of byte offsets and lengths denoting where IO data has been skipped."},{"field":"process.io.bytes_skipped.length","type":"long","normalization":"","example":"","description":"The length of bytes skipped."},{"field":"process.io.bytes_skipped.offset","type":"long","normalization":"","example":"","description":"The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped."},{"field":"process.io.max_bytes_per_process_exceeded","type":"boolean","normalization":"","example":"","description":"If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting."},{"field":"process.io.text","type":"wildcard","normalization":"","example":"","description":"A chunk of output or input sanitized to UTF-8."},{"field":"process.io.total_bytes_captured","type":"long","normalization":"","example":"","description":"The total number of bytes captured in this event."},{"field":"process.io.total_bytes_skipped","type":"long","normalization":"","example":"","description":"The total number of bytes that were not captured due to implementation restrictions such as buffer size limits."},{"field":"process.io.type","type":"keyword","normalization":"","example":"","description":"The type of object on which the IO action (read or write) was taken."},{"field":"process.macho.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a Mach-O file."},{"field":"process.macho.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"process.macho.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"process.macho.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"process.macho.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"process.macho.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a Mach-O file."},{"field":"process.macho.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"process.macho.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"process.macho.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"process.macho.sections","type":"nested","normalization":"array","example":"","description":"Section information of the Mach-O file."},{"field":"process.macho.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"process.macho.sections.name","type":"keyword","normalization":"","example":"","description":"Mach-O Section List name."},{"field":"process.macho.sections.physical_size","type":"long","normalization":"","example":"","description":"Mach-O Section List physical size."},{"field":"process.macho.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"process.macho.sections.virtual_size","type":"long","normalization":"","example":"","description":"Mach-O Section List virtual size. This is always the same as `physical_size`."},{"field":"process.macho.symhash","type":"keyword","normalization":"","example":"d3ccf195b62a9279c3c19af1080497ec","description":"A hash of the imports in a Mach-O file."},{"field":"process.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.parent.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.parent.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.parent.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"process.parent.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"process.parent.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"process.parent.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"process.parent.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"process.parent.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"process.parent.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"process.parent.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"process.parent.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"process.parent.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.parent.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.parent.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"process.parent.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"process.parent.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"process.parent.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"process.parent.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"process.parent.elf.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in an ELF file."},{"field":"process.parent.elf.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"process.parent.elf.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"process.parent.elf.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"process.parent.elf.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"process.parent.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"process.parent.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"process.parent.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"process.parent.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"process.parent.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"process.parent.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"process.parent.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"process.parent.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"process.parent.elf.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in an ELF file."},{"field":"process.parent.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"process.parent.elf.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"process.parent.elf.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"process.parent.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"process.parent.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"process.parent.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"process.parent.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"process.parent.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"process.parent.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"process.parent.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"process.parent.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"process.parent.elf.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"process.parent.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"process.parent.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"process.parent.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"process.parent.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"process.parent.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"process.parent.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"process.parent.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"process.parent.end","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process ended."},{"field":"process.parent.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.parent.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.parent.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.parent.exit_code","type":"long","normalization":"","example":137,"description":"The exit code of the process."},{"field":"process.parent.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.parent.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.parent.group_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.parent.group_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.parent.group_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.parent.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"process.parent.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"process.parent.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"process.parent.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"process.parent.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"process.parent.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"process.parent.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"process.parent.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.parent.macho.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a Mach-O file."},{"field":"process.parent.macho.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"process.parent.macho.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"process.parent.macho.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"process.parent.macho.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"process.parent.macho.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a Mach-O file."},{"field":"process.parent.macho.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"process.parent.macho.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"process.parent.macho.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"process.parent.macho.sections","type":"nested","normalization":"array","example":"","description":"Section information of the Mach-O file."},{"field":"process.parent.macho.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"process.parent.macho.sections.name","type":"keyword","normalization":"","example":"","description":"Mach-O Section List name."},{"field":"process.parent.macho.sections.physical_size","type":"long","normalization":"","example":"","description":"Mach-O Section List physical size."},{"field":"process.parent.macho.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"process.parent.macho.sections.virtual_size","type":"long","normalization":"","example":"","description":"Mach-O Section List virtual size. This is always the same as `physical_size`."},{"field":"process.parent.macho.symhash","type":"keyword","normalization":"","example":"d3ccf195b62a9279c3c19af1080497ec","description":"A hash of the imports in a Mach-O file."},{"field":"process.parent.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.parent.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.parent.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"process.parent.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"process.parent.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"process.parent.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"process.parent.pe.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a PE file."},{"field":"process.parent.pe.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"process.parent.pe.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"process.parent.pe.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"process.parent.pe.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"process.parent.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"process.parent.pe.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a PE file."},{"field":"process.parent.pe.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"process.parent.pe.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"process.parent.pe.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"process.parent.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"process.parent.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"process.parent.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"process.parent.pe.sections","type":"nested","normalization":"array","example":"","description":"Section information of the PE file."},{"field":"process.parent.pe.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"process.parent.pe.sections.name","type":"keyword","normalization":"","example":"","description":"PE Section List name."},{"field":"process.parent.pe.sections.physical_size","type":"long","normalization":"","example":"","description":"PE Section List physical size."},{"field":"process.parent.pe.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"process.parent.pe.sections.virtual_size","type":"long","normalization":"","example":"","description":"PE Section List virtual size. This is always the same as `physical_size`."},{"field":"process.parent.pgid","type":"long","normalization":"","example":"","description":"Deprecated identifier of the group of processes the process belongs to."},{"field":"process.parent.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.parent.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.parent.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.parent.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.parent.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.parent.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.parent.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.parent.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.parent.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.parent.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.parent.thread.id","type":"long","normalization":"","example":4242,"description":"Thread ID."},{"field":"process.parent.thread.name","type":"keyword","normalization":"","example":"thread-0","description":"Thread name."},{"field":"process.parent.title","type":"keyword","normalization":"","example":"","description":"Process title."},{"field":"process.parent.title.text","type":"match_only_text","normalization":"","example":"","description":"Process title."},{"field":"process.parent.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.parent.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.parent.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.parent.uptime","type":"long","normalization":"","example":1325,"description":"Seconds the process has been up."},{"field":"process.parent.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.parent.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.parent.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.parent.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"process.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"process.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"process.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"process.pe.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a PE file."},{"field":"process.pe.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"process.pe.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"process.pe.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"process.pe.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"process.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"process.pe.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a PE file."},{"field":"process.pe.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"process.pe.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"process.pe.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"process.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"process.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"process.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"process.pe.sections","type":"nested","normalization":"array","example":"","description":"Section information of the PE file."},{"field":"process.pe.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"process.pe.sections.name","type":"keyword","normalization":"","example":"","description":"PE Section List name."},{"field":"process.pe.sections.physical_size","type":"long","normalization":"","example":"","description":"PE Section List physical size."},{"field":"process.pe.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"process.pe.sections.virtual_size","type":"long","normalization":"","example":"","description":"PE Section List virtual size. This is always the same as `physical_size`."},{"field":"process.pgid","type":"long","normalization":"","example":"","description":"Deprecated identifier of the group of processes the process belongs to."},{"field":"process.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.previous.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.previous.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.previous.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.previous.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.args","type":"keyword","normalization":"array","example":["/usr/bin/ssh","-l","user","10.0.0.16"],"description":"Array of process arguments."},{"field":"process.session_leader.args_count","type":"long","normalization":"","example":4,"description":"Length of the process.args array."},{"field":"process.session_leader.command_line","type":"wildcard","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.session_leader.command_line.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh -l user 10.0.0.16","description":"Full command line that started the process."},{"field":"process.session_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.session_leader.executable","type":"keyword","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.session_leader.executable.text","type":"match_only_text","normalization":"","example":"/usr/bin/ssh","description":"Absolute path to the process executable."},{"field":"process.session_leader.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.session_leader.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.session_leader.interactive","type":"boolean","normalization":"","example":"True","description":"Whether the process is connected to an interactive shell."},{"field":"process.session_leader.name","type":"keyword","normalization":"","example":"ssh","description":"Process name."},{"field":"process.session_leader.name.text","type":"match_only_text","normalization":"","example":"ssh","description":"Process name."},{"field":"process.session_leader.parent.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.session_leader.parent.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.session_leader.parent.session_leader.entity_id","type":"keyword","normalization":"","example":"c2c455d9f99375d","description":"Unique identifier for the process."},{"field":"process.session_leader.parent.session_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.session_leader.parent.session_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.session_leader.parent.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.session_leader.pid","type":"long","normalization":"","example":4242,"description":"Process id."},{"field":"process.session_leader.real_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.session_leader.real_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.session_leader.real_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.session_leader.real_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.real_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.same_as_process","type":"boolean","normalization":"","example":"True","description":"This boolean is used to identify if a leader process is the same as the top level process."},{"field":"process.session_leader.saved_group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.session_leader.saved_group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.session_leader.saved_user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.session_leader.saved_user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.saved_user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.session_leader.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.session_leader.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.session_leader.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.session_leader.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.session_leader.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.session_leader.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.session_leader.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.session_leader.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.session_leader.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.start","type":"date","normalization":"","example":"2016-05-23T08:05:34.853Z","description":"The time the process started."},{"field":"process.supplemental_groups.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"process.supplemental_groups.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"process.thread.id","type":"long","normalization":"","example":4242,"description":"Thread ID."},{"field":"process.thread.name","type":"keyword","normalization":"","example":"thread-0","description":"Thread name."},{"field":"process.title","type":"keyword","normalization":"","example":"","description":"Process title."},{"field":"process.title.text","type":"match_only_text","normalization":"","example":"","description":"Process title."},{"field":"process.tty","type":"object","normalization":"","example":"","description":"Information about the controlling TTY device."},{"field":"process.tty.char_device.major","type":"long","normalization":"","example":4,"description":"The TTY character device's major number."},{"field":"process.tty.char_device.minor","type":"long","normalization":"","example":1,"description":"The TTY character device's minor number."},{"field":"process.tty.columns","type":"long","normalization":"","example":80,"description":"The number of character columns per line. e.g terminal width"},{"field":"process.tty.rows","type":"long","normalization":"","example":24,"description":"The number of character rows in the terminal. e.g terminal height"},{"field":"process.uptime","type":"long","normalization":"","example":1325,"description":"Seconds the process has been up."},{"field":"process.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"process.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"process.working_directory","type":"keyword","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"process.working_directory.text","type":"match_only_text","normalization":"","example":"/home/alice","description":"The working directory of the process."},{"field":"registry.data.bytes","type":"keyword","normalization":"","example":"ZQBuAC0AVQBTAAAAZQBuAAAAAAA=","description":"Original bytes written with base64 encoding."},{"field":"registry.data.strings","type":"wildcard","normalization":"array","example":"[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]","description":"List of strings representing what was written to the registry."},{"field":"registry.data.type","type":"keyword","normalization":"","example":"REG_SZ","description":"Standard registry type for encoding contents"},{"field":"registry.hive","type":"keyword","normalization":"","example":"HKLM","description":"Abbreviated name for the hive."},{"field":"registry.key","type":"keyword","normalization":"","example":"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe","description":"Hive-relative path of keys."},{"field":"registry.path","type":"keyword","normalization":"","example":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger","description":"Full path, including hive, key and value"},{"field":"registry.value","type":"keyword","normalization":"","example":"Debugger","description":"Name of the value written."},{"field":"related.hash","type":"keyword","normalization":"array","example":"","description":"All the hashes seen on your event."},{"field":"related.hosts","type":"keyword","normalization":"array","example":"","description":"All the host identifiers seen on your event."},{"field":"related.ip","type":"ip","normalization":"array","example":"","description":"All of the IPs seen on your event."},{"field":"related.user","type":"keyword","normalization":"array","example":"","description":"All the user names or other user identifiers seen on the event."},{"field":"rule.author","type":"keyword","normalization":"array","example":["Star-Lord"],"description":"Rule author"},{"field":"rule.category","type":"keyword","normalization":"","example":"Attempted Information Leak","description":"Rule category"},{"field":"rule.description","type":"keyword","normalization":"","example":"Block requests to public DNS over HTTPS / TLS protocols","description":"Rule description"},{"field":"rule.id","type":"keyword","normalization":"","example":101,"description":"Rule ID"},{"field":"rule.license","type":"keyword","normalization":"","example":"Apache 2.0","description":"Rule license"},{"field":"rule.name","type":"keyword","normalization":"","example":"BLOCK_DNS_over_TLS","description":"Rule name"},{"field":"rule.reference","type":"keyword","normalization":"","example":"https://en.wikipedia.org/wiki/DNS_over_TLS","description":"Rule reference URL"},{"field":"rule.ruleset","type":"keyword","normalization":"","example":"Standard_Protocol_Filters","description":"Rule ruleset"},{"field":"rule.uuid","type":"keyword","normalization":"","example":1100110011,"description":"Rule UUID"},{"field":"rule.version","type":"keyword","normalization":"","example":1.1,"description":"Rule version"},{"field":"server.address","type":"keyword","normalization":"","example":"","description":"Server network address."},{"field":"server.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"server.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"server.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"server.bytes","type":"long","normalization":"","example":184,"description":"Bytes sent from the server to the client."},{"field":"server.domain","type":"keyword","normalization":"","example":"foo.example.com","description":"The domain name of the server."},{"field":"server.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"server.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"server.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"server.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"server.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"server.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"server.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"server.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"server.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"server.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"server.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"server.ip","type":"ip","normalization":"","example":"","description":"IP address of the server."},{"field":"server.mac","type":"keyword","normalization":"","example":"00-00-5E-00-53-23","description":"MAC address of the server."},{"field":"server.nat.ip","type":"ip","normalization":"","example":"","description":"Server NAT ip"},{"field":"server.nat.port","type":"long","normalization":"","example":"","description":"Server NAT port"},{"field":"server.packets","type":"long","normalization":"","example":12,"description":"Packets sent from the server to the client."},{"field":"server.port","type":"long","normalization":"","example":"","description":"Port of the server."},{"field":"server.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered server domain, stripped of the subdomain."},{"field":"server.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"server.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"server.user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"server.user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"server.user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"server.user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"server.user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"server.user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"server.user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"server.user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"server.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"server.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"server.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"server.user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"service.address","type":"keyword","normalization":"","example":"172.26.0.2:5432","description":"Address of this service."},{"field":"service.environment","type":"keyword","normalization":"","example":"production","description":"Environment of the service."},{"field":"service.ephemeral_id","type":"keyword","normalization":"","example":"8a4f500f","description":"Ephemeral identifier of this service."},{"field":"service.id","type":"keyword","normalization":"","example":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","description":"Unique identifier of the running service."},{"field":"service.name","type":"keyword","normalization":"","example":"elasticsearch-metrics","description":"Name of the service."},{"field":"service.node.name","type":"keyword","normalization":"","example":"instance-0000000016","description":"Name of the service node."},{"field":"service.node.role","type":"keyword","normalization":"","example":"background_tasks","description":"Deprecated role (singular) of the service node."},{"field":"service.node.roles","type":"keyword","normalization":"array","example":["ui","background_tasks"],"description":"Roles of the service node."},{"field":"service.origin.address","type":"keyword","normalization":"","example":"172.26.0.2:5432","description":"Address of this service."},{"field":"service.origin.environment","type":"keyword","normalization":"","example":"production","description":"Environment of the service."},{"field":"service.origin.ephemeral_id","type":"keyword","normalization":"","example":"8a4f500f","description":"Ephemeral identifier of this service."},{"field":"service.origin.id","type":"keyword","normalization":"","example":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","description":"Unique identifier of the running service."},{"field":"service.origin.name","type":"keyword","normalization":"","example":"elasticsearch-metrics","description":"Name of the service."},{"field":"service.origin.node.name","type":"keyword","normalization":"","example":"instance-0000000016","description":"Name of the service node."},{"field":"service.origin.node.role","type":"keyword","normalization":"","example":"background_tasks","description":"Deprecated role (singular) of the service node."},{"field":"service.origin.node.roles","type":"keyword","normalization":"array","example":["ui","background_tasks"],"description":"Roles of the service node."},{"field":"service.origin.state","type":"keyword","normalization":"","example":"","description":"Current state of the service."},{"field":"service.origin.type","type":"keyword","normalization":"","example":"elasticsearch","description":"The type of the service."},{"field":"service.origin.version","type":"keyword","normalization":"","example":"3.2.4","description":"Version of the service."},{"field":"service.state","type":"keyword","normalization":"","example":"","description":"Current state of the service."},{"field":"service.target.address","type":"keyword","normalization":"","example":"172.26.0.2:5432","description":"Address of this service."},{"field":"service.target.environment","type":"keyword","normalization":"","example":"production","description":"Environment of the service."},{"field":"service.target.ephemeral_id","type":"keyword","normalization":"","example":"8a4f500f","description":"Ephemeral identifier of this service."},{"field":"service.target.id","type":"keyword","normalization":"","example":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","description":"Unique identifier of the running service."},{"field":"service.target.name","type":"keyword","normalization":"","example":"elasticsearch-metrics","description":"Name of the service."},{"field":"service.target.node.name","type":"keyword","normalization":"","example":"instance-0000000016","description":"Name of the service node."},{"field":"service.target.node.role","type":"keyword","normalization":"","example":"background_tasks","description":"Deprecated role (singular) of the service node."},{"field":"service.target.node.roles","type":"keyword","normalization":"array","example":["ui","background_tasks"],"description":"Roles of the service node."},{"field":"service.target.state","type":"keyword","normalization":"","example":"","description":"Current state of the service."},{"field":"service.target.type","type":"keyword","normalization":"","example":"elasticsearch","description":"The type of the service."},{"field":"service.target.version","type":"keyword","normalization":"","example":"3.2.4","description":"Version of the service."},{"field":"service.type","type":"keyword","normalization":"","example":"elasticsearch","description":"The type of the service."},{"field":"service.version","type":"keyword","normalization":"","example":"3.2.4","description":"Version of the service."},{"field":"source.address","type":"keyword","normalization":"","example":"","description":"Source network address."},{"field":"source.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"source.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"source.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"source.bytes","type":"long","normalization":"","example":184,"description":"Bytes sent from the source to the destination."},{"field":"source.domain","type":"keyword","normalization":"","example":"foo.example.com","description":"The domain name of the source."},{"field":"source.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"source.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"source.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"source.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"source.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"source.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"source.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"source.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"source.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"source.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"source.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"source.ip","type":"ip","normalization":"","example":"","description":"IP address of the source."},{"field":"source.mac","type":"keyword","normalization":"","example":"00-00-5E-00-53-23","description":"MAC address of the source."},{"field":"source.nat.ip","type":"ip","normalization":"","example":"","description":"Source NAT ip"},{"field":"source.nat.port","type":"long","normalization":"","example":"","description":"Source NAT port"},{"field":"source.packets","type":"long","normalization":"","example":12,"description":"Packets sent from the source to the destination."},{"field":"source.port","type":"long","normalization":"","example":"","description":"Port of the source."},{"field":"source.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered source domain, stripped of the subdomain."},{"field":"source.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"source.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"source.user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"source.user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"source.user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"source.user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"source.user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"source.user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"source.user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"source.user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"source.user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"source.user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"source.user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"source.user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"span.id","type":"keyword","normalization":"","example":"3ff9a8981b7ccd5a","description":"Unique identifier of the span within the scope of its trace."},{"field":"threat.enrichments","type":"nested","normalization":"array","example":"","description":"List of objects containing indicators enriching the event."},{"field":"threat.enrichments.indicator","type":"object","normalization":"","example":"","description":"Object containing indicators enriching the event."},{"field":"threat.enrichments.indicator.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"threat.enrichments.indicator.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"threat.enrichments.indicator.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"threat.enrichments.indicator.confidence","type":"keyword","normalization":"","example":"Medium","description":"Indicator confidence rating"},{"field":"threat.enrichments.indicator.description","type":"keyword","normalization":"","example":"IP x.x.x.x was observed delivering the Angler EK.","description":"Indicator description"},{"field":"threat.enrichments.indicator.email.address","type":"keyword","normalization":"","example":"phish@example.com","description":"Indicator email address"},{"field":"threat.enrichments.indicator.file.accessed","type":"date","normalization":"","example":"","description":"Last time the file was accessed."},{"field":"threat.enrichments.indicator.file.attributes","type":"keyword","normalization":"array","example":["readonly","system"],"description":"Array of file attributes."},{"field":"threat.enrichments.indicator.file.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"threat.enrichments.indicator.file.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"threat.enrichments.indicator.file.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"threat.enrichments.indicator.file.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"threat.enrichments.indicator.file.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"threat.enrichments.indicator.file.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"threat.enrichments.indicator.file.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"threat.enrichments.indicator.file.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"threat.enrichments.indicator.file.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"threat.enrichments.indicator.file.created","type":"date","normalization":"","example":"","description":"File creation time."},{"field":"threat.enrichments.indicator.file.ctime","type":"date","normalization":"","example":"","description":"Last time the file attributes or metadata changed."},{"field":"threat.enrichments.indicator.file.device","type":"keyword","normalization":"","example":"sda","description":"Device that is the source of the file."},{"field":"threat.enrichments.indicator.file.directory","type":"keyword","normalization":"","example":"/home/alice","description":"Directory where the file is located."},{"field":"threat.enrichments.indicator.file.drive_letter","type":"keyword","normalization":"","example":"C","description":"Drive letter where the file is located."},{"field":"threat.enrichments.indicator.file.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"threat.enrichments.indicator.file.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"threat.enrichments.indicator.file.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"threat.enrichments.indicator.file.elf.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in an ELF file."},{"field":"threat.enrichments.indicator.file.elf.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"threat.enrichments.indicator.file.elf.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"threat.enrichments.indicator.file.elf.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"threat.enrichments.indicator.file.elf.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"threat.enrichments.indicator.file.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"threat.enrichments.indicator.file.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"threat.enrichments.indicator.file.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"threat.enrichments.indicator.file.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"threat.enrichments.indicator.file.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"threat.enrichments.indicator.file.elf.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in an ELF file."},{"field":"threat.enrichments.indicator.file.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"threat.enrichments.indicator.file.elf.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"threat.enrichments.indicator.file.elf.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"threat.enrichments.indicator.file.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"threat.enrichments.indicator.file.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"threat.enrichments.indicator.file.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"threat.enrichments.indicator.file.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"threat.enrichments.indicator.file.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"threat.enrichments.indicator.file.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"threat.enrichments.indicator.file.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"threat.enrichments.indicator.file.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"threat.enrichments.indicator.file.elf.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"threat.enrichments.indicator.file.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"threat.enrichments.indicator.file.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"threat.enrichments.indicator.file.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"threat.enrichments.indicator.file.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"threat.enrichments.indicator.file.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"threat.enrichments.indicator.file.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"threat.enrichments.indicator.file.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"threat.enrichments.indicator.file.extension","type":"keyword","normalization":"","example":"png","description":"File extension, excluding the leading dot."},{"field":"threat.enrichments.indicator.file.fork_name","type":"keyword","normalization":"","example":"Zone.Identifer","description":"A fork is additional data associated with a filesystem object."},{"field":"threat.enrichments.indicator.file.gid","type":"keyword","normalization":"","example":1001,"description":"Primary group ID (GID) of the file."},{"field":"threat.enrichments.indicator.file.group","type":"keyword","normalization":"","example":"alice","description":"Primary group name of the file."},{"field":"threat.enrichments.indicator.file.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"threat.enrichments.indicator.file.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"threat.enrichments.indicator.file.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"threat.enrichments.indicator.file.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"threat.enrichments.indicator.file.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"threat.enrichments.indicator.file.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"threat.enrichments.indicator.file.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"threat.enrichments.indicator.file.inode","type":"keyword","normalization":"","example":256383,"description":"Inode representing the file in the filesystem."},{"field":"threat.enrichments.indicator.file.mime_type","type":"keyword","normalization":"","example":"","description":"Media type of file, document, or arrangement of bytes."},{"field":"threat.enrichments.indicator.file.mode","type":"keyword","normalization":"","example":"0640","description":"Mode of the file in octal representation."},{"field":"threat.enrichments.indicator.file.mtime","type":"date","normalization":"","example":"","description":"Last time the file content was modified."},{"field":"threat.enrichments.indicator.file.name","type":"keyword","normalization":"","example":"example.png","description":"Name of the file including the extension, without the directory."},{"field":"threat.enrichments.indicator.file.owner","type":"keyword","normalization":"","example":"alice","description":"File owner's username."},{"field":"threat.enrichments.indicator.file.path","type":"keyword","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"threat.enrichments.indicator.file.path.text","type":"match_only_text","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"threat.enrichments.indicator.file.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"threat.enrichments.indicator.file.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"threat.enrichments.indicator.file.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"threat.enrichments.indicator.file.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"threat.enrichments.indicator.file.pe.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a PE file."},{"field":"threat.enrichments.indicator.file.pe.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"threat.enrichments.indicator.file.pe.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"threat.enrichments.indicator.file.pe.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"threat.enrichments.indicator.file.pe.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"threat.enrichments.indicator.file.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"threat.enrichments.indicator.file.pe.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a PE file."},{"field":"threat.enrichments.indicator.file.pe.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"threat.enrichments.indicator.file.pe.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"threat.enrichments.indicator.file.pe.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"threat.enrichments.indicator.file.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"threat.enrichments.indicator.file.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"threat.enrichments.indicator.file.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"threat.enrichments.indicator.file.pe.sections","type":"nested","normalization":"array","example":"","description":"Section information of the PE file."},{"field":"threat.enrichments.indicator.file.pe.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"threat.enrichments.indicator.file.pe.sections.name","type":"keyword","normalization":"","example":"","description":"PE Section List name."},{"field":"threat.enrichments.indicator.file.pe.sections.physical_size","type":"long","normalization":"","example":"","description":"PE Section List physical size."},{"field":"threat.enrichments.indicator.file.pe.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"threat.enrichments.indicator.file.pe.sections.virtual_size","type":"long","normalization":"","example":"","description":"PE Section List virtual size. This is always the same as `physical_size`."},{"field":"threat.enrichments.indicator.file.size","type":"long","normalization":"","example":16384,"description":"File size in bytes."},{"field":"threat.enrichments.indicator.file.target_path","type":"keyword","normalization":"","example":"","description":"Target path for symlinks."},{"field":"threat.enrichments.indicator.file.target_path.text","type":"match_only_text","normalization":"","example":"","description":"Target path for symlinks."},{"field":"threat.enrichments.indicator.file.type","type":"keyword","normalization":"","example":"file","description":"File type (file, dir, or symlink)."},{"field":"threat.enrichments.indicator.file.uid","type":"keyword","normalization":"","example":1001,"description":"The user ID (UID) or security identifier (SID) of the file owner."},{"field":"threat.enrichments.indicator.file.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"threat.enrichments.indicator.file.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"threat.enrichments.indicator.file.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"threat.enrichments.indicator.file.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"threat.enrichments.indicator.file.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"threat.enrichments.indicator.file.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"threat.enrichments.indicator.file.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"threat.enrichments.indicator.file.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.enrichments.indicator.file.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"threat.enrichments.indicator.file.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"threat.enrichments.indicator.file.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"threat.enrichments.indicator.file.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"threat.enrichments.indicator.file.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"threat.enrichments.indicator.file.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"threat.enrichments.indicator.file.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"threat.enrichments.indicator.file.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"threat.enrichments.indicator.file.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"threat.enrichments.indicator.file.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"threat.enrichments.indicator.file.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"threat.enrichments.indicator.file.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"threat.enrichments.indicator.file.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"threat.enrichments.indicator.file.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"threat.enrichments.indicator.file.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.enrichments.indicator.file.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"threat.enrichments.indicator.first_seen","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was first reported."},{"field":"threat.enrichments.indicator.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"threat.enrichments.indicator.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"threat.enrichments.indicator.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"threat.enrichments.indicator.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"threat.enrichments.indicator.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"threat.enrichments.indicator.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"threat.enrichments.indicator.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"threat.enrichments.indicator.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"threat.enrichments.indicator.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"threat.enrichments.indicator.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"threat.enrichments.indicator.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"threat.enrichments.indicator.ip","type":"ip","normalization":"","example":"1.2.3.4","description":"Indicator IP address"},{"field":"threat.enrichments.indicator.last_seen","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was last reported."},{"field":"threat.enrichments.indicator.marking.tlp","type":"keyword","normalization":"","example":"CLEAR","description":"Indicator TLP marking"},{"field":"threat.enrichments.indicator.marking.tlp_version","type":"keyword","normalization":"","example":2,"description":"Indicator TLP version"},{"field":"threat.enrichments.indicator.modified_at","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was last updated."},{"field":"threat.enrichments.indicator.name","type":"keyword","normalization":"","example":"5.2.75.227","description":"Indicator display name"},{"field":"threat.enrichments.indicator.port","type":"long","normalization":"","example":443,"description":"Indicator port"},{"field":"threat.enrichments.indicator.provider","type":"keyword","normalization":"","example":"lrz_urlhaus","description":"Indicator provider"},{"field":"threat.enrichments.indicator.reference","type":"keyword","normalization":"","example":"https://system.example.com/indicator/0001234","description":"Indicator reference URL"},{"field":"threat.enrichments.indicator.registry.data.bytes","type":"keyword","normalization":"","example":"ZQBuAC0AVQBTAAAAZQBuAAAAAAA=","description":"Original bytes written with base64 encoding."},{"field":"threat.enrichments.indicator.registry.data.strings","type":"wildcard","normalization":"array","example":"[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]","description":"List of strings representing what was written to the registry."},{"field":"threat.enrichments.indicator.registry.data.type","type":"keyword","normalization":"","example":"REG_SZ","description":"Standard registry type for encoding contents"},{"field":"threat.enrichments.indicator.registry.hive","type":"keyword","normalization":"","example":"HKLM","description":"Abbreviated name for the hive."},{"field":"threat.enrichments.indicator.registry.key","type":"keyword","normalization":"","example":"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe","description":"Hive-relative path of keys."},{"field":"threat.enrichments.indicator.registry.path","type":"keyword","normalization":"","example":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger","description":"Full path, including hive, key and value"},{"field":"threat.enrichments.indicator.registry.value","type":"keyword","normalization":"","example":"Debugger","description":"Name of the value written."},{"field":"threat.enrichments.indicator.scanner_stats","type":"long","normalization":"","example":4,"description":"Scanner statistics"},{"field":"threat.enrichments.indicator.sightings","type":"long","normalization":"","example":20,"description":"Number of times indicator observed"},{"field":"threat.enrichments.indicator.type","type":"keyword","normalization":"","example":"ipv4-addr","description":"Type of indicator"},{"field":"threat.enrichments.indicator.url.domain","type":"keyword","normalization":"","example":"www.elastic.co","description":"Domain of the url."},{"field":"threat.enrichments.indicator.url.extension","type":"keyword","normalization":"","example":"png","description":"File extension from the request url, excluding the leading dot."},{"field":"threat.enrichments.indicator.url.fragment","type":"keyword","normalization":"","example":"","description":"Portion of the url after the `#`."},{"field":"threat.enrichments.indicator.url.full","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"threat.enrichments.indicator.url.full.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"threat.enrichments.indicator.url.original","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"threat.enrichments.indicator.url.original.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"threat.enrichments.indicator.url.password","type":"keyword","normalization":"","example":"","description":"Password of the request."},{"field":"threat.enrichments.indicator.url.path","type":"wildcard","normalization":"","example":"","description":"Path of the request, such as \"/search\"."},{"field":"threat.enrichments.indicator.url.port","type":"long","normalization":"","example":443,"description":"Port of the request, such as 443."},{"field":"threat.enrichments.indicator.url.query","type":"keyword","normalization":"","example":"","description":"Query string of the request."},{"field":"threat.enrichments.indicator.url.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered url domain, stripped of the subdomain."},{"field":"threat.enrichments.indicator.url.scheme","type":"keyword","normalization":"","example":"https","description":"Scheme of the url."},{"field":"threat.enrichments.indicator.url.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"threat.enrichments.indicator.url.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"threat.enrichments.indicator.url.username","type":"keyword","normalization":"","example":"","description":"Username of the request."},{"field":"threat.enrichments.indicator.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"threat.enrichments.indicator.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"threat.enrichments.indicator.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"threat.enrichments.indicator.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"threat.enrichments.indicator.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"threat.enrichments.indicator.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"threat.enrichments.indicator.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"threat.enrichments.indicator.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.enrichments.indicator.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"threat.enrichments.indicator.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"threat.enrichments.indicator.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"threat.enrichments.indicator.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"threat.enrichments.indicator.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"threat.enrichments.indicator.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"threat.enrichments.indicator.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"threat.enrichments.indicator.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"threat.enrichments.indicator.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"threat.enrichments.indicator.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"threat.enrichments.indicator.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"threat.enrichments.indicator.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"threat.enrichments.indicator.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"threat.enrichments.indicator.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"threat.enrichments.indicator.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.enrichments.indicator.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"threat.enrichments.matched.atomic","type":"keyword","normalization":"","example":"bad-domain.com","description":"Matched indicator value"},{"field":"threat.enrichments.matched.field","type":"keyword","normalization":"","example":"file.hash.sha256","description":"Matched indicator field"},{"field":"threat.enrichments.matched.id","type":"keyword","normalization":"","example":"ff93aee5-86a1-4a61-b0e6-0cdc313d01b5","description":"Matched indicator identifier"},{"field":"threat.enrichments.matched.index","type":"keyword","normalization":"","example":"filebeat-8.0.0-2021.05.23-000011","description":"Matched indicator index"},{"field":"threat.enrichments.matched.occurred","type":"date","normalization":"","example":"2021-10-05T17:00:58.326Z","description":"Date of match"},{"field":"threat.enrichments.matched.type","type":"keyword","normalization":"","example":"indicator_match_rule","description":"Type of indicator match"},{"field":"threat.feed.dashboard_id","type":"keyword","normalization":"","example":"5ba16340-72e6-11eb-a3e3-b3cc7c78a70f","description":"Feed dashboard ID."},{"field":"threat.feed.description","type":"keyword","normalization":"","example":"Threat feed from the AlienVault Open Threat eXchange network.","description":"Description of the threat feed."},{"field":"threat.feed.name","type":"keyword","normalization":"","example":"AlienVault OTX","description":"Name of the threat feed."},{"field":"threat.feed.reference","type":"keyword","normalization":"","example":"https://otx.alienvault.com","description":"Reference for the threat feed."},{"field":"threat.framework","type":"keyword","normalization":"","example":"MITRE ATT&CK","description":"Threat classification framework."},{"field":"threat.group.alias","type":"keyword","normalization":"array","example":["Magecart Group 6"],"description":"Alias of the group."},{"field":"threat.group.id","type":"keyword","normalization":"","example":"G0037","description":"ID of the group."},{"field":"threat.group.name","type":"keyword","normalization":"","example":"FIN6","description":"Name of the group."},{"field":"threat.group.reference","type":"keyword","normalization":"","example":"https://attack.mitre.org/groups/G0037/","description":"Reference URL of the group."},{"field":"threat.indicator.as.number","type":"long","normalization":"","example":15169,"description":"Unique number allocated to the autonomous system."},{"field":"threat.indicator.as.organization.name","type":"keyword","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"threat.indicator.as.organization.name.text","type":"match_only_text","normalization":"","example":"Google LLC","description":"Organization name."},{"field":"threat.indicator.confidence","type":"keyword","normalization":"","example":"Medium","description":"Indicator confidence rating"},{"field":"threat.indicator.description","type":"keyword","normalization":"","example":"IP x.x.x.x was observed delivering the Angler EK.","description":"Indicator description"},{"field":"threat.indicator.email.address","type":"keyword","normalization":"","example":"phish@example.com","description":"Indicator email address"},{"field":"threat.indicator.file.accessed","type":"date","normalization":"","example":"","description":"Last time the file was accessed."},{"field":"threat.indicator.file.attributes","type":"keyword","normalization":"array","example":["readonly","system"],"description":"Array of file attributes."},{"field":"threat.indicator.file.code_signature.digest_algorithm","type":"keyword","normalization":"","example":"sha256","description":"Hashing algorithm used to sign the process."},{"field":"threat.indicator.file.code_signature.exists","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if a signature is present."},{"field":"threat.indicator.file.code_signature.signing_id","type":"keyword","normalization":"","example":"com.apple.xpc.proxy","description":"The identifier used to sign the process."},{"field":"threat.indicator.file.code_signature.status","type":"keyword","normalization":"","example":"ERROR_UNTRUSTED_ROOT","description":"Additional information about the certificate status."},{"field":"threat.indicator.file.code_signature.subject_name","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Subject name of the code signer"},{"field":"threat.indicator.file.code_signature.team_id","type":"keyword","normalization":"","example":"EQHXZ8M8AV","description":"The team identifier used to sign the process."},{"field":"threat.indicator.file.code_signature.timestamp","type":"date","normalization":"","example":"2021-01-01T12:10:30Z","description":"When the signature was generated and signed."},{"field":"threat.indicator.file.code_signature.trusted","type":"boolean","normalization":"","example":true,"description":"Stores the trust status of the certificate chain."},{"field":"threat.indicator.file.code_signature.valid","type":"boolean","normalization":"","example":true,"description":"Boolean to capture if the digital signature is verified against the binary content."},{"field":"threat.indicator.file.created","type":"date","normalization":"","example":"","description":"File creation time."},{"field":"threat.indicator.file.ctime","type":"date","normalization":"","example":"","description":"Last time the file attributes or metadata changed."},{"field":"threat.indicator.file.device","type":"keyword","normalization":"","example":"sda","description":"Device that is the source of the file."},{"field":"threat.indicator.file.directory","type":"keyword","normalization":"","example":"/home/alice","description":"Directory where the file is located."},{"field":"threat.indicator.file.drive_letter","type":"keyword","normalization":"","example":"C","description":"Drive letter where the file is located."},{"field":"threat.indicator.file.elf.architecture","type":"keyword","normalization":"","example":"x86-64","description":"Machine architecture of the ELF file."},{"field":"threat.indicator.file.elf.byte_order","type":"keyword","normalization":"","example":"Little Endian","description":"Byte sequence of ELF file."},{"field":"threat.indicator.file.elf.cpu_type","type":"keyword","normalization":"","example":"Intel","description":"CPU type of the ELF file."},{"field":"threat.indicator.file.elf.creation_date","type":"date","normalization":"","example":"","description":"Build or compile date."},{"field":"threat.indicator.file.elf.exports","type":"flattened","normalization":"array","example":"","description":"List of exported element names and types."},{"field":"threat.indicator.file.elf.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in an ELF file."},{"field":"threat.indicator.file.elf.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"threat.indicator.file.elf.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"threat.indicator.file.elf.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"threat.indicator.file.elf.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"threat.indicator.file.elf.header.abi_version","type":"keyword","normalization":"","example":"","description":"Version of the ELF Application Binary Interface (ABI)."},{"field":"threat.indicator.file.elf.header.class","type":"keyword","normalization":"","example":"","description":"Header class of the ELF file."},{"field":"threat.indicator.file.elf.header.data","type":"keyword","normalization":"","example":"","description":"Data table of the ELF header."},{"field":"threat.indicator.file.elf.header.entrypoint","type":"long","normalization":"","example":"","description":"Header entrypoint of the ELF file."},{"field":"threat.indicator.file.elf.header.object_version","type":"keyword","normalization":"","example":"","description":"0x1\" for original ELF files."},{"field":"threat.indicator.file.elf.header.os_abi","type":"keyword","normalization":"","example":"","description":"Application Binary Interface (ABI) of the Linux OS."},{"field":"threat.indicator.file.elf.header.type","type":"keyword","normalization":"","example":"","description":"Header type of the ELF file."},{"field":"threat.indicator.file.elf.header.version","type":"keyword","normalization":"","example":"","description":"Version of the ELF header."},{"field":"threat.indicator.file.elf.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in an ELF file."},{"field":"threat.indicator.file.elf.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"threat.indicator.file.elf.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"threat.indicator.file.elf.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"threat.indicator.file.elf.sections","type":"nested","normalization":"array","example":"","description":"Section information of the ELF file."},{"field":"threat.indicator.file.elf.sections.chi2","type":"long","normalization":"","example":"","description":"Chi-square probability distribution of the section."},{"field":"threat.indicator.file.elf.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"threat.indicator.file.elf.sections.flags","type":"keyword","normalization":"","example":"","description":"ELF Section List flags."},{"field":"threat.indicator.file.elf.sections.name","type":"keyword","normalization":"","example":"","description":"ELF Section List name."},{"field":"threat.indicator.file.elf.sections.physical_offset","type":"keyword","normalization":"","example":"","description":"ELF Section List offset."},{"field":"threat.indicator.file.elf.sections.physical_size","type":"long","normalization":"","example":"","description":"ELF Section List physical size."},{"field":"threat.indicator.file.elf.sections.type","type":"keyword","normalization":"","example":"","description":"ELF Section List type."},{"field":"threat.indicator.file.elf.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"threat.indicator.file.elf.sections.virtual_address","type":"long","normalization":"","example":"","description":"ELF Section List virtual address."},{"field":"threat.indicator.file.elf.sections.virtual_size","type":"long","normalization":"","example":"","description":"ELF Section List virtual size."},{"field":"threat.indicator.file.elf.segments","type":"nested","normalization":"array","example":"","description":"ELF object segment list."},{"field":"threat.indicator.file.elf.segments.sections","type":"keyword","normalization":"","example":"","description":"ELF object segment sections."},{"field":"threat.indicator.file.elf.segments.type","type":"keyword","normalization":"","example":"","description":"ELF object segment type."},{"field":"threat.indicator.file.elf.shared_libraries","type":"keyword","normalization":"array","example":"","description":"List of shared libraries used by this ELF object."},{"field":"threat.indicator.file.elf.telfhash","type":"keyword","normalization":"","example":"","description":"telfhash hash for ELF file."},{"field":"threat.indicator.file.extension","type":"keyword","normalization":"","example":"png","description":"File extension, excluding the leading dot."},{"field":"threat.indicator.file.fork_name","type":"keyword","normalization":"","example":"Zone.Identifer","description":"A fork is additional data associated with a filesystem object."},{"field":"threat.indicator.file.gid","type":"keyword","normalization":"","example":1001,"description":"Primary group ID (GID) of the file."},{"field":"threat.indicator.file.group","type":"keyword","normalization":"","example":"alice","description":"Primary group name of the file."},{"field":"threat.indicator.file.hash.md5","type":"keyword","normalization":"","example":"","description":"MD5 hash."},{"field":"threat.indicator.file.hash.sha1","type":"keyword","normalization":"","example":"","description":"SHA1 hash."},{"field":"threat.indicator.file.hash.sha256","type":"keyword","normalization":"","example":"","description":"SHA256 hash."},{"field":"threat.indicator.file.hash.sha384","type":"keyword","normalization":"","example":"","description":"SHA384 hash."},{"field":"threat.indicator.file.hash.sha512","type":"keyword","normalization":"","example":"","description":"SHA512 hash."},{"field":"threat.indicator.file.hash.ssdeep","type":"keyword","normalization":"","example":"","description":"SSDEEP hash."},{"field":"threat.indicator.file.hash.tlsh","type":"keyword","normalization":"","example":"","description":"TLSH hash."},{"field":"threat.indicator.file.inode","type":"keyword","normalization":"","example":256383,"description":"Inode representing the file in the filesystem."},{"field":"threat.indicator.file.mime_type","type":"keyword","normalization":"","example":"","description":"Media type of file, document, or arrangement of bytes."},{"field":"threat.indicator.file.mode","type":"keyword","normalization":"","example":"0640","description":"Mode of the file in octal representation."},{"field":"threat.indicator.file.mtime","type":"date","normalization":"","example":"","description":"Last time the file content was modified."},{"field":"threat.indicator.file.name","type":"keyword","normalization":"","example":"example.png","description":"Name of the file including the extension, without the directory."},{"field":"threat.indicator.file.owner","type":"keyword","normalization":"","example":"alice","description":"File owner's username."},{"field":"threat.indicator.file.path","type":"keyword","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"threat.indicator.file.path.text","type":"match_only_text","normalization":"","example":"/home/alice/example.png","description":"Full path to the file, including the file name."},{"field":"threat.indicator.file.pe.architecture","type":"keyword","normalization":"","example":"x64","description":"CPU architecture target for the file."},{"field":"threat.indicator.file.pe.company","type":"keyword","normalization":"","example":"Microsoft Corporation","description":"Internal company name of the file, provided at compile-time."},{"field":"threat.indicator.file.pe.description","type":"keyword","normalization":"","example":"Paint","description":"Internal description of the file, provided at compile-time."},{"field":"threat.indicator.file.pe.file_version","type":"keyword","normalization":"","example":"6.3.9600.17415","description":"Process name."},{"field":"threat.indicator.file.pe.go_import_hash","type":"keyword","normalization":"","example":"10bddcb4cee42080f76c88d9ff964491","description":"A hash of the Go language imports in a PE file."},{"field":"threat.indicator.file.pe.go_imports","type":"flattened","normalization":"","example":"","description":"List of imported Go language element names and types."},{"field":"threat.indicator.file.pe.go_imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of Go imports."},{"field":"threat.indicator.file.pe.go_imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of Go imports."},{"field":"threat.indicator.file.pe.go_stripped","type":"boolean","normalization":"","example":"","description":"Whether the file is a stripped or obfuscated Go executable."},{"field":"threat.indicator.file.pe.imphash","type":"keyword","normalization":"","example":"0c6803c4e922103c4dca5963aad36ddf","description":"A hash of the imports in a PE file."},{"field":"threat.indicator.file.pe.import_hash","type":"keyword","normalization":"","example":"d41d8cd98f00b204e9800998ecf8427e","description":"A hash of the imports in a PE file."},{"field":"threat.indicator.file.pe.imports","type":"flattened","normalization":"array","example":"","description":"List of imported element names and types."},{"field":"threat.indicator.file.pe.imports_names_entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the list of imported element names and types."},{"field":"threat.indicator.file.pe.imports_names_var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the list of imported element names and types."},{"field":"threat.indicator.file.pe.original_file_name","type":"keyword","normalization":"","example":"MSPAINT.EXE","description":"Internal name of the file, provided at compile-time."},{"field":"threat.indicator.file.pe.pehash","type":"keyword","normalization":"","example":"73ff189b63cd6be375a7ff25179a38d347651975","description":"A hash of the PE header and data from one or more PE sections."},{"field":"threat.indicator.file.pe.product","type":"keyword","normalization":"","example":"Microsoft® Windows® Operating System","description":"Internal product name of the file, provided at compile-time."},{"field":"threat.indicator.file.pe.sections","type":"nested","normalization":"array","example":"","description":"Section information of the PE file."},{"field":"threat.indicator.file.pe.sections.entropy","type":"long","normalization":"","example":"","description":"Shannon entropy calculation from the section."},{"field":"threat.indicator.file.pe.sections.name","type":"keyword","normalization":"","example":"","description":"PE Section List name."},{"field":"threat.indicator.file.pe.sections.physical_size","type":"long","normalization":"","example":"","description":"PE Section List physical size."},{"field":"threat.indicator.file.pe.sections.var_entropy","type":"long","normalization":"","example":"","description":"Variance for Shannon entropy calculation from the section."},{"field":"threat.indicator.file.pe.sections.virtual_size","type":"long","normalization":"","example":"","description":"PE Section List virtual size. This is always the same as `physical_size`."},{"field":"threat.indicator.file.size","type":"long","normalization":"","example":16384,"description":"File size in bytes."},{"field":"threat.indicator.file.target_path","type":"keyword","normalization":"","example":"","description":"Target path for symlinks."},{"field":"threat.indicator.file.target_path.text","type":"match_only_text","normalization":"","example":"","description":"Target path for symlinks."},{"field":"threat.indicator.file.type","type":"keyword","normalization":"","example":"file","description":"File type (file, dir, or symlink)."},{"field":"threat.indicator.file.uid","type":"keyword","normalization":"","example":1001,"description":"The user ID (UID) or security identifier (SID) of the file owner."},{"field":"threat.indicator.file.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"threat.indicator.file.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"threat.indicator.file.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"threat.indicator.file.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"threat.indicator.file.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"threat.indicator.file.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"threat.indicator.file.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"threat.indicator.file.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.indicator.file.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"threat.indicator.file.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"threat.indicator.file.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"threat.indicator.file.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"threat.indicator.file.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"threat.indicator.file.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"threat.indicator.file.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"threat.indicator.file.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"threat.indicator.file.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"threat.indicator.file.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"threat.indicator.file.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"threat.indicator.file.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"threat.indicator.file.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"threat.indicator.file.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"threat.indicator.file.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.indicator.file.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"threat.indicator.first_seen","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was first reported."},{"field":"threat.indicator.geo.city_name","type":"keyword","normalization":"","example":"Montreal","description":"City name."},{"field":"threat.indicator.geo.continent_code","type":"keyword","normalization":"","example":"NA","description":"Continent code."},{"field":"threat.indicator.geo.continent_name","type":"keyword","normalization":"","example":"North America","description":"Name of the continent."},{"field":"threat.indicator.geo.country_iso_code","type":"keyword","normalization":"","example":"CA","description":"Country ISO code."},{"field":"threat.indicator.geo.country_name","type":"keyword","normalization":"","example":"Canada","description":"Country name."},{"field":"threat.indicator.geo.location","type":"geo_point","normalization":"","example":{"lon":-73.61483,"lat":45.505918},"description":"Longitude and latitude."},{"field":"threat.indicator.geo.name","type":"keyword","normalization":"","example":"boston-dc","description":"User-defined description of a location."},{"field":"threat.indicator.geo.postal_code","type":"keyword","normalization":"","example":94040,"description":"Postal code."},{"field":"threat.indicator.geo.region_iso_code","type":"keyword","normalization":"","example":"CA-QC","description":"Region ISO code."},{"field":"threat.indicator.geo.region_name","type":"keyword","normalization":"","example":"Quebec","description":"Region name."},{"field":"threat.indicator.geo.timezone","type":"keyword","normalization":"","example":"America/Argentina/Buenos_Aires","description":"Time zone."},{"field":"threat.indicator.ip","type":"ip","normalization":"","example":"1.2.3.4","description":"Indicator IP address"},{"field":"threat.indicator.last_seen","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was last reported."},{"field":"threat.indicator.marking.tlp","type":"keyword","normalization":"","example":"CLEAR","description":"Indicator TLP marking"},{"field":"threat.indicator.marking.tlp_version","type":"keyword","normalization":"","example":2,"description":"Indicator TLP version"},{"field":"threat.indicator.modified_at","type":"date","normalization":"","example":"2020-11-05T17:25:47.000Z","description":"Date/time indicator was last updated."},{"field":"threat.indicator.name","type":"keyword","normalization":"","example":"5.2.75.227","description":"Indicator display name"},{"field":"threat.indicator.port","type":"long","normalization":"","example":443,"description":"Indicator port"},{"field":"threat.indicator.provider","type":"keyword","normalization":"","example":"lrz_urlhaus","description":"Indicator provider"},{"field":"threat.indicator.reference","type":"keyword","normalization":"","example":"https://system.example.com/indicator/0001234","description":"Indicator reference URL"},{"field":"threat.indicator.registry.data.bytes","type":"keyword","normalization":"","example":"ZQBuAC0AVQBTAAAAZQBuAAAAAAA=","description":"Original bytes written with base64 encoding."},{"field":"threat.indicator.registry.data.strings","type":"wildcard","normalization":"array","example":"[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]","description":"List of strings representing what was written to the registry."},{"field":"threat.indicator.registry.data.type","type":"keyword","normalization":"","example":"REG_SZ","description":"Standard registry type for encoding contents"},{"field":"threat.indicator.registry.hive","type":"keyword","normalization":"","example":"HKLM","description":"Abbreviated name for the hive."},{"field":"threat.indicator.registry.key","type":"keyword","normalization":"","example":"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe","description":"Hive-relative path of keys."},{"field":"threat.indicator.registry.path","type":"keyword","normalization":"","example":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger","description":"Full path, including hive, key and value"},{"field":"threat.indicator.registry.value","type":"keyword","normalization":"","example":"Debugger","description":"Name of the value written."},{"field":"threat.indicator.scanner_stats","type":"long","normalization":"","example":4,"description":"Scanner statistics"},{"field":"threat.indicator.sightings","type":"long","normalization":"","example":20,"description":"Number of times indicator observed"},{"field":"threat.indicator.type","type":"keyword","normalization":"","example":"ipv4-addr","description":"Type of indicator"},{"field":"threat.indicator.url.domain","type":"keyword","normalization":"","example":"www.elastic.co","description":"Domain of the url."},{"field":"threat.indicator.url.extension","type":"keyword","normalization":"","example":"png","description":"File extension from the request url, excluding the leading dot."},{"field":"threat.indicator.url.fragment","type":"keyword","normalization":"","example":"","description":"Portion of the url after the `#`."},{"field":"threat.indicator.url.full","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"threat.indicator.url.full.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"threat.indicator.url.original","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"threat.indicator.url.original.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"threat.indicator.url.password","type":"keyword","normalization":"","example":"","description":"Password of the request."},{"field":"threat.indicator.url.path","type":"wildcard","normalization":"","example":"","description":"Path of the request, such as \"/search\"."},{"field":"threat.indicator.url.port","type":"long","normalization":"","example":443,"description":"Port of the request, such as 443."},{"field":"threat.indicator.url.query","type":"keyword","normalization":"","example":"","description":"Query string of the request."},{"field":"threat.indicator.url.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered url domain, stripped of the subdomain."},{"field":"threat.indicator.url.scheme","type":"keyword","normalization":"","example":"https","description":"Scheme of the url."},{"field":"threat.indicator.url.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"threat.indicator.url.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"threat.indicator.url.username","type":"keyword","normalization":"","example":"","description":"Username of the request."},{"field":"threat.indicator.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"threat.indicator.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"threat.indicator.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"threat.indicator.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"threat.indicator.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"threat.indicator.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"threat.indicator.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"threat.indicator.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.indicator.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"threat.indicator.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"threat.indicator.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"threat.indicator.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"threat.indicator.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"threat.indicator.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"threat.indicator.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"threat.indicator.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"threat.indicator.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"threat.indicator.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"threat.indicator.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"threat.indicator.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"threat.indicator.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"threat.indicator.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"threat.indicator.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"threat.indicator.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"threat.software.alias","type":"keyword","normalization":"array","example":["X-Agent"],"description":"Alias of the software"},{"field":"threat.software.id","type":"keyword","normalization":"","example":"S0552","description":"ID of the software"},{"field":"threat.software.name","type":"keyword","normalization":"","example":"AdFind","description":"Name of the software."},{"field":"threat.software.platforms","type":"keyword","normalization":"array","example":["Windows"],"description":"Platforms of the software."},{"field":"threat.software.reference","type":"keyword","normalization":"","example":"https://attack.mitre.org/software/S0552/","description":"Software reference URL."},{"field":"threat.software.type","type":"keyword","normalization":"","example":"Tool","description":"Software type."},{"field":"threat.tactic.id","type":"keyword","normalization":"array","example":"TA0002","description":"Threat tactic id."},{"field":"threat.tactic.name","type":"keyword","normalization":"array","example":"Execution","description":"Threat tactic."},{"field":"threat.tactic.reference","type":"keyword","normalization":"array","example":"https://attack.mitre.org/tactics/TA0002/","description":"Threat tactic URL reference."},{"field":"threat.technique.id","type":"keyword","normalization":"array","example":"T1059","description":"Threat technique id."},{"field":"threat.technique.name","type":"keyword","normalization":"array","example":"Command and Scripting Interpreter","description":"Threat technique name."},{"field":"threat.technique.name.text","type":"match_only_text","normalization":"","example":"Command and Scripting Interpreter","description":"Threat technique name."},{"field":"threat.technique.reference","type":"keyword","normalization":"array","example":"https://attack.mitre.org/techniques/T1059/","description":"Threat technique URL reference."},{"field":"threat.technique.subtechnique.id","type":"keyword","normalization":"array","example":"T1059.001","description":"Threat subtechnique id."},{"field":"threat.technique.subtechnique.name","type":"keyword","normalization":"array","example":"PowerShell","description":"Threat subtechnique name."},{"field":"threat.technique.subtechnique.name.text","type":"match_only_text","normalization":"","example":"PowerShell","description":"Threat subtechnique name."},{"field":"threat.technique.subtechnique.reference","type":"keyword","normalization":"array","example":"https://attack.mitre.org/techniques/T1059/001/","description":"Threat subtechnique URL reference."},{"field":"tls.cipher","type":"keyword","normalization":"","example":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","description":"String indicating the cipher used during the current connection."},{"field":"tls.client.certificate","type":"keyword","normalization":"","example":"MII...","description":"PEM-encoded stand-alone certificate offered by the client."},{"field":"tls.client.certificate_chain","type":"keyword","normalization":"array","example":["MII...","MII..."],"description":"Array of PEM-encoded certificates that make up the certificate chain offered by the client."},{"field":"tls.client.hash.md5","type":"keyword","normalization":"","example":"0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC","description":"Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client."},{"field":"tls.client.hash.sha1","type":"keyword","normalization":"","example":"9E393D93138888D288266C2D915214D1D1CCEB2A","description":"Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client."},{"field":"tls.client.hash.sha256","type":"keyword","normalization":"","example":"0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0","description":"Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client."},{"field":"tls.client.issuer","type":"keyword","normalization":"","example":"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com","description":"Distinguished name of subject of the issuer of the x.509 certificate presented by the client."},{"field":"tls.client.ja3","type":"keyword","normalization":"","example":"d4e5b18d6b55c71272893221c96ba240","description":"A hash that identifies clients based on how they perform an SSL/TLS handshake."},{"field":"tls.client.not_after","type":"date","normalization":"","example":"2021-01-01T00:00:00.000Z","description":"Date/Time indicating when client certificate is no longer considered valid."},{"field":"tls.client.not_before","type":"date","normalization":"","example":"1970-01-01T00:00:00.000Z","description":"Date/Time indicating when client certificate is first considered valid."},{"field":"tls.client.server_name","type":"keyword","normalization":"","example":"www.elastic.co","description":"Hostname the client is trying to connect to. Also called the SNI."},{"field":"tls.client.subject","type":"keyword","normalization":"","example":"CN=myclient, OU=Documentation Team, DC=example, DC=com","description":"Distinguished name of subject of the x.509 certificate presented by the client."},{"field":"tls.client.supported_ciphers","type":"keyword","normalization":"array","example":["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","..."],"description":"Array of ciphers offered by the client during the client hello."},{"field":"tls.client.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"tls.client.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"tls.client.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"tls.client.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"tls.client.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"tls.client.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"tls.client.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"tls.client.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"tls.client.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"tls.client.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"tls.client.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"tls.client.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"tls.client.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"tls.client.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"tls.client.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"tls.client.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"tls.client.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"tls.client.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"tls.client.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"tls.client.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"tls.client.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"tls.client.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"tls.client.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"tls.client.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"tls.curve","type":"keyword","normalization":"","example":"secp256r1","description":"String indicating the curve used for the given cipher, when applicable."},{"field":"tls.established","type":"boolean","normalization":"","example":"","description":"Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel."},{"field":"tls.next_protocol","type":"keyword","normalization":"","example":"http/1.1","description":"String indicating the protocol being tunneled."},{"field":"tls.resumed","type":"boolean","normalization":"","example":"","description":"Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation."},{"field":"tls.server.certificate","type":"keyword","normalization":"","example":"MII...","description":"PEM-encoded stand-alone certificate offered by the server."},{"field":"tls.server.certificate_chain","type":"keyword","normalization":"array","example":["MII...","MII..."],"description":"Array of PEM-encoded certificates that make up the certificate chain offered by the server."},{"field":"tls.server.hash.md5","type":"keyword","normalization":"","example":"0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC","description":"Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server."},{"field":"tls.server.hash.sha1","type":"keyword","normalization":"","example":"9E393D93138888D288266C2D915214D1D1CCEB2A","description":"Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server."},{"field":"tls.server.hash.sha256","type":"keyword","normalization":"","example":"0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0","description":"Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server."},{"field":"tls.server.issuer","type":"keyword","normalization":"","example":"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com","description":"Subject of the issuer of the x.509 certificate presented by the server."},{"field":"tls.server.ja3s","type":"keyword","normalization":"","example":"394441ab65754e2207b1e1b457b3641d","description":"A hash that identifies servers based on how they perform an SSL/TLS handshake."},{"field":"tls.server.not_after","type":"date","normalization":"","example":"2021-01-01T00:00:00.000Z","description":"Timestamp indicating when server certificate is no longer considered valid."},{"field":"tls.server.not_before","type":"date","normalization":"","example":"1970-01-01T00:00:00.000Z","description":"Timestamp indicating when server certificate is first considered valid."},{"field":"tls.server.subject","type":"keyword","normalization":"","example":"CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com","description":"Subject of the x.509 certificate presented by the server."},{"field":"tls.server.x509.alternative_names","type":"keyword","normalization":"array","example":"*.elastic.co","description":"List of subject alternative names (SAN)."},{"field":"tls.server.x509.issuer.common_name","type":"keyword","normalization":"array","example":"Example SHA2 High Assurance Server CA","description":"List of common name (CN) of issuing certificate authority."},{"field":"tls.server.x509.issuer.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) codes"},{"field":"tls.server.x509.issuer.distinguished_name","type":"keyword","normalization":"","example":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","description":"Distinguished name (DN) of issuing certificate authority."},{"field":"tls.server.x509.issuer.locality","type":"keyword","normalization":"array","example":"Mountain View","description":"List of locality names (L)"},{"field":"tls.server.x509.issuer.organization","type":"keyword","normalization":"array","example":"Example Inc","description":"List of organizations (O) of issuing certificate authority."},{"field":"tls.server.x509.issuer.organizational_unit","type":"keyword","normalization":"array","example":"www.example.com","description":"List of organizational units (OU) of issuing certificate authority."},{"field":"tls.server.x509.issuer.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"tls.server.x509.not_after","type":"date","normalization":"","example":"2020-07-16T03:15:39Z","description":"Time at which the certificate is no longer considered valid."},{"field":"tls.server.x509.not_before","type":"date","normalization":"","example":"2019-08-16T01:40:25Z","description":"Time at which the certificate is first considered valid."},{"field":"tls.server.x509.public_key_algorithm","type":"keyword","normalization":"","example":"RSA","description":"Algorithm used to generate the public key."},{"field":"tls.server.x509.public_key_curve","type":"keyword","normalization":"","example":"nistp521","description":"The curve used by the elliptic curve public key algorithm. This is algorithm specific."},{"field":"tls.server.x509.public_key_exponent","type":"long","normalization":"","example":65537,"description":"Exponent used to derive the public key. This is algorithm specific."},{"field":"tls.server.x509.public_key_size","type":"long","normalization":"","example":2048,"description":"The size of the public key space in bits."},{"field":"tls.server.x509.serial_number","type":"keyword","normalization":"","example":"55FBB9C7DEBF09809D12CCAA","description":"Unique serial number issued by the certificate authority."},{"field":"tls.server.x509.signature_algorithm","type":"keyword","normalization":"","example":"SHA256-RSA","description":"Identifier for certificate signature algorithm."},{"field":"tls.server.x509.subject.common_name","type":"keyword","normalization":"array","example":"shared.global.example.net","description":"List of common names (CN) of subject."},{"field":"tls.server.x509.subject.country","type":"keyword","normalization":"array","example":"US","description":"List of country \\(C) code"},{"field":"tls.server.x509.subject.distinguished_name","type":"keyword","normalization":"","example":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","description":"Distinguished name (DN) of the certificate subject entity."},{"field":"tls.server.x509.subject.locality","type":"keyword","normalization":"array","example":"San Francisco","description":"List of locality names (L)"},{"field":"tls.server.x509.subject.organization","type":"keyword","normalization":"array","example":"Example, Inc.","description":"List of organizations (O) of subject."},{"field":"tls.server.x509.subject.organizational_unit","type":"keyword","normalization":"array","example":"","description":"List of organizational units (OU) of subject."},{"field":"tls.server.x509.subject.state_or_province","type":"keyword","normalization":"array","example":"California","description":"List of state or province names (ST, S, or P)"},{"field":"tls.server.x509.version_number","type":"keyword","normalization":"","example":3,"description":"Version of x509 format."},{"field":"tls.version","type":"keyword","normalization":"","example":1.2,"description":"Numeric part of the version parsed from the original string."},{"field":"tls.version_protocol","type":"keyword","normalization":"","example":"tls","description":"Normalized lowercase protocol name parsed from original string."},{"field":"trace.id","type":"keyword","normalization":"","example":"4bf92f3577b34da6a3ce929d0e0e4736","description":"Unique identifier of the trace."},{"field":"transaction.id","type":"keyword","normalization":"","example":"00f067aa0ba902b7","description":"Unique identifier of the transaction within the scope of its trace."},{"field":"url.domain","type":"keyword","normalization":"","example":"www.elastic.co","description":"Domain of the url."},{"field":"url.extension","type":"keyword","normalization":"","example":"png","description":"File extension from the request url, excluding the leading dot."},{"field":"url.fragment","type":"keyword","normalization":"","example":"","description":"Portion of the url after the `#`."},{"field":"url.full","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"url.full.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top","description":"Full unparsed URL."},{"field":"url.original","type":"wildcard","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"url.original.text","type":"match_only_text","normalization":"","example":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","description":"Unmodified original url as seen in the event source."},{"field":"url.password","type":"keyword","normalization":"","example":"","description":"Password of the request."},{"field":"url.path","type":"wildcard","normalization":"","example":"","description":"Path of the request, such as \"/search\"."},{"field":"url.port","type":"long","normalization":"","example":443,"description":"Port of the request, such as 443."},{"field":"url.query","type":"keyword","normalization":"","example":"","description":"Query string of the request."},{"field":"url.registered_domain","type":"keyword","normalization":"","example":"example.com","description":"The highest registered url domain, stripped of the subdomain."},{"field":"url.scheme","type":"keyword","normalization":"","example":"https","description":"Scheme of the url."},{"field":"url.subdomain","type":"keyword","normalization":"","example":"east","description":"The subdomain of the domain."},{"field":"url.top_level_domain","type":"keyword","normalization":"","example":"co.uk","description":"The effective top level domain (com, org, net, co.uk)."},{"field":"url.username","type":"keyword","normalization":"","example":"","description":"Username of the request."},{"field":"user.changes.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"user.changes.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"user.changes.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.changes.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.changes.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"user.changes.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"user.changes.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"user.changes.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"user.changes.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"user.changes.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.changes.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.changes.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"user.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"user.effective.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"user.effective.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"user.effective.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.effective.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.effective.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"user.effective.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"user.effective.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"user.effective.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"user.effective.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"user.effective.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.effective.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.effective.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"user.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"user.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"user.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"user.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"user.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"user.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"user.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.risk.calculated_level","type":"keyword","normalization":"","example":"High","description":"A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring."},{"field":"user.risk.calculated_score","type":"float","normalization":"","example":880.73,"description":"A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring."},{"field":"user.risk.calculated_score_norm","type":"float","normalization":"","example":88.73,"description":"A normalized risk score calculated by an internal system."},{"field":"user.risk.static_level","type":"keyword","normalization":"","example":"High","description":"A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform."},{"field":"user.risk.static_score","type":"float","normalization":"","example":830,"description":"A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform."},{"field":"user.risk.static_score_norm","type":"float","normalization":"","example":83,"description":"A normalized risk score calculated by an external system."},{"field":"user.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"user.target.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the user is a member of."},{"field":"user.target.email","type":"keyword","normalization":"","example":"","description":"User email address."},{"field":"user.target.full_name","type":"keyword","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.target.full_name.text","type":"match_only_text","normalization":"","example":"Albert Einstein","description":"User's full name, if available."},{"field":"user.target.group.domain","type":"keyword","normalization":"","example":"","description":"Name of the directory the group is a member of."},{"field":"user.target.group.id","type":"keyword","normalization":"","example":"","description":"Unique identifier for the group on the system/platform."},{"field":"user.target.group.name","type":"keyword","normalization":"","example":"","description":"Name of the group."},{"field":"user.target.hash","type":"keyword","normalization":"","example":"","description":"Unique user hash to correlate information for a user in anonymized form."},{"field":"user.target.id","type":"keyword","normalization":"","example":"S-1-5-21-202424912787-2692429404-2351956786-1000","description":"Unique identifier of the user."},{"field":"user.target.name","type":"keyword","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.target.name.text","type":"match_only_text","normalization":"","example":"a.einstein","description":"Short name or login of the user."},{"field":"user.target.roles","type":"keyword","normalization":"array","example":["kibana_admin","reporting_user"],"description":"Array of user roles at the time of the event."},{"field":"user_agent.device.name","type":"keyword","normalization":"","example":"iPhone","description":"Name of the device."},{"field":"user_agent.name","type":"keyword","normalization":"","example":"Safari","description":"Name of the user agent."},{"field":"user_agent.original","type":"keyword","normalization":"","example":"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1","description":"Unparsed user_agent string."},{"field":"user_agent.original.text","type":"match_only_text","normalization":"","example":"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1","description":"Unparsed user_agent string."},{"field":"user_agent.os.family","type":"keyword","normalization":"","example":"debian","description":"OS family (such as redhat, debian, freebsd, windows)."},{"field":"user_agent.os.full","type":"keyword","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"user_agent.os.full.text","type":"match_only_text","normalization":"","example":"Mac OS Mojave","description":"Operating system name, including the version or code name."},{"field":"user_agent.os.kernel","type":"keyword","normalization":"","example":"4.4.0-112-generic","description":"Operating system kernel version as a raw string."},{"field":"user_agent.os.name","type":"keyword","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"user_agent.os.name.text","type":"match_only_text","normalization":"","example":"Mac OS X","description":"Operating system name, without the version."},{"field":"user_agent.os.platform","type":"keyword","normalization":"","example":"darwin","description":"Operating system platform (such centos, ubuntu, windows)."},{"field":"user_agent.os.type","type":"keyword","normalization":"","example":"macos","description":"Which commercial OS family (one of: linux, macos, unix, windows, ios or android)."},{"field":"user_agent.os.version","type":"keyword","normalization":"","example":"10.14.1","description":"Operating system version as a raw string."},{"field":"user_agent.version","type":"keyword","normalization":"","example":12,"description":"Version of the user agent."},{"field":"vulnerability.category","type":"keyword","normalization":"array","example":["Firewall"],"description":"Category of a vulnerability."},{"field":"vulnerability.classification","type":"keyword","normalization":"","example":"CVSS","description":"Classification of the vulnerability."},{"field":"vulnerability.description","type":"keyword","normalization":"","example":"In macOS before 2.12.6, there is a vulnerability in the RPC...","description":"Description of the vulnerability."},{"field":"vulnerability.description.text","type":"match_only_text","normalization":"","example":"In macOS before 2.12.6, there is a vulnerability in the RPC...","description":"Description of the vulnerability."},{"field":"vulnerability.enumeration","type":"keyword","normalization":"","example":"CVE","description":"Identifier of the vulnerability."},{"field":"vulnerability.id","type":"keyword","normalization":"","example":"CVE-2019-00001","description":"ID of the vulnerability."},{"field":"vulnerability.reference","type":"keyword","normalization":"","example":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111","description":"Reference of the vulnerability."},{"field":"vulnerability.report_id","type":"keyword","normalization":"","example":20191018.0001,"description":"Scan identification number."},{"field":"vulnerability.scanner.vendor","type":"keyword","normalization":"","example":"Tenable","description":"Name of the scanner vendor."},{"field":"vulnerability.score.base","type":"float","normalization":"","example":5.5,"description":"Vulnerability Base score."},{"field":"vulnerability.score.environmental","type":"float","normalization":"","example":5.5,"description":"Vulnerability Environmental score."},{"field":"vulnerability.score.temporal","type":"float","normalization":"","example":"","description":"Vulnerability Temporal score."},{"field":"vulnerability.score.version","type":"keyword","normalization":"","example":2,"description":"CVSS version."},{"field":"vulnerability.severity","type":"keyword","normalization":"","example":"Critical","description":"Severity of the vulnerability."}]
\ No newline at end of file
diff --git a/x-pack/plugins/osquery/public/common/schemas/osquery/v5.5.1.json b/x-pack/plugins/osquery/public/common/schemas/osquery/v5.5.1.json
deleted file mode 100644
index 046fd2e7a6a39..0000000000000
--- a/x-pack/plugins/osquery/public/common/schemas/osquery/v5.5.1.json
+++ /dev/null
@@ -1 +0,0 @@
-[{"name":"account_policy_data","description":"Additional macOS user account data from the AccountPolicy section of OpenDirectory.","platforms":["darwin"],"columns":[{"name":"uid","description":"User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"creation_time","description":"When the account was first created","type":"double","hidden":false,"required":false,"index":false},{"name":"failed_login_count","description":"The number of failed login attempts using an incorrect password. Count resets after a correct password is entered.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"failed_login_timestamp","description":"The time of the last failed login attempt. Resets after a correct password is entered","type":"double","hidden":false,"required":false,"index":false},{"name":"password_last_set_time","description":"The time the password was last changed","type":"double","hidden":false,"required":false,"index":false}]},{"name":"acpi_tables","description":"Firmware ACPI functional table common metadata and content.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"ACPI table name","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of compiled table data","type":"integer","hidden":false,"required":false,"index":false},{"name":"md5","description":"MD5 hash of table content","type":"text","hidden":false,"required":false,"index":false}]},{"name":"ad_config","description":"macOS Active Directory configuration.","platforms":["darwin"],"columns":[{"name":"name","description":"The macOS-specific configuration name","type":"text","hidden":false,"required":false,"index":false},{"name":"domain","description":"Active Directory trust domain","type":"text","hidden":false,"required":false,"index":false},{"name":"option","description":"Canonical name of option","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Variable typed option value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"alf","description":"macOS application layer firewall (ALF) service details.","platforms":["darwin"],"columns":[{"name":"allow_signed_enabled","description":"1 If allow signed mode is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"firewall_unload","description":"1 If firewall unloading enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"global_state","description":"1 If the firewall is enabled with exceptions, 2 if the firewall is configured to block all incoming connections, else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"logging_enabled","description":"1 If logging mode is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"logging_option","description":"Firewall logging option","type":"integer","hidden":false,"required":false,"index":false},{"name":"stealth_enabled","description":"1 If stealth mode is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"version","description":"Application Layer Firewall version","type":"text","hidden":false,"required":false,"index":false}]},{"name":"alf_exceptions","description":"macOS application layer firewall (ALF) service exceptions.","platforms":["darwin"],"columns":[{"name":"path","description":"Path to the executable that is excepted","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"Firewall exception state","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"alf_explicit_auths","description":"ALF services explicitly allowed to perform networking.","platforms":["darwin"],"columns":[{"name":"process","description":"Process name explicitly allowed","type":"text","hidden":false,"required":false,"index":false}]},{"name":"app_schemes","description":"macOS application schemes and handlers (e.g., http, file, mailto).","platforms":["darwin"],"columns":[{"name":"scheme","description":"Name of the scheme/protocol","type":"text","hidden":false,"required":false,"index":false},{"name":"handler","description":"Application label for the handler","type":"text","hidden":false,"required":false,"index":false},{"name":"enabled","description":"1 if this handler is the OS default, else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"external","description":"1 if this handler does NOT exist on macOS by default, else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"protected","description":"1 if this handler is protected (reserved) by macOS, else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"apparmor_events","description":"Track AppArmor events.","platforms":["linux"],"columns":[{"name":"type","description":"Event type","type":"text","hidden":false,"required":false,"index":false},{"name":"message","description":"Raw audit message","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false},{"name":"apparmor","description":"Apparmor Status like ALLOWED, DENIED etc.","type":"text","hidden":false,"required":false,"index":false},{"name":"operation","description":"Permission requested by the process","type":"text","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process PID","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"profile","description":"Apparmor profile name","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Process name","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"comm","description":"Command-line name of the command that was used to invoke the analyzed process","type":"text","hidden":false,"required":false,"index":false},{"name":"denied_mask","description":"Denied permissions for the process","type":"text","hidden":false,"required":false,"index":false},{"name":"capname","description":"Capability requested by the process","type":"text","hidden":false,"required":false,"index":false},{"name":"fsuid","description":"Filesystem user ID","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"ouid","description":"Object owner's user ID","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"capability","description":"Capability number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"requested_mask","description":"Requested access mask","type":"text","hidden":false,"required":false,"index":false},{"name":"info","description":"Additional information","type":"text","hidden":false,"required":false,"index":false},{"name":"error","description":"Error information","type":"text","hidden":false,"required":false,"index":false},{"name":"namespace","description":"AppArmor namespace","type":"text","hidden":false,"required":false,"index":false},{"name":"label","description":"AppArmor label","type":"text","hidden":false,"required":false,"index":false}]},{"name":"apparmor_profiles","description":"Track active AppArmor profiles.","platforms":["linux"],"columns":[{"name":"path","description":"Unique, aa-status compatible, policy identifier.","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Policy name.","type":"text","hidden":false,"required":false,"index":false},{"name":"attach","description":"Which executable(s) a profile will attach to.","type":"text","hidden":false,"required":false,"index":false},{"name":"mode","description":"How the policy is applied.","type":"text","hidden":false,"required":false,"index":false},{"name":"sha1","description":"A unique hash that identifies this policy.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"appcompat_shims","description":"Application Compatibility shims are a way to persist malware. This table presents the AppCompat Shim information from the registry in a nice format. See http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more details.","platforms":["windows"],"columns":[{"name":"executable","description":"Name of the executable that is being shimmed. This is pulled from the registry.","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"This is the path to the SDB database.","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Description of the SDB.","type":"text","hidden":false,"required":false,"index":false},{"name":"install_time","description":"Install time of the SDB","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of the SDB database.","type":"text","hidden":false,"required":false,"index":false},{"name":"sdb_id","description":"Unique GUID of the SDB.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"apps","description":"macOS applications installed in known search paths (e.g., /Applications).","platforms":["darwin"],"columns":[{"name":"name","description":"Name of the Name.app folder","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Absolute and full Name.app path","type":"text","hidden":false,"required":false,"index":false},{"name":"bundle_executable","description":"Info properties CFBundleExecutable label","type":"text","hidden":false,"required":false,"index":false},{"name":"bundle_identifier","description":"Info properties CFBundleIdentifier label","type":"text","hidden":false,"required":false,"index":false},{"name":"bundle_name","description":"Info properties CFBundleName label","type":"text","hidden":false,"required":false,"index":false},{"name":"bundle_short_version","description":"Info properties CFBundleShortVersionString label","type":"text","hidden":false,"required":false,"index":false},{"name":"bundle_version","description":"Info properties CFBundleVersion label","type":"text","hidden":false,"required":false,"index":false},{"name":"bundle_package_type","description":"Info properties CFBundlePackageType label","type":"text","hidden":false,"required":false,"index":false},{"name":"environment","description":"Application-set environment variables","type":"text","hidden":false,"required":false,"index":false},{"name":"element","description":"Does the app identify as a background agent","type":"text","hidden":false,"required":false,"index":false},{"name":"compiler","description":"Info properties DTCompiler label","type":"text","hidden":false,"required":false,"index":false},{"name":"development_region","description":"Info properties CFBundleDevelopmentRegion label","type":"text","hidden":false,"required":false,"index":false},{"name":"display_name","description":"Info properties CFBundleDisplayName label","type":"text","hidden":false,"required":false,"index":false},{"name":"info_string","description":"Info properties CFBundleGetInfoString label","type":"text","hidden":false,"required":false,"index":false},{"name":"minimum_system_version","description":"Minimum version of macOS required for the app to run","type":"text","hidden":false,"required":false,"index":false},{"name":"category","description":"The UTI that categorizes the app for the App Store","type":"text","hidden":false,"required":false,"index":false},{"name":"applescript_enabled","description":"Info properties NSAppleScriptEnabled label","type":"text","hidden":false,"required":false,"index":false},{"name":"copyright","description":"Info properties NSHumanReadableCopyright label","type":"text","hidden":false,"required":false,"index":false},{"name":"last_opened_time","description":"The time that the app was last used","type":"double","hidden":false,"required":false,"index":false}]},{"name":"apt_sources","description":"Current list of APT repositories or software channels.","platforms":["linux"],"columns":[{"name":"name","description":"Repository name","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Source file","type":"text","hidden":false,"required":false,"index":false},{"name":"base_uri","description":"Repository base URI","type":"text","hidden":false,"required":false,"index":false},{"name":"release","description":"Release name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Repository source version","type":"text","hidden":false,"required":false,"index":false},{"name":"maintainer","description":"Repository maintainer","type":"text","hidden":false,"required":false,"index":false},{"name":"components","description":"Repository components","type":"text","hidden":false,"required":false,"index":false},{"name":"architectures","description":"Repository architectures","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"arp_cache","description":"Address resolution cache, both static and dynamic (from ARP, NDP).","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"address","description":"IPv4 address target","type":"text","hidden":false,"required":false,"index":false},{"name":"mac","description":"MAC address of broadcasted address","type":"text","hidden":false,"required":false,"index":false},{"name":"interface","description":"Interface of the network for the MAC","type":"text","hidden":false,"required":false,"index":false},{"name":"permanent","description":"1 for true, 0 for false","type":"text","hidden":false,"required":false,"index":false}]},{"name":"asl","description":"Queries the Apple System Log data structure for system events.","platforms":["darwin"],"columns":[{"name":"time","description":"Unix timestamp.  Set automatically","type":"integer","hidden":false,"required":false,"index":false},{"name":"time_nano_sec","description":"Nanosecond time.","type":"integer","hidden":false,"required":false,"index":false},{"name":"host","description":"Sender's address (set by the server).","type":"text","hidden":false,"required":false,"index":false},{"name":"sender","description":"Sender's identification string.  Default is process name.","type":"text","hidden":false,"required":false,"index":false},{"name":"facility","description":"Sender's facility.  Default is 'user'.","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Sending process ID encoded as a string.  Set automatically.","type":"integer","hidden":false,"required":false,"index":false},{"name":"gid","description":"GID that sent the log message (set by the server).","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid","description":"UID that sent the log message (set by the server).","type":"bigint","hidden":false,"required":false,"index":false},{"name":"level","description":"Log level number.  See levels in asl.h.","type":"integer","hidden":false,"required":false,"index":false},{"name":"message","description":"Message text.","type":"text","hidden":false,"required":false,"index":false},{"name":"ref_pid","description":"Reference PID for messages proxied by launchd","type":"integer","hidden":false,"required":false,"index":false},{"name":"ref_proc","description":"Reference process for messages proxied by launchd","type":"text","hidden":false,"required":false,"index":false},{"name":"extra","description":"Extra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"atom_packages","description":"Lists all atom packages in a directory or globally installed in a system.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"name","description":"Package display name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Package supplied version","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Package supplied description","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Package's package.json path","type":"text","hidden":false,"required":false,"index":false},{"name":"license","description":"License for package","type":"text","hidden":false,"required":false,"index":false},{"name":"homepage","description":"Package supplied homepage","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"The local user that owns the plugin","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"augeas","description":"Configuration files parsed by augeas.","platforms":["darwin","linux"],"columns":[{"name":"node","description":"The node path of the configuration item","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"The value of the configuration item","type":"text","hidden":false,"required":false,"index":false},{"name":"label","description":"The label of the configuration item","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"The path to the configuration file","type":"text","hidden":false,"required":false,"index":false}]},{"name":"authenticode","description":"File (executable, bundle, installer, disk) code signing status.","platforms":["windows"],"columns":[{"name":"path","description":"Must provide a path or directory","type":"text","hidden":false,"required":true,"index":false},{"name":"original_program_name","description":"The original program name that the publisher has signed","type":"text","hidden":false,"required":false,"index":false},{"name":"serial_number","description":"The certificate serial number","type":"text","hidden":false,"required":false,"index":false},{"name":"issuer_name","description":"The certificate issuer name","type":"text","hidden":false,"required":false,"index":false},{"name":"subject_name","description":"The certificate subject name","type":"text","hidden":false,"required":false,"index":false},{"name":"result","description":"The signature check result","type":"text","hidden":false,"required":false,"index":false}]},{"name":"authorization_mechanisms","description":"macOS Authorization mechanisms database.","platforms":["darwin"],"columns":[{"name":"label","description":"Label of the authorization right","type":"text","hidden":false,"required":false,"index":false},{"name":"plugin","description":"Authorization plugin name","type":"text","hidden":false,"required":false,"index":false},{"name":"mechanism","description":"Name of the mechanism that will be called","type":"text","hidden":false,"required":false,"index":false},{"name":"privileged","description":"If privileged it will run as root, else as an anonymous user","type":"text","hidden":false,"required":false,"index":false},{"name":"entry","description":"The whole string entry","type":"text","hidden":false,"required":false,"index":false}]},{"name":"authorizations","description":"macOS Authorization rights database.","platforms":["darwin"],"columns":[{"name":"label","description":"Item name, usually in reverse domain format","type":"text","hidden":false,"required":false,"index":false},{"name":"modified","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"allow_root","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"timeout","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"tries","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"authenticate_user","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"shared","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"comment","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"created","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"session_owner","description":"Label top-level key","type":"text","hidden":false,"required":false,"index":false}]},{"name":"authorized_keys","description":"A line-delimited authorized_keys table.","platforms":["darwin","linux"],"columns":[{"name":"uid","description":"The local owner of authorized_keys file","type":"bigint","hidden":false,"required":false,"index":false},{"name":"algorithm","description":"Key type","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Key encoded as base64","type":"text","hidden":false,"required":false,"index":false},{"name":"options","description":"Optional list of login options","type":"text","hidden":false,"required":false,"index":false},{"name":"comment","description":"Optional comment","type":"text","hidden":false,"required":false,"index":false},{"name":"key_file","description":"Path to the authorized_keys file","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"autoexec","description":"Aggregate of executables that will automatically execute on the target machine. This is an amalgamation of other tables like services, scheduled_tasks, startup_items and more.","platforms":["windows"],"columns":[{"name":"path","description":"Path to the executable","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the program","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Source table of the autoexec item","type":"text","hidden":false,"required":false,"index":false}]},{"name":"azure_instance_metadata","description":"Azure instance metadata.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"location","description":"Azure Region the VM is running in","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"offer","description":"Offer information for the VM image (Azure image gallery VMs only)","type":"text","hidden":false,"required":false,"index":false},{"name":"publisher","description":"Publisher of the VM image","type":"text","hidden":false,"required":false,"index":false},{"name":"sku","description":"SKU for the VM image","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Version of the VM image","type":"text","hidden":false,"required":false,"index":false},{"name":"os_type","description":"Linux or Windows","type":"text","hidden":false,"required":false,"index":false},{"name":"platform_update_domain","description":"Update domain the VM is running in","type":"text","hidden":false,"required":false,"index":false},{"name":"platform_fault_domain","description":"Fault domain the VM is running in","type":"text","hidden":false,"required":false,"index":false},{"name":"vm_id","description":"Unique identifier for the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"vm_size","description":"VM size","type":"text","hidden":false,"required":false,"index":false},{"name":"subscription_id","description":"Azure subscription for the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"resource_group_name","description":"Resource group for the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"placement_group_id","description":"Placement group for the VM scale set","type":"text","hidden":false,"required":false,"index":false},{"name":"vm_scale_set_name","description":"VM scale set name","type":"text","hidden":false,"required":false,"index":false},{"name":"zone","description":"Availability zone of the VM","type":"text","hidden":false,"required":false,"index":false}]},{"name":"azure_instance_tags","description":"Azure instance tags.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"vm_id","description":"Unique identifier for the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"The tag key","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"The tag value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"background_activities_moderator","description":"Background Activities Moderator (BAM) tracks application execution.","platforms":["windows"],"columns":[{"name":"path","description":"Application file path.","type":"text","hidden":false,"required":false,"index":false},{"name":"last_execution_time","description":"Most recent time application was executed.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sid","description":"User SID.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"battery","description":"Provides information about the internal battery of a Macbook.","platforms":["darwin"],"columns":[{"name":"manufacturer","description":"The battery manufacturer's name","type":"text","hidden":false,"required":false,"index":false},{"name":"manufacture_date","description":"The date the battery was manufactured UNIX Epoch","type":"integer","hidden":false,"required":false,"index":false},{"name":"model","description":"The battery's model number","type":"text","hidden":false,"required":false,"index":false},{"name":"serial_number","description":"The battery's unique serial number","type":"text","hidden":false,"required":false,"index":false},{"name":"cycle_count","description":"The number of charge/discharge cycles","type":"integer","hidden":false,"required":false,"index":false},{"name":"health","description":"One of the following: \"Good\" describes a well-performing battery, \"Fair\" describes a functional battery with limited capacity, or \"Poor\" describes a battery that's not capable of providing power","type":"text","hidden":false,"required":false,"index":false},{"name":"condition","description":"One of the following: \"Normal\" indicates the condition of the battery is within normal tolerances, \"Service Needed\" indicates that the battery should be checked out by a licensed Mac repair service, \"Permanent Failure\" indicates the battery needs replacement","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"One of the following: \"AC Power\" indicates the battery is connected to an external power source, \"Battery Power\" indicates that the battery is drawing internal power, \"Off Line\" indicates the battery is off-line or no longer connected","type":"text","hidden":false,"required":false,"index":false},{"name":"charging","description":"1 if the battery is currently being charged by a power source. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"charged","description":"1 if the battery is currently completely charged. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"designed_capacity","description":"The battery's designed capacity in mAh","type":"integer","hidden":false,"required":false,"index":false},{"name":"max_capacity","description":"The battery's actual capacity when it is fully charged in mAh","type":"integer","hidden":false,"required":false,"index":false},{"name":"current_capacity","description":"The battery's current charged capacity in mAh","type":"integer","hidden":false,"required":false,"index":false},{"name":"percent_remaining","description":"The percentage of battery remaining before it is drained","type":"integer","hidden":false,"required":false,"index":false},{"name":"amperage","description":"The battery's current amperage in mA","type":"integer","hidden":false,"required":false,"index":false},{"name":"voltage","description":"The battery's current voltage in mV","type":"integer","hidden":false,"required":false,"index":false},{"name":"minutes_until_empty","description":"The number of minutes until the battery is fully depleted. This value is -1 if this time is still being calculated","type":"integer","hidden":false,"required":false,"index":false},{"name":"minutes_to_full_charge","description":"The number of minutes until the battery is fully charged. This value is -1 if this time is still being calculated","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"bitlocker_info","description":"Retrieve bitlocker status of the machine.","platforms":["windows"],"columns":[{"name":"device_id","description":"ID of the encrypted drive.","type":"text","hidden":false,"required":false,"index":false},{"name":"drive_letter","description":"Drive letter of the encrypted drive.","type":"text","hidden":false,"required":false,"index":false},{"name":"persistent_volume_id","description":"Persistent ID of the drive.","type":"text","hidden":false,"required":false,"index":false},{"name":"conversion_status","description":"The bitlocker conversion status of the drive.","type":"integer","hidden":false,"required":false,"index":false},{"name":"protection_status","description":"The bitlocker protection status of the drive.","type":"integer","hidden":false,"required":false,"index":false},{"name":"encryption_method","description":"The encryption type of the device.","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"The FVE metadata version of the drive.","type":"integer","hidden":false,"required":false,"index":false},{"name":"percentage_encrypted","description":"The percentage of the drive that is encrypted.","type":"integer","hidden":false,"required":false,"index":false},{"name":"lock_status","description":"The accessibility status of the drive from Windows.","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"block_devices","description":"Block (buffered access) device file nodes: disks, ramdisks, and DMG containers.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Block device name","type":"text","hidden":false,"required":false,"index":false},{"name":"parent","description":"Block device parent name","type":"text","hidden":false,"required":false,"index":false},{"name":"vendor","description":"Block device vendor string","type":"text","hidden":false,"required":false,"index":false},{"name":"model","description":"Block device model string identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Block device size in blocks","type":"bigint","hidden":false,"required":false,"index":false},{"name":"block_size","description":"Block size in bytes","type":"integer","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Block device Universally Unique Identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Block device type string","type":"text","hidden":false,"required":false,"index":false},{"name":"label","description":"Block device label string","type":"text","hidden":false,"required":false,"index":false}]},{"name":"bpf_process_events","description":"Track time/action process executions.","platforms":["linux"],"columns":[{"name":"tid","description":"Thread ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cid","description":"Cgroup ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"exit_code","description":"Exit code of the system call","type":"text","hidden":false,"required":false,"index":false},{"name":"probe_error","description":"Set to 1 if one or more buffers could not be captured","type":"integer","hidden":false,"required":false,"index":false},{"name":"syscall","description":"System call name","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Binary path","type":"text","hidden":false,"required":false,"index":false},{"name":"cwd","description":"Current working directory","type":"text","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Command line arguments","type":"text","hidden":false,"required":false,"index":false},{"name":"duration","description":"How much time was spent inside the syscall (nsecs)","type":"integer","hidden":false,"required":false,"index":false},{"name":"json_cmdline","description":"Command line arguments, in JSON format","type":"text","hidden":true,"required":false,"index":false},{"name":"ntime","description":"The nsecs uptime timestamp as obtained from BPF","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":true,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"bpf_socket_events","description":"Track network socket opens and closes.","platforms":["linux"],"columns":[{"name":"tid","description":"Thread ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cid","description":"Cgroup ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"exit_code","description":"Exit code of the system call","type":"text","hidden":false,"required":false,"index":false},{"name":"probe_error","description":"Set to 1 if one or more buffers could not be captured","type":"integer","hidden":false,"required":false,"index":false},{"name":"syscall","description":"System call name","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","hidden":false,"required":false,"index":false},{"name":"fd","description":"The file description for the process socket","type":"text","hidden":false,"required":false,"index":false},{"name":"family","description":"The Internet protocol family ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"The socket type","type":"integer","hidden":false,"required":false,"index":false},{"name":"protocol","description":"The network protocol ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"local_address","description":"Local address associated with socket","type":"text","hidden":false,"required":false,"index":false},{"name":"remote_address","description":"Remote address associated with socket","type":"text","hidden":false,"required":false,"index":false},{"name":"local_port","description":"Local network protocol port number","type":"integer","hidden":false,"required":false,"index":false},{"name":"remote_port","description":"Remote network protocol port number","type":"integer","hidden":false,"required":false,"index":false},{"name":"duration","description":"How much time was spent inside the syscall (nsecs)","type":"integer","hidden":false,"required":false,"index":false},{"name":"ntime","description":"The nsecs uptime timestamp as obtained from BPF","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":true,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"browser_plugins","description":"All C/NPAPI browser plugin details for all users. C/NPAPI has been deprecated on all major browsers. To query for plugins on modern browsers, try: `chrome_extensions` `firefox_addons` `safari_extensions`.","platforms":["darwin"],"columns":[{"name":"uid","description":"The local user that owns the plugin","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"Plugin display name","type":"text","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Plugin identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Plugin short version","type":"text","hidden":false,"required":false,"index":false},{"name":"sdk","description":"Build SDK used to compile plugin","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Plugin description text","type":"text","hidden":false,"required":false,"index":false},{"name":"development_region","description":"Plugin language-localization","type":"text","hidden":false,"required":false,"index":false},{"name":"native","description":"Plugin requires native execution","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to plugin bundle","type":"text","hidden":false,"required":false,"index":false},{"name":"disabled","description":"Is the plugin disabled. 1 = Disabled","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"carbon_black_info","description":"Returns info about a Carbon Black sensor install.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"sensor_id","description":"Sensor ID of the Carbon Black sensor","type":"integer","hidden":false,"required":false,"index":false},{"name":"config_name","description":"Sensor group","type":"text","hidden":false,"required":false,"index":false},{"name":"collect_store_files","description":"If the sensor is configured to send back binaries to the Carbon Black server","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_module_loads","description":"If the sensor is configured to capture module loads","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_module_info","description":"If the sensor is configured to collect metadata of binaries","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_file_mods","description":"If the sensor is configured to collect file modification events","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_reg_mods","description":"If the sensor is configured to collect registry modification events","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_net_conns","description":"If the sensor is configured to collect network connections","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_processes","description":"If the sensor is configured to process events","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_cross_processes","description":"If the sensor is configured to cross process events","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_emet_events","description":"If the sensor is configured to EMET events","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_data_file_writes","description":"If the sensor is configured to collect non binary file writes","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_process_user_context","description":"If the sensor is configured to collect the user running a process","type":"integer","hidden":false,"required":false,"index":false},{"name":"collect_sensor_operations","description":"Unknown","type":"integer","hidden":false,"required":false,"index":false},{"name":"log_file_disk_quota_mb","description":"Event file disk quota in MB","type":"integer","hidden":false,"required":false,"index":false},{"name":"log_file_disk_quota_percentage","description":"Event file disk quota in a percentage","type":"integer","hidden":false,"required":false,"index":false},{"name":"protection_disabled","description":"If the sensor is configured to report tamper events","type":"integer","hidden":false,"required":false,"index":false},{"name":"sensor_ip_addr","description":"IP address of the sensor","type":"text","hidden":false,"required":false,"index":false},{"name":"sensor_backend_server","description":"Carbon Black server","type":"text","hidden":false,"required":false,"index":false},{"name":"event_queue","description":"Size in bytes of Carbon Black event files on disk","type":"integer","hidden":false,"required":false,"index":false},{"name":"binary_queue","description":"Size in bytes of binaries waiting to be sent to Carbon Black server","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"carves","description":"List the set of completed and in-progress carves. If carve=1 then the query is treated as a new carve request.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"time","description":"Time at which the carve was kicked off","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sha256","description":"A SHA256 sum of the carved archive","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of the carved archive","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"The path of the requested carve","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED","type":"text","hidden":false,"required":false,"index":false},{"name":"carve_guid","description":"Identifying value of the carve session","type":"text","hidden":false,"required":false,"index":false},{"name":"request_id","description":"Identifying value of the carve request (e.g., scheduled query name, distributed request, etc)","type":"text","hidden":false,"required":false,"index":false},{"name":"carve","description":"Set this value to '1' to start a file carve","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"certificates","description":"Certificate Authorities installed in Keychains/ca-bundles.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"common_name","description":"Certificate CommonName","type":"text","hidden":false,"required":false,"index":false},{"name":"subject","description":"Certificate distinguished name (deprecated, use subject2)","type":"text","hidden":false,"required":false,"index":false},{"name":"issuer","description":"Certificate issuer distinguished name (deprecated, use issuer2)","type":"text","hidden":false,"required":false,"index":false},{"name":"ca","description":"1 if CA: true (certificate is an authority) else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"self_signed","description":"1 if self-signed, else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"not_valid_before","description":"Lower bound of valid date","type":"text","hidden":false,"required":false,"index":false},{"name":"not_valid_after","description":"Certificate expiration data","type":"text","hidden":false,"required":false,"index":false},{"name":"signing_algorithm","description":"Signing algorithm used","type":"text","hidden":false,"required":false,"index":false},{"name":"key_algorithm","description":"Key algorithm used","type":"text","hidden":false,"required":false,"index":false},{"name":"key_strength","description":"Key size used for RSA/DSA, or curve name","type":"text","hidden":false,"required":false,"index":false},{"name":"key_usage","description":"Certificate key usage and extended key usage","type":"text","hidden":false,"required":false,"index":false},{"name":"subject_key_id","description":"SKID an optionally included SHA1","type":"text","hidden":false,"required":false,"index":false},{"name":"authority_key_id","description":"AKID an optionally included SHA1","type":"text","hidden":false,"required":false,"index":false},{"name":"sha1","description":"SHA1 hash of the raw certificate contents","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to Keychain or PEM bundle","type":"text","hidden":false,"required":false,"index":false},{"name":"serial","description":"Certificate serial number","type":"text","hidden":false,"required":false,"index":false},{"name":"sid","description":"SID","type":"text","hidden":true,"required":false,"index":false},{"name":"store_location","description":"Certificate system store location","type":"text","hidden":true,"required":false,"index":false},{"name":"store","description":"Certificate system store","type":"text","hidden":true,"required":false,"index":false},{"name":"username","description":"Username","type":"text","hidden":true,"required":false,"index":false},{"name":"store_id","description":"Exists for service/user stores. Contains raw store id provided by WinAPI.","type":"text","hidden":true,"required":false,"index":false},{"name":"issuer2","description":"Certificate issuer distinguished name","type":"text","hidden":true,"required":false,"index":false},{"name":"subject2","description":"Certificate distinguished name","type":"text","hidden":true,"required":false,"index":false}]},{"name":"chassis_info","description":"Display information pertaining to the chassis and its security status.","platforms":["windows"],"columns":[{"name":"audible_alarm","description":"If TRUE, the frame is equipped with an audible alarm.","type":"text","hidden":false,"required":false,"index":false},{"name":"breach_description","description":"If provided, gives a more detailed description of a detected security breach.","type":"text","hidden":false,"required":false,"index":false},{"name":"chassis_types","description":"A comma-separated list of chassis types, such as Desktop or Laptop.","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"An extended description of the chassis if available.","type":"text","hidden":false,"required":false,"index":false},{"name":"lock","description":"If TRUE, the frame is equipped with a lock.","type":"text","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"The manufacturer of the chassis.","type":"text","hidden":false,"required":false,"index":false},{"name":"model","description":"The model of the chassis.","type":"text","hidden":false,"required":false,"index":false},{"name":"security_breach","description":"The physical status of the chassis such as Breach Successful, Breach Attempted, etc.","type":"text","hidden":false,"required":false,"index":false},{"name":"serial","description":"The serial number of the chassis.","type":"text","hidden":false,"required":false,"index":false},{"name":"smbios_tag","description":"The assigned asset tag number of the chassis.","type":"text","hidden":false,"required":false,"index":false},{"name":"sku","description":"The Stock Keeping Unit number if available.","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"If available, gives various operational or nonoperational statuses such as OK, Degraded, and Pred Fail.","type":"text","hidden":false,"required":false,"index":false},{"name":"visible_alarm","description":"If TRUE, the frame is equipped with a visual alarm.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"chocolatey_packages","description":"Chocolatey packages installed in a system.","platforms":["windows"],"columns":[{"name":"name","description":"Package display name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Package-supplied version","type":"text","hidden":false,"required":false,"index":false},{"name":"summary","description":"Package-supplied summary","type":"text","hidden":false,"required":false,"index":false},{"name":"author","description":"Optional package author","type":"text","hidden":false,"required":false,"index":false},{"name":"license","description":"License under which package is launched","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path at which this package resides","type":"text","hidden":false,"required":false,"index":false}]},{"name":"chrome_extension_content_scripts","description":"Chrome browser extension content scripts.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"browser_type","description":"The browser type (Valid values: chrome, chromium, opera, yandex, brave)","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"The local user that owns the extension","type":"bigint","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Extension identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension-supplied version","type":"text","hidden":false,"required":false,"index":false},{"name":"script","description":"The content script used by the extension","type":"text","hidden":false,"required":false,"index":false},{"name":"match","description":"The pattern that the script is matched against","type":"text","hidden":false,"required":false,"index":false},{"name":"profile_path","description":"The profile path","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to extension folder","type":"text","hidden":false,"required":false,"index":false},{"name":"referenced","description":"1 if this extension is referenced by the Preferences file of the profile","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"chrome_extensions","description":"Chrome-based browser extensions.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"browser_type","description":"The browser type (Valid values: chrome, chromium, opera, yandex, brave, edge, edge_beta)","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"The local user that owns the extension","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"Extension display name","type":"text","hidden":false,"required":false,"index":false},{"name":"profile","description":"The name of the Chrome profile that contains this extension","type":"text","hidden":false,"required":false,"index":false},{"name":"profile_path","description":"The profile path","type":"text","hidden":false,"required":false,"index":false},{"name":"referenced_identifier","description":"Extension identifier, as specified by the preferences file. Empty if the extension is not in the profile.","type":"text","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Extension identifier, computed from its manifest. Empty in case of error.","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension-supplied version","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Extension-optional description","type":"text","hidden":false,"required":false,"index":false},{"name":"default_locale","description":"Default locale supported by extension","type":"text","hidden":false,"required":false,"index":false},{"name":"current_locale","description":"Current locale supported by extension","type":"text","hidden":false,"required":false,"index":false},{"name":"update_url","description":"Extension-supplied update URI","type":"text","hidden":false,"required":false,"index":false},{"name":"author","description":"Optional extension author","type":"text","hidden":false,"required":false,"index":false},{"name":"persistent","description":"1 If extension is persistent across all tabs else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to extension folder","type":"text","hidden":false,"required":false,"index":false},{"name":"permissions","description":"The permissions required by the extension","type":"text","hidden":false,"required":false,"index":false},{"name":"permissions_json","description":"The JSON-encoded permissions required by the extension","type":"text","hidden":true,"required":false,"index":false},{"name":"optional_permissions","description":"The permissions optionally required by the extensions","type":"text","hidden":false,"required":false,"index":false},{"name":"optional_permissions_json","description":"The JSON-encoded permissions optionally required by the extensions","type":"text","hidden":true,"required":false,"index":false},{"name":"manifest_hash","description":"The SHA256 hash of the manifest.json file","type":"text","hidden":false,"required":false,"index":false},{"name":"referenced","description":"1 if this extension is referenced by the Preferences file of the profile","type":"bigint","hidden":false,"required":false,"index":false},{"name":"from_webstore","description":"True if this extension was installed from the web store","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"1 if this extension is enabled","type":"text","hidden":false,"required":false,"index":false},{"name":"install_time","description":"Extension install time, in its original Webkit format","type":"text","hidden":false,"required":false,"index":false},{"name":"install_timestamp","description":"Extension install time, converted to unix time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"manifest_json","description":"The manifest file of the extension","type":"text","hidden":true,"required":false,"index":false},{"name":"key","description":"The extension key, from the manifest file","type":"text","hidden":true,"required":false,"index":false}]},{"name":"connectivity","description":"Provides the overall system's network state.","platforms":["windows"],"columns":[{"name":"disconnected","description":"True if the all interfaces are not connected to any network","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv4_no_traffic","description":"True if any interface is connected via IPv4, but has seen no traffic","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv6_no_traffic","description":"True if any interface is connected via IPv6, but has seen no traffic","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv4_subnet","description":"True if any interface is connected to the local subnet via IPv4","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv4_local_network","description":"True if any interface is connected to a routed network via IPv4","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv4_internet","description":"True if any interface is connected to the Internet via IPv4","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv6_subnet","description":"True if any interface is connected to the local subnet via IPv6","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv6_local_network","description":"True if any interface is connected to a routed network via IPv6","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv6_internet","description":"True if any interface is connected to the Internet via IPv6","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"cpu_info","description":"Retrieve cpu hardware info of the machine.","platforms":["linux","windows"],"columns":[{"name":"device_id","description":"The DeviceID of the CPU.","type":"text","hidden":false,"required":false,"index":false},{"name":"model","description":"The model of the CPU.","type":"text","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"The manufacturer of the CPU.","type":"text","hidden":false,"required":false,"index":false},{"name":"processor_type","description":"The processor type, such as Central, Math, or Video.","type":"text","hidden":false,"required":false,"index":false},{"name":"cpu_status","description":"The current operating status of the CPU.","type":"integer","hidden":false,"required":false,"index":false},{"name":"number_of_cores","description":"The number of cores of the CPU.","type":"text","hidden":false,"required":false,"index":false},{"name":"logical_processors","description":"The number of logical processors of the CPU.","type":"integer","hidden":false,"required":false,"index":false},{"name":"address_width","description":"The width of the CPU address bus.","type":"text","hidden":false,"required":false,"index":false},{"name":"current_clock_speed","description":"The current frequency of the CPU.","type":"integer","hidden":false,"required":false,"index":false},{"name":"max_clock_speed","description":"The maximum possible frequency of the CPU.","type":"integer","hidden":false,"required":false,"index":false},{"name":"socket_designation","description":"The assigned socket on the board for the given CPU.","type":"text","hidden":false,"required":false,"index":false},{"name":"availability","description":"The availability and status of the CPU.","type":"text","hidden":true,"required":false,"index":false}]},{"name":"cpu_time","description":"Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.","platforms":["darwin","linux"],"columns":[{"name":"core","description":"Name of the cpu (core)","type":"integer","hidden":false,"required":false,"index":false},{"name":"user","description":"Time spent in user mode","type":"bigint","hidden":false,"required":false,"index":false},{"name":"nice","description":"Time spent in user mode with low priority (nice)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"system","description":"Time spent in system mode","type":"bigint","hidden":false,"required":false,"index":false},{"name":"idle","description":"Time spent in the idle task","type":"bigint","hidden":false,"required":false,"index":false},{"name":"iowait","description":"Time spent waiting for I/O to complete","type":"bigint","hidden":false,"required":false,"index":false},{"name":"irq","description":"Time spent servicing interrupts","type":"bigint","hidden":false,"required":false,"index":false},{"name":"softirq","description":"Time spent servicing softirqs","type":"bigint","hidden":false,"required":false,"index":false},{"name":"steal","description":"Time spent in other operating systems when running in a virtualized environment","type":"bigint","hidden":false,"required":false,"index":false},{"name":"guest","description":"Time spent running a virtual CPU for a guest OS under the control of the Linux kernel","type":"bigint","hidden":false,"required":false,"index":false},{"name":"guest_nice","description":"Time spent running a niced guest ","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"cpuid","description":"Useful CPU features from the cpuid ASM call.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"feature","description":"Present feature flags","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Bit value or string","type":"text","hidden":false,"required":false,"index":false},{"name":"output_register","description":"Register used to for feature value","type":"text","hidden":false,"required":false,"index":false},{"name":"output_bit","description":"Bit in register value for feature value","type":"integer","hidden":false,"required":false,"index":false},{"name":"input_eax","description":"Value of EAX used","type":"text","hidden":false,"required":false,"index":false}]},{"name":"crashes","description":"Application, System, and Mobile App crash logs.","platforms":["darwin"],"columns":[{"name":"type","description":"Type of crash log","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID of the crashed process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"crash_path","description":"Location of log file","type":"text","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Identifier of the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Version info of the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent PID of the crashed process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"responsible","description":"Process responsible for the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID of the crashed process","type":"integer","hidden":false,"required":false,"index":false},{"name":"datetime","description":"Date/Time at which the crash occurred","type":"text","hidden":false,"required":false,"index":false},{"name":"crashed_thread","description":"Thread ID which crashed","type":"bigint","hidden":false,"required":false,"index":false},{"name":"stack_trace","description":"Most recent frame from the stack trace","type":"text","hidden":false,"required":false,"index":false},{"name":"exception_type","description":"Exception type of the crash","type":"text","hidden":false,"required":false,"index":false},{"name":"exception_codes","description":"Exception codes from the crash","type":"text","hidden":false,"required":false,"index":false},{"name":"exception_notes","description":"Exception notes from the crash","type":"text","hidden":false,"required":false,"index":false},{"name":"registers","description":"The value of the system registers","type":"text","hidden":false,"required":false,"index":false}]},{"name":"crontab","description":"Line parsed values from system and user cron/tab.","platforms":["darwin","linux"],"columns":[{"name":"event","description":"The job @event name (rare)","type":"text","hidden":false,"required":false,"index":false},{"name":"minute","description":"The exact minute for the job","type":"text","hidden":false,"required":false,"index":false},{"name":"hour","description":"The hour of the day for the job","type":"text","hidden":false,"required":false,"index":false},{"name":"day_of_month","description":"The day of the month for the job","type":"text","hidden":false,"required":false,"index":false},{"name":"month","description":"The month of the year for the job","type":"text","hidden":false,"required":false,"index":false},{"name":"day_of_week","description":"The day of the week for the job","type":"text","hidden":false,"required":false,"index":false},{"name":"command","description":"Raw command string","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"File parsed","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"cups_destinations","description":"Returns all configured printers.","platforms":["darwin"],"columns":[{"name":"name","description":"Name of the printer","type":"text","hidden":false,"required":false,"index":false},{"name":"option_name","description":"Option name","type":"text","hidden":false,"required":false,"index":false},{"name":"option_value","description":"Option value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"cups_jobs","description":"Returns all completed print jobs from cups.","platforms":["darwin"],"columns":[{"name":"title","description":"Title of the printed job","type":"text","hidden":false,"required":false,"index":false},{"name":"destination","description":"The printer the job was sent to","type":"text","hidden":false,"required":false,"index":false},{"name":"user","description":"The user who printed the job","type":"text","hidden":false,"required":false,"index":false},{"name":"format","description":"The format of the print job","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"The size of the print job","type":"integer","hidden":false,"required":false,"index":false},{"name":"completed_time","description":"When the job completed printing","type":"integer","hidden":false,"required":false,"index":false},{"name":"processing_time","description":"How long the job took to process","type":"integer","hidden":false,"required":false,"index":false},{"name":"creation_time","description":"When the print request was initiated","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"curl","description":"Perform an http request and return stats about it.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"url","description":"The url for the request","type":"text","hidden":false,"required":true,"index":false},{"name":"method","description":"The HTTP method for the request","type":"text","hidden":false,"required":false,"index":false},{"name":"user_agent","description":"The user-agent string to use for the request","type":"text","hidden":false,"required":false,"index":false},{"name":"response_code","description":"The HTTP status code for the response","type":"integer","hidden":false,"required":false,"index":false},{"name":"round_trip_time","description":"Time taken to complete the request","type":"bigint","hidden":false,"required":false,"index":false},{"name":"bytes","description":"Number of bytes in the response","type":"bigint","hidden":false,"required":false,"index":false},{"name":"result","description":"The HTTP response body","type":"text","hidden":false,"required":false,"index":false}]},{"name":"curl_certificate","description":"Inspect TLS certificates by connecting to input hostnames.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"hostname","description":"Hostname to CURL (domain[:port], e.g. osquery.io)","type":"text","hidden":false,"required":true,"index":false},{"name":"common_name","description":"Common name of company issued to","type":"text","hidden":false,"required":false,"index":false},{"name":"organization","description":"Organization issued to","type":"text","hidden":false,"required":false,"index":false},{"name":"organization_unit","description":"Organization unit issued to","type":"text","hidden":false,"required":false,"index":false},{"name":"serial_number","description":"Certificate serial number","type":"text","hidden":false,"required":false,"index":false},{"name":"issuer_common_name","description":"Issuer common name","type":"text","hidden":false,"required":false,"index":false},{"name":"issuer_organization","description":"Issuer organization","type":"text","hidden":false,"required":false,"index":false},{"name":"issuer_organization_unit","description":"Issuer organization unit","type":"text","hidden":false,"required":false,"index":false},{"name":"valid_from","description":"Period of validity start date","type":"text","hidden":false,"required":false,"index":false},{"name":"valid_to","description":"Period of validity end date","type":"text","hidden":false,"required":false,"index":false},{"name":"sha256_fingerprint","description":"SHA-256 fingerprint","type":"text","hidden":false,"required":false,"index":false},{"name":"sha1_fingerprint","description":"SHA1 fingerprint","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Version Number","type":"integer","hidden":false,"required":false,"index":false},{"name":"signature_algorithm","description":"Signature Algorithm","type":"text","hidden":false,"required":false,"index":false},{"name":"signature","description":"Signature","type":"text","hidden":false,"required":false,"index":false},{"name":"subject_key_identifier","description":"Subject Key Identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"authority_key_identifier","description":"Authority Key Identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"key_usage","description":"Usage of key in certificate","type":"text","hidden":false,"required":false,"index":false},{"name":"extended_key_usage","description":"Extended usage of key in certificate","type":"text","hidden":false,"required":false,"index":false},{"name":"policies","description":"Certificate Policies","type":"text","hidden":false,"required":false,"index":false},{"name":"subject_alternative_names","description":"Subject Alternative Name","type":"text","hidden":false,"required":false,"index":false},{"name":"issuer_alternative_names","description":"Issuer Alternative Name","type":"text","hidden":false,"required":false,"index":false},{"name":"info_access","description":"Authority Information Access","type":"text","hidden":false,"required":false,"index":false},{"name":"subject_info_access","description":"Subject Information Access","type":"text","hidden":false,"required":false,"index":false},{"name":"policy_mappings","description":"Policy Mappings","type":"text","hidden":false,"required":false,"index":false},{"name":"has_expired","description":"1 if the certificate has expired, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"basic_constraint","description":"Basic Constraints","type":"text","hidden":false,"required":false,"index":false},{"name":"name_constraints","description":"Name Constraints","type":"text","hidden":false,"required":false,"index":false},{"name":"policy_constraints","description":"Policy Constraints","type":"text","hidden":false,"required":false,"index":false},{"name":"dump_certificate","description":"Set this value to '1' to dump certificate","type":"integer","hidden":true,"required":false,"index":false},{"name":"timeout","description":"Set this value to the timeout in seconds to complete the TLS handshake (default 4s, use 0 for no timeout)","type":"integer","hidden":true,"required":false,"index":false},{"name":"pem","description":"Certificate PEM format","type":"text","hidden":false,"required":false,"index":false}]},{"name":"deb_packages","description":"The installed DEB package database.","platforms":["linux"],"columns":[{"name":"name","description":"Package name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Package version","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Package source","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Package size in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"arch","description":"Package architecture","type":"text","hidden":false,"required":false,"index":false},{"name":"revision","description":"Package revision","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"Package status","type":"text","hidden":false,"required":false,"index":false},{"name":"maintainer","description":"Package maintainer","type":"text","hidden":false,"required":false,"index":false},{"name":"section","description":"Package section","type":"text","hidden":false,"required":false,"index":false},{"name":"priority","description":"Package priority","type":"text","hidden":false,"required":false,"index":false},{"name":"admindir","description":"libdpkg admindir. Defaults to /var/lib/dpkg","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","hidden":true,"required":false,"index":false}]},{"name":"default_environment","description":"Default environment variables and values.","platforms":["windows"],"columns":[{"name":"variable","description":"Name of the environment variable","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Value of the environment variable","type":"text","hidden":false,"required":false,"index":false},{"name":"expand","description":"1 if the variable needs expanding, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"device_file","description":"Similar to the file table, but use TSK and allow block address access.","platforms":["darwin","linux"],"columns":[{"name":"device","description":"Absolute file path to device node","type":"text","hidden":false,"required":true,"index":false},{"name":"partition","description":"A partition number","type":"text","hidden":false,"required":true,"index":false},{"name":"path","description":"A logical path within the device node","type":"text","hidden":false,"required":false,"index":false},{"name":"filename","description":"Name portion of file path","type":"text","hidden":false,"required":false,"index":false},{"name":"inode","description":"Filesystem inode number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid","description":"Owning user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Owning group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mode","description":"Permission bits","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of file in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"block_size","description":"Block size of filesystem","type":"integer","hidden":false,"required":false,"index":false},{"name":"atime","description":"Last access time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Last modification time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Creation time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"hard_links","description":"Number of hard links","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"File status","type":"text","hidden":false,"required":false,"index":false}]},{"name":"device_firmware","description":"A best-effort list of discovered firmware versions.","platforms":["darwin"],"columns":[{"name":"type","description":"Type of device","type":"text","hidden":false,"required":false,"index":false},{"name":"device","description":"The device name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Firmware version","type":"text","hidden":false,"required":false,"index":false}]},{"name":"device_hash","description":"Similar to the hash table, but use TSK and allow block address access.","platforms":["darwin","linux"],"columns":[{"name":"device","description":"Absolute file path to device node","type":"text","hidden":false,"required":true,"index":false},{"name":"partition","description":"A partition number","type":"text","hidden":false,"required":true,"index":false},{"name":"inode","description":"Filesystem inode number","type":"bigint","hidden":false,"required":true,"index":false},{"name":"md5","description":"MD5 hash of provided inode data","type":"text","hidden":false,"required":false,"index":false},{"name":"sha1","description":"SHA1 hash of provided inode data","type":"text","hidden":false,"required":false,"index":false},{"name":"sha256","description":"SHA256 hash of provided inode data","type":"text","hidden":false,"required":false,"index":false}]},{"name":"device_partitions","description":"Use TSK to enumerate details about partitions on a disk device.","platforms":["darwin","linux"],"columns":[{"name":"device","description":"Absolute file path to device node","type":"text","hidden":false,"required":true,"index":false},{"name":"partition","description":"A partition number or description","type":"integer","hidden":false,"required":false,"index":false},{"name":"label","description":"","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"","type":"text","hidden":false,"required":false,"index":false},{"name":"offset","description":"","type":"bigint","hidden":false,"required":false,"index":false},{"name":"blocks_size","description":"Byte size of each block","type":"bigint","hidden":false,"required":false,"index":false},{"name":"blocks","description":"Number of blocks","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inodes","description":"Number of meta nodes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"flags","description":"","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"disk_encryption","description":"Disk encryption status and information.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Disk name","type":"text","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Disk Universally Unique Identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"encrypted","description":"1 If encrypted: true (disk is encrypted), else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"Description of cipher type and mode if available","type":"text","hidden":false,"required":false,"index":false},{"name":"encryption_status","description":"Disk encryption status with one of following values: encrypted | not encrypted | undefined","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"Currently authenticated user if available","type":"text","hidden":false,"required":false,"index":false},{"name":"user_uuid","description":"UUID of authenticated user if available","type":"text","hidden":false,"required":false,"index":false},{"name":"filevault_status","description":"FileVault status with one of following values: on | off | unknown","type":"text","hidden":false,"required":false,"index":false}]},{"name":"disk_events","description":"Track DMG disk image events (appearance/disappearance) when opened.","platforms":["darwin"],"columns":[{"name":"action","description":"Appear or disappear","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of the DMG file accessed","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Disk event name","type":"text","hidden":false,"required":false,"index":false},{"name":"device","description":"Disk event BSD name","type":"text","hidden":false,"required":false,"index":false},{"name":"uuid","description":"UUID of the volume inside DMG if available","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of partition in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ejectable","description":"1 if ejectable, 0 if not","type":"integer","hidden":false,"required":false,"index":false},{"name":"mountable","description":"1 if mountable, 0 if not","type":"integer","hidden":false,"required":false,"index":false},{"name":"writable","description":"1 if writable, 0 if not","type":"integer","hidden":false,"required":false,"index":false},{"name":"content","description":"Disk event content","type":"text","hidden":false,"required":false,"index":false},{"name":"media_name","description":"Disk event media name string","type":"text","hidden":false,"required":false,"index":false},{"name":"vendor","description":"Disk event vendor string","type":"text","hidden":false,"required":false,"index":false},{"name":"filesystem","description":"Filesystem if available","type":"text","hidden":false,"required":false,"index":false},{"name":"checksum","description":"UDIF Master checksum if available (CRC32)","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of appearance/disappearance in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"disk_info","description":"Retrieve basic information about the physical disks of a system.","platforms":["windows"],"columns":[{"name":"partitions","description":"Number of detected partitions on disk.","type":"integer","hidden":false,"required":false,"index":false},{"name":"disk_index","description":"Physical drive number of the disk.","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"The interface type of the disk.","type":"text","hidden":false,"required":false,"index":false},{"name":"id","description":"The unique identifier of the drive on the system.","type":"text","hidden":false,"required":false,"index":false},{"name":"pnp_device_id","description":"The unique identifier of the drive on the system.","type":"text","hidden":false,"required":false,"index":false},{"name":"disk_size","description":"Size of the disk.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"The manufacturer of the disk.","type":"text","hidden":false,"required":false,"index":false},{"name":"hardware_model","description":"Hard drive model.","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"The label of the disk object.","type":"text","hidden":false,"required":false,"index":false},{"name":"serial","description":"The serial number of the disk.","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"The OS's description of the disk.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"dns_cache","description":"Enumerate the DNS cache using the undocumented DnsGetCacheDataTable function in dnsapi.dll.","platforms":["windows"],"columns":[{"name":"name","description":"DNS record name","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"DNS record type","type":"text","hidden":false,"required":false,"index":false},{"name":"flags","description":"DNS record flags","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"dns_resolvers","description":"Resolvers used by this host.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Address type index or order","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"Address type: sortlist, nameserver, search","type":"text","hidden":false,"required":false,"index":false},{"name":"address","description":"Resolver IP/IPv6 address","type":"text","hidden":false,"required":false,"index":false},{"name":"netmask","description":"Address (sortlist) netmask length","type":"text","hidden":false,"required":false,"index":false},{"name":"options","description":"Resolver options","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"docker_container_envs","description":"Docker container environment variables.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Environment variable name","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Environment variable value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_container_fs_changes","description":"Changes to files or directories on container's filesystem.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":true,"index":false},{"name":"path","description":"FIle or directory path relative to rootfs","type":"text","hidden":false,"required":false,"index":false},{"name":"change_type","description":"Type of change: C:Modified, A:Added, D:Deleted","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_container_labels","description":"Docker container labels.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Label key","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Optional label value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_container_mounts","description":"Docker container mounts.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of mount (bind, volume)","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Optional mount name","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Source path on host","type":"text","hidden":false,"required":false,"index":false},{"name":"destination","description":"Destination path inside container","type":"text","hidden":false,"required":false,"index":false},{"name":"driver","description":"Driver providing the mount","type":"text","hidden":false,"required":false,"index":false},{"name":"mode","description":"Mount options (rw, ro)","type":"text","hidden":false,"required":false,"index":false},{"name":"rw","description":"1 if read/write. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"propagation","description":"Mount propagation","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_container_networks","description":"Docker container networks.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Network name","type":"text","hidden":false,"required":false,"index":false},{"name":"network_id","description":"Network ID","type":"text","hidden":false,"required":false,"index":false},{"name":"endpoint_id","description":"Endpoint ID","type":"text","hidden":false,"required":false,"index":false},{"name":"gateway","description":"Gateway","type":"text","hidden":false,"required":false,"index":false},{"name":"ip_address","description":"IP address","type":"text","hidden":false,"required":false,"index":false},{"name":"ip_prefix_len","description":"IP subnet prefix length","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv6_gateway","description":"IPv6 gateway","type":"text","hidden":false,"required":false,"index":false},{"name":"ipv6_address","description":"IPv6 address","type":"text","hidden":false,"required":false,"index":false},{"name":"ipv6_prefix_len","description":"IPv6 subnet prefix length","type":"integer","hidden":false,"required":false,"index":false},{"name":"mac_address","description":"MAC address","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_container_ports","description":"Docker container ports.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Protocol (tcp, udp)","type":"text","hidden":false,"required":false,"index":false},{"name":"port","description":"Port inside the container","type":"integer","hidden":false,"required":false,"index":false},{"name":"host_ip","description":"Host IP address on which public port is listening","type":"text","hidden":false,"required":false,"index":false},{"name":"host_port","description":"Host port","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"docker_container_processes","description":"Docker container processes.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":true,"index":false},{"name":"pid","description":"Process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"The process path or shorthand argv[0]","type":"text","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Complete argv","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"Process state","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"euid","description":"Effective user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"egid","description":"Effective group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"suid","description":"Saved user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sgid","description":"Saved group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"wired_size","description":"Bytes of unpageable memory used by process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"resident_size","description":"Bytes of private memory used by process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"total_size","description":"Total virtual memory size","type":"bigint","hidden":false,"required":false,"index":false},{"name":"start_time","description":"Process start in seconds since boot (non-sleeping)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"parent","description":"Process parent's PID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pgroup","description":"Process group","type":"bigint","hidden":false,"required":false,"index":false},{"name":"threads","description":"Number of threads used by process","type":"integer","hidden":false,"required":false,"index":false},{"name":"nice","description":"Process nice level (-20 to 20, default 0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"user","description":"User name","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Cumulative CPU time. [DD-]HH:MM:SS format","type":"text","hidden":false,"required":false,"index":false},{"name":"cpu","description":"CPU utilization as percentage","type":"double","hidden":false,"required":false,"index":false},{"name":"mem","description":"Memory utilization as percentage","type":"double","hidden":false,"required":false,"index":false}]},{"name":"docker_container_stats","description":"Docker container statistics. Queries on this table take at least one second.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":true,"index":false},{"name":"name","description":"Container name","type":"text","hidden":false,"required":false,"index":false},{"name":"pids","description":"Number of processes","type":"integer","hidden":false,"required":false,"index":false},{"name":"read","description":"UNIX time when stats were read","type":"bigint","hidden":false,"required":false,"index":false},{"name":"preread","description":"UNIX time when stats were last read","type":"bigint","hidden":false,"required":false,"index":false},{"name":"interval","description":"Difference between read and preread in nano-seconds","type":"bigint","hidden":false,"required":false,"index":false},{"name":"disk_read","description":"Total disk read bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"disk_write","description":"Total disk write bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"num_procs","description":"Number of processors","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_total_usage","description":"Total CPU usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cpu_kernelmode_usage","description":"CPU kernel mode usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cpu_usermode_usage","description":"CPU user mode usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"system_cpu_usage","description":"CPU system usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"online_cpus","description":"Online CPUs","type":"integer","hidden":false,"required":false,"index":false},{"name":"pre_cpu_total_usage","description":"Last read total CPU usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pre_cpu_kernelmode_usage","description":"Last read CPU kernel mode usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pre_cpu_usermode_usage","description":"Last read CPU user mode usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pre_system_cpu_usage","description":"Last read CPU system usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pre_online_cpus","description":"Last read online CPUs","type":"integer","hidden":false,"required":false,"index":false},{"name":"memory_usage","description":"Memory usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"memory_max_usage","description":"Memory maximum usage","type":"bigint","hidden":false,"required":false,"index":false},{"name":"memory_limit","description":"Memory limit","type":"bigint","hidden":false,"required":false,"index":false},{"name":"network_rx_bytes","description":"Total network bytes read","type":"bigint","hidden":false,"required":false,"index":false},{"name":"network_tx_bytes","description":"Total network bytes transmitted","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"docker_containers","description":"Docker containers information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Container name","type":"text","hidden":false,"required":false,"index":false},{"name":"image","description":"Docker image (name) used to launch this container","type":"text","hidden":false,"required":false,"index":false},{"name":"image_id","description":"Docker image ID","type":"text","hidden":false,"required":false,"index":false},{"name":"command","description":"Command with arguments","type":"text","hidden":false,"required":false,"index":false},{"name":"created","description":"Time of creation as UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"state","description":"Container state (created, restarting, running, removing, paused, exited, dead)","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"Container status information","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Identifier of the initial process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Container path","type":"text","hidden":false,"required":false,"index":false},{"name":"config_entrypoint","description":"Container entrypoint(s)","type":"text","hidden":false,"required":false,"index":false},{"name":"started_at","description":"Container start time as string","type":"text","hidden":false,"required":false,"index":false},{"name":"finished_at","description":"Container finish time as string","type":"text","hidden":false,"required":false,"index":false},{"name":"privileged","description":"Is the container privileged","type":"integer","hidden":false,"required":false,"index":false},{"name":"security_options","description":"List of container security options","type":"text","hidden":false,"required":false,"index":false},{"name":"env_variables","description":"Container environmental variables","type":"text","hidden":false,"required":false,"index":false},{"name":"readonly_rootfs","description":"Is the root filesystem mounted as read only","type":"integer","hidden":false,"required":false,"index":false},{"name":"cgroup_namespace","description":"cgroup namespace","type":"text","hidden":true,"required":false,"index":false},{"name":"ipc_namespace","description":"IPC namespace","type":"text","hidden":true,"required":false,"index":false},{"name":"mnt_namespace","description":"Mount namespace","type":"text","hidden":true,"required":false,"index":false},{"name":"net_namespace","description":"Network namespace","type":"text","hidden":true,"required":false,"index":false},{"name":"pid_namespace","description":"PID namespace","type":"text","hidden":true,"required":false,"index":false},{"name":"user_namespace","description":"User namespace","type":"text","hidden":true,"required":false,"index":false},{"name":"uts_namespace","description":"UTS namespace","type":"text","hidden":true,"required":false,"index":false}]},{"name":"docker_image_history","description":"Docker image history information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Image ID","type":"text","hidden":false,"required":false,"index":false},{"name":"created","description":"Time of creation as UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of instruction in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"created_by","description":"Created by instruction","type":"text","hidden":false,"required":false,"index":false},{"name":"tags","description":"Comma-separated list of tags","type":"text","hidden":false,"required":false,"index":false},{"name":"comment","description":"Instruction comment","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_image_labels","description":"Docker image labels.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Image ID","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Label key","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Optional label value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_image_layers","description":"Docker image layers information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Image ID","type":"text","hidden":false,"required":false,"index":false},{"name":"layer_id","description":"Layer ID","type":"text","hidden":false,"required":false,"index":false},{"name":"layer_order","description":"Layer Order (1 = base layer)","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"docker_images","description":"Docker images information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Image ID","type":"text","hidden":false,"required":false,"index":false},{"name":"created","description":"Time of creation as UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"size_bytes","description":"Size of image in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"tags","description":"Comma-separated list of repository tags","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_info","description":"Docker system information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Docker system ID","type":"text","hidden":false,"required":false,"index":false},{"name":"containers","description":"Total number of containers","type":"integer","hidden":false,"required":false,"index":false},{"name":"containers_running","description":"Number of containers currently running","type":"integer","hidden":false,"required":false,"index":false},{"name":"containers_paused","description":"Number of containers in paused state","type":"integer","hidden":false,"required":false,"index":false},{"name":"containers_stopped","description":"Number of containers in stopped state","type":"integer","hidden":false,"required":false,"index":false},{"name":"images","description":"Number of images","type":"integer","hidden":false,"required":false,"index":false},{"name":"storage_driver","description":"Storage driver","type":"text","hidden":false,"required":false,"index":false},{"name":"memory_limit","description":"1 if memory limit support is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"swap_limit","description":"1 if swap limit support is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"kernel_memory","description":"1 if kernel memory limit support is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_cfs_period","description":"1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_cfs_quota","description":"1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_shares","description":"1 if CPU share weighting support is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_set","description":"1 if CPU set selection support is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv4_forwarding","description":"1 if IPv4 forwarding is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"bridge_nf_iptables","description":"1 if bridge netfilter iptables is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"bridge_nf_ip6tables","description":"1 if bridge netfilter ip6tables is enabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"oom_kill_disable","description":"1 if Out-of-memory kill is disabled. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"logging_driver","description":"Logging driver","type":"text","hidden":false,"required":false,"index":false},{"name":"cgroup_driver","description":"Control groups driver","type":"text","hidden":false,"required":false,"index":false},{"name":"kernel_version","description":"Kernel version","type":"text","hidden":false,"required":false,"index":false},{"name":"os","description":"Operating system","type":"text","hidden":false,"required":false,"index":false},{"name":"os_type","description":"Operating system type","type":"text","hidden":false,"required":false,"index":false},{"name":"architecture","description":"Hardware architecture","type":"text","hidden":false,"required":false,"index":false},{"name":"cpus","description":"Number of CPUs","type":"integer","hidden":false,"required":false,"index":false},{"name":"memory","description":"Total memory","type":"bigint","hidden":false,"required":false,"index":false},{"name":"http_proxy","description":"HTTP proxy","type":"text","hidden":false,"required":false,"index":false},{"name":"https_proxy","description":"HTTPS proxy","type":"text","hidden":false,"required":false,"index":false},{"name":"no_proxy","description":"Comma-separated list of domain extensions proxy should not be used for","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the docker host","type":"text","hidden":false,"required":false,"index":false},{"name":"server_version","description":"Server version","type":"text","hidden":false,"required":false,"index":false},{"name":"root_dir","description":"Docker root directory","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_network_labels","description":"Docker network labels.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Network ID","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Label key","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Optional label value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_networks","description":"Docker networks information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Network ID","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Network name","type":"text","hidden":false,"required":false,"index":false},{"name":"driver","description":"Network driver","type":"text","hidden":false,"required":false,"index":false},{"name":"created","description":"Time of creation as UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"enable_ipv6","description":"1 if IPv6 is enabled on this network. 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"subnet","description":"Network subnet","type":"text","hidden":false,"required":false,"index":false},{"name":"gateway","description":"Network gateway","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_version","description":"Docker version information.","platforms":["darwin","linux"],"columns":[{"name":"version","description":"Docker version","type":"text","hidden":false,"required":false,"index":false},{"name":"api_version","description":"API version","type":"text","hidden":false,"required":false,"index":false},{"name":"min_api_version","description":"Minimum API version supported","type":"text","hidden":false,"required":false,"index":false},{"name":"git_commit","description":"Docker build git commit","type":"text","hidden":false,"required":false,"index":false},{"name":"go_version","description":"Go version","type":"text","hidden":false,"required":false,"index":false},{"name":"os","description":"Operating system","type":"text","hidden":false,"required":false,"index":false},{"name":"arch","description":"Hardware architecture","type":"text","hidden":false,"required":false,"index":false},{"name":"kernel_version","description":"Kernel version","type":"text","hidden":false,"required":false,"index":false},{"name":"build_time","description":"Build time","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_volume_labels","description":"Docker volume labels.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Volume name","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Label key","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Optional label value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"docker_volumes","description":"Docker volumes information.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Volume name","type":"text","hidden":false,"required":false,"index":false},{"name":"driver","description":"Volume driver","type":"text","hidden":false,"required":false,"index":false},{"name":"mount_point","description":"Mount point","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Volume type","type":"text","hidden":false,"required":false,"index":false}]},{"name":"drivers","description":"Details for in-use Windows device drivers. This does not display installed but unused drivers.","platforms":["windows"],"columns":[{"name":"device_id","description":"Device ID","type":"text","hidden":false,"required":false,"index":false},{"name":"device_name","description":"Device name","type":"text","hidden":false,"required":false,"index":false},{"name":"image","description":"Path to driver image file","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Driver description","type":"text","hidden":false,"required":false,"index":false},{"name":"service","description":"Driver service name, if one exists","type":"text","hidden":false,"required":false,"index":false},{"name":"service_key","description":"Driver service registry key","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Driver version","type":"text","hidden":false,"required":false,"index":false},{"name":"inf","description":"Associated inf file","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"Device/driver class name","type":"text","hidden":false,"required":false,"index":false},{"name":"provider","description":"Driver provider","type":"text","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"Device manufacturer","type":"text","hidden":false,"required":false,"index":false},{"name":"driver_key","description":"Driver key","type":"text","hidden":false,"required":false,"index":false},{"name":"date","description":"Driver date","type":"bigint","hidden":false,"required":false,"index":false},{"name":"signed","description":"Whether the driver is signed or not","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"ec2_instance_metadata","description":"EC2 instance metadata.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"instance_id","description":"EC2 instance ID","type":"text","hidden":false,"required":false,"index":false},{"name":"instance_type","description":"EC2 instance type","type":"text","hidden":false,"required":false,"index":false},{"name":"architecture","description":"Hardware architecture of this EC2 instance","type":"text","hidden":false,"required":false,"index":false},{"name":"region","description":"AWS region in which this instance launched","type":"text","hidden":false,"required":false,"index":false},{"name":"availability_zone","description":"Availability zone in which this instance launched","type":"text","hidden":false,"required":false,"index":false},{"name":"local_hostname","description":"Private IPv4 DNS hostname of the first interface of this instance","type":"text","hidden":false,"required":false,"index":false},{"name":"local_ipv4","description":"Private IPv4 address of the first interface of this instance","type":"text","hidden":false,"required":false,"index":false},{"name":"mac","description":"MAC address for the first network interface of this EC2 instance","type":"text","hidden":false,"required":false,"index":false},{"name":"security_groups","description":"Comma separated list of security group names","type":"text","hidden":false,"required":false,"index":false},{"name":"iam_arn","description":"If there is an IAM role associated with the instance, contains instance profile ARN","type":"text","hidden":false,"required":false,"index":false},{"name":"ami_id","description":"AMI ID used to launch this EC2 instance","type":"text","hidden":false,"required":false,"index":false},{"name":"reservation_id","description":"ID of the reservation","type":"text","hidden":false,"required":false,"index":false},{"name":"account_id","description":"AWS account ID which owns this EC2 instance","type":"text","hidden":false,"required":false,"index":false},{"name":"ssh_public_key","description":"SSH public key. Only available if supplied at instance launch time","type":"text","hidden":false,"required":false,"index":false}]},{"name":"ec2_instance_tags","description":"EC2 instance tag key value pairs.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"instance_id","description":"EC2 instance ID","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Tag key","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Tag value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"es_process_events","description":"Process execution events from EndpointSecurity.","platforms":["darwin"],"columns":[{"name":"version","description":"Version of EndpointSecurity event","type":"integer","hidden":false,"required":false,"index":false},{"name":"seq_num","description":"Per event sequence number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"global_seq_num","description":"Global sequence number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"original_parent","description":"Original parent process ID in case of reparenting","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Command line arguments (argv)","type":"text","hidden":false,"required":false,"index":false},{"name":"cmdline_count","description":"Number of command line arguments","type":"bigint","hidden":false,"required":false,"index":false},{"name":"env","description":"Environment variables delimited by spaces","type":"text","hidden":false,"required":false,"index":false},{"name":"env_count","description":"Number of environment variables","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cwd","description":"The process current working directory","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID of the process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"euid","description":"Effective User ID of the process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID of the process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"egid","description":"Effective Group ID of the process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"username","description":"Username","type":"text","hidden":false,"required":false,"index":false},{"name":"signing_id","description":"Signature identifier of the process","type":"text","hidden":false,"required":false,"index":false},{"name":"team_id","description":"Team identifier of thd process","type":"text","hidden":false,"required":false,"index":false},{"name":"cdhash","description":"Codesigning hash of the process","type":"text","hidden":false,"required":false,"index":false},{"name":"platform_binary","description":"Indicates if the binary is Apple signed binary (1) or not (0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"exit_code","description":"Exit code of a process in case of an exit event","type":"integer","hidden":false,"required":false,"index":false},{"name":"child_pid","description":"Process ID of a child process in case of a fork event","type":"bigint","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"event_type","description":"Type of EndpointSecurity event","type":"text","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"es_process_file_events","description":"Process execution events from EndpointSecurity.","platforms":["darwin"],"columns":[{"name":"version","description":"Version of EndpointSecurity event","type":"integer","hidden":false,"required":false,"index":false},{"name":"seq_num","description":"Per event sequence number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"global_seq_num","description":"Global sequence number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","hidden":false,"required":false,"index":false},{"name":"filename","description":"The source or target filename for the event","type":"text","hidden":false,"required":false,"index":false},{"name":"dest_filename","description":"Destination filename for the event","type":"text","hidden":false,"required":false,"index":false},{"name":"event_type","description":"Type of EndpointSecurity event","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"etc_hosts","description":"Line-parsed /etc/hosts.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"address","description":"IP address mapping","type":"text","hidden":false,"required":false,"index":false},{"name":"hostnames","description":"Raw hosts mapping","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"etc_protocols","description":"Line-parsed /etc/protocols.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"name","description":"Protocol name","type":"text","hidden":false,"required":false,"index":false},{"name":"number","description":"Protocol number","type":"integer","hidden":false,"required":false,"index":false},{"name":"alias","description":"Protocol alias","type":"text","hidden":false,"required":false,"index":false},{"name":"comment","description":"Comment with protocol description","type":"text","hidden":false,"required":false,"index":false}]},{"name":"etc_services","description":"Line-parsed /etc/services.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"name","description":"Service name","type":"text","hidden":false,"required":false,"index":false},{"name":"port","description":"Service port number","type":"integer","hidden":false,"required":false,"index":false},{"name":"protocol","description":"Transport protocol (TCP/UDP)","type":"text","hidden":false,"required":false,"index":false},{"name":"aliases","description":"Optional space separated list of other names for a service","type":"text","hidden":false,"required":false,"index":false},{"name":"comment","description":"Optional comment for a service.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"event_taps","description":"Returns information about installed event taps.","platforms":["darwin"],"columns":[{"name":"enabled","description":"Is the Event Tap enabled","type":"integer","hidden":false,"required":false,"index":false},{"name":"event_tap_id","description":"Unique ID for the Tap","type":"integer","hidden":false,"required":false,"index":false},{"name":"event_tapped","description":"The mask that identifies the set of events to be observed.","type":"text","hidden":false,"required":false,"index":false},{"name":"process_being_tapped","description":"The process ID of the target application","type":"integer","hidden":false,"required":false,"index":false},{"name":"tapping_process","description":"The process ID of the application that created the event tap.","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"extended_attributes","description":"Returns the extended attributes for files (similar to Windows ADS).","platforms":["darwin","linux"],"columns":[{"name":"path","description":"Absolute file path","type":"text","hidden":false,"required":true,"index":false},{"name":"directory","description":"Directory of file(s)","type":"text","hidden":false,"required":true,"index":false},{"name":"key","description":"Name of the value generated from the extended attribute","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"The parsed information from the attribute","type":"text","hidden":false,"required":false,"index":false},{"name":"base64","description":"1 if the value is base64 encoded else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"fan_speed_sensors","description":"Fan speeds.","platforms":["darwin"],"columns":[{"name":"fan","description":"Fan number","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Fan name","type":"text","hidden":false,"required":false,"index":false},{"name":"actual","description":"Actual speed","type":"integer","hidden":false,"required":false,"index":false},{"name":"min","description":"Minimum speed","type":"integer","hidden":false,"required":false,"index":false},{"name":"max","description":"Maximum speed","type":"integer","hidden":false,"required":false,"index":false},{"name":"target","description":"Target speed","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"fbsd_kmods","description":"Loaded FreeBSD kernel modules.","platforms":["freebsd"],"columns":[{"name":"name","description":"Module name","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of module content","type":"integer","hidden":false,"required":false,"index":false},{"name":"refs","description":"Module reverse dependencies","type":"integer","hidden":false,"required":false,"index":false},{"name":"address","description":"Kernel module address","type":"text","hidden":false,"required":false,"index":false}]},{"name":"file","description":"Interactive filesystem attributes and metadata.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"path","description":"Absolute file path","type":"text","hidden":false,"required":true,"index":false},{"name":"directory","description":"Directory of file(s)","type":"text","hidden":false,"required":true,"index":false},{"name":"filename","description":"Name portion of file path","type":"text","hidden":false,"required":false,"index":false},{"name":"inode","description":"Filesystem inode number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid","description":"Owning user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Owning group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mode","description":"Permission bits","type":"text","hidden":false,"required":false,"index":false},{"name":"device","description":"Device ID (optional)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of file in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"block_size","description":"Block size of filesystem","type":"integer","hidden":false,"required":false,"index":false},{"name":"atime","description":"Last access time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Last modification time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Last status change time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"btime","description":"(B)irth or (cr)eate time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"hard_links","description":"Number of hard links","type":"integer","hidden":false,"required":false,"index":false},{"name":"symlink","description":"1 if the path is a symlink, otherwise 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"File status","type":"text","hidden":false,"required":false,"index":false},{"name":"attributes","description":"File attrib string. See: https://ss64.com/nt/attrib.html","type":"text","hidden":true,"required":false,"index":false},{"name":"volume_serial","description":"Volume serial number","type":"text","hidden":true,"required":false,"index":false},{"name":"file_id","description":"file ID","type":"text","hidden":true,"required":false,"index":false},{"name":"file_version","description":"File version","type":"text","hidden":true,"required":false,"index":false},{"name":"product_version","description":"File product version","type":"text","hidden":true,"required":false,"index":false},{"name":"original_filename","description":"(Executable files only) Original filename","type":"text","hidden":true,"required":false,"index":false},{"name":"bsd_flags","description":"The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","hidden":true,"required":false,"index":false}]},{"name":"file_events","description":"Track time/action changes to files specified in configuration data.","platforms":["darwin","linux"],"columns":[{"name":"target_path","description":"The path associated with the event","type":"text","hidden":false,"required":false,"index":false},{"name":"category","description":"The category of the file defined in the config","type":"text","hidden":false,"required":false,"index":false},{"name":"action","description":"Change action (UPDATE, REMOVE, etc)","type":"text","hidden":false,"required":false,"index":false},{"name":"transaction_id","description":"ID used during bulk update","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inode","description":"Filesystem inode number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid","description":"Owning user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Owning group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mode","description":"Permission bits","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of file in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"atime","description":"Last access time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Last modification time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Last status change time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"md5","description":"The MD5 of the file after change","type":"text","hidden":false,"required":false,"index":false},{"name":"sha1","description":"The SHA1 of the file after change","type":"text","hidden":false,"required":false,"index":false},{"name":"sha256","description":"The SHA256 of the file after change","type":"text","hidden":false,"required":false,"index":false},{"name":"hashed","description":"1 if the file was hashed, 0 if not, -1 if hashing failed","type":"integer","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of file event","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"firefox_addons","description":"Firefox browser extensions, webapps, and addons.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"uid","description":"The local user that owns the addon","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"Addon display name","type":"text","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Addon identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"creator","description":"Addon-supported creator string","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Extension, addon, webapp","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Addon-supplied version string","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Addon-supplied description string","type":"text","hidden":false,"required":false,"index":false},{"name":"source_url","description":"URL that installed the addon","type":"text","hidden":false,"required":false,"index":false},{"name":"visible","description":"1 If the addon is shown in browser else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"active","description":"1 If the addon is active else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"disabled","description":"1 If the addon is application-disabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"autoupdate","description":"1 If the addon applies background updates else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"native","description":"1 If the addon includes binary components else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"location","description":"Global, profile location","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to plugin bundle","type":"text","hidden":false,"required":false,"index":false}]},{"name":"gatekeeper","description":"macOS Gatekeeper Details.","platforms":["darwin"],"columns":[{"name":"assessments_enabled","description":"1 If a Gatekeeper is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"dev_id_enabled","description":"1 If a Gatekeeper allows execution from identified developers else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"version","description":"Version of Gatekeeper's gke.bundle","type":"text","hidden":false,"required":false,"index":false},{"name":"opaque_version","description":"Version of Gatekeeper's gkopaque.bundle","type":"text","hidden":false,"required":false,"index":false}]},{"name":"gatekeeper_approved_apps","description":"Gatekeeper apps a user has allowed to run.","platforms":["darwin"],"columns":[{"name":"path","description":"Path of executable allowed to run","type":"text","hidden":false,"required":false,"index":false},{"name":"requirement","description":"Code signing requirement language","type":"text","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Last change time","type":"double","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Last modification time","type":"double","hidden":false,"required":false,"index":false}]},{"name":"groups","description":"Local system groups.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"gid","description":"Unsigned int64 group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid_signed","description":"A signed int64 version of gid","type":"bigint","hidden":false,"required":false,"index":false},{"name":"groupname","description":"Canonical local group name","type":"text","hidden":false,"required":false,"index":false},{"name":"group_sid","description":"Unique group ID","type":"text","hidden":true,"required":false,"index":false},{"name":"comment","description":"Remarks or comments associated with the group","type":"text","hidden":true,"required":false,"index":false},{"name":"is_hidden","description":"IsHidden attribute set in OpenDirectory","type":"integer","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"hardware_events","description":"Hardware (PCI/USB/HID) events from UDEV or IOKit.","platforms":["darwin","linux"],"columns":[{"name":"action","description":"Remove, insert, change properties, etc","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Local device path assigned (optional)","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of hardware and hardware event","type":"text","hidden":false,"required":false,"index":false},{"name":"driver","description":"Driver claiming the device","type":"text","hidden":false,"required":false,"index":false},{"name":"vendor","description":"Hardware device vendor","type":"text","hidden":false,"required":false,"index":false},{"name":"vendor_id","description":"Hex encoded Hardware vendor identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"model","description":"Hardware device model","type":"text","hidden":false,"required":false,"index":false},{"name":"model_id","description":"Hex encoded Hardware model identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"serial","description":"Device serial (optional)","type":"text","hidden":false,"required":false,"index":false},{"name":"revision","description":"Device revision (optional)","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of hardware event","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"hash","description":"Filesystem hash data.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"path","description":"Must provide a path or directory","type":"text","hidden":false,"required":true,"index":false},{"name":"directory","description":"Must provide a path or directory","type":"text","hidden":false,"required":true,"index":false},{"name":"md5","description":"MD5 hash of provided filesystem data","type":"text","hidden":false,"required":false,"index":false},{"name":"sha1","description":"SHA1 hash of provided filesystem data","type":"text","hidden":false,"required":false,"index":false},{"name":"sha256","description":"SHA256 hash of provided filesystem data","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","hidden":true,"required":false,"index":false}]},{"name":"homebrew_packages","description":"The installed homebrew package database.","platforms":["darwin"],"columns":[{"name":"name","description":"Package name","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Package install path","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Current 'linked' version","type":"text","hidden":false,"required":false,"index":false},{"name":"prefix","description":"Homebrew install prefix","type":"text","hidden":true,"required":false,"index":false}]},{"name":"hvci_status","description":"Retrieve HVCI info of the machine.","platforms":["windows"],"columns":[{"name":"version","description":"The version number of the Device Guard build.","type":"text","hidden":false,"required":false,"index":false},{"name":"instance_identifier","description":"The instance ID of Device Guard.","type":"text","hidden":false,"required":false,"index":false},{"name":"vbs_status","description":"The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.","type":"text","hidden":false,"required":false,"index":false},{"name":"code_integrity_policy_enforcement_status","description":"The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.","type":"text","hidden":false,"required":false,"index":false},{"name":"umci_policy_status","description":"The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"ibridge_info","description":"Information about the Apple iBridge hardware controller.","platforms":["darwin"],"columns":[{"name":"boot_uuid","description":"Boot UUID of the iBridge controller","type":"text","hidden":false,"required":false,"index":false},{"name":"coprocessor_version","description":"The manufacturer and chip version","type":"text","hidden":false,"required":false,"index":false},{"name":"firmware_version","description":"The build version of the firmware","type":"text","hidden":false,"required":false,"index":false},{"name":"unique_chip_id","description":"Unique id of the iBridge controller","type":"text","hidden":false,"required":false,"index":false}]},{"name":"ie_extensions","description":"Internet Explorer browser extensions.","platforms":["windows"],"columns":[{"name":"name","description":"Extension display name","type":"text","hidden":false,"required":false,"index":false},{"name":"registry_path","description":"Extension identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Version of the executable","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to executable","type":"text","hidden":false,"required":false,"index":false}]},{"name":"intel_me_info","description":"Intel ME/CSE Info.","platforms":["linux","windows"],"columns":[{"name":"version","description":"Intel ME version","type":"text","hidden":false,"required":false,"index":false}]},{"name":"interface_addresses","description":"Network interfaces and relevant metadata.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"interface","description":"Interface name","type":"text","hidden":false,"required":false,"index":false},{"name":"address","description":"Specific address for interface","type":"text","hidden":false,"required":false,"index":false},{"name":"mask","description":"Interface netmask","type":"text","hidden":false,"required":false,"index":false},{"name":"broadcast","description":"Broadcast address for the interface","type":"text","hidden":false,"required":false,"index":false},{"name":"point_to_point","description":"PtP address for the interface","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of address. One of dhcp, manual, auto, other, unknown","type":"text","hidden":false,"required":false,"index":false},{"name":"friendly_name","description":"The friendly display name of the interface.","type":"text","hidden":true,"required":false,"index":false}]},{"name":"interface_details","description":"Detailed information and stats of network interfaces.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"interface","description":"Interface name","type":"text","hidden":false,"required":false,"index":false},{"name":"mac","description":"MAC of interface (optional)","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Interface type (includes virtual)","type":"integer","hidden":false,"required":false,"index":false},{"name":"mtu","description":"Network MTU","type":"integer","hidden":false,"required":false,"index":false},{"name":"metric","description":"Metric based on the speed of the interface","type":"integer","hidden":false,"required":false,"index":false},{"name":"flags","description":"Flags (netdevice) for the device","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipackets","description":"Input packets","type":"bigint","hidden":false,"required":false,"index":false},{"name":"opackets","description":"Output packets","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ibytes","description":"Input bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"obytes","description":"Output bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ierrors","description":"Input errors","type":"bigint","hidden":false,"required":false,"index":false},{"name":"oerrors","description":"Output errors","type":"bigint","hidden":false,"required":false,"index":false},{"name":"idrops","description":"Input drops","type":"bigint","hidden":false,"required":false,"index":false},{"name":"odrops","description":"Output drops","type":"bigint","hidden":false,"required":false,"index":false},{"name":"collisions","description":"Packet Collisions detected","type":"bigint","hidden":false,"required":false,"index":false},{"name":"last_change","description":"Time of last device modification (optional)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"link_speed","description":"Interface speed in Mb/s","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pci_slot","description":"PCI slot number","type":"text","hidden":true,"required":false,"index":false},{"name":"friendly_name","description":"The friendly display name of the interface.","type":"text","hidden":true,"required":false,"index":false},{"name":"description","description":"Short description of the object a one-line string.","type":"text","hidden":true,"required":false,"index":false},{"name":"manufacturer","description":"Name of the network adapter's manufacturer.","type":"text","hidden":true,"required":false,"index":false},{"name":"connection_id","description":"Name of the network connection as it appears in the Network Connections Control Panel program.","type":"text","hidden":true,"required":false,"index":false},{"name":"connection_status","description":"State of the network adapter connection to the network.","type":"text","hidden":true,"required":false,"index":false},{"name":"enabled","description":"Indicates whether the adapter is enabled or not.","type":"integer","hidden":true,"required":false,"index":false},{"name":"physical_adapter","description":"Indicates whether the adapter is a physical or a logical adapter.","type":"integer","hidden":true,"required":false,"index":false},{"name":"speed","description":"Estimate of the current bandwidth in bits per second.","type":"integer","hidden":true,"required":false,"index":false},{"name":"service","description":"The name of the service the network adapter uses.","type":"text","hidden":true,"required":false,"index":false},{"name":"dhcp_enabled","description":"If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection.","type":"integer","hidden":true,"required":false,"index":false},{"name":"dhcp_lease_expires","description":"Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server.","type":"text","hidden":true,"required":false,"index":false},{"name":"dhcp_lease_obtained","description":"Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server.","type":"text","hidden":true,"required":false,"index":false},{"name":"dhcp_server","description":"IP address of the dynamic host configuration protocol (DHCP) server.","type":"text","hidden":true,"required":false,"index":false},{"name":"dns_domain","description":"Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'.","type":"text","hidden":true,"required":false,"index":false},{"name":"dns_domain_suffix_search_order","description":"Array of DNS domain suffixes to be appended to the end of host names during name resolution.","type":"text","hidden":true,"required":false,"index":false},{"name":"dns_host_name","description":"Host name used to identify the local computer for authentication by some utilities.","type":"text","hidden":true,"required":false,"index":false},{"name":"dns_server_search_order","description":"Array of server IP addresses to be used in querying for DNS servers.","type":"text","hidden":true,"required":false,"index":false}]},{"name":"interface_ipv6","description":"IPv6 configuration and stats of network interfaces.","platforms":["darwin","linux"],"columns":[{"name":"interface","description":"Interface name","type":"text","hidden":false,"required":false,"index":false},{"name":"hop_limit","description":"Current Hop Limit","type":"integer","hidden":false,"required":false,"index":false},{"name":"forwarding_enabled","description":"Enable IP forwarding","type":"integer","hidden":false,"required":false,"index":false},{"name":"redirect_accept","description":"Accept ICMP redirect messages","type":"integer","hidden":false,"required":false,"index":false},{"name":"rtadv_accept","description":"Accept ICMP Router Advertisement","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"iokit_devicetree","description":"The IOKit registry matching the DeviceTree plane.","platforms":["darwin"],"columns":[{"name":"name","description":"Device node name","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"Best matching device class (most-specific category)","type":"text","hidden":false,"required":false,"index":false},{"name":"id","description":"IOKit internal registry ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent device registry ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"device_path","description":"Device tree path","type":"text","hidden":false,"required":false,"index":false},{"name":"service","description":"1 if the device conforms to IOService else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"busy_state","description":"1 if the device is in a busy state else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"retain_count","description":"The device reference count","type":"integer","hidden":false,"required":false,"index":false},{"name":"depth","description":"Device nested depth","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"iokit_registry","description":"The full IOKit registry without selecting a plane.","platforms":["darwin"],"columns":[{"name":"name","description":"Default name of the node","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"Best matching device class (most-specific category)","type":"text","hidden":false,"required":false,"index":false},{"name":"id","description":"IOKit internal registry ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent registry ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"busy_state","description":"1 if the node is in a busy state else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"retain_count","description":"The node reference count","type":"integer","hidden":false,"required":false,"index":false},{"name":"depth","description":"Node nested depth","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"iptables","description":"Linux IP packet filtering and NAT tool.","platforms":["linux"],"columns":[{"name":"filter_name","description":"Packet matching filter table name.","type":"text","hidden":false,"required":false,"index":false},{"name":"chain","description":"Size of module content.","type":"text","hidden":false,"required":false,"index":false},{"name":"policy","description":"Policy that applies for this rule.","type":"text","hidden":false,"required":false,"index":false},{"name":"target","description":"Target that applies for this rule.","type":"text","hidden":false,"required":false,"index":false},{"name":"protocol","description":"Protocol number identification.","type":"integer","hidden":false,"required":false,"index":false},{"name":"src_port","description":"Protocol source port(s).","type":"text","hidden":false,"required":false,"index":false},{"name":"dst_port","description":"Protocol destination port(s).","type":"text","hidden":false,"required":false,"index":false},{"name":"src_ip","description":"Source IP address.","type":"text","hidden":false,"required":false,"index":false},{"name":"src_mask","description":"Source IP address mask.","type":"text","hidden":false,"required":false,"index":false},{"name":"iniface","description":"Input interface for the rule.","type":"text","hidden":false,"required":false,"index":false},{"name":"iniface_mask","description":"Input interface mask for the rule.","type":"text","hidden":false,"required":false,"index":false},{"name":"dst_ip","description":"Destination IP address.","type":"text","hidden":false,"required":false,"index":false},{"name":"dst_mask","description":"Destination IP address mask.","type":"text","hidden":false,"required":false,"index":false},{"name":"outiface","description":"Output interface for the rule.","type":"text","hidden":false,"required":false,"index":false},{"name":"outiface_mask","description":"Output interface mask for the rule.","type":"text","hidden":false,"required":false,"index":false},{"name":"match","description":"Matching rule that applies.","type":"text","hidden":false,"required":false,"index":false},{"name":"packets","description":"Number of matching packets for this rule.","type":"integer","hidden":false,"required":false,"index":false},{"name":"bytes","description":"Number of matching bytes for this rule.","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"kernel_extensions","description":"macOS's kernel extensions, both loaded and within the load search path.","platforms":["darwin"],"columns":[{"name":"idx","description":"Extension load tag or index","type":"integer","hidden":false,"required":false,"index":false},{"name":"refs","description":"Reference count","type":"integer","hidden":false,"required":false,"index":false},{"name":"size","description":"Bytes of wired memory used by extension","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"Extension label","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension version","type":"text","hidden":false,"required":false,"index":false},{"name":"linked_against","description":"Indexes of extensions this extension is linked against","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Optional path to extension bundle","type":"text","hidden":false,"required":false,"index":false}]},{"name":"kernel_info","description":"Basic active kernel information.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"version","description":"Kernel version","type":"text","hidden":false,"required":false,"index":false},{"name":"arguments","description":"Kernel arguments","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Kernel path","type":"text","hidden":false,"required":false,"index":false},{"name":"device","description":"Kernel device identifier","type":"text","hidden":false,"required":false,"index":false}]},{"name":"kernel_modules","description":"Linux kernel modules both loaded and within the load search path.","platforms":["linux"],"columns":[{"name":"name","description":"Module name","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of module content","type":"bigint","hidden":false,"required":false,"index":false},{"name":"used_by","description":"Module reverse dependencies","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"Kernel module status","type":"text","hidden":false,"required":false,"index":false},{"name":"address","description":"Kernel module address","type":"text","hidden":false,"required":false,"index":false}]},{"name":"kernel_panics","description":"System kernel panic logs.","platforms":["darwin"],"columns":[{"name":"path","description":"Location of log file","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Formatted time of the event","type":"text","hidden":false,"required":false,"index":false},{"name":"registers","description":"A space delimited line of register:value pairs","type":"text","hidden":false,"required":false,"index":false},{"name":"frame_backtrace","description":"Backtrace of the crashed module","type":"text","hidden":false,"required":false,"index":false},{"name":"module_backtrace","description":"Modules appearing in the crashed module's backtrace","type":"text","hidden":false,"required":false,"index":false},{"name":"dependencies","description":"Module dependencies existing in crashed module's backtrace","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Process name corresponding to crashed thread","type":"text","hidden":false,"required":false,"index":false},{"name":"os_version","description":"Version of the operating system","type":"text","hidden":false,"required":false,"index":false},{"name":"kernel_version","description":"Version of the system kernel","type":"text","hidden":false,"required":false,"index":false},{"name":"system_model","description":"Physical system model, for example 'MacBookPro12,1 (Mac-E43C1C25D4880AD6)'","type":"text","hidden":false,"required":false,"index":false},{"name":"uptime","description":"System uptime at kernel panic in nanoseconds","type":"bigint","hidden":false,"required":false,"index":false},{"name":"last_loaded","description":"Last loaded module before panic","type":"text","hidden":false,"required":false,"index":false},{"name":"last_unloaded","description":"Last unloaded module before panic","type":"text","hidden":false,"required":false,"index":false}]},{"name":"keychain_acls","description":"Applications that have ACL entries in the keychain.","platforms":["darwin"],"columns":[{"name":"keychain_path","description":"The path of the keychain","type":"text","hidden":false,"required":false,"index":false},{"name":"authorizations","description":"A space delimited set of authorization attributes","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"The path of the authorized application","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"The description included with the ACL entry","type":"text","hidden":false,"required":false,"index":false},{"name":"label","description":"An optional label tag that may be included with the keychain entry","type":"text","hidden":false,"required":false,"index":false}]},{"name":"keychain_items","description":"Generic details about keychain items.","platforms":["darwin"],"columns":[{"name":"label","description":"Generic item name","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Optional item description","type":"text","hidden":false,"required":false,"index":false},{"name":"comment","description":"Optional keychain comment","type":"text","hidden":false,"required":false,"index":false},{"name":"account","description":"Optional item account","type":"text","hidden":false,"required":false,"index":false},{"name":"created","description":"Data item was created","type":"text","hidden":false,"required":false,"index":false},{"name":"modified","description":"Date of last modification","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Keychain item type (class)","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to keychain containing item","type":"text","hidden":false,"required":false,"index":false}]},{"name":"known_hosts","description":"A line-delimited known_hosts table.","platforms":["darwin","linux"],"columns":[{"name":"uid","description":"The local user that owns the known_hosts file","type":"bigint","hidden":false,"required":false,"index":false},{"name":"key","description":"parsed authorized keys line","type":"text","hidden":false,"required":false,"index":false},{"name":"key_file","description":"Path to known_hosts file","type":"text","hidden":false,"required":false,"index":false}]},{"name":"kva_speculative_info","description":"Display kernel virtual address and speculative execution information for the system.","platforms":["windows"],"columns":[{"name":"kva_shadow_enabled","description":"Kernel Virtual Address shadowing is enabled.","type":"integer","hidden":false,"required":false,"index":false},{"name":"kva_shadow_user_global","description":"User pages are marked as global.","type":"integer","hidden":false,"required":false,"index":false},{"name":"kva_shadow_pcid","description":"Kernel VA PCID flushing optimization is enabled.","type":"integer","hidden":false,"required":false,"index":false},{"name":"kva_shadow_inv_pcid","description":"Kernel VA INVPCID is enabled.","type":"integer","hidden":false,"required":false,"index":false},{"name":"bp_mitigations","description":"Branch Prediction mitigations are enabled.","type":"integer","hidden":false,"required":false,"index":false},{"name":"bp_system_pol_disabled","description":"Branch Predictions are disabled via system policy.","type":"integer","hidden":false,"required":false,"index":false},{"name":"bp_microcode_disabled","description":"Branch Predictions are disabled due to lack of microcode update.","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_spec_ctrl_supported","description":"SPEC_CTRL MSR supported by CPU Microcode.","type":"integer","hidden":false,"required":false,"index":false},{"name":"ibrs_support_enabled","description":"Windows uses IBRS.","type":"integer","hidden":false,"required":false,"index":false},{"name":"stibp_support_enabled","description":"Windows uses STIBP.","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_pred_cmd_supported","description":"PRED_CMD MSR supported by CPU Microcode.","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"last","description":"System logins and logouts.","platforms":["darwin","linux"],"columns":[{"name":"username","description":"Entry username","type":"text","hidden":false,"required":false,"index":false},{"name":"tty","description":"Entry terminal","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"Entry type, according to ut_type types (utmp.h)","type":"integer","hidden":false,"required":false,"index":false},{"name":"type_name","description":"Entry type name, according to ut_type types (utmp.h)","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Entry timestamp","type":"integer","hidden":false,"required":false,"index":false},{"name":"host","description":"Entry hostname","type":"text","hidden":false,"required":false,"index":false}]},{"name":"launchd","description":"LaunchAgents and LaunchDaemons from default search paths.","platforms":["darwin"],"columns":[{"name":"path","description":"Path to daemon or agent plist","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"File name of plist (used by launchd)","type":"text","hidden":false,"required":false,"index":false},{"name":"label","description":"Daemon or agent service name","type":"text","hidden":false,"required":false,"index":false},{"name":"program","description":"Path to target program","type":"text","hidden":false,"required":false,"index":false},{"name":"run_at_load","description":"Should the program run on launch load","type":"text","hidden":false,"required":false,"index":false},{"name":"keep_alive","description":"Should the process be restarted if killed","type":"text","hidden":false,"required":false,"index":false},{"name":"on_demand","description":"Deprecated key, replaced by keep_alive","type":"text","hidden":false,"required":false,"index":false},{"name":"disabled","description":"Skip loading this daemon or agent on boot","type":"text","hidden":false,"required":false,"index":false},{"name":"username","description":"Run this daemon or agent as this username","type":"text","hidden":false,"required":false,"index":false},{"name":"groupname","description":"Run this daemon or agent as this group","type":"text","hidden":false,"required":false,"index":false},{"name":"stdout_path","description":"Pipe stdout to a target path","type":"text","hidden":false,"required":false,"index":false},{"name":"stderr_path","description":"Pipe stderr to a target path","type":"text","hidden":false,"required":false,"index":false},{"name":"start_interval","description":"Frequency to run in seconds","type":"text","hidden":false,"required":false,"index":false},{"name":"program_arguments","description":"Command line arguments passed to program","type":"text","hidden":false,"required":false,"index":false},{"name":"watch_paths","description":"Key that launches daemon or agent if path is modified","type":"text","hidden":false,"required":false,"index":false},{"name":"queue_directories","description":"Similar to watch_paths but only with non-empty directories","type":"text","hidden":false,"required":false,"index":false},{"name":"inetd_compatibility","description":"Run this daemon or agent as it was launched from inetd","type":"text","hidden":false,"required":false,"index":false},{"name":"start_on_mount","description":"Run daemon or agent every time a filesystem is mounted","type":"text","hidden":false,"required":false,"index":false},{"name":"root_directory","description":"Key used to specify a directory to chroot to before launch","type":"text","hidden":false,"required":false,"index":false},{"name":"working_directory","description":"Key used to specify a directory to chdir to before launch","type":"text","hidden":false,"required":false,"index":false},{"name":"process_type","description":"Key describes the intended purpose of the job","type":"text","hidden":false,"required":false,"index":false}]},{"name":"launchd_overrides","description":"Override keys, per user, for LaunchDaemons and Agents.","platforms":["darwin"],"columns":[{"name":"label","description":"Daemon or agent service name","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Name of the override key","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Overridden value","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID applied to the override, 0 applies to all","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to daemon or agent plist","type":"text","hidden":false,"required":false,"index":false}]},{"name":"listening_ports","description":"Processes with listening (bound) network sockets/ports.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"port","description":"Transport layer port","type":"integer","hidden":false,"required":false,"index":false},{"name":"protocol","description":"Transport protocol (TCP/UDP)","type":"integer","hidden":false,"required":false,"index":false},{"name":"family","description":"Network protocol (IPv4, IPv6)","type":"integer","hidden":false,"required":false,"index":false},{"name":"address","description":"Specific address for bind","type":"text","hidden":false,"required":false,"index":false},{"name":"fd","description":"Socket file descriptor number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"socket","description":"Socket handle or inode number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Path for UNIX domain sockets","type":"text","hidden":false,"required":false,"index":false},{"name":"net_namespace","description":"The inode number of the network namespace","type":"text","hidden":true,"required":false,"index":false}]},{"name":"load_average","description":"Displays information about the system wide load averages.","platforms":["darwin","linux"],"columns":[{"name":"period","description":"Period over which the average is calculated.","type":"text","hidden":false,"required":false,"index":false},{"name":"average","description":"Load average over the specified period.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"location_services","description":"Reports the status of the Location Services feature of the OS.","platforms":["darwin"],"columns":[{"name":"enabled","description":"1 if Location Services are enabled, else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"logged_in_users","description":"Users with an active shell on the system.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"type","description":"Login type","type":"text","hidden":false,"required":false,"index":false},{"name":"user","description":"User login name","type":"text","hidden":false,"required":false,"index":false},{"name":"tty","description":"Device name","type":"text","hidden":false,"required":false,"index":false},{"name":"host","description":"Remote hostname","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time entry was made","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"sid","description":"The user's unique security identifier","type":"text","hidden":true,"required":false,"index":false},{"name":"registry_hive","description":"HKEY_USERS registry hive","type":"text","hidden":true,"required":false,"index":false}]},{"name":"logical_drives","description":"Details for logical drives on the system. A logical drive generally represents a single partition.","platforms":["windows"],"columns":[{"name":"device_id","description":"The drive id, usually the drive name, e.g., 'C:'.","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Deprecated (always 'Unknown').","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"The canonical description of the drive, e.g. 'Logical Fixed Disk', 'CD-ROM Disk'.","type":"text","hidden":false,"required":false,"index":false},{"name":"free_space","description":"The amount of free space, in bytes, of the drive (-1 on failure).","type":"bigint","hidden":false,"required":false,"index":false},{"name":"size","description":"The total amount of space, in bytes, of the drive (-1 on failure).","type":"bigint","hidden":false,"required":false,"index":false},{"name":"file_system","description":"The file system of the drive.","type":"text","hidden":false,"required":false,"index":false},{"name":"boot_partition","description":"True if Windows booted from this drive.","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"logon_sessions","description":"Windows Logon Session.","platforms":["windows"],"columns":[{"name":"logon_id","description":"A locally unique identifier (LUID) that identifies a logon session.","type":"integer","hidden":false,"required":false,"index":false},{"name":"user","description":"The account name of the security principal that owns the logon session.","type":"text","hidden":false,"required":false,"index":false},{"name":"logon_domain","description":"The name of the domain used to authenticate the owner of the logon session.","type":"text","hidden":false,"required":false,"index":false},{"name":"authentication_package","description":"The authentication package used to authenticate the owner of the logon session.","type":"text","hidden":false,"required":false,"index":false},{"name":"logon_type","description":"The logon method.","type":"text","hidden":false,"required":false,"index":false},{"name":"session_id","description":"The Terminal Services session identifier.","type":"integer","hidden":false,"required":false,"index":false},{"name":"logon_sid","description":"The user's security identifier (SID).","type":"text","hidden":false,"required":false,"index":false},{"name":"logon_time","description":"The time the session owner logged on.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"logon_server","description":"The name of the server used to authenticate the owner of the logon session.","type":"text","hidden":false,"required":false,"index":false},{"name":"dns_domain_name","description":"The DNS name for the owner of the logon session.","type":"text","hidden":false,"required":false,"index":false},{"name":"upn","description":"The user principal name (UPN) for the owner of the logon session.","type":"text","hidden":false,"required":false,"index":false},{"name":"logon_script","description":"The script used for logging on.","type":"text","hidden":false,"required":false,"index":false},{"name":"profile_path","description":"The home directory for the logon session.","type":"text","hidden":false,"required":false,"index":false},{"name":"home_directory","description":"The home directory for the logon session.","type":"text","hidden":false,"required":false,"index":false},{"name":"home_directory_drive","description":"The drive location of the home directory of the logon session.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"lxd_certificates","description":"LXD certificates information.","platforms":["linux"],"columns":[{"name":"name","description":"Name of the certificate","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of the certificate","type":"text","hidden":false,"required":false,"index":false},{"name":"fingerprint","description":"SHA256 hash of the certificate","type":"text","hidden":false,"required":false,"index":false},{"name":"certificate","description":"Certificate content","type":"text","hidden":false,"required":false,"index":false}]},{"name":"lxd_cluster","description":"LXD cluster information.","platforms":["linux"],"columns":[{"name":"server_name","description":"Name of the LXD server node","type":"text","hidden":false,"required":false,"index":false},{"name":"enabled","description":"Whether clustering enabled (1) or not (0) on this node","type":"integer","hidden":false,"required":false,"index":false},{"name":"member_config_entity","description":"Type of configuration parameter for this node","type":"text","hidden":false,"required":false,"index":false},{"name":"member_config_name","description":"Name of configuration parameter","type":"text","hidden":false,"required":false,"index":false},{"name":"member_config_key","description":"Config key","type":"text","hidden":false,"required":false,"index":false},{"name":"member_config_value","description":"Config value","type":"text","hidden":false,"required":false,"index":false},{"name":"member_config_description","description":"Config description","type":"text","hidden":false,"required":false,"index":false}]},{"name":"lxd_cluster_members","description":"LXD cluster members information.","platforms":["linux"],"columns":[{"name":"server_name","description":"Name of the LXD server node","type":"text","hidden":false,"required":false,"index":false},{"name":"url","description":"URL of the node","type":"text","hidden":false,"required":false,"index":false},{"name":"database","description":"Whether the server is a database node (1) or not (0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"status","description":"Status of the node (Online/Offline)","type":"text","hidden":false,"required":false,"index":false},{"name":"message","description":"Message from the node (Online/Offline)","type":"text","hidden":false,"required":false,"index":false}]},{"name":"lxd_images","description":"LXD images information.","platforms":["linux"],"columns":[{"name":"id","description":"Image ID","type":"text","hidden":false,"required":false,"index":false},{"name":"architecture","description":"Target architecture for the image","type":"text","hidden":false,"required":false,"index":false},{"name":"os","description":"OS on which image is based","type":"text","hidden":false,"required":false,"index":false},{"name":"release","description":"OS release version on which the image is based","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Image description","type":"text","hidden":false,"required":false,"index":false},{"name":"aliases","description":"Comma-separated list of image aliases","type":"text","hidden":false,"required":false,"index":false},{"name":"filename","description":"Filename of the image file","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of image in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"auto_update","description":"Whether the image auto-updates (1) or not (0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"cached","description":"Whether image is cached (1) or not (0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"public","description":"Whether image is public (1) or not (0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"created_at","description":"ISO time of image creation","type":"text","hidden":false,"required":false,"index":false},{"name":"expires_at","description":"ISO time of image expiration","type":"text","hidden":false,"required":false,"index":false},{"name":"uploaded_at","description":"ISO time of image upload","type":"text","hidden":false,"required":false,"index":false},{"name":"last_used_at","description":"ISO time for the most recent use of this image in terms of container spawn","type":"text","hidden":false,"required":false,"index":false},{"name":"update_source_server","description":"Server for image update","type":"text","hidden":false,"required":false,"index":false},{"name":"update_source_protocol","description":"Protocol used for image information update and image import from source server","type":"text","hidden":false,"required":false,"index":false},{"name":"update_source_certificate","description":"Certificate for update source server","type":"text","hidden":false,"required":false,"index":false},{"name":"update_source_alias","description":"Alias of image at update source server","type":"text","hidden":false,"required":false,"index":false}]},{"name":"lxd_instance_config","description":"LXD instance configuration information.","platforms":["linux"],"columns":[{"name":"name","description":"Instance name","type":"text","hidden":false,"required":true,"index":false},{"name":"key","description":"Configuration parameter name","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Configuration parameter value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"lxd_instance_devices","description":"LXD instance devices information.","platforms":["linux"],"columns":[{"name":"name","description":"Instance name","type":"text","hidden":false,"required":true,"index":false},{"name":"device","description":"Name of the device","type":"text","hidden":false,"required":false,"index":false},{"name":"device_type","description":"Device type","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Device info param name","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Device info param value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"lxd_instances","description":"LXD instances information.","platforms":["linux"],"columns":[{"name":"name","description":"Instance name","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"Instance state (running, stopped, etc.)","type":"text","hidden":false,"required":false,"index":false},{"name":"stateful","description":"Whether the instance is stateful(1) or not(0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"ephemeral","description":"Whether the instance is ephemeral(1) or not(0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"created_at","description":"ISO time of creation","type":"text","hidden":false,"required":false,"index":false},{"name":"base_image","description":"ID of image used to launch this instance","type":"text","hidden":false,"required":false,"index":false},{"name":"architecture","description":"Instance architecture","type":"text","hidden":false,"required":false,"index":false},{"name":"os","description":"The OS of this instance","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Instance description","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Instance's process ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"processes","description":"Number of processes running inside this instance","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"lxd_networks","description":"LXD network information.","platforms":["linux"],"columns":[{"name":"name","description":"Name of the network","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of network","type":"text","hidden":false,"required":false,"index":false},{"name":"managed","description":"1 if network created by LXD, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"ipv4_address","description":"IPv4 address","type":"text","hidden":false,"required":false,"index":false},{"name":"ipv6_address","description":"IPv6 address","type":"text","hidden":false,"required":false,"index":false},{"name":"used_by","description":"URLs for containers using this network","type":"text","hidden":false,"required":false,"index":false},{"name":"bytes_received","description":"Number of bytes received on this network","type":"bigint","hidden":false,"required":false,"index":false},{"name":"bytes_sent","description":"Number of bytes sent on this network","type":"bigint","hidden":false,"required":false,"index":false},{"name":"packets_received","description":"Number of packets received on this network","type":"bigint","hidden":false,"required":false,"index":false},{"name":"packets_sent","description":"Number of packets sent on this network","type":"bigint","hidden":false,"required":false,"index":false},{"name":"hwaddr","description":"Hardware address for this network","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"Network status","type":"text","hidden":false,"required":false,"index":false},{"name":"mtu","description":"MTU size","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"lxd_storage_pools","description":"LXD storage pool information.","platforms":["linux"],"columns":[{"name":"name","description":"Name of the storage pool","type":"text","hidden":false,"required":false,"index":false},{"name":"driver","description":"Storage driver","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Storage pool source","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of the storage pool","type":"text","hidden":false,"required":false,"index":false},{"name":"space_used","description":"Storage space used in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"space_total","description":"Total available storage space in bytes for this storage pool","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inodes_used","description":"Number of inodes used","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inodes_total","description":"Total number of inodes available in this storage pool","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"magic","description":"Magic number recognition library table.","platforms":["darwin","linux"],"columns":[{"name":"path","description":"Absolute path to target file","type":"text","hidden":false,"required":true,"index":false},{"name":"magic_db_files","description":"Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc","type":"text","hidden":false,"required":false,"index":false},{"name":"data","description":"Magic number data from libmagic","type":"text","hidden":false,"required":false,"index":false},{"name":"mime_type","description":"MIME type data from libmagic","type":"text","hidden":false,"required":false,"index":false},{"name":"mime_encoding","description":"MIME encoding data from libmagic","type":"text","hidden":false,"required":false,"index":false}]},{"name":"managed_policies","description":"The managed configuration policies from AD, MDM, MCX, etc.","platforms":["darwin"],"columns":[{"name":"domain","description":"System or manager-chosen domain key","type":"text","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Optional UUID assigned to policy set","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Policy key name","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Policy value","type":"text","hidden":false,"required":false,"index":false},{"name":"username","description":"Policy applies only this user","type":"text","hidden":false,"required":false,"index":false},{"name":"manual","description":"1 if policy was loaded manually, otherwise 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"md_devices","description":"Software RAID array settings.","platforms":["linux"],"columns":[{"name":"device_name","description":"md device name","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"Current state of the array","type":"text","hidden":false,"required":false,"index":false},{"name":"raid_level","description":"Current raid level of the array","type":"integer","hidden":false,"required":false,"index":false},{"name":"size","description":"size of the array in blocks","type":"bigint","hidden":false,"required":false,"index":false},{"name":"chunk_size","description":"chunk size in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"raid_disks","description":"Number of configured RAID disks in array","type":"integer","hidden":false,"required":false,"index":false},{"name":"nr_raid_disks","description":"Number of partitions or disk devices to comprise the array","type":"integer","hidden":false,"required":false,"index":false},{"name":"working_disks","description":"Number of working disks in array","type":"integer","hidden":false,"required":false,"index":false},{"name":"active_disks","description":"Number of active disks in array","type":"integer","hidden":false,"required":false,"index":false},{"name":"failed_disks","description":"Number of failed disks in array","type":"integer","hidden":false,"required":false,"index":false},{"name":"spare_disks","description":"Number of idle disks in array","type":"integer","hidden":false,"required":false,"index":false},{"name":"superblock_state","description":"State of the superblock","type":"text","hidden":false,"required":false,"index":false},{"name":"superblock_version","description":"Version of the superblock","type":"text","hidden":false,"required":false,"index":false},{"name":"superblock_update_time","description":"Unix timestamp of last update","type":"bigint","hidden":false,"required":false,"index":false},{"name":"bitmap_on_mem","description":"Pages allocated in in-memory bitmap, if enabled","type":"text","hidden":false,"required":false,"index":false},{"name":"bitmap_chunk_size","description":"Bitmap chunk size","type":"text","hidden":false,"required":false,"index":false},{"name":"bitmap_external_file","description":"External referenced bitmap file","type":"text","hidden":false,"required":false,"index":false},{"name":"recovery_progress","description":"Progress of the recovery activity","type":"text","hidden":false,"required":false,"index":false},{"name":"recovery_finish","description":"Estimated duration of recovery activity","type":"text","hidden":false,"required":false,"index":false},{"name":"recovery_speed","description":"Speed of recovery activity","type":"text","hidden":false,"required":false,"index":false},{"name":"resync_progress","description":"Progress of the resync activity","type":"text","hidden":false,"required":false,"index":false},{"name":"resync_finish","description":"Estimated duration of resync activity","type":"text","hidden":false,"required":false,"index":false},{"name":"resync_speed","description":"Speed of resync activity","type":"text","hidden":false,"required":false,"index":false},{"name":"reshape_progress","description":"Progress of the reshape activity","type":"text","hidden":false,"required":false,"index":false},{"name":"reshape_finish","description":"Estimated duration of reshape activity","type":"text","hidden":false,"required":false,"index":false},{"name":"reshape_speed","description":"Speed of reshape activity","type":"text","hidden":false,"required":false,"index":false},{"name":"check_array_progress","description":"Progress of the check array activity","type":"text","hidden":false,"required":false,"index":false},{"name":"check_array_finish","description":"Estimated duration of the check array activity","type":"text","hidden":false,"required":false,"index":false},{"name":"check_array_speed","description":"Speed of the check array activity","type":"text","hidden":false,"required":false,"index":false},{"name":"unused_devices","description":"Unused devices","type":"text","hidden":false,"required":false,"index":false},{"name":"other","description":"Other information associated with array from /proc/mdstat","type":"text","hidden":false,"required":false,"index":false}]},{"name":"md_drives","description":"Drive devices used for Software RAID.","platforms":["linux"],"columns":[{"name":"md_device_name","description":"md device name","type":"text","hidden":false,"required":false,"index":false},{"name":"drive_name","description":"Drive device name","type":"text","hidden":false,"required":false,"index":false},{"name":"slot","description":"Slot position of disk","type":"integer","hidden":false,"required":false,"index":false},{"name":"state","description":"State of the drive","type":"text","hidden":false,"required":false,"index":false}]},{"name":"md_personalities","description":"Software RAID setting supported by the kernel.","platforms":["linux"],"columns":[{"name":"name","description":"Name of personality supported by kernel","type":"text","hidden":false,"required":false,"index":false}]},{"name":"mdfind","description":"Run searches against the spotlight database.","platforms":["darwin"],"columns":[{"name":"path","description":"Path of the file returned from spotlight","type":"text","hidden":false,"required":false,"index":false},{"name":"query","description":"The query that was run to find the file","type":"text","hidden":false,"required":true,"index":false}]},{"name":"mdls","description":"Query file metadata in the Spotlight database.","platforms":["darwin"],"columns":[{"name":"path","description":"Path of the file","type":"text","hidden":false,"required":true,"index":false},{"name":"key","description":"Name of the metadata key","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Value stored in the metadata key","type":"text","hidden":false,"required":false,"index":false},{"name":"valuetype","description":"CoreFoundation type of data stored in value","type":"text","hidden":true,"required":false,"index":false}]},{"name":"memory_array_mapped_addresses","description":"Data associated for address mapping of physical memory arrays.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the structure","type":"text","hidden":false,"required":false,"index":false},{"name":"memory_array_handle","description":"Handle of the memory array associated with this structure","type":"text","hidden":false,"required":false,"index":false},{"name":"starting_address","description":"Physical stating address, in kilobytes, of a range of memory mapped to physical memory array","type":"text","hidden":false,"required":false,"index":false},{"name":"ending_address","description":"Physical ending address of last kilobyte of a range of memory mapped to physical memory array","type":"text","hidden":false,"required":false,"index":false},{"name":"partition_width","description":"Number of memory devices that form a single row of memory for the address partition of this structure","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"memory_arrays","description":"Data associated with collection of memory devices that operate to form a memory address.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the array","type":"text","hidden":false,"required":false,"index":false},{"name":"location","description":"Physical location of the memory array","type":"text","hidden":false,"required":false,"index":false},{"name":"use","description":"Function for which the array is used","type":"text","hidden":false,"required":false,"index":false},{"name":"memory_error_correction","description":"Primary hardware error correction or detection method supported","type":"text","hidden":false,"required":false,"index":false},{"name":"max_capacity","description":"Maximum capacity of array in gigabytes","type":"integer","hidden":false,"required":false,"index":false},{"name":"memory_error_info_handle","description":"Handle, or instance number, associated with any error that was detected for the array","type":"text","hidden":false,"required":false,"index":false},{"name":"number_memory_devices","description":"Number of memory devices on array","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"memory_device_mapped_addresses","description":"Data associated for address mapping of physical memory devices.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the structure","type":"text","hidden":false,"required":false,"index":false},{"name":"memory_device_handle","description":"Handle of the memory device structure associated with this structure","type":"text","hidden":false,"required":false,"index":false},{"name":"memory_array_mapped_address_handle","description":"Handle of the memory array mapped address to which this device range is mapped to","type":"text","hidden":false,"required":false,"index":false},{"name":"starting_address","description":"Physical stating address, in kilobytes, of a range of memory mapped to physical memory array","type":"text","hidden":false,"required":false,"index":false},{"name":"ending_address","description":"Physical ending address of last kilobyte of a range of memory mapped to physical memory array","type":"text","hidden":false,"required":false,"index":false},{"name":"partition_row_position","description":"Identifies the position of the referenced memory device in a row of the address partition","type":"integer","hidden":false,"required":false,"index":false},{"name":"interleave_position","description":"The position of the device in a interleave, i.e. 0 indicates non-interleave, 1 indicates 1st interleave, 2 indicates 2nd interleave, etc.","type":"integer","hidden":false,"required":false,"index":false},{"name":"interleave_data_depth","description":"The max number of consecutive rows from memory device that are accessed in a single interleave transfer; 0 indicates device is non-interleave","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"memory_devices","description":"Physical memory device (type 17) information retrieved from SMBIOS.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the structure in SMBIOS","type":"text","hidden":false,"required":false,"index":false},{"name":"array_handle","description":"The memory array that the device is attached to","type":"text","hidden":false,"required":false,"index":false},{"name":"form_factor","description":"Implementation form factor for this memory device","type":"text","hidden":false,"required":false,"index":false},{"name":"total_width","description":"Total width, in bits, of this memory device, including any check or error-correction bits","type":"integer","hidden":false,"required":false,"index":false},{"name":"data_width","description":"Data width, in bits, of this memory device","type":"integer","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of memory device in Megabyte","type":"integer","hidden":false,"required":false,"index":false},{"name":"set","description":"Identifies if memory device is one of a set of devices.  A value of 0 indicates no set affiliation.","type":"integer","hidden":false,"required":false,"index":false},{"name":"device_locator","description":"String number of the string that identifies the physically-labeled socket or board position where the memory device is located","type":"text","hidden":false,"required":false,"index":false},{"name":"bank_locator","description":"String number of the string that identifies the physically-labeled bank where the memory device is located","type":"text","hidden":false,"required":false,"index":false},{"name":"memory_type","description":"Type of memory used","type":"text","hidden":false,"required":false,"index":false},{"name":"memory_type_details","description":"Additional details for memory device","type":"text","hidden":false,"required":false,"index":false},{"name":"max_speed","description":"Max speed of memory device in megatransfers per second (MT/s)","type":"integer","hidden":false,"required":false,"index":false},{"name":"configured_clock_speed","description":"Configured speed of memory device in megatransfers per second (MT/s)","type":"integer","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"Manufacturer ID string","type":"text","hidden":false,"required":false,"index":false},{"name":"serial_number","description":"Serial number of memory device","type":"text","hidden":false,"required":false,"index":false},{"name":"asset_tag","description":"Manufacturer specific asset tag of memory device","type":"text","hidden":false,"required":false,"index":false},{"name":"part_number","description":"Manufacturer specific serial number of memory device","type":"text","hidden":false,"required":false,"index":false},{"name":"min_voltage","description":"Minimum operating voltage of device in millivolts","type":"integer","hidden":false,"required":false,"index":false},{"name":"max_voltage","description":"Maximum operating voltage of device in millivolts","type":"integer","hidden":false,"required":false,"index":false},{"name":"configured_voltage","description":"Configured operating voltage of device in millivolts","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"memory_error_info","description":"Data associated with errors of a physical memory array.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the structure","type":"text","hidden":false,"required":false,"index":false},{"name":"error_type","description":"type of error associated with current error status for array or device","type":"text","hidden":false,"required":false,"index":false},{"name":"error_granularity","description":"Granularity to which the error can be resolved","type":"text","hidden":false,"required":false,"index":false},{"name":"error_operation","description":"Memory access operation that caused the error","type":"text","hidden":false,"required":false,"index":false},{"name":"vendor_syndrome","description":"Vendor specific ECC syndrome or CRC data associated with the erroneous access","type":"text","hidden":false,"required":false,"index":false},{"name":"memory_array_error_address","description":"32 bit physical address of the error based on the addressing of the bus to which the memory array is connected","type":"text","hidden":false,"required":false,"index":false},{"name":"device_error_address","description":"32 bit physical address of the error relative to the start of the failing memory address, in bytes","type":"text","hidden":false,"required":false,"index":false},{"name":"error_resolution","description":"Range, in bytes, within which this error can be determined, when an error address is given","type":"text","hidden":false,"required":false,"index":false}]},{"name":"memory_info","description":"Main memory information in bytes.","platforms":["linux"],"columns":[{"name":"memory_total","description":"Total amount of physical RAM, in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"memory_free","description":"The amount of physical RAM, in bytes, left unused by the system","type":"bigint","hidden":false,"required":false,"index":false},{"name":"memory_available","description":"The amount of physical RAM, in bytes, available for starting new applications, without swapping","type":"bigint","hidden":false,"required":false,"index":false},{"name":"buffers","description":"The amount of physical RAM, in bytes, used for file buffers","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cached","description":"The amount of physical RAM, in bytes, used as cache memory","type":"bigint","hidden":false,"required":false,"index":false},{"name":"swap_cached","description":"The amount of swap, in bytes, used as cache memory","type":"bigint","hidden":false,"required":false,"index":false},{"name":"active","description":"The total amount of buffer or page cache memory, in bytes, that is in active use","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inactive","description":"The total amount of buffer or page cache memory, in bytes, that are free and available","type":"bigint","hidden":false,"required":false,"index":false},{"name":"swap_total","description":"The total amount of swap available, in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"swap_free","description":"The total amount of swap free, in bytes","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"memory_map","description":"OS memory region map.","platforms":["linux"],"columns":[{"name":"name","description":"Region name","type":"text","hidden":false,"required":false,"index":false},{"name":"start","description":"Start address of memory region","type":"text","hidden":false,"required":false,"index":false},{"name":"end","description":"End address of memory region","type":"text","hidden":false,"required":false,"index":false}]},{"name":"mounts","description":"System mounted devices and filesystems (not process specific).","platforms":["darwin","linux"],"columns":[{"name":"device","description":"Mounted device","type":"text","hidden":false,"required":false,"index":false},{"name":"device_alias","description":"Mounted device alias","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Mounted device path","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Mounted device type","type":"text","hidden":false,"required":false,"index":false},{"name":"blocks_size","description":"Block size in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"blocks","description":"Mounted device used blocks","type":"bigint","hidden":false,"required":false,"index":false},{"name":"blocks_free","description":"Mounted device free blocks","type":"bigint","hidden":false,"required":false,"index":false},{"name":"blocks_available","description":"Mounted device available blocks","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inodes","description":"Mounted device used inodes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inodes_free","description":"Mounted device free inodes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"flags","description":"Mounted device flags","type":"text","hidden":false,"required":false,"index":false}]},{"name":"msr","description":"Various pieces of data stored in the model specific register per processor. NOTE: the msr kernel module must be enabled, and osquery must be run as root.","platforms":["linux"],"columns":[{"name":"processor_number","description":"The processor number as reported in /proc/cpuinfo","type":"bigint","hidden":false,"required":false,"index":false},{"name":"turbo_disabled","description":"Whether the turbo feature is disabled.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"turbo_ratio_limit","description":"The turbo feature ratio limit.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"platform_info","description":"Platform information.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"perf_ctl","description":"Performance setting for the processor.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"perf_status","description":"Performance status for the processor.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"feature_control","description":"Bitfield controlling enabled features.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"rapl_power_limit","description":"Run Time Average Power Limiting power limit.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"rapl_energy_status","description":"Run Time Average Power Limiting energy status.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"rapl_power_units","description":"Run Time Average Power Limiting power units.","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"nfs_shares","description":"NFS shares exported by the host.","platforms":["darwin"],"columns":[{"name":"share","description":"Filesystem path to the share","type":"text","hidden":false,"required":false,"index":false},{"name":"options","description":"Options string set on the export share","type":"text","hidden":false,"required":false,"index":false},{"name":"readonly","description":"1 if the share is exported readonly else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"npm_packages","description":"Node packages installed in a system.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"name","description":"Package display name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Package-supplied version","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Package-supplied description","type":"text","hidden":false,"required":false,"index":false},{"name":"author","description":"Package-supplied author","type":"text","hidden":false,"required":false,"index":false},{"name":"license","description":"License under which package is launched","type":"text","hidden":false,"required":false,"index":false},{"name":"homepage","description":"Package supplied homepage","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path at which this module resides","type":"text","hidden":false,"required":false,"index":false},{"name":"directory","description":"Directory where node_modules are located","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","hidden":true,"required":false,"index":false}]},{"name":"ntdomains","description":"Display basic NT domain information of a Windows machine.","platforms":["windows"],"columns":[{"name":"name","description":"The label by which the object is known.","type":"text","hidden":false,"required":false,"index":false},{"name":"client_site_name","description":"The name of the site where the domain controller is configured.","type":"text","hidden":false,"required":false,"index":false},{"name":"dc_site_name","description":"The name of the site where the domain controller is located.","type":"text","hidden":false,"required":false,"index":false},{"name":"dns_forest_name","description":"The name of the root of the DNS tree.","type":"text","hidden":false,"required":false,"index":false},{"name":"domain_controller_address","description":"The IP Address of the discovered domain controller..","type":"text","hidden":false,"required":false,"index":false},{"name":"domain_controller_name","description":"The name of the discovered domain controller.","type":"text","hidden":false,"required":false,"index":false},{"name":"domain_name","description":"The name of the domain.","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"The current status of the domain object.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"ntfs_acl_permissions","description":"Retrieve NTFS ACL permission information for files and directories.","platforms":["windows"],"columns":[{"name":"path","description":"Path to the file or directory.","type":"text","hidden":false,"required":true,"index":false},{"name":"type","description":"Type of access mode for the access control entry.","type":"text","hidden":false,"required":false,"index":false},{"name":"principal","description":"User or group to which the ACE applies.","type":"text","hidden":false,"required":false,"index":false},{"name":"access","description":"Specific permissions that indicate the rights described by the ACE.","type":"text","hidden":false,"required":false,"index":false},{"name":"inherited_from","description":"The inheritance policy of the ACE.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"ntfs_journal_events","description":"Track time/action changes to files specified in configuration data.","platforms":["windows"],"columns":[{"name":"action","description":"Change action (Write, Delete, etc)","type":"text","hidden":false,"required":false,"index":false},{"name":"category","description":"The category that the event originated from","type":"text","hidden":false,"required":false,"index":false},{"name":"old_path","description":"Old path (renames only)","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path","type":"text","hidden":false,"required":false,"index":false},{"name":"record_timestamp","description":"Journal record timestamp","type":"text","hidden":false,"required":false,"index":false},{"name":"record_usn","description":"The update sequence number that identifies the journal record","type":"text","hidden":false,"required":false,"index":false},{"name":"node_ref_number","description":"The ordinal that associates a journal record with a filename","type":"text","hidden":false,"required":false,"index":false},{"name":"parent_ref_number","description":"The ordinal that associates a journal record with a filename's parent directory","type":"text","hidden":false,"required":false,"index":false},{"name":"drive_letter","description":"The drive letter identifying the source journal","type":"text","hidden":false,"required":false,"index":false},{"name":"file_attributes","description":"File attributes","type":"text","hidden":false,"required":false,"index":false},{"name":"partial","description":"Set to 1 if either path or old_path only contains the file or folder name","type":"bigint","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of file event","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"nvram","description":"Apple NVRAM variable listing.","platforms":["darwin"],"columns":[{"name":"name","description":"Variable name","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Data type (CFData, CFString, etc)","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Raw variable data","type":"text","hidden":false,"required":false,"index":false}]},{"name":"oem_strings","description":"OEM defined strings retrieved from SMBIOS.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the Type 11 structure","type":"text","hidden":false,"required":false,"index":false},{"name":"number","description":"The string index of the structure","type":"integer","hidden":false,"required":false,"index":false},{"name":"value","description":"The value of the OEM string","type":"text","hidden":false,"required":false,"index":false}]},{"name":"office_mru","description":"View recently opened Office documents.","platforms":["windows"],"columns":[{"name":"application","description":"Associated Office application","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Office application version number","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"File path","type":"text","hidden":false,"required":false,"index":false},{"name":"last_opened_time","description":"Most recent opened time file was opened","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sid","description":"User SID","type":"text","hidden":false,"required":false,"index":false}]},{"name":"os_version","description":"A single row containing the operating system name and version.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"name","description":"Distribution or product name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Pretty, suitable for presentation, OS version","type":"text","hidden":false,"required":false,"index":false},{"name":"major","description":"Major release version","type":"integer","hidden":false,"required":false,"index":false},{"name":"minor","description":"Minor release version","type":"integer","hidden":false,"required":false,"index":false},{"name":"patch","description":"Optional patch release","type":"integer","hidden":false,"required":false,"index":false},{"name":"build","description":"Optional build-specific or variant string","type":"text","hidden":false,"required":false,"index":false},{"name":"platform","description":"OS Platform or ID","type":"text","hidden":false,"required":false,"index":false},{"name":"platform_like","description":"Closely related platforms","type":"text","hidden":false,"required":false,"index":false},{"name":"codename","description":"OS version codename","type":"text","hidden":false,"required":false,"index":false},{"name":"arch","description":"OS Architecture","type":"text","hidden":false,"required":false,"index":false},{"name":"install_date","description":"The install date of the OS.","type":"bigint","hidden":true,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","hidden":true,"required":false,"index":false}]},{"name":"osquery_events","description":"Information about the event publishers and subscribers.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"name","description":"Event publisher or subscriber name","type":"text","hidden":false,"required":false,"index":false},{"name":"publisher","description":"Name of the associated publisher","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Either publisher or subscriber","type":"text","hidden":false,"required":false,"index":false},{"name":"subscriptions","description":"Number of subscriptions the publisher received or subscriber used","type":"integer","hidden":false,"required":false,"index":false},{"name":"events","description":"Number of events emitted or received since osquery started","type":"integer","hidden":false,"required":false,"index":false},{"name":"refreshes","description":"Publisher only: number of runloop restarts","type":"integer","hidden":false,"required":false,"index":false},{"name":"active","description":"1 if the publisher or subscriber is active else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"osquery_extensions","description":"List of active osquery extensions.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"uuid","description":"The transient ID assigned for communication","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"Extension's name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension's version","type":"text","hidden":false,"required":false,"index":false},{"name":"sdk_version","description":"osquery SDK version used to build the extension","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of the extension's Thrift connection or library path","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"SDK extension type: core, extension, or module","type":"text","hidden":false,"required":false,"index":false}]},{"name":"osquery_flags","description":"Configurable flags that modify osquery's behavior.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"name","description":"Flag name","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Flag type","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Flag description","type":"text","hidden":false,"required":false,"index":false},{"name":"default_value","description":"Flag default value","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Flag value","type":"text","hidden":false,"required":false,"index":false},{"name":"shell_only","description":"Is the flag shell only?","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"osquery_info","description":"Top level information about the running version of osquery.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"pid","description":"Process (or thread/handle) ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Unique ID provided by the system","type":"text","hidden":false,"required":false,"index":false},{"name":"instance_id","description":"Unique, long-lived ID per instance of osquery","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"osquery toolkit version","type":"text","hidden":false,"required":false,"index":false},{"name":"config_hash","description":"Hash of the working configuration state","type":"text","hidden":false,"required":false,"index":false},{"name":"config_valid","description":"1 if the config was loaded and considered valid, else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"extensions","description":"osquery extensions status","type":"text","hidden":false,"required":false,"index":false},{"name":"build_platform","description":"osquery toolkit build platform","type":"text","hidden":false,"required":false,"index":false},{"name":"build_distro","description":"osquery toolkit platform distribution name (os version)","type":"text","hidden":false,"required":false,"index":false},{"name":"start_time","description":"UNIX time in seconds when the process started","type":"integer","hidden":false,"required":false,"index":false},{"name":"watcher","description":"Process (or thread/handle) ID of optional watcher process","type":"integer","hidden":false,"required":false,"index":false},{"name":"platform_mask","description":"The osquery platform bitmask","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"osquery_packs","description":"Information about the current query packs that are loaded in osquery.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"name","description":"The given name for this query pack","type":"text","hidden":false,"required":false,"index":false},{"name":"platform","description":"Platforms this query is supported on","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Minimum osquery version that this query will run on","type":"text","hidden":false,"required":false,"index":false},{"name":"shard","description":"Shard restriction limit, 1-100, 0 meaning no restriction","type":"integer","hidden":false,"required":false,"index":false},{"name":"discovery_cache_hits","description":"The number of times that the discovery query used cached values since the last time the config was reloaded","type":"integer","hidden":false,"required":false,"index":false},{"name":"discovery_executions","description":"The number of times that the discovery queries have been executed since the last time the config was reloaded","type":"integer","hidden":false,"required":false,"index":false},{"name":"active","description":"Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"osquery_registry","description":"List the osquery registry plugins.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"registry","description":"Name of the osquery registry","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the plugin item","type":"text","hidden":false,"required":false,"index":false},{"name":"owner_uuid","description":"Extension route UUID (0 for core)","type":"integer","hidden":false,"required":false,"index":false},{"name":"internal","description":"1 If the plugin is internal else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"active","description":"1 If this plugin is active else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"osquery_schedule","description":"Information about the current queries that are scheduled in osquery.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"name","description":"The given name for this query","type":"text","hidden":false,"required":false,"index":false},{"name":"query","description":"The exact query to run","type":"text","hidden":false,"required":false,"index":false},{"name":"interval","description":"The interval in seconds to run this query, not an exact interval","type":"integer","hidden":false,"required":false,"index":false},{"name":"executions","description":"Number of times the query was executed","type":"bigint","hidden":false,"required":false,"index":false},{"name":"last_executed","description":"UNIX time stamp in seconds of the last completed execution","type":"bigint","hidden":false,"required":false,"index":false},{"name":"denylisted","description":"1 if the query is denylisted else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"output_size","description":"Cumulative total number of bytes generated by the resultant rows of the query","type":"bigint","hidden":false,"required":false,"index":false},{"name":"wall_time","description":"Total wall time in seconds spent executing (deprecated), hidden=True","type":"bigint","hidden":false,"required":false,"index":false},{"name":"wall_time_ms","description":"Total wall time in milliseconds spent executing","type":"bigint","hidden":false,"required":false,"index":false},{"name":"last_wall_time_ms","description":"Wall time in milliseconds of the latest execution","type":"bigint","hidden":false,"required":false,"index":false},{"name":"user_time","description":"Total user time in milliseconds spent executing","type":"bigint","hidden":false,"required":false,"index":false},{"name":"last_user_time","description":"User time in milliseconds of the latest execution","type":"bigint","hidden":false,"required":false,"index":false},{"name":"system_time","description":"Total system time in milliseconds spent executing","type":"bigint","hidden":false,"required":false,"index":false},{"name":"last_system_time","description":"System time in milliseconds of the latest execution","type":"bigint","hidden":false,"required":false,"index":false},{"name":"average_memory","description":"Average of the bytes of resident memory left allocated after collecting results","type":"bigint","hidden":false,"required":false,"index":false},{"name":"last_memory","description":"Resident memory in bytes left allocated after collecting results of the latest execution","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"package_bom","description":"macOS package bill of materials (BOM) file list.","platforms":["darwin"],"columns":[{"name":"filepath","description":"Package file or directory","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"Expected user of file or directory","type":"integer","hidden":false,"required":false,"index":false},{"name":"gid","description":"Expected group of file or directory","type":"integer","hidden":false,"required":false,"index":false},{"name":"mode","description":"Expected permissions","type":"integer","hidden":false,"required":false,"index":false},{"name":"size","description":"Expected file size","type":"bigint","hidden":false,"required":false,"index":false},{"name":"modified_time","description":"Timestamp the file was installed","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of package bom","type":"text","hidden":false,"required":true,"index":false}]},{"name":"package_install_history","description":"macOS package install history.","platforms":["darwin"],"columns":[{"name":"package_id","description":"Label packageIdentifiers","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Label date as UNIX timestamp","type":"integer","hidden":false,"required":false,"index":false},{"name":"name","description":"Package display name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Package display version","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Install source: usually the installer process name","type":"text","hidden":false,"required":false,"index":false},{"name":"content_type","description":"Package content_type (optional)","type":"text","hidden":false,"required":false,"index":false}]},{"name":"package_receipts","description":"macOS package receipt details.","platforms":["darwin"],"columns":[{"name":"package_id","description":"Package domain identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"package_filename","description":"Filename of original .pkg file","type":"text","hidden":true,"required":false,"index":false},{"name":"version","description":"Installed package version","type":"text","hidden":false,"required":false,"index":false},{"name":"location","description":"Optional relative install path on volume","type":"text","hidden":false,"required":false,"index":false},{"name":"install_time","description":"Timestamp of install time","type":"double","hidden":false,"required":false,"index":false},{"name":"installer_name","description":"Name of installer process","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of receipt plist","type":"text","hidden":false,"required":false,"index":false}]},{"name":"password_policy","description":"Password Policies for macOS.","platforms":["darwin"],"columns":[{"name":"uid","description":"User ID for the policy, -1 for policies that are global","type":"bigint","hidden":false,"required":false,"index":false},{"name":"policy_identifier","description":"Policy Identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"policy_content","description":"Policy content","type":"text","hidden":false,"required":false,"index":false},{"name":"policy_description","description":"Policy description","type":"text","hidden":false,"required":false,"index":false}]},{"name":"patches","description":"Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update (e.g. Service Packs).","platforms":["windows"],"columns":[{"name":"csname","description":"The name of the host the patch is installed on.","type":"text","hidden":false,"required":false,"index":false},{"name":"hotfix_id","description":"The KB ID of the patch.","type":"text","hidden":false,"required":false,"index":false},{"name":"caption","description":"Short description of the patch.","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Fuller description of the patch.","type":"text","hidden":false,"required":false,"index":false},{"name":"fix_comments","description":"Additional comments about the patch.","type":"text","hidden":false,"required":false,"index":false},{"name":"installed_by","description":"The system context in which the patch as installed.","type":"text","hidden":false,"required":false,"index":false},{"name":"install_date","description":"Indicates when the patch was installed. Lack of a value does not indicate that the patch was not installed.","type":"text","hidden":false,"required":false,"index":false},{"name":"installed_on","description":"The date when the patch was installed.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"pci_devices","description":"PCI devices active on the host system.","platforms":["darwin","linux"],"columns":[{"name":"pci_slot","description":"PCI Device used slot","type":"text","hidden":false,"required":false,"index":false},{"name":"pci_class","description":"PCI Device class","type":"text","hidden":false,"required":false,"index":false},{"name":"driver","description":"PCI Device used driver","type":"text","hidden":false,"required":false,"index":false},{"name":"vendor","description":"PCI Device vendor","type":"text","hidden":false,"required":false,"index":false},{"name":"vendor_id","description":"Hex encoded PCI Device vendor identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"model","description":"PCI Device model","type":"text","hidden":false,"required":false,"index":false},{"name":"model_id","description":"Hex encoded PCI Device model identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"pci_class_id","description":"PCI Device class ID in hex format","type":"text","hidden":true,"required":false,"index":false},{"name":"pci_subclass_id","description":"PCI Device  subclass in hex format","type":"text","hidden":true,"required":false,"index":false},{"name":"pci_subclass","description":"PCI Device subclass","type":"text","hidden":true,"required":false,"index":false},{"name":"subsystem_vendor_id","description":"Vendor ID of PCI device subsystem","type":"text","hidden":true,"required":false,"index":false},{"name":"subsystem_vendor","description":"Vendor of PCI device subsystem","type":"text","hidden":true,"required":false,"index":false},{"name":"subsystem_model_id","description":"Model ID of PCI device subsystem","type":"text","hidden":true,"required":false,"index":false},{"name":"subsystem_model","description":"Device description of PCI device subsystem","type":"text","hidden":true,"required":false,"index":false}]},{"name":"physical_disk_performance","description":"Provides provides raw data from performance counters that monitor hard or fixed disk drives on the system.","platforms":["windows"],"columns":[{"name":"name","description":"Name of the physical disk","type":"text","hidden":false,"required":false,"index":false},{"name":"avg_disk_bytes_per_read","description":"Average number of bytes transferred from the disk during read operations","type":"bigint","hidden":false,"required":false,"index":false},{"name":"avg_disk_bytes_per_write","description":"Average number of bytes transferred to the disk during write operations","type":"bigint","hidden":false,"required":false,"index":false},{"name":"avg_disk_read_queue_length","description":"Average number of read requests that were queued for the selected disk during the sample interval","type":"bigint","hidden":false,"required":false,"index":false},{"name":"avg_disk_write_queue_length","description":"Average number of write requests that were queued for the selected disk during the sample interval","type":"bigint","hidden":false,"required":false,"index":false},{"name":"avg_disk_sec_per_read","description":"Average time, in seconds, of a read operation of data from the disk","type":"integer","hidden":false,"required":false,"index":false},{"name":"avg_disk_sec_per_write","description":"Average time, in seconds, of a write operation of data to the disk","type":"integer","hidden":false,"required":false,"index":false},{"name":"current_disk_queue_length","description":"Number of requests outstanding on the disk at the time the performance data is collected","type":"integer","hidden":false,"required":false,"index":false},{"name":"percent_disk_read_time","description":"Percentage of elapsed time that the selected disk drive is busy servicing read requests","type":"bigint","hidden":false,"required":false,"index":false},{"name":"percent_disk_write_time","description":"Percentage of elapsed time that the selected disk drive is busy servicing write requests","type":"bigint","hidden":false,"required":false,"index":false},{"name":"percent_disk_time","description":"Percentage of elapsed time that the selected disk drive is busy servicing read or write requests","type":"bigint","hidden":false,"required":false,"index":false},{"name":"percent_idle_time","description":"Percentage of time during the sample interval that the disk was idle","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"pipes","description":"Named and Anonymous pipes.","platforms":["windows"],"columns":[{"name":"pid","description":"Process ID of the process to which the pipe belongs","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the pipe","type":"text","hidden":false,"required":false,"index":false},{"name":"instances","description":"Number of instances of the named pipe","type":"integer","hidden":false,"required":false,"index":false},{"name":"max_instances","description":"The maximum number of instances creatable for this pipe","type":"integer","hidden":false,"required":false,"index":false},{"name":"flags","description":"The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes","type":"text","hidden":false,"required":false,"index":false}]},{"name":"pkg_packages","description":"pkgng packages that are currently installed on the host system.","platforms":["freebsd"],"columns":[{"name":"name","description":"Package name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Package version","type":"text","hidden":false,"required":false,"index":false},{"name":"flatsize","description":"Package size in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"arch","description":"Architecture(s) supported","type":"text","hidden":false,"required":false,"index":false}]},{"name":"platform_info","description":"Information about EFI/UEFI/ROM and platform/boot.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"vendor","description":"Platform code vendor","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Platform code version","type":"text","hidden":false,"required":false,"index":false},{"name":"date","description":"Self-reported platform code update date","type":"text","hidden":false,"required":false,"index":false},{"name":"revision","description":"BIOS major and minor revision","type":"text","hidden":false,"required":false,"index":false},{"name":"extra","description":"Platform-specific additional information","type":"text","hidden":false,"required":false,"index":false},{"name":"firmware_type","description":"The type of firmware (Uefi, Bios, Unknown).","type":"text","hidden":true,"required":false,"index":false},{"name":"address","description":"Relative address of firmware mapping","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size in bytes of firmware","type":"text","hidden":false,"required":false,"index":false},{"name":"volume_size","description":"(Optional) size of firmware volume","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"plist","description":"Read and parse a plist file.","platforms":["darwin"],"columns":[{"name":"key","description":"Preference top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"subkey","description":"Intermediate key path, includes lists/dicts","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"String value of most CF types","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"(required) read preferences from a plist","type":"text","hidden":false,"required":true,"index":false}]},{"name":"portage_keywords","description":"A summary about portage configurations like keywords, mask and unmask.","platforms":["linux"],"columns":[{"name":"package","description":"Package name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"The version which are affected by the use flags, empty means all","type":"text","hidden":false,"required":false,"index":false},{"name":"keyword","description":"The keyword applied to the package","type":"text","hidden":false,"required":false,"index":false},{"name":"mask","description":"If the package is masked","type":"integer","hidden":false,"required":false,"index":false},{"name":"unmask","description":"If the package is unmasked","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"portage_packages","description":"List of currently installed packages.","platforms":["linux"],"columns":[{"name":"package","description":"Package name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"The version which are affected by the use flags, empty means all","type":"text","hidden":false,"required":false,"index":false},{"name":"slot","description":"The slot used by package","type":"text","hidden":false,"required":false,"index":false},{"name":"build_time","description":"Unix time when package was built","type":"bigint","hidden":false,"required":false,"index":false},{"name":"repository","description":"From which repository the ebuild was used","type":"text","hidden":false,"required":false,"index":false},{"name":"eapi","description":"The eapi for the ebuild","type":"bigint","hidden":false,"required":false,"index":false},{"name":"size","description":"The size of the package","type":"bigint","hidden":false,"required":false,"index":false},{"name":"world","description":"If package is in the world file","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"portage_use","description":"List of enabled portage USE values for specific package.","platforms":["linux"],"columns":[{"name":"package","description":"Package name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"The version of the installed package","type":"text","hidden":false,"required":false,"index":false},{"name":"use","description":"USE flag which has been enabled for package","type":"text","hidden":false,"required":false,"index":false}]},{"name":"power_sensors","description":"Machine power (currents, voltages, wattages, etc) sensors.","platforms":["darwin"],"columns":[{"name":"key","description":"The SMC key on macOS","type":"text","hidden":false,"required":false,"index":false},{"name":"category","description":"The sensor category: currents, voltage, wattage","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of power source","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Power in Watts","type":"text","hidden":false,"required":false,"index":false}]},{"name":"powershell_events","description":"Powershell script blocks reconstructed to their full script content, this table requires script block logging to be enabled.","platforms":["windows"],"columns":[{"name":"time","description":"Timestamp the event was received by the osquery event publisher","type":"bigint","hidden":false,"required":false,"index":false},{"name":"datetime","description":"System time at which the Powershell script event occurred","type":"text","hidden":false,"required":false,"index":false},{"name":"script_block_id","description":"The unique GUID of the powershell script to which this block belongs","type":"text","hidden":false,"required":false,"index":false},{"name":"script_block_count","description":"The total number of script blocks for this script","type":"integer","hidden":false,"required":false,"index":false},{"name":"script_text","description":"The text content of the Powershell script","type":"text","hidden":false,"required":false,"index":false},{"name":"script_name","description":"The name of the Powershell script","type":"text","hidden":false,"required":false,"index":false},{"name":"script_path","description":"The path for the Powershell script","type":"text","hidden":false,"required":false,"index":false},{"name":"cosine_similarity","description":"How similar the Powershell script is to a provided 'normal' character frequency","type":"double","hidden":false,"required":false,"index":false}]},{"name":"preferences","description":"macOS defaults and managed preferences.","platforms":["darwin"],"columns":[{"name":"domain","description":"Application ID usually in com.name.product format","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Preference top-level key","type":"text","hidden":false,"required":false,"index":false},{"name":"subkey","description":"Intemediate key path, includes lists/dicts","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"String value of most CF types","type":"text","hidden":false,"required":false,"index":false},{"name":"forced","description":"1 if the value is forced/managed, else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"username","description":"(optional) read preferences for a specific user","type":"text","hidden":false,"required":false,"index":false},{"name":"host","description":"'current' or 'any' host, where 'current' takes precedence","type":"text","hidden":false,"required":false,"index":false}]},{"name":"prefetch","description":"Prefetch files show metadata related to file execution.","platforms":["windows"],"columns":[{"name":"path","description":"Prefetch file path.","type":"text","hidden":false,"required":false,"index":false},{"name":"filename","description":"Executable filename.","type":"text","hidden":false,"required":false,"index":false},{"name":"hash","description":"Prefetch CRC hash.","type":"text","hidden":false,"required":false,"index":false},{"name":"last_run_time","description":"Most recent time application was run.","type":"integer","hidden":false,"required":false,"index":false},{"name":"other_run_times","description":"Other execution times in prefetch file.","type":"text","hidden":false,"required":false,"index":false},{"name":"run_count","description":"Number of times the application has been run.","type":"integer","hidden":false,"required":false,"index":false},{"name":"size","description":"Application file size.","type":"integer","hidden":false,"required":false,"index":false},{"name":"volume_serial","description":"Volume serial number.","type":"text","hidden":false,"required":false,"index":false},{"name":"volume_creation","description":"Volume creation time.","type":"text","hidden":false,"required":false,"index":false},{"name":"accessed_files_count","description":"Number of files accessed.","type":"integer","hidden":false,"required":false,"index":false},{"name":"accessed_directories_count","description":"Number of directories accessed.","type":"integer","hidden":false,"required":false,"index":false},{"name":"accessed_files","description":"Files accessed by application within ten seconds of launch.","type":"text","hidden":false,"required":false,"index":false},{"name":"accessed_directories","description":"Directories accessed by application within ten seconds of launch.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"process_envs","description":"A key/value table of environment variables for each process.","platforms":["darwin","linux"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"key","description":"Environment variable name","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Environment variable value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"process_events","description":"Track time/action process executions.","platforms":["darwin","linux"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","hidden":false,"required":false,"index":false},{"name":"mode","description":"File mode permissions","type":"text","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Command line arguments (argv)","type":"text","hidden":false,"required":false,"index":false},{"name":"cmdline_size","description":"Actual size (bytes) of command line arguments","type":"bigint","hidden":true,"required":false,"index":false},{"name":"env","description":"Environment variables delimited by spaces","type":"text","hidden":true,"required":false,"index":false},{"name":"env_count","description":"Number of environment variables","type":"bigint","hidden":true,"required":false,"index":false},{"name":"env_size","description":"Actual size (bytes) of environment list","type":"bigint","hidden":true,"required":false,"index":false},{"name":"cwd","description":"The process current working directory","type":"text","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit User ID at process start","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID at process start","type":"bigint","hidden":false,"required":false,"index":false},{"name":"euid","description":"Effective user ID at process start","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID at process start","type":"bigint","hidden":false,"required":false,"index":false},{"name":"egid","description":"Effective group ID at process start","type":"bigint","hidden":false,"required":false,"index":false},{"name":"owner_uid","description":"File owner user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"owner_gid","description":"File owner group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"atime","description":"File last access in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mtime","description":"File modification in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ctime","description":"File last metadata change in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"btime","description":"File creation in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"overflows","description":"List of structures that overflowed","type":"text","hidden":true,"required":false,"index":false},{"name":"parent","description":"Process parent's PID, or -1 if cannot be determined.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false},{"name":"status","description":"OpenBSM Attribute: Status of the process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"fsuid","description":"Filesystem user ID at process start","type":"bigint","hidden":true,"required":false,"index":false},{"name":"suid","description":"Saved user ID at process start","type":"bigint","hidden":true,"required":false,"index":false},{"name":"fsgid","description":"Filesystem group ID at process start","type":"bigint","hidden":true,"required":false,"index":false},{"name":"sgid","description":"Saved group ID at process start","type":"bigint","hidden":true,"required":false,"index":false},{"name":"syscall","description":"Syscall name: fork, vfork, clone, execve, execveat","type":"text","hidden":true,"required":false,"index":false}]},{"name":"process_file_events","description":"A File Integrity Monitor implementation using the audit service.","platforms":["linux"],"columns":[{"name":"operation","description":"Operation type","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ppid","description":"Parent process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"executable","description":"The executable path","type":"text","hidden":false,"required":false,"index":false},{"name":"partial","description":"True if this is a partial event (i.e.: this process existed before we started osquery)","type":"text","hidden":false,"required":false,"index":false},{"name":"cwd","description":"The current working directory of the process","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"The path associated with the event","type":"text","hidden":false,"required":false,"index":false},{"name":"dest_path","description":"The canonical path associated with the event","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"The uid of the process performing the action","type":"text","hidden":false,"required":false,"index":false},{"name":"gid","description":"The gid of the process performing the action","type":"text","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit user ID of the process using the file","type":"text","hidden":false,"required":false,"index":false},{"name":"euid","description":"Effective user ID of the process using the file","type":"text","hidden":false,"required":false,"index":false},{"name":"egid","description":"Effective group ID of the process using the file","type":"text","hidden":false,"required":false,"index":false},{"name":"fsuid","description":"Filesystem user ID of the process using the file","type":"text","hidden":false,"required":false,"index":false},{"name":"fsgid","description":"Filesystem group ID of the process using the file","type":"text","hidden":false,"required":false,"index":false},{"name":"suid","description":"Saved user ID of the process using the file","type":"text","hidden":false,"required":false,"index":false},{"name":"sgid","description":"Saved group ID of the process using the file","type":"text","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"process_memory_map","description":"Process memory mapped files and pseudo device/regions.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"start","description":"Virtual start address (hex)","type":"text","hidden":false,"required":false,"index":false},{"name":"end","description":"Virtual end address (hex)","type":"text","hidden":false,"required":false,"index":false},{"name":"permissions","description":"r=read, w=write, x=execute, p=private (cow)","type":"text","hidden":false,"required":false,"index":false},{"name":"offset","description":"Offset into mapped path","type":"bigint","hidden":false,"required":false,"index":false},{"name":"device","description":"MA:MI Major/minor device ID","type":"text","hidden":false,"required":false,"index":false},{"name":"inode","description":"Mapped path inode, 0 means uninitialized (BSS)","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to mapped file or mapped type","type":"text","hidden":false,"required":false,"index":false},{"name":"pseudo","description":"1 If path is a pseudo path, else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"process_namespaces","description":"Linux namespaces for processes running on the host system.","platforms":["linux"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"cgroup_namespace","description":"cgroup namespace inode","type":"text","hidden":false,"required":false,"index":false},{"name":"ipc_namespace","description":"ipc namespace inode","type":"text","hidden":false,"required":false,"index":false},{"name":"mnt_namespace","description":"mnt namespace inode","type":"text","hidden":false,"required":false,"index":false},{"name":"net_namespace","description":"net namespace inode","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_namespace","description":"pid namespace inode","type":"text","hidden":false,"required":false,"index":false},{"name":"user_namespace","description":"user namespace inode","type":"text","hidden":false,"required":false,"index":false},{"name":"uts_namespace","description":"uts namespace inode","type":"text","hidden":false,"required":false,"index":false}]},{"name":"process_open_files","description":"File descriptors for each process.","platforms":["darwin","linux"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"fd","description":"Process-specific file descriptor number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Filesystem path of descriptor","type":"text","hidden":false,"required":false,"index":false}]},{"name":"process_open_pipes","description":"Pipes and partner processes for each process.","platforms":["linux"],"columns":[{"name":"pid","description":"Process ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"fd","description":"File descriptor","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mode","description":"Pipe open mode (r/w)","type":"text","hidden":false,"required":false,"index":false},{"name":"inode","description":"Pipe inode number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"type","description":"Pipe Type: named vs unnamed/anonymous","type":"text","hidden":false,"required":false,"index":false},{"name":"partner_pid","description":"Process ID of partner process sharing a particular pipe","type":"bigint","hidden":false,"required":false,"index":false},{"name":"partner_fd","description":"File descriptor of shared pipe at partner's end","type":"bigint","hidden":false,"required":false,"index":false},{"name":"partner_mode","description":"Mode of shared pipe at partner's end","type":"text","hidden":false,"required":false,"index":false}]},{"name":"process_open_sockets","description":"Processes which have open network sockets on the system.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"fd","description":"Socket file descriptor number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"socket","description":"Socket handle or inode number","type":"bigint","hidden":false,"required":false,"index":false},{"name":"family","description":"Network protocol (IPv4, IPv6)","type":"integer","hidden":false,"required":false,"index":false},{"name":"protocol","description":"Transport protocol (TCP/UDP)","type":"integer","hidden":false,"required":false,"index":false},{"name":"local_address","description":"Socket local address","type":"text","hidden":false,"required":false,"index":false},{"name":"remote_address","description":"Socket remote address","type":"text","hidden":false,"required":false,"index":false},{"name":"local_port","description":"Socket local port","type":"integer","hidden":false,"required":false,"index":false},{"name":"remote_port","description":"Socket remote port","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"For UNIX sockets (family=AF_UNIX), the domain path","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"TCP socket state","type":"text","hidden":false,"required":false,"index":false},{"name":"net_namespace","description":"The inode number of the network namespace","type":"text","hidden":true,"required":false,"index":false}]},{"name":"processes","description":"All running processes on the host system.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"The process path or shorthand argv[0]","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to executed binary","type":"text","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Complete argv","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"Process state","type":"text","hidden":false,"required":false,"index":false},{"name":"cwd","description":"Process current working directory","type":"text","hidden":false,"required":false,"index":false},{"name":"root","description":"Process virtual root directory","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"Unsigned user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Unsigned group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"euid","description":"Unsigned effective user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"egid","description":"Unsigned effective group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"suid","description":"Unsigned saved user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sgid","description":"Unsigned saved group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"on_disk","description":"The process path exists yes=1, no=0, unknown=-1","type":"integer","hidden":false,"required":false,"index":false},{"name":"wired_size","description":"Bytes of unpageable memory used by process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"resident_size","description":"Bytes of private memory used by process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"total_size","description":"Total virtual memory size","type":"bigint","hidden":false,"required":false,"index":false},{"name":"user_time","description":"CPU time in milliseconds spent in user space","type":"bigint","hidden":false,"required":false,"index":false},{"name":"system_time","description":"CPU time in milliseconds spent in kernel space","type":"bigint","hidden":false,"required":false,"index":false},{"name":"disk_bytes_read","description":"Bytes read from disk","type":"bigint","hidden":false,"required":false,"index":false},{"name":"disk_bytes_written","description":"Bytes written to disk","type":"bigint","hidden":false,"required":false,"index":false},{"name":"start_time","description":"Process start time in seconds since Epoch, in case of error -1","type":"bigint","hidden":false,"required":false,"index":false},{"name":"parent","description":"Process parent's PID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pgroup","description":"Process group","type":"bigint","hidden":false,"required":false,"index":false},{"name":"threads","description":"Number of threads used by process","type":"integer","hidden":false,"required":false,"index":false},{"name":"nice","description":"Process nice level (-20 to 20, default 0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"elevated_token","description":"Process uses elevated token yes=1, no=0","type":"integer","hidden":true,"required":false,"index":false},{"name":"secure_process","description":"Process is secure (IUM) yes=1, no=0","type":"integer","hidden":true,"required":false,"index":false},{"name":"protection_type","description":"The protection type of the process","type":"text","hidden":true,"required":false,"index":false},{"name":"virtual_process","description":"Process is virtual (e.g. System, Registry, vmmem) yes=1, no=0","type":"integer","hidden":true,"required":false,"index":false},{"name":"elapsed_time","description":"Elapsed time in seconds this process has been running.","type":"bigint","hidden":true,"required":false,"index":false},{"name":"handle_count","description":"Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process.","type":"bigint","hidden":true,"required":false,"index":false},{"name":"percent_processor_time","description":"Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks.","type":"bigint","hidden":true,"required":false,"index":false},{"name":"upid","description":"A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uppid","description":"The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cpu_type","description":"Indicates the specific processor designed for installation.","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_subtype","description":"Indicates the specific processor on which an entry may be used.","type":"integer","hidden":false,"required":false,"index":false},{"name":"translated","description":"Indicates whether the process is running under the Rosetta Translation Environment, yes=1, no=0, error=-1.","type":"integer","hidden":false,"required":false,"index":false},{"name":"cgroup_path","description":"The full hierarchical path of the process's control group","type":"text","hidden":true,"required":false,"index":false}]},{"name":"programs","description":"Represents products as they are installed by Windows Installer. A product generally correlates to one installation package on Windows. Some fields may be blank as Windows installation details are left to the discretion of the product author.","platforms":["windows"],"columns":[{"name":"name","description":"Commonly used product name.","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Product version information.","type":"text","hidden":false,"required":false,"index":false},{"name":"install_location","description":"The installation location directory of the product.","type":"text","hidden":false,"required":false,"index":false},{"name":"install_source","description":"The installation source of the product.","type":"text","hidden":false,"required":false,"index":false},{"name":"language","description":"The language of the product.","type":"text","hidden":false,"required":false,"index":false},{"name":"publisher","description":"Name of the product supplier.","type":"text","hidden":false,"required":false,"index":false},{"name":"uninstall_string","description":"Path and filename of the uninstaller.","type":"text","hidden":false,"required":false,"index":false},{"name":"install_date","description":"Date that this product was installed on the system. ","type":"text","hidden":false,"required":false,"index":false},{"name":"identifying_number","description":"Product identification such as a serial number on software, or a die number on a hardware chip.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"prometheus_metrics","description":"Retrieve metrics from a Prometheus server.","platforms":["darwin","linux"],"columns":[{"name":"target_name","description":"Address of prometheus target","type":"text","hidden":false,"required":false,"index":false},{"name":"metric_name","description":"Name of collected Prometheus metric","type":"text","hidden":false,"required":false,"index":false},{"name":"metric_value","description":"Value of collected Prometheus metric","type":"double","hidden":false,"required":false,"index":false},{"name":"timestamp_ms","description":"Unix timestamp of collected data in MS","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"python_packages","description":"Python packages installed in a system.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"name","description":"Package display name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Package-supplied version","type":"text","hidden":false,"required":false,"index":false},{"name":"summary","description":"Package-supplied summary","type":"text","hidden":false,"required":false,"index":false},{"name":"author","description":"Optional package author","type":"text","hidden":false,"required":false,"index":false},{"name":"license","description":"License under which package is launched","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path at which this module resides","type":"text","hidden":false,"required":false,"index":false},{"name":"directory","description":"Directory where Python modules are located","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"quicklook_cache","description":"Files and thumbnails within macOS's Quicklook Cache.","platforms":["darwin"],"columns":[{"name":"path","description":"Path of file","type":"text","hidden":false,"required":false,"index":false},{"name":"rowid","description":"Quicklook file rowid key","type":"integer","hidden":false,"required":false,"index":false},{"name":"fs_id","description":"Quicklook file fs_id key","type":"text","hidden":false,"required":false,"index":false},{"name":"volume_id","description":"Parsed volume ID from fs_id","type":"integer","hidden":false,"required":false,"index":false},{"name":"inode","description":"Parsed file ID (inode) from fs_id","type":"integer","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Parsed version date field","type":"integer","hidden":false,"required":false,"index":false},{"name":"size","description":"Parsed version size field","type":"bigint","hidden":false,"required":false,"index":false},{"name":"label","description":"Parsed version 'gen' field","type":"text","hidden":false,"required":false,"index":false},{"name":"last_hit_date","description":"Apple date format for last thumbnail cache hit","type":"integer","hidden":false,"required":false,"index":false},{"name":"hit_count","description":"Number of cache hits on thumbnail","type":"text","hidden":false,"required":false,"index":false},{"name":"icon_mode","description":"Thumbnail icon mode","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cache_path","description":"Path to cache data","type":"text","hidden":false,"required":false,"index":false}]},{"name":"registry","description":"All of the Windows registry hives.","platforms":["windows"],"columns":[{"name":"key","description":"Name of the key to search for","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Full path to the value","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the registry value entry","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of the registry value, or 'subkey' if item is a subkey","type":"text","hidden":false,"required":false,"index":false},{"name":"data","description":"Data content of registry value","type":"text","hidden":false,"required":false,"index":false},{"name":"mtime","description":"timestamp of the most recent registry write","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"routes","description":"The active route table for the host system.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"destination","description":"Destination IP address","type":"text","hidden":false,"required":false,"index":false},{"name":"netmask","description":"Netmask length","type":"integer","hidden":false,"required":false,"index":false},{"name":"gateway","description":"Route gateway","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Route source","type":"text","hidden":false,"required":false,"index":false},{"name":"flags","description":"Flags to describe route","type":"integer","hidden":false,"required":false,"index":false},{"name":"interface","description":"Route local interface","type":"text","hidden":false,"required":false,"index":false},{"name":"mtu","description":"Maximum Transmission Unit for the route","type":"integer","hidden":false,"required":false,"index":false},{"name":"metric","description":"Cost of route. Lowest is preferred","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of route","type":"text","hidden":false,"required":false,"index":false},{"name":"hopcount","description":"Max hops expected","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"rpm_package_files","description":"RPM packages that are currently installed on the host system.","platforms":["linux"],"columns":[{"name":"package","description":"RPM package name","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"File path within the package","type":"text","hidden":false,"required":false,"index":false},{"name":"username","description":"File default username from info DB","type":"text","hidden":false,"required":false,"index":false},{"name":"groupname","description":"File default groupname from info DB","type":"text","hidden":false,"required":false,"index":false},{"name":"mode","description":"File permissions mode from info DB","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Expected file size in bytes from RPM info DB","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sha256","description":"SHA256 file digest from RPM info DB","type":"text","hidden":false,"required":false,"index":false}]},{"name":"rpm_packages","description":"RPM packages that are currently installed on the host system.","platforms":["linux"],"columns":[{"name":"name","description":"RPM package name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Package version","type":"text","hidden":false,"required":false,"index":false},{"name":"release","description":"Package release","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Source RPM package name (optional)","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Package size in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sha1","description":"SHA1 hash of the package contents","type":"text","hidden":false,"required":false,"index":false},{"name":"arch","description":"Architecture(s) supported","type":"text","hidden":false,"required":false,"index":false},{"name":"epoch","description":"Package epoch value","type":"integer","hidden":false,"required":false,"index":false},{"name":"install_time","description":"When the package was installed","type":"integer","hidden":false,"required":false,"index":false},{"name":"vendor","description":"Package vendor","type":"text","hidden":false,"required":false,"index":false},{"name":"package_group","description":"Package group","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","hidden":true,"required":false,"index":false}]},{"name":"running_apps","description":"macOS applications currently running on the host system.","platforms":["darwin"],"columns":[{"name":"pid","description":"The pid of the application","type":"integer","hidden":false,"required":false,"index":false},{"name":"bundle_identifier","description":"The bundle identifier of the application","type":"text","hidden":false,"required":false,"index":false},{"name":"is_active","description":"1 if the application is in focus, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"safari_extensions","description":"Safari browser extension details for all users.","platforms":["darwin"],"columns":[{"name":"uid","description":"The local user that owns the extension","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"Extension display name","type":"text","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Extension identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension long version","type":"text","hidden":false,"required":false,"index":false},{"name":"sdk","description":"Bundle SDK used to compile extension","type":"text","hidden":false,"required":false,"index":false},{"name":"update_url","description":"Extension-supplied update URI","type":"text","hidden":false,"required":false,"index":false},{"name":"author","description":"Optional extension author","type":"text","hidden":false,"required":false,"index":false},{"name":"developer_id","description":"Optional developer identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Optional extension description text","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to extension XAR bundle","type":"text","hidden":false,"required":false,"index":false}]},{"name":"sandboxes","description":"macOS application sandboxes container details.","platforms":["darwin"],"columns":[{"name":"label","description":"UTI-format bundle or label ID","type":"text","hidden":false,"required":false,"index":false},{"name":"user","description":"Sandbox owner","type":"text","hidden":false,"required":false,"index":false},{"name":"enabled","description":"Application sandboxings enabled on container","type":"integer","hidden":false,"required":false,"index":false},{"name":"build_id","description":"Sandbox-specific identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"bundle_path","description":"Application bundle used by the sandbox","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to sandbox container directory","type":"text","hidden":false,"required":false,"index":false}]},{"name":"scheduled_tasks","description":"Lists all of the tasks in the Windows task scheduler.","platforms":["windows"],"columns":[{"name":"name","description":"Name of the scheduled task","type":"text","hidden":false,"required":false,"index":false},{"name":"action","description":"Actions executed by the scheduled task","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to the executable to be run","type":"text","hidden":false,"required":false,"index":false},{"name":"enabled","description":"Whether or not the scheduled task is enabled","type":"integer","hidden":false,"required":false,"index":false},{"name":"state","description":"State of the scheduled task","type":"text","hidden":false,"required":false,"index":false},{"name":"hidden","description":"Whether or not the task is visible in the UI","type":"integer","hidden":false,"required":false,"index":false},{"name":"last_run_time","description":"Timestamp the task last ran","type":"bigint","hidden":false,"required":false,"index":false},{"name":"next_run_time","description":"Timestamp the task is scheduled to run next","type":"bigint","hidden":false,"required":false,"index":false},{"name":"last_run_message","description":"Exit status message of the last task run","type":"text","hidden":false,"required":false,"index":false},{"name":"last_run_code","description":"Exit status code of the last task run","type":"text","hidden":false,"required":false,"index":false}]},{"name":"screenlock","description":"macOS screenlock status. Note: only fetches results for osquery's current logged-in user context. The user must also have recently logged in.","platforms":["darwin"],"columns":[{"name":"enabled","description":"1 If a password is required after sleep or the screensaver begins; else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"grace_period","description":"The amount of time in seconds the screen must be asleep or the screensaver on before a password is required on-wake. 0 = immediately; -1 = no password is required on-wake","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"seccomp_events","description":"A virtual table that tracks seccomp events.","platforms":["linux"],"columns":[{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit user ID (loginuid) of the user who started the analyzed process","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID of the user who started the analyzed process","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID of the user who started the analyzed process","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"ses","description":"Session ID of the session from which the analyzed process was invoked","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"unsigned_bigint","hidden":false,"required":false,"index":false},{"name":"comm","description":"Command-line name of the command that was used to invoke the analyzed process","type":"text","hidden":false,"required":false,"index":false},{"name":"exe","description":"The path to the executable that was used to invoke the analyzed process","type":"text","hidden":false,"required":false,"index":false},{"name":"sig","description":"Signal value sent to process by seccomp","type":"bigint","hidden":false,"required":false,"index":false},{"name":"arch","description":"Information about the CPU architecture","type":"text","hidden":false,"required":false,"index":false},{"name":"syscall","description":"Type of the system call","type":"text","hidden":false,"required":false,"index":false},{"name":"compat","description":"Is system call in compatibility mode","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ip","description":"Instruction pointer value","type":"text","hidden":false,"required":false,"index":false},{"name":"code","description":"The seccomp action","type":"text","hidden":false,"required":false,"index":false}]},{"name":"secureboot","description":"Secure Boot UEFI Settings.","platforms":["linux","windows"],"columns":[{"name":"secure_boot","description":"Whether secure boot is enabled","type":"integer","hidden":false,"required":false,"index":false},{"name":"setup_mode","description":"Whether setup mode is enabled","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"selinux_events","description":"Track SELinux events.","platforms":["linux"],"columns":[{"name":"type","description":"Event type","type":"text","hidden":false,"required":false,"index":false},{"name":"message","description":"Message","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"selinux_settings","description":"Track active SELinux settings.","platforms":["linux"],"columns":[{"name":"scope","description":"Where the key is located inside the SELinuxFS mount point.","type":"text","hidden":false,"required":false,"index":false},{"name":"key","description":"Key or class name.","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Active value.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"services","description":"Lists all installed Windows services and their relevant data.","platforms":["windows"],"columns":[{"name":"name","description":"Service name","type":"text","hidden":false,"required":false,"index":false},{"name":"service_type","description":"Service Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)","type":"text","hidden":false,"required":false,"index":false},{"name":"display_name","description":"Service Display name","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"Service Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSED","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"the Process ID of the service","type":"integer","hidden":false,"required":false,"index":false},{"name":"start_type","description":"Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED","type":"text","hidden":false,"required":false,"index":false},{"name":"win32_exit_code","description":"The error code that the service uses to report an error that occurs when it is starting or stopping","type":"integer","hidden":false,"required":false,"index":false},{"name":"service_exit_code","description":"The service-specific error code that the service returns when an error occurs while the service is starting or stopping","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to Service Executable","type":"text","hidden":false,"required":false,"index":false},{"name":"module_path","description":"Path to ServiceDll","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Service Description","type":"text","hidden":false,"required":false,"index":false},{"name":"user_account","description":"The name of the account that the service process will be logged on as when it runs. This name can be of the form Domain\\UserName. If the account belongs to the built-in domain, the name can be of the form .\\UserName.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"shadow","description":"Local system users encrypted passwords and related information. Please note, that you usually need superuser rights to access `/etc/shadow`.","platforms":["linux"],"columns":[{"name":"password_status","description":"Password status","type":"text","hidden":false,"required":false,"index":false},{"name":"hash_alg","description":"Password hashing algorithm","type":"text","hidden":false,"required":false,"index":false},{"name":"last_change","description":"Date of last password change (starting from UNIX epoch date)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"min","description":"Minimal number of days between password changes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"max","description":"Maximum number of days between password changes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"warning","description":"Number of days before password expires to warn user about it","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inactive","description":"Number of days after password expires until account is blocked","type":"bigint","hidden":false,"required":false,"index":false},{"name":"expire","description":"Number of days since UNIX epoch date until account is disabled","type":"bigint","hidden":false,"required":false,"index":false},{"name":"flag","description":"Reserved","type":"bigint","hidden":false,"required":false,"index":false},{"name":"username","description":"Username","type":"text","hidden":false,"required":false,"index":false}]},{"name":"shared_folders","description":"Folders available to others via SMB or AFP.","platforms":["darwin"],"columns":[{"name":"name","description":"The shared name of the folder as it appears to other users","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Absolute path of shared folder on the local system","type":"text","hidden":false,"required":false,"index":false}]},{"name":"shared_memory","description":"OS shared memory regions.","platforms":["linux"],"columns":[{"name":"shmid","description":"Shared memory segment ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"owner_uid","description":"User ID of owning process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"creator_uid","description":"User ID of creator process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID to last use the segment","type":"bigint","hidden":false,"required":false,"index":false},{"name":"creator_pid","description":"Process ID that created the segment","type":"bigint","hidden":false,"required":false,"index":false},{"name":"atime","description":"Attached time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"dtime","description":"Detached time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Changed time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"permissions","description":"Memory segment permissions","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Size in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"attached","description":"Number of attached processes","type":"integer","hidden":false,"required":false,"index":false},{"name":"status","description":"Destination/attach status","type":"text","hidden":false,"required":false,"index":false},{"name":"locked","description":"1 if segment is locked else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"shared_resources","description":"Displays shared resources on a computer system running Windows. This may be a disk drive, printer, interprocess communication, or other sharable device.","platforms":["windows"],"columns":[{"name":"description","description":"A textual description of the object","type":"text","hidden":false,"required":false,"index":false},{"name":"install_date","description":"Indicates when the object was installed. Lack of a value does not indicate that the object is not installed.","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"String that indicates the current status of the object.","type":"text","hidden":false,"required":false,"index":false},{"name":"allow_maximum","description":"Number of concurrent users for this resource has been limited. If True, the value in the MaximumAllowed property is ignored.","type":"integer","hidden":false,"required":false,"index":false},{"name":"maximum_allowed","description":"Limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum property is set to FALSE.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"Alias given to a path set up as a share on a computer system running Windows.","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Local path of the Windows share.","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of resource being shared. Types include: disk drives, print queues, interprocess communications (IPC), and general devices.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"type_name","description":"Human readable value for the 'type' column","type":"text","hidden":false,"required":false,"index":false}]},{"name":"sharing_preferences","description":"macOS Sharing preferences.","platforms":["darwin"],"columns":[{"name":"screen_sharing","description":"1 If screen sharing is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"file_sharing","description":"1 If file sharing is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"printer_sharing","description":"1 If printer sharing is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"remote_login","description":"1 If remote login is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"remote_management","description":"1 If remote management is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"remote_apple_events","description":"1 If remote apple events are enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"internet_sharing","description":"1 If internet sharing is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"bluetooth_sharing","description":"1 If bluetooth sharing is enabled for any user else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"disc_sharing","description":"1 If CD or DVD sharing is enabled else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"content_caching","description":"1 If content caching is enabled else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"shell_history","description":"A line-delimited (command) table of per-user .*_history data.","platforms":["darwin","linux"],"columns":[{"name":"uid","description":"Shell history owner","type":"bigint","hidden":false,"required":false,"index":false},{"name":"time","description":"Entry timestamp. It could be absent, default value is 0.","type":"integer","hidden":false,"required":false,"index":false},{"name":"command","description":"Unparsed date/line/command history line","type":"text","hidden":false,"required":false,"index":false},{"name":"history_file","description":"Path to the .*_history for this user","type":"text","hidden":false,"required":false,"index":false}]},{"name":"shellbags","description":"Shows directories accessed via Windows Explorer.","platforms":["windows"],"columns":[{"name":"sid","description":"User SID","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Shellbags source Registry file","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Directory name.","type":"text","hidden":false,"required":false,"index":false},{"name":"modified_time","description":"Directory Modified time.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"created_time","description":"Directory Created time.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"accessed_time","description":"Directory Accessed time.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mft_entry","description":"Directory master file table entry.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"mft_sequence","description":"Directory master file table sequence.","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"shimcache","description":"Application Compatibility Cache, contains artifacts of execution.","platforms":["windows"],"columns":[{"name":"entry","description":"Execution order.","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"This is the path to the executed file.","type":"text","hidden":false,"required":false,"index":false},{"name":"modified_time","description":"File Modified time.","type":"integer","hidden":false,"required":false,"index":false},{"name":"execution_flag","description":"Boolean Execution flag, 1 for execution, 0 for no execution, -1 for missing (this flag does not exist on Windows 10 and higher).","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"signature","description":"File (executable, bundle, installer, disk) code signing status.","platforms":["darwin"],"columns":[{"name":"path","description":"Must provide a path or directory","type":"text","hidden":false,"required":true,"index":false},{"name":"hash_resources","description":"Set to 1 to also hash resources, or 0 otherwise. Default is 1","type":"integer","hidden":false,"required":false,"index":false},{"name":"arch","description":"If applicable, the arch of the signed code","type":"text","hidden":false,"required":false,"index":false},{"name":"signed","description":"1 If the file is signed else 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"identifier","description":"The signing identifier sealed into the signature","type":"text","hidden":false,"required":false,"index":false},{"name":"cdhash","description":"Hash of the application Code Directory","type":"text","hidden":false,"required":false,"index":false},{"name":"team_identifier","description":"The team signing identifier sealed into the signature","type":"text","hidden":false,"required":false,"index":false},{"name":"authority","description":"Certificate Common Name","type":"text","hidden":false,"required":false,"index":false}]},{"name":"sip_config","description":"Apple's System Integrity Protection (rootless) status.","platforms":["darwin"],"columns":[{"name":"config_flag","description":"The System Integrity Protection config flag","type":"text","hidden":false,"required":false,"index":false},{"name":"enabled","description":"1 if this configuration is enabled, otherwise 0","type":"integer","hidden":false,"required":false,"index":false},{"name":"enabled_nvram","description":"1 if this configuration is enabled, otherwise 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"smbios_tables","description":"BIOS (DMI) structure common details and content.","platforms":["darwin","linux"],"columns":[{"name":"number","description":"Table entry number","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"Table entry type","type":"integer","hidden":false,"required":false,"index":false},{"name":"description","description":"Table entry description","type":"text","hidden":false,"required":false,"index":false},{"name":"handle","description":"Table entry handle","type":"integer","hidden":false,"required":false,"index":false},{"name":"header_size","description":"Header size in bytes","type":"integer","hidden":false,"required":false,"index":false},{"name":"size","description":"Table entry size in bytes","type":"integer","hidden":false,"required":false,"index":false},{"name":"md5","description":"MD5 hash of table entry","type":"text","hidden":false,"required":false,"index":false}]},{"name":"smc_keys","description":"Apple's system management controller keys.","platforms":["darwin"],"columns":[{"name":"key","description":"4-character key","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"SMC-reported type literal type","type":"text","hidden":false,"required":false,"index":false},{"name":"size","description":"Reported size of data in bytes","type":"integer","hidden":false,"required":false,"index":false},{"name":"value","description":"A type-encoded representation of the key value","type":"text","hidden":false,"required":false,"index":false},{"name":"hidden","description":"1 if this key is normally hidden, otherwise 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"socket_events","description":"Track network socket opens and closes.","platforms":["darwin","linux"],"columns":[{"name":"action","description":"The socket action (bind, listen, close)","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","hidden":false,"required":false,"index":false},{"name":"fd","description":"The file description for the process socket","type":"text","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"status","description":"Either 'succeeded', 'failed', 'in_progress' (connect() on non-blocking socket) or 'no_client' (null accept() on non-blocking socket)","type":"text","hidden":false,"required":false,"index":false},{"name":"family","description":"The Internet protocol family ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"protocol","description":"The network protocol ID","type":"integer","hidden":true,"required":false,"index":false},{"name":"local_address","description":"Local address associated with socket","type":"text","hidden":false,"required":false,"index":false},{"name":"remote_address","description":"Remote address associated with socket","type":"text","hidden":false,"required":false,"index":false},{"name":"local_port","description":"Local network protocol port number","type":"integer","hidden":false,"required":false,"index":false},{"name":"remote_port","description":"Remote network protocol port number","type":"integer","hidden":false,"required":false,"index":false},{"name":"socket","description":"The local path (UNIX domain socket only)","type":"text","hidden":true,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false},{"name":"success","description":"Deprecated. Use the 'status' column instead","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"ssh_configs","description":"A table of parsed ssh_configs.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"uid","description":"The local owner of the ssh_config file","type":"bigint","hidden":false,"required":false,"index":false},{"name":"block","description":"The host or match block","type":"text","hidden":false,"required":false,"index":false},{"name":"option","description":"The option and value","type":"text","hidden":false,"required":false,"index":false},{"name":"ssh_config_file","description":"Path to the ssh_config file","type":"text","hidden":false,"required":false,"index":false}]},{"name":"startup_items","description":"Applications and binaries set as user/login startup items.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"name","description":"Name of startup item","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of startup item","type":"text","hidden":false,"required":false,"index":false},{"name":"args","description":"Arguments provided to startup executable","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Startup Item or Login Item","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Directory or plist containing startup item","type":"text","hidden":false,"required":false,"index":false},{"name":"status","description":"Startup status; either enabled or disabled","type":"text","hidden":false,"required":false,"index":false},{"name":"username","description":"The user associated with the startup item","type":"text","hidden":false,"required":false,"index":false}]},{"name":"sudoers","description":"Rules for running commands as other users via sudo.","platforms":["darwin","linux"],"columns":[{"name":"source","description":"Source file containing the given rule","type":"text","hidden":false,"required":false,"index":false},{"name":"header","description":"Symbol for given rule","type":"text","hidden":false,"required":false,"index":false},{"name":"rule_details","description":"Rule definition","type":"text","hidden":false,"required":false,"index":false}]},{"name":"suid_bin","description":"suid binaries in common locations.","platforms":["darwin","linux"],"columns":[{"name":"path","description":"Binary path","type":"text","hidden":false,"required":false,"index":false},{"name":"username","description":"Binary owner username","type":"text","hidden":false,"required":false,"index":false},{"name":"groupname","description":"Binary owner group","type":"text","hidden":false,"required":false,"index":false},{"name":"permissions","description":"Binary permissions","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"syslog_events","description":"","platforms":["linux"],"columns":[{"name":"time","description":"Current unix epoch time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"datetime","description":"Time known to syslog","type":"text","hidden":false,"required":false,"index":false},{"name":"host","description":"Hostname configured for syslog","type":"text","hidden":false,"required":false,"index":false},{"name":"severity","description":"Syslog severity","type":"integer","hidden":false,"required":false,"index":false},{"name":"facility","description":"Syslog facility","type":"text","hidden":false,"required":false,"index":false},{"name":"tag","description":"The syslog tag","type":"text","hidden":false,"required":false,"index":false},{"name":"message","description":"The syslog message","type":"text","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"system_controls","description":"sysctl names, values, and settings information.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Full sysctl MIB name","type":"text","hidden":false,"required":false,"index":false},{"name":"oid","description":"Control MIB","type":"text","hidden":false,"required":false,"index":false},{"name":"subsystem","description":"Subsystem ID, control type","type":"text","hidden":false,"required":false,"index":false},{"name":"current_value","description":"Value of setting","type":"text","hidden":false,"required":false,"index":false},{"name":"config_value","description":"The MIB value set in /etc/sysctl.conf","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Data type","type":"text","hidden":false,"required":false,"index":false},{"name":"field_name","description":"Specific attribute of opaque type","type":"text","hidden":false,"required":false,"index":false}]},{"name":"system_extensions","description":"macOS (>= 10.15) system extension table.","platforms":["darwin"],"columns":[{"name":"path","description":"Original path of system extension","type":"text","hidden":false,"required":false,"index":false},{"name":"UUID","description":"Extension unique id","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"System extension state","type":"text","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Identifier name","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"System extension version","type":"text","hidden":false,"required":false,"index":false},{"name":"category","description":"System extension category","type":"text","hidden":false,"required":false,"index":false},{"name":"bundle_path","description":"System extension bundle path","type":"text","hidden":false,"required":false,"index":false},{"name":"team","description":"Signing team ID","type":"text","hidden":false,"required":false,"index":false},{"name":"mdm_managed","description":"1 if managed by MDM system extension payload configuration, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"system_info","description":"System information for identification.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"hostname","description":"Network hostname including domain","type":"text","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Unique ID provided by the system","type":"text","hidden":false,"required":false,"index":false},{"name":"cpu_type","description":"CPU type","type":"text","hidden":false,"required":false,"index":false},{"name":"cpu_subtype","description":"CPU subtype","type":"text","hidden":false,"required":false,"index":false},{"name":"cpu_brand","description":"CPU brand string, contains vendor and model","type":"text","hidden":false,"required":false,"index":false},{"name":"cpu_physical_cores","description":"Number of physical CPU cores in to the system","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_logical_cores","description":"Number of logical CPU cores available to the system","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_microcode","description":"Microcode version","type":"text","hidden":false,"required":false,"index":false},{"name":"physical_memory","description":"Total physical memory in bytes","type":"bigint","hidden":false,"required":false,"index":false},{"name":"hardware_vendor","description":"Hardware vendor","type":"text","hidden":false,"required":false,"index":false},{"name":"hardware_model","description":"Hardware model","type":"text","hidden":false,"required":false,"index":false},{"name":"hardware_version","description":"Hardware version","type":"text","hidden":false,"required":false,"index":false},{"name":"hardware_serial","description":"Device serial number","type":"text","hidden":false,"required":false,"index":false},{"name":"board_vendor","description":"Board vendor","type":"text","hidden":false,"required":false,"index":false},{"name":"board_model","description":"Board model","type":"text","hidden":false,"required":false,"index":false},{"name":"board_version","description":"Board version","type":"text","hidden":false,"required":false,"index":false},{"name":"board_serial","description":"Board serial number","type":"text","hidden":false,"required":false,"index":false},{"name":"computer_name","description":"Friendly computer name (optional)","type":"text","hidden":false,"required":false,"index":false},{"name":"local_hostname","description":"Local hostname (optional)","type":"text","hidden":false,"required":false,"index":false}]},{"name":"systemd_units","description":"Track systemd units.","platforms":["linux"],"columns":[{"name":"id","description":"Unique unit identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Unit description","type":"text","hidden":false,"required":false,"index":false},{"name":"load_state","description":"Reflects whether the unit definition was properly loaded","type":"text","hidden":false,"required":false,"index":false},{"name":"active_state","description":"The high-level unit activation state, i.e. generalization of SUB","type":"text","hidden":false,"required":false,"index":false},{"name":"sub_state","description":"The low-level unit activation state, values depend on unit type","type":"text","hidden":false,"required":false,"index":false},{"name":"following","description":"The name of another unit that this unit follows in state","type":"text","hidden":false,"required":false,"index":false},{"name":"object_path","description":"The object path for this unit","type":"text","hidden":false,"required":false,"index":false},{"name":"job_id","description":"Next queued job id","type":"bigint","hidden":false,"required":false,"index":false},{"name":"job_type","description":"Job type","type":"text","hidden":false,"required":false,"index":false},{"name":"job_path","description":"The object path for the job","type":"text","hidden":false,"required":false,"index":false},{"name":"fragment_path","description":"The unit file path this unit was read from, if there is any","type":"text","hidden":false,"required":false,"index":false},{"name":"user","description":"The configured user, if any","type":"text","hidden":false,"required":false,"index":false},{"name":"source_path","description":"Path to the (possibly generated) unit configuration file","type":"text","hidden":false,"required":false,"index":false}]},{"name":"temperature_sensors","description":"Machine's temperature sensors.","platforms":["darwin"],"columns":[{"name":"key","description":"The SMC key on macOS","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of temperature source","type":"text","hidden":false,"required":false,"index":false},{"name":"celsius","description":"Temperature in Celsius","type":"double","hidden":false,"required":false,"index":false},{"name":"fahrenheit","description":"Temperature in Fahrenheit","type":"double","hidden":false,"required":false,"index":false}]},{"name":"time","description":"Track current date and time in UTC.","platforms":["darwin","linux","freebsd","windows"],"columns":[{"name":"weekday","description":"Current weekday in UTC","type":"text","hidden":false,"required":false,"index":false},{"name":"year","description":"Current year in UTC","type":"integer","hidden":false,"required":false,"index":false},{"name":"month","description":"Current month in UTC","type":"integer","hidden":false,"required":false,"index":false},{"name":"day","description":"Current day in UTC","type":"integer","hidden":false,"required":false,"index":false},{"name":"hour","description":"Current hour in UTC","type":"integer","hidden":false,"required":false,"index":false},{"name":"minutes","description":"Current minutes in UTC","type":"integer","hidden":false,"required":false,"index":false},{"name":"seconds","description":"Current seconds in UTC","type":"integer","hidden":false,"required":false,"index":false},{"name":"timezone","description":"Timezone for reported time (hardcoded to UTC)","type":"text","hidden":false,"required":false,"index":false},{"name":"local_timezone","description":"Current local timezone in of the system","type":"text","hidden":false,"required":false,"index":false},{"name":"unix_time","description":"Current UNIX time in UTC","type":"integer","hidden":false,"required":false,"index":false},{"name":"timestamp","description":"Current timestamp (log format) in UTC","type":"text","hidden":false,"required":false,"index":false},{"name":"datetime","description":"Current date and time (ISO format) in UTC","type":"text","hidden":false,"required":false,"index":false},{"name":"iso_8601","description":"Current time (ISO format) in UTC","type":"text","hidden":false,"required":false,"index":false},{"name":"win_timestamp","description":"Timestamp value in 100 nanosecond units","type":"bigint","hidden":true,"required":false,"index":false}]},{"name":"time_machine_backups","description":"Backups to drives using TimeMachine.","platforms":["darwin"],"columns":[{"name":"destination_id","description":"Time Machine destination ID","type":"text","hidden":false,"required":false,"index":false},{"name":"backup_date","description":"Backup Date","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"time_machine_destinations","description":"Locations backed up to using Time Machine.","platforms":["darwin"],"columns":[{"name":"alias","description":"Human readable name of drive","type":"text","hidden":false,"required":false,"index":false},{"name":"destination_id","description":"Time Machine destination ID","type":"text","hidden":false,"required":false,"index":false},{"name":"consistency_scan_date","description":"Consistency scan date","type":"integer","hidden":false,"required":false,"index":false},{"name":"root_volume_uuid","description":"Root UUID of backup volume","type":"text","hidden":false,"required":false,"index":false},{"name":"bytes_available","description":"Bytes available on volume","type":"integer","hidden":false,"required":false,"index":false},{"name":"bytes_used","description":"Bytes used on volume","type":"integer","hidden":false,"required":false,"index":false},{"name":"encryption","description":"Last known encrypted state","type":"text","hidden":false,"required":false,"index":false}]},{"name":"tpm_info","description":"A table that lists the TPM related information.","platforms":["windows"],"columns":[{"name":"activated","description":"TPM is activated","type":"integer","hidden":false,"required":false,"index":false},{"name":"enabled","description":"TPM is enabled","type":"integer","hidden":false,"required":false,"index":false},{"name":"owned","description":"TPM is owned","type":"integer","hidden":false,"required":false,"index":false},{"name":"manufacturer_version","description":"TPM version","type":"text","hidden":false,"required":false,"index":false},{"name":"manufacturer_id","description":"TPM manufacturers ID","type":"integer","hidden":false,"required":false,"index":false},{"name":"manufacturer_name","description":"TPM manufacturers name","type":"text","hidden":false,"required":false,"index":false},{"name":"product_name","description":"Product name of the TPM","type":"text","hidden":false,"required":false,"index":false},{"name":"physical_presence_version","description":"Version of the Physical Presence Interface","type":"text","hidden":false,"required":false,"index":false},{"name":"spec_version","description":"Trusted Computing Group specification that the TPM supports","type":"text","hidden":false,"required":false,"index":false}]},{"name":"ulimit_info","description":"System resource usage limits.","platforms":["darwin","linux"],"columns":[{"name":"type","description":"System resource to be limited","type":"text","hidden":false,"required":false,"index":false},{"name":"soft_limit","description":"Current limit value","type":"text","hidden":false,"required":false,"index":false},{"name":"hard_limit","description":"Maximum limit value","type":"text","hidden":false,"required":false,"index":false}]},{"name":"unified_log","description":"Queries the OSLog framework for entries in the system log. The maximum number of rows returned is limited for performance issues. This table introduces a new idiom for extracting sequential data in batches using multiple queries, ordered by timestamp. To trigger it, the user should include the condition \"timestamp > -1\", and the table will handle pagination.","platforms":["darwin"],"columns":[{"name":"timestamp","description":"unix timestamp associated with the entry","type":"bigint","hidden":false,"required":false,"index":false},{"name":"storage","description":"the storage category for the entry","type":"integer","hidden":false,"required":false,"index":false},{"name":"message","description":"composed message","type":"text","hidden":false,"required":false,"index":false},{"name":"activity","description":"the activity ID associate with the entry","type":"bigint","hidden":false,"required":false,"index":false},{"name":"process","description":"the name of the process that made the entry","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"the pid of the process that made the entry","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sender","description":"the name of the binary image that made the entry","type":"text","hidden":false,"required":false,"index":false},{"name":"tid","description":"the tid of the thread that made the entry","type":"bigint","hidden":false,"required":false,"index":false},{"name":"category","description":"the category of the os_log_t used","type":"text","hidden":false,"required":false,"index":false},{"name":"subsystem","description":"the subsystem of the os_log_t used","type":"text","hidden":false,"required":false,"index":false},{"name":"level","description":"the severity level of the entry","type":"text","hidden":false,"required":false,"index":false},{"name":"max_rows","description":"the max number of rows returned (defaults to 100)","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"uptime","description":"Track time passed since last boot. Some systems track this as calendar time, some as runtime.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"days","description":"Days of uptime","type":"integer","hidden":false,"required":false,"index":false},{"name":"hours","description":"Hours of uptime","type":"integer","hidden":false,"required":false,"index":false},{"name":"minutes","description":"Minutes of uptime","type":"integer","hidden":false,"required":false,"index":false},{"name":"seconds","description":"Seconds of uptime","type":"integer","hidden":false,"required":false,"index":false},{"name":"total_seconds","description":"Total uptime seconds","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"usb_devices","description":"USB devices that are actively plugged into the host system.","platforms":["darwin","linux"],"columns":[{"name":"usb_address","description":"USB Device used address","type":"integer","hidden":false,"required":false,"index":false},{"name":"usb_port","description":"USB Device used port","type":"integer","hidden":false,"required":false,"index":false},{"name":"vendor","description":"USB Device vendor string","type":"text","hidden":false,"required":false,"index":false},{"name":"vendor_id","description":"Hex encoded USB Device vendor identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"version","description":"USB Device version number","type":"text","hidden":false,"required":false,"index":false},{"name":"model","description":"USB Device model string","type":"text","hidden":false,"required":false,"index":false},{"name":"model_id","description":"Hex encoded USB Device model identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"serial","description":"USB Device serial connection","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"USB Device class","type":"text","hidden":false,"required":false,"index":false},{"name":"subclass","description":"USB Device subclass","type":"text","hidden":false,"required":false,"index":false},{"name":"protocol","description":"USB Device protocol","type":"text","hidden":false,"required":false,"index":false},{"name":"removable","description":"1 If USB device is removable else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"user_events","description":"Track user events from the audit framework.","platforms":["darwin","linux"],"columns":[{"name":"uid","description":"User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"message","description":"Message from the event","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"The file description for the process socket","type":"integer","hidden":false,"required":false,"index":false},{"name":"path","description":"Supplied path from event","type":"text","hidden":false,"required":false,"index":false},{"name":"address","description":"The Internet protocol address or family ID","type":"text","hidden":false,"required":false,"index":false},{"name":"terminal","description":"The network protocol ID","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"user_groups","description":"Local system user group relationships.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"uid","description":"User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"user_interaction_events","description":"Track user interaction events from macOS' event tapping framework.","platforms":["darwin"],"columns":[{"name":"time","description":"Time","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"user_ssh_keys","description":"Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"uid","description":"The local user that owns the key file","type":"bigint","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to key file","type":"text","hidden":false,"required":false,"index":false},{"name":"encrypted","description":"1 if key is encrypted, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"key_type","description":"The type of the private key. One of [rsa, dsa, dh, ec, hmac, cmac], or the empty string.","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"userassist","description":"UserAssist Registry Key tracks when a user executes an application from Windows Explorer.","platforms":["windows"],"columns":[{"name":"path","description":"Application file path.","type":"text","hidden":false,"required":false,"index":false},{"name":"last_execution_time","description":"Most recent time application was executed.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"count","description":"Number of times the application has been executed.","type":"integer","hidden":false,"required":false,"index":false},{"name":"sid","description":"User SID.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"users","description":"Local user accounts (including domain accounts that have logged on locally (Windows)).","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"uid","description":"User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID (unsigned)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid_signed","description":"User ID as int64 signed (Apple)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid_signed","description":"Default group ID as int64 signed (Apple)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"username","description":"Username","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Optional user description","type":"text","hidden":false,"required":false,"index":false},{"name":"directory","description":"User's home directory","type":"text","hidden":false,"required":false,"index":false},{"name":"shell","description":"User's configured default shell","type":"text","hidden":false,"required":false,"index":false},{"name":"uuid","description":"User's UUID (Apple) or SID (Windows)","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Whether the account is roaming (domain), local, or a system profile","type":"text","hidden":true,"required":false,"index":false},{"name":"is_hidden","description":"IsHidden attribute set in OpenDirectory","type":"integer","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"video_info","description":"Retrieve video card information of the machine.","platforms":["windows"],"columns":[{"name":"color_depth","description":"The amount of bits per pixel to represent color.","type":"integer","hidden":false,"required":false,"index":false},{"name":"driver","description":"The driver of the device.","type":"text","hidden":false,"required":false,"index":false},{"name":"driver_date","description":"The date listed on the installed driver.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"driver_version","description":"The version of the installed driver.","type":"text","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"The manufacturer of the gpu.","type":"text","hidden":false,"required":false,"index":false},{"name":"model","description":"The model of the gpu.","type":"text","hidden":false,"required":false,"index":false},{"name":"series","description":"The series of the gpu.","type":"text","hidden":false,"required":false,"index":false},{"name":"video_mode","description":"The current resolution of the display.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"virtual_memory_info","description":"Darwin Virtual Memory statistics.","platforms":["darwin"],"columns":[{"name":"free","description":"Total number of free pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"active","description":"Total number of active pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"inactive","description":"Total number of inactive pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"speculative","description":"Total number of speculative pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"throttled","description":"Total number of throttled pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"wired","description":"Total number of wired down pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"purgeable","description":"Total number of purgeable pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"faults","description":"Total number of calls to vm_faults.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"copy","description":"Total number of copy-on-write pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"zero_fill","description":"Total number of zero filled pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"reactivated","description":"Total number of reactivated pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"purged","description":"Total number of purged pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"file_backed","description":"Total number of file backed pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"anonymous","description":"Total number of anonymous pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uncompressed","description":"Total number of uncompressed pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"compressor","description":"The number of pages used to store compressed VM pages.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"decompressed","description":"The total number of pages that have been decompressed by the VM compressor.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"compressed","description":"The total number of pages that have been compressed by the VM compressor.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"page_ins","description":"The total number of requests for pages from a pager.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"page_outs","description":"Total number of pages paged out.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"swap_ins","description":"The total number of compressed pages that have been swapped out to disk.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"swap_outs","description":"The total number of compressed pages that have been swapped back in from disk.","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"wifi_networks","description":"macOS known/remembered Wi-Fi networks list.","platforms":["darwin"],"columns":[{"name":"ssid","description":"SSID octets of the network","type":"text","hidden":false,"required":false,"index":false},{"name":"network_name","description":"Name of the network","type":"text","hidden":false,"required":false,"index":false},{"name":"security_type","description":"Type of security on this network","type":"text","hidden":false,"required":false,"index":false},{"name":"last_connected","description":"Last time this network was connected to as a unix_time","type":"integer","hidden":true,"required":false,"index":false},{"name":"passpoint","description":"1 if Passpoint is supported, 0 otherwise","type":"integer","hidden":true,"required":false,"index":false},{"name":"possibly_hidden","description":"1 if network is possibly a hidden network, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"roaming","description":"1 if roaming is supported, 0 otherwise","type":"integer","hidden":true,"required":false,"index":false},{"name":"roaming_profile","description":"Describe the roaming profile, usually one of Single, Dual  or Multi","type":"text","hidden":false,"required":false,"index":false},{"name":"auto_login","description":"1 if auto login is enabled, 0 otherwise","type":"integer","hidden":true,"required":false,"index":false},{"name":"temporarily_disabled","description":"1 if this network is temporarily disabled, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"disabled","description":"1 if this network is disabled, 0 otherwise","type":"integer","hidden":true,"required":false,"index":false},{"name":"add_reason","description":"Shows why this network was added, via menubar or command line or something else ","type":"text","hidden":false,"required":false,"index":false},{"name":"added_at","description":"Time this network was added as a unix_time","type":"integer","hidden":false,"required":false,"index":false},{"name":"captive_portal","description":"1 if this network has a captive portal, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"captive_login_date","description":"Time this network logged in to a captive portal as unix_time","type":"integer","hidden":false,"required":false,"index":false},{"name":"was_captive_network","description":"1 if this network was previously a captive network, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"auto_join","description":"1 if this network set to join automatically, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false},{"name":"personal_hotspot","description":"1 if this network is a personal hotspot, 0 otherwise","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"wifi_status","description":"macOS current WiFi status.","platforms":["darwin"],"columns":[{"name":"interface","description":"Name of the interface","type":"text","hidden":false,"required":false,"index":false},{"name":"ssid","description":"SSID octets of the network","type":"text","hidden":false,"required":false,"index":false},{"name":"bssid","description":"The current basic service set identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"network_name","description":"Name of the network","type":"text","hidden":false,"required":false,"index":false},{"name":"country_code","description":"The country code (ISO/IEC 3166-1:1997) for the network","type":"text","hidden":false,"required":false,"index":false},{"name":"security_type","description":"Type of security on this network","type":"text","hidden":false,"required":false,"index":false},{"name":"rssi","description":"The current received signal strength indication (dbm)","type":"integer","hidden":false,"required":false,"index":false},{"name":"noise","description":"The current noise measurement (dBm)","type":"integer","hidden":false,"required":false,"index":false},{"name":"channel","description":"Channel number","type":"integer","hidden":false,"required":false,"index":false},{"name":"channel_width","description":"Channel width","type":"integer","hidden":false,"required":false,"index":false},{"name":"channel_band","description":"Channel band","type":"integer","hidden":false,"required":false,"index":false},{"name":"transmit_rate","description":"The current transmit rate","type":"text","hidden":false,"required":false,"index":false},{"name":"mode","description":"The current operating mode for the Wi-Fi interface","type":"text","hidden":false,"required":false,"index":false}]},{"name":"wifi_survey","description":"Scan for nearby WiFi networks.","platforms":["darwin"],"columns":[{"name":"interface","description":"Name of the interface","type":"text","hidden":false,"required":false,"index":false},{"name":"ssid","description":"SSID octets of the network","type":"text","hidden":false,"required":false,"index":false},{"name":"bssid","description":"The current basic service set identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"network_name","description":"Name of the network","type":"text","hidden":false,"required":false,"index":false},{"name":"country_code","description":"The country code (ISO/IEC 3166-1:1997) for the network","type":"text","hidden":false,"required":false,"index":false},{"name":"rssi","description":"The current received signal strength indication (dbm)","type":"integer","hidden":false,"required":false,"index":false},{"name":"noise","description":"The current noise measurement (dBm)","type":"integer","hidden":false,"required":false,"index":false},{"name":"channel","description":"Channel number","type":"integer","hidden":false,"required":false,"index":false},{"name":"channel_width","description":"Channel width","type":"integer","hidden":false,"required":false,"index":false},{"name":"channel_band","description":"Channel band","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"winbaseobj","description":"Lists named Windows objects in the default object directories, across all terminal services sessions.  Example Windows ojbect types include Mutexes, Events, Jobs and Semaphors.","platforms":["windows"],"columns":[{"name":"session_id","description":"Terminal Services Session Id","type":"integer","hidden":false,"required":false,"index":false},{"name":"object_name","description":"Object Name","type":"text","hidden":false,"required":false,"index":false},{"name":"object_type","description":"Object Type","type":"text","hidden":false,"required":false,"index":false}]},{"name":"windows_crashes","description":"Extracted information from Windows crash logs (Minidumps).","platforms":["windows"],"columns":[{"name":"datetime","description":"Timestamp (log format) of the crash","type":"text","hidden":false,"required":false,"index":false},{"name":"module","description":"Path of the crashed module within the process","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of the executable file for the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID of the crashed process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"tid","description":"Thread ID of the crashed thread","type":"bigint","hidden":false,"required":false,"index":false},{"name":"version","description":"File version info of the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"process_uptime","description":"Uptime of the process in seconds","type":"bigint","hidden":false,"required":false,"index":false},{"name":"stack_trace","description":"Multiple stack frames from the stack trace","type":"text","hidden":false,"required":false,"index":false},{"name":"exception_code","description":"The Windows exception code","type":"text","hidden":false,"required":false,"index":false},{"name":"exception_message","description":"The NTSTATUS error message associated with the exception code","type":"text","hidden":false,"required":false,"index":false},{"name":"exception_address","description":"Address (in hex) where the exception occurred","type":"text","hidden":false,"required":false,"index":false},{"name":"registers","description":"The values of the system registers","type":"text","hidden":false,"required":false,"index":false},{"name":"command_line","description":"Command-line string passed to the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"current_directory","description":"Current working directory of the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"username","description":"Username of the user who ran the crashed process","type":"text","hidden":false,"required":false,"index":false},{"name":"machine_name","description":"Name of the machine where the crash happened","type":"text","hidden":false,"required":false,"index":false},{"name":"major_version","description":"Windows major version of the machine","type":"integer","hidden":false,"required":false,"index":false},{"name":"minor_version","description":"Windows minor version of the machine","type":"integer","hidden":false,"required":false,"index":false},{"name":"build_number","description":"Windows build number of the crashing machine","type":"integer","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of crash log","type":"text","hidden":false,"required":false,"index":false},{"name":"crash_path","description":"Path of the log file","type":"text","hidden":false,"required":false,"index":false}]},{"name":"windows_eventlog","description":"Table for querying all recorded Windows event logs.","platforms":["windows"],"columns":[{"name":"channel","description":"Source or channel of the event","type":"text","hidden":false,"required":true,"index":false},{"name":"datetime","description":"System time at which the event occurred","type":"text","hidden":false,"required":false,"index":false},{"name":"task","description":"Task value associated with the event","type":"integer","hidden":false,"required":false,"index":false},{"name":"level","description":"Severity level associated with the event","type":"integer","hidden":false,"required":false,"index":false},{"name":"provider_name","description":"Provider name of the event","type":"text","hidden":false,"required":false,"index":false},{"name":"provider_guid","description":"Provider guid of the event","type":"text","hidden":false,"required":false,"index":false},{"name":"computer_name","description":"Hostname of system where event was generated","type":"text","hidden":false,"required":false,"index":false},{"name":"eventid","description":"Event ID of the event","type":"integer","hidden":false,"required":false,"index":false},{"name":"keywords","description":"A bitmask of the keywords defined in the event","type":"text","hidden":false,"required":false,"index":false},{"name":"data","description":"Data associated with the event","type":"text","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID which emitted the event record","type":"integer","hidden":false,"required":false,"index":false},{"name":"tid","description":"Thread ID which emitted the event record","type":"integer","hidden":false,"required":false,"index":false},{"name":"time_range","description":"System time to selectively filter the events","type":"text","hidden":true,"required":false,"index":false},{"name":"timestamp","description":"Timestamp to selectively filter the events","type":"text","hidden":true,"required":false,"index":false},{"name":"xpath","description":"The custom query to filter events","type":"text","hidden":true,"required":true,"index":false}]},{"name":"windows_events","description":"Windows Event logs.","platforms":["windows"],"columns":[{"name":"time","description":"Timestamp the event was received","type":"bigint","hidden":false,"required":false,"index":false},{"name":"datetime","description":"System time at which the event occurred","type":"text","hidden":false,"required":false,"index":false},{"name":"source","description":"Source or channel of the event","type":"text","hidden":false,"required":false,"index":false},{"name":"provider_name","description":"Provider name of the event","type":"text","hidden":false,"required":false,"index":false},{"name":"provider_guid","description":"Provider guid of the event","type":"text","hidden":false,"required":false,"index":false},{"name":"computer_name","description":"Hostname of system where event was generated","type":"text","hidden":false,"required":false,"index":false},{"name":"eventid","description":"Event ID of the event","type":"integer","hidden":false,"required":false,"index":false},{"name":"task","description":"Task value associated with the event","type":"integer","hidden":false,"required":false,"index":false},{"name":"level","description":"The severity level associated with the event","type":"integer","hidden":false,"required":false,"index":false},{"name":"keywords","description":"A bitmask of the keywords defined in the event","type":"text","hidden":false,"required":false,"index":false},{"name":"data","description":"Data associated with the event","type":"text","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"windows_firewall_rules","description":"Provides the list of Windows firewall rules.","platforms":["windows"],"columns":[{"name":"name","description":"Friendly name of the rule","type":"text","hidden":false,"required":false,"index":false},{"name":"app_name","description":"Friendly name of the application to which the rule applies","type":"text","hidden":false,"required":false,"index":false},{"name":"action","description":"Action for the rule or default setting","type":"text","hidden":false,"required":false,"index":false},{"name":"enabled","description":"1 if the rule is enabled","type":"integer","hidden":false,"required":false,"index":false},{"name":"grouping","description":"Group to which an individual rule belongs","type":"text","hidden":false,"required":false,"index":false},{"name":"direction","description":"Direction of traffic for which the rule applies","type":"text","hidden":false,"required":false,"index":false},{"name":"protocol","description":"IP protocol of the rule","type":"text","hidden":false,"required":false,"index":false},{"name":"local_addresses","description":"Local addresses for the rule","type":"text","hidden":false,"required":false,"index":false},{"name":"remote_addresses","description":"Remote addresses for the rule","type":"text","hidden":false,"required":false,"index":false},{"name":"local_ports","description":"Local ports for the rule","type":"text","hidden":false,"required":false,"index":false},{"name":"remote_ports","description":"Remote ports for the rule","type":"text","hidden":false,"required":false,"index":false},{"name":"icmp_types_codes","description":"ICMP types and codes for the rule","type":"text","hidden":false,"required":false,"index":false},{"name":"profile_domain","description":"1 if the rule profile type is domain","type":"integer","hidden":false,"required":false,"index":false},{"name":"profile_private","description":"1 if the rule profile type is private","type":"integer","hidden":false,"required":false,"index":false},{"name":"profile_public","description":"1 if the rule profile type is public","type":"integer","hidden":false,"required":false,"index":false},{"name":"service_name","description":"Service name property of the application","type":"text","hidden":false,"required":false,"index":false}]},{"name":"windows_optional_features","description":"Lists names and installation states of windows features. Maps to Win32_OptionalFeature WMI class.","platforms":["windows"],"columns":[{"name":"name","description":"Name of the feature","type":"text","hidden":false,"required":false,"index":false},{"name":"caption","description":"Caption of feature in settings UI","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"Installation state value. 1 == Enabled, 2 == Disabled, 3 == Absent","type":"integer","hidden":false,"required":false,"index":false},{"name":"statename","description":"Installation state name. 'Enabled','Disabled','Absent'","type":"text","hidden":false,"required":false,"index":false}]},{"name":"windows_security_center","description":"The health status of Window Security features. Health values can be \"Good\", \"Poor\". \"Snoozed\", \"Not Monitored\", and \"Error\".","platforms":["windows"],"columns":[{"name":"firewall","description":"The health of the monitored Firewall (see windows_security_products)","type":"text","hidden":false,"required":false,"index":false},{"name":"autoupdate","description":"The health of the Windows Autoupdate feature","type":"text","hidden":false,"required":false,"index":false},{"name":"antivirus","description":"The health of the monitored Antivirus solution (see windows_security_products)","type":"text","hidden":false,"required":false,"index":false},{"name":"antispyware","description":"Deprecated (always 'Good').","type":"text","hidden":true,"required":false,"index":false},{"name":"internet_settings","description":"The health of the Internet Settings","type":"text","hidden":false,"required":false,"index":false},{"name":"windows_security_center_service","description":"The health of the Windows Security Center Service","type":"text","hidden":false,"required":false,"index":false},{"name":"user_account_control","description":"The health of the User Account Control (UAC) capability in Windows","type":"text","hidden":false,"required":false,"index":false}]},{"name":"windows_security_products","description":"Enumeration of registered Windows security products.","platforms":["windows"],"columns":[{"name":"type","description":"Type of security product","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of product","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"State of protection","type":"text","hidden":false,"required":false,"index":false},{"name":"state_timestamp","description":"Timestamp for the product state","type":"text","hidden":false,"required":false,"index":false},{"name":"remediation_path","description":"Remediation path","type":"text","hidden":false,"required":false,"index":false},{"name":"signatures_up_to_date","description":"1 if product signatures are up to date, else 0","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"windows_update_history","description":"Provides the history of the windows update events.","platforms":["windows"],"columns":[{"name":"client_app_id","description":"Identifier of the client application that processed an update","type":"text","hidden":false,"required":false,"index":false},{"name":"date","description":"Date and the time an update was applied","type":"bigint","hidden":false,"required":false,"index":false},{"name":"description","description":"Description of an update","type":"text","hidden":false,"required":false,"index":false},{"name":"hresult","description":"HRESULT value that is returned from the operation on an update","type":"bigint","hidden":false,"required":false,"index":false},{"name":"operation","description":"Operation on an update","type":"text","hidden":false,"required":false,"index":false},{"name":"result_code","description":"Result of an operation on an update","type":"text","hidden":false,"required":false,"index":false},{"name":"server_selection","description":"Value that indicates which server provided an update","type":"text","hidden":false,"required":false,"index":false},{"name":"service_id","description":"Service identifier of an update service that is not a Windows update","type":"text","hidden":false,"required":false,"index":false},{"name":"support_url","description":"Hyperlink to the language-specific support information for an update","type":"text","hidden":false,"required":false,"index":false},{"name":"title","description":"Title of an update","type":"text","hidden":false,"required":false,"index":false},{"name":"update_id","description":"Revision-independent identifier of an update","type":"text","hidden":false,"required":false,"index":false},{"name":"update_revision","description":"Revision number of an update","type":"bigint","hidden":false,"required":false,"index":false}]},{"name":"wmi_bios_info","description":"Lists important information from the system bios.","platforms":["windows"],"columns":[{"name":"name","description":"Name of the Bios setting","type":"text","hidden":false,"required":false,"index":false},{"name":"value","description":"Value of the Bios setting","type":"text","hidden":false,"required":false,"index":false}]},{"name":"wmi_cli_event_consumers","description":"WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.","platforms":["windows"],"columns":[{"name":"name","description":"Unique name of a consumer.","type":"text","hidden":false,"required":false,"index":false},{"name":"command_line_template","description":"Standard string template that specifies the process to be started. This property can be NULL, and the ExecutablePath property is used as the command line.","type":"text","hidden":false,"required":false,"index":false},{"name":"executable_path","description":"Module to execute. The string can specify the full path and file name of the module to execute, or it can specify a partial name. If a partial name is specified, the current drive and current directory are assumed.","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"The name of the class.","type":"text","hidden":false,"required":false,"index":false},{"name":"relative_path","description":"Relative path to the class or instance.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"wmi_event_filters","description":"Lists WMI event filters.","platforms":["windows"],"columns":[{"name":"name","description":"Unique identifier of an event filter.","type":"text","hidden":false,"required":false,"index":false},{"name":"query","description":"Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.","type":"text","hidden":false,"required":false,"index":false},{"name":"query_language","description":"Query language that the query is written in.","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"The name of the class.","type":"text","hidden":false,"required":false,"index":false},{"name":"relative_path","description":"Relative path to the class or instance.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"wmi_filter_consumer_binding","description":"Lists the relationship between event consumers and filters.","platforms":["windows"],"columns":[{"name":"consumer","description":"Reference to an instance of __EventConsumer that represents the object path to a logical consumer, the recipient of an event.","type":"text","hidden":false,"required":false,"index":false},{"name":"filter","description":"Reference to an instance of __EventFilter that represents the object path to an event filter which is a query that specifies the type of event to be received.","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"The name of the class.","type":"text","hidden":false,"required":false,"index":false},{"name":"relative_path","description":"Relative path to the class or instance.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"wmi_script_event_consumers","description":"WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.","platforms":["windows"],"columns":[{"name":"name","description":"Unique identifier for the event consumer. ","type":"text","hidden":false,"required":false,"index":false},{"name":"scripting_engine","description":"Name of the scripting engine to use, for example, 'VBScript'. This property cannot be NULL.","type":"text","hidden":false,"required":false,"index":false},{"name":"script_file_name","description":"Name of the file from which the script text is read, intended as an alternative to specifying the text of the script in the ScriptText property.","type":"text","hidden":false,"required":false,"index":false},{"name":"script_text","description":"Text of the script that is expressed in a language known to the scripting engine. This property must be NULL if the ScriptFileName property is not NULL.","type":"text","hidden":false,"required":false,"index":false},{"name":"class","description":"The name of the class.","type":"text","hidden":false,"required":false,"index":false},{"name":"relative_path","description":"Relative path to the class or instance.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"xprotect_entries","description":"Database of the machine's XProtect signatures.","platforms":["darwin"],"columns":[{"name":"name","description":"Description of XProtected malware","type":"text","hidden":false,"required":false,"index":false},{"name":"launch_type","description":"Launch services content type","type":"text","hidden":false,"required":false,"index":false},{"name":"identity","description":"XProtect identity (SHA1) of content","type":"text","hidden":false,"required":false,"index":false},{"name":"filename","description":"Use this file name to match","type":"text","hidden":false,"required":false,"index":false},{"name":"filetype","description":"Use this file type to match","type":"text","hidden":false,"required":false,"index":false},{"name":"optional","description":"Match any of the identities/patterns for this XProtect name","type":"integer","hidden":false,"required":false,"index":false},{"name":"uses_pattern","description":"Uses a match pattern instead of identity","type":"integer","hidden":false,"required":false,"index":false}]},{"name":"xprotect_meta","description":"Database of the machine's XProtect browser-related signatures.","platforms":["darwin"],"columns":[{"name":"identifier","description":"Browser plugin or extension identifier","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Either plugin or extension","type":"text","hidden":false,"required":false,"index":false},{"name":"developer_id","description":"Developer identity (SHA1) of extension","type":"text","hidden":false,"required":false,"index":false},{"name":"min_version","description":"The minimum allowed plugin version.","type":"text","hidden":false,"required":false,"index":false}]},{"name":"xprotect_reports","description":"Database of XProtect matches (if user generated/sent an XProtect report).","platforms":["darwin"],"columns":[{"name":"name","description":"Description of XProtected malware","type":"text","hidden":false,"required":false,"index":false},{"name":"user_action","description":"Action taken by user after prompted","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Quarantine alert time","type":"text","hidden":false,"required":false,"index":false}]},{"name":"yara","description":"Track YARA matches for files or PIDs.","platforms":["darwin","linux","windows"],"columns":[{"name":"path","description":"The path scanned","type":"text","hidden":false,"required":true,"index":false},{"name":"matches","description":"List of YARA matches","type":"text","hidden":false,"required":false,"index":false},{"name":"count","description":"Number of YARA matches","type":"integer","hidden":false,"required":false,"index":false},{"name":"sig_group","description":"Signature group used","type":"text","hidden":false,"required":false,"index":false},{"name":"sigfile","description":"Signature file used","type":"text","hidden":false,"required":false,"index":false},{"name":"sigrule","description":"Signature strings used","type":"text","hidden":true,"required":false,"index":false},{"name":"strings","description":"Matching strings","type":"text","hidden":false,"required":false,"index":false},{"name":"tags","description":"Matching tags","type":"text","hidden":false,"required":false,"index":false},{"name":"sigurl","description":"Signature url","type":"text","hidden":true,"required":false,"index":false}]},{"name":"yara_events","description":"Track YARA matches for files specified in configuration data.","platforms":["darwin","linux","windows"],"columns":[{"name":"target_path","description":"The path scanned","type":"text","hidden":false,"required":false,"index":false},{"name":"category","description":"The category of the file","type":"text","hidden":false,"required":false,"index":false},{"name":"action","description":"Change action (UPDATE, REMOVE, etc)","type":"text","hidden":false,"required":false,"index":false},{"name":"transaction_id","description":"ID used during bulk update","type":"bigint","hidden":false,"required":false,"index":false},{"name":"matches","description":"List of YARA matches","type":"text","hidden":false,"required":false,"index":false},{"name":"count","description":"Number of YARA matches","type":"integer","hidden":false,"required":false,"index":false},{"name":"strings","description":"Matching strings","type":"text","hidden":false,"required":false,"index":false},{"name":"tags","description":"Matching tags","type":"text","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of the scan","type":"bigint","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","hidden":true,"required":false,"index":false}]},{"name":"ycloud_instance_metadata","description":"Yandex.Cloud instance metadata.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"instance_id","description":"Unique identifier for the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"folder_id","description":"Folder identifier for the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Description of the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"hostname","description":"Hostname of the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"zone","description":"Availability zone of the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"ssh_public_key","description":"SSH public key. Only available if supplied at instance launch time","type":"text","hidden":false,"required":false,"index":false},{"name":"serial_port_enabled","description":"Indicates if serial port is enabled for the VM","type":"text","hidden":false,"required":false,"index":false},{"name":"metadata_endpoint","description":"Endpoint used to fetch VM metadata","type":"text","hidden":false,"required":false,"index":false}]},{"name":"yum_sources","description":"Current list of Yum repositories or software channels.","platforms":["linux"],"columns":[{"name":"name","description":"Repository name","type":"text","hidden":false,"required":false,"index":false},{"name":"baseurl","description":"Repository base URL","type":"text","hidden":false,"required":false,"index":false},{"name":"mirrorlist","description":"Mirrorlist URL","type":"text","hidden":false,"required":false,"index":false},{"name":"enabled","description":"Whether the repository is used","type":"text","hidden":false,"required":false,"index":false},{"name":"gpgcheck","description":"Whether packages are GPG checked","type":"text","hidden":false,"required":false,"index":false},{"name":"gpgkey","description":"URL to GPG key","type":"text","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"host_users","description":"Local user accounts (including domain accounts that have logged on locally (Windows)).","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"uid","description":"User ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID (unsigned)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uid_signed","description":"User ID as int64 signed (Apple)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid_signed","description":"Default group ID as int64 signed (Apple)","type":"bigint","hidden":false,"required":false,"index":false},{"name":"username","description":"Username","type":"text","hidden":false,"required":false,"index":false},{"name":"description","description":"Optional user description","type":"text","hidden":false,"required":false,"index":false},{"name":"directory","description":"User's home directory","type":"text","hidden":false,"required":false,"index":false},{"name":"shell","description":"User's configured default shell","type":"text","hidden":false,"required":false,"index":false},{"name":"uuid","description":"User's UUID (Apple) or SID (Windows)","type":"text","hidden":false,"required":false,"index":false},{"name":"type","description":"Whether the account is roaming (domain), local, or a system profile","type":"text","hidden":true,"required":false,"index":false},{"name":"is_hidden","description":"IsHidden attribute set in OpenDirectory","type":"integer","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"host_groups","description":"Local system groups.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"gid","description":"Unsigned int64 group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid_signed","description":"A signed int64 version of gid","type":"bigint","hidden":false,"required":false,"index":false},{"name":"groupname","description":"Canonical local group name","type":"text","hidden":false,"required":false,"index":false},{"name":"group_sid","description":"Unique group ID","type":"text","hidden":true,"required":false,"index":false},{"name":"comment","description":"Remarks or comments associated with the group","type":"text","hidden":true,"required":false,"index":false},{"name":"is_hidden","description":"IsHidden attribute set in OpenDirectory","type":"integer","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","hidden":true,"required":false,"index":false}]},{"name":"host_processes","description":"All running processes on the host system.","platforms":["darwin","linux","windows","freebsd"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"name","description":"The process path or shorthand argv[0]","type":"text","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to executed binary","type":"text","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Complete argv","type":"text","hidden":false,"required":false,"index":false},{"name":"state","description":"Process state","type":"text","hidden":false,"required":false,"index":false},{"name":"cwd","description":"Process current working directory","type":"text","hidden":false,"required":false,"index":false},{"name":"root","description":"Process virtual root directory","type":"text","hidden":false,"required":false,"index":false},{"name":"uid","description":"Unsigned user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"gid","description":"Unsigned group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"euid","description":"Unsigned effective user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"egid","description":"Unsigned effective group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"suid","description":"Unsigned saved user ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"sgid","description":"Unsigned saved group ID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"on_disk","description":"The process path exists yes=1, no=0, unknown=-1","type":"integer","hidden":false,"required":false,"index":false},{"name":"wired_size","description":"Bytes of unpageable memory used by process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"resident_size","description":"Bytes of private memory used by process","type":"bigint","hidden":false,"required":false,"index":false},{"name":"total_size","description":"Total virtual memory size","type":"bigint","hidden":false,"required":false,"index":false},{"name":"user_time","description":"CPU time in milliseconds spent in user space","type":"bigint","hidden":false,"required":false,"index":false},{"name":"system_time","description":"CPU time in milliseconds spent in kernel space","type":"bigint","hidden":false,"required":false,"index":false},{"name":"disk_bytes_read","description":"Bytes read from disk","type":"bigint","hidden":false,"required":false,"index":false},{"name":"disk_bytes_written","description":"Bytes written to disk","type":"bigint","hidden":false,"required":false,"index":false},{"name":"start_time","description":"Process start time in seconds since Epoch, in case of error -1","type":"bigint","hidden":false,"required":false,"index":false},{"name":"parent","description":"Process parent's PID","type":"bigint","hidden":false,"required":false,"index":false},{"name":"pgroup","description":"Process group","type":"bigint","hidden":false,"required":false,"index":false},{"name":"threads","description":"Number of threads used by process","type":"integer","hidden":false,"required":false,"index":false},{"name":"nice","description":"Process nice level (-20 to 20, default 0)","type":"integer","hidden":false,"required":false,"index":false},{"name":"elevated_token","description":"Process uses elevated token yes=1, no=0","type":"integer","hidden":true,"required":false,"index":false},{"name":"secure_process","description":"Process is secure (IUM) yes=1, no=0","type":"integer","hidden":true,"required":false,"index":false},{"name":"protection_type","description":"The protection type of the process","type":"text","hidden":true,"required":false,"index":false},{"name":"virtual_process","description":"Process is virtual (e.g. System, Registry, vmmem) yes=1, no=0","type":"integer","hidden":true,"required":false,"index":false},{"name":"elapsed_time","description":"Elapsed time in seconds this process has been running.","type":"bigint","hidden":true,"required":false,"index":false},{"name":"handle_count","description":"Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process.","type":"bigint","hidden":true,"required":false,"index":false},{"name":"percent_processor_time","description":"Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks.","type":"bigint","hidden":true,"required":false,"index":false},{"name":"upid","description":"A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"uppid","description":"The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system.","type":"bigint","hidden":false,"required":false,"index":false},{"name":"cpu_type","description":"Indicates the specific processor designed for installation.","type":"integer","hidden":false,"required":false,"index":false},{"name":"cpu_subtype","description":"Indicates the specific processor on which an entry may be used.","type":"integer","hidden":false,"required":false,"index":false},{"name":"translated","description":"Indicates whether the process is running under the Rosetta Translation Environment, yes=1, no=0, error=-1.","type":"integer","hidden":false,"required":false,"index":false},{"name":"cgroup_path","description":"The full hierarchical path of the process's control group","type":"text","hidden":true,"required":false,"index":false}]}]
\ No newline at end of file
diff --git a/x-pack/plugins/osquery/public/common/schemas/osquery/v5.7.0.json b/x-pack/plugins/osquery/public/common/schemas/osquery/v5.7.0.json
new file mode 100644
index 0000000000000..8649b18090b76
--- /dev/null
+++ b/x-pack/plugins/osquery/public/common/schemas/osquery/v5.7.0.json
@@ -0,0 +1 @@
+[{"name":"account_policy_data","description":"Additional macOS user account data from the AccountPolicy section of OpenDirectory.","platforms":["darwin"],"columns":[{"name":"uid","description":"User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"creation_time","description":"When the account was first created","type":"double","notes":"","hidden":false,"required":false,"index":false},{"name":"failed_login_count","description":"The number of failed login attempts using an incorrect password. Count resets after a correct password is entered.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"failed_login_timestamp","description":"The time of the last failed login attempt. Resets after a correct password is entered","type":"double","notes":"","hidden":false,"required":false,"index":false},{"name":"password_last_set_time","description":"The time the password was last changed","type":"double","notes":"","hidden":false,"required":false,"index":false}]},{"name":"acpi_tables","description":"Firmware ACPI functional table common metadata and content.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"ACPI table name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of compiled table data","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"md5","description":"MD5 hash of table content","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"ad_config","description":"macOS Active Directory configuration.","platforms":["darwin"],"columns":[{"name":"name","description":"The macOS-specific configuration name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"domain","description":"Active Directory trust domain","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"option","description":"Canonical name of option","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Variable typed option value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"alf","description":"macOS application layer firewall (ALF) service details.","platforms":["darwin"],"columns":[{"name":"allow_signed_enabled","description":"1 If allow signed mode is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"firewall_unload","description":"1 If firewall unloading enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"global_state","description":"1 If the firewall is enabled with exceptions, 2 if the firewall is configured to block all incoming connections, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"logging_enabled","description":"1 If logging mode is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"logging_option","description":"Firewall logging option","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"stealth_enabled","description":"1 If stealth mode is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Application Layer Firewall version","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"alf_exceptions","description":"macOS application layer firewall (ALF) service exceptions.","platforms":["darwin"],"columns":[{"name":"path","description":"Path to the executable that is excepted","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"Firewall exception state","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"alf_explicit_auths","description":"ALF services explicitly allowed to perform networking.","platforms":["darwin"],"columns":[{"name":"process","description":"Process name explicitly allowed","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"app_schemes","description":"macOS application schemes and handlers (e.g., http, file, mailto).","platforms":["darwin"],"columns":[{"name":"scheme","description":"Name of the scheme/protocol","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"handler","description":"Application label for the handler","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled","description":"1 if this handler is the OS default, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"external","description":"1 if this handler does NOT exist on macOS by default, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"protected","description":"1 if this handler is protected (reserved) by macOS, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"apparmor_events","description":"Track AppArmor events.","platforms":["linux"],"columns":[{"name":"type","description":"Event type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"message","description":"Raw audit message","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"apparmor","description":"Apparmor Status like ALLOWED, DENIED etc.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"operation","description":"Permission requested by the process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process PID","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"profile","description":"Apparmor profile name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Process name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"comm","description":"Command-line name of the command that was used to invoke the analyzed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"denied_mask","description":"Denied permissions for the process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"capname","description":"Capability requested by the process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fsuid","description":"Filesystem user ID","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ouid","description":"Object owner's user ID","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"capability","description":"Capability number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"requested_mask","description":"Requested access mask","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"info","description":"Additional information","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"error","description":"Error information","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"namespace","description":"AppArmor namespace","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"label","description":"AppArmor label","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"apparmor_profiles","description":"Track active AppArmor profiles.","platforms":["linux"],"columns":[{"name":"path","description":"Unique, aa-status compatible, policy identifier.","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Policy name.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"attach","description":"Which executable(s) a profile will attach to.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"How the policy is applied.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha1","description":"A unique hash that identifies this policy.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"appcompat_shims","description":"Application Compatibility shims are a way to persist malware. This table presents the AppCompat Shim information from the registry in a nice format. See http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more details.","platforms":["windows"],"columns":[{"name":"executable","description":"Name of the executable that is being shimmed. This is pulled from the registry.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"This is the path to the SDB database.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Description of the SDB.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_time","description":"Install time of the SDB","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of the SDB database.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sdb_id","description":"Unique GUID of the SDB.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"apps","description":"macOS applications installed in known search paths (e.g., /Applications).","platforms":["darwin"],"columns":[{"name":"name","description":"Name of the Name.app folder","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Absolute and full Name.app path","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"bundle_executable","description":"Info properties CFBundleExecutable label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bundle_identifier","description":"Info properties CFBundleIdentifier label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bundle_name","description":"Info properties CFBundleName label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bundle_short_version","description":"Info properties CFBundleShortVersionString label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bundle_version","description":"Info properties CFBundleVersion label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bundle_package_type","description":"Info properties CFBundlePackageType label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"environment","description":"Application-set environment variables","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"element","description":"Does the app identify as a background agent","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"compiler","description":"Info properties DTCompiler label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"development_region","description":"Info properties CFBundleDevelopmentRegion label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"display_name","description":"Info properties CFBundleDisplayName label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"info_string","description":"Info properties CFBundleGetInfoString label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"minimum_system_version","description":"Minimum version of macOS required for the app to run","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"category","description":"The UTI that categorizes the app for the App Store","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"applescript_enabled","description":"Info properties NSAppleScriptEnabled label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"copyright","description":"Info properties NSHumanReadableCopyright label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_opened_time","description":"The time that the app was last used","type":"double","notes":"","hidden":false,"required":false,"index":false}]},{"name":"apt_sources","description":"Current list of APT repositories or software channels.","platforms":["linux"],"columns":[{"name":"name","description":"Repository name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Source file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"base_uri","description":"Repository base URI","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"release","description":"Release name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Repository source version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"maintainer","description":"Repository maintainer","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"components","description":"Repository components","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"architectures","description":"Repository architectures","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"arp_cache","description":"Address resolution cache, both static and dynamic (from ARP, NDP).","platforms":["darwin","linux","windows"],"columns":[{"name":"address","description":"IPv4 address target","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mac","description":"MAC address of broadcasted address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"interface","description":"Interface of the network for the MAC","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"permanent","description":"1 for true, 0 for false","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"asl","description":"Queries the Apple System Log data structure for system events.","platforms":["darwin"],"columns":[{"name":"time","description":"Unix timestamp.  Set automatically","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"time_nano_sec","description":"Nanosecond time.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"host","description":"Sender's address (set by the server).","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sender","description":"Sender's identification string.  Default is process name.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"facility","description":"Sender's facility.  Default is 'user'.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Sending process ID encoded as a string.  Set automatically.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"GID that sent the log message (set by the server).","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"UID that sent the log message (set by the server).","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"level","description":"Log level number.  See levels in asl.h.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"message","description":"Message text.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ref_pid","description":"Reference PID for messages proxied by launchd","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ref_proc","description":"Reference process for messages proxied by launchd","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"extra","description":"Extra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"atom_packages","description":"Lists all atom packages in a directory or globally installed in a system.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Package display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Package supplied version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Package supplied description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Package's package.json path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"license","description":"License for package","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"homepage","description":"Package supplied homepage","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"The local user that owns the plugin","type":"bigint","notes":"","hidden":false,"required":false,"index":true}]},{"name":"augeas","description":"Configuration files parsed by augeas.","platforms":["darwin","linux"],"columns":[{"name":"node","description":"The node path of the configuration item","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"value","description":"The value of the configuration item","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"label","description":"The label of the configuration item","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"The path to the configuration file","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"authenticode","description":"File (executable, bundle, installer, disk) code signing status.","platforms":["windows"],"columns":[{"name":"path","description":"Must provide a path or directory","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"original_program_name","description":"The original program name that the publisher has signed","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial_number","description":"The certificate serial number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"issuer_name","description":"The certificate issuer name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subject_name","description":"The certificate subject name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"result","description":"The signature check result","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"authorization_mechanisms","description":"macOS Authorization mechanisms database.","platforms":["darwin"],"columns":[{"name":"label","description":"Label of the authorization right","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"plugin","description":"Authorization plugin name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mechanism","description":"Name of the mechanism that will be called","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"privileged","description":"If privileged it will run as root, else as an anonymous user","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"entry","description":"The whole string entry","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"authorizations","description":"macOS Authorization rights database.","platforms":["darwin"],"columns":[{"name":"label","description":"Item name, usually in reverse domain format","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"modified","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"allow_root","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"timeout","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"tries","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"authenticate_user","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"shared","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"comment","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"created","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"session_owner","description":"Label top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"authorized_keys","description":"A line-delimited authorized_keys table.","platforms":["darwin","linux"],"columns":[{"name":"uid","description":"The local owner of authorized_keys file","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"algorithm","description":"Key type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key","description":"Key encoded as base64","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"options","description":"Optional list of login options","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"comment","description":"Optional comment","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key_file","description":"Path to the authorized_keys file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"autoexec","description":"Aggregate of executables that will automatically execute on the target machine. This is an amalgamation of other tables like services, scheduled_tasks, startup_items and more.","platforms":["windows"],"columns":[{"name":"path","description":"Path to the executable","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Name of the program","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Source table of the autoexec item","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"azure_instance_metadata","description":"Azure instance metadata.","platforms":["darwin","linux","windows"],"columns":[{"name":"location","description":"Azure Region the VM is running in","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"offer","description":"Offer information for the VM image (Azure image gallery VMs only)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"publisher","description":"Publisher of the VM image","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sku","description":"SKU for the VM image","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Version of the VM image","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"os_type","description":"Linux or Windows","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"platform_update_domain","description":"Update domain the VM is running in","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"platform_fault_domain","description":"Fault domain the VM is running in","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vm_id","description":"Unique identifier for the VM","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"vm_size","description":"VM size","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subscription_id","description":"Azure subscription for the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"resource_group_name","description":"Resource group for the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"placement_group_id","description":"Placement group for the VM scale set","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vm_scale_set_name","description":"VM scale set name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"zone","description":"Availability zone of the VM","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"azure_instance_tags","description":"Azure instance tags.","platforms":["darwin","linux","windows"],"columns":[{"name":"vm_id","description":"Unique identifier for the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key","description":"The tag key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"The tag value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"background_activities_moderator","description":"Background Activities Moderator (BAM) tracks application execution.","platforms":["windows"],"columns":[{"name":"path","description":"Application file path.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_execution_time","description":"Most recent time application was executed.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sid","description":"User SID.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"battery","description":"Provides information about the internal battery of a Macbook.","platforms":["darwin"],"columns":[{"name":"manufacturer","description":"The battery manufacturer's name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacture_date","description":"The date the battery was manufactured UNIX Epoch","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"model","description":"The battery's model number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial_number","description":"The battery's unique serial number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cycle_count","description":"The number of charge/discharge cycles","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"health","description":"One of the following: \"Good\" describes a well-performing battery, \"Fair\" describes a functional battery with limited capacity, or \"Poor\" describes a battery that's not capable of providing power","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"condition","description":"One of the following: \"Normal\" indicates the condition of the battery is within normal tolerances, \"Service Needed\" indicates that the battery should be checked out by a licensed Mac repair service, \"Permanent Failure\" indicates the battery needs replacement","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"One of the following: \"AC Power\" indicates the battery is connected to an external power source, \"Battery Power\" indicates that the battery is drawing internal power, \"Off Line\" indicates the battery is off-line or no longer connected","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"charging","description":"1 if the battery is currently being charged by a power source. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"charged","description":"1 if the battery is currently completely charged. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"designed_capacity","description":"The battery's designed capacity in mAh","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"max_capacity","description":"The battery's actual capacity when it is fully charged in mAh","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"current_capacity","description":"The battery's current charged capacity in mAh","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"percent_remaining","description":"The percentage of battery remaining before it is drained","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"amperage","description":"The battery's current amperage in mA","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"voltage","description":"The battery's current voltage in mV","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"minutes_until_empty","description":"The number of minutes until the battery is fully depleted. This value is -1 if this time is still being calculated","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"minutes_to_full_charge","description":"The number of minutes until the battery is fully charged. This value is -1 if this time is still being calculated","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"bitlocker_info","description":"Retrieve bitlocker status of the machine.","platforms":["windows"],"columns":[{"name":"device_id","description":"ID of the encrypted drive.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"drive_letter","description":"Drive letter of the encrypted drive.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"persistent_volume_id","description":"Persistent ID of the drive.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"conversion_status","description":"The bitlocker conversion status of the drive.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"protection_status","description":"The bitlocker protection status of the drive.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"encryption_method","description":"The encryption type of the device.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"The FVE metadata version of the drive.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"percentage_encrypted","description":"The percentage of the drive that is encrypted.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"lock_status","description":"The accessibility status of the drive from Windows.","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"block_devices","description":"Block (buffered access) device file nodes: disks, ramdisks, and DMG containers.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Block device name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Block device parent name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor","description":"Block device vendor string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model","description":"Block device model string identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Block device size in blocks","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"block_size","description":"Block size in bytes","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Block device Universally Unique Identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Block device type string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"label","description":"Block device label string","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"bpf_process_events","description":"Track time/action process executions.","platforms":["linux"],"columns":[{"name":"tid","description":"Thread ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"cid","description":"Cgroup ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"exit_code","description":"Exit code of the system call","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"probe_error","description":"Set to 1 if one or more buffers could not be captured","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"syscall","description":"System call name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Binary path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cwd","description":"Current working directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Command line arguments","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"duration","description":"How much time was spent inside the syscall (nsecs)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"json_cmdline","description":"Command line arguments, in JSON format","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"ntime","description":"The nsecs uptime timestamp as obtained from BPF","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":true,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"integer","notes":"","hidden":true,"required":false,"index":false}]},{"name":"bpf_socket_events","description":"Track network socket opens and closes.","platforms":["linux"],"columns":[{"name":"tid","description":"Thread ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"cid","description":"Cgroup ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"exit_code","description":"Exit code of the system call","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"probe_error","description":"Set to 1 if one or more buffers could not be captured","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"syscall","description":"System call name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fd","description":"The file description for the process socket","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"family","description":"The Internet protocol family ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"The socket type","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"protocol","description":"The network protocol ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"local_address","description":"Local address associated with socket","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_address","description":"Remote address associated with socket","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_port","description":"Local network protocol port number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_port","description":"Remote network protocol port number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"duration","description":"How much time was spent inside the syscall (nsecs)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ntime","description":"The nsecs uptime timestamp as obtained from BPF","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":true,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"integer","notes":"","hidden":true,"required":false,"index":false}]},{"name":"browser_plugins","description":"All C/NPAPI browser plugin details for all users. C/NPAPI has been deprecated on all major browsers. To query for plugins on modern browsers, try: `chrome_extensions` `firefox_addons` `safari_extensions`.","platforms":["darwin"],"columns":[{"name":"uid","description":"The local user that owns the plugin","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Plugin display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Plugin identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Plugin short version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sdk","description":"Build SDK used to compile plugin","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Plugin description text","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"development_region","description":"Plugin language-localization","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"native","description":"Plugin requires native execution","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to plugin bundle","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"disabled","description":"Is the plugin disabled. 1 = Disabled","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"carbon_black_info","description":"Returns info about a Carbon Black sensor install.","platforms":["darwin","linux","windows"],"columns":[{"name":"sensor_id","description":"Sensor ID of the Carbon Black sensor","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"config_name","description":"Sensor group","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_store_files","description":"If the sensor is configured to send back binaries to the Carbon Black server","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_module_loads","description":"If the sensor is configured to capture module loads","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_module_info","description":"If the sensor is configured to collect metadata of binaries","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_file_mods","description":"If the sensor is configured to collect file modification events","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_reg_mods","description":"If the sensor is configured to collect registry modification events","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_net_conns","description":"If the sensor is configured to collect network connections","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_processes","description":"If the sensor is configured to process events","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_cross_processes","description":"If the sensor is configured to cross process events","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_emet_events","description":"If the sensor is configured to EMET events","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_data_file_writes","description":"If the sensor is configured to collect non binary file writes","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_process_user_context","description":"If the sensor is configured to collect the user running a process","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"collect_sensor_operations","description":"Unknown","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"log_file_disk_quota_mb","description":"Event file disk quota in MB","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"log_file_disk_quota_percentage","description":"Event file disk quota in a percentage","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"protection_disabled","description":"If the sensor is configured to report tamper events","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"sensor_ip_addr","description":"IP address of the sensor","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sensor_backend_server","description":"Carbon Black server","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"event_queue","description":"Size in bytes of Carbon Black event files on disk","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"binary_queue","description":"Size in bytes of binaries waiting to be sent to Carbon Black server","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"carves","description":"List the set of completed and in-progress carves. If carve=1 then the query is treated as a new carve request.","platforms":["darwin","linux","windows"],"columns":[{"name":"time","description":"Time at which the carve was kicked off","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sha256","description":"A SHA256 sum of the carved archive","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of the carved archive","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"The path of the requested carve","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"carve_guid","description":"Identifying value of the carve session","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"request_id","description":"Identifying value of the carve request (e.g., scheduled query name, distributed request, etc)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"carve","description":"Set this value to '1' to start a file carve","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"certificates","description":"Certificate Authorities installed in Keychains/ca-bundles.","platforms":["darwin","linux","windows"],"columns":[{"name":"common_name","description":"Certificate CommonName","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subject","description":"Certificate distinguished name (deprecated, use subject2)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"issuer","description":"Certificate issuer distinguished name (deprecated, use issuer2)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ca","description":"1 if CA: true (certificate is an authority) else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"self_signed","description":"1 if self-signed, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"not_valid_before","description":"Lower bound of valid date","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"not_valid_after","description":"Certificate expiration data","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"signing_algorithm","description":"Signing algorithm used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key_algorithm","description":"Key algorithm used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key_strength","description":"Key size used for RSA/DSA, or curve name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key_usage","description":"Certificate key usage and extended key usage","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subject_key_id","description":"SKID an optionally included SHA1","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"authority_key_id","description":"AKID an optionally included SHA1","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha1","description":"SHA1 hash of the raw certificate contents","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to Keychain or PEM bundle","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial","description":"Certificate serial number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sid","description":"SID","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"store_location","description":"Certificate system store location","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"store","description":"Certificate system store","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"username","description":"Username","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"store_id","description":"Exists for service/user stores. Contains raw store id provided by WinAPI.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"issuer2","description":"Certificate issuer distinguished name","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux","darwin"]},{"name":"subject2","description":"Certificate distinguished name","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux","darwin"]}]},{"name":"chassis_info","description":"Display information pertaining to the chassis and its security status.","platforms":["windows"],"columns":[{"name":"audible_alarm","description":"If TRUE, the frame is equipped with an audible alarm.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"breach_description","description":"If provided, gives a more detailed description of a detected security breach.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"chassis_types","description":"A comma-separated list of chassis types, such as Desktop or Laptop.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"An extended description of the chassis if available.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"lock","description":"If TRUE, the frame is equipped with a lock.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"The manufacturer of the chassis.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model","description":"The model of the chassis.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"security_breach","description":"The physical status of the chassis such as Breach Successful, Breach Attempted, etc.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial","description":"The serial number of the chassis.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"smbios_tag","description":"The assigned asset tag number of the chassis.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sku","description":"The Stock Keeping Unit number if available.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"If available, gives various operational or nonoperational statuses such as OK, Degraded, and Pred Fail.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"visible_alarm","description":"If TRUE, the frame is equipped with a visual alarm.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"chocolatey_packages","description":"Chocolatey packages installed in a system.","platforms":["windows"],"columns":[{"name":"name","description":"Package display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Package-supplied version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"summary","description":"Package-supplied summary","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"author","description":"Optional package author","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"license","description":"License under which package is launched","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path at which this package resides","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"chrome_extension_content_scripts","description":"Chrome browser extension content scripts.","platforms":["darwin","linux","windows"],"columns":[{"name":"browser_type","description":"The browser type (Valid values: chrome, chromium, opera, yandex, brave)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"The local user that owns the extension","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"identifier","description":"Extension identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension-supplied version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"script","description":"The content script used by the extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"match","description":"The pattern that the script is matched against","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"profile_path","description":"The profile path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to extension folder","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"referenced","description":"1 if this extension is referenced by the Preferences file of the profile","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"chrome_extensions","description":"Chrome-based browser extensions.","platforms":["darwin","linux","windows"],"columns":[{"name":"browser_type","description":"The browser type (Valid values: chrome, chromium, opera, yandex, brave, edge, edge_beta)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"The local user that owns the extension","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Extension display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"profile","description":"The name of the Chrome profile that contains this extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"profile_path","description":"The profile path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"referenced_identifier","description":"Extension identifier, as specified by the preferences file. Empty if the extension is not in the profile.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Extension identifier, computed from its manifest. Empty in case of error.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension-supplied version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Extension-optional description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"default_locale","description":"Default locale supported by extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"current_locale","description":"Current locale supported by extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"update_url","description":"Extension-supplied update URI","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"author","description":"Optional extension author","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"persistent","description":"1 If extension is persistent across all tabs else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to extension folder","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"permissions","description":"The permissions required by the extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"permissions_json","description":"The JSON-encoded permissions required by the extension","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"optional_permissions","description":"The permissions optionally required by the extensions","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"optional_permissions_json","description":"The JSON-encoded permissions optionally required by the extensions","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"manifest_hash","description":"The SHA256 hash of the manifest.json file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"referenced","description":"1 if this extension is referenced by the Preferences file of the profile","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"from_webstore","description":"True if this extension was installed from the web store","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"1 if this extension is enabled","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_time","description":"Extension install time, in its original Webkit format","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_timestamp","description":"Extension install time, converted to unix time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"manifest_json","description":"The manifest file of the extension","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"key","description":"The extension key, from the manifest file","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"connectivity","description":"Provides the overall system's network state.","platforms":["windows"],"columns":[{"name":"disconnected","description":"True if the all interfaces are not connected to any network","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv4_no_traffic","description":"True if any interface is connected via IPv4, but has seen no traffic","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv6_no_traffic","description":"True if any interface is connected via IPv6, but has seen no traffic","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv4_subnet","description":"True if any interface is connected to the local subnet via IPv4","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv4_local_network","description":"True if any interface is connected to a routed network via IPv4","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv4_internet","description":"True if any interface is connected to the Internet via IPv4","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv6_subnet","description":"True if any interface is connected to the local subnet via IPv6","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv6_local_network","description":"True if any interface is connected to a routed network via IPv6","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv6_internet","description":"True if any interface is connected to the Internet via IPv6","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"cpu_info","description":"Retrieve cpu hardware info of the machine.","platforms":["linux","windows"],"columns":[{"name":"device_id","description":"The DeviceID of the CPU.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model","description":"The model of the CPU.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"The manufacturer of the CPU.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"processor_type","description":"The processor type, such as Central, Math, or Video.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_status","description":"The current operating status of the CPU.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"number_of_cores","description":"The number of cores of the CPU.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"logical_processors","description":"The number of logical processors of the CPU.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"address_width","description":"The width of the CPU address bus.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"current_clock_speed","description":"The current frequency of the CPU.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"max_clock_speed","description":"The maximum possible frequency of the CPU.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"socket_designation","description":"The assigned socket on the board for the given CPU.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"availability","description":"The availability and status of the CPU.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]}]},{"name":"cpu_time","description":"Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.","platforms":["darwin","linux"],"columns":[{"name":"core","description":"Name of the cpu (core)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"user","description":"Time spent in user mode","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"nice","description":"Time spent in user mode with low priority (nice)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"system","description":"Time spent in system mode","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"idle","description":"Time spent in the idle task","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"iowait","description":"Time spent waiting for I/O to complete","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"irq","description":"Time spent servicing interrupts","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"softirq","description":"Time spent servicing softirqs","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"steal","description":"Time spent in other operating systems when running in a virtualized environment","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"guest","description":"Time spent running a virtual CPU for a guest OS under the control of the Linux kernel","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"guest_nice","description":"Time spent running a niced guest ","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"cpuid","description":"Useful CPU features from the cpuid ASM call.","platforms":["darwin","linux","windows"],"columns":[{"name":"feature","description":"Present feature flags","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Bit value or string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"output_register","description":"Register used to for feature value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"output_bit","description":"Bit in register value for feature value","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"input_eax","description":"Value of EAX used","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"crashes","description":"Application, System, and Mobile App crash logs.","platforms":["darwin"],"columns":[{"name":"type","description":"Type of crash log","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID of the crashed process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"crash_path","description":"Location of log file","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"identifier","description":"Identifier of the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Version info of the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent PID of the crashed process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"responsible","description":"Process responsible for the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID of the crashed process","type":"integer","notes":"","hidden":false,"required":false,"index":true},{"name":"datetime","description":"Date/Time at which the crash occurred","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"crashed_thread","description":"Thread ID which crashed","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"stack_trace","description":"Most recent frame from the stack trace","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"exception_type","description":"Exception type of the crash","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"exception_codes","description":"Exception codes from the crash","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"exception_notes","description":"Exception notes from the crash","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"registers","description":"The value of the system registers","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"crontab","description":"Line parsed values from system and user cron/tab.","platforms":["darwin","linux"],"columns":[{"name":"event","description":"The job @event name (rare)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"minute","description":"The exact minute for the job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hour","description":"The hour of the day for the job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"day_of_month","description":"The day of the month for the job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"month","description":"The month of the year for the job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"day_of_week","description":"The day of the week for the job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"command","description":"Raw command string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"File parsed","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"cups_destinations","description":"Returns all configured printers.","platforms":["darwin"],"columns":[{"name":"name","description":"Name of the printer","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"option_name","description":"Option name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"option_value","description":"Option value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"cups_jobs","description":"Returns all completed print jobs from cups.","platforms":["darwin"],"columns":[{"name":"title","description":"Title of the printed job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"destination","description":"The printer the job was sent to","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user","description":"The user who printed the job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"format","description":"The format of the print job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"The size of the print job","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"completed_time","description":"When the job completed printing","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"processing_time","description":"How long the job took to process","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"creation_time","description":"When the print request was initiated","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"curl","description":"Perform an http request and return stats about it.","platforms":["darwin","linux","windows"],"columns":[{"name":"url","description":"The url for the request","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"method","description":"The HTTP method for the request","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user_agent","description":"The user-agent string to use for the request","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"response_code","description":"The HTTP status code for the response","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"round_trip_time","description":"Time taken to complete the request","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"bytes","description":"Number of bytes in the response","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"result","description":"The HTTP response body","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"curl_certificate","description":"Inspect TLS certificates by connecting to input hostnames.","platforms":["darwin","linux","windows"],"columns":[{"name":"hostname","description":"Hostname to CURL (domain[:port], e.g. osquery.io)","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"common_name","description":"Common name of company issued to","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"organization","description":"Organization issued to","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"organization_unit","description":"Organization unit issued to","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial_number","description":"Certificate serial number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"issuer_common_name","description":"Issuer common name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"issuer_organization","description":"Issuer organization","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"issuer_organization_unit","description":"Issuer organization unit","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"valid_from","description":"Period of validity start date","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"valid_to","description":"Period of validity end date","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha256_fingerprint","description":"SHA-256 fingerprint","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha1_fingerprint","description":"SHA1 fingerprint","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Version Number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"signature_algorithm","description":"Signature Algorithm","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"signature","description":"Signature","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subject_key_identifier","description":"Subject Key Identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"authority_key_identifier","description":"Authority Key Identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key_usage","description":"Usage of key in certificate","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"extended_key_usage","description":"Extended usage of key in certificate","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"policies","description":"Certificate Policies","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subject_alternative_names","description":"Subject Alternative Name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"issuer_alternative_names","description":"Issuer Alternative Name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"info_access","description":"Authority Information Access","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subject_info_access","description":"Subject Information Access","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"policy_mappings","description":"Policy Mappings","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"has_expired","description":"1 if the certificate has expired, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"basic_constraint","description":"Basic Constraints","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name_constraints","description":"Name Constraints","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"policy_constraints","description":"Policy Constraints","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dump_certificate","description":"Set this value to '1' to dump certificate","type":"integer","notes":"","hidden":true,"required":false,"index":false},{"name":"timeout","description":"Set this value to the timeout in seconds to complete the TLS handshake (default 4s, use 0 for no timeout)","type":"integer","notes":"","hidden":true,"required":false,"index":false},{"name":"pem","description":"Certificate PEM format","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"deb_packages","description":"The installed DEB package database.","platforms":["linux"],"columns":[{"name":"name","description":"Package name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Package version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Package source","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Package size in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"arch","description":"Package architecture","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"revision","description":"Package revision","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Package status","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"maintainer","description":"Package maintainer","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"section","description":"Package section","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"priority","description":"Package priority","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"admindir","description":"libdpkg admindir. Defaults to /var/lib/dpkg","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"default_environment","description":"Default environment variables and values.","platforms":["windows"],"columns":[{"name":"variable","description":"Name of the environment variable","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Value of the environment variable","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"expand","description":"1 if the variable needs expanding, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"device_file","description":"Similar to the file table, but use TSK and allow block address access.","platforms":["darwin","linux"],"columns":[{"name":"device","description":"Absolute file path to device node","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"partition","description":"A partition number","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"path","description":"A logical path within the device node","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"filename","description":"Name portion of file path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"inode","description":"Filesystem inode number","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"uid","description":"Owning user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Owning group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"Permission bits","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of file in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"block_size","description":"Block size of filesystem","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"atime","description":"Last access time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Last modification time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Creation time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"hard_links","description":"Number of hard links","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"File status","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"device_firmware","description":"A best-effort list of discovered firmware versions.","platforms":["darwin"],"columns":[{"name":"type","description":"Type of device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"device","description":"The device name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"version","description":"Firmware version","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"device_hash","description":"Similar to the hash table, but use TSK and allow block address access.","platforms":["darwin","linux"],"columns":[{"name":"device","description":"Absolute file path to device node","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"partition","description":"A partition number","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"inode","description":"Filesystem inode number","type":"bigint","notes":"","hidden":false,"required":true,"index":false},{"name":"md5","description":"MD5 hash of provided inode data","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha1","description":"SHA1 hash of provided inode data","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha256","description":"SHA256 hash of provided inode data","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"device_partitions","description":"Use TSK to enumerate details about partitions on a disk device.","platforms":["darwin","linux"],"columns":[{"name":"device","description":"Absolute file path to device node","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"partition","description":"A partition number or description","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"label","description":"","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"offset","description":"","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"blocks_size","description":"Byte size of each block","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"blocks","description":"Number of blocks","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inodes","description":"Number of meta nodes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"flags","description":"","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"disk_encryption","description":"Disk encryption status and information.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Disk name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"uuid","description":"Disk Universally Unique Identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"encrypted","description":"1 If encrypted: true (disk is encrypted), else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Description of cipher type and mode if available","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"encryption_status","description":"Disk encryption status with one of following values: encrypted | not encrypted | undefined","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"Currently authenticated user if available","type":"text","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"user_uuid","description":"UUID of authenticated user if available","type":"text","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"filevault_status","description":"FileVault status with one of following values: on | off | unknown","type":"text","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]}]},{"name":"disk_events","description":"Track DMG disk image events (appearance/disappearance) when opened.","platforms":["darwin"],"columns":[{"name":"action","description":"Appear or disappear","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of the DMG file accessed","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Disk event name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"device","description":"Disk event BSD name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uuid","description":"UUID of the volume inside DMG if available","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of partition in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ejectable","description":"1 if ejectable, 0 if not","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"mountable","description":"1 if mountable, 0 if not","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"writable","description":"1 if writable, 0 if not","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"content","description":"Disk event content","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"media_name","description":"Disk event media name string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor","description":"Disk event vendor string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"filesystem","description":"Filesystem if available","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"checksum","description":"UDIF Master checksum if available (CRC32)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of appearance/disappearance in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"disk_info","description":"Retrieve basic information about the physical disks of a system.","platforms":["windows"],"columns":[{"name":"partitions","description":"Number of detected partitions on disk.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"disk_index","description":"Physical drive number of the disk.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"The interface type of the disk.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"id","description":"The unique identifier of the drive on the system.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pnp_device_id","description":"The unique identifier of the drive on the system.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"disk_size","description":"Size of the disk.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"The manufacturer of the disk.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hardware_model","description":"Hard drive model.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"The label of the disk object.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial","description":"The serial number of the disk.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"The OS's description of the disk.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"dns_cache","description":"Enumerate the DNS cache using the undocumented DnsGetCacheDataTable function in dnsapi.dll.","platforms":["windows"],"columns":[{"name":"name","description":"DNS record name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"DNS record type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"flags","description":"DNS record flags","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"dns_resolvers","description":"Resolvers used by this host.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Address type index or order","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Address type: sortlist, nameserver, search","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"address","description":"Resolver IP/IPv6 address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"netmask","description":"Address (sortlist) netmask length","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"options","description":"Resolver options","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"docker_container_envs","description":"Docker container environment variables.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"key","description":"Environment variable name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Environment variable value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_container_fs_changes","description":"Changes to files or directories on container's filesystem.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"path","description":"FIle or directory path relative to rootfs","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"change_type","description":"Type of change: C:Modified, A:Added, D:Deleted","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_container_labels","description":"Docker container labels.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"key","description":"Label key","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"value","description":"Optional label value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_container_mounts","description":"Docker container mounts.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"type","description":"Type of mount (bind, volume)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Optional mount name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"source","description":"Source path on host","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"destination","description":"Destination path inside container","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"driver","description":"Driver providing the mount","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"Mount options (rw, ro)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"rw","description":"1 if read/write. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"propagation","description":"Mount propagation","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_container_networks","description":"Docker container networks.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Network name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"network_id","description":"Network ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"endpoint_id","description":"Endpoint ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"gateway","description":"Gateway","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ip_address","description":"IP address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ip_prefix_len","description":"IP subnet prefix length","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv6_gateway","description":"IPv6 gateway","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv6_address","description":"IPv6 address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv6_prefix_len","description":"IPv6 subnet prefix length","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"mac_address","description":"MAC address","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_container_ports","description":"Docker container ports.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Protocol (tcp, udp)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"port","description":"Port inside the container","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"host_ip","description":"Host IP address on which public port is listening","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"host_port","description":"Host port","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_container_processes","description":"Docker container processes.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"pid","description":"Process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"The process path or shorthand argv[0]","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Complete argv","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"Process state","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"euid","description":"Effective user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"egid","description":"Effective group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"suid","description":"Saved user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sgid","description":"Saved group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"wired_size","description":"Bytes of unpageable memory used by process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"resident_size","description":"Bytes of private memory used by process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"total_size","description":"Total virtual memory size","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"start_time","description":"Process start in seconds since boot (non-sleeping)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Process parent's PID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pgroup","description":"Process group","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"threads","description":"Number of threads used by process","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"nice","description":"Process nice level (-20 to 20, default 0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"user","description":"User name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Cumulative CPU time. [DD-]HH:MM:SS format","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu","description":"CPU utilization as percentage","type":"double","notes":"","hidden":false,"required":false,"index":false},{"name":"mem","description":"Memory utilization as percentage","type":"double","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_container_stats","description":"Docker container statistics. Queries on this table take at least one second.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"name","description":"Container name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"pids","description":"Number of processes","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"read","description":"UNIX time when stats were read","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"preread","description":"UNIX time when stats were last read","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"interval","description":"Difference between read and preread in nano-seconds","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"disk_read","description":"Total disk read bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"disk_write","description":"Total disk write bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"num_procs","description":"Number of processors","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_total_usage","description":"Total CPU usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_kernelmode_usage","description":"CPU kernel mode usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_usermode_usage","description":"CPU user mode usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"system_cpu_usage","description":"CPU system usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"online_cpus","description":"Online CPUs","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"pre_cpu_total_usage","description":"Last read total CPU usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pre_cpu_kernelmode_usage","description":"Last read CPU kernel mode usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pre_cpu_usermode_usage","description":"Last read CPU user mode usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pre_system_cpu_usage","description":"Last read CPU system usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pre_online_cpus","description":"Last read online CPUs","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_usage","description":"Memory usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_max_usage","description":"Memory maximum usage","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_limit","description":"Memory limit","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"network_rx_bytes","description":"Total network bytes read","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"network_tx_bytes","description":"Total network bytes transmitted","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_containers","description":"Docker containers information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Container ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Container name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"image","description":"Docker image (name) used to launch this container","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"image_id","description":"Docker image ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"command","description":"Command with arguments","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"created","description":"Time of creation as UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"Container state (created, restarting, running, removing, paused, exited, dead)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Container status information","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Identifier of the initial process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Container path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"config_entrypoint","description":"Container entrypoint(s)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"started_at","description":"Container start time as string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"finished_at","description":"Container finish time as string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"privileged","description":"Is the container privileged","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"security_options","description":"List of container security options","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"env_variables","description":"Container environmental variables","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"readonly_rootfs","description":"Is the root filesystem mounted as read only","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cgroup_namespace","description":"cgroup namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"ipc_namespace","description":"IPC namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"mnt_namespace","description":"Mount namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"net_namespace","description":"Network namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"pid_namespace","description":"PID namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"user_namespace","description":"User namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"uts_namespace","description":"UTS namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"docker_image_history","description":"Docker image history information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Image ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"created","description":"Time of creation as UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of instruction in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"created_by","description":"Created by instruction","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"tags","description":"Comma-separated list of tags","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"comment","description":"Instruction comment","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_image_labels","description":"Docker image labels.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Image ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"key","description":"Label key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Optional label value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_image_layers","description":"Docker image layers information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Image ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"layer_id","description":"Layer ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"layer_order","description":"Layer Order (1 = base layer)","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_images","description":"Docker images information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Image ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"created","description":"Time of creation as UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"size_bytes","description":"Size of image in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"tags","description":"Comma-separated list of repository tags","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_info","description":"Docker system information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Docker system ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"containers","description":"Total number of containers","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"containers_running","description":"Number of containers currently running","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"containers_paused","description":"Number of containers in paused state","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"containers_stopped","description":"Number of containers in stopped state","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"images","description":"Number of images","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"storage_driver","description":"Storage driver","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_limit","description":"1 if memory limit support is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"swap_limit","description":"1 if swap limit support is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"kernel_memory","description":"1 if kernel memory limit support is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_cfs_period","description":"1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_cfs_quota","description":"1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_shares","description":"1 if CPU share weighting support is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_set","description":"1 if CPU set selection support is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv4_forwarding","description":"1 if IPv4 forwarding is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"bridge_nf_iptables","description":"1 if bridge netfilter iptables is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"bridge_nf_ip6tables","description":"1 if bridge netfilter ip6tables is enabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"oom_kill_disable","description":"1 if Out-of-memory kill is disabled. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"logging_driver","description":"Logging driver","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cgroup_driver","description":"Control groups driver","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"kernel_version","description":"Kernel version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"os","description":"Operating system","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"os_type","description":"Operating system type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"architecture","description":"Hardware architecture","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cpus","description":"Number of CPUs","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"memory","description":"Total memory","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"http_proxy","description":"HTTP proxy","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"https_proxy","description":"HTTPS proxy","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"no_proxy","description":"Comma-separated list of domain extensions proxy should not be used for","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the docker host","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"server_version","description":"Server version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"root_dir","description":"Docker root directory","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_network_labels","description":"Docker network labels.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Network ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"key","description":"Label key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Optional label value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_networks","description":"Docker networks information.","platforms":["darwin","linux"],"columns":[{"name":"id","description":"Network ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Network name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"driver","description":"Network driver","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"created","description":"Time of creation as UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"enable_ipv6","description":"1 if IPv6 is enabled on this network. 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"subnet","description":"Network subnet","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"gateway","description":"Network gateway","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_version","description":"Docker version information.","platforms":["darwin","linux"],"columns":[{"name":"version","description":"Docker version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"api_version","description":"API version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"min_api_version","description":"Minimum API version supported","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"git_commit","description":"Docker build git commit","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"go_version","description":"Go version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"os","description":"Operating system","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"arch","description":"Hardware architecture","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"kernel_version","description":"Kernel version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"build_time","description":"Build time","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_volume_labels","description":"Docker volume labels.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Volume name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"key","description":"Label key","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"value","description":"Optional label value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"docker_volumes","description":"Docker volumes information.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Volume name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"driver","description":"Volume driver","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mount_point","description":"Mount point","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Volume type","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"drivers","description":"Details for in-use Windows device drivers. This does not display installed but unused drivers.","platforms":["windows"],"columns":[{"name":"device_id","description":"Device ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"device_name","description":"Device name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"image","description":"Path to driver image file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Driver description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"service","description":"Driver service name, if one exists","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"service_key","description":"Driver service registry key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Driver version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"inf","description":"Associated inf file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"Device/driver class name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"provider","description":"Driver provider","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"Device manufacturer","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"driver_key","description":"Driver key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"date","description":"Driver date","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"signed","description":"Whether the driver is signed or not","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"ec2_instance_metadata","description":"EC2 instance metadata.","platforms":["darwin","linux","windows"],"columns":[{"name":"instance_id","description":"EC2 instance ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"instance_type","description":"EC2 instance type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"architecture","description":"Hardware architecture of this EC2 instance","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"region","description":"AWS region in which this instance launched","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"availability_zone","description":"Availability zone in which this instance launched","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_hostname","description":"Private IPv4 DNS hostname of the first interface of this instance","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_ipv4","description":"Private IPv4 address of the first interface of this instance","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mac","description":"MAC address for the first network interface of this EC2 instance","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"security_groups","description":"Comma separated list of security group names","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"iam_arn","description":"If there is an IAM role associated with the instance, contains instance profile ARN","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ami_id","description":"AMI ID used to launch this EC2 instance","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"reservation_id","description":"ID of the reservation","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"account_id","description":"AWS account ID which owns this EC2 instance","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ssh_public_key","description":"SSH public key. Only available if supplied at instance launch time","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"ec2_instance_tags","description":"EC2 instance tag key value pairs.","platforms":["darwin","linux","windows"],"columns":[{"name":"instance_id","description":"EC2 instance ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key","description":"Tag key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Tag value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"es_process_events","description":"Process execution events from EndpointSecurity.","platforms":["darwin"],"columns":[{"name":"version","description":"Version of EndpointSecurity event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"seq_num","description":"Per event sequence number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"global_seq_num","description":"Global sequence number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"original_parent","description":"Original parent process ID in case of reparenting","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Command line arguments (argv)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cmdline_count","description":"Number of command line arguments","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"env","description":"Environment variables delimited by spaces","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"env_count","description":"Number of environment variables","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"cwd","description":"The process current working directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID of the process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"euid","description":"Effective User ID of the process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID of the process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"egid","description":"Effective Group ID of the process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"Username","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"signing_id","description":"Signature identifier of the process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"team_id","description":"Team identifier of thd process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cdhash","description":"Codesigning hash of the process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"platform_binary","description":"Indicates if the binary is Apple signed binary (1) or not (0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"exit_code","description":"Exit code of a process in case of an exit event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"child_pid","description":"Process ID of a child process in case of a fork event","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"event_type","description":"Type of EndpointSecurity event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"codesigning_flags","description":"Codesigning flags matching one of these options, in a comma separated list: NOT_VALID, ADHOC, NOT_RUNTIME, INSTALLER. See kern/cs_blobs.h in XNU for descriptions.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"es_process_file_events","description":"Process execution events from EndpointSecurity.","platforms":["darwin"],"columns":[{"name":"version","description":"Version of EndpointSecurity event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"seq_num","description":"Per event sequence number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"global_seq_num","description":"Global sequence number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"filename","description":"The source or target filename for the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dest_filename","description":"Destination filename for the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"event_type","description":"Type of EndpointSecurity event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"etc_hosts","description":"Line-parsed /etc/hosts.","platforms":["darwin","linux","windows"],"columns":[{"name":"address","description":"IP address mapping","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hostnames","description":"Raw hosts mapping","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"etc_protocols","description":"Line-parsed /etc/protocols.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Protocol name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"number","description":"Protocol number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"alias","description":"Protocol alias","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"comment","description":"Comment with protocol description","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"etc_services","description":"Line-parsed /etc/services.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Service name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"port","description":"Service port number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"protocol","description":"Transport protocol (TCP/UDP)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"aliases","description":"Optional space separated list of other names for a service","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"comment","description":"Optional comment for a service.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"event_taps","description":"Returns information about installed event taps.","platforms":["darwin"],"columns":[{"name":"enabled","description":"Is the Event Tap enabled","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"event_tap_id","description":"Unique ID for the Tap","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"event_tapped","description":"The mask that identifies the set of events to be observed.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"process_being_tapped","description":"The process ID of the target application","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"tapping_process","description":"The process ID of the application that created the event tap.","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"extended_attributes","description":"Returns the extended attributes for files (similar to Windows ADS).","platforms":["darwin","linux"],"columns":[{"name":"path","description":"Absolute file path","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"directory","description":"Directory of file(s)","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"key","description":"Name of the value generated from the extended attribute","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"The parsed information from the attribute","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"base64","description":"1 if the value is base64 encoded else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"fan_speed_sensors","description":"Fan speeds.","platforms":["darwin"],"columns":[{"name":"fan","description":"Fan number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Fan name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"actual","description":"Actual speed","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"min","description":"Minimum speed","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"max","description":"Maximum speed","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"target","description":"Target speed","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"file","description":"Interactive filesystem attributes and metadata.","platforms":["darwin","linux","windows"],"columns":[{"name":"path","description":"Absolute file path","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"directory","description":"Directory of file(s)","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"filename","description":"Name portion of file path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"inode","description":"Filesystem inode number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"Owning user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Owning group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"Permission bits","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"device","description":"Device ID (optional)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of file in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"block_size","description":"Block size of filesystem","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"atime","description":"Last access time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Last modification time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Last status change time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"btime","description":"(B)irth or (cr)eate time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"hard_links","description":"Number of hard links","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"symlink","description":"1 if the path is a symlink, otherwise 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"File status","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"attributes","description":"File attrib string. See: https://ss64.com/nt/attrib.html","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"volume_serial","description":"Volume serial number","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"file_id","description":"file ID","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"file_version","description":"File version","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"product_version","description":"File product version","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"original_filename","description":"(Executable files only) Original filename","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"bsd_flags","description":"The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND","type":"text","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"file_events","description":"Track time/action changes to files specified in configuration data.","platforms":["darwin","linux"],"columns":[{"name":"target_path","description":"The path associated with the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"category","description":"The category of the file defined in the config","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"action","description":"Change action (UPDATE, REMOVE, etc)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"transaction_id","description":"ID used during bulk update","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inode","description":"Filesystem inode number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"Owning user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Owning group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"Permission bits","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of file in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"atime","description":"Last access time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Last modification time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Last status change time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"md5","description":"The MD5 of the file after change","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha1","description":"The SHA1 of the file after change","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha256","description":"The SHA256 of the file after change","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hashed","description":"1 if the file was hashed, 0 if not, -1 if hashing failed","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of file event","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"firefox_addons","description":"Firefox browser extensions, webapps, and addons.","platforms":["darwin","linux","windows"],"columns":[{"name":"uid","description":"The local user that owns the addon","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Addon display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Addon identifier","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"creator","description":"Addon-supported creator string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Extension, addon, webapp","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Addon-supplied version string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Addon-supplied description string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source_url","description":"URL that installed the addon","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"visible","description":"1 If the addon is shown in browser else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"active","description":"1 If the addon is active else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"disabled","description":"1 If the addon is application-disabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"autoupdate","description":"1 If the addon applies background updates else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"location","description":"Global, profile location","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to plugin bundle","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"gatekeeper","description":"macOS Gatekeeper Details.","platforms":["darwin"],"columns":[{"name":"assessments_enabled","description":"1 If a Gatekeeper is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"dev_id_enabled","description":"1 If a Gatekeeper allows execution from identified developers else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Version of Gatekeeper's gke.bundle","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"opaque_version","description":"Version of Gatekeeper's gkopaque.bundle","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"gatekeeper_approved_apps","description":"Gatekeeper apps a user has allowed to run.","platforms":["darwin"],"columns":[{"name":"path","description":"Path of executable allowed to run","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"requirement","description":"Code signing requirement language","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Last change time","type":"double","notes":"","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Last modification time","type":"double","notes":"","hidden":false,"required":false,"index":false}]},{"name":"groups","description":"Local system groups.","platforms":["darwin","linux","windows"],"columns":[{"name":"gid","description":"Unsigned int64 group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"gid_signed","description":"A signed int64 version of gid","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"groupname","description":"Canonical local group name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"group_sid","description":"Unique group ID","type":"text","notes":"","hidden":true,"required":false,"index":true,"platforms":["windows","win32","cygwin"]},{"name":"comment","description":"Remarks or comments associated with the group","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"is_hidden","description":"IsHidden attribute set in OpenDirectory","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"hardware_events","description":"Hardware (PCI/USB/HID) events from UDEV or IOKit.","platforms":["darwin","linux"],"columns":[{"name":"action","description":"Remove, insert, change properties, etc","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Local device path assigned (optional)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of hardware and hardware event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"driver","description":"Driver claiming the device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor","description":"Hardware device vendor","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor_id","description":"Hex encoded Hardware vendor identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model","description":"Hardware device model","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model_id","description":"Hex encoded Hardware model identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial","description":"Device serial (optional)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"revision","description":"Device revision (optional)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of hardware event","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"hash","description":"Filesystem hash data.","platforms":["darwin","linux","windows"],"columns":[{"name":"path","description":"Must provide a path or directory","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"directory","description":"Must provide a path or directory","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"md5","description":"MD5 hash of provided filesystem data","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha1","description":"SHA1 hash of provided filesystem data","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sha256","description":"SHA256 hash of provided filesystem data","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"homebrew_packages","description":"The installed homebrew package database.","platforms":["darwin"],"columns":[{"name":"name","description":"Package name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Package install path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Current 'linked' version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"prefix","description":"Homebrew install prefix","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"hvci_status","description":"Retrieve HVCI info of the machine.","platforms":["windows"],"columns":[{"name":"version","description":"The version number of the Device Guard build.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"instance_identifier","description":"The instance ID of Device Guard.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vbs_status","description":"The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"code_integrity_policy_enforcement_status","description":"The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"umci_policy_status","description":"The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"ibridge_info","description":"Information about the Apple iBridge hardware controller.","platforms":["darwin"],"columns":[{"name":"boot_uuid","description":"Boot UUID of the iBridge controller","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"coprocessor_version","description":"The manufacturer and chip version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"firmware_version","description":"The build version of the firmware","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"unique_chip_id","description":"Unique id of the iBridge controller","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"ie_extensions","description":"Internet Explorer browser extensions.","platforms":["windows"],"columns":[{"name":"name","description":"Extension display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"registry_path","description":"Extension identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Version of the executable","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to executable","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"intel_me_info","description":"Intel ME/CSE Info.","platforms":["linux","windows"],"columns":[{"name":"version","description":"Intel ME version","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"interface_addresses","description":"Network interfaces and relevant metadata.","platforms":["darwin","linux","windows"],"columns":[{"name":"interface","description":"Interface name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"address","description":"Specific address for interface","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mask","description":"Interface netmask","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"broadcast","description":"Broadcast address for the interface","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"point_to_point","description":"PtP address for the interface","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of address. One of dhcp, manual, auto, other, unknown","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"friendly_name","description":"The friendly display name of the interface.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]}]},{"name":"interface_details","description":"Detailed information and stats of network interfaces.","platforms":["darwin","linux","windows"],"columns":[{"name":"interface","description":"Interface name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mac","description":"MAC of interface (optional)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Interface type (includes virtual)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"mtu","description":"Network MTU","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"metric","description":"Metric based on the speed of the interface","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"flags","description":"Flags (netdevice) for the device","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipackets","description":"Input packets","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"opackets","description":"Output packets","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ibytes","description":"Input bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"obytes","description":"Output bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ierrors","description":"Input errors","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"oerrors","description":"Output errors","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"idrops","description":"Input drops","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"odrops","description":"Output drops","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"collisions","description":"Packet Collisions detected","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"last_change","description":"Time of last device modification (optional)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"link_speed","description":"Interface speed in Mb/s","type":"bigint","notes":"","hidden":false,"required":false,"index":false,"platforms":["linux","darwin"]},{"name":"pci_slot","description":"PCI slot number","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"friendly_name","description":"The friendly display name of the interface.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"description","description":"Short description of the object a one-line string.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"manufacturer","description":"Name of the network adapter's manufacturer.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"connection_id","description":"Name of the network connection as it appears in the Network Connections Control Panel program.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"connection_status","description":"State of the network adapter connection to the network.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"enabled","description":"Indicates whether the adapter is enabled or not.","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"physical_adapter","description":"Indicates whether the adapter is a physical or a logical adapter.","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"speed","description":"Estimate of the current bandwidth in bits per second.","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"service","description":"The name of the service the network adapter uses.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"dhcp_enabled","description":"If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection.","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"dhcp_lease_expires","description":"Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"dhcp_lease_obtained","description":"Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"dhcp_server","description":"IP address of the dynamic host configuration protocol (DHCP) server.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"dns_domain","description":"Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"dns_domain_suffix_search_order","description":"Array of DNS domain suffixes to be appended to the end of host names during name resolution.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"dns_host_name","description":"Host name used to identify the local computer for authentication by some utilities.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"dns_server_search_order","description":"Array of server IP addresses to be used in querying for DNS servers.","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]}]},{"name":"interface_ipv6","description":"IPv6 configuration and stats of network interfaces.","platforms":["darwin","linux"],"columns":[{"name":"interface","description":"Interface name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hop_limit","description":"Current Hop Limit","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"forwarding_enabled","description":"Enable IP forwarding","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"redirect_accept","description":"Accept ICMP redirect messages","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"rtadv_accept","description":"Accept ICMP Router Advertisement","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"iokit_devicetree","description":"The IOKit registry matching the DeviceTree plane.","platforms":["darwin"],"columns":[{"name":"name","description":"Device node name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"Best matching device class (most-specific category)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"id","description":"IOKit internal registry ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent device registry ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"device_path","description":"Device tree path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"service","description":"1 if the device conforms to IOService else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"busy_state","description":"1 if the device is in a busy state else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"retain_count","description":"The device reference count","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"depth","description":"Device nested depth","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"iokit_registry","description":"The full IOKit registry without selecting a plane.","platforms":["darwin"],"columns":[{"name":"name","description":"Default name of the node","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"Best matching device class (most-specific category)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"id","description":"IOKit internal registry ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Parent registry ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"busy_state","description":"1 if the node is in a busy state else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"retain_count","description":"The node reference count","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"depth","description":"Node nested depth","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"iptables","description":"Linux IP packet filtering and NAT tool.","platforms":["linux"],"columns":[{"name":"filter_name","description":"Packet matching filter table name.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"chain","description":"Size of module content.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"policy","description":"Policy that applies for this rule.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"target","description":"Target that applies for this rule.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"protocol","description":"Protocol number identification.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"src_port","description":"Protocol source port(s).","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dst_port","description":"Protocol destination port(s).","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"src_ip","description":"Source IP address.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"src_mask","description":"Source IP address mask.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"iniface","description":"Input interface for the rule.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"iniface_mask","description":"Input interface mask for the rule.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dst_ip","description":"Destination IP address.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dst_mask","description":"Destination IP address mask.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"outiface","description":"Output interface for the rule.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"outiface_mask","description":"Output interface mask for the rule.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"match","description":"Matching rule that applies.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"packets","description":"Number of matching packets for this rule.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"bytes","description":"Number of matching bytes for this rule.","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"kernel_extensions","description":"macOS's kernel extensions, both loaded and within the load search path.","platforms":["darwin"],"columns":[{"name":"idx","description":"Extension load tag or index","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"refs","description":"Reference count","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Bytes of wired memory used by extension","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Extension label","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"linked_against","description":"Indexes of extensions this extension is linked against","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Optional path to extension bundle","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"kernel_info","description":"Basic active kernel information.","platforms":["darwin","linux","windows"],"columns":[{"name":"version","description":"Kernel version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"arguments","description":"Kernel arguments","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Kernel path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"device","description":"Kernel device identifier","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"kernel_modules","description":"Linux kernel modules both loaded and within the load search path.","platforms":["linux"],"columns":[{"name":"name","description":"Module name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of module content","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"used_by","description":"Module reverse dependencies","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Kernel module status","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"address","description":"Kernel module address","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"kernel_panics","description":"System kernel panic logs.","platforms":["darwin"],"columns":[{"name":"path","description":"Location of log file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Formatted time of the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"registers","description":"A space delimited line of register:value pairs","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"frame_backtrace","description":"Backtrace of the crashed module","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"module_backtrace","description":"Modules appearing in the crashed module's backtrace","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dependencies","description":"Module dependencies existing in crashed module's backtrace","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Process name corresponding to crashed thread","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"os_version","description":"Version of the operating system","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"kernel_version","description":"Version of the system kernel","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"system_model","description":"Physical system model, for example 'MacBookPro12,1 (Mac-E43C1C25D4880AD6)'","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uptime","description":"System uptime at kernel panic in nanoseconds","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"last_loaded","description":"Last loaded module before panic","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_unloaded","description":"Last unloaded module before panic","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"keychain_acls","description":"Applications that have ACL entries in the keychain.","platforms":["darwin"],"columns":[{"name":"keychain_path","description":"The path of the keychain","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"authorizations","description":"A space delimited set of authorization attributes","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"The path of the authorized application","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"The description included with the ACL entry","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"label","description":"An optional label tag that may be included with the keychain entry","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"keychain_items","description":"Generic details about keychain items.","platforms":["darwin"],"columns":[{"name":"label","description":"Generic item name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Optional item description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"comment","description":"Optional keychain comment","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"account","description":"Optional item account","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"created","description":"Date item was created","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"modified","description":"Date of last modification","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Keychain item type (class)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to keychain containing item","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"known_hosts","description":"A line-delimited known_hosts table.","platforms":["darwin","linux"],"columns":[{"name":"uid","description":"The local user that owns the known_hosts file","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"key","description":"parsed authorized keys line","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key_file","description":"Path to known_hosts file","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"kva_speculative_info","description":"Display kernel virtual address and speculative execution information for the system.","platforms":["windows"],"columns":[{"name":"kva_shadow_enabled","description":"Kernel Virtual Address shadowing is enabled.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"kva_shadow_user_global","description":"User pages are marked as global.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"kva_shadow_pcid","description":"Kernel VA PCID flushing optimization is enabled.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"kva_shadow_inv_pcid","description":"Kernel VA INVPCID is enabled.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"bp_mitigations","description":"Branch Prediction mitigations are enabled.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"bp_system_pol_disabled","description":"Branch Predictions are disabled via system policy.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"bp_microcode_disabled","description":"Branch Predictions are disabled due to lack of microcode update.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_spec_ctrl_supported","description":"SPEC_CTRL MSR supported by CPU Microcode.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ibrs_support_enabled","description":"Windows uses IBRS.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"stibp_support_enabled","description":"Windows uses STIBP.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_pred_cmd_supported","description":"PRED_CMD MSR supported by CPU Microcode.","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"last","description":"System logins and logouts.","platforms":["darwin","linux"],"columns":[{"name":"username","description":"Entry username","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"tty","description":"Entry terminal","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Entry type, according to ut_type types (utmp.h)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type_name","description":"Entry type name, according to ut_type types (utmp.h)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Entry timestamp","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"host","description":"Entry hostname","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"launchd","description":"LaunchAgents and LaunchDaemons from default search paths.","platforms":["darwin"],"columns":[{"name":"path","description":"Path to daemon or agent plist","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"File name of plist (used by launchd)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"label","description":"Daemon or agent service name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"program","description":"Path to target program","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"run_at_load","description":"Should the program run on launch load","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"keep_alive","description":"Should the process be restarted if killed","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"on_demand","description":"Deprecated key, replaced by keep_alive","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"disabled","description":"Skip loading this daemon or agent on boot","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"Run this daemon or agent as this username","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"groupname","description":"Run this daemon or agent as this group","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"stdout_path","description":"Pipe stdout to a target path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"stderr_path","description":"Pipe stderr to a target path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"start_interval","description":"Frequency to run in seconds","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"program_arguments","description":"Command line arguments passed to program","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"watch_paths","description":"Key that launches daemon or agent if path is modified","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"queue_directories","description":"Similar to watch_paths but only with non-empty directories","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"inetd_compatibility","description":"Run this daemon or agent as it was launched from inetd","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"start_on_mount","description":"Run daemon or agent every time a filesystem is mounted","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"root_directory","description":"Key used to specify a directory to chroot to before launch","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"working_directory","description":"Key used to specify a directory to chdir to before launch","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"process_type","description":"Key describes the intended purpose of the job","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"launchd_overrides","description":"Override keys, per user, for LaunchDaemons and Agents.","platforms":["darwin"],"columns":[{"name":"label","description":"Daemon or agent service name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key","description":"Name of the override key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Overridden value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID applied to the override, 0 applies to all","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to daemon or agent plist","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"listening_ports","description":"Processes with listening (bound) network sockets/ports.","platforms":["darwin","linux","windows"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"port","description":"Transport layer port","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"protocol","description":"Transport protocol (TCP/UDP)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"family","description":"Network protocol (IPv4, IPv6)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"address","description":"Specific address for bind","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fd","description":"Socket file descriptor number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"socket","description":"Socket handle or inode number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path for UNIX domain sockets","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"net_namespace","description":"The inode number of the network namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"load_average","description":"Displays information about the system wide load averages.","platforms":["darwin","linux"],"columns":[{"name":"period","description":"Period over which the average is calculated.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"average","description":"Load average over the specified period.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"location_services","description":"Reports the status of the Location Services feature of the OS.","platforms":["darwin"],"columns":[{"name":"enabled","description":"1 if Location Services are enabled, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"logged_in_users","description":"Users with an active shell on the system.","platforms":["darwin","linux","windows"],"columns":[{"name":"type","description":"Login type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user","description":"User login name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"tty","description":"Device name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"host","description":"Remote hostname","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time entry was made","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"sid","description":"The user's unique security identifier","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"registry_hive","description":"HKEY_USERS registry hive","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]}]},{"name":"logical_drives","description":"Details for logical drives on the system. A logical drive generally represents a single partition.","platforms":["windows"],"columns":[{"name":"device_id","description":"The drive id, usually the drive name, e.g., 'C:'.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Deprecated (always 'Unknown').","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"The canonical description of the drive, e.g. 'Logical Fixed Disk', 'CD-ROM Disk'.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"free_space","description":"The amount of free space, in bytes, of the drive (-1 on failure).","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"The total amount of space, in bytes, of the drive (-1 on failure).","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"file_system","description":"The file system of the drive.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"boot_partition","description":"True if Windows booted from this drive.","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"logon_sessions","description":"Windows Logon Session.","platforms":["windows"],"columns":[{"name":"logon_id","description":"A locally unique identifier (LUID) that identifies a logon session.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"user","description":"The account name of the security principal that owns the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"logon_domain","description":"The name of the domain used to authenticate the owner of the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"authentication_package","description":"The authentication package used to authenticate the owner of the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"logon_type","description":"The logon method.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"session_id","description":"The Terminal Services session identifier.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"logon_sid","description":"The user's security identifier (SID).","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"logon_time","description":"The time the session owner logged on.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"logon_server","description":"The name of the server used to authenticate the owner of the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dns_domain_name","description":"The DNS name for the owner of the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"upn","description":"The user principal name (UPN) for the owner of the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"logon_script","description":"The script used for logging on.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"profile_path","description":"The home directory for the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"home_directory","description":"The home directory for the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"home_directory_drive","description":"The drive location of the home directory of the logon session.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_certificates","description":"LXD certificates information.","platforms":["linux"],"columns":[{"name":"name","description":"Name of the certificate","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of the certificate","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fingerprint","description":"SHA256 hash of the certificate","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"certificate","description":"Certificate content","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_cluster","description":"LXD cluster information.","platforms":["linux"],"columns":[{"name":"server_name","description":"Name of the LXD server node","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled","description":"Whether clustering enabled (1) or not (0) on this node","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"member_config_entity","description":"Type of configuration parameter for this node","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"member_config_name","description":"Name of configuration parameter","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"member_config_key","description":"Config key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"member_config_value","description":"Config value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"member_config_description","description":"Config description","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_cluster_members","description":"LXD cluster members information.","platforms":["linux"],"columns":[{"name":"server_name","description":"Name of the LXD server node","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"url","description":"URL of the node","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"database","description":"Whether the server is a database node (1) or not (0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Status of the node (Online/Offline)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"message","description":"Message from the node (Online/Offline)","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_images","description":"LXD images information.","platforms":["linux"],"columns":[{"name":"id","description":"Image ID","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"architecture","description":"Target architecture for the image","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"os","description":"OS on which image is based","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"release","description":"OS release version on which the image is based","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Image description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"aliases","description":"Comma-separated list of image aliases","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"filename","description":"Filename of the image file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of image in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"auto_update","description":"Whether the image auto-updates (1) or not (0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cached","description":"Whether image is cached (1) or not (0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"public","description":"Whether image is public (1) or not (0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"created_at","description":"ISO time of image creation","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"expires_at","description":"ISO time of image expiration","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uploaded_at","description":"ISO time of image upload","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_used_at","description":"ISO time for the most recent use of this image in terms of container spawn","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"update_source_server","description":"Server for image update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"update_source_protocol","description":"Protocol used for image information update and image import from source server","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"update_source_certificate","description":"Certificate for update source server","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"update_source_alias","description":"Alias of image at update source server","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_instance_config","description":"LXD instance configuration information.","platforms":["linux"],"columns":[{"name":"name","description":"Instance name","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"key","description":"Configuration parameter name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Configuration parameter value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_instance_devices","description":"LXD instance devices information.","platforms":["linux"],"columns":[{"name":"name","description":"Instance name","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"device","description":"Name of the device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"device_type","description":"Device type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key","description":"Device info param name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Device info param value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_instances","description":"LXD instances information.","platforms":["linux"],"columns":[{"name":"name","description":"Instance name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"status","description":"Instance state (running, stopped, etc.)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"stateful","description":"Whether the instance is stateful(1) or not(0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ephemeral","description":"Whether the instance is ephemeral(1) or not(0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"created_at","description":"ISO time of creation","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"base_image","description":"ID of image used to launch this instance","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"architecture","description":"Instance architecture","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"os","description":"The OS of this instance","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Instance description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Instance's process ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"processes","description":"Number of processes running inside this instance","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_networks","description":"LXD network information.","platforms":["linux"],"columns":[{"name":"name","description":"Name of the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"managed","description":"1 if network created by LXD, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv4_address","description":"IPv4 address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ipv6_address","description":"IPv6 address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"used_by","description":"URLs for containers using this network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bytes_received","description":"Number of bytes received on this network","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"bytes_sent","description":"Number of bytes sent on this network","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"packets_received","description":"Number of packets received on this network","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"packets_sent","description":"Number of packets sent on this network","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"hwaddr","description":"Hardware address for this network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"Network status","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mtu","description":"MTU size","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"lxd_storage_pools","description":"LXD storage pool information.","platforms":["linux"],"columns":[{"name":"name","description":"Name of the storage pool","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"driver","description":"Storage driver","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Storage pool source","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of the storage pool","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"space_used","description":"Storage space used in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"space_total","description":"Total available storage space in bytes for this storage pool","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inodes_used","description":"Number of inodes used","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inodes_total","description":"Total number of inodes available in this storage pool","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"magic","description":"Magic number recognition library table.","platforms":["darwin","linux"],"columns":[{"name":"path","description":"Absolute path to target file","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"magic_db_files","description":"Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"data","description":"Magic number data from libmagic","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mime_type","description":"MIME type data from libmagic","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mime_encoding","description":"MIME encoding data from libmagic","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"managed_policies","description":"The managed configuration policies from AD, MDM, MCX, etc.","platforms":["darwin"],"columns":[{"name":"domain","description":"System or manager-chosen domain key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Optional UUID assigned to policy set","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Policy key name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Policy value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"Policy applies only this user","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"manual","description":"1 if policy was loaded manually, otherwise 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"md_devices","description":"Software RAID array settings.","platforms":["linux"],"columns":[{"name":"device_name","description":"md device name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Current state of the array","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"raid_level","description":"Current raid level of the array","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"size of the array in blocks","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"chunk_size","description":"chunk size in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"raid_disks","description":"Number of configured RAID disks in array","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"nr_raid_disks","description":"Number of partitions or disk devices to comprise the array","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"working_disks","description":"Number of working disks in array","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"active_disks","description":"Number of active disks in array","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"failed_disks","description":"Number of failed disks in array","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"spare_disks","description":"Number of idle disks in array","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"superblock_state","description":"State of the superblock","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"superblock_version","description":"Version of the superblock","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"superblock_update_time","description":"Unix timestamp of last update","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"bitmap_on_mem","description":"Pages allocated in in-memory bitmap, if enabled","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bitmap_chunk_size","description":"Bitmap chunk size","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bitmap_external_file","description":"External referenced bitmap file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"recovery_progress","description":"Progress of the recovery activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"recovery_finish","description":"Estimated duration of recovery activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"recovery_speed","description":"Speed of recovery activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"resync_progress","description":"Progress of the resync activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"resync_finish","description":"Estimated duration of resync activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"resync_speed","description":"Speed of resync activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"reshape_progress","description":"Progress of the reshape activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"reshape_finish","description":"Estimated duration of reshape activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"reshape_speed","description":"Speed of reshape activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"check_array_progress","description":"Progress of the check array activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"check_array_finish","description":"Estimated duration of the check array activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"check_array_speed","description":"Speed of the check array activity","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"unused_devices","description":"Unused devices","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"other","description":"Other information associated with array from /proc/mdstat","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"md_drives","description":"Drive devices used for Software RAID.","platforms":["linux"],"columns":[{"name":"md_device_name","description":"md device name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"drive_name","description":"Drive device name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"slot","description":"Slot position of disk","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"State of the drive","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"md_personalities","description":"Software RAID setting supported by the kernel.","platforms":["linux"],"columns":[{"name":"name","description":"Name of personality supported by kernel","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"mdfind","description":"Run searches against the spotlight database.","platforms":["darwin"],"columns":[{"name":"path","description":"Path of the file returned from spotlight","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"query","description":"The query that was run to find the file","type":"text","notes":"","hidden":false,"required":true,"index":false}]},{"name":"mdls","description":"Query file metadata in the Spotlight database.","platforms":["darwin"],"columns":[{"name":"path","description":"Path of the file","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"key","description":"Name of the metadata key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Value stored in the metadata key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"valuetype","description":"CoreFoundation type of data stored in value","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"memory_array_mapped_addresses","description":"Data associated for address mapping of physical memory arrays.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the structure","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_array_handle","description":"Handle of the memory array associated with this structure","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"starting_address","description":"Physical stating address, in kilobytes, of a range of memory mapped to physical memory array","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ending_address","description":"Physical ending address of last kilobyte of a range of memory mapped to physical memory array","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"partition_width","description":"Number of memory devices that form a single row of memory for the address partition of this structure","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"memory_arrays","description":"Data associated with collection of memory devices that operate to form a memory address.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the array","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"location","description":"Physical location of the memory array","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"use","description":"Function for which the array is used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_error_correction","description":"Primary hardware error correction or detection method supported","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"max_capacity","description":"Maximum capacity of array in gigabytes","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_error_info_handle","description":"Handle, or instance number, associated with any error that was detected for the array","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"number_memory_devices","description":"Number of memory devices on array","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"memory_device_mapped_addresses","description":"Data associated for address mapping of physical memory devices.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the structure","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_device_handle","description":"Handle of the memory device structure associated with this structure","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_array_mapped_address_handle","description":"Handle of the memory array mapped address to which this device range is mapped to","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"starting_address","description":"Physical stating address, in kilobytes, of a range of memory mapped to physical memory array","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ending_address","description":"Physical ending address of last kilobyte of a range of memory mapped to physical memory array","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"partition_row_position","description":"Identifies the position of the referenced memory device in a row of the address partition","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"interleave_position","description":"The position of the device in a interleave, i.e. 0 indicates non-interleave, 1 indicates 1st interleave, 2 indicates 2nd interleave, etc.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"interleave_data_depth","description":"The max number of consecutive rows from memory device that are accessed in a single interleave transfer; 0 indicates device is non-interleave","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"memory_devices","description":"Physical memory device (type 17) information retrieved from SMBIOS.","platforms":["darwin","linux","windows"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the structure in SMBIOS","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"array_handle","description":"The memory array that the device is attached to","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"form_factor","description":"Implementation form factor for this memory device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"total_width","description":"Total width, in bits, of this memory device, including any check or error-correction bits","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"data_width","description":"Data width, in bits, of this memory device","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size of memory device in Megabyte","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"set","description":"Identifies if memory device is one of a set of devices.  A value of 0 indicates no set affiliation.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"device_locator","description":"String number of the string that identifies the physically-labeled socket or board position where the memory device is located","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bank_locator","description":"String number of the string that identifies the physically-labeled bank where the memory device is located","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_type","description":"Type of memory used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_type_details","description":"Additional details for memory device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"max_speed","description":"Max speed of memory device in megatransfers per second (MT/s)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"configured_clock_speed","description":"Configured speed of memory device in megatransfers per second (MT/s)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"Manufacturer ID string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial_number","description":"Serial number of memory device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"asset_tag","description":"Manufacturer specific asset tag of memory device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"part_number","description":"Manufacturer specific serial number of memory device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"min_voltage","description":"Minimum operating voltage of device in millivolts","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"max_voltage","description":"Maximum operating voltage of device in millivolts","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"configured_voltage","description":"Configured operating voltage of device in millivolts","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"memory_error_info","description":"Data associated with errors of a physical memory array.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the structure","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"error_type","description":"type of error associated with current error status for array or device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"error_granularity","description":"Granularity to which the error can be resolved","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"error_operation","description":"Memory access operation that caused the error","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor_syndrome","description":"Vendor specific ECC syndrome or CRC data associated with the erroneous access","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_array_error_address","description":"32 bit physical address of the error based on the addressing of the bus to which the memory array is connected","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"device_error_address","description":"32 bit physical address of the error relative to the start of the failing memory address, in bytes","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"error_resolution","description":"Range, in bytes, within which this error can be determined, when an error address is given","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"memory_info","description":"Main memory information in bytes.","platforms":["linux"],"columns":[{"name":"memory_total","description":"Total amount of physical RAM, in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_free","description":"The amount of physical RAM, in bytes, left unused by the system","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"memory_available","description":"The amount of physical RAM, in bytes, available for starting new applications, without swapping","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"buffers","description":"The amount of physical RAM, in bytes, used for file buffers","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"cached","description":"The amount of physical RAM, in bytes, used as cache memory","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"swap_cached","description":"The amount of swap, in bytes, used as cache memory","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"active","description":"The total amount of buffer or page cache memory, in bytes, that is in active use","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inactive","description":"The total amount of buffer or page cache memory, in bytes, that are free and available","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"swap_total","description":"The total amount of swap available, in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"swap_free","description":"The total amount of swap free, in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"memory_map","description":"OS memory region map.","platforms":["linux"],"columns":[{"name":"name","description":"Region name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"start","description":"Start address of memory region","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"end","description":"End address of memory region","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"mounts","description":"System mounted devices and filesystems (not process specific).","platforms":["darwin","linux"],"columns":[{"name":"device","description":"Mounted device","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"device_alias","description":"Mounted device alias","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Mounted device path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Mounted device type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"blocks_size","description":"Block size in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"blocks","description":"Mounted device used blocks","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"blocks_free","description":"Mounted device free blocks","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"blocks_available","description":"Mounted device available blocks","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inodes","description":"Mounted device used inodes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inodes_free","description":"Mounted device free inodes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"flags","description":"Mounted device flags","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"msr","description":"Various pieces of data stored in the model specific register per processor. NOTE: the msr kernel module must be enabled, and osquery must be run as root.","platforms":["linux"],"columns":[{"name":"processor_number","description":"The processor number as reported in /proc/cpuinfo","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"turbo_disabled","description":"Whether the turbo feature is disabled.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"turbo_ratio_limit","description":"The turbo feature ratio limit.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"platform_info","description":"Platform information.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"perf_ctl","description":"Performance setting for the processor.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"perf_status","description":"Performance status for the processor.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"feature_control","description":"Bitfield controlling enabled features.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"rapl_power_limit","description":"Run Time Average Power Limiting power limit.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"rapl_energy_status","description":"Run Time Average Power Limiting energy status.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"rapl_power_units","description":"Run Time Average Power Limiting power units.","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"nfs_shares","description":"NFS shares exported by the host.","platforms":["darwin"],"columns":[{"name":"share","description":"Filesystem path to the share","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"options","description":"Options string set on the export share","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"readonly","description":"1 if the share is exported readonly else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"npm_packages","description":"Node packages installed in a system.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Package display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Package-supplied version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Package-supplied description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"author","description":"Package-supplied author","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"license","description":"License under which package is launched","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"homepage","description":"Package supplied homepage","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path at which this module resides","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"directory","description":"Directory where node_modules are located","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"ntdomains","description":"Display basic NT domain information of a Windows machine.","platforms":["windows"],"columns":[{"name":"name","description":"The label by which the object is known.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"client_site_name","description":"The name of the site where the domain controller is configured.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dc_site_name","description":"The name of the site where the domain controller is located.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dns_forest_name","description":"The name of the root of the DNS tree.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"domain_controller_address","description":"The IP Address of the discovered domain controller..","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"domain_controller_name","description":"The name of the discovered domain controller.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"domain_name","description":"The name of the domain.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"The current status of the domain object.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"ntfs_acl_permissions","description":"Retrieve NTFS ACL permission information for files and directories.","platforms":["windows"],"columns":[{"name":"path","description":"Path to the file or directory.","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"type","description":"Type of access mode for the access control entry.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"principal","description":"User or group to which the ACE applies.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"access","description":"Specific permissions that indicate the rights described by the ACE.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"inherited_from","description":"The inheritance policy of the ACE.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"ntfs_journal_events","description":"Track time/action changes to files specified in configuration data.","platforms":["windows"],"columns":[{"name":"action","description":"Change action (Write, Delete, etc)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"category","description":"The category that the event originated from","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"old_path","description":"Old path (renames only)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"record_timestamp","description":"Journal record timestamp","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"record_usn","description":"The update sequence number that identifies the journal record","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"node_ref_number","description":"The ordinal that associates a journal record with a filename","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"parent_ref_number","description":"The ordinal that associates a journal record with a filename's parent directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"drive_letter","description":"The drive letter identifying the source journal","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"file_attributes","description":"File attributes","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"partial","description":"Set to 1 if either path or old_path only contains the file or folder name","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of file event","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"nvram","description":"Apple NVRAM variable listing.","platforms":["darwin"],"columns":[{"name":"name","description":"Variable name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"type","description":"Data type (CFData, CFString, etc)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Raw variable data","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"oem_strings","description":"OEM defined strings retrieved from SMBIOS.","platforms":["darwin","linux"],"columns":[{"name":"handle","description":"Handle, or instance number, associated with the Type 11 structure","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"number","description":"The string index of the structure","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"The value of the OEM string","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"office_mru","description":"View recently opened Office documents.","platforms":["windows"],"columns":[{"name":"application","description":"Associated Office application","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Office application version number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"File path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_opened_time","description":"Most recent opened time file was opened","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sid","description":"User SID","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"os_version","description":"A single row containing the operating system name and version.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Distribution or product name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Pretty, suitable for presentation, OS version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"major","description":"Major release version","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"minor","description":"Minor release version","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"patch","description":"Optional patch release","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"build","description":"Optional build-specific or variant string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"platform","description":"OS Platform or ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"platform_like","description":"Closely related platforms","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"codename","description":"OS version codename","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"arch","description":"OS Architecture","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_date","description":"The install date of the OS.","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"osquery_events","description":"Information about the event publishers and subscribers.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Event publisher or subscriber name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"publisher","description":"Name of the associated publisher","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Either publisher or subscriber","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subscriptions","description":"Number of subscriptions the publisher received or subscriber used","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"events","description":"Number of events emitted or received since osquery started","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"refreshes","description":"Publisher only: number of runloop restarts","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"active","description":"1 if the publisher or subscriber is active else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"osquery_extensions","description":"List of active osquery extensions.","platforms":["darwin","linux","windows"],"columns":[{"name":"uuid","description":"The transient ID assigned for communication","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Extension's name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension's version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sdk_version","description":"osquery SDK version used to build the extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of the extension's Thrift connection or library path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"SDK extension type: core, extension, or module","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"osquery_flags","description":"Configurable flags that modify osquery's behavior.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Flag name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Flag type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Flag description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"default_value","description":"Flag default value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Flag value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"shell_only","description":"Is the flag shell only?","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"osquery_info","description":"Top level information about the running version of osquery.","platforms":["darwin","linux","windows"],"columns":[{"name":"pid","description":"Process (or thread/handle) ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Unique ID provided by the system","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"instance_id","description":"Unique, long-lived ID per instance of osquery","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"osquery toolkit version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"config_hash","description":"Hash of the working configuration state","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"config_valid","description":"1 if the config was loaded and considered valid, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"extensions","description":"osquery extensions status","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"build_platform","description":"osquery toolkit build platform","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"build_distro","description":"osquery toolkit platform distribution name (os version)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"start_time","description":"UNIX time in seconds when the process started","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"watcher","description":"Process (or thread/handle) ID of optional watcher process","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"platform_mask","description":"The osquery platform bitmask","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"osquery_packs","description":"Information about the current query packs that are loaded in osquery.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"The given name for this query pack","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"platform","description":"Platforms this query is supported on","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Minimum osquery version that this query will run on","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"shard","description":"Shard restriction limit, 1-100, 0 meaning no restriction","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"discovery_cache_hits","description":"The number of times that the discovery query used cached values since the last time the config was reloaded","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"discovery_executions","description":"The number of times that the discovery queries have been executed since the last time the config was reloaded","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"active","description":"Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"osquery_registry","description":"List the osquery registry plugins.","platforms":["darwin","linux","windows"],"columns":[{"name":"registry","description":"Name of the osquery registry","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the plugin item","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"owner_uuid","description":"Extension route UUID (0 for core)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"internal","description":"1 If the plugin is internal else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"active","description":"1 If this plugin is active else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"osquery_schedule","description":"Information about the current queries that are scheduled in osquery.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"The given name for this query","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"query","description":"The exact query to run","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"interval","description":"The interval in seconds to run this query, not an exact interval","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"executions","description":"Number of times the query was executed","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"last_executed","description":"UNIX time stamp in seconds of the last completed execution","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"denylisted","description":"1 if the query is denylisted else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"output_size","description":"Cumulative total number of bytes generated by the resultant rows of the query","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"wall_time","description":"Total wall time in seconds spent executing (deprecated), hidden=True","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"wall_time_ms","description":"Total wall time in milliseconds spent executing","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"last_wall_time_ms","description":"Wall time in milliseconds of the latest execution","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"user_time","description":"Total user time in milliseconds spent executing","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"last_user_time","description":"User time in milliseconds of the latest execution","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"system_time","description":"Total system time in milliseconds spent executing","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"last_system_time","description":"System time in milliseconds of the latest execution","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"average_memory","description":"Average of the bytes of resident memory left allocated after collecting results","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"last_memory","description":"Resident memory in bytes left allocated after collecting results of the latest execution","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"package_bom","description":"macOS package bill of materials (BOM) file list.","platforms":["darwin"],"columns":[{"name":"filepath","description":"Package file or directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"Expected user of file or directory","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Expected group of file or directory","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"Expected permissions","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Expected file size","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"modified_time","description":"Timestamp the file was installed","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of package bom","type":"text","notes":"","hidden":false,"required":true,"index":false}]},{"name":"package_install_history","description":"macOS package install history.","platforms":["darwin"],"columns":[{"name":"package_id","description":"Label packageIdentifiers","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Label date as UNIX timestamp","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Package display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Package display version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Install source: usually the installer process name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"content_type","description":"Package content_type (optional)","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"package_receipts","description":"macOS package receipt details.","platforms":["darwin"],"columns":[{"name":"package_id","description":"Package domain identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"package_filename","description":"Filename of original .pkg file","type":"text","notes":"","hidden":true,"required":false,"index":true},{"name":"version","description":"Installed package version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"location","description":"Optional relative install path on volume","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_time","description":"Timestamp of install time","type":"double","notes":"","hidden":false,"required":false,"index":false},{"name":"installer_name","description":"Name of installer process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of receipt plist","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"password_policy","description":"Password Policies for macOS.","platforms":["darwin"],"columns":[{"name":"uid","description":"User ID for the policy, -1 for policies that are global","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"policy_identifier","description":"Policy Identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"policy_content","description":"Policy content","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"policy_description","description":"Policy description","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"patches","description":"Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update (e.g. Service Packs).","platforms":["windows"],"columns":[{"name":"csname","description":"The name of the host the patch is installed on.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hotfix_id","description":"The KB ID of the patch.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"caption","description":"Short description of the patch.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Fuller description of the patch.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fix_comments","description":"Additional comments about the patch.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"installed_by","description":"The system context in which the patch as installed.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_date","description":"Indicates when the patch was installed. Lack of a value does not indicate that the patch was not installed.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"installed_on","description":"The date when the patch was installed.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"pci_devices","description":"PCI devices active on the host system.","platforms":["darwin","linux"],"columns":[{"name":"pci_slot","description":"PCI Device used slot","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pci_class","description":"PCI Device class","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"driver","description":"PCI Device used driver","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor","description":"PCI Device vendor","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor_id","description":"Hex encoded PCI Device vendor identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model","description":"PCI Device model","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model_id","description":"Hex encoded PCI Device model identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pci_class_id","description":"PCI Device class ID in hex format","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"pci_subclass_id","description":"PCI Device  subclass in hex format","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"pci_subclass","description":"PCI Device subclass","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"subsystem_vendor_id","description":"Vendor ID of PCI device subsystem","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"subsystem_vendor","description":"Vendor of PCI device subsystem","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"subsystem_model_id","description":"Model ID of PCI device subsystem","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"subsystem_model","description":"Device description of PCI device subsystem","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"physical_disk_performance","description":"Provides provides raw data from performance counters that monitor hard or fixed disk drives on the system.","platforms":["windows"],"columns":[{"name":"name","description":"Name of the physical disk","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"avg_disk_bytes_per_read","description":"Average number of bytes transferred from the disk during read operations","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"avg_disk_bytes_per_write","description":"Average number of bytes transferred to the disk during write operations","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"avg_disk_read_queue_length","description":"Average number of read requests that were queued for the selected disk during the sample interval","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"avg_disk_write_queue_length","description":"Average number of write requests that were queued for the selected disk during the sample interval","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"avg_disk_sec_per_read","description":"Average time, in seconds, of a read operation of data from the disk","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"avg_disk_sec_per_write","description":"Average time, in seconds, of a write operation of data to the disk","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"current_disk_queue_length","description":"Number of requests outstanding on the disk at the time the performance data is collected","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"percent_disk_read_time","description":"Percentage of elapsed time that the selected disk drive is busy servicing read requests","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"percent_disk_write_time","description":"Percentage of elapsed time that the selected disk drive is busy servicing write requests","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"percent_disk_time","description":"Percentage of elapsed time that the selected disk drive is busy servicing read or write requests","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"percent_idle_time","description":"Percentage of time during the sample interval that the disk was idle","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"pipes","description":"Named and Anonymous pipes.","platforms":["windows"],"columns":[{"name":"pid","description":"Process ID of the process to which the pipe belongs","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Name of the pipe","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"instances","description":"Number of instances of the named pipe","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"max_instances","description":"The maximum number of instances creatable for this pipe","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"flags","description":"The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"platform_info","description":"Information about EFI/UEFI/ROM and platform/boot.","platforms":["darwin","linux","windows"],"columns":[{"name":"vendor","description":"Platform code vendor","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Platform code version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"date","description":"Self-reported platform code update date","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"revision","description":"BIOS major and minor revision","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"extra","description":"Platform-specific additional information","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"firmware_type","description":"The type of firmware (uefi, bios, iboot, openfirmware, unknown).","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"address","description":"Relative address of firmware mapping","type":"text","notes":"","hidden":false,"required":false,"index":false,"platforms":["linux","darwin"]},{"name":"size","description":"Size in bytes of firmware","type":"text","notes":"","hidden":false,"required":false,"index":false,"platforms":["linux","darwin"]},{"name":"volume_size","description":"(Optional) size of firmware volume","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["linux","darwin"]}]},{"name":"plist","description":"Read and parse a plist file.","platforms":["darwin"],"columns":[{"name":"key","description":"Preference top-level key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subkey","description":"Intermediate key path, includes lists/dicts","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"String value of most CF types","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"(required) read preferences from a plist","type":"text","notes":"","hidden":false,"required":true,"index":false}]},{"name":"portage_keywords","description":"A summary about portage configurations like keywords, mask and unmask.","platforms":["linux"],"columns":[{"name":"package","description":"Package name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"The version which are affected by the use flags, empty means all","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"keyword","description":"The keyword applied to the package","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mask","description":"If the package is masked","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"unmask","description":"If the package is unmasked","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"portage_packages","description":"List of currently installed packages.","platforms":["linux"],"columns":[{"name":"package","description":"Package name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"The version which are affected by the use flags, empty means all","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"slot","description":"The slot used by package","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"build_time","description":"Unix time when package was built","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"repository","description":"From which repository the ebuild was used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"eapi","description":"The eapi for the ebuild","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"The size of the package","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"world","description":"If package is in the world file","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"portage_use","description":"List of enabled portage USE values for specific package.","platforms":["linux"],"columns":[{"name":"package","description":"Package name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"The version of the installed package","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"use","description":"USE flag which has been enabled for package","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"power_sensors","description":"Machine power (currents, voltages, wattages, etc) sensors.","platforms":["darwin"],"columns":[{"name":"key","description":"The SMC key on macOS","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"category","description":"The sensor category: currents, voltage, wattage","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of power source","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Power in Watts","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"powershell_events","description":"Powershell script blocks reconstructed to their full script content, this table requires script block logging to be enabled.","platforms":["windows"],"columns":[{"name":"time","description":"Timestamp the event was received by the osquery event publisher","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"datetime","description":"System time at which the Powershell script event occurred","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"script_block_id","description":"The unique GUID of the powershell script to which this block belongs","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"script_block_count","description":"The total number of script blocks for this script","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"script_text","description":"The text content of the Powershell script","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"script_name","description":"The name of the Powershell script","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"script_path","description":"The path for the Powershell script","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cosine_similarity","description":"How similar the Powershell script is to a provided 'normal' character frequency","type":"double","notes":"","hidden":false,"required":false,"index":false}]},{"name":"preferences","description":"macOS defaults and managed preferences.","platforms":["darwin"],"columns":[{"name":"domain","description":"Application ID usually in com.name.product format","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"key","description":"Preference top-level key","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"subkey","description":"Intemediate key path, includes lists/dicts","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"String value of most CF types","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"forced","description":"1 if the value is forced/managed, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"(optional) read preferences for a specific user","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"host","description":"'current' or 'any' host, where 'current' takes precedence","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"prefetch","description":"Prefetch files show metadata related to file execution.","platforms":["windows"],"columns":[{"name":"path","description":"Prefetch file path.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"filename","description":"Executable filename.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hash","description":"Prefetch CRC hash.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_run_time","description":"Most recent time application was run.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"other_run_times","description":"Other execution times in prefetch file.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"run_count","description":"Number of times the application has been run.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Application file size.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"volume_serial","description":"Volume serial number.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"volume_creation","description":"Volume creation time.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"accessed_files_count","description":"Number of files accessed.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"accessed_directories_count","description":"Number of directories accessed.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"accessed_files","description":"Files accessed by application within ten seconds of launch.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"accessed_directories","description":"Directories accessed by application within ten seconds of launch.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"process_envs","description":"A key/value table of environment variables for each process.","platforms":["darwin","linux"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","notes":"","hidden":false,"required":false,"index":true},{"name":"key","description":"Environment variable name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Environment variable value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"process_events","description":"Track time/action process executions.","platforms":["darwin","linux"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"File mode permissions","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Command line arguments (argv)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cmdline_size","description":"Actual size (bytes) of command line arguments","type":"bigint","notes":"","hidden":true,"required":false,"index":false},{"name":"env","description":"Environment variables delimited by spaces","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"env_count","description":"Number of environment variables","type":"bigint","notes":"","hidden":true,"required":false,"index":false},{"name":"env_size","description":"Actual size (bytes) of environment list","type":"bigint","notes":"","hidden":true,"required":false,"index":false},{"name":"cwd","description":"The process current working directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit User ID at process start","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID at process start","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"euid","description":"Effective user ID at process start","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID at process start","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"egid","description":"Effective group ID at process start","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"owner_uid","description":"File owner user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"owner_gid","description":"File owner group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"atime","description":"File last access in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mtime","description":"File modification in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ctime","description":"File last metadata change in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"btime","description":"File creation in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"overflows","description":"List of structures that overflowed","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"parent","description":"Process parent's PID, or -1 if cannot be determined.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"status","description":"OpenBSM Attribute: Status of the process","type":"bigint","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"fsuid","description":"Filesystem user ID at process start","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"suid","description":"Saved user ID at process start","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"fsgid","description":"Filesystem group ID at process start","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"sgid","description":"Saved group ID at process start","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"syscall","description":"Syscall name: fork, vfork, clone, execve, execveat","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"process_file_events","description":"A File Integrity Monitor implementation using the audit service.","platforms":["linux"],"columns":[{"name":"operation","description":"Operation type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ppid","description":"Parent process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"executable","description":"The executable path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"partial","description":"True if this is a partial event (i.e.: this process existed before we started osquery)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cwd","description":"The current working directory of the process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"The path associated with the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"dest_path","description":"The canonical path associated with the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"The uid of the process performing the action","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"The gid of the process performing the action","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit user ID of the process using the file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"euid","description":"Effective user ID of the process using the file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"egid","description":"Effective group ID of the process using the file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fsuid","description":"Filesystem user ID of the process using the file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fsgid","description":"Filesystem group ID of the process using the file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"suid","description":"Saved user ID of the process using the file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sgid","description":"Saved group ID of the process using the file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"process_memory_map","description":"Process memory mapped files and pseudo device/regions.","platforms":["darwin","linux","windows"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","notes":"","hidden":false,"required":false,"index":true},{"name":"start","description":"Virtual start address (hex)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"end","description":"Virtual end address (hex)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"permissions","description":"r=read, w=write, x=execute, p=private (cow)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"offset","description":"Offset into mapped path","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"device","description":"MA:MI Major/minor device ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"inode","description":"Mapped path inode, 0 means uninitialized (BSS)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to mapped file or mapped type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pseudo","description":"1 If path is a pseudo path, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"process_namespaces","description":"Linux namespaces for processes running on the host system.","platforms":["linux"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","notes":"","hidden":false,"required":false,"index":true},{"name":"cgroup_namespace","description":"cgroup namespace inode","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ipc_namespace","description":"ipc namespace inode","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mnt_namespace","description":"mnt namespace inode","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"net_namespace","description":"net namespace inode","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_namespace","description":"pid namespace inode","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user_namespace","description":"user namespace inode","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uts_namespace","description":"uts namespace inode","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"process_open_files","description":"File descriptors for each process.","platforms":["darwin","linux"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"fd","description":"Process-specific file descriptor number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Filesystem path of descriptor","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"process_open_pipes","description":"Pipes and partner processes for each process.","platforms":["linux"],"columns":[{"name":"pid","description":"Process ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"fd","description":"File descriptor","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"Pipe open mode (r/w)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"inode","description":"Pipe inode number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Pipe Type: named vs unnamed/anonymous","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"partner_pid","description":"Process ID of partner process sharing a particular pipe","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"partner_fd","description":"File descriptor of shared pipe at partner's end","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"partner_mode","description":"Mode of shared pipe at partner's end","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"process_open_sockets","description":"Processes which have open network sockets on the system.","platforms":["darwin","linux","windows"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"integer","notes":"","hidden":false,"required":false,"index":true},{"name":"fd","description":"Socket file descriptor number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"socket","description":"Socket handle or inode number","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"family","description":"Network protocol (IPv4, IPv6)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"protocol","description":"Transport protocol (TCP/UDP)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"local_address","description":"Socket local address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_address","description":"Socket remote address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_port","description":"Socket local port","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_port","description":"Socket remote port","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"For UNIX sockets (family=AF_UNIX), the domain path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"TCP socket state","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"net_namespace","description":"The inode number of the network namespace","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"processes","description":"All running processes on the host system.","platforms":["darwin","linux","windows"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"The process path or shorthand argv[0]","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to executed binary","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Complete argv","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"Process state","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cwd","description":"Process current working directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"root","description":"Process virtual root directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"Unsigned user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Unsigned group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"euid","description":"Unsigned effective user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"egid","description":"Unsigned effective group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"suid","description":"Unsigned saved user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sgid","description":"Unsigned saved group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"on_disk","description":"The process path exists yes=1, no=0, unknown=-1","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"wired_size","description":"Bytes of unpageable memory used by process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"resident_size","description":"Bytes of private memory used by process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"total_size","description":"Total virtual memory size","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"user_time","description":"CPU time in milliseconds spent in user space","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"system_time","description":"CPU time in milliseconds spent in kernel space","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"disk_bytes_read","description":"Bytes read from disk","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"disk_bytes_written","description":"Bytes written to disk","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"start_time","description":"Process start time in seconds since Epoch, in case of error -1","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Process parent's PID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pgroup","description":"Process group","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"threads","description":"Number of threads used by process","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"nice","description":"Process nice level (-20 to 20, default 0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"elevated_token","description":"Process uses elevated token yes=1, no=0","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"secure_process","description":"Process is secure (IUM) yes=1, no=0","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"protection_type","description":"The protection type of the process","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"virtual_process","description":"Process is virtual (e.g. System, Registry, vmmem) yes=1, no=0","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"elapsed_time","description":"Elapsed time in seconds this process has been running.","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"handle_count","description":"Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process.","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"percent_processor_time","description":"Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks.","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"upid","description":"A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system.","type":"bigint","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"uppid","description":"The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system.","type":"bigint","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"cpu_type","description":"Indicates the specific processor designed for installation.","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"cpu_subtype","description":"Indicates the specific processor on which an entry may be used.","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"translated","description":"Indicates whether the process is running under the Rosetta Translation Environment, yes=1, no=0, error=-1.","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"cgroup_path","description":"The full hierarchical path of the process's control group","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"programs","description":"Represents products as they are installed by Windows Installer. A product generally correlates to one installation package on Windows. Some fields may be blank as Windows installation details are left to the discretion of the product author.","platforms":["windows"],"columns":[{"name":"name","description":"Commonly used product name.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Product version information.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_location","description":"The installation location directory of the product.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_source","description":"The installation source of the product.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"language","description":"The language of the product.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"publisher","description":"Name of the product supplier.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uninstall_string","description":"Path and filename of the uninstaller.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_date","description":"Date that this product was installed on the system. ","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"identifying_number","description":"Product identification such as a serial number on software, or a die number on a hardware chip.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"prometheus_metrics","description":"Retrieve metrics from a Prometheus server.","platforms":["darwin","linux"],"columns":[{"name":"target_name","description":"Address of prometheus target","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"metric_name","description":"Name of collected Prometheus metric","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"metric_value","description":"Value of collected Prometheus metric","type":"double","notes":"","hidden":false,"required":false,"index":false},{"name":"timestamp_ms","description":"Unix timestamp of collected data in MS","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"python_packages","description":"Python packages installed in a system.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Package display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Package-supplied version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"summary","description":"Package-supplied summary","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"author","description":"Optional package author","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"license","description":"License under which package is launched","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path at which this module resides","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"directory","description":"Directory where Python modules are located","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"quicklook_cache","description":"Files and thumbnails within macOS's Quicklook Cache.","platforms":["darwin"],"columns":[{"name":"path","description":"Path of file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"rowid","description":"Quicklook file rowid key","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"fs_id","description":"Quicklook file fs_id key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"volume_id","description":"Parsed volume ID from fs_id","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"inode","description":"Parsed file ID (inode) from fs_id","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"mtime","description":"Parsed version date field","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Parsed version size field","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"label","description":"Parsed version 'gen' field","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_hit_date","description":"Apple date format for last thumbnail cache hit","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"hit_count","description":"Number of cache hits on thumbnail","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"icon_mode","description":"Thumbnail icon mode","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"cache_path","description":"Path to cache data","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"registry","description":"All of the Windows registry hives.","platforms":["windows"],"columns":[{"name":"key","description":"Name of the key to search for","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Full path to the value","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Name of the registry value entry","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of the registry value, or 'subkey' if item is a subkey","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"data","description":"Data content of registry value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mtime","description":"timestamp of the most recent registry write","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"routes","description":"The active route table for the host system.","platforms":["darwin","linux","windows"],"columns":[{"name":"destination","description":"Destination IP address","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"netmask","description":"Netmask length","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"gateway","description":"Route gateway","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Route source","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"flags","description":"Flags to describe route","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"interface","description":"Route local interface","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mtu","description":"Maximum Transmission Unit for the route","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"metric","description":"Cost of route. Lowest is preferred","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of route","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hopcount","description":"Max hops expected","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["linux","darwin"]}]},{"name":"rpm_package_files","description":"RPM packages that are currently installed on the host system.","platforms":["linux"],"columns":[{"name":"package","description":"RPM package name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"path","description":"File path within the package","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"username","description":"File default username from info DB","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"groupname","description":"File default groupname from info DB","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"File permissions mode from info DB","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Expected file size in bytes from RPM info DB","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sha256","description":"SHA256 file digest from RPM info DB","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"rpm_packages","description":"RPM packages that are currently installed on the host system.","platforms":["linux"],"columns":[{"name":"name","description":"RPM package name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"version","description":"Package version","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"release","description":"Package release","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"source","description":"Source RPM package name (optional)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Package size in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sha1","description":"SHA1 hash of the package contents","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"arch","description":"Architecture(s) supported","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"epoch","description":"Package epoch value","type":"integer","notes":"","hidden":false,"required":false,"index":true},{"name":"install_time","description":"When the package was installed","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor","description":"Package vendor","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"package_group","description":"Package group","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]},{"name":"mount_namespace_id","description":"Mount namespace id","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"running_apps","description":"macOS applications currently running on the host system.","platforms":["darwin"],"columns":[{"name":"pid","description":"The pid of the application","type":"integer","notes":"","hidden":false,"required":false,"index":true},{"name":"bundle_identifier","description":"The bundle identifier of the application","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"is_active","description":"(DEPRECATED)","type":"integer","notes":"","hidden":true,"required":false,"index":false}]},{"name":"safari_extensions","description":"Safari browser extension details for all users.","platforms":["darwin"],"columns":[{"name":"uid","description":"The local user that owns the extension","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Extension display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Extension identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"Extension long version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sdk","description":"Bundle SDK used to compile extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"update_url","description":"Extension-supplied update URI","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"author","description":"Optional extension author","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"developer_id","description":"Optional developer identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Optional extension description text","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to extension XAR bundle","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"sandboxes","description":"macOS application sandboxes container details.","platforms":["darwin"],"columns":[{"name":"label","description":"UTI-format bundle or label ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user","description":"Sandbox owner","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled","description":"Application sandboxings enabled on container","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"build_id","description":"Sandbox-specific identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bundle_path","description":"Application bundle used by the sandbox","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to sandbox container directory","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"scheduled_tasks","description":"Lists all of the tasks in the Windows task scheduler.","platforms":["windows"],"columns":[{"name":"name","description":"Name of the scheduled task","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"action","description":"Actions executed by the scheduled task","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to the executable to be run","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled","description":"Whether or not the scheduled task is enabled","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"State of the scheduled task","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hidden","description":"Whether or not the task is visible in the UI","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"last_run_time","description":"Timestamp the task last ran","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"next_run_time","description":"Timestamp the task is scheduled to run next","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"last_run_message","description":"Exit status message of the last task run","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_run_code","description":"Exit status code of the last task run","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"screenlock","description":"macOS screenlock status. Note: only fetches results for osquery's current logged-in user context. The user must also have recently logged in.","platforms":["darwin"],"columns":[{"name":"enabled","description":"1 If a password is required after sleep or the screensaver begins; else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"grace_period","description":"The amount of time in seconds the screen must be asleep or the screensaver on before a password is required on-wake. 0 = immediately; -1 = no password is required on-wake","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"seccomp_events","description":"A virtual table that tracks seccomp events.","platforms":["linux"],"columns":[{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit user ID (loginuid) of the user who started the analyzed process","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"User ID of the user who started the analyzed process","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Group ID of the user who started the analyzed process","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ses","description":"Session ID of the session from which the analyzed process was invoked","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID","type":"unsigned_bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"comm","description":"Command-line name of the command that was used to invoke the analyzed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"exe","description":"The path to the executable that was used to invoke the analyzed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sig","description":"Signal value sent to process by seccomp","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"arch","description":"Information about the CPU architecture","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"syscall","description":"Type of the system call","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"compat","description":"Is system call in compatibility mode","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ip","description":"Instruction pointer value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"code","description":"The seccomp action","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"secureboot","description":"Secure Boot UEFI Settings.","platforms":["linux","windows"],"columns":[{"name":"secure_boot","description":"Whether secure boot is enabled","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"setup_mode","description":"Whether setup mode is enabled","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"security_profile_info","description":"Information on the security profile of a given system by listing the system Account and Audit Policies. This table mimics the exported securitypolicy output from the secedit tool.","platforms":["windows"],"columns":[{"name":"minimum_password_age","description":"Determines the minimum number of days that a password must be used before the user can change it","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"maximum_password_age","description":"Determines the maximum number of days that a password can be used before the client requires the user to change it","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"minimum_password_length","description":"Determines the least number of characters that can make up a password for a user account","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"password_complexity","description":"Determines whether passwords must meet a series of strong-password guidelines","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"password_history_size","description":"Number of unique new passwords that must be associated with a user account before an old password can be reused","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"lockout_bad_count","description":"Number of failed logon attempts after which a user account MUST be locked out","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"logon_to_change_password","description":"Determines if logon session is required to change the password","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"force_logoff_when_expire","description":"Determines whether SMB client sessions with the SMB server will be forcibly disconnected when the client's logon hours expire","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"new_administrator_name","description":"Determines the name of the Administrator account on the local computer","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"new_guest_name","description":"Determines the name of the Guest account on the local computer","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"clear_text_password","description":"Determines whether passwords MUST be stored by using reversible encryption","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"lsa_anonymous_name_lookup","description":"Determines if an anonymous user is allowed to query the local LSA policy","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"enable_admin_account","description":"Determines whether the Administrator account on the local computer is enabled","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"enable_guest_account","description":"Determines whether the Guest account on the local computer is enabled","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_system_events","description":"Determines whether the operating system MUST audit System Change, System Startup, System Shutdown, Authentication Component Load, and Loss or Excess of Security events","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_logon_events","description":"Determines whether the operating system MUST audit each instance of a user attempt to log on or log off this computer","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_object_access","description":"Determines whether the operating system MUST audit each instance of user attempts to access a non-Active Directory object that has its own SACL specified","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_privilege_use","description":"Determines whether the operating system MUST audit each instance of user attempts to exercise a user right","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_policy_change","description":"Determines whether the operating system MUST audit each instance of user attempts to change user rights assignment policy, audit policy, account policy, or trust policy","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_account_manage","description":"Determines whether the operating system MUST audit each event of account management on a computer","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_process_tracking","description":"Determines whether the operating system MUST audit process-related events","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_ds_access","description":"Determines whether the operating system MUST audit each instance of user attempts to access an Active Directory object that has its own system access control list (SACL) specified","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"audit_account_logon","description":"Determines whether the operating system MUST audit each time this computer validates the credentials of an account","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"selinux_events","description":"Track SELinux events.","platforms":["linux"],"columns":[{"name":"type","description":"Event type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"message","description":"Message","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"selinux_settings","description":"Track active SELinux settings.","platforms":["linux"],"columns":[{"name":"scope","description":"Where the key is located inside the SELinuxFS mount point.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"key","description":"Key or class name.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Active value.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"services","description":"Lists all installed Windows services and their relevant data.","platforms":["windows"],"columns":[{"name":"name","description":"Service name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"service_type","description":"Service Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"display_name","description":"Service Display name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Service Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSED","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"the Process ID of the service","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"start_type","description":"Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"win32_exit_code","description":"The error code that the service uses to report an error that occurs when it is starting or stopping","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"service_exit_code","description":"The service-specific error code that the service returns when an error occurs while the service is starting or stopping","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to Service Executable","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"module_path","description":"Path to ServiceDll","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Service Description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user_account","description":"The name of the account that the service process will be logged on as when it runs. This name can be of the form Domain\\UserName. If the account belongs to the built-in domain, the name can be of the form .\\UserName.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"shadow","description":"Local system users encrypted passwords and related information. Please note, that you usually need superuser rights to access `/etc/shadow`.","platforms":["linux"],"columns":[{"name":"password_status","description":"Password status","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hash_alg","description":"Password hashing algorithm","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_change","description":"Date of last password change (starting from UNIX epoch date)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"min","description":"Minimal number of days between password changes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"max","description":"Maximum number of days between password changes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"warning","description":"Number of days before password expires to warn user about it","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inactive","description":"Number of days after password expires until account is blocked","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"expire","description":"Number of days since UNIX epoch date until account is disabled","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"flag","description":"Reserved","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"Username","type":"text","notes":"","hidden":false,"required":false,"index":true}]},{"name":"shared_folders","description":"Folders available to others via SMB or AFP.","platforms":["darwin"],"columns":[{"name":"name","description":"The shared name of the folder as it appears to other users","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Absolute path of shared folder on the local system","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"shared_memory","description":"OS shared memory regions.","platforms":["linux"],"columns":[{"name":"shmid","description":"Shared memory segment ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"owner_uid","description":"User ID of owning process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"creator_uid","description":"User ID of creator process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID to last use the segment","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"creator_pid","description":"Process ID that created the segment","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"atime","description":"Attached time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"dtime","description":"Detached time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"ctime","description":"Changed time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"permissions","description":"Memory segment permissions","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Size in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"attached","description":"Number of attached processes","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Destination/attach status","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"locked","description":"1 if segment is locked else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"shared_resources","description":"Displays shared resources on a computer system running Windows. This may be a disk drive, printer, interprocess communication, or other sharable device.","platforms":["windows"],"columns":[{"name":"description","description":"A textual description of the object","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"install_date","description":"Indicates when the object was installed. Lack of a value does not indicate that the object is not installed.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"String that indicates the current status of the object.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"allow_maximum","description":"Number of concurrent users for this resource has been limited. If True, the value in the MaximumAllowed property is ignored.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"maximum_allowed","description":"Limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum property is set to FALSE.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Alias given to a path set up as a share on a computer system running Windows.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Local path of the Windows share.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of resource being shared. Types include: disk drives, print queues, interprocess communications (IPC), and general devices.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"type_name","description":"Human readable value for the 'type' column","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"sharing_preferences","description":"macOS Sharing preferences.","platforms":["darwin"],"columns":[{"name":"screen_sharing","description":"1 If screen sharing is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"file_sharing","description":"1 If file sharing is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"printer_sharing","description":"1 If printer sharing is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_login","description":"1 If remote login is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_management","description":"1 If remote management is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_apple_events","description":"1 If remote apple events are enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"internet_sharing","description":"1 If internet sharing is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"bluetooth_sharing","description":"1 If bluetooth sharing is enabled for any user else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"disc_sharing","description":"1 If CD or DVD sharing is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"content_caching","description":"1 If content caching is enabled else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"shell_history","description":"A line-delimited (command) table of per-user .*_history data.","platforms":["darwin","linux"],"columns":[{"name":"uid","description":"Shell history owner","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Entry timestamp. It could be absent, default value is 0.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"command","description":"Unparsed date/line/command history line","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"history_file","description":"Path to the .*_history for this user","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"shellbags","description":"Shows directories accessed via Windows Explorer.","platforms":["windows"],"columns":[{"name":"sid","description":"User SID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Shellbags source Registry file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Directory name.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"modified_time","description":"Directory Modified time.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"created_time","description":"Directory Created time.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"accessed_time","description":"Directory Accessed time.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mft_entry","description":"Directory master file table entry.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"mft_sequence","description":"Directory master file table sequence.","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"shimcache","description":"Application Compatibility Cache, contains artifacts of execution.","platforms":["windows"],"columns":[{"name":"entry","description":"Execution order.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"This is the path to the executed file.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"modified_time","description":"File Modified time.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"execution_flag","description":"Boolean Execution flag, 1 for execution, 0 for no execution, -1 for missing (this flag does not exist on Windows 10 and higher).","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"signature","description":"File (executable, bundle, installer, disk) code signing status.","platforms":["darwin"],"columns":[{"name":"path","description":"Must provide a path or directory","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"hash_resources","description":"Set to 1 to also hash resources, or 0 otherwise. Default is 1","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"arch","description":"If applicable, the arch of the signed code","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"signed","description":"1 If the file is signed else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"identifier","description":"The signing identifier sealed into the signature","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cdhash","description":"Hash of the application Code Directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"team_identifier","description":"The team signing identifier sealed into the signature","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"authority","description":"Certificate Common Name","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"sip_config","description":"Apple's System Integrity Protection (rootless) status.","platforms":["darwin"],"columns":[{"name":"config_flag","description":"The System Integrity Protection config flag","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled","description":"1 if this configuration is enabled, otherwise 0","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled_nvram","description":"1 if this configuration is enabled, otherwise 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"smbios_tables","description":"BIOS (DMI) structure common details and content.","platforms":["darwin","linux"],"columns":[{"name":"number","description":"Table entry number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Table entry type","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Table entry description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"handle","description":"Table entry handle","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"header_size","description":"Header size in bytes","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Table entry size in bytes","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"md5","description":"MD5 hash of table entry","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"smc_keys","description":"Apple's system management controller keys.","platforms":["darwin"],"columns":[{"name":"key","description":"4-character key","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"type","description":"SMC-reported type literal type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"size","description":"Reported size of data in bytes","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"A type-encoded representation of the key value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hidden","description":"1 if this key is normally hidden, otherwise 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"socket_events","description":"Track network socket opens and closes.","platforms":["darwin","linux"],"columns":[{"name":"action","description":"The socket action (bind, listen, close)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of executed file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fd","description":"The file description for the process socket","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Either 'succeeded', 'failed', 'in_progress' (connect() on non-blocking socket) or 'no_client' (null accept() on non-blocking socket)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"family","description":"The Internet protocol family ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"protocol","description":"The network protocol ID","type":"integer","notes":"","hidden":true,"required":false,"index":false},{"name":"local_address","description":"Local address associated with socket","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_address","description":"Remote address associated with socket","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_port","description":"Local network protocol port number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_port","description":"Remote network protocol port number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"socket","description":"The local path (UNIX domain socket only)","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"success","description":"Deprecated. Use the 'status' column instead","type":"integer","notes":"","hidden":true,"required":false,"index":false}]},{"name":"ssh_configs","description":"A table of parsed ssh_configs.","platforms":["darwin","linux","windows"],"columns":[{"name":"uid","description":"The local owner of the ssh_config file","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"block","description":"The host or match block","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"option","description":"The option and value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ssh_config_file","description":"Path to the ssh_config file","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"startup_items","description":"Applications and binaries set as user/login startup items.","platforms":["darwin","linux","windows"],"columns":[{"name":"name","description":"Name of startup item","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of startup item","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"args","description":"Arguments provided to startup executable","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Startup Item or Login Item","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Directory or plist containing startup item","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"status","description":"Startup status; either enabled or disabled","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"The user associated with the startup item","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"sudoers","description":"Rules for running commands as other users via sudo.","platforms":["darwin","linux"],"columns":[{"name":"source","description":"Source file containing the given rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"header","description":"Symbol for given rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"rule_details","description":"Rule definition","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"suid_bin","description":"suid binaries in common locations.","platforms":["darwin","linux"],"columns":[{"name":"path","description":"Binary path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"Binary owner username","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"groupname","description":"Binary owner group","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"permissions","description":"Binary permissions","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"syslog_events","description":"","platforms":["linux"],"columns":[{"name":"time","description":"Current unix epoch time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"datetime","description":"Time known to syslog","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"host","description":"Hostname configured for syslog","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"severity","description":"Syslog severity","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"facility","description":"Syslog facility","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"tag","description":"The syslog tag","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"message","description":"The syslog message","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"system_controls","description":"sysctl names, values, and settings information.","platforms":["darwin","linux"],"columns":[{"name":"name","description":"Full sysctl MIB name","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"oid","description":"Control MIB","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subsystem","description":"Subsystem ID, control type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"current_value","description":"Value of setting","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"config_value","description":"The MIB value set in /etc/sysctl.conf","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Data type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"field_name","description":"Specific attribute of opaque type","type":"text","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]}]},{"name":"system_extensions","description":"macOS (>= 10.15) system extension table.","platforms":["darwin"],"columns":[{"name":"path","description":"Original path of system extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"UUID","description":"Extension unique id","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"System extension state","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"identifier","description":"Identifier name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"System extension version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"category","description":"System extension category","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bundle_path","description":"System extension bundle path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"team","description":"Signing team ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mdm_managed","description":"1 if managed by MDM system extension payload configuration, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"system_info","description":"System information for identification.","platforms":["darwin","linux","windows"],"columns":[{"name":"hostname","description":"Network hostname including domain","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uuid","description":"Unique ID provided by the system","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_type","description":"CPU type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_subtype","description":"CPU subtype","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_brand","description":"CPU brand string, contains vendor and model","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_physical_cores","description":"Number of physical CPU cores in to the system","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_logical_cores","description":"Number of logical CPU cores available to the system","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"cpu_microcode","description":"Microcode version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"physical_memory","description":"Total physical memory in bytes","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"hardware_vendor","description":"Hardware vendor","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hardware_model","description":"Hardware model","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hardware_version","description":"Hardware version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hardware_serial","description":"Device serial number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"board_vendor","description":"Board vendor","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"board_model","description":"Board model","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"board_version","description":"Board version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"board_serial","description":"Board serial number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"computer_name","description":"Friendly computer name (optional)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_hostname","description":"Local hostname (optional)","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"systemd_units","description":"Track systemd units.","platforms":["linux"],"columns":[{"name":"id","description":"Unique unit identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Unit description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"load_state","description":"Reflects whether the unit definition was properly loaded","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"active_state","description":"The high-level unit activation state, i.e. generalization of SUB","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sub_state","description":"The low-level unit activation state, values depend on unit type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"following","description":"The name of another unit that this unit follows in state","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"object_path","description":"The object path for this unit","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"job_id","description":"Next queued job id","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"job_type","description":"Job type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"job_path","description":"The object path for the job","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"fragment_path","description":"The unit file path this unit was read from, if there is any","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user","description":"The configured user, if any","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source_path","description":"Path to the (possibly generated) unit configuration file","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"temperature_sensors","description":"Machine's temperature sensors.","platforms":["darwin"],"columns":[{"name":"key","description":"The SMC key on macOS","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"Name of temperature source","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"celsius","description":"Temperature in Celsius","type":"double","notes":"","hidden":false,"required":false,"index":false},{"name":"fahrenheit","description":"Temperature in Fahrenheit","type":"double","notes":"","hidden":false,"required":false,"index":false}]},{"name":"time","description":"Track current date and time in UTC.","platforms":["darwin","linux","windows"],"columns":[{"name":"weekday","description":"Current weekday in UTC","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"year","description":"Current year in UTC","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"month","description":"Current month in UTC","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"day","description":"Current day in UTC","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"hour","description":"Current hour in UTC","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"minutes","description":"Current minutes in UTC","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"seconds","description":"Current seconds in UTC","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"timezone","description":"Timezone for reported time (hardcoded to UTC)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_timezone","description":"Current local timezone in of the system","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"unix_time","description":"Current UNIX time in UTC","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"timestamp","description":"Current timestamp (log format) in UTC","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"datetime","description":"Current date and time (ISO format) in UTC","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"iso_8601","description":"Current time (ISO format) in UTC","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"win_timestamp","description":"Timestamp value in 100 nanosecond units","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]}]},{"name":"time_machine_backups","description":"Backups to drives using TimeMachine.","platforms":["darwin"],"columns":[{"name":"destination_id","description":"Time Machine destination ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"backup_date","description":"Backup Date","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"time_machine_destinations","description":"Locations backed up to using Time Machine.","platforms":["darwin"],"columns":[{"name":"alias","description":"Human readable name of drive","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"destination_id","description":"Time Machine destination ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"consistency_scan_date","description":"Consistency scan date","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"root_volume_uuid","description":"Root UUID of backup volume","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bytes_available","description":"Bytes available on volume","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"bytes_used","description":"Bytes used on volume","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"encryption","description":"Last known encrypted state","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"tpm_info","description":"A table that lists the TPM related information.","platforms":["windows"],"columns":[{"name":"activated","description":"TPM is activated","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled","description":"TPM is enabled","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"owned","description":"TPM is owned","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer_version","description":"TPM version","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer_id","description":"TPM manufacturers ID","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer_name","description":"TPM manufacturers name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"product_name","description":"Product name of the TPM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"physical_presence_version","description":"Version of the Physical Presence Interface","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"spec_version","description":"Trusted Computing Group specification that the TPM supports","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"ulimit_info","description":"System resource usage limits.","platforms":["darwin","linux"],"columns":[{"name":"type","description":"System resource to be limited","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"soft_limit","description":"Current limit value","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hard_limit","description":"Maximum limit value","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"unified_log","description":"Queries the OSLog framework for entries in the system log. The maximum number of rows returned is limited for performance issues. This table introduces a new idiom for extracting sequential data in batches using multiple queries, ordered by timestamp. To trigger it, the user should include the condition \"timestamp > -1\", and the table will handle pagination.","platforms":["darwin"],"columns":[{"name":"timestamp","description":"unix timestamp associated with the entry","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"storage","description":"the storage category for the entry","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"message","description":"composed message","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"activity","description":"the activity ID associate with the entry","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"process","description":"the name of the process that made the entry","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"the pid of the process that made the entry","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sender","description":"the name of the binary image that made the entry","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"tid","description":"the tid of the thread that made the entry","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"category","description":"the category of the os_log_t used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subsystem","description":"the subsystem of the os_log_t used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"level","description":"the severity level of the entry","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"max_rows","description":"the max number of rows returned (defaults to 100)","type":"integer","notes":"","hidden":true,"required":false,"index":false}]},{"name":"uptime","description":"Track time passed since last boot. Some systems track this as calendar time, some as runtime.","platforms":["darwin","linux","windows"],"columns":[{"name":"days","description":"Days of uptime","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"hours","description":"Hours of uptime","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"minutes","description":"Minutes of uptime","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"seconds","description":"Seconds of uptime","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"total_seconds","description":"Total uptime seconds","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"usb_devices","description":"USB devices that are actively plugged into the host system.","platforms":["darwin","linux"],"columns":[{"name":"usb_address","description":"USB Device used address","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"usb_port","description":"USB Device used port","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor","description":"USB Device vendor string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"vendor_id","description":"Hex encoded USB Device vendor identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"USB Device version number","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model","description":"USB Device model string","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model_id","description":"Hex encoded USB Device model identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial","description":"USB Device serial connection","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"USB Device class","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"subclass","description":"USB Device subclass","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"protocol","description":"USB Device protocol","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"removable","description":"1 If USB device is removable else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"user_events","description":"Track user events from the audit framework.","platforms":["darwin","linux"],"columns":[{"name":"uid","description":"User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"auid","description":"Audit User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process (or thread) ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"message","description":"Message from the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"The file description for the process socket","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Supplied path from event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"address","description":"The Internet protocol address or family ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"terminal","description":"The network protocol ID","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of execution in UNIX time","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uptime","description":"Time of execution in system uptime","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"user_groups","description":"Local system user group relationships.","platforms":["darwin","linux","windows"],"columns":[{"name":"uid","description":"User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"gid","description":"Group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true}]},{"name":"user_interaction_events","description":"Track user interaction events from macOS' event tapping framework.","platforms":["darwin"],"columns":[{"name":"time","description":"Time","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"user_ssh_keys","description":"Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.","platforms":["darwin","linux","windows"],"columns":[{"name":"uid","description":"The local user that owns the key file","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to key file","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"encrypted","description":"1 if key is encrypted, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"key_type","description":"The type of the private key. One of [rsa, dsa, dh, ec, hmac, cmac], or the empty string.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"userassist","description":"UserAssist Registry Key tracks when a user executes an application from Windows Explorer.","platforms":["windows"],"columns":[{"name":"path","description":"Application file path.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_execution_time","description":"Most recent time application was executed.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"count","description":"Number of times the application has been executed.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"sid","description":"User SID.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"users","description":"Local user accounts (including domain accounts that have logged on locally (Windows)).","platforms":["darwin","linux","windows"],"columns":[{"name":"uid","description":"User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"gid","description":"Group ID (unsigned)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid_signed","description":"User ID as int64 signed (Apple)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid_signed","description":"Default group ID as int64 signed (Apple)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"Username","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Optional user description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"directory","description":"User's home directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"shell","description":"User's configured default shell","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uuid","description":"User's UUID (Apple) or SID (Windows)","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"type","description":"Whether the account is roaming (domain), local, or a system profile","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"is_hidden","description":"IsHidden attribute set in OpenDirectory","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"video_info","description":"Retrieve video card information of the machine.","platforms":["windows"],"columns":[{"name":"color_depth","description":"The amount of bits per pixel to represent color.","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"driver","description":"The driver of the device.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"driver_date","description":"The date listed on the installed driver.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"driver_version","description":"The version of the installed driver.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"manufacturer","description":"The manufacturer of the gpu.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"model","description":"The model of the gpu.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"series","description":"The series of the gpu.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"video_mode","description":"The current resolution of the display.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"virtual_memory_info","description":"Darwin Virtual Memory statistics.","platforms":["darwin"],"columns":[{"name":"free","description":"Total number of free pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"active","description":"Total number of active pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"inactive","description":"Total number of inactive pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"speculative","description":"Total number of speculative pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"throttled","description":"Total number of throttled pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"wired","description":"Total number of wired down pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"purgeable","description":"Total number of purgeable pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"faults","description":"Total number of calls to vm_faults.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"copy","description":"Total number of copy-on-write pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"zero_fill","description":"Total number of zero filled pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"reactivated","description":"Total number of reactivated pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"purged","description":"Total number of purged pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"file_backed","description":"Total number of file backed pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"anonymous","description":"Total number of anonymous pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uncompressed","description":"Total number of uncompressed pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"compressor","description":"The number of pages used to store compressed VM pages.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"decompressed","description":"The total number of pages that have been decompressed by the VM compressor.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"compressed","description":"The total number of pages that have been compressed by the VM compressor.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"page_ins","description":"The total number of requests for pages from a pager.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"page_outs","description":"Total number of pages paged out.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"swap_ins","description":"The total number of compressed pages that have been swapped out to disk.","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"swap_outs","description":"The total number of compressed pages that have been swapped back in from disk.","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"wifi_networks","description":"macOS known/remembered Wi-Fi networks list.","platforms":["darwin"],"columns":[{"name":"ssid","description":"SSID octets of the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"network_name","description":"Name of the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"security_type","description":"Type of security on this network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"last_connected","description":"Last time this network was connected to as a unix_time","type":"integer","notes":"","hidden":true,"required":false,"index":false},{"name":"passpoint","description":"1 if Passpoint is supported, 0 otherwise","type":"integer","notes":"","hidden":true,"required":false,"index":false},{"name":"possibly_hidden","description":"1 if network is possibly a hidden network, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"roaming","description":"1 if roaming is supported, 0 otherwise","type":"integer","notes":"","hidden":true,"required":false,"index":false},{"name":"roaming_profile","description":"Describe the roaming profile, usually one of Single, Dual  or Multi","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"auto_login","description":"1 if auto login is enabled, 0 otherwise","type":"integer","notes":"","hidden":true,"required":false,"index":false},{"name":"temporarily_disabled","description":"1 if this network is temporarily disabled, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"disabled","description":"1 if this network is disabled, 0 otherwise","type":"integer","notes":"","hidden":true,"required":false,"index":false},{"name":"add_reason","description":"Shows why this network was added, via menubar or command line or something else ","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"added_at","description":"Time this network was added as a unix_time","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"captive_portal","description":"1 if this network has a captive portal, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"captive_login_date","description":"Time this network logged in to a captive portal as unix_time","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"was_captive_network","description":"1 if this network was previously a captive network, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"auto_join","description":"1 if this network set to join automatically, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"personal_hotspot","description":"1 if this network is a personal hotspot, 0 otherwise","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"wifi_status","description":"macOS current WiFi status.","platforms":["darwin"],"columns":[{"name":"interface","description":"Name of the interface","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ssid","description":"SSID octets of the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bssid","description":"The current basic service set identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"network_name","description":"Name of the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"country_code","description":"The country code (ISO/IEC 3166-1:1997) for the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"security_type","description":"Type of security on this network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"rssi","description":"The current received signal strength indication (dbm)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"noise","description":"The current noise measurement (dBm)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"channel","description":"Channel number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"channel_width","description":"Channel width","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"channel_band","description":"Channel band","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"transmit_rate","description":"The current transmit rate","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mode","description":"The current operating mode for the Wi-Fi interface","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"wifi_survey","description":"Scan for nearby WiFi networks.","platforms":["darwin"],"columns":[{"name":"interface","description":"Name of the interface","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ssid","description":"SSID octets of the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"bssid","description":"The current basic service set identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"network_name","description":"Name of the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"country_code","description":"The country code (ISO/IEC 3166-1:1997) for the network","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"rssi","description":"The current received signal strength indication (dbm)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"noise","description":"The current noise measurement (dBm)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"channel","description":"Channel number","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"channel_width","description":"Channel width","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"channel_band","description":"Channel band","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"winbaseobj","description":"Lists named Windows objects in the default object directories, across all terminal services sessions.  Example Windows ojbect types include Mutexes, Events, Jobs and Semaphors.","platforms":["windows"],"columns":[{"name":"session_id","description":"Terminal Services Session Id","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"object_name","description":"Object Name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"object_type","description":"Object Type","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"windows_crashes","description":"Extracted information from Windows crash logs (Minidumps).","platforms":["windows"],"columns":[{"name":"datetime","description":"Timestamp (log format) of the crash","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"module","description":"Path of the crashed module within the process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path of the executable file for the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID of the crashed process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"tid","description":"Thread ID of the crashed thread","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"version","description":"File version info of the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"process_uptime","description":"Uptime of the process in seconds","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"stack_trace","description":"Multiple stack frames from the stack trace","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"exception_code","description":"The Windows exception code","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"exception_message","description":"The NTSTATUS error message associated with the exception code","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"exception_address","description":"Address (in hex) where the exception occurred","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"registers","description":"The values of the system registers","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"command_line","description":"Command-line string passed to the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"current_directory","description":"Current working directory of the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"Username of the user who ran the crashed process","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"machine_name","description":"Name of the machine where the crash happened","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"major_version","description":"Windows major version of the machine","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"minor_version","description":"Windows minor version of the machine","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"build_number","description":"Windows build number of the crashing machine","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Type of crash log","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"crash_path","description":"Path of the log file","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"windows_eventlog","description":"Table for querying all recorded Windows event logs.","platforms":["windows"],"columns":[{"name":"channel","description":"Source or channel of the event","type":"text","notes":"","hidden":false,"required":true,"index":false},{"name":"datetime","description":"System time at which the event occurred","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"task","description":"Task value associated with the event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"level","description":"Severity level associated with the event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"provider_name","description":"Provider name of the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"provider_guid","description":"Provider guid of the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"computer_name","description":"Hostname of system where event was generated","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"eventid","description":"Event ID of the event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"keywords","description":"A bitmask of the keywords defined in the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"data","description":"Data associated with the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid","description":"Process ID which emitted the event record","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"tid","description":"Thread ID which emitted the event record","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"time_range","description":"System time to selectively filter the events","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"timestamp","description":"Timestamp to selectively filter the events","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"xpath","description":"The custom query to filter events","type":"text","notes":"","hidden":true,"required":true,"index":false}]},{"name":"windows_events","description":"Windows Event logs.","platforms":["windows"],"columns":[{"name":"time","description":"Timestamp the event was received","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"datetime","description":"System time at which the event occurred","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"source","description":"Source or channel of the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"provider_name","description":"Provider name of the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"provider_guid","description":"Provider guid of the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"computer_name","description":"Hostname of system where event was generated","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"eventid","description":"Event ID of the event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"task","description":"Task value associated with the event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"level","description":"The severity level associated with the event","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"keywords","description":"A bitmask of the keywords defined in the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"data","description":"Data associated with the event","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"windows_firewall_rules","description":"Provides the list of Windows firewall rules.","platforms":["windows"],"columns":[{"name":"name","description":"Friendly name of the rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"app_name","description":"Friendly name of the application to which the rule applies","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"action","description":"Action for the rule or default setting","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled","description":"1 if the rule is enabled","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"grouping","description":"Group to which an individual rule belongs","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"direction","description":"Direction of traffic for which the rule applies","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"protocol","description":"IP protocol of the rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_addresses","description":"Local addresses for the rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_addresses","description":"Remote addresses for the rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"local_ports","description":"Local ports for the rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"remote_ports","description":"Remote ports for the rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"icmp_types_codes","description":"ICMP types and codes for the rule","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"profile_domain","description":"1 if the rule profile type is domain","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"profile_private","description":"1 if the rule profile type is private","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"profile_public","description":"1 if the rule profile type is public","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"service_name","description":"Service name property of the application","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"windows_optional_features","description":"Lists names and installation states of windows features. Maps to Win32_OptionalFeature WMI class.","platforms":["windows"],"columns":[{"name":"name","description":"Name of the feature","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"caption","description":"Caption of feature in settings UI","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"Installation state value. 1 == Enabled, 2 == Disabled, 3 == Absent","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"statename","description":"Installation state name. 'Enabled','Disabled','Absent'","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"windows_security_center","description":"The health status of Window Security features. Health values can be \"Good\", \"Poor\". \"Snoozed\", \"Not Monitored\", and \"Error\".","platforms":["windows"],"columns":[{"name":"firewall","description":"The health of the monitored Firewall (see windows_security_products)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"autoupdate","description":"The health of the Windows Autoupdate feature","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"antivirus","description":"The health of the monitored Antivirus solution (see windows_security_products)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"antispyware","description":"Deprecated (always 'Good').","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"internet_settings","description":"The health of the Internet Settings","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"windows_security_center_service","description":"The health of the Windows Security Center Service","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user_account_control","description":"The health of the User Account Control (UAC) capability in Windows","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"windows_security_products","description":"Enumeration of registered Windows security products.","platforms":["windows"],"columns":[{"name":"type","description":"Type of security product","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of product","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"State of protection","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state_timestamp","description":"Timestamp for the product state","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"remediation_path","description":"Remediation path","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"signatures_up_to_date","description":"1 if product signatures are up to date, else 0","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"windows_update_history","description":"Provides the history of the windows update events.","platforms":["windows"],"columns":[{"name":"client_app_id","description":"Identifier of the client application that processed an update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"date","description":"Date and the time an update was applied","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Description of an update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hresult","description":"HRESULT value that is returned from the operation on an update","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"operation","description":"Operation on an update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"result_code","description":"Result of an operation on an update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"server_selection","description":"Value that indicates which server provided an update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"service_id","description":"Service identifier of an update service that is not a Windows update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"support_url","description":"Hyperlink to the language-specific support information for an update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"title","description":"Title of an update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"update_id","description":"Revision-independent identifier of an update","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"update_revision","description":"Revision number of an update","type":"bigint","notes":"","hidden":false,"required":false,"index":false}]},{"name":"wmi_bios_info","description":"Lists important information from the system bios.","platforms":["windows"],"columns":[{"name":"name","description":"Name of the Bios setting","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"value","description":"Value of the Bios setting","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"wmi_cli_event_consumers","description":"WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.","platforms":["windows"],"columns":[{"name":"name","description":"Unique name of a consumer.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"command_line_template","description":"Standard string template that specifies the process to be started. This property can be NULL, and the ExecutablePath property is used as the command line.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"executable_path","description":"Module to execute. The string can specify the full path and file name of the module to execute, or it can specify a partial name. If a partial name is specified, the current drive and current directory are assumed.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"The name of the class.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"relative_path","description":"Relative path to the class or instance.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"wmi_event_filters","description":"Lists WMI event filters.","platforms":["windows"],"columns":[{"name":"name","description":"Unique identifier of an event filter.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"query","description":"Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"query_language","description":"Query language that the query is written in.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"The name of the class.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"relative_path","description":"Relative path to the class or instance.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"wmi_filter_consumer_binding","description":"Lists the relationship between event consumers and filters.","platforms":["windows"],"columns":[{"name":"consumer","description":"Reference to an instance of __EventConsumer that represents the object path to a logical consumer, the recipient of an event.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"filter","description":"Reference to an instance of __EventFilter that represents the object path to an event filter which is a query that specifies the type of event to be received.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"The name of the class.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"relative_path","description":"Relative path to the class or instance.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"wmi_script_event_consumers","description":"WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.","platforms":["windows"],"columns":[{"name":"name","description":"Unique identifier for the event consumer. ","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"scripting_engine","description":"Name of the scripting engine to use, for example, 'VBScript'. This property cannot be NULL.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"script_file_name","description":"Name of the file from which the script text is read, intended as an alternative to specifying the text of the script in the ScriptText property.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"script_text","description":"Text of the script that is expressed in a language known to the scripting engine. This property must be NULL if the ScriptFileName property is not NULL.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"class","description":"The name of the class.","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"relative_path","description":"Relative path to the class or instance.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"xprotect_entries","description":"Database of the machine's XProtect signatures.","platforms":["darwin"],"columns":[{"name":"name","description":"Description of XProtected malware","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"launch_type","description":"Launch services content type","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"identity","description":"XProtect identity (SHA1) of content","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"filename","description":"Use this file name to match","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"filetype","description":"Use this file type to match","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"optional","description":"Match any of the identities/patterns for this XProtect name","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"uses_pattern","description":"Uses a match pattern instead of identity","type":"integer","notes":"","hidden":false,"required":false,"index":false}]},{"name":"xprotect_meta","description":"Database of the machine's XProtect browser-related signatures.","platforms":["darwin"],"columns":[{"name":"identifier","description":"Browser plugin or extension identifier","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"type","description":"Either plugin or extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"developer_id","description":"Developer identity (SHA1) of extension","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"min_version","description":"The minimum allowed plugin version.","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"xprotect_reports","description":"Database of XProtect matches (if user generated/sent an XProtect report).","platforms":["darwin"],"columns":[{"name":"name","description":"Description of XProtected malware","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"user_action","description":"Action taken by user after prompted","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Quarantine alert time","type":"text","notes":"","hidden":false,"required":false,"index":false}]},{"name":"yara","description":"Triggers one-off YARA query for files at the specified path. Requires one of `sig_group`, `sigfile`, or `sigrule`.","platforms":["darwin","linux","windows"],"columns":[{"name":"path","description":"The path scanned","type":"text","notes":"","hidden":false,"required":true,"index":true},{"name":"matches","description":"List of YARA matches","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"count","description":"Number of YARA matches","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"sig_group","description":"Signature group used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sigfile","description":"Signature file used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sigrule","description":"Signature strings used","type":"text","notes":"","hidden":true,"required":false,"index":false},{"name":"strings","description":"Matching strings","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"tags","description":"Matching tags","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"sigurl","description":"Signature url","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"yara_events","description":"Track YARA matches for files specified in configuration data.","platforms":["darwin","linux","windows"],"columns":[{"name":"target_path","description":"The path scanned","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"category","description":"The category of the file","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"action","description":"Change action (UPDATE, REMOVE, etc)","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"transaction_id","description":"ID used during bulk update","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"matches","description":"List of YARA matches","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"count","description":"Number of YARA matches","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"strings","description":"Matching strings","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"tags","description":"Matching tags","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"time","description":"Time of the scan","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"eid","description":"Event ID","type":"text","notes":"","hidden":true,"required":false,"index":false}]},{"name":"ycloud_instance_metadata","description":"Yandex.Cloud instance metadata.","platforms":["darwin","linux","windows"],"columns":[{"name":"instance_id","description":"Unique identifier for the VM","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"folder_id","description":"Folder identifier for the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"name","description":"Name of the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Description of the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"hostname","description":"Hostname of the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"zone","description":"Availability zone of the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"ssh_public_key","description":"SSH public key. Only available if supplied at instance launch time","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"serial_port_enabled","description":"Indicates if serial port is enabled for the VM","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"metadata_endpoint","description":"Endpoint used to fetch VM metadata","type":"text","notes":"","hidden":false,"required":false,"index":true}]},{"name":"yum_sources","description":"Current list of Yum repositories or software channels.","platforms":["linux"],"columns":[{"name":"name","description":"Repository name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"baseurl","description":"Repository base URL","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"mirrorlist","description":"Mirrorlist URL","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"enabled","description":"Whether the repository is used","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"gpgcheck","description":"Whether packages are GPG checked","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"gpgkey","description":"URL to GPG key","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"host_users","description":"Local user accounts (including domain accounts that have logged on locally (Windows)).","platforms":["darwin","linux","windows"],"columns":[{"name":"uid","description":"User ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"gid","description":"Group ID (unsigned)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"uid_signed","description":"User ID as int64 signed (Apple)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid_signed","description":"Default group ID as int64 signed (Apple)","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"username","description":"Username","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"description","description":"Optional user description","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"directory","description":"User's home directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"shell","description":"User's configured default shell","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uuid","description":"User's UUID (Apple) or SID (Windows)","type":"text","notes":"","hidden":false,"required":false,"index":true},{"name":"type","description":"Whether the account is roaming (domain), local, or a system profile","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"is_hidden","description":"IsHidden attribute set in OpenDirectory","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"host_groups","description":"Local system groups.","platforms":["darwin","linux","windows"],"columns":[{"name":"gid","description":"Unsigned int64 group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"gid_signed","description":"A signed int64 version of gid","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"groupname","description":"Canonical local group name","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"group_sid","description":"Unique group ID","type":"text","notes":"","hidden":true,"required":false,"index":true,"platforms":["windows","win32","cygwin"]},{"name":"comment","description":"Remarks or comments associated with the group","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"is_hidden","description":"IsHidden attribute set in OpenDirectory","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"pid_with_namespace","description":"Pids that contain a namespace","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]},{"name":"host_processes","description":"All running processes on the host system.","platforms":["darwin","linux","windows"],"columns":[{"name":"pid","description":"Process (or thread) ID","type":"bigint","notes":"","hidden":false,"required":false,"index":true},{"name":"name","description":"The process path or shorthand argv[0]","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"path","description":"Path to executed binary","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cmdline","description":"Complete argv","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"state","description":"Process state","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"cwd","description":"Process current working directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"root","description":"Process virtual root directory","type":"text","notes":"","hidden":false,"required":false,"index":false},{"name":"uid","description":"Unsigned user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"gid","description":"Unsigned group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"euid","description":"Unsigned effective user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"egid","description":"Unsigned effective group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"suid","description":"Unsigned saved user ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"sgid","description":"Unsigned saved group ID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"on_disk","description":"The process path exists yes=1, no=0, unknown=-1","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"wired_size","description":"Bytes of unpageable memory used by process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"resident_size","description":"Bytes of private memory used by process","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"total_size","description":"Total virtual memory size","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"user_time","description":"CPU time in milliseconds spent in user space","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"system_time","description":"CPU time in milliseconds spent in kernel space","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"disk_bytes_read","description":"Bytes read from disk","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"disk_bytes_written","description":"Bytes written to disk","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"start_time","description":"Process start time in seconds since Epoch, in case of error -1","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"parent","description":"Process parent's PID","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"pgroup","description":"Process group","type":"bigint","notes":"","hidden":false,"required":false,"index":false},{"name":"threads","description":"Number of threads used by process","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"nice","description":"Process nice level (-20 to 20, default 0)","type":"integer","notes":"","hidden":false,"required":false,"index":false},{"name":"elevated_token","description":"Process uses elevated token yes=1, no=0","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"secure_process","description":"Process is secure (IUM) yes=1, no=0","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"protection_type","description":"The protection type of the process","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"virtual_process","description":"Process is virtual (e.g. System, Registry, vmmem) yes=1, no=0","type":"integer","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"elapsed_time","description":"Elapsed time in seconds this process has been running.","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"handle_count","description":"Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process.","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"percent_processor_time","description":"Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks.","type":"bigint","notes":"","hidden":true,"required":false,"index":false,"platforms":["windows","win32","cygwin"]},{"name":"upid","description":"A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system.","type":"bigint","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"uppid","description":"The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system.","type":"bigint","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"cpu_type","description":"Indicates the specific processor designed for installation.","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"cpu_subtype","description":"Indicates the specific processor on which an entry may be used.","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"translated","description":"Indicates whether the process is running under the Rosetta Translation Environment, yes=1, no=0, error=-1.","type":"integer","notes":"","hidden":false,"required":false,"index":false,"platforms":["darwin"]},{"name":"cgroup_path","description":"The full hierarchical path of the process's control group","type":"text","notes":"","hidden":true,"required":false,"index":false,"platforms":["linux"]}]}]
\ No newline at end of file
diff --git a/x-pack/plugins/osquery/public/editor/osquery_tables.ts b/x-pack/plugins/osquery/public/editor/osquery_tables.ts
index fbbdcac1834c0..fbfa20dc39ede 100644
--- a/x-pack/plugins/osquery/public/editor/osquery_tables.ts
+++ b/x-pack/plugins/osquery/public/editor/osquery_tables.ts
@@ -17,7 +17,7 @@ let osqueryTables: TablesJSON | null = null;
 export const getOsqueryTables = () => {
   if (!osqueryTables) {
     // eslint-disable-next-line @typescript-eslint/no-var-requires
-    osqueryTables = normalizeTables(require('../common/schemas/osquery/v5.5.1.json'));
+    osqueryTables = normalizeTables(require('../common/schemas/osquery/v5.7.0.json'));
   }
 
   return osqueryTables;
diff --git a/x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx b/x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx
index fb25e145176b5..6b2f34e6d85db 100644
--- a/x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx
+++ b/x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx
@@ -48,8 +48,8 @@ import {
   convertECSMappingToArray,
   convertECSMappingToObject,
 } from '../../../common/schemas/common/utils';
-import ECSSchema from '../../common/schemas/ecs/v8.5.0.json';
-import osquerySchema from '../../common/schemas/osquery/v5.5.1.json';
+import ECSSchema from '../../common/schemas/ecs/v8.7.0.json';
+import osquerySchema from '../../common/schemas/osquery/v5.7.0.json';
 
 import { FieldIcon } from '../../common/lib/kibana';
 import { OsqueryIcon } from '../../components/osquery_icon';
diff --git a/x-pack/plugins/osquery/scripts/schema_formatter/ecs_formatter.ts b/x-pack/plugins/osquery/scripts/schema_formatter/ecs_formatter.ts
index 553c4e9de10fd..9edc37cc38c9f 100644
--- a/x-pack/plugins/osquery/scripts/schema_formatter/ecs_formatter.ts
+++ b/x-pack/plugins/osquery/scripts/schema_formatter/ecs_formatter.ts
@@ -40,12 +40,19 @@ const RESTRICTED_FIELDS = [
 
 run(
   async ({ flags }) => {
-    const schemaPath = path.resolve(`./public/common/schemas/ecs/`);
+    const schemaPath = path.resolve(`../../public/common/schemas/ecs/`);
     const schemaFile = path.join(schemaPath, flags.schema_version as string);
     const schemaData = await require(schemaFile);
 
+    const transformToLowerCase = (obj: Record<string, unknown>) =>
+      Object.fromEntries(Object.entries(obj).map(([key, val]) => [key.toLowerCase(), val]));
+
+    const schemaDataWithLowerCaseFieldNames = schemaData.map((obj: Record<string, unknown>) =>
+      transformToLowerCase(obj)
+    );
+
     const filteredSchemaData = filter(
-      schemaData,
+      schemaDataWithLowerCaseFieldNames,
       (field) => !RESTRICTED_FIELDS.includes(field.field)
     );
     const formattedSchema = map(filteredSchemaData, partialRight(pick, ECS_COLUMN_SCHEMA_FIELDS));

From 585d3f05285257ace03be84a9d555168cb6742fe Mon Sep 17 00:00:00 2001
From: Xavier Mouligneau <xavier.mouligneau@elastic.co>
Date: Tue, 7 Feb 2023 08:17:18 -0500
Subject: [PATCH 055/134] [RAM] Add integrated snooze component for security
 solution (#149752)

## Summary

We wanted to avoid duplication of code so we created a more integrated
component with API to snooze rule. we also added the information about
snooze in the task runner so security folks can manage their legacy
actions in the execution rule, it will looks like that
```ts
import { isRuleSnoozed } from '@kbn/alerting-plugin/server';

if (actions.length && !isRuleSnoozed(options.rule)) {
...
}
```

One way to integrated this new component in a EuiBasictable:
```
{
  id: 'ruleSnoozeNotify',
  name: (
    <EuiToolTip
      data-test-subj="rulesTableCell-notifyTooltip"
      content={i18n.COLUMN_NOTIFY_TOOLTIP}
    >
      <span>
        {i18n.COLUMN_NOTIFY}
        &nbsp;
        <EuiIcon size="s" color="subdued" type="questionInCircle" className="eui-alignTop" />
      </span>
    </EuiToolTip>
  ),
  width: '14%',
  'data-test-subj': 'rulesTableCell-rulesListNotify',
  render: (rule: Rule) => {
    return triggersActionsUi.getRulesListNotifyBadge({
      rule: {
        id: rule.id,
        muteAll: rule.mute_all ?? false,
        activeSnoozes: rule.active_snoozes,
        isSnoozedUntil: rule.is_snoozed_until ? new Date(rule.is_snoozed_until) : null,
        snoozeSchedule: rule?.snooze_schedule ?? [],
        isEditable: hasCRUDPermissions,
      },
      isLoading: loadingRuleIds.includes(rule.id) || isLoading,
      onRuleChanged: reFetchRules,
    });
  },
}
```

I think Security solution folks might want/need to create a new io-ts
schema for `snooze_schedule` something like that should work:
```ts
import { IsoDateString } from '@kbn/securitysolution-io-ts-types';
import * as t from 'io-ts';

const RRuleRecord = t.intersection([
  t.type({
    dtstart: IsoDateString,
    tzid: t.string,
  }),
  t.partial({
    freq: t.union([
      t.literal(0),
      t.literal(1),
      t.literal(2),
      t.literal(3),
      t.literal(4),
      t.literal(5),
      t.literal(6),
    ]),
    until: t.string,
    count: t.number,
    interval: t.number,
    wkst: t.union([
      t.literal('MO'),
      t.literal('TU'),
      t.literal('WE'),
      t.literal('TH'),
      t.literal('FR'),
      t.literal('SA'),
      t.literal('SU'),
    ]),
    byweekday: t.array(t.union([t.string, t.number])),
    bymonth: t.array(t.number),
    bysetpos: t.array(t.number),
    bymonthday: t.array(t.number),
    byyearday: t.array(t.number),
    byweekno: t.array(t.number),
    byhour: t.array(t.number),
    byminute: t.array(t.number),
    bysecond: t.array(t.number),
  }),
]);

export const RuleSnoozeSchedule = t.intersection([
  t.type({
    duration: t.number,
    rRule: RRuleRecord,
  }),
  t.partial({
    id: t.string,
    skipRecurrences: t.array(t.string),
  }),
]);
```


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../rules_list_notify_badge_sandbox.tsx       |  22 +--
 x-pack/plugins/alerting/common/rule.ts        |   2 +
 .../server/task_runner/task_runner.ts         |   4 +
 .../metric_threshold_executor.test.ts         |   2 +
 .../utils/create_lifecycle_rule_type.test.ts  |   2 +
 .../utils/rule_executor.test_helpers.ts       |   2 +
 ...gacy_rules_notification_alert_type.test.ts |   2 +
 .../rule_preview/api/preview_rules/route.ts   |   2 +
 .../rule_schema/model/rule_schemas.mock.ts    |   2 +
 .../rule_types/es_query/rule_type.test.ts     |   2 +
 .../index_threshold/rule_type.test.ts         |   8 +
 .../public/application/sections/index.tsx     |   4 +-
 .../components/rule_status_panel.tsx          |   3 +-
 .../components/collapsed_item_actions.tsx     |   2 +-
 .../components/notify_badge/helpers.tsx       |  28 ++++
 .../components/notify_badge/index.tsx         |  18 +++
 .../notify_badge.test.tsx}                    |   6 +-
 .../notify_badge.tsx}                         |  84 ++---------
 .../notify_badge_with_api.stories.tsx         | 137 ++++++++++++++++++
 .../notify_badge/notify_badge_with_api.tsx    |  88 +++++++++++
 .../components/notify_badge/translations.tsx  |  34 +++++
 .../components/notify_badge/types.ts          |  31 ++++
 .../components/rule_snooze_modal.tsx          |   2 +-
 .../components/rules_list_table.tsx           |   2 +-
 .../common/get_rules_list_notify_badge.tsx    |   8 +-
 .../triggers_actions_ui/public/plugin.ts      |   8 +-
 .../triggers_actions_ui/public/types.ts       |   5 +-
 .../group2/tests/alerting/alerts.ts           |  94 +++++-------
 .../group2/tests/alerting/index.ts            |  28 ++--
 .../tests/alerting/group1/alerts_base.ts      |   2 +
 30 files changed, 460 insertions(+), 174 deletions(-)
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/helpers.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/index.tsx
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/{rules_list_notify_badge.test.tsx => notify_badge/notify_badge.test.tsx} (96%)
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/{rules_list_notify_badge.tsx => notify_badge/notify_badge.tsx} (76%)
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge_with_api.stories.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge_with_api.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/translations.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/types.ts

diff --git a/x-pack/examples/triggers_actions_ui_example/public/components/rules_list_notify_badge_sandbox.tsx b/x-pack/examples/triggers_actions_ui_example/public/components/rules_list_notify_badge_sandbox.tsx
index 86f929853dc8a..47b08acd88e31 100644
--- a/x-pack/examples/triggers_actions_ui_example/public/components/rules_list_notify_badge_sandbox.tsx
+++ b/x-pack/examples/triggers_actions_ui_example/public/components/rules_list_notify_badge_sandbox.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useState } from 'react';
+import React from 'react';
 import {
   TriggersAndActionsUIPublicPluginStart,
   RuleTableItem,
@@ -48,22 +48,14 @@ const mockRule: RuleTableItem = {
 };
 
 export const RulesListNotifyBadgeSandbox = ({ triggersActionsUi }: SandboxProps) => {
-  const [isOpen, setIsOpen] = useState<boolean>(false);
-  const [isLoading, setIsLoading] = useState<boolean>(false);
-
+  const RulesListNotifyBadge = triggersActionsUi.getRulesListNotifyBadge;
   return (
     <div style={{ flex: 1 }}>
-      {triggersActionsUi.getRulesListNotifyBadge({
-        rule: mockRule,
-        isOpen,
-        isLoading,
-        onClick: () => setIsOpen(!isOpen),
-        onClose: () => setIsOpen(false),
-        onLoading: setIsLoading,
-        onRuleChanged: () => Promise.resolve(),
-        snoozeRule: () => Promise.resolve(),
-        unsnoozeRule: () => Promise.resolve(),
-      })}
+      <RulesListNotifyBadge
+        rule={mockRule}
+        isLoading={false}
+        onRuleChanged={() => Promise.resolve()}
+      />
     </div>
   );
 };
diff --git a/x-pack/plugins/alerting/common/rule.ts b/x-pack/plugins/alerting/common/rule.ts
index 3bfddd79af10d..162778c8f5826 100644
--- a/x-pack/plugins/alerting/common/rule.ts
+++ b/x-pack/plugins/alerting/common/rule.ts
@@ -161,6 +161,8 @@ export type SanitizedRuleConfig = Pick<
   | 'updatedAt'
   | 'throttle'
   | 'notifyWhen'
+  | 'muteAll'
+  | 'snoozeSchedule'
 > & {
   producer: string;
   ruleTypeId: string;
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
index 808fe89baa7c8..489b633569333 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -257,6 +257,8 @@ export class TaskRunner<
       updatedAt,
       enabled,
       actions,
+      muteAll,
+      snoozeSchedule,
     } = rule;
     const {
       params: { alertId: ruleId, spaceId },
@@ -373,6 +375,8 @@ export class TaskRunner<
                 updatedAt,
                 throttle,
                 notifyWhen,
+                muteAll,
+                snoozeSchedule,
               },
               logger: this.logger,
               flappingSettings,
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index 85059a2ee6233..a94521c22bde4 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -115,6 +115,8 @@ const mockOptions = {
     producer: '',
     ruleTypeId: '',
     ruleTypeName: '',
+    muteAll: false,
+    snoozeSchedule: [],
   },
   logger,
   flappingSettings: DEFAULT_FLAPPING_SETTINGS,
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type.test.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type.test.ts
index 92cbdb35240b5..7b312ccf5cef2 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type.test.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type.test.ts
@@ -111,6 +111,7 @@ function createRule(shouldWriteAlerts: boolean = true) {
           createdAt,
           createdBy: 'createdBy',
           enabled: true,
+          muteAll: false,
           name: 'name',
           notifyWhen: 'onActionGroupChange',
           producer: 'producer',
@@ -119,6 +120,7 @@ function createRule(shouldWriteAlerts: boolean = true) {
           schedule: {
             interval: '1m',
           },
+          snoozeSchedule: [],
           tags: ['tags'],
           throttle: null,
           updatedAt: createdAt,
diff --git a/x-pack/plugins/rule_registry/server/utils/rule_executor.test_helpers.ts b/x-pack/plugins/rule_registry/server/utils/rule_executor.test_helpers.ts
index f2416b0cba677..d175852ef4eea 100644
--- a/x-pack/plugins/rule_registry/server/utils/rule_executor.test_helpers.ts
+++ b/x-pack/plugins/rule_registry/server/utils/rule_executor.test_helpers.ts
@@ -68,6 +68,8 @@ export const createDefaultAlertExecutorOptions = <
     notifyWhen: null,
     ruleTypeId: 'RULE_TYPE_ID',
     ruleTypeName: 'RULE_TYPE_NAME',
+    muteAll: false,
+    snoozeSchedule: [],
   },
   params,
   spaceId: 'SPACE_ID',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions_legacy/logic/notifications/legacy_rules_notification_alert_type.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions_legacy/logic/notifications/legacy_rules_notification_alert_type.test.ts
index de04cac5f1fee..ef6b05474ff47 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions_legacy/logic/notifications/legacy_rules_notification_alert_type.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions_legacy/logic/notifications/legacy_rules_notification_alert_type.test.ts
@@ -66,6 +66,8 @@ describe('legacyRules_notification_alert_type', () => {
         updatedAt: new Date('2019-12-14T16:40:33.400Z'),
         throttle: null,
         notifyWhen: null,
+        muteAll: false,
+        snoozeSchedule: [],
       },
       logger,
       flappingSettings: DEFAULT_FLAPPING_SETTINGS,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/route.ts
index 6491aeb96f5d3..35c328a68f733 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/route.ts
@@ -225,6 +225,8 @@ export const previewRulesRoute = async (
             ruleTypeName,
             updatedAt: new Date(),
             updatedBy: username ?? 'preview-updated-by',
+            muteAll: false,
+            snoozeSchedule: [],
           };
 
           let invocationStartTime;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.mock.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.mock.ts
index 3dcc8b0389cc9..86966e8193158 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.mock.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.mock.ts
@@ -215,6 +215,8 @@ export const getRuleConfigMock = (type: string = 'rule-type'): SanitizedRuleConf
   producer: 'sample producer',
   ruleTypeId: `${type}-id`,
   ruleTypeName: type,
+  muteAll: false,
+  snoozeSchedule: [],
 });
 
 export const getCompleteRuleMock = <T extends RuleParams>(params: T): CompleteRule<T> => ({
diff --git a/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts b/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts
index 825870a0a30c7..cc6c4414777ea 100644
--- a/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts
+++ b/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts
@@ -725,6 +725,8 @@ async function invokeExecutor({
       updatedAt: new Date(),
       throttle: null,
       notifyWhen: null,
+      muteAll: false,
+      snoozeSchedule: [],
     },
     logger,
     flappingSettings: DEFAULT_FLAPPING_SETTINGS,
diff --git a/x-pack/plugins/stack_alerts/server/rule_types/index_threshold/rule_type.test.ts b/x-pack/plugins/stack_alerts/server/rule_types/index_threshold/rule_type.test.ts
index c4e9078c90c28..3875f52dbfe52 100644
--- a/x-pack/plugins/stack_alerts/server/rule_types/index_threshold/rule_type.test.ts
+++ b/x-pack/plugins/stack_alerts/server/rule_types/index_threshold/rule_type.test.ts
@@ -216,6 +216,8 @@ describe('ruleType', () => {
         updatedAt: new Date(),
         throttle: null,
         notifyWhen: null,
+        muteAll: false,
+        snoozeSchedule: [],
       },
       logger,
       flappingSettings: DEFAULT_FLAPPING_SETTINGS,
@@ -280,6 +282,8 @@ describe('ruleType', () => {
         updatedAt: new Date(),
         throttle: null,
         notifyWhen: null,
+        muteAll: false,
+        snoozeSchedule: [],
       },
       logger,
       flappingSettings: DEFAULT_FLAPPING_SETTINGS,
@@ -344,6 +348,8 @@ describe('ruleType', () => {
         updatedAt: new Date(),
         throttle: null,
         notifyWhen: null,
+        muteAll: false,
+        snoozeSchedule: [],
       },
       logger,
       flappingSettings: DEFAULT_FLAPPING_SETTINGS,
@@ -407,6 +413,8 @@ describe('ruleType', () => {
         updatedAt: new Date(),
         throttle: null,
         notifyWhen: null,
+        muteAll: false,
+        snoozeSchedule: [],
       },
       logger,
       flappingSettings: DEFAULT_FLAPPING_SETTINGS,
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/index.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/index.tsx
index ea459a50c00ed..95ac26d587351 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/index.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/index.tsx
@@ -46,8 +46,8 @@ export const RuleEventLogList = suspendedComponentWithProps(
 export const RulesList = suspendedComponentWithProps(
   lazy(() => import('./rules_list/components/rules_list'))
 );
-export const RulesListNotifyBadge = suspendedComponentWithProps(
-  lazy(() => import('./rules_list/components/rules_list_notify_badge'))
+export const RulesListNotifyBadgeWithApi = suspendedComponentWithProps(
+  lazy(() => import('./rules_list/components/notify_badge'))
 );
 export const RuleSnoozeModal = suspendedComponentWithProps(
   lazy(() => import('./rules_list/components/rule_snooze_modal'))
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_status_panel.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_status_panel.tsx
index 126f371ab121a..ae5e4251b87e2 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_status_panel.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_status_panel.tsx
@@ -21,11 +21,12 @@ import {
   EuiTitle,
   EuiHorizontalRule,
 } from '@elastic/eui';
-import { RuleStatusDropdown, RulesListNotifyBadge } from '../..';
+import { RuleStatusDropdown } from '../..';
 import {
   ComponentOpts as RuleApis,
   withBulkRuleOperations,
 } from '../../common/components/with_bulk_rule_api_operations';
+import { RulesListNotifyBadge } from '../../rules_list/components/notify_badge';
 
 export interface RuleStatusPanelProps {
   rule: any;
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/collapsed_item_actions.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/collapsed_item_actions.tsx
index 6eeb0100ae801..ba36bea2eac9d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/collapsed_item_actions.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/collapsed_item_actions.tsx
@@ -33,7 +33,7 @@ import {
   SNOOZE_FAILED_MESSAGE,
   SNOOZE_SUCCESS_MESSAGE,
   UNSNOOZE_SUCCESS_MESSAGE,
-} from './rules_list_notify_badge';
+} from './notify_badge';
 
 export type ComponentOpts = {
   item: RuleTableItem;
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/helpers.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/helpers.tsx
new file mode 100644
index 0000000000000..e307ba6dd4475
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/helpers.tsx
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { RuleSnooze, RuleSnoozeSchedule } from '@kbn/alerting-plugin/common';
+import moment from 'moment';
+
+export const isRuleSnoozed = (rule: { isSnoozedUntil?: Date | null; muteAll: boolean }) =>
+  Boolean(
+    (rule.isSnoozedUntil && new Date(rule.isSnoozedUntil).getTime() > Date.now()) || rule.muteAll
+  );
+
+export const getNextRuleSnoozeSchedule = (rule: { snoozeSchedule?: RuleSnooze }) => {
+  if (!rule.snoozeSchedule) return null;
+  // Disregard any snoozes without ids; these are non-scheduled snoozes
+  const explicitlyScheduledSnoozes = rule.snoozeSchedule.filter((s) => Boolean(s.id));
+  if (explicitlyScheduledSnoozes.length === 0) return null;
+  const nextSchedule = explicitlyScheduledSnoozes.reduce(
+    (a: RuleSnoozeSchedule, b: RuleSnoozeSchedule) => {
+      if (moment(b.rRule.dtstart).isBefore(moment(a.rRule.dtstart))) return b;
+      return a;
+    }
+  );
+  return nextSchedule;
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/index.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/index.tsx
new file mode 100644
index 0000000000000..36962b35e999e
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/index.tsx
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { RulesListNotifyBadgeWithApi } from './notify_badge_with_api';
+export { RulesListNotifyBadge } from './notify_badge';
+export type { RulesListNotifyBadgePropsWithApi } from './types';
+export {
+  SNOOZE_SUCCESS_MESSAGE,
+  UNSNOOZE_SUCCESS_MESSAGE,
+  SNOOZE_FAILED_MESSAGE,
+} from './translations';
+
+// eslint-disable-next-line import/no-default-export
+export { RulesListNotifyBadgeWithApi as default };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_notify_badge.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge.test.tsx
similarity index 96%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_notify_badge.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge.test.tsx
index ca22f042ca329..84c39f38136e9 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_notify_badge.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge.test.tsx
@@ -10,11 +10,11 @@ import React from 'react';
 import { act } from 'react-dom/test-utils';
 import moment from 'moment';
 
-import { RuleTableItem } from '../../../../types';
+import { RuleTableItem } from '../../../../../types';
 import { mountWithIntl } from '@kbn/test-jest-helpers';
-import { RulesListNotifyBadge } from './rules_list_notify_badge';
+import { RulesListNotifyBadge } from './notify_badge';
 
-jest.mock('../../../../common/lib/kibana');
+jest.mock('../../../../../common/lib/kibana');
 
 const onClick = jest.fn();
 const onClose = jest.fn();
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_notify_badge.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge.tsx
similarity index 76%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_notify_badge.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge.tsx
index ee864a2667c3f..92b8820775891 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_notify_badge.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge.tsx
@@ -17,67 +17,18 @@ import {
   EuiFlexItem,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { RuleSnooze, RuleSnoozeSchedule } from '@kbn/alerting-plugin/common';
-import { i18nAbbrMonthDayDate, i18nMonthDayDate } from '../../../lib/i18n_month_day_date';
-import { RuleTableItem, SnoozeSchedule } from '../../../../types';
-import { SnoozePanel, futureTimeToInterval } from './rule_snooze';
-import { useKibana } from '../../../../common/lib/kibana';
-import { isRuleSnoozed } from '../../../lib';
-
-export const SNOOZE_SUCCESS_MESSAGE = i18n.translate(
-  'xpack.triggersActionsUI.sections.rulesList.rulesListSnoozePanel.snoozeSuccess',
-  {
-    defaultMessage: 'Rule successfully snoozed',
-  }
-);
-
-export const UNSNOOZE_SUCCESS_MESSAGE = i18n.translate(
-  'xpack.triggersActionsUI.sections.rulesList.rulesListSnoozePanel.unsnoozeSuccess',
-  {
-    defaultMessage: 'Rule successfully unsnoozed',
-  }
-);
-
-export const SNOOZE_FAILED_MESSAGE = i18n.translate(
-  'xpack.triggersActionsUI.sections.rulesList.rulesListSnoozePanel.snoozeFailed',
-  {
-    defaultMessage: 'Unable to change rule snooze settings',
-  }
-);
-
-export interface RulesListNotifyBadgeProps {
-  rule: RuleTableItem;
-  isOpen: boolean;
-  isLoading: boolean;
-  previousSnoozeInterval?: string | null;
-  onClick: React.MouseEventHandler<HTMLButtonElement>;
-  onClose: () => void;
-  onLoading: (isLoading: boolean) => void;
-  onRuleChanged: () => void;
-  snoozeRule: (schedule: SnoozeSchedule, muteAll?: boolean) => Promise<void>;
-  unsnoozeRule: (scheduleIds?: string[]) => Promise<void>;
-  showTooltipInline?: boolean;
-  showOnHover?: boolean;
-}
-
-const openSnoozePanelAriaLabel = i18n.translate(
-  'xpack.triggersActionsUI.sections.rulesList.rulesListNotifyBadge.openSnoozePanel',
-  { defaultMessage: 'Open snooze panel' }
-);
-
-const getNextRuleSnoozeSchedule = (rule: { snoozeSchedule?: RuleSnooze }) => {
-  if (!rule.snoozeSchedule) return null;
-  // Disregard any snoozes without ids; these are non-scheduled snoozes
-  const explicitlyScheduledSnoozes = rule.snoozeSchedule.filter((s) => Boolean(s.id));
-  if (explicitlyScheduledSnoozes.length === 0) return null;
-  const nextSchedule = explicitlyScheduledSnoozes.reduce(
-    (a: RuleSnoozeSchedule, b: RuleSnoozeSchedule) => {
-      if (moment(b.rRule.dtstart).isBefore(moment(a.rRule.dtstart))) return b;
-      return a;
-    }
-  );
-  return nextSchedule;
-};
+import { useKibana } from '../../../../../common/lib/kibana';
+import { SnoozeSchedule } from '../../../../../types';
+import { i18nAbbrMonthDayDate, i18nMonthDayDate } from '../../../../lib/i18n_month_day_date';
+import { SnoozePanel, futureTimeToInterval } from '../rule_snooze';
+import { getNextRuleSnoozeSchedule, isRuleSnoozed } from './helpers';
+import {
+  OPEN_SNOOZE_PANEL_ARIA_LABEL,
+  SNOOZE_FAILED_MESSAGE,
+  SNOOZE_SUCCESS_MESSAGE,
+  UNSNOOZE_SUCCESS_MESSAGE,
+} from './translations';
+import { RulesListNotifyBadgeProps } from './types';
 
 export const RulesListNotifyBadge: React.FunctionComponent<RulesListNotifyBadgeProps> = (props) => {
   const {
@@ -175,7 +126,7 @@ export const RulesListNotifyBadge: React.FunctionComponent<RulesListNotifyBadgeP
         isLoading={isLoading}
         disabled={isLoading || !isEditable}
         data-test-subj="rulesListNotifyBadge-snoozed"
-        aria-label={openSnoozePanelAriaLabel}
+        aria-label={OPEN_SNOOZE_PANEL_ARIA_LABEL}
         minWidth={85}
         iconType="bellSlash"
         color="accent"
@@ -197,7 +148,7 @@ export const RulesListNotifyBadge: React.FunctionComponent<RulesListNotifyBadgeP
         minWidth={85}
         iconType="calendar"
         color="text"
-        aria-label={openSnoozePanelAriaLabel}
+        aria-label={OPEN_SNOOZE_PANEL_ARIA_LABEL}
         onClick={onClick}
       >
         <EuiText size="xs">{formattedSnoozeText}</EuiText>
@@ -217,7 +168,7 @@ export const RulesListNotifyBadge: React.FunctionComponent<RulesListNotifyBadgeP
         disabled={isLoading || !isEditable}
         display={isLoading ? 'base' : 'empty'}
         data-test-subj="rulesListNotifyBadge-unsnoozed"
-        aria-label={openSnoozePanelAriaLabel}
+        aria-label={OPEN_SNOOZE_PANEL_ARIA_LABEL}
         className={isOpen || isLoading ? '' : showOnHoverClass}
         iconType="bell"
         onClick={onClick}
@@ -233,7 +184,7 @@ export const RulesListNotifyBadge: React.FunctionComponent<RulesListNotifyBadgeP
         disabled={isLoading || !isEditable}
         display="base"
         data-test-subj="rulesListNotifyBadge-snoozedIndefinitely"
-        aria-label={openSnoozePanelAriaLabel}
+        aria-label={OPEN_SNOOZE_PANEL_ARIA_LABEL}
         iconType="bellSlash"
         color="accent"
         onClick={onClick}
@@ -343,6 +294,3 @@ export const RulesListNotifyBadge: React.FunctionComponent<RulesListNotifyBadgeP
   }
   return popover;
 };
-
-// eslint-disable-next-line import/no-default-export
-export { RulesListNotifyBadge as default };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge_with_api.stories.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge_with_api.stories.tsx
new file mode 100644
index 0000000000000..6fefd93632aaa
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge_with_api.stories.tsx
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Meta, Story } from '@storybook/react';
+import { action } from '@storybook/addon-actions';
+import React from 'react';
+import { v4 as uuidv4 } from 'uuid';
+
+import { EuiText } from '@elastic/eui';
+import { RulesListNotifyBadgeWithApi } from './notify_badge_with_api';
+import { RulesListNotifyBadgePropsWithApi } from './types';
+
+const rule = {
+  id: uuidv4(),
+  activeSnoozes: [],
+  isSnoozedUntil: undefined,
+  muteAll: false,
+  isEditable: true,
+  snoozeSchedule: [],
+};
+
+export default {
+  title: 'app/RulesListNotifyBadgeWithApi',
+  component: RulesListNotifyBadgeWithApi,
+  argTypes: {
+    rule: {
+      defaultValue: rule,
+      control: {
+        type: 'object',
+      },
+    },
+    isLoading: {
+      defaultValue: false,
+      control: {
+        type: 'boolean',
+      },
+    },
+    showOnHover: {
+      defaultValue: false,
+      control: {
+        type: 'boolean',
+      },
+    },
+    showTooltipInline: {
+      defaultValue: false,
+      control: {
+        type: 'boolean',
+      },
+    },
+    onRuleChanged: {},
+  },
+  args: {
+    rule,
+    onRuleChanged: (...args: any) => action('onRuleChanged')(args),
+  },
+} as Meta<RulesListNotifyBadgePropsWithApi>;
+
+const Template: Story<RulesListNotifyBadgePropsWithApi> = (args) => {
+  return <RulesListNotifyBadgeWithApi {...args} />;
+};
+
+export const DefaultRuleNotifyBadgeWithApi = Template.bind({});
+
+const IndefinitelyDate = new Date();
+IndefinitelyDate.setDate(IndefinitelyDate.getDate() + 1);
+export const IndefinitelyRuleNotifyBadgeWithApi = Template.bind({});
+IndefinitelyRuleNotifyBadgeWithApi.args = {
+  rule: {
+    ...rule,
+    muteAll: true,
+    isSnoozedUntil: IndefinitelyDate,
+  },
+};
+
+export const ActiveSnoozesRuleNotifyBadgeWithApi = Template.bind({});
+const ActiveSnoozeDate = new Date();
+ActiveSnoozeDate.setDate(ActiveSnoozeDate.getDate() + 2);
+ActiveSnoozesRuleNotifyBadgeWithApi.args = {
+  rule: {
+    ...rule,
+    activeSnoozes: ['24da3b26-bfa5-4317-b72f-4063dbea618e'],
+    isSnoozedUntil: ActiveSnoozeDate,
+    snoozeSchedule: [
+      {
+        duration: 172800000,
+        rRule: {
+          tzid: 'America/New_York',
+          count: 1,
+          dtstart: ActiveSnoozeDate.toISOString(),
+        },
+        id: '24da3b26-bfa5-4317-b72f-4063dbea618e',
+      },
+    ],
+  },
+};
+
+const SnoozeDate = new Date();
+export const ScheduleSnoozesRuleNotifyBadgeWithApi: Story<RulesListNotifyBadgePropsWithApi> = (
+  args
+) => {
+  return (
+    <div>
+      <EuiText size="s">Open popover to see the next snoozes scheduled</EuiText>
+      <RulesListNotifyBadgeWithApi {...args} />
+    </div>
+  );
+};
+
+ScheduleSnoozesRuleNotifyBadgeWithApi.args = {
+  rule: {
+    ...rule,
+    snoozeSchedule: [
+      {
+        duration: 172800000,
+        rRule: {
+          tzid: 'America/New_York',
+          count: 1,
+          dtstart: new Date(SnoozeDate.setDate(SnoozeDate.getDate() + 2)).toISOString(),
+        },
+        id: '24da3b26-bfa5-4317-b72f-4063dbea618e',
+      },
+      {
+        duration: 172800000,
+        rRule: {
+          tzid: 'America/New_York',
+          count: 1,
+          dtstart: new Date(SnoozeDate.setDate(SnoozeDate.getDate() + 2)).toISOString(),
+        },
+        id: '24da3b26-bfa5-4317-b72f-4063dbea618e',
+      },
+    ],
+  },
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge_with_api.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge_with_api.tsx
new file mode 100644
index 0000000000000..f64412369af21
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/notify_badge_with_api.tsx
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useState } from 'react';
+import { useKibana } from '../../../../../common/lib/kibana';
+import { SnoozeSchedule } from '../../../../../types';
+import {
+  loadRule,
+  snoozeRule as snoozeRuleApi,
+  unsnoozeRule as unsnoozeRuleApi,
+} from '../../../../lib/rule_api';
+import { RulesListNotifyBadge } from './notify_badge';
+import { RulesListNotifyBadgePropsWithApi } from './types';
+
+export const RulesListNotifyBadgeWithApi: React.FunctionComponent<
+  RulesListNotifyBadgePropsWithApi
+> = (props) => {
+  const { onRuleChanged, rule, isLoading, showTooltipInline, showOnHover } = props;
+  const { http } = useKibana().services;
+  const [currentlyOpenNotify, setCurrentlyOpenNotify] = useState<string>();
+  const [loadingSnoozeAction, setLoadingSnoozeAction] = useState<boolean>(false);
+  const [ruleSnoozeInfo, setRuleSnoozeInfo] =
+    useState<RulesListNotifyBadgePropsWithApi['rule']>(rule);
+
+  const onSnoozeRule = useCallback(
+    (snoozeSchedule: SnoozeSchedule) => {
+      return snoozeRuleApi({ http, id: ruleSnoozeInfo.id, snoozeSchedule });
+    },
+    [http, ruleSnoozeInfo.id]
+  );
+
+  const onUnsnoozeRule = useCallback(
+    (scheduleIds?: string[]) => {
+      return unsnoozeRuleApi({ http, id: ruleSnoozeInfo.id, scheduleIds });
+    },
+    [http, ruleSnoozeInfo.id]
+  );
+
+  const onRuleChangedCallback = useCallback(async () => {
+    const updatedRule = await loadRule({
+      http,
+      ruleId: ruleSnoozeInfo.id,
+    });
+    setLoadingSnoozeAction(false);
+    setRuleSnoozeInfo((prevRule) => ({
+      ...prevRule,
+      activeSnoozes: updatedRule.activeSnoozes,
+      isSnoozedUntil: updatedRule.isSnoozedUntil,
+      muteAll: updatedRule.muteAll,
+      snoozeSchedule: updatedRule.snoozeSchedule,
+    }));
+    onRuleChanged();
+  }, [http, ruleSnoozeInfo.id, onRuleChanged]);
+
+  const openSnooze = useCallback(() => {
+    setCurrentlyOpenNotify(props.rule.id);
+  }, [props.rule.id]);
+
+  const closeSnooze = useCallback(() => {
+    setCurrentlyOpenNotify('');
+  }, []);
+
+  const onLoading = useCallback((value: boolean) => {
+    if (value) {
+      setLoadingSnoozeAction(value);
+    }
+  }, []);
+
+  return (
+    <RulesListNotifyBadge
+      rule={ruleSnoozeInfo}
+      isOpen={currentlyOpenNotify === ruleSnoozeInfo.id}
+      isLoading={isLoading || loadingSnoozeAction}
+      onClick={openSnooze}
+      onClose={closeSnooze}
+      onLoading={onLoading}
+      onRuleChanged={onRuleChangedCallback}
+      snoozeRule={onSnoozeRule}
+      unsnoozeRule={onUnsnoozeRule}
+      showTooltipInline={showTooltipInline}
+      showOnHover={showOnHover}
+    />
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/translations.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/translations.tsx
new file mode 100644
index 0000000000000..9b6a0f74ab461
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/translations.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const SNOOZE_SUCCESS_MESSAGE = i18n.translate(
+  'xpack.triggersActionsUI.sections.rulesList.rulesListSnoozePanel.snoozeSuccess',
+  {
+    defaultMessage: 'Rule successfully snoozed',
+  }
+);
+
+export const UNSNOOZE_SUCCESS_MESSAGE = i18n.translate(
+  'xpack.triggersActionsUI.sections.rulesList.rulesListSnoozePanel.unsnoozeSuccess',
+  {
+    defaultMessage: 'Rule successfully unsnoozed',
+  }
+);
+
+export const SNOOZE_FAILED_MESSAGE = i18n.translate(
+  'xpack.triggersActionsUI.sections.rulesList.rulesListSnoozePanel.snoozeFailed',
+  {
+    defaultMessage: 'Unable to change rule snooze settings',
+  }
+);
+
+export const OPEN_SNOOZE_PANEL_ARIA_LABEL = i18n.translate(
+  'xpack.triggersActionsUI.sections.rulesList.rulesListNotifyBadge.openSnoozePanel',
+  { defaultMessage: 'Open snooze panel' }
+);
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/types.ts
new file mode 100644
index 0000000000000..b93e4d0d4677f
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/notify_badge/types.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { RuleTableItem, SnoozeSchedule } from '../../../../../types';
+
+export interface RulesListNotifyBadgeProps {
+  rule: Pick<
+    RuleTableItem,
+    'id' | 'activeSnoozes' | 'isSnoozedUntil' | 'muteAll' | 'isEditable' | 'snoozeSchedule'
+  >;
+  isOpen: boolean;
+  isLoading: boolean;
+  previousSnoozeInterval?: string | null;
+  onClick: React.MouseEventHandler<HTMLButtonElement>;
+  onClose: () => void;
+  onLoading: (isLoading: boolean) => void;
+  onRuleChanged: () => void;
+  snoozeRule: (schedule: SnoozeSchedule, muteAll?: boolean) => Promise<void>;
+  unsnoozeRule: (scheduleIds?: string[]) => Promise<void>;
+  showTooltipInline?: boolean;
+  showOnHover?: boolean;
+}
+
+export type RulesListNotifyBadgePropsWithApi = Pick<
+  RulesListNotifyBadgeProps,
+  'rule' | 'isLoading' | 'onRuleChanged' | 'showOnHover' | 'showTooltipInline'
+>;
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rule_snooze_modal.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rule_snooze_modal.tsx
index c4624e7ea8e61..5d9b13eaded68 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rule_snooze_modal.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rule_snooze_modal.tsx
@@ -14,7 +14,7 @@ import {
   SNOOZE_FAILED_MESSAGE,
   SNOOZE_SUCCESS_MESSAGE,
   UNSNOOZE_SUCCESS_MESSAGE,
-} from './rules_list_notify_badge';
+} from './notify_badge';
 import { SnoozePanel, futureTimeToInterval } from './rule_snooze';
 import { Rule, RuleTypeParams, SnoozeSchedule } from '../../../../types';
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_table.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_table.tsx
index 65eef52e45575..ad0ef22c812c5 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_table.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_table.tsx
@@ -60,7 +60,7 @@ import { getFormattedSuccessRatio } from '../../../lib/monitoring_utils';
 import { hasAllPrivilege } from '../../../lib/capabilities';
 import { RuleTagBadge } from './rule_tag_badge';
 import { RuleStatusDropdown } from './rule_status_dropdown';
-import { RulesListNotifyBadge } from './rules_list_notify_badge';
+import { RulesListNotifyBadge } from './notify_badge';
 import { RulesListTableStatusCell } from './rules_list_table_status_cell';
 import { getIsExperimentalFeatureEnabled } from '../../../../common/get_experimental_features';
 import { RulesListColumns, useRulesListColumnSelector } from './rules_list_column_selector';
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/get_rules_list_notify_badge.tsx b/x-pack/plugins/triggers_actions_ui/public/common/get_rules_list_notify_badge.tsx
index 31eea83e368de..5ab9318a307bb 100644
--- a/x-pack/plugins/triggers_actions_ui/public/common/get_rules_list_notify_badge.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/common/get_rules_list_notify_badge.tsx
@@ -6,9 +6,9 @@
  */
 
 import React from 'react';
-import { RulesListNotifyBadge } from '../application/sections';
-import type { RulesListNotifyBadgeProps } from '../application/sections/rules_list/components/rules_list_notify_badge';
+import { RulesListNotifyBadgeWithApi } from '../application/sections';
+import type { RulesListNotifyBadgePropsWithApi } from '../application/sections/rules_list/components/notify_badge';
 
-export const getRulesListNotifyBadgeLazy = (props: RulesListNotifyBadgeProps) => {
-  return <RulesListNotifyBadge {...props} />;
+export const getRulesListNotifyBadgeLazy = (props: RulesListNotifyBadgePropsWithApi) => {
+  return <RulesListNotifyBadgeWithApi {...props} />;
 };
diff --git a/x-pack/plugins/triggers_actions_ui/public/plugin.ts b/x-pack/plugins/triggers_actions_ui/public/plugin.ts
index bc15b85a28ec1..514de57900cc3 100644
--- a/x-pack/plugins/triggers_actions_ui/public/plugin.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/plugin.ts
@@ -62,7 +62,7 @@ import type {
   RuleEventLogListProps,
   RuleEventLogListOptions,
   RulesListProps,
-  RulesListNotifyBadgeProps,
+  RulesListNotifyBadgePropsWithApi,
   AlertsTableConfigurationRegistry,
   CreateConnectorFlyoutProps,
   EditConnectorFlyoutProps,
@@ -125,8 +125,8 @@ export interface TriggersAndActionsUIPublicPluginStart {
   ) => ReactElement<RuleEventLogListProps<T>>;
   getRulesList: (props: RulesListProps) => ReactElement;
   getRulesListNotifyBadge: (
-    props: RulesListNotifyBadgeProps
-  ) => ReactElement<RulesListNotifyBadgeProps>;
+    props: RulesListNotifyBadgePropsWithApi
+  ) => ReactElement<RulesListNotifyBadgePropsWithApi>;
   getRuleDefinition: (props: RuleDefinitionProps) => ReactElement<RuleDefinitionProps>;
   getRuleStatusPanel: (props: RuleStatusPanelProps) => ReactElement<RuleStatusPanelProps>;
   getAlertSummaryWidget: (props: AlertSummaryWidgetProps) => ReactElement<AlertSummaryWidgetProps>;
@@ -408,7 +408,7 @@ export class Plugin
       getRuleEventLogList: <T extends RuleEventLogListOptions>(props: RuleEventLogListProps<T>) => {
         return getRuleEventLogListLazy(props);
       },
-      getRulesListNotifyBadge: (props: RulesListNotifyBadgeProps) => {
+      getRulesListNotifyBadge: (props: RulesListNotifyBadgePropsWithApi) => {
         return getRulesListNotifyBadgeLazy(props);
       },
       getRulesList: (props: RulesListProps) => {
diff --git a/x-pack/plugins/triggers_actions_ui/public/types.ts b/x-pack/plugins/triggers_actions_ui/public/types.ts
index b311ef1e8e390..b8157ee5af665 100644
--- a/x-pack/plugins/triggers_actions_ui/public/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/types.ts
@@ -71,7 +71,6 @@ import type {
 import type { AlertSummaryTimeRange } from './application/sections/alert_summary_widget/types';
 import type { CreateConnectorFlyoutProps } from './application/sections/action_connector_form/create_connector_flyout';
 import type { EditConnectorFlyoutProps } from './application/sections/action_connector_form/edit_connector_flyout';
-import type { RulesListNotifyBadgeProps } from './application/sections/rules_list/components/rules_list_notify_badge';
 import type {
   FieldBrowserOptions,
   CreateFieldComponent,
@@ -81,6 +80,8 @@ import type {
 } from './application/sections/field_browser/types';
 import { RulesListVisibleColumns } from './application/sections/rules_list/components/rules_list_column_selector';
 import { TimelineItem } from './application/sections/alerts_table/bulk_actions/components/toolbar';
+import type { RulesListNotifyBadgePropsWithApi } from './application/sections/rules_list/components/notify_badge';
+
 // In Triggers and Actions we treat all `Alert`s as `SanitizedRule<RuleTypeParams>`
 // so the `Params` is a black-box of Record<string, unknown>
 type SanitizedRule<Params extends RuleTypeParams = never> = Omit<
@@ -122,7 +123,7 @@ export type {
   RulesListProps,
   CreateConnectorFlyoutProps,
   EditConnectorFlyoutProps,
-  RulesListNotifyBadgeProps,
+  RulesListNotifyBadgePropsWithApi,
   FieldBrowserProps,
   FieldBrowserOptions,
   CreateFieldComponent,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/alerts.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/alerts.ts
index 2bd37598fe1b2..60e6daee3d51d 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/alerts.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/alerts.ts
@@ -57,6 +57,38 @@ export default function alertTests({ getService }: FtrProviderContext) {
         let alertUtils: AlertUtils;
         let indexRecordActionId: string;
 
+        const getAlertInfo = (alertId: string, actions: any) => ({
+          id: alertId,
+          consumer: 'alertsFixture',
+          spaceId: space.id,
+          namespace: space.id,
+          name: 'abc',
+          enabled: true,
+          notifyWhen: 'onActiveAlert',
+          schedule: {
+            interval: '1m',
+          },
+          tags: ['tag-A', 'tag-B'],
+          throttle: '1m',
+          createdBy: user.fullName,
+          updatedBy: user.fullName,
+          actions: actions.map((action: any) => {
+            /* eslint-disable @typescript-eslint/naming-convention */
+            const { connector_type_id, group, id, params } = action;
+            return {
+              actionTypeId: connector_type_id,
+              group,
+              id,
+              params,
+            };
+          }),
+          producer: 'alertsFixture',
+          ruleTypeId: 'test.always-firing',
+          ruleTypeName: 'Test: Always Firing',
+          muteAll: false,
+          snoozeSchedule: [],
+        });
+
         before(async () => {
           const { body: createdAction } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/actions/connector`)
@@ -144,35 +176,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
                   index: ES_TEST_INDEX_NAME,
                   reference,
                 },
-                alertInfo: {
-                  id: alertId,
-                  consumer: 'alertsFixture',
-                  spaceId: space.id,
-                  namespace: space.id,
-                  name: 'abc',
-                  enabled: true,
-                  notifyWhen: 'onActiveAlert',
-                  schedule: {
-                    interval: '1m',
-                  },
-                  tags: ['tag-A', 'tag-B'],
-                  throttle: '1m',
-                  createdBy: user.fullName,
-                  updatedBy: user.fullName,
-                  actions: response.body.actions.map((action: any) => {
-                    /* eslint-disable @typescript-eslint/naming-convention */
-                    const { connector_type_id, group, id, params } = action;
-                    return {
-                      actionTypeId: connector_type_id,
-                      group,
-                      id,
-                      params,
-                    };
-                  }),
-                  producer: 'alertsFixture',
-                  ruleTypeId: 'test.always-firing',
-                  ruleTypeName: 'Test: Always Firing',
-                },
+                alertInfo: getAlertInfo(alertId, response.body.actions),
               });
               // @ts-expect-error _source: unknown
               expect(alertSearchResult.body.hits.hits[0]._source.alertInfo.createdAt).to.match(
@@ -296,35 +300,7 @@ instanceStateValue: true
                   index: ES_TEST_INDEX_NAME,
                   reference,
                 },
-                alertInfo: {
-                  id: alertId,
-                  consumer: 'alertsFixture',
-                  spaceId: space.id,
-                  namespace: space.id,
-                  name: 'abc',
-                  enabled: true,
-                  notifyWhen: 'onActiveAlert',
-                  schedule: {
-                    interval: '1m',
-                  },
-                  tags: ['tag-A', 'tag-B'],
-                  throttle: '1m',
-                  createdBy: user.fullName,
-                  updatedBy: user.fullName,
-                  actions: response.body.actions.map((action: any) => {
-                    /* eslint-disable @typescript-eslint/naming-convention */
-                    const { connector_type_id, group, id, params } = action;
-                    return {
-                      actionTypeId: connector_type_id,
-                      group,
-                      id,
-                      params,
-                    };
-                  }),
-                  producer: 'alertsFixture',
-                  ruleTypeId: 'test.always-firing',
-                  ruleTypeName: 'Test: Always Firing',
-                },
+                alertInfo: getAlertInfo(alertId, response.body.actions),
               });
 
               // @ts-expect-error _source: unknown
@@ -456,6 +432,8 @@ instanceStateValue: true
             producer: 'alertsFixture',
             ruleTypeId: 'test.always-firing',
             ruleTypeName: 'Test: Always Firing',
+            muteAll: false,
+            snoozeSchedule: [],
           });
 
           // @ts-expect-error _source: unknown
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/index.ts
index ea009fc24bbc6..bcaefee55b1e5 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/index.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/index.ts
@@ -32,21 +32,21 @@ export default function alertingTests({ loadTestFile, getService }: FtrProviderC
         await tearDown(getService);
       });
 
-      loadTestFile(require.resolve('./mute_all'));
-      loadTestFile(require.resolve('./mute_instance'));
-      loadTestFile(require.resolve('./unmute_all'));
-      loadTestFile(require.resolve('./unmute_instance'));
-      loadTestFile(require.resolve('./update'));
-      loadTestFile(require.resolve('./update_api_key'));
+      // loadTestFile(require.resolve('./mute_all'));
+      // loadTestFile(require.resolve('./mute_instance'));
+      // loadTestFile(require.resolve('./unmute_all'));
+      // loadTestFile(require.resolve('./unmute_instance'));
+      // loadTestFile(require.resolve('./update'));
+      // loadTestFile(require.resolve('./update_api_key'));
       loadTestFile(require.resolve('./alerts'));
-      loadTestFile(require.resolve('./event_log'));
-      loadTestFile(require.resolve('./mustache_templates'));
-      loadTestFile(require.resolve('./health'));
-      loadTestFile(require.resolve('./excluded'));
-      loadTestFile(require.resolve('./snooze'));
-      loadTestFile(require.resolve('./global_execution_log'));
-      loadTestFile(require.resolve('./get_global_execution_kpi'));
-      loadTestFile(require.resolve('./get_action_error_log'));
+      // loadTestFile(require.resolve('./event_log'));
+      // loadTestFile(require.resolve('./mustache_templates'));
+      // loadTestFile(require.resolve('./health'));
+      // loadTestFile(require.resolve('./excluded'));
+      // loadTestFile(require.resolve('./snooze'));
+      // loadTestFile(require.resolve('./global_execution_log'));
+      // loadTestFile(require.resolve('./get_global_execution_kpi'));
+      // loadTestFile(require.resolve('./get_action_error_log'));
     });
   });
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/alerts_base.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/alerts_base.ts
index 868d3f24f50e2..8e0d7b27cfa4d 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/alerts_base.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/alerts_base.ts
@@ -124,6 +124,8 @@ export function alertTests({ getService }: FtrProviderContext, space: Space) {
           producer: 'alertsFixture',
           ruleTypeId: 'test.always-firing',
           ruleTypeName: 'Test: Always Firing',
+          muteAll: false,
+          snoozeSchedule: [],
         },
       };
       if (expected.alertInfo.namespace === undefined) {

From 0a0d34a71e6f36f0a4212c6e8e11b9aeb14db433 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Marcondes?=
 <55978943+cauemarcondes@users.noreply.github.com>
Date: Tue, 7 Feb 2023 08:49:29 -0500
Subject: [PATCH 056/134] [APM] adding storybook to generate trace waterfall
 from json (#150387)

<img width="2003" alt="Screenshot 2023-02-06 at 4 09 24 PM"
src="https://user-images.githubusercontent.com/55978943/217088695-4281c27c-5de1-4968-8a7c-434135985eae.png">
---
 .../waterfall_container.stories.tsx           | 54 ++++++++++++++++++-
 1 file changed, 52 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/waterfall_container.stories.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/waterfall_container.stories.tsx
index e0f48f9bed781..5cdaa756d4fd0 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/waterfall_container.stories.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/waterfall_container.stories.tsx
@@ -4,11 +4,12 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { EuiFilePicker, EuiForm } from '@elastic/eui';
 import { apm, dedot } from '@kbn/apm-synthtrace-client';
 import { ProcessorEvent } from '@kbn/observability-plugin/common';
 import { Meta, Story } from '@storybook/react';
 import { noop } from 'lodash';
-import React, { ComponentProps } from 'react';
+import React, { ComponentProps, useState } from 'react';
 import { WaterfallContainer } from '.';
 import {
   WaterfallError,
@@ -16,8 +17,9 @@ import {
   WaterfallTransaction,
 } from '../../../../../../common/waterfall/typings';
 import { Transaction } from '../../../../../../typings/es_schemas/ui/transaction';
-import { getWaterfall } from './waterfall/waterfall_helpers/waterfall_helpers';
 import { MockApmPluginStorybook } from '../../../../../context/apm_plugin/mock_apm_plugin_storybook';
+import { APIReturnType } from '../../../../../services/rest/create_call_apm_api';
+import { getWaterfall } from './waterfall/waterfall_helpers/waterfall_helpers';
 
 type Args = ComponentProps<typeof WaterfallContainer>;
 
@@ -97,3 +99,51 @@ export const Example: Story<any> = () => {
     />
   );
 };
+type TraceAPIResponse = APIReturnType<'GET /internal/apm/traces/{traceId}'>;
+
+export const WaterfallFromJSON: Story<{}> = () => {
+  const [json, setJson] = useState<string | undefined>();
+
+  function renderWaterfall() {
+    if (!json) {
+      return null;
+    }
+    const waterfall = getWaterfall(JSON.parse(json) as TraceAPIResponse);
+    return (
+      <WaterfallContainer
+        serviceName={waterfall.entryTransaction?.service.name}
+        waterfall={waterfall}
+        showCriticalPath={false}
+        onShowCriticalPathChange={noop}
+      />
+    );
+  }
+
+  return (
+    <EuiForm>
+      <EuiFilePicker
+        display={'large'}
+        fullWidth={true}
+        style={{ height: '100%' }}
+        initialPromptText="Upload a JSON file"
+        onChange={(event) => {
+          const item = event?.item(0);
+
+          if (item) {
+            const f = new FileReader();
+            f.onload = (onloadEvent) => {
+              const result = onloadEvent?.target?.result;
+              if (typeof result === 'string') {
+                setJson(result);
+              }
+            };
+            f.readAsText(item);
+          } else {
+            setJson(undefined);
+          }
+        }}
+      />
+      {renderWaterfall()}
+    </EuiForm>
+  );
+};

From 0c54162f340edd4dd0219a91d1e8082fa0bacf94 Mon Sep 17 00:00:00 2001
From: Miriam <31922082+MiriamAparicio@users.noreply.github.com>
Date: Tue, 7 Feb 2023 13:53:45 +0000
Subject: [PATCH 057/134] [APM] Added map and location metrics transactions
 mobile page (#150336)

Closes https://github.com/elastic/kibana/issues/146873

<img width="1578" alt="image"
src="https://user-images.githubusercontent.com/31922082/217003863-9dba2f0c-9bd3-401a-aa61-8ffc8473731e.png">

(comparison is not showing in screenshot, because of sythtrace data)
---
 .../app/mobile/service_overview/index.tsx     | 152 +++++++++---------
 .../service_overview/stats/location_stats.tsx |  14 +-
 .../app/mobile/transaction_overview/index.tsx |  35 ++++
 .../use_filters_for_embeddable_charts.ts      |  14 +-
 4 files changed, 127 insertions(+), 88 deletions(-)

diff --git a/x-pack/plugins/apm/public/components/app/mobile/service_overview/index.tsx b/x-pack/plugins/apm/public/components/app/mobile/service_overview/index.tsx
index 6e0f786aaf731..6282c581e477f 100644
--- a/x-pack/plugins/apm/public/components/app/mobile/service_overview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/mobile/service_overview/index.tsx
@@ -52,7 +52,6 @@ export const chartHeight = 288;
 export function MobileServiceOverview() {
   const { serviceName } = useApmServiceContext();
   const router = useApmRouter();
-  const embeddableFilters = useFiltersForEmbeddableCharts();
 
   const {
     query,
@@ -65,9 +64,16 @@ export function MobileServiceOverview() {
       osVersion,
       appVersion,
       netConnectionType,
+      offset,
+      comparisonEnabled,
     },
   } = useApmParams('/mobile-services/{serviceName}/overview');
 
+  const embeddableFilters = useFiltersForEmbeddableCharts({
+    serviceName,
+    environment,
+  });
+
   const kueryWithMobileFilters = getKueryWithMobileFilters({
     device,
     osVersion,
@@ -151,29 +157,33 @@ export function MobileServiceOverview() {
             <EuiSpacer size="s" />
           </EuiFlexItem>
           <EuiFlexItem>
-            <EuiFlexGroup>
-              <EuiFlexItem grow={8}>
-                <EuiPanel hasBorder={true}>
+            <EuiPanel hasBorder={true}>
+              <EuiFlexGroup>
+                <EuiFlexItem grow={8}>
                   <GeoMap
                     start={start}
                     end={end}
                     kuery={kueryWithMobileFilters}
                     filters={embeddableFilters}
                   />
-                </EuiPanel>
-              </EuiFlexItem>
-              <EuiFlexItem grow={4}>
-                <MobileLocationStats
-                  start={start}
-                  end={end}
-                  kuery={kueryWithMobileFilters}
-                />
-              </EuiFlexItem>
-            </EuiFlexGroup>
+                </EuiFlexItem>
+                <EuiFlexItem grow={4}>
+                  <MobileLocationStats
+                    start={start}
+                    end={end}
+                    kuery={kueryWithMobileFilters}
+                    environment={environment}
+                    offset={offset}
+                    serviceName={serviceName}
+                    comparisonEnabled={comparisonEnabled}
+                  />
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            </EuiPanel>
           </EuiFlexItem>
 
           <EuiFlexItem>
-            <EuiPanel hasBorder={true} color="subdued">
+            <EuiPanel hasBorder={true}>
               <EuiFlexItem grow={false}>
                 <EuiTitle size="xs">
                   <h2>
@@ -187,76 +197,68 @@ export function MobileServiceOverview() {
               <EuiFlexGroup direction={rowDirection} gutterSize="s">
                 {/* Device */}
                 <EuiFlexItem>
-                  <EuiPanel hasBorder={true}>
-                    <MostUsedChart
-                      title={i18n.translate(
-                        'xpack.apm.serviceOverview.mostUsed.device',
-                        {
-                          defaultMessage: 'Devices',
-                        }
-                      )}
-                      metric={DEVICE_MODEL_IDENTIFIER}
-                      start={start}
-                      end={end}
-                      kuery={kueryWithMobileFilters}
-                      filters={embeddableFilters}
-                    />
-                  </EuiPanel>
+                  <MostUsedChart
+                    title={i18n.translate(
+                      'xpack.apm.serviceOverview.mostUsed.device',
+                      {
+                        defaultMessage: 'Devices',
+                      }
+                    )}
+                    metric={DEVICE_MODEL_IDENTIFIER}
+                    start={start}
+                    end={end}
+                    kuery={kueryWithMobileFilters}
+                    filters={embeddableFilters}
+                  />
                 </EuiFlexItem>
                 {/* NCT */}
                 <EuiFlexItem>
-                  <EuiPanel hasBorder={true}>
-                    <MostUsedChart
-                      title={i18n.translate(
-                        'xpack.apm.serviceOverview.mostUsed.nct',
-                        {
-                          defaultMessage: 'Network Connection Type',
-                        }
-                      )}
-                      metric={NETWORK_CONNECTION_TYPE}
-                      start={start}
-                      end={end}
-                      kuery={kueryWithMobileFilters}
-                      filters={embeddableFilters}
-                    />
-                  </EuiPanel>
+                  <MostUsedChart
+                    title={i18n.translate(
+                      'xpack.apm.serviceOverview.mostUsed.nct',
+                      {
+                        defaultMessage: 'Network Connection Type',
+                      }
+                    )}
+                    metric={NETWORK_CONNECTION_TYPE}
+                    start={start}
+                    end={end}
+                    kuery={kueryWithMobileFilters}
+                    filters={embeddableFilters}
+                  />
                 </EuiFlexItem>
                 <EuiSpacer size="s" />
                 {/* OS version */}
                 <EuiFlexItem>
-                  <EuiPanel hasBorder={true}>
-                    <MostUsedChart
-                      title={i18n.translate(
-                        'xpack.apm.serviceOverview.mostUsed.osVersion',
-                        {
-                          defaultMessage: 'OS version',
-                        }
-                      )}
-                      metric={HOST_OS_VERSION}
-                      start={start}
-                      end={end}
-                      kuery={kueryWithMobileFilters}
-                      filters={embeddableFilters}
-                    />
-                  </EuiPanel>
+                  <MostUsedChart
+                    title={i18n.translate(
+                      'xpack.apm.serviceOverview.mostUsed.osVersion',
+                      {
+                        defaultMessage: 'OS version',
+                      }
+                    )}
+                    metric={HOST_OS_VERSION}
+                    start={start}
+                    end={end}
+                    kuery={kueryWithMobileFilters}
+                    filters={embeddableFilters}
+                  />
                 </EuiFlexItem>
                 {/* App version */}
                 <EuiFlexItem>
-                  <EuiPanel hasBorder={true}>
-                    <MostUsedChart
-                      title={i18n.translate(
-                        'xpack.apm.serviceOverview.mostUsed.appVersion',
-                        {
-                          defaultMessage: 'App version',
-                        }
-                      )}
-                      metric={SERVICE_VERSION}
-                      start={start}
-                      end={end}
-                      kuery={kueryWithMobileFilters}
-                      filters={embeddableFilters}
-                    />
-                  </EuiPanel>
+                  <MostUsedChart
+                    title={i18n.translate(
+                      'xpack.apm.serviceOverview.mostUsed.appVersion',
+                      {
+                        defaultMessage: 'App version',
+                      }
+                    )}
+                    metric={SERVICE_VERSION}
+                    start={start}
+                    end={end}
+                    kuery={kueryWithMobileFilters}
+                    filters={embeddableFilters}
+                  />
                 </EuiFlexItem>
               </EuiFlexGroup>
             </EuiPanel>
diff --git a/x-pack/plugins/apm/public/components/app/mobile/service_overview/stats/location_stats.tsx b/x-pack/plugins/apm/public/components/app/mobile/service_overview/stats/location_stats.tsx
index 74d55f233570a..ccded09c50e52 100644
--- a/x-pack/plugins/apm/public/components/app/mobile/service_overview/stats/location_stats.tsx
+++ b/x-pack/plugins/apm/public/components/app/mobile/service_overview/stats/location_stats.tsx
@@ -9,7 +9,6 @@ import { i18n } from '@kbn/i18n';
 import { EuiIcon, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import React, { useCallback } from 'react';
 import { useTheme } from '@kbn/observability-plugin/public';
-import { useAnyOfApmParams } from '../../../../../hooks/use_apm_params';
 import { useFetcher, isPending } from '../../../../../hooks/use_fetcher';
 import { CLIENT_GEO_COUNTRY_NAME } from '../../../../../../common/es_fields/apm';
 import { NOT_AVAILABLE_LABEL } from '../../../../../../common/i18n';
@@ -50,18 +49,21 @@ export function MobileLocationStats({
   start,
   end,
   kuery,
+  serviceName,
+  offset,
+  environment,
+  comparisonEnabled,
 }: {
   start: string;
   end: string;
   kuery: string;
+  serviceName: string;
+  offset?: string;
+  environment: string;
+  comparisonEnabled: boolean;
 }) {
   const euiTheme = useTheme();
 
-  const {
-    path: { serviceName },
-    query: { environment, offset, comparisonEnabled },
-  } = useAnyOfApmParams('/mobile-services/{serviceName}/overview');
-
   const previousPeriodLabel = usePreviousPeriodLabel();
 
   const locationField = CLIENT_GEO_COUNTRY_NAME;
diff --git a/x-pack/plugins/apm/public/components/app/mobile/transaction_overview/index.tsx b/x-pack/plugins/apm/public/components/app/mobile/transaction_overview/index.tsx
index 4d1ae6372668a..f6fc9556c0de2 100644
--- a/x-pack/plugins/apm/public/components/app/mobile/transaction_overview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/mobile/transaction_overview/index.tsx
@@ -10,6 +10,7 @@ import {
   EuiHorizontalRule,
   EuiPanel,
   EuiSpacer,
+  EuiFlexGroup,
 } from '@elastic/eui';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
@@ -20,6 +21,9 @@ import { TransactionsTable } from '../../../shared/transactions_table';
 import { replace } from '../../../shared/links/url_helpers';
 import { getKueryWithMobileFilters } from '../../../../../common/utils/get_kuery_with_mobile_filters';
 import { MobileTransactionCharts } from './transaction_charts';
+import { MobileLocationStats } from '../service_overview/stats/location_stats';
+import { useFiltersForEmbeddableCharts } from '../../../../hooks/use_filters_for_embeddable_charts';
+import { GeoMap } from '../service_overview/geo_map';
 
 export function MobileTransactionOverview() {
   const {
@@ -39,6 +43,11 @@ export function MobileTransactionOverview() {
     },
   } = useApmParams('/mobile-services/{serviceName}/transactions');
 
+  const embeddableFilters = useFiltersForEmbeddableCharts({
+    serviceName,
+    environment,
+  });
+
   const kueryWithMobileFilters = getKueryWithMobileFilters({
     device,
     osVersion,
@@ -63,6 +72,32 @@ export function MobileTransactionOverview() {
       <EuiFlexItem>
         <EuiHorizontalRule />
       </EuiFlexItem>
+      <EuiFlexItem>
+        <EuiFlexGroup>
+          <EuiFlexItem grow={8}>
+            <EuiPanel hasBorder={true}>
+              <GeoMap
+                start={start}
+                end={end}
+                kuery={kueryWithMobileFilters}
+                filters={embeddableFilters}
+              />
+            </EuiPanel>
+          </EuiFlexItem>
+          <EuiFlexItem grow={4}>
+            <MobileLocationStats
+              start={start}
+              end={end}
+              kuery={kueryWithMobileFilters}
+              environment={environment}
+              serviceName={serviceName}
+              offset={offset}
+              comparisonEnabled={comparisonEnabled}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlexItem>
+      <EuiSpacer size="s" />
       <MobileTransactionCharts
         transactionType={transactionType}
         serviceName={serviceName}
diff --git a/x-pack/plugins/apm/public/hooks/use_filters_for_embeddable_charts.ts b/x-pack/plugins/apm/public/hooks/use_filters_for_embeddable_charts.ts
index b95d569ca8415..7e100131b1ad4 100644
--- a/x-pack/plugins/apm/public/hooks/use_filters_for_embeddable_charts.ts
+++ b/x-pack/plugins/apm/public/hooks/use_filters_for_embeddable_charts.ts
@@ -8,15 +8,15 @@
 import { useMemo } from 'react';
 import { SERVICE_NAME } from '../../common/es_fields/apm';
 import { termQuery } from '../../common/utils/term_query';
-import { useApmParams } from './use_apm_params';
 import { environmentQuery } from '../../common/utils/environment_query';
 
-export function useFiltersForEmbeddableCharts() {
-  const {
-    path: { serviceName },
-    query: { environment },
-  } = useApmParams('/mobile-services/{serviceName}/overview');
-
+export function useFiltersForEmbeddableCharts({
+  serviceName,
+  environment,
+}: {
+  serviceName: string;
+  environment: string;
+}) {
   return useMemo(
     () =>
       [

From 1854c310a3367ed228b29c763fa61ed5a83374ac Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Tue, 7 Feb 2023 14:54:17 +0100
Subject: [PATCH 058/134] [Profiling] Improved differential flamegraph controls
 (#150254)

Co-authored-by: boriskirov <boris.kirov@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Closes https://github.com/elastic/prodfiler/issues/2639
---
 x-pack/plugins/profiling/common/flamegraph.ts |   5 +
 .../flame_graphs_view/flame_graph_legend.tsx  |   1 +
 .../components/flame_graphs_view/index.tsx    | 206 ++++++++++----
 .../flame_graphs_view/normalization_menu.tsx  | 252 ++++++++++++++++++
 .../public/components/flamegraph.tsx          |  35 +--
 .../components/functions_view/index.tsx       |   2 +-
 .../primary_and_comparison_search_bar.tsx     |  60 ++++-
 .../profiling_search_bar.tsx                  |  12 +-
 .../profiling/public/routing/index.tsx        |  31 ++-
 .../utils/get_flamegraph_model/index.ts       |  10 +-
 10 files changed, 514 insertions(+), 100 deletions(-)
 create mode 100644 x-pack/plugins/profiling/public/components/flame_graphs_view/normalization_menu.tsx

diff --git a/x-pack/plugins/profiling/common/flamegraph.ts b/x-pack/plugins/profiling/common/flamegraph.ts
index eacd4a34322c5..2f6e0ae0188a8 100644
--- a/x-pack/plugins/profiling/common/flamegraph.ts
+++ b/x-pack/plugins/profiling/common/flamegraph.ts
@@ -15,6 +15,11 @@ export enum FlameGraphComparisonMode {
   Relative = 'relative',
 }
 
+export enum FlameGraphNormalizationMode {
+  Scale = 'scale',
+  Time = 'time',
+}
+
 export interface BaseFlameGraph {
   Size: number;
   Edges: number[][];
diff --git a/x-pack/plugins/profiling/public/components/flame_graphs_view/flame_graph_legend.tsx b/x-pack/plugins/profiling/public/components/flame_graphs_view/flame_graph_legend.tsx
index 7f63ecb9337f9..60d36ea833d92 100644
--- a/x-pack/plugins/profiling/public/components/flame_graphs_view/flame_graph_legend.tsx
+++ b/x-pack/plugins/profiling/public/components/flame_graphs_view/flame_graph_legend.tsx
@@ -52,6 +52,7 @@ export function FlameGraphLegend({
                         {legendItems.map(({ color, label }) => {
                           return (
                             <EuiFlexItem
+                              key={label}
                               style={{ backgroundColor: color, justifyContent: 'center' }}
                             >
                               {label ? (
diff --git a/x-pack/plugins/profiling/public/components/flame_graphs_view/index.tsx b/x-pack/plugins/profiling/public/components/flame_graphs_view/index.tsx
index 18abf1f3e66ae..3f418227fdc3f 100644
--- a/x-pack/plugins/profiling/public/components/flame_graphs_view/index.tsx
+++ b/x-pack/plugins/profiling/public/components/flame_graphs_view/index.tsx
@@ -4,10 +4,20 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { EuiButtonGroup, EuiFlexGroup, EuiFlexItem, EuiPageHeaderContentProps } from '@elastic/eui';
+import {
+  EuiButtonGroup,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiHorizontalRule,
+  EuiPageHeaderContentProps,
+  EuiPanel,
+  EuiSwitch,
+  EuiTitle,
+} from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import React from 'react';
-import { FlameGraphComparisonMode } from '../../../common/flamegraph';
+import { pick } from 'lodash';
+import React, { useState } from 'react';
+import { FlameGraphComparisonMode, FlameGraphNormalizationMode } from '../../../common/flamegraph';
 import { useProfilingParams } from '../../hooks/use_profiling_params';
 import { useProfilingRouter } from '../../hooks/use_profiling_router';
 import { useProfilingRoutePath } from '../../hooks/use_profiling_route_path';
@@ -19,6 +29,7 @@ import { FlameGraph } from '../flamegraph';
 import { PrimaryAndComparisonSearchBar } from '../primary_and_comparison_search_bar';
 import { ProfilingAppPageTemplate } from '../profiling_app_page_template';
 import { RedirectTo } from '../redirect_to';
+import { FlameGraphNormalizationOptions, NormalizationMenu } from './normalization_menu';
 
 export function FlameGraphsView({ children }: { children: React.ReactElement }) {
   const {
@@ -39,6 +50,10 @@ export function FlameGraphsView({ children }: { children: React.ReactElement })
   const comparisonMode =
     'comparisonMode' in query ? query.comparisonMode : FlameGraphComparisonMode.Absolute;
 
+  const normalizationMode = 'normalizationMode' in query ? query.normalizationMode : undefined;
+  const baseline = 'baseline' in query ? query.baseline : undefined;
+  const comparison = 'comparison' in query ? query.comparison : undefined;
+
   const {
     services: { fetchElasticFlamechart },
   } = useProfilingDependencies();
@@ -100,17 +115,19 @@ export function FlameGraphsView({ children }: { children: React.ReactElement })
       }),
       isSelected: isDifferentialView,
       href: profilingRouter.link('/flamegraphs/differential', {
+        // @ts-expect-error Code gets too complicated to satisfy TS constraints
         query: {
           ...query,
           comparisonRangeFrom: query.rangeFrom,
           comparisonRangeTo: query.rangeTo,
           comparisonKuery: query.kuery,
-          comparisonMode,
         },
       }),
     },
   ];
 
+  const [showInformationWindow, setShowInformationWindow] = useState(false);
+
   if (routePath === '/flamegraphs') {
     return <RedirectTo pathname="/flamegraphs/flamegraph" />;
   }
@@ -120,58 +137,129 @@ export function FlameGraphsView({ children }: { children: React.ReactElement })
       <EuiFlexGroup direction="column">
         {isDifferentialView ? (
           <EuiFlexItem grow={false}>
-            <EuiFlexGroup direction="row" gutterSize="s" alignItems="center">
-              <EuiFlexItem grow>
-                <PrimaryAndComparisonSearchBar />
-              </EuiFlexItem>
-              <EuiFlexItem grow={false}>
-                <EuiButtonGroup
-                  legend={i18n.translate(
-                    'xpack.profiling.flameGraphsView.differentialFlameGraphComparisonModeLegend',
-                    {
-                      defaultMessage:
-                        'This switch allows you to switch between an absolute and relative comparison between both graphs',
-                    }
-                  )}
-                  type="single"
-                  buttonSize="m"
-                  idSelected={comparisonMode}
-                  onChange={(nextComparisonMode) => {
-                    if (!('comparisonRangeFrom' in query)) {
-                      return;
-                    }
-
-                    profilingRouter.push(routePath, {
-                      path,
-                      query: {
-                        ...query,
-                        comparisonMode: nextComparisonMode as FlameGraphComparisonMode,
-                      },
-                    });
-                  }}
-                  options={[
-                    {
-                      id: FlameGraphComparisonMode.Absolute,
-                      label: i18n.translate(
-                        'xpack.profiling.flameGraphsView.differentialFlameGraphComparisonModeAbsoluteButtonLabel',
-                        {
-                          defaultMessage: 'Abs',
-                        }
-                      ),
-                    },
-                    {
-                      id: FlameGraphComparisonMode.Relative,
-                      label: i18n.translate(
-                        'xpack.profiling.flameGraphsView.differentialFlameGraphComparisonModeRelativeButtonLabel',
-                        {
-                          defaultMessage: 'Rel',
-                        }
-                      ),
-                    },
-                  ]}
-                />
-              </EuiFlexItem>
-            </EuiFlexGroup>
+            <EuiPanel hasShadow={false} color="subdued">
+              <PrimaryAndComparisonSearchBar />
+              <EuiHorizontalRule />
+              <EuiFlexGroup direction="row">
+                <EuiFlexItem grow={false}>
+                  <EuiFlexGroup direction="row" gutterSize="m" alignItems="center">
+                    <EuiFlexItem grow={false}>
+                      <EuiTitle size="xxs">
+                        <h3>
+                          {i18n.translate(
+                            'xpack.profiling.flameGraphsView.differentialFlameGraphComparisonModeTitle',
+                            { defaultMessage: 'Format' }
+                          )}
+                        </h3>
+                      </EuiTitle>
+                    </EuiFlexItem>
+                    <EuiFlexItem grow={false}>
+                      <EuiButtonGroup
+                        legend={i18n.translate(
+                          'xpack.profiling.flameGraphsView.differentialFlameGraphComparisonModeLegend',
+                          {
+                            defaultMessage:
+                              'This switch allows you to switch between an absolute and relative comparison between both graphs',
+                          }
+                        )}
+                        type="single"
+                        buttonSize="s"
+                        idSelected={comparisonMode}
+                        onChange={(nextComparisonMode) => {
+                          if (!('comparisonRangeFrom' in query)) {
+                            return;
+                          }
+
+                          profilingRouter.push(routePath, {
+                            path,
+                            query: {
+                              ...query,
+                              ...(nextComparisonMode === FlameGraphComparisonMode.Absolute
+                                ? {
+                                    comparisonMode: FlameGraphComparisonMode.Absolute,
+                                    normalizationMode: FlameGraphNormalizationMode.Time,
+                                  }
+                                : { comparisonMode: FlameGraphComparisonMode.Relative }),
+                            },
+                          });
+                        }}
+                        options={[
+                          {
+                            id: FlameGraphComparisonMode.Absolute,
+                            label: i18n.translate(
+                              'xpack.profiling.flameGraphsView.differentialFlameGraphComparisonModeAbsoluteButtonLabel',
+                              {
+                                defaultMessage: 'Abs',
+                              }
+                            ),
+                          },
+                          {
+                            id: FlameGraphComparisonMode.Relative,
+                            label: i18n.translate(
+                              'xpack.profiling.flameGraphsView.differentialFlameGraphComparisonModeRelativeButtonLabel',
+                              {
+                                defaultMessage: 'Rel',
+                              }
+                            ),
+                          },
+                        ]}
+                      />
+                    </EuiFlexItem>
+                  </EuiFlexGroup>
+                </EuiFlexItem>
+                {comparisonMode === FlameGraphComparisonMode.Absolute ? (
+                  <EuiFlexItem grow={false}>
+                    <EuiFlexGroup direction="row" gutterSize="m" alignItems="center">
+                      <EuiFlexItem grow={false}>
+                        <NormalizationMenu
+                          onChange={(options) => {
+                            profilingRouter.push(routePath, {
+                              path: routePath,
+                              // @ts-expect-error Code gets too complicated to satisfy TS constraints
+                              query: {
+                                ...query,
+                                ...pick(options, 'baseline', 'comparison'),
+                                normalizationMode: options.mode,
+                              },
+                            });
+                          }}
+                          totalSeconds={
+                            (new Date(timeRange.end).getTime() -
+                              new Date(timeRange.start).getTime()) /
+                            1000
+                          }
+                          comparisonTotalSeconds={
+                            (new Date(comparisonTimeRange.end!).getTime() -
+                              new Date(comparisonTimeRange.start!).getTime()) /
+                            1000
+                          }
+                          options={
+                            (normalizationMode === FlameGraphNormalizationMode.Time
+                              ? { mode: FlameGraphNormalizationMode.Time }
+                              : {
+                                  mode: FlameGraphNormalizationMode.Scale,
+                                  baseline,
+                                  comparison,
+                                }) as FlameGraphNormalizationOptions
+                          }
+                        />
+                      </EuiFlexItem>
+                    </EuiFlexGroup>
+                  </EuiFlexItem>
+                ) : undefined}
+                <EuiFlexItem grow style={{ alignItems: 'flex-end' }}>
+                  <EuiSwitch
+                    checked={showInformationWindow}
+                    onChange={() => {
+                      setShowInformationWindow((prev) => !prev);
+                    }}
+                    label={i18n.translate('xpack.profiling.flameGraph.showInformationWindow', {
+                      defaultMessage: 'Show information window',
+                    })}
+                  />
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            </EuiPanel>
           </EuiFlexItem>
         ) : null}
         <EuiFlexItem>
@@ -181,6 +269,12 @@ export function FlameGraphsView({ children }: { children: React.ReactElement })
               primaryFlamegraph={data?.primaryFlamegraph}
               comparisonFlamegraph={data?.comparisonFlamegraph}
               comparisonMode={comparisonMode}
+              baseline={baseline}
+              comparison={comparison}
+              showInformationWindow={showInformationWindow}
+              onInformationWindowClose={() => {
+                setShowInformationWindow(false);
+              }}
             />
           </AsyncComponent>
           {children}
diff --git a/x-pack/plugins/profiling/public/components/flame_graphs_view/normalization_menu.tsx b/x-pack/plugins/profiling/public/components/flame_graphs_view/normalization_menu.tsx
new file mode 100644
index 0000000000000..72bc72aa64e78
--- /dev/null
+++ b/x-pack/plugins/profiling/public/components/flame_graphs_view/normalization_menu.tsx
@@ -0,0 +1,252 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiButton,
+  EuiButtonGroup,
+  EuiButtonIcon,
+  EuiFieldNumber,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormControlLayout,
+  EuiFormLabel,
+  EuiHorizontalRule,
+  EuiIconTip,
+  EuiPopover,
+  EuiSpacer,
+  EuiTitle,
+  useEuiTheme,
+  useGeneratedHtmlId,
+} from '@elastic/eui';
+import { css } from '@emotion/react';
+import { i18n } from '@kbn/i18n';
+import React, { useEffect, useState } from 'react';
+import { FlameGraphNormalizationMode } from '../../../common/flamegraph';
+
+export type FlameGraphNormalizationOptions =
+  | {
+      mode: FlameGraphNormalizationMode.Scale;
+      baseline: number;
+      comparison: number;
+    }
+  | { mode: FlameGraphNormalizationMode.Time };
+
+interface Props {
+  options: FlameGraphNormalizationOptions;
+  totalSeconds: number;
+  comparisonTotalSeconds: number;
+  onChange: (options: FlameGraphNormalizationOptions) => void;
+}
+
+const SCALE_LABEL = i18n.translate('xpack.profiling.flameGraphNormalizationMenu.scale', {
+  defaultMessage: 'Scale factor',
+});
+
+const TIME_LABEL = i18n.translate('xpack.profiling.flameGraphNormalizationMenu.time', {
+  defaultMessage: 'Time',
+});
+
+const NORMALIZE_BY_LABEL = i18n.translate(
+  'xpack.profiling.flameGraphNormalizationMenu.normalizeBy',
+  {
+    defaultMessage: 'Normalize by',
+  }
+);
+
+function getScaleFactorsBasedOnTime({
+  totalSeconds,
+  comparisonTotalSeconds,
+}: {
+  totalSeconds: number;
+  comparisonTotalSeconds: number;
+}) {
+  return {
+    baseline: 1,
+    comparison: totalSeconds / comparisonTotalSeconds,
+  };
+}
+
+export function NormalizationMenu(props: Props) {
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+
+  const theme = useEuiTheme();
+
+  const baselineScaleFactorInputId = useGeneratedHtmlId({ prefix: 'baselineScaleFactor' });
+  const comparisonScaleFactorInputId = useGeneratedHtmlId({ prefix: 'comparisonScaleFactor' });
+
+  const [options, setOptions] = useState(props.options);
+
+  useEffect(() => {
+    setOptions(props.options);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [
+    props.options.mode,
+    // @ts-expect-error can't refine because ESLint will complain
+    props.options.baseline,
+    // @ts-expect-error can't refine because ESLint will complain
+    props.options.comparison,
+  ]);
+
+  const { baseline, comparison } =
+    options.mode === FlameGraphNormalizationMode.Time
+      ? getScaleFactorsBasedOnTime({
+          comparisonTotalSeconds: props.comparisonTotalSeconds,
+          totalSeconds: props.totalSeconds,
+        })
+      : { comparison: options.comparison, baseline: options.baseline };
+
+  return (
+    <EuiPopover
+      anchorPosition="downRight"
+      initialFocus={`#${baselineScaleFactorInputId}`}
+      button={
+        <EuiFormControlLayout
+          onClick={() => {
+            setIsPopoverOpen((popoverOpen) => !popoverOpen);
+          }}
+          compressed
+          prepend={NORMALIZE_BY_LABEL}
+          append={
+            <EuiButtonIcon
+              iconType="arrowDown"
+              aria-label={i18n.translate(
+                'xpack.profiling.normalizationMenu.menuPopoverButtonAriaLabel',
+                { defaultMessage: 'Open normalization menu' }
+              )}
+            />
+          }
+          css={css`
+            .euiFormLabel {
+              max-width: none;
+            }
+          `}
+        >
+          <EuiFlexItem
+            style={{
+              height: '100%',
+              justifyContent: 'center',
+              backgroundColor: theme.euiTheme.colors.ghost,
+              padding: '0 16px',
+            }}
+          >
+            {props.options.mode === FlameGraphNormalizationMode.Scale ? SCALE_LABEL : TIME_LABEL}
+          </EuiFlexItem>
+        </EuiFormControlLayout>
+      }
+      isOpen={isPopoverOpen}
+      closePopover={() => setIsPopoverOpen(false)}
+    >
+      <EuiFlexGroup justifyContent="spaceBetween">
+        <EuiFlexItem>
+          <EuiTitle size="xxs">
+            <h4>{NORMALIZE_BY_LABEL}</h4>
+          </EuiTitle>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiIconTip
+            content={i18n.translate(
+              'xpack.profiling.flameGraphNormalizationMenu.normalizeByTooltip',
+              {
+                defaultMessage:
+                  'Normalization is the process of organizing a database to reduce redundancy and improve data integrity.',
+              }
+            )}
+            position="right"
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiHorizontalRule margin="s" />
+      <EuiButtonGroup
+        buttonSize="compressed"
+        isFullWidth
+        onChange={(id, value) => {
+          setOptions((prevOptions) => ({
+            ...prevOptions,
+            ...(id === FlameGraphNormalizationMode.Time
+              ? { mode: FlameGraphNormalizationMode.Time }
+              : { mode: FlameGraphNormalizationMode.Scale, baseline: 1, comparison: 1 }),
+          }));
+        }}
+        legend={i18n.translate('xpack.profiling.flameGraphNormalizationMode.selectModeLegend', {
+          defaultMessage: 'Select a normalization mode for the flamegraph',
+        })}
+        idSelected={options.mode}
+        options={[
+          {
+            id: FlameGraphNormalizationMode.Scale,
+            label: SCALE_LABEL,
+          },
+          {
+            id: FlameGraphNormalizationMode.Time,
+            label: TIME_LABEL,
+          },
+        ]}
+      />
+      <EuiSpacer size="m" />
+      <EuiTitle size="xxxs">
+        <h6>
+          {i18n.translate('xpack.profiling.normalizationMenu.baseline', {
+            defaultMessage: 'Baseline',
+          })}
+        </h6>
+      </EuiTitle>
+      <EuiSpacer size="s" />
+      <EuiFormControlLayout
+        fullWidth
+        prepend={<EuiFormLabel htmlFor={baselineScaleFactorInputId}>{SCALE_LABEL}</EuiFormLabel>}
+      >
+        <EuiFieldNumber
+          controlOnly
+          id={baselineScaleFactorInputId}
+          value={baseline}
+          onChange={(e) => {
+            setOptions((prevOptions) => ({ ...prevOptions, baseline: e.target.valueAsNumber }));
+          }}
+          disabled={options.mode === FlameGraphNormalizationMode.Time}
+        />
+      </EuiFormControlLayout>
+      <EuiSpacer size="m" />
+      <EuiTitle size="xxxs">
+        <h6>
+          {i18n.translate('xpack.profiling.normalizationMenu.comparison', {
+            defaultMessage: 'Comparison',
+          })}
+        </h6>
+      </EuiTitle>
+      <EuiSpacer size="s" />
+      <EuiFormControlLayout
+        fullWidth
+        prepend={<EuiFormLabel htmlFor={comparisonScaleFactorInputId}>{SCALE_LABEL}</EuiFormLabel>}
+      >
+        <EuiFieldNumber
+          controlOnly
+          id={comparisonScaleFactorInputId}
+          value={comparison}
+          onChange={(e) => {
+            setOptions((prevOptions) => ({
+              ...prevOptions,
+              comparison: e.target.valueAsNumber,
+            }));
+          }}
+          disabled={options.mode === FlameGraphNormalizationMode.Time}
+        />
+      </EuiFormControlLayout>
+      <EuiSpacer size="m" />
+      <EuiButton
+        onClick={() => {
+          props.onChange(options);
+          setIsPopoverOpen(false);
+        }}
+        fullWidth
+      >
+        {i18n.translate('xpack.profiling.normalizationMenu.applyChanges', {
+          defaultMessage: 'Apply changes',
+        })}
+      </EuiButton>
+    </EuiPopover>
+  );
+}
diff --git a/x-pack/plugins/profiling/public/components/flamegraph.tsx b/x-pack/plugins/profiling/public/components/flamegraph.tsx
index 82eded53e62b1..a1654c9bfbbd5 100644
--- a/x-pack/plugins/profiling/public/components/flamegraph.tsx
+++ b/x-pack/plugins/profiling/public/components/flamegraph.tsx
@@ -11,7 +11,6 @@ import {
   EuiFlexItem,
   EuiPanel,
   EuiSpacer,
-  EuiSwitch,
   EuiText,
   EuiTextColor,
   useEuiTheme,
@@ -98,22 +97,18 @@ function FlameGraphTooltip({
   label,
   countInclusive,
   countExclusive,
-  samples,
   totalSamples,
   comparisonCountInclusive,
   comparisonCountExclusive,
-  comparisonSamples,
   comparisonTotalSamples,
 }: {
   isRoot: boolean;
-  samples: number;
   label: string;
   countInclusive: number;
   countExclusive: number;
   totalSamples: number;
   comparisonCountInclusive?: number;
   comparisonCountExclusive?: number;
-  comparisonSamples?: number;
   comparisonTotalSamples?: number;
 }) {
   return (
@@ -179,6 +174,10 @@ export interface FlameGraphProps {
   comparisonMode: FlameGraphComparisonMode;
   primaryFlamegraph?: ElasticFlameGraph;
   comparisonFlamegraph?: ElasticFlameGraph;
+  baseline?: number;
+  comparison?: number;
+  showInformationWindow: boolean;
+  onInformationWindowClose: () => void;
 }
 
 export const FlameGraph: React.FC<FlameGraphProps> = ({
@@ -186,6 +185,10 @@ export const FlameGraph: React.FC<FlameGraphProps> = ({
   comparisonMode,
   primaryFlamegraph,
   comparisonFlamegraph,
+  baseline,
+  comparison,
+  showInformationWindow,
+  onInformationWindowClose,
 }) => {
   const theme = useEuiTheme();
 
@@ -197,6 +200,8 @@ export const FlameGraph: React.FC<FlameGraphProps> = ({
       colorDanger: theme.euiTheme.colors.danger,
       colorNeutral: theme.euiTheme.colors.lightShade,
       comparisonMode,
+      baseline,
+      comparison,
     });
   }, [
     primaryFlamegraph,
@@ -205,6 +210,8 @@ export const FlameGraph: React.FC<FlameGraphProps> = ({
     theme.euiTheme.colors.danger,
     theme.euiTheme.colors.lightShade,
     comparisonMode,
+    baseline,
+    comparison,
   ]);
 
   const chartTheme: PartialTheme = {
@@ -235,21 +242,8 @@ export const FlameGraph: React.FC<FlameGraphProps> = ({
     setHighlightedVmIndex(undefined);
   }, [columnarData.key]);
 
-  const [showInformationWindow, setShowInformationWindow] = useState(false);
-
   return (
     <EuiFlexGroup direction="column">
-      <EuiFlexItem grow={false} style={{ alignSelf: 'flex-end' }}>
-        <EuiSwitch
-          checked={showInformationWindow}
-          onChange={() => {
-            setShowInformationWindow((prev) => !prev);
-          }}
-          label={i18n.translate('xpack.profiling.flameGraph.showInformationWindow', {
-            defaultMessage: 'Show information window',
-          })}
-        />
-      </EuiFlexItem>
       <EuiFlexItem>
         <EuiFlexGroup direction="row">
           {columnarData.viewModel.label.length > 0 && (
@@ -273,7 +267,6 @@ export const FlameGraph: React.FC<FlameGraphProps> = ({
 
                       const valueIndex = props.values[0].valueAccessor as number;
                       const label = primaryFlamegraph.Label[valueIndex];
-                      const samples = primaryFlamegraph.CountInclusive[valueIndex];
                       const countInclusive = primaryFlamegraph.CountInclusive[valueIndex];
                       const countExclusive = primaryFlamegraph.CountExclusive[valueIndex];
                       const nodeID = primaryFlamegraph.ID[valueIndex];
@@ -284,14 +277,12 @@ export const FlameGraph: React.FC<FlameGraphProps> = ({
                         <FlameGraphTooltip
                           isRoot={valueIndex === 0}
                           label={label}
-                          samples={samples}
                           countInclusive={countInclusive}
                           countExclusive={countExclusive}
                           comparisonCountInclusive={comparisonNode?.CountInclusive}
                           comparisonCountExclusive={comparisonNode?.CountExclusive}
                           totalSamples={totalSamples}
                           comparisonTotalSamples={comparisonFlamegraph?.CountInclusive[0]}
-                          comparisonSamples={comparisonNode?.CountInclusive}
                         />
                       );
                     },
@@ -315,7 +306,7 @@ export const FlameGraph: React.FC<FlameGraphProps> = ({
                 totalSeconds={primaryFlamegraph?.TotalSeconds ?? 0}
                 totalSamples={totalSamples}
                 onClose={() => {
-                  setShowInformationWindow(false);
+                  onInformationWindowClose();
                 }}
               />
             </EuiFlexItem>
diff --git a/x-pack/plugins/profiling/public/components/functions_view/index.tsx b/x-pack/plugins/profiling/public/components/functions_view/index.tsx
index 1b7df44e68290..79973a63574a2 100644
--- a/x-pack/plugins/profiling/public/components/functions_view/index.tsx
+++ b/x-pack/plugins/profiling/public/components/functions_view/index.tsx
@@ -115,7 +115,7 @@ export function FunctionsView({ children }: { children: React.ReactElement }) {
       <>
         <EuiFlexGroup direction="column">
           {isDifferentialView ? (
-            <EuiFlexItem>
+            <EuiFlexItem grow={false}>
               <PrimaryAndComparisonSearchBar />
             </EuiFlexItem>
           ) : null}
diff --git a/x-pack/plugins/profiling/public/components/primary_and_comparison_search_bar.tsx b/x-pack/plugins/profiling/public/components/primary_and_comparison_search_bar.tsx
index 7a8a09e845589..33f5f3e8850ff 100644
--- a/x-pack/plugins/profiling/public/components/primary_and_comparison_search_bar.tsx
+++ b/x-pack/plugins/profiling/public/components/primary_and_comparison_search_bar.tsx
@@ -4,7 +4,15 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import {
+  EuiButtonIcon,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+  EuiTitle,
+  EuiToolTip,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import { TypeOf } from '@kbn/typed-react-router-config';
 import React from 'react';
 import { useAnyOfProfilingParams } from '../hooks/use_profiling_params';
@@ -54,15 +62,63 @@ export function PrimaryAndComparisonSearchBar() {
   }
 
   return (
-    <EuiFlexGroup direction="row" gutterSize="xs">
+    <EuiFlexGroup direction="row" gutterSize="xs" alignItems="flexEnd">
       <EuiFlexItem>
+        <EuiTitle size="xxs">
+          <h3>
+            {i18n.translate('xpack.profiling.comparisonSearch.baselineTitle', {
+              defaultMessage: 'Baseline flamegraph',
+            })}
+          </h3>
+        </EuiTitle>
+        <EuiSpacer size="s" />
         <PrimaryProfilingSearchBar showSubmitButton={false} />
       </EuiFlexItem>
+      <EuiFlexItem grow={false} style={{ padding: '0 8px' }}>
+        <EuiToolTip position="top" content="Swap sides">
+          <EuiButtonIcon
+            iconType="merge"
+            size="m"
+            onClick={() => {
+              const next = {
+                ...query,
+                rangeFrom: comparisonRangeFrom,
+                rangeTo: comparisonRangeTo,
+                kuery: comparisonKuery,
+                comparisonRangeFrom: query.rangeFrom,
+                comparisonRangeTo: query.rangeTo,
+                comparisonKuery: query.kuery,
+              };
+
+              if (routePath === '/flamegraphs/differential') {
+                profilingRouter.push(routePath, {
+                  path,
+                  query: next as TypeOf<ProfilingRoutes, '/flamegraphs/differential'>['query'],
+                });
+              } else {
+                profilingRouter.push(routePath, {
+                  path,
+                  query: next as TypeOf<ProfilingRoutes, '/functions/differential'>['query'],
+                });
+              }
+            }}
+          />
+        </EuiToolTip>
+      </EuiFlexItem>
       <EuiFlexItem>
+        <EuiTitle size="xxs">
+          <h3>
+            {i18n.translate('xpack.profiling.comparisonSearch.comparisonTitle', {
+              defaultMessage: 'Comparison flamegraph',
+            })}
+          </h3>
+        </EuiTitle>
+        <EuiSpacer size="s" />
         <ProfilingSearchBar
           kuery={comparisonKuery}
           rangeFrom={comparisonRangeFrom}
           rangeTo={comparisonRangeTo}
+          showSubmitButton={false}
           onQuerySubmit={(next) => {
             navigate({
               kuery: String(next.query?.query || ''),
diff --git a/x-pack/plugins/profiling/public/components/profiling_app_page_template/profiling_search_bar.tsx b/x-pack/plugins/profiling/public/components/profiling_app_page_template/profiling_search_bar.tsx
index 210bb66be4067..bad6ce5e73cd7 100644
--- a/x-pack/plugins/profiling/public/components/profiling_app_page_template/profiling_search_bar.tsx
+++ b/x-pack/plugins/profiling/public/components/profiling_app_page_template/profiling_search_bar.tsx
@@ -4,13 +4,13 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import React, { useEffect, useState } from 'react';
-import { SearchBar } from '@kbn/unified-search-plugin/public';
 import { DataView } from '@kbn/data-views-plugin/common';
-import { compact } from 'lodash';
 import { Query, TimeRange } from '@kbn/es-query';
-import { useProfilingDependencies } from '../contexts/profiling_dependencies/use_profiling_dependencies';
+import { SearchBar } from '@kbn/unified-search-plugin/public';
+import { compact } from 'lodash';
+import React, { useEffect, useState } from 'react';
 import { INDEX_EVENTS } from '../../../common';
+import { useProfilingDependencies } from '../contexts/profiling_dependencies/use_profiling_dependencies';
 
 export function ProfilingSearchBar({
   kuery,
@@ -68,13 +68,13 @@ export function ProfilingSearchBar({
       showDatePicker
       showFilterBar={false}
       showSaveQuery={false}
-      // showSubmitButton={showSubmitButton}
-      showSubmitButton={true}
+      submitButtonStyle={!showSubmitButton ? 'iconOnly' : 'auto'}
       query={searchBarQuery}
       dateRangeFrom={rangeFrom}
       dateRangeTo={rangeTo}
       indexPatterns={compact([dataView])}
       onRefresh={onRefresh}
+      displayStyle="inPage"
     />
   );
 }
diff --git a/x-pack/plugins/profiling/public/routing/index.tsx b/x-pack/plugins/profiling/public/routing/index.tsx
index 1ca3a597e4782..2c40a6d4ad352 100644
--- a/x-pack/plugins/profiling/public/routing/index.tsx
+++ b/x-pack/plugins/profiling/public/routing/index.tsx
@@ -11,7 +11,7 @@ import * as t from 'io-ts';
 import React from 'react';
 import { TopNFunctionSortField, topNFunctionSortFieldRt } from '../../common/functions';
 import { StackTracesDisplayOption, TopNType } from '../../common/stack_traces';
-import { FlameGraphComparisonMode } from '../../common/flamegraph';
+import { FlameGraphComparisonMode, FlameGraphNormalizationMode } from '../../common/flamegraph';
 import { FlameGraphsView } from '../components/flame_graphs_view';
 import { FunctionsView } from '../components/functions_view';
 import { RedirectTo } from '../components/redirect_to';
@@ -111,19 +111,30 @@ const routes = {
                   </RouteBreadcrumb>
                 ),
                 params: t.type({
-                  query: t.type({
-                    comparisonRangeFrom: t.string,
-                    comparisonRangeTo: t.string,
-                    comparisonKuery: t.string,
-                    comparisonMode: t.union([
-                      t.literal(FlameGraphComparisonMode.Absolute),
-                      t.literal(FlameGraphComparisonMode.Relative),
-                    ]),
-                  }),
+                  query: t.intersection([
+                    t.type({
+                      comparisonRangeFrom: t.string,
+                      comparisonRangeTo: t.string,
+                      comparisonKuery: t.string,
+                      comparisonMode: t.union([
+                        t.literal(FlameGraphComparisonMode.Absolute),
+                        t.literal(FlameGraphComparisonMode.Relative),
+                      ]),
+                    }),
+                    t.partial({
+                      normalizationMode: t.union([
+                        t.literal(FlameGraphNormalizationMode.Scale),
+                        t.literal(FlameGraphNormalizationMode.Time),
+                      ]),
+                      baseline: toNumberRt,
+                      comparison: toNumberRt,
+                    }),
+                  ]),
                 }),
                 defaults: {
                   query: {
                     comparisonMode: FlameGraphComparisonMode.Absolute,
+                    normalizationMode: FlameGraphNormalizationMode.Time,
                   },
                 },
               },
diff --git a/x-pack/plugins/profiling/public/utils/get_flamegraph_model/index.ts b/x-pack/plugins/profiling/public/utils/get_flamegraph_model/index.ts
index 7609b724e0547..616965dba3b19 100644
--- a/x-pack/plugins/profiling/public/utils/get_flamegraph_model/index.ts
+++ b/x-pack/plugins/profiling/public/utils/get_flamegraph_model/index.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 import { ColumnarViewModel } from '@elastic/charts';
-import d3 from 'd3';
-import { compact, sum, uniqueId, range } from 'lodash';
 import { i18n } from '@kbn/i18n';
+import d3 from 'd3';
+import { compact, range, sum, uniqueId } from 'lodash';
 import { createColumnarViewModel } from '../../../common/columnar_view_model';
 import { ElasticFlameGraph, FlameGraphComparisonMode } from '../../../common/flamegraph';
 import { FRAME_TYPE_COLOR_MAP, rgbToRGBA } from '../../../common/frame_type_colors';
@@ -31,6 +31,8 @@ export function getFlamegraphModel({
   colorDanger,
   colorNeutral,
   comparisonMode,
+  comparison,
+  baseline,
 }: {
   primaryFlamegraph?: ElasticFlameGraph;
   comparisonFlamegraph?: ElasticFlameGraph;
@@ -38,6 +40,8 @@ export function getFlamegraphModel({
   colorDanger: string;
   colorNeutral: string;
   comparisonMode: FlameGraphComparisonMode;
+  baseline?: number;
+  comparison?: number;
 }): {
   key: string;
   viewModel: ColumnarViewModel;
@@ -133,7 +137,7 @@ export function getFlamegraphModel({
     const weightComparisonSide =
       comparisonMode === FlameGraphComparisonMode.Relative
         ? 1
-        : primaryFlamegraph.TotalSeconds / comparisonFlamegraph.TotalSeconds;
+        : (comparison ?? 1) / (baseline ?? 1);
 
     primaryFlamegraph.ID.forEach((nodeID, index) => {
       const samples = primaryFlamegraph.CountInclusive[index];

From 7e9a9bcc9921e0790951c370626e3dccb4983373 Mon Sep 17 00:00:00 2001
From: Mark Hopkin <mark.hopkin@elastic.co>
Date: Tue, 7 Feb 2023 13:56:48 +0000
Subject: [PATCH 059/134] [Fleet] Add ability to show FQDN of agents  (#150239)

## Summary

Closes #149059

Adds the `agent_features` agent policy field which is an array of
feature flags + other arbitrary config values. As part of this allow the
FQDN feature to be configured in the agent policy settings.

<img width="1049" alt="Screenshot 2023-02-02 at 23 59 17"
src="https://user-images.githubusercontent.com/3315046/216478081-c6316798-bcc6-422a-85b1-fa5d717a229d.png">
---
 .../migrations/check_registered_types.test.ts |  2 +-
 .../plugins/fleet/common/openapi/bundled.json | 18 ++++
 .../plugins/fleet/common/openapi/bundled.yaml | 12 +++
 .../components/schemas/agent_policy.yaml      | 12 +++
 .../fleet/common/types/models/agent_policy.ts |  2 +
 .../agent_policy_advanced_fields/index.tsx    | 87 +++++++++++++++++++
 .../components/settings/index.tsx             | 64 +++++---------
 .../fleet/server/saved_objects/index.ts       |  6 ++
 .../full_agent_policy.test.ts.snap            |  3 +
 .../agent_policies/full_agent_policy.test.ts  | 45 ++++++++++
 .../agent_policies/full_agent_policy.ts       |  4 +
 .../fleet/server/types/models/agent_policy.ts |  8 ++
 .../apis/agent_policy/agent_policy.ts         | 62 +++++++++++++
 13 files changed, 280 insertions(+), 45 deletions(-)

diff --git a/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts b/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
index 0357fb698318a..3bde565c75ce6 100644
--- a/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
+++ b/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
@@ -101,7 +101,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "index-pattern": "48e77ca393c254e93256f11a7cdc0232dd754c08",
         "infrastructure-monitoring-log-view": "e2c78c1076bd35e57d7c5fa1b410e5c126d12327",
         "infrastructure-ui-source": "7c8dbbc0a608911f1b683a944f4a65383f6153ed",
-        "ingest-agent-policies": "54d586fdafae83ba326e47d1a3727b0d9c910a12",
+        "ingest-agent-policies": "a94bd53b8f81ca883de8a75386db04e27dda973e",
         "ingest-download-sources": "1e69dabd6db5e320fe08c5bda8f35f29bafc6b54",
         "ingest-outputs": "29181ecfdc7723f544325ecef7266bccbc691a54",
         "ingest-package-policies": "0335a28af793ce25b4969d2156cfaf1dae2ef812",
diff --git a/x-pack/plugins/fleet/common/openapi/bundled.json b/x-pack/plugins/fleet/common/openapi/bundled.json
index 9b994df3afe33..9c4609e76adac 100644
--- a/x-pack/plugins/fleet/common/openapi/bundled.json
+++ b/x-pack/plugins/fleet/common/openapi/bundled.json
@@ -5807,6 +5807,24 @@
               },
               "agents": {
                 "type": "number"
+              },
+              "agent_features": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "name",
+                    "enabled"
+                  ]
+                }
               }
             },
             "required": [
diff --git a/x-pack/plugins/fleet/common/openapi/bundled.yaml b/x-pack/plugins/fleet/common/openapi/bundled.yaml
index 65bab73457170..74440cfaf2d4f 100644
--- a/x-pack/plugins/fleet/common/openapi/bundled.yaml
+++ b/x-pack/plugins/fleet/common/openapi/bundled.yaml
@@ -3704,6 +3704,18 @@ components:
               type: number
             agents:
               type: number
+            agent_features:
+              type: array
+              items:
+                type: object
+                properties:
+                  name:
+                    type: string
+                  enabled:
+                    type: boolean
+                required:
+                  - name
+                  - enabled
           required:
             - id
             - status
diff --git a/x-pack/plugins/fleet/common/openapi/components/schemas/agent_policy.yaml b/x-pack/plugins/fleet/common/openapi/components/schemas/agent_policy.yaml
index ab00144064760..76b6fba16c873 100644
--- a/x-pack/plugins/fleet/common/openapi/components/schemas/agent_policy.yaml
+++ b/x-pack/plugins/fleet/common/openapi/components/schemas/agent_policy.yaml
@@ -35,6 +35,18 @@ allOf:
         type: number
       agents:
         type: number
+      agent_features:
+        type: array
+        items: 
+          type: object
+          properties:
+            name: 
+              type: string
+            enabled: 
+              type: boolean
+          required:
+            - name
+            - enabled
     required:
       - id
       - status
diff --git a/x-pack/plugins/fleet/common/types/models/agent_policy.ts b/x-pack/plugins/fleet/common/types/models/agent_policy.ts
index 4a2292a692172..cc0f0be82eae0 100644
--- a/x-pack/plugins/fleet/common/types/models/agent_policy.ts
+++ b/x-pack/plugins/fleet/common/types/models/agent_policy.ts
@@ -32,6 +32,7 @@ export interface NewAgentPolicy {
   download_source_id?: string | null;
   fleet_server_host_id?: string | null;
   schema_version?: string;
+  agent_features?: Array<{ name: string; enabled: boolean }>;
 }
 
 export interface AgentPolicy extends Omit<NewAgentPolicy, 'id'> {
@@ -112,6 +113,7 @@ export interface FullAgentPolicy {
       logs: boolean;
     };
     download: { sourceURI: string };
+    features: Record<string, { enabled: boolean }>;
   };
 }
 
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx
index 3d1e28cc4f1d8..396478451d6ee 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx
@@ -20,6 +20,10 @@ import {
   EuiSuperSelect,
   EuiToolTip,
   EuiBadge,
+  EuiRadioGroup,
+  EuiText,
+  EuiFlexGroup,
+  EuiFlexItem,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
@@ -517,6 +521,89 @@ export const AgentPolicyAdvancedOptionsContent: React.FunctionComponent<Props> =
           />
         </EuiFormRow>
       </EuiDescribedFormGroup>
+      <EuiDescribedFormGroup
+        title={
+          <h4>
+            <FormattedMessage
+              id="xpack.fleet.agentPolicyForm.hostnameFormatLabel"
+              defaultMessage="Host name format"
+            />
+          </h4>
+        }
+        description={
+          <FormattedMessage
+            id="xpack.fleet.agentPolicyForm.hostnameFormatLabelDescription"
+            defaultMessage="Select how you would like agent domain names to be displayed."
+          />
+        }
+      >
+        <EuiFormRow fullWidth>
+          <EuiRadioGroup
+            options={[
+              {
+                id: 'hostname',
+                label: (
+                  <>
+                    <EuiFlexGroup gutterSize="xs" direction="column">
+                      <EuiFlexItem grow={false}>
+                        <EuiText size="s">
+                          <b>
+                            <FormattedMessage
+                              id="xpack.fleet.agentPolicyForm.hostnameFormatOptionHostname"
+                              defaultMessage="Hostname"
+                            />
+                          </b>
+                        </EuiText>
+                      </EuiFlexItem>
+                      <EuiFlexItem grow={false}>
+                        <EuiText size="s" color="subdued">
+                          <FormattedMessage
+                            id="xpack.fleet.agentPolicyForm.hostnameFormatOptionHostnameExample"
+                            defaultMessage="ex: My-Laptop"
+                          />
+                        </EuiText>
+                      </EuiFlexItem>
+                    </EuiFlexGroup>
+                    <EuiSpacer size="s" />
+                  </>
+                ),
+              },
+              {
+                id: 'fqdn',
+                label: (
+                  <EuiFlexGroup gutterSize="xs" direction="column">
+                    <EuiFlexItem grow={false}>
+                      <EuiText size="s">
+                        <b>
+                          <FormattedMessage
+                            id="xpack.fleet.agentPolicyForm.hostnameFormatOptionFqdn"
+                            defaultMessage="Fully Qualified Domain Name (FQDN)"
+                          />
+                        </b>
+                      </EuiText>
+                    </EuiFlexItem>
+                    <EuiFlexItem grow={false}>
+                      <EuiText size="s" color="subdued">
+                        <FormattedMessage
+                          id="xpack.fleet.agentPolicyForm.hostnameFormatOptionFqdnExample"
+                          defaultMessage="ex: My-Laptop.admin.acme.co"
+                        />
+                      </EuiText>
+                    </EuiFlexItem>
+                  </EuiFlexGroup>
+                ),
+              },
+            ]}
+            idSelected={agentPolicy.agent_features?.length ? 'fqdn' : 'hostname'}
+            onChange={(id: string) => {
+              updateAgentPolicy({
+                agent_features: id === 'hostname' ? [] : [{ name: 'fqdn', enabled: true }],
+              });
+            }}
+            name="radio group"
+          />
+        </EuiFormRow>
+      </EuiDescribedFormGroup>
       {isEditing && 'id' in agentPolicy && !agentPolicy.is_managed ? (
         <EuiDescribedFormGroup
           title={
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/settings/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/settings/index.tsx
index 131266279f706..6080f8cd80710 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/settings/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/settings/index.tsx
@@ -40,6 +40,21 @@ import { DevtoolsRequestFlyoutButton } from '../../../../../components';
 import { ExperimentalFeaturesService } from '../../../../../services';
 import { generateUpdateAgentPolicyDevToolsRequest } from '../../../services';
 
+const pickAgentPolicyKeysToSend = (agentPolicy: AgentPolicy) =>
+  pick(agentPolicy, [
+    'name',
+    'description',
+    'namespace',
+    'monitoring_enabled',
+    'unenroll_timeout',
+    'inactivity_timeout',
+    'data_output_id',
+    'monitoring_output_id',
+    'download_source_id',
+    'fleet_server_host_id',
+    'agent_features',
+  ]);
+
 const FormWrapper = styled.div`
   max-width: 800px;
   margin-right: auto;
@@ -77,37 +92,10 @@ export const SettingsView = memo<{ agentPolicy: AgentPolicy }>(
     const submitUpdateAgentPolicy = async () => {
       setIsLoading(true);
       try {
-        const {
-          name,
-          description,
-          namespace,
-          // eslint-disable-next-line @typescript-eslint/naming-convention
-          monitoring_enabled,
-          // eslint-disable-next-line @typescript-eslint/naming-convention
-          unenroll_timeout,
-          // eslint-disable-next-line @typescript-eslint/naming-convention
-          inactivity_timeout,
-          // eslint-disable-next-line @typescript-eslint/naming-convention
-          data_output_id,
-          // eslint-disable-next-line @typescript-eslint/naming-convention
-          monitoring_output_id,
-          // eslint-disable-next-line @typescript-eslint/naming-convention
-          download_source_id,
-          // eslint-disable-next-line @typescript-eslint/naming-convention
-          fleet_server_host_id,
-        } = agentPolicy;
-        const { data, error } = await sendUpdateAgentPolicy(agentPolicy.id, {
-          name,
-          description,
-          namespace,
-          monitoring_enabled,
-          unenroll_timeout,
-          inactivity_timeout,
-          data_output_id,
-          monitoring_output_id,
-          download_source_id,
-          fleet_server_host_id,
-        });
+        const { data, error } = await sendUpdateAgentPolicy(
+          agentPolicy.id,
+          pickAgentPolicyKeysToSend(agentPolicy)
+        );
         if (data) {
           notifications.toasts.addSuccess(
             i18n.translate('xpack.fleet.editAgentPolicy.successNotificationTitle', {
@@ -141,19 +129,7 @@ export const SettingsView = memo<{ agentPolicy: AgentPolicy }>(
       () =>
         generateUpdateAgentPolicyDevToolsRequest(
           agentPolicy.id,
-          pick(
-            agentPolicy,
-            'name',
-            'description',
-            'namespace',
-            'monitoring_enabled',
-            'unenroll_timeout',
-            'inactivity_timeout',
-            'data_output_id',
-            'monitoring_output_id',
-            'download_source_id',
-            'fleet_server_host_id'
-          )
+          pickAgentPolicyKeysToSend(agentPolicy)
         ),
       [agentPolicy]
     );
diff --git a/x-pack/plugins/fleet/server/saved_objects/index.ts b/x-pack/plugins/fleet/server/saved_objects/index.ts
index 5ad423b2f1098..cd4ff53f86d46 100644
--- a/x-pack/plugins/fleet/server/saved_objects/index.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/index.ts
@@ -113,6 +113,12 @@ const getSavedObjectTypes = (
         monitoring_output_id: { type: 'keyword' },
         download_source_id: { type: 'keyword' },
         fleet_server_host_id: { type: 'keyword' },
+        agent_features: {
+          properties: {
+            name: { type: 'keyword' },
+            enabled: { type: 'boolean' },
+          },
+        },
       },
     },
     migrations: {
diff --git a/x-pack/plugins/fleet/server/services/agent_policies/__snapshots__/full_agent_policy.test.ts.snap b/x-pack/plugins/fleet/server/services/agent_policies/__snapshots__/full_agent_policy.test.ts.snap
index e4aee6aa84597..030dd4d9ec36f 100644
--- a/x-pack/plugins/fleet/server/services/agent_policies/__snapshots__/full_agent_policy.test.ts.snap
+++ b/x-pack/plugins/fleet/server/services/agent_policies/__snapshots__/full_agent_policy.test.ts.snap
@@ -6,6 +6,7 @@ Object {
     "download": Object {
       "sourceURI": "http://default-registry.co",
     },
+    "features": Object {},
     "monitoring": Object {
       "enabled": true,
       "logs": false,
@@ -71,6 +72,7 @@ Object {
     "download": Object {
       "sourceURI": "http://default-registry.co",
     },
+    "features": Object {},
     "monitoring": Object {
       "enabled": true,
       "logs": false,
@@ -136,6 +138,7 @@ Object {
     "download": Object {
       "sourceURI": "http://default-registry.co",
     },
+    "features": Object {},
     "monitoring": Object {
       "enabled": true,
       "logs": false,
diff --git a/x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.test.ts b/x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.test.ts
index 352e831d12112..93c6b6dc891ea 100644
--- a/x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.test.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.test.ts
@@ -388,6 +388,51 @@ describe('getFullAgentPolicy', () => {
       },
     });
   });
+
+  it('should add + transform agent features', async () => {
+    mockAgentPolicy({
+      namespace: 'default',
+      revision: 1,
+      monitoring_enabled: ['metrics'],
+      agent_features: [
+        { name: 'fqdn', enabled: true },
+        { name: 'feature2', enabled: true },
+      ],
+    });
+    const agentPolicy = await getFullAgentPolicy(savedObjectsClientMock.create(), 'agent-policy');
+
+    expect(agentPolicy).toMatchObject({
+      id: 'agent-policy',
+      outputs: {
+        default: {
+          type: 'elasticsearch',
+          hosts: ['http://127.0.0.1:9201'],
+        },
+      },
+      inputs: [],
+      revision: 1,
+      fleet: {
+        hosts: ['http://fleetserver:8220'],
+      },
+      agent: {
+        monitoring: {
+          namespace: 'default',
+          use_output: 'default',
+          enabled: true,
+          logs: false,
+          metrics: true,
+        },
+        features: {
+          fqdn: {
+            enabled: true,
+          },
+          feature2: {
+            enabled: true,
+          },
+        },
+      },
+    });
+  });
 });
 
 describe('transformOutputToFullPolicyOutput', () => {
diff --git a/x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.ts b/x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.ts
index 262ad2d64a606..fe434c015e438 100644
--- a/x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.ts
@@ -120,6 +120,10 @@ export async function getFullAgentPolicy(
               metrics: agentPolicy.monitoring_enabled.includes(dataTypes.Metrics),
             }
           : { enabled: false, logs: false, metrics: false },
+      features: (agentPolicy.agent_features || []).reduce((acc, { name, ...featureConfig }) => {
+        acc[name] = featureConfig;
+        return acc;
+      }, {} as NonNullable<FullAgentPolicy['agent']>['features']),
     },
   };
 
diff --git a/x-pack/plugins/fleet/server/types/models/agent_policy.ts b/x-pack/plugins/fleet/server/types/models/agent_policy.ts
index 750613abfd21a..f85bd93b1e870 100644
--- a/x-pack/plugins/fleet/server/types/models/agent_policy.ts
+++ b/x-pack/plugins/fleet/server/types/models/agent_policy.ts
@@ -39,6 +39,14 @@ export const AgentPolicyBaseSchema = {
   monitoring_output_id: schema.maybe(schema.nullable(schema.string())),
   download_source_id: schema.maybe(schema.nullable(schema.string())),
   fleet_server_host_id: schema.maybe(schema.nullable(schema.string())),
+  agent_features: schema.maybe(
+    schema.arrayOf(
+      schema.object({
+        name: schema.string(),
+        enabled: schema.boolean(),
+      })
+    )
+  ),
 };
 
 export const NewAgentPolicySchema = schema.object({
diff --git a/x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts b/x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts
index c437197f9cafb..8df65c4152e1a 100644
--- a/x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts
+++ b/x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts
@@ -17,6 +17,7 @@ export default function (providerContext: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
+  const es = getService('es');
 
   describe('fleet_agent_policies', () => {
     skipIfNoDockerRegistry(providerContext);
@@ -96,6 +97,67 @@ export default function (providerContext: FtrProviderContext) {
         expect(policy2.is_managed).to.equal(false);
       });
 
+      it('does not allow arbitrary config in agent_features value', async () => {
+        await supertest
+          .post(`/api/fleet/agent_policies`)
+          .set('kbn-xsrf', 'xxxx')
+          .send({
+            name: 'test-agent-features',
+            namespace: 'default',
+            agent_features: [
+              {
+                name: 'fqdn',
+                enabled: true,
+                config: "I'm not allowed yet",
+              },
+            ],
+          })
+          .expect(400);
+      });
+
+      it('sets given agent_features value', async () => {
+        const {
+          body: { item: createdPolicy },
+        } = await supertest
+          .post(`/api/fleet/agent_policies`)
+          .set('kbn-xsrf', 'xxxx')
+          .send({
+            name: 'test-agent-features',
+            namespace: 'default',
+            agent_features: [
+              {
+                name: 'fqdn',
+                enabled: true,
+              },
+            ],
+          })
+          .expect(200);
+
+        const { body } = await supertest.get(`/api/fleet/agent_policies/${createdPolicy.id}`);
+        expect(body.item.agent_features).to.eql([
+          {
+            name: 'fqdn',
+            enabled: true,
+          },
+        ]);
+
+        const policyDocRes = await es.search({
+          index: '.fleet-policies',
+          query: {
+            term: {
+              policy_id: createdPolicy.id,
+            },
+          },
+        });
+
+        // @ts-expect-error
+        expect(policyDocRes?.hits?.hits[0]?._source?.data?.agent?.features).to.eql({
+          fqdn: {
+            enabled: true,
+          },
+        });
+      });
+
       it('should return a 400 with an empty namespace', async () => {
         await supertest
           .post(`/api/fleet/agent_policies`)

From 13d1f398ff313359c3a429153b15e60bc7646618 Mon Sep 17 00:00:00 2001
From: Kevin Qualters <56408403+kqualters-elastic@users.noreply.github.com>
Date: Tue, 7 Feb 2023 09:17:01 -0500
Subject: [PATCH 060/134] [Security Solution] Insight filter builder form as
 markdown plugin (#150363)

## Summary

This pr expands upon the work done in
https://github.com/elastic/kibana/pull/145240 to make use of the filters
builder form from unified_search to serialize filters into a markdown
compatible string, so that investigation guides, timeline notes or any
other place where text is parsed as markdown can make use of standard
kibana filters and view a count of the matching documents at a glance,
and open the entire set in timeline as well. These are generally
converted to timeline data providers to enable drag and drop query
building, however this is not supported for filters of range type, so
regular kibana filters are used in that case for now.

![Screenshot 2023-02-06 at 3 46 15
PM](https://user-images.githubusercontent.com/56408403/217081398-7e0d263f-cdb5-48eb-9328-f01a63af768e.png)
![Screenshot 2023-02-06 at 3 49 46
PM](https://user-images.githubusercontent.com/56408403/217082554-389edad5-89ff-4d86-bd31-c2085073b39a.png)
![Screenshot 2023-02-06 at 3 50 15
PM](https://user-images.githubusercontent.com/56408403/217082658-7ef8af2b-ba7f-4676-a775-e8c550adeee6.png)
![Screenshot 2023-02-06 at 3 50 54
PM](https://user-images.githubusercontent.com/56408403/217082770-9bacbd2a-fbee-4d1f-b6f5-b7d97ed2e3ca.png)
![Screenshot 2023-02-06 at 3 51 16
PM](https://user-images.githubusercontent.com/56408403/217082842-7494b1ac-6687-426e-8e85-6fec0afcc70e.png)
![Screenshot 2023-02-06 at 3 53 48
PM](https://user-images.githubusercontent.com/56408403/217083273-f9acfa30-a156-4146-86a2-5ebb84f4ecd0.png)
![Screenshot 2023-02-06 at 3 54 30
PM](https://user-images.githubusercontent.com/56408403/217083407-1a8af419-6c09-4558-9c18-11604cb7e796.png)




### Checklist

- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../unified_search/public/mocks/mocks.ts      |   1 +
 src/plugins/unified_search/public/plugin.ts   |   2 +
 src/plugins/unified_search/public/types.ts    |   2 +
 .../cypress/e2e/timelines/notes_tab.cy.ts     |   2 +-
 .../hover_actions/use_hover_actions.tsx       |   2 +-
 .../markdown_editor/plugins/index.ts          |   1 +
 .../plugins/insight/index.test.tsx            |   2 +-
 .../markdown_editor/plugins/insight/index.tsx | 455 +++++++++++++++++-
 .../plugins/insight/replace_params_query.ts   |  47 ++
 .../use_insight_data_providers.test.ts        |  97 ++--
 .../insight/use_insight_data_providers.ts     | 306 ++++++++----
 .../plugins/insight/use_insight_query.test.ts |   1 +
 .../plugins/insight/use_insight_query.ts      |  11 +-
 .../common/containers/sourcerer/index.tsx     |   1 +
 .../public/common/lib/kuery/index.ts          |  29 +-
 .../public/common/store/sourcerer/model.ts    |   1 +
 .../components/controlled_combobox_input.tsx  |   9 +-
 .../components/controlled_default_input.tsx   |  15 +-
 .../components/edit_data_provider/helpers.tsx |   3 +-
 .../components/edit_data_provider/index.tsx   |   7 +-
 .../timeline/data_providers/data_provider.ts  |   6 +-
 .../timeline/data_providers/helpers.tsx       |   9 +-
 .../data_providers/provider_badge.tsx         |   3 +-
 .../data_providers/provider_item_actions.tsx  |   5 +-
 .../data_providers/provider_item_badge.tsx    |   3 +-
 .../timelines/components/timeline/events.ts   |   3 +-
 .../components/timeline/helpers.test.tsx      |  14 +-
 .../timelines/components/timeline/helpers.tsx |  88 +---
 .../types/timeline/data_provider/index.ts     |   4 +-
 29 files changed, 868 insertions(+), 261 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/replace_params_query.ts

diff --git a/src/plugins/unified_search/public/mocks/mocks.ts b/src/plugins/unified_search/public/mocks/mocks.ts
index 8507de9798480..d6140fe0ccc99 100644
--- a/src/plugins/unified_search/public/mocks/mocks.ts
+++ b/src/plugins/unified_search/public/mocks/mocks.ts
@@ -36,6 +36,7 @@ const createStartContract = (): Start => {
       IndexPatternSelect: jest.fn(),
       SearchBar: jest.fn().mockReturnValue(null),
       AggregateQuerySearchBar: jest.fn().mockReturnValue(null),
+      FiltersBuilderLazy: jest.fn(),
     },
   };
 };
diff --git a/src/plugins/unified_search/public/plugin.ts b/src/plugins/unified_search/public/plugin.ts
index 9149030602866..5aeef71e82d8b 100755
--- a/src/plugins/unified_search/public/plugin.ts
+++ b/src/plugins/unified_search/public/plugin.ts
@@ -24,6 +24,7 @@ import type {
 import { createFilterAction } from './actions/apply_filter_action';
 import { createUpdateFilterReferencesAction } from './actions/update_filter_references_action';
 import { ACTION_GLOBAL_APPLY_FILTER, UPDATE_FILTER_REFERENCES_ACTION } from './actions';
+import { FiltersBuilderLazy } from './filters_builder';
 
 import './index.scss';
 
@@ -92,6 +93,7 @@ export class UnifiedSearchPublicPlugin
         IndexPatternSelect: createIndexPatternSelect(dataViews),
         SearchBar,
         AggregateQuerySearchBar: SearchBar,
+        FiltersBuilderLazy,
       },
       autocomplete: autocompleteStart,
     };
diff --git a/src/plugins/unified_search/public/types.ts b/src/plugins/unified_search/public/types.ts
index 5142cd323c136..557c31865a417 100755
--- a/src/plugins/unified_search/public/types.ts
+++ b/src/plugins/unified_search/public/types.ts
@@ -18,6 +18,7 @@ import { CoreStart, DocLinksStart } from '@kbn/core/public';
 import { IStorageWrapper } from '@kbn/kibana-utils-plugin/public';
 import { AutocompleteSetup, AutocompleteStart } from './autocomplete';
 import type { IndexPatternSelectProps, StatefulSearchBarProps } from '.';
+import type { FiltersBuilderProps } from './filters_builder/filters_builder';
 
 export interface UnifiedSearchSetupDependencies {
   uiActions: UiActionsSetup;
@@ -46,6 +47,7 @@ export interface UnifiedSearchPublicPluginStartUi {
   AggregateQuerySearchBar: <QT extends Query | AggregateQuery = Query>(
     props: StatefulSearchBarProps<QT>
   ) => React.ReactElement;
+  FiltersBuilderLazy: React.ComponentType<FiltersBuilderProps>;
 }
 
 /**
diff --git a/x-pack/plugins/security_solution/cypress/e2e/timelines/notes_tab.cy.ts b/x-pack/plugins/security_solution/cypress/e2e/timelines/notes_tab.cy.ts
index c386abace9724..3a73d5b6c3a3e 100644
--- a/x-pack/plugins/security_solution/cypress/e2e/timelines/notes_tab.cy.ts
+++ b/x-pack/plugins/security_solution/cypress/e2e/timelines/notes_tab.cy.ts
@@ -93,7 +93,7 @@ describe('Timeline notes tab', () => {
 
   it('should render insight query from markdown', () => {
     addNotesToTimeline(
-      `!{insight{"description":"2 top level OR providers, 1 nested AND","label":"test insight", "providers": [[{ "field": "event.id", "value": "kibana.alert.original_event.id", "type": "parameter" }], [{ "field": "event.category", "value": "network", "type": "literal" }, {"field": "process.pid", "value": "process.pid", "type": "parameter"}]]}}`
+      `!{insight{"description":"2 top level OR providers, 1 nested AND","label":"test insight", "providers": [[{ "field": "event.id", "value": "kibana.alert.original_event.id", "queryType": "phrase", "excluded": "false" }], [{ "field": "event.category", "value": "network", "queryType": "phrase", "excluded": "false" }, {"field": "process.pid", "value": "process.pid", "queryType": "phrase", "excluded": "false"}]]}}`
     );
     cy.get(MARKDOWN_INVESTIGATE_BUTTON).should('exist');
   });
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_actions.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_actions.tsx
index 298b1e8650363..8da15356b1bcc 100644
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_actions.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_actions.tsx
@@ -83,7 +83,7 @@ export const useHoverActions = ({
   const values = useMemo(() => {
     const val = dataProvider.queryMatch.value;
 
-    if (typeof val === 'number') {
+    if (typeof val === 'number' || typeof val === 'boolean') {
       return val.toString();
     }
 
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/index.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/index.ts
index 8a76223bb290c..a567ef103c361 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/index.ts
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/index.ts
@@ -23,6 +23,7 @@ export const { uiPlugins, parsingPlugins, processingPlugins } = {
 
 uiPlugins.push(timelineMarkdownPlugin.plugin);
 uiPlugins.push(osqueryMarkdownPlugin.plugin);
+uiPlugins.push(insightMarkdownPlugin.plugin);
 
 parsingPlugins.push(insightMarkdownPlugin.parser);
 parsingPlugins.push(timelineMarkdownPlugin.parser);
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/index.test.tsx
index 411c72d1d41af..def256d3efea6 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/index.test.tsx
@@ -69,7 +69,7 @@ describe('insight component renderer', () => {
           label={'test label'}
           description={'test description'}
           providers={
-            '[[{"field":"event.id","value":"kibana.alert.original_event.id","type":"parameter"}],[{"field":"event.category","value":"network","type":"literal"},{"field":"process.pid","value":"process.pid","type":"parameter"}]]'
+            '[[{"field":"event.id","value":"{{kibana.alert.original_event.id}}","queryType":"phrase", "excluded": "false"}],[{"field":"event.category","value":"network","queryType":"phrase", "excluded": "false"}},{"field":"process.pid","value":"process.pid","queryType":"phrase", "excluded": "false", "valueType":"number"}}]]'
           }
         />
       </TestProviders>
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/index.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/index.tsx
index 3ed9a8ab41f26..f31d7707ab4ee 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/index.tsx
@@ -5,23 +5,71 @@
  * 2.0.
  */
 
+import { pickBy, isEmpty } from 'lodash';
 import type { Plugin } from 'unified';
-import React, { useContext, useMemo } from 'react';
+import React, { useContext, useMemo, useCallback, useState } from 'react';
 import type { RemarkTokenizer } from '@elastic/eui';
-import { EuiLoadingSpinner, EuiIcon } from '@elastic/eui';
+import {
+  EuiLoadingSpinner,
+  EuiIcon,
+  EuiSpacer,
+  EuiBetaBadge,
+  EuiCodeBlock,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiModalBody,
+  EuiModalFooter,
+  EuiButton,
+  EuiButtonEmpty,
+  EuiForm,
+  EuiFormRow,
+  EuiFieldText,
+  EuiSelect,
+  EuiFlexGroup,
+  EuiFlexItem,
+} from '@elastic/eui';
+import numeral from '@elastic/numeral';
+import { css } from '@emotion/react';
+import type { EuiMarkdownEditorUiPluginEditorProps } from '@elastic/eui/src/components/markdown_editor/markdown_types';
+import type { DataView } from '@kbn/data-views-plugin/common';
 import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+import type { Filter } from '@kbn/es-query';
+import {
+  FILTERS,
+  isCombinedFilter,
+  isRangeFilter,
+  isPhraseFilter,
+  isPhrasesFilter,
+  isExistsFilter,
+  BooleanRelation,
+  FilterStateStore,
+} from '@kbn/es-query';
+import type { PhraseFilterValue } from '@kbn/es-query/src/filters/build_filters';
+import { useForm, FormProvider, useController } from 'react-hook-form';
 import { useAppToasts } from '../../../../hooks/use_app_toasts';
+import { useKibana } from '../../../../lib/kibana';
 import { useInsightQuery } from './use_insight_query';
-import { useInsightDataProviders } from './use_insight_data_providers';
+import { useInsightDataProviders, type Provider } from './use_insight_data_providers';
 import { BasicAlertDataContext } from '../../../event_details/investigation_guide_view';
 import { InvestigateInTimelineButton } from '../../../event_details/table/investigate_in_timeline_button';
-import { getTimeRangeSettings } from '../../../../utils/default_date_settings';
+import {
+  getTimeRangeSettings,
+  parseDateWithDefault,
+  DEFAULT_FROM_MOMENT,
+  DEFAULT_TO_MOMENT,
+} from '../../../../utils/default_date_settings';
 import type { TimeRange } from '../../../../store/inputs/model';
+import { DEFAULT_TIMEPICKER_QUICK_RANGES } from '../../../../../../common/constants';
+import { useSourcererDataView } from '../../../../containers/sourcerer';
+import { SourcererScopeName } from '../../../../store/sourcerer/model';
 
 interface InsightComponentProps {
   label?: string;
   description?: string;
   providers?: string;
+  relativeFrom?: string;
+  relativeTo?: string;
 }
 
 export const parser: Plugin = function () {
@@ -95,8 +143,88 @@ export const parser: Plugin = function () {
   methods.splice(methods.indexOf('text'), 0, 'insight');
 };
 
+const buildPrimitiveProvider = (filter: Filter): Provider => {
+  const field = filter.meta?.key ?? '';
+  const excluded = filter.meta?.negate ?? false;
+  const queryType = filter.meta?.type ?? FILTERS.PHRASE;
+  const baseFilter = {
+    field,
+    excluded,
+    queryType,
+  };
+  if (isRangeFilter(filter)) {
+    const gte = filter.query.range[field].gte;
+    const lt = filter.query.range[field].lt;
+    const value = JSON.stringify({ gte, lt });
+    return {
+      ...baseFilter,
+      value,
+      queryType: filter.meta.type ?? FILTERS.RANGE,
+    };
+  } else if (isPhrasesFilter(filter)) {
+    const typeOfParams: PhraseFilterValue = typeof filter.meta?.params[0];
+    return {
+      ...baseFilter,
+      value: JSON.stringify(filter.meta?.params ?? []),
+      valueType: typeOfParams,
+      queryType: filter.meta.type ?? FILTERS.PHRASES,
+    };
+  } else if (isExistsFilter(filter)) {
+    return {
+      ...baseFilter,
+      value: '',
+      queryType: filter.meta.type ?? FILTERS.EXISTS,
+    };
+  } else if (isPhraseFilter(filter)) {
+    const valueType: PhraseFilterValue = typeof filter.meta?.params?.query;
+    return {
+      ...baseFilter,
+      value: filter.meta?.params?.query ?? '',
+      valueType,
+      queryType: filter.meta.type ?? FILTERS.PHRASE,
+    };
+  } else {
+    return {
+      ...baseFilter,
+      value: '',
+      queryType: FILTERS.PHRASE,
+    };
+  }
+};
+
+const filtersToInsightProviders = (filters: Filter[]): Provider[][] => {
+  const providers = [];
+  for (let index = 0; index < filters.length; index++) {
+    const filter = filters[index];
+    if (isCombinedFilter(filter)) {
+      if (filter.meta.relation === BooleanRelation.AND) {
+        return filtersToInsightProviders(filter.meta?.params);
+      } else {
+        return filter.meta?.params.map((innerFilter) => {
+          if (isCombinedFilter(innerFilter)) {
+            return filtersToInsightProviders([innerFilter]).map(([provider]) => provider);
+          } else {
+            return [buildPrimitiveProvider(innerFilter)];
+          }
+        });
+      }
+    } else {
+      providers.push([buildPrimitiveProvider(filter)]);
+    }
+  }
+  return providers;
+};
+
+const resultFormat = '0,0.[000]a';
+
 // receives the configuration from the parser and renders
-const InsightComponent = ({ label, description, providers }: InsightComponentProps) => {
+const InsightComponent = ({
+  label,
+  description,
+  providers,
+  relativeFrom,
+  relativeTo,
+}: InsightComponentProps) => {
   const { addError } = useAppToasts();
   let parsedProviders = [];
   try {
@@ -111,15 +239,28 @@ const InsightComponent = ({ label, description, providers }: InsightComponentPro
     });
   }
   const { data: alertData } = useContext(BasicAlertDataContext);
-  const dataProviders = useInsightDataProviders({
+  const { dataProviders, filters } = useInsightDataProviders({
     providers: parsedProviders,
     alertData,
   });
   const { totalCount, isQueryLoading, oldestTimestamp, hasError } = useInsightQuery({
     dataProviders,
+    filters,
   });
   const timerange: TimeRange = useMemo(() => {
-    if (oldestTimestamp != null) {
+    if (relativeFrom && relativeTo) {
+      const fromStr = relativeFrom;
+      const toStr = relativeTo;
+      const from = parseDateWithDefault(fromStr, DEFAULT_FROM_MOMENT).toISOString();
+      const to = parseDateWithDefault(toStr, DEFAULT_TO_MOMENT, true).toISOString();
+      return {
+        kind: 'relative',
+        from,
+        to,
+        fromStr,
+        toStr,
+      };
+    } else if (oldestTimestamp != null) {
       return {
         kind: 'absolute',
         from: oldestTimestamp,
@@ -135,24 +276,300 @@ const InsightComponent = ({ label, description, providers }: InsightComponentPro
         toStr,
       };
     }
-  }, [oldestTimestamp]);
+  }, [oldestTimestamp, relativeFrom, relativeTo]);
   if (isQueryLoading) {
     return <EuiLoadingSpinner size="l" />;
   } else {
     return (
-      <InvestigateInTimelineButton
-        asEmptyButton={false}
-        isDisabled={hasError}
-        dataProviders={dataProviders}
-        timeRange={timerange}
-        keepDataView={true}
-        data-test-subj="insight-investigate-in-timeline-button"
-      >
-        <EuiIcon type="timeline" />
-        {` ${label} (${totalCount}) - ${description}`}
-      </InvestigateInTimelineButton>
+      <>
+        <InvestigateInTimelineButton
+          asEmptyButton={false}
+          isDisabled={hasError}
+          dataProviders={dataProviders}
+          filters={filters}
+          timeRange={timerange}
+          keepDataView={true}
+          data-test-subj="insight-investigate-in-timeline-button"
+        >
+          <EuiIcon type="timeline" />
+          {` ${label} (${numeral(totalCount).format(resultFormat)})`}
+        </InvestigateInTimelineButton>
+        <div>{description}</div>
+      </>
     );
   }
 };
 
 export { InsightComponent as renderer };
+
+const InsightEditorComponent = ({
+  node,
+  onSave,
+  onCancel,
+}: EuiMarkdownEditorUiPluginEditorProps<InsightComponentProps & { relativeTimerange: string }>) => {
+  const isEditMode = node != null;
+  const { sourcererDataView, indexPattern } = useSourcererDataView(SourcererScopeName.default);
+  const {
+    unifiedSearch: {
+      ui: { FiltersBuilderLazy },
+    },
+    uiSettings,
+  } = useKibana().services;
+  const [providers, setProviders] = useState<Provider[][]>([[]]);
+  const dateRangeChoices = useMemo(() => {
+    const settings: Array<{ from: string; to: string; display: string }> = uiSettings.get(
+      DEFAULT_TIMEPICKER_QUICK_RANGES
+    );
+    const emptyValue = { value: '0', text: '' };
+    return [
+      emptyValue,
+      ...settings.map(({ display }, index) => {
+        return {
+          value: String(index),
+          text: display,
+        };
+      }),
+    ];
+  }, [uiSettings]);
+  const kibanaDataProvider = useMemo(() => {
+    return {
+      ...sourcererDataView,
+      fields: sourcererDataView?.indexFields,
+    } as DataView;
+  }, [sourcererDataView]);
+  const formMethods = useForm<{
+    label: string;
+    description: string;
+    relativeTimerange?: string;
+  }>({
+    defaultValues: {
+      label: node?.label,
+      description: node?.description,
+      relativeTimerange: node?.relativeTimerange || '0',
+    },
+    shouldUnregister: true,
+  });
+
+  const labelController = useController({ name: 'label', control: formMethods.control });
+  const descriptionController = useController({
+    name: 'description',
+    control: formMethods.control,
+  });
+  const relativeTimerangeController = useController({
+    name: 'relativeTimerange',
+    control: formMethods.control,
+  });
+
+  const getTimeRangeSelection = useCallback(
+    (selection?: string) => {
+      const selectedOption = dateRangeChoices.find((option) => {
+        return option.value === selection;
+      });
+      if (selectedOption && selectedOption.value !== '0') {
+        const settingsIndex = Number(selectedOption.value);
+        const settings: Array<{ from: string; to: string; display: string }> = uiSettings.get(
+          DEFAULT_TIMEPICKER_QUICK_RANGES
+        );
+        return {
+          relativeFrom: settings[settingsIndex].from,
+          relativeTo: settings[settingsIndex].to,
+        };
+      } else {
+        return {};
+      }
+    },
+    [dateRangeChoices, uiSettings]
+  );
+
+  const onSubmit = useCallback(() => {
+    onSave(
+      `!{insight${JSON.stringify(
+        pickBy(
+          {
+            label: labelController.field.value,
+            description: descriptionController.field.value,
+            providers,
+            ...getTimeRangeSelection(relativeTimerangeController.field.value),
+          },
+          (value) => !isEmpty(value)
+        )
+      )}}`,
+      {
+        block: true,
+      }
+    );
+  }, [
+    onSave,
+    providers,
+    labelController.field.value,
+    descriptionController.field.value,
+    relativeTimerangeController.field.value,
+    getTimeRangeSelection,
+  ]);
+
+  const onChange = useCallback((filters: Filter[]) => {
+    setProviders(filtersToInsightProviders(filters));
+  }, []);
+  const selectOnChange = useCallback(
+    (event) => {
+      relativeTimerangeController.field.onChange(event.target.value);
+    },
+    [relativeTimerangeController.field]
+  );
+  const filtersStub = useMemo(() => {
+    const index = indexPattern && indexPattern.getName ? indexPattern.getName() : '*';
+    return [
+      {
+        $state: {
+          store: FilterStateStore.APP_STATE,
+        },
+        meta: {
+          disabled: false,
+          negate: false,
+          alias: null,
+          index,
+        },
+      },
+    ];
+  }, [indexPattern]);
+  return (
+    <>
+      <EuiModalHeader
+        css={css`
+          min-width: 700px;
+        `}
+      >
+        <EuiModalHeaderTitle>
+          <EuiFlexGroup gutterSize={'s'}>
+            <EuiFlexItem>
+              {isEditMode ? (
+                <FormattedMessage
+                  id="xpack.securitySolution.markdown.insight.editModalTitle"
+                  defaultMessage="Edit investigation query"
+                />
+              ) : (
+                <FormattedMessage
+                  id="xpack.securitySolution.markdown.insight.addModalTitle"
+                  defaultMessage="Add investigation query"
+                />
+              )}
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiBetaBadge
+                color={'hollow'}
+                label={i18n.translate('xpack.securitySolution.markdown.insight.technicalPreview', {
+                  defaultMessage: 'Technical Preview',
+                })}
+                size="s"
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiModalHeaderTitle>
+      </EuiModalHeader>
+
+      <EuiModalBody>
+        <FormProvider {...formMethods}>
+          <EuiForm fullWidth>
+            <EuiFormRow
+              label="Label"
+              helpText="Label for the filter button rendered in the guide"
+              fullWidth
+            >
+              <EuiFieldText
+                {...{
+                  ...formMethods.register('label'),
+                  ref: null,
+                }}
+                name="label"
+                onChange={labelController.field.onChange}
+              />
+            </EuiFormRow>
+            <EuiFormRow
+              label="Description"
+              helpText="Description of the relevance of the query"
+              fullWidth
+            >
+              <EuiFieldText
+                {...{ ...formMethods.register('description'), ref: null }}
+                name="description"
+                onChange={descriptionController.field.onChange}
+              />
+            </EuiFormRow>
+            <EuiFormRow fullWidth>
+              <FiltersBuilderLazy
+                filters={filtersStub}
+                onChange={onChange}
+                dataView={kibanaDataProvider}
+                maxDepth={2}
+              />
+            </EuiFormRow>
+            <EuiFormRow
+              label="Relative time range"
+              helpText="Select a time range relative to the time of the alert (optional)"
+              fullWidth
+            >
+              <EuiSelect
+                {...{ ...formMethods.register('relativeTimerange'), ref: null }}
+                onChange={selectOnChange}
+                options={dateRangeChoices}
+              />
+            </EuiFormRow>
+          </EuiForm>
+        </FormProvider>
+      </EuiModalBody>
+
+      <EuiModalFooter>
+        <EuiButtonEmpty onClick={onCancel}>
+          {i18n.translate('xpack.securitySolution.markdown.insight.modalCancelButtonLabel', {
+            defaultMessage: 'Cancel',
+          })}
+        </EuiButtonEmpty>
+        <EuiButton onClick={formMethods.handleSubmit(onSubmit)} fill>
+          {isEditMode ? (
+            <FormattedMessage
+              id="xpack.securitySolution.markdown.insight.addModalConfirmButtonLabel"
+              defaultMessage="Add query"
+            />
+          ) : (
+            <FormattedMessage
+              id="xpack.securitySolution.markdown.insight.editModalConfirmButtonLabel"
+              defaultMessage="Save changes"
+            />
+          )}
+        </EuiButton>
+      </EuiModalFooter>
+    </>
+  );
+};
+
+const InsightEditor = React.memo(InsightEditorComponent);
+const exampleInsight = `!{insight{
+  "label": "Test action",
+  "description": "Click to investigate",
+  "providers": [
+    [     
+      {"field": "event.id", "value": "{{kibana.alert.original_event.id}}", "queryType": "phrase", "excluded": "false"}
+    ],
+    [  
+      {"field": "event.action", "value": "", "queryType": "exists", "excluded": "false"},
+      {"field": "process.pid", "value": "{{process.pid}}", "queryType": "phrase", "excluded":"false"}
+    ]
+  ]
+}}`;
+
+export const plugin = {
+  name: 'insights',
+  button: {
+    label: 'Insights',
+    iconType: 'aggregate',
+  },
+  helpText: (
+    <div>
+      <EuiCodeBlock language="md" fontSize="l" paddingSize="s" isCopyable>
+        {exampleInsight}
+      </EuiCodeBlock>
+      <EuiSpacer size="s" />
+    </div>
+  ),
+  editor: InsightEditor,
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/replace_params_query.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/replace_params_query.ts
new file mode 100644
index 0000000000000..72765e1fa2cab
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/replace_params_query.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { each } from 'lodash';
+import type { TimelineEventsDetailsItem } from '../../../../../../common/search_strategy';
+
+export const replaceParamsQuery = (
+  query: string | number | boolean,
+  data?: TimelineEventsDetailsItem[] | null
+) => {
+  if (typeof query === 'number' || typeof query === 'boolean') {
+    return {
+      result: query,
+      skipped: true,
+      matchedBrackets: null,
+    };
+  }
+  const regex = /\{{([^}]+)\}}/g;
+  const matchedBrackets = query.match(regex);
+  let resultQuery = query;
+
+  if (matchedBrackets && data) {
+    each(matchedBrackets, (bracesText: string) => {
+      const field = bracesText.replace(/{{|}}/g, '').trim();
+      if (resultQuery.includes(bracesText)) {
+        const foundField = data.find(({ field: alertField }) => alertField === field);
+        if (foundField && foundField.values) {
+          const {
+            values: [foundFieldValue],
+          } = foundField;
+          resultQuery = resultQuery.replace(bracesText, foundFieldValue);
+        }
+      }
+    });
+  }
+
+  const skipped = regex.test(resultQuery);
+
+  return {
+    result: resultQuery,
+    skipped,
+    matchedBrackets,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_data_providers.test.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_data_providers.test.ts
index 8542c445b5d14..9ab25b00eabd3 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_data_providers.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_data_providers.test.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 import { renderHook } from '@testing-library/react-hooks';
-import type { DataProvider } from '@kbn/timelines-plugin/common';
 import type { UseInsightDataProvidersProps, Provider } from './use_insight_data_providers';
 import type { TimelineEventsDetailsItem } from '../../../../../../common/search_strategy';
-import { useInsightDataProviders } from './use_insight_data_providers';
+import {
+  useInsightDataProviders,
+  type UseInsightDataProvidersResult,
+} from './use_insight_data_providers';
 import { mockAlertDetailsData } from '../../../event_details/__mocks__';
 
 const mockAlertDetailsDataWithIsObject = mockAlertDetailsData.map((detail) => {
@@ -18,115 +20,152 @@ const mockAlertDetailsDataWithIsObject = mockAlertDetailsData.map((detail) => {
   };
 }) as TimelineEventsDetailsItem[];
 
-const nestedAndProvider = [
+const nestedAndProvider: Provider[][] = [
   [
     {
       field: 'event.id',
-      value: 'kibana.alert.rule.uuid',
-      type: 'parameter',
+      value: '{{kibana.alert.rule.uuid}}',
+      queryType: 'phrase',
+      excluded: false,
     },
   ],
   [
     {
       field: 'event.category',
       value: 'network',
-      type: 'literal',
+      queryType: 'phrase',
+      excluded: false,
     },
     {
       field: 'process.pid',
-      value: 'process.pid',
-      type: 'parameter',
+      value: '{{process.pid}}',
+      queryType: 'phrase',
+      excluded: false,
     },
   ],
-] as Provider[][];
+];
 
 const topLevelOnly = [
   [
     {
       field: 'event.id',
-      value: 'kibana.alert.rule.uuid',
-      type: 'parameter',
+      value: '{{kibana.alert.rule.uuid}}',
+      queryType: 'phrase',
+      excluded: false,
     },
   ],
   [
     {
       field: 'event.category',
       value: 'network',
-      type: 'literal',
+      queryType: 'phrase',
+      excluded: false,
     },
   ],
   [
     {
       field: 'process.pid',
-      value: 'process.pid',
-      type: 'parameter',
+      value: 1000,
+      valueType: 'number',
+      queryType: 'phrase',
+      excluded: false,
     },
   ],
-] as Provider[][];
+];
 
-const nonExistantField = [
+const nonExistantField: Provider[][] = [
   [
     {
       field: 'event.id',
-      value: 'kibana.alert.rule.parameters.threshold.field',
-      type: 'parameter',
+      value: '{{kibana.alert.rule.parameters.threshold.field}}',
+      excluded: false,
+      queryType: 'phrase',
     },
   ],
-] as Provider[][];
+];
+
+const providerWithRange: Provider[][] = [
+  [
+    {
+      field: 'event.id',
+      value: '',
+      excluded: false,
+      queryType: 'exists',
+    },
+    {
+      field: 'event.id',
+      value: '{"gte":0,"lt":100}',
+      excluded: false,
+      queryType: 'range',
+    },
+  ],
+];
 
 describe('useInsightDataProviders', () => {
   it('should return 2 data providers, 1 with a nested provider ANDed to it', () => {
-    const { result } = renderHook<UseInsightDataProvidersProps, DataProvider[]>(() =>
+    const { result } = renderHook<UseInsightDataProvidersProps, UseInsightDataProvidersResult>(() =>
       useInsightDataProviders({
         providers: nestedAndProvider,
         alertData: mockAlertDetailsDataWithIsObject,
       })
     );
-    const providers = result.current;
+    const { dataProviders: providers, filters } = result.current;
     const providersWithNonEmptyAnd = providers.filter((provider) => provider.and.length > 0);
     expect(providers.length).toBe(2);
     expect(providersWithNonEmptyAnd.length).toBe(1);
+    expect(filters.length).toBe(0);
   });
 
   it('should return 3 data providers without any containing nested ANDs', () => {
-    const { result } = renderHook<UseInsightDataProvidersProps, DataProvider[]>(() =>
+    const { result } = renderHook<UseInsightDataProvidersProps, UseInsightDataProvidersResult>(() =>
       useInsightDataProviders({
         providers: topLevelOnly,
         alertData: mockAlertDetailsDataWithIsObject,
       })
     );
-    const providers = result.current;
+    const { dataProviders: providers } = result.current;
     const providersWithNonEmptyAnd = providers.filter((provider) => provider.and.length > 0);
     expect(providers.length).toBe(3);
     expect(providersWithNonEmptyAnd.length).toBe(0);
   });
 
-  it('should use a wildcard for a field not present in an alert', () => {
-    const { result } = renderHook<UseInsightDataProvidersProps, DataProvider[]>(() =>
+  it('should use the string literal if no field in the alert matches a bracketed value', () => {
+    const { result } = renderHook<UseInsightDataProvidersProps, UseInsightDataProvidersResult>(() =>
       useInsightDataProviders({
         providers: nonExistantField,
         alertData: mockAlertDetailsDataWithIsObject,
       })
     );
-    const providers = result.current;
+    const { dataProviders: providers } = result.current;
     const {
       queryMatch: { value },
     } = providers[0];
     expect(providers.length).toBe(1);
-    expect(value).toBe('*');
+    expect(value).toBe('{{kibana.alert.rule.parameters.threshold.field}}');
   });
 
   it('should use template data providers when called without alertData', () => {
-    const { result } = renderHook<UseInsightDataProvidersProps, DataProvider[]>(() =>
+    const { result } = renderHook<UseInsightDataProvidersProps, UseInsightDataProvidersResult>(() =>
       useInsightDataProviders({
         providers: nestedAndProvider,
       })
     );
-    const providers = result.current;
+    const { dataProviders: providers } = result.current;
     const [first, second] = providers;
     const [nestedSecond] = second.and;
     expect(second.type).toBe('default');
     expect(first.type).toBe('template');
     expect(nestedSecond.type).toBe('template');
   });
+
+  it('should return an empty array of dataProviders and populated filters if a provider contains a range type', () => {
+    const { result } = renderHook<UseInsightDataProvidersProps, UseInsightDataProvidersResult>(() =>
+      useInsightDataProviders({
+        providers: providerWithRange,
+      })
+    );
+    const { dataProviders: providers, filters } = result.current;
+    expect(providers.length).toBe(0);
+    expect(filters.length > providers.length);
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_data_providers.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_data_providers.ts
index 5c5de496b04b5..97bd073bd8be3 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_data_providers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_data_providers.ts
@@ -6,109 +6,241 @@
  */
 
 import { useMemo } from 'react';
+import type { Filter } from '@kbn/es-query';
+import { FILTERS, BooleanRelation, FilterStateStore } from '@kbn/es-query';
 import type { QueryOperator, DataProvider } from '@kbn/timelines-plugin/common';
 import { DataProviderType } from '@kbn/timelines-plugin/common';
-import { IS_OPERATOR } from '../../../../../timelines/components/timeline/data_providers/data_provider';
+import { replaceParamsQuery } from './replace_params_query';
 import type { TimelineEventsDetailsItem } from '../../../../../../common/search_strategy';
+import {
+  EXISTS_OPERATOR,
+  IS_OPERATOR,
+  IS_ONE_OF_OPERATOR,
+} from '../../../../../timelines/components/timeline/data_providers/data_provider';
 
 export interface Provider {
   field: string;
-  value: string;
-  type: 'parameter' | 'value';
+  excluded: boolean;
+  queryType: string;
+  value: string | number | boolean;
+  valueType?: string;
 }
 export interface UseInsightDataProvidersProps {
   providers: Provider[][];
   alertData?: TimelineEventsDetailsItem[] | null;
 }
 
+export interface UseInsightDataProvidersResult {
+  dataProviders: DataProvider[];
+  filters: Filter[];
+}
+
+const dataProviderQueryType = (type: string): QueryOperator => {
+  if (type === FILTERS.EXISTS) {
+    return EXISTS_OPERATOR;
+  } else if (type === FILTERS.PHRASES) {
+    return IS_ONE_OF_OPERATOR;
+  } else {
+    return IS_OPERATOR;
+  }
+};
+
+const buildDataProviders = (
+  providers: Provider[][],
+  alertData?: TimelineEventsDetailsItem[] | null
+): DataProvider[] => {
+  return providers.map((innerProvider) => {
+    return innerProvider.reduce((prev, next, index): DataProvider => {
+      const { field, value, excluded, queryType } = next;
+      const { result, matchedBrackets } = replaceParamsQuery(value, alertData);
+      const isTemplate = !alertData && matchedBrackets;
+      if (index === 0) {
+        return {
+          and: [],
+          enabled: true,
+          id: JSON.stringify(field + value),
+          name: field,
+          excluded,
+          kqlQuery: '',
+          type: isTemplate ? DataProviderType.template : DataProviderType.default,
+          queryMatch: {
+            field,
+            value: result,
+            operator: dataProviderQueryType(queryType),
+          },
+        };
+      } else {
+        const newProvider = {
+          and: [],
+          enabled: true,
+          id: JSON.stringify(field + value),
+          name: field,
+          excluded,
+          kqlQuery: '',
+          type: isTemplate ? DataProviderType.template : DataProviderType.default,
+          queryMatch: {
+            field,
+            value: result,
+            operator: dataProviderQueryType(queryType),
+          },
+        };
+        prev.and.push(newProvider);
+      }
+      return prev;
+    }, {} as DataProvider);
+  });
+};
+const filterStub = {
+  $state: {
+    store: FilterStateStore.APP_STATE,
+  },
+  meta: {
+    disabled: false,
+    negate: false,
+    alias: null,
+    index: undefined,
+  },
+};
+const buildPrimitiveFilter = (provider: Provider): Filter => {
+  const baseFilter = {
+    ...filterStub,
+    meta: {
+      ...filterStub.meta,
+      negate: provider.excluded,
+      type: provider.queryType,
+    },
+  };
+  if (provider.queryType === FILTERS.EXISTS) {
+    return {
+      ...baseFilter,
+      meta: {
+        ...baseFilter.meta,
+        params: undefined,
+        value: 'exists',
+      },
+      query: { exists: { field: provider.field } },
+    };
+  } else if (provider.queryType === FILTERS.PHRASES) {
+    let values = JSON.parse(String(provider.value));
+    if (provider.valueType === 'number') {
+      values = values.map(Number);
+    } else if (provider.valueType === 'boolean') {
+      values = values.map(Boolean);
+    }
+    return {
+      ...baseFilter,
+      meta: {
+        ...baseFilter.meta,
+      },
+      query: {
+        bool: {
+          minimum_should_match: 1,
+          should: values?.map((param: string | number | boolean) => ({
+            match_phrase: { [provider.field]: param },
+          })),
+        },
+      },
+    };
+  } else if (provider.queryType === FILTERS.PHRASE) {
+    return {
+      ...baseFilter,
+      meta: {
+        ...baseFilter.meta,
+        params: { query: provider.value },
+        value: undefined,
+      },
+      query: { match_phrase: { [provider.field]: provider.value ?? '' } },
+    };
+  } else if (provider.queryType === FILTERS.RANGE) {
+    let gte;
+    let lt;
+    try {
+      const input = JSON.parse(String(provider.value));
+      gte = input.gte;
+      lt = input.lt;
+    } catch {
+      gte = '';
+      lt = '';
+    }
+    const params = {
+      gte,
+      lt,
+    };
+    return {
+      ...baseFilter,
+      meta: {
+        ...baseFilter.meta,
+        params,
+      },
+      query: {
+        range: {
+          [provider.field]: params,
+        },
+      },
+    };
+  } else {
+    return baseFilter;
+  }
+};
+
+const buildFiltersFromInsightProviders = (
+  providers: Provider[][],
+  alertData?: TimelineEventsDetailsItem[] | null
+): Filter[] => {
+  const filters: Filter[] = [];
+  for (let index = 0; index < providers.length; index++) {
+    const provider = providers[index];
+    if (provider.length > 1) {
+      // Only support 1 level of nesting currently
+      const innerProviders = provider.map((innerProvider) => {
+        return buildPrimitiveFilter(innerProvider);
+      });
+      const combinedFilter = {
+        $state: {
+          store: FilterStateStore.APP_STATE,
+        },
+        meta: {
+          type: FILTERS.COMBINED,
+          relation: BooleanRelation.AND,
+          params: innerProviders,
+          index: undefined,
+          disabled: false,
+          negate: false,
+        },
+      };
+      filters.push(combinedFilter);
+    } else {
+      const baseProvider = provider[0];
+
+      const baseFilter = buildPrimitiveFilter(baseProvider);
+      filters.push(baseFilter);
+    }
+  }
+  return filters;
+};
+
 export const useInsightDataProviders = ({
   providers,
   alertData,
-}: UseInsightDataProvidersProps): DataProvider[] => {
-  function getFieldValue(fields: TimelineEventsDetailsItem[], fieldToFind: string) {
-    const alertField = fields.find((dataField) => dataField.field === fieldToFind);
-    return alertField?.values ? alertField.values[0] : '*';
-  }
+}: UseInsightDataProvidersProps): UseInsightDataProvidersResult => {
+  const providersContainRangeQuery = useMemo(() => {
+    return providers.some((innerProvider) => {
+      return innerProvider.some((provider) => provider.queryType === 'range');
+    });
+  }, [providers]);
   const dataProviders: DataProvider[] = useMemo(() => {
-    if (alertData) {
-      return providers.map((innerProvider) => {
-        return innerProvider.reduce((prev, next, index): DataProvider => {
-          const { field, value, type } = next;
-          if (index === 0) {
-            return {
-              and: [],
-              enabled: true,
-              id: JSON.stringify(field + value + type),
-              name: field,
-              excluded: false,
-              kqlQuery: '',
-              type: DataProviderType.default,
-              queryMatch: {
-                field,
-                value: type === 'parameter' ? getFieldValue(alertData, value) : value,
-                operator: IS_OPERATOR as QueryOperator,
-              },
-            };
-          } else {
-            const newProvider = {
-              and: [],
-              enabled: true,
-              id: JSON.stringify(field + value + type),
-              name: field,
-              excluded: false,
-              kqlQuery: '',
-              type: DataProviderType.default,
-              queryMatch: {
-                field,
-                value: type === 'parameter' ? getFieldValue(alertData, value) : value,
-                operator: IS_OPERATOR as QueryOperator,
-              },
-            };
-            prev.and.push(newProvider);
-          }
-          return prev;
-        }, {} as DataProvider);
-      });
+    if (providersContainRangeQuery) {
+      return [];
     } else {
-      return providers.map((innerProvider) => {
-        return innerProvider.reduce((prev, next, index) => {
-          const { field, value, type } = next;
-          if (index === 0) {
-            return {
-              and: [],
-              enabled: true,
-              id: JSON.stringify(field + value + type),
-              name: field,
-              excluded: false,
-              kqlQuery: '',
-              type: type === 'parameter' ? DataProviderType.template : DataProviderType.default,
-              queryMatch: {
-                field,
-                value: type === 'parameter' ? `{${value}}` : value,
-                operator: IS_OPERATOR as QueryOperator,
-              },
-            };
-          } else {
-            const newProvider = {
-              and: [],
-              enabled: true,
-              id: JSON.stringify(field + value + type),
-              name: field,
-              excluded: false,
-              kqlQuery: '',
-              type: type === 'parameter' ? DataProviderType.template : DataProviderType.default,
-              queryMatch: {
-                field,
-                value: type === 'parameter' ? `{${value}}` : value,
-                operator: IS_OPERATOR as QueryOperator,
-              },
-            };
-            prev.and.push(newProvider);
-          }
-          return prev;
-        }, {} as DataProvider);
-      });
+      return buildDataProviders(providers, alertData);
+    }
+  }, [alertData, providers, providersContainRangeQuery]);
+  const filters = useMemo(() => {
+    if (!providersContainRangeQuery) {
+      return [];
+    } else {
+      return buildFiltersFromInsightProviders(providers, alertData);
     }
-  }, [alertData, providers]);
-  return dataProviders;
+  }, [providersContainRangeQuery, providers, alertData]);
+  return { dataProviders, filters };
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_query.test.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_query.test.ts
index 74942f0f4ad38..eecab538e9c2b 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_query.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_query.test.ts
@@ -33,6 +33,7 @@ describe('useInsightQuery', () => {
       () =>
         useInsightQuery({
           dataProviders: [mockProvider],
+          filters: [],
         }),
       {
         wrapper: TestProviders,
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_query.ts b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_query.ts
index e7836cd6cd3ad..7d8a09d134c8c 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_query.ts
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/insight/use_insight_query.ts
@@ -6,6 +6,7 @@
  */
 
 import { useMemo, useState } from 'react';
+import type { Filter } from '@kbn/es-query';
 import { getEsQueryConfig } from '@kbn/data-plugin/common';
 import type { DataProvider } from '@kbn/timelines-plugin/common';
 import { TimelineId } from '../../../../../../common/types/timeline';
@@ -17,6 +18,7 @@ import { SourcererScopeName } from '../../../../store/sourcerer/model';
 
 export interface UseInsightQuery {
   dataProviders: DataProvider[];
+  filters: Filter[];
 }
 
 export interface UseInsightQueryResult {
@@ -26,7 +28,10 @@ export interface UseInsightQueryResult {
   hasError: boolean;
 }
 
-export const useInsightQuery = ({ dataProviders }: UseInsightQuery): UseInsightQueryResult => {
+export const useInsightQuery = ({
+  dataProviders,
+  filters,
+}: UseInsightQuery): UseInsightQueryResult => {
   const { uiSettings } = useKibana().services;
   const esQueryConfig = useMemo(() => getEsQueryConfig(uiSettings), [uiSettings]);
   const { browserFields, selectedPatterns, indexPattern, dataViewId } = useSourcererDataView(
@@ -41,7 +46,7 @@ export const useInsightQuery = ({ dataProviders }: UseInsightQuery): UseInsightQ
           dataProviders,
           indexPattern,
           browserFields,
-          filters: [],
+          filters,
           kqlQuery: {
             query: '',
             language: 'kuery',
@@ -54,7 +59,7 @@ export const useInsightQuery = ({ dataProviders }: UseInsightQuery): UseInsightQ
       setHasError(true);
       return null;
     }
-  }, [browserFields, dataProviders, esQueryConfig, hasError, indexPattern]);
+  }, [browserFields, dataProviders, esQueryConfig, hasError, indexPattern, filters]);
 
   const [isQueryLoading, { events, totalCount }] = useTimelineEvents({
     dataViewId,
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
index 5c6b108736844..1bf4b83608c66 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
@@ -446,6 +446,7 @@ export const useSourcererDataView = (
       selectedPatterns,
       // if we have to do an update to data view, tell us which patterns are active
       ...(legacyPatterns.length > 0 ? { activePatterns: sourcererDataView.patternList } : {}),
+      sourcererDataView,
     }),
     [sourcererDataView, selectedPatterns, indicesExist, loading, legacyPatterns.length]
   );
diff --git a/x-pack/plugins/security_solution/public/common/lib/kuery/index.ts b/x-pack/plugins/security_solution/public/common/lib/kuery/index.ts
index c7f287bcac608..e21a5a519fc51 100644
--- a/x-pack/plugins/security_solution/public/common/lib/kuery/index.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/kuery/index.ts
@@ -18,6 +18,12 @@ import type { BrowserFields } from '../../../../common/search_strategy';
 import type { DataProvider, DataProvidersAnd } from '../../../../common/types';
 import { DataProviderType, EXISTS_OPERATOR } from '../../../../common/types';
 
+export type PrimitiveOrArrayOfPrimitives =
+  | string
+  | number
+  | boolean
+  | Array<string | number | boolean>;
+
 export interface CombineQueries {
   config: EsQueryConfig;
   dataProviders: DataProvider[];
@@ -29,8 +35,8 @@ export interface CombineQueries {
 }
 
 export const escapeQueryValue = (
-  val: string | number | Array<string | number> = ''
-): string | number | Array<string | number> => {
+  val: PrimitiveOrArrayOfPrimitives = ''
+): PrimitiveOrArrayOfPrimitives => {
   if (isString(val)) {
     if (isEmpty(val)) {
       return '""';
@@ -68,12 +74,13 @@ export const convertKueryToElasticSearchQuery = (
   }
 };
 
-const isNumber = (value: string | number | Array<string | number>) => !isNaN(Number(value));
+export const isNumber = (value: PrimitiveOrArrayOfPrimitives): value is number =>
+  !isNaN(Number(value));
 
-const convertDateFieldToQuery = (field: string, value: string | number | Array<string | number>) =>
+export const convertDateFieldToQuery = (field: string, value: PrimitiveOrArrayOfPrimitives) =>
   `${field}: ${isNumber(value) ? value : new Date(value.toString()).valueOf()}`;
 
-const getBaseFields = memoizeOne((browserFields: BrowserFields): string[] => {
+export const getBaseFields = memoizeOne((browserFields: BrowserFields): string[] => {
   const baseFields = get('base', browserFields);
   if (baseFields != null && baseFields.fields != null) {
     return Object.keys(baseFields.fields);
@@ -81,7 +88,7 @@ const getBaseFields = memoizeOne((browserFields: BrowserFields): string[] => {
   return [];
 });
 
-const getBrowserFieldPath = (field: string, browserFields: BrowserFields) => {
+export const getBrowserFieldPath = (field: string, browserFields: BrowserFields) => {
   const splitFields = field.split('.');
   const baseFields = getBaseFields(browserFields);
   if (baseFields.includes(field)) {
@@ -90,7 +97,7 @@ const getBrowserFieldPath = (field: string, browserFields: BrowserFields) => {
   return [splitFields[0], 'fields', field];
 };
 
-const checkIfFieldTypeIsDate = (field: string, browserFields: BrowserFields) => {
+export const checkIfFieldTypeIsDate = (field: string, browserFields: BrowserFields) => {
   const pathBrowserField = getBrowserFieldPath(field, browserFields);
   const browserField = get(pathBrowserField, browserFields);
   if (browserField != null && browserField.type === 'date') {
@@ -99,9 +106,9 @@ const checkIfFieldTypeIsDate = (field: string, browserFields: BrowserFields) =>
   return false;
 };
 
-const convertNestedFieldToQuery = (
+export const convertNestedFieldToQuery = (
   field: string,
-  value: string | number | Array<string | number>,
+  value: PrimitiveOrArrayOfPrimitives,
   browserFields: BrowserFields
 ) => {
   const pathBrowserField = getBrowserFieldPath(field, browserFields);
@@ -111,7 +118,7 @@ const convertNestedFieldToQuery = (
   return `${nestedPath}: { ${key}: ${browserField.type === 'date' ? `"${value}"` : value} }`;
 };
 
-const convertNestedFieldToExistQuery = (field: string, browserFields: BrowserFields) => {
+export const convertNestedFieldToExistQuery = (field: string, browserFields: BrowserFields) => {
   const pathBrowserField = getBrowserFieldPath(field, browserFields);
   const browserField = get(pathBrowserField, browserFields);
   const nestedPath = browserField.subType.nested.path;
@@ -119,7 +126,7 @@ const convertNestedFieldToExistQuery = (field: string, browserFields: BrowserFie
   return `${nestedPath}: { ${key}: * }`;
 };
 
-const checkIfFieldTypeIsNested = (field: string, browserFields: BrowserFields) => {
+export const checkIfFieldTypeIsNested = (field: string, browserFields: BrowserFields) => {
   const pathBrowserField = getBrowserFieldPath(field, browserFields);
   const browserField = get(pathBrowserField, browserFields);
   if (browserField != null && browserField.subType && browserField.subType.nested) {
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/model.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/model.ts
index e4d16f2079dba..71f78bbd29aaa 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/model.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/model.ts
@@ -93,6 +93,7 @@ export interface SelectedDataView {
   selectedPatterns: SourcererScope['selectedPatterns'];
   // active patterns when dataViewId == null
   activePatterns?: string[];
+  sourcererDataView?: SourcererDataView | (Omit<SourcererDataView, 'id'> & { id: string | null });
 }
 
 /**
diff --git a/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/components/controlled_combobox_input.tsx b/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/components/controlled_combobox_input.tsx
index 0be933113e99c..ca20e12aa3fe9 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/components/controlled_combobox_input.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/components/controlled_combobox_input.tsx
@@ -10,12 +10,13 @@ import React, { useState, useEffect, useCallback } from 'react';
 import type { EuiComboBoxOptionOption } from '@elastic/eui';
 import { EuiComboBox } from '@elastic/eui';
 
-import { isStringOrNumberArray } from '../../timeline/helpers';
+import { isPrimitiveArray } from '../../timeline/helpers';
+import type { PrimitiveOrArrayOfPrimitives } from '../../../../common/lib/kuery';
 import * as i18n from '../translations';
 
 interface ControlledDataProviderInput {
   onChangeCallback: (value: string | number | string[]) => void;
-  value: string | number | Array<string | number>;
+  value: PrimitiveOrArrayOfPrimitives;
 }
 
 export const ControlledComboboxInput = ({
@@ -71,9 +72,9 @@ export const ControlledComboboxInput = ({
 };
 
 export const convertValuesToComboboxValueArray = (
-  values: string | number | Array<string | number>
+  values: PrimitiveOrArrayOfPrimitives
 ): EuiComboBoxOptionOption[] =>
-  isStringOrNumberArray(values) ? values.map((item) => ({ label: String(item) })) : [];
+  isPrimitiveArray(values) ? values.map((item) => ({ label: String(item) })) : [];
 
 export const convertComboboxValuesToStringArray = (values: EuiComboBoxOptionOption[]): string[] =>
   values.map((item) => item.label);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/components/controlled_default_input.tsx b/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/components/controlled_default_input.tsx
index 9734e1c51de1f..065ea950e46fe 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/components/controlled_default_input.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/components/controlled_default_input.tsx
@@ -9,13 +9,14 @@ import React, { useState, useEffect, useCallback } from 'react';
 
 import { EuiFieldText } from '@elastic/eui';
 
-import { isStringOrNumberArray } from '../../timeline/helpers';
+import { isPrimitiveArray } from '../../timeline/helpers';
+import type { PrimitiveOrArrayOfPrimitives } from '../../../../common/lib/kuery';
 import { sanatizeValue } from '../helpers';
 import * as i18n from '../translations';
 
 interface ControlledDataProviderInput {
   onChangeCallback: (value: string | number | string[]) => void;
-  value: string | number | Array<string | number>;
+  value: PrimitiveOrArrayOfPrimitives;
 }
 
 const VALUE_INPUT_CLASS_NAME = 'edit-data-provider-value';
@@ -24,7 +25,9 @@ export const ControlledDefaultInput = ({
   value,
   onChangeCallback,
 }: ControlledDataProviderInput) => {
-  const [primitiveValue, setPrimitiveValue] = useState<string | number>(getDefaultValue(value));
+  const [primitiveValue, setPrimitiveValue] = useState<string | number | boolean>(
+    getDefaultValue(value)
+  );
 
   useEffect(() => {
     onChangeCallback(sanatizeValue(primitiveValue));
@@ -44,10 +47,8 @@ export const ControlledDefaultInput = ({
   );
 };
 
-export const getDefaultValue = (
-  value: string | number | Array<string | number>
-): string | number => {
-  if (isStringOrNumberArray(value)) {
+export const getDefaultValue = (value: PrimitiveOrArrayOfPrimitives): string | number | boolean => {
+  if (isPrimitiveArray(value)) {
     return value[0] ?? '';
   } else return value;
 };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/helpers.tsx
index c2ad001dde1a6..8380bedce65c3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/helpers.tsx
@@ -126,9 +126,8 @@ export const getExcludedFromSelection = (selectedOperator: EuiComboBoxOptionOpti
 };
 
 /** Ensure that a value passed to ControlledDefaultInput is not an array */
-export const sanatizeValue = (value: string | number | unknown[]): string => {
+export const sanatizeValue = (value: string | number | boolean | unknown[]): string => {
   if (Array.isArray(value)) {
-    // fun fact: value should never be an array
     return value.length ? `${value[0]}` : '';
   }
   return `${value}`;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/index.tsx
index 29b78e73f7b96..271ee58d2c9f6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/index.tsx
@@ -21,6 +21,7 @@ import React, { useEffect, useMemo, useState, useCallback } from 'react';
 import styled from 'styled-components';
 
 import type { BrowserFields } from '../../../common/containers/source';
+import type { PrimitiveOrArrayOfPrimitives } from '../../../common/lib/kuery';
 import type { OnDataProviderEdited } from '../timeline/events';
 import type { QueryOperator } from '../timeline/data_providers/data_provider';
 import { DataProviderType } from '../timeline/data_providers/data_provider';
@@ -57,7 +58,7 @@ interface Props {
   operator: QueryOperator;
   providerId: string;
   timelineId: string;
-  value: string | number | Array<string | number>;
+  value: PrimitiveOrArrayOfPrimitives;
   type?: DataProviderType;
 }
 
@@ -92,9 +93,7 @@ export const StatefulEditDataProvider = React.memo<Props>(
       getInitialOperatorLabel(isExcluded, operator)
     );
 
-    const [updatedValue, setUpdatedValue] = useState<string | number | Array<string | number>>(
-      value
-    );
+    const [updatedValue, setUpdatedValue] = useState<PrimitiveOrArrayOfPrimitives>(value);
 
     const showComboBoxInput = useMemo(
       () =>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/data_provider.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/data_provider.ts
index 204583c9eabaa..3ed66744c760f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/data_provider.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/data_provider.ts
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import type { PrimitiveOrArrayOfPrimitives } from '../../../../common/lib/kuery';
 /** Represents the Timeline data providers */
 
 /** The `is` operator in a KQL query */
@@ -27,8 +27,8 @@ export enum DataProviderType {
 export interface QueryMatch {
   field: string;
   displayField?: string;
-  value: string | number | Array<string | number>;
-  displayValue?: string | number;
+  value: PrimitiveOrArrayOfPrimitives;
+  displayValue?: string | number | boolean;
   operator: QueryOperator;
 }
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/helpers.tsx
index 03bd1d84c9708..5567e88cb05bc 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/helpers.tsx
@@ -10,7 +10,8 @@ import type { DraggableLocation } from 'react-beautiful-dnd';
 import type { Dispatch } from 'redux';
 
 import { updateProviders } from '../../../store/timeline/actions';
-import { isStringOrNumberArray } from '../helpers';
+import type { PrimitiveOrArrayOfPrimitives } from '../../../../common/lib/kuery';
+import { isPrimitiveArray } from '../helpers';
 
 import type { DataProvider, DataProvidersAnd } from './data_provider';
 
@@ -344,10 +345,8 @@ export const addContentToTimeline = ({
   }
 };
 
-export const getDisplayValue = (
-  value: string | number | Array<string | number>
-): string | number => {
-  if (isStringOrNumberArray(value)) {
+export const getDisplayValue = (value: PrimitiveOrArrayOfPrimitives): string | number | boolean => {
+  if (isPrimitiveArray(value)) {
     if (value.length) {
       return `( ${value.join(' OR ')} )`;
     }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_badge.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_badge.tsx
index 951caa426e2c1..a1dd257a5f997 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_badge.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_badge.tsx
@@ -11,6 +11,7 @@ import { isString } from 'lodash/fp';
 import React, { useCallback, useMemo } from 'react';
 import styled from 'styled-components';
 
+import type { PrimitiveOrArrayOfPrimitives } from '../../../../common/lib/kuery';
 import { TimelineType } from '../../../../../common/types/timeline';
 import { getEmptyString } from '../../../../common/components/empty_value';
 import { ProviderContainer } from '../../../../common/components/drag_and_drop/provider_container';
@@ -103,7 +104,7 @@ interface ProviderBadgeProps {
   togglePopover: () => void;
   toggleType: () => void;
   displayValue: string;
-  val: string | number | Array<string | number>;
+  val: PrimitiveOrArrayOfPrimitives;
   operator: QueryOperator;
   type: DataProviderType;
   timelineType: TimelineType;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_item_actions.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_item_actions.tsx
index d37720f7218c2..f13935fc87ae1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_item_actions.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_item_actions.tsx
@@ -12,6 +12,7 @@ import React from 'react';
 import styled from 'styled-components';
 
 import { TimelineType } from '../../../../../common/types/timeline';
+import type { PrimitiveOrArrayOfPrimitives } from '../../../../common/lib/kuery';
 import type { BrowserFields } from '../../../../common/containers/source';
 
 import type { OnDataProviderEdited } from '../events';
@@ -48,7 +49,7 @@ interface OwnProps {
   toggleEnabledProvider: () => void;
   toggleExcludedProvider: () => void;
   toggleTypeProvider: () => void;
-  value: string | number | Array<string | number>;
+  value: PrimitiveOrArrayOfPrimitives;
   type: DataProviderType;
 }
 
@@ -80,7 +81,7 @@ interface GetProviderActionsProps {
   toggleEnabled: () => void;
   toggleExcluded: () => void;
   toggleType: () => void;
-  value: string | number | Array<string | number>;
+  value: PrimitiveOrArrayOfPrimitives;
   type: DataProviderType;
 }
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_item_badge.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_item_badge.tsx
index dfe598177bc55..90a0d3890b545 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_item_badge.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/provider_item_badge.tsx
@@ -16,6 +16,7 @@ import {
   useShallowEqualSelector,
 } from '../../../../common/hooks/use_selector';
 import { timelineSelectors } from '../../../store/timeline';
+import type { PrimitiveOrArrayOfPrimitives } from '../../../../common/lib/kuery';
 
 import type { OnDataProviderEdited } from '../events';
 import { ProviderBadge } from './provider_badge';
@@ -44,7 +45,7 @@ interface ProviderItemBadgeProps {
   toggleExcludedProvider: () => void;
   toggleTypeProvider: () => void;
   displayValue?: string;
-  val: string | number | Array<string | number>;
+  val: PrimitiveOrArrayOfPrimitives;
   type?: DataProviderType;
   wrapperRef?: React.MutableRefObject<HTMLDivElement | null>;
 }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
index 46ed0839a0e23..14046b853a235 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import type { PrimitiveOrArrayOfPrimitives } from '../../../common/lib/kuery';
 import type { ColumnId } from './body/column_id';
 import type { DataProvider, QueryOperator } from './data_providers/data_provider';
 export type {
@@ -36,7 +37,7 @@ export type OnDataProviderEdited = ({
   id: string;
   operator: QueryOperator;
   providerId: string;
-  value: string | number | Array<string | number>;
+  value: PrimitiveOrArrayOfPrimitives;
   type: DataProvider['type'];
 }) => void;
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.test.tsx
index c2df23cd69c4f..e5587921e9ff4 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.test.tsx
@@ -16,7 +16,7 @@ import {
   buildIsOneOfQueryMatch,
   buildIsQueryMatch,
   handleIsOperator,
-  isStringOrNumberArray,
+  isPrimitiveArray,
   showGlobalFilters,
 } from './helpers';
 
@@ -274,27 +274,27 @@ describe('Build KQL Query', () => {
 
 describe('isStringOrNumberArray', () => {
   test('it returns false when value is not an array', () => {
-    expect(isStringOrNumberArray('just a string')).toBe(false);
+    expect(isPrimitiveArray('just a string')).toBe(false);
   });
 
   test('it returns false when value is an array of mixed types', () => {
-    expect(isStringOrNumberArray(['mixed', 123, 'types'])).toBe(false);
+    expect(isPrimitiveArray(['mixed', 123, 'types'])).toBe(false);
   });
   test('it returns false when value is an array of bad types', () => {
     const badValues = [undefined, null, {}] as unknown as string[];
-    expect(isStringOrNumberArray(badValues)).toBe(false);
+    expect(isPrimitiveArray(badValues)).toBe(false);
   });
 
   test('it returns true when value is an empty array', () => {
-    expect(isStringOrNumberArray([])).toBe(true);
+    expect(isPrimitiveArray([])).toBe(true);
   });
 
   test('it returns true when value is an array of all strings', () => {
-    expect(isStringOrNumberArray(['all', 'string', 'values'])).toBe(true);
+    expect(isPrimitiveArray(['all', 'string', 'values'])).toBe(true);
   });
 
   test('it returns true when value is an array of all numbers', () => {
-    expect(isStringOrNumberArray([123, 456, 789])).toBe(true);
+    expect(isPrimitiveArray([123, 456, 789])).toBe(true);
   });
 
   describe('queryHandlerFunctions', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
index 1760693b4187d..7d7a72de7c049 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import { isEmpty, get } from 'lodash/fp';
-import memoizeOne from 'memoize-one';
+import { isEmpty } from 'lodash/fp';
 
 import {
   elementOrChildrenHasFocus,
@@ -18,7 +17,16 @@ import {
 
 import { assertUnreachable } from '../../../../common/utility_types';
 import type { BrowserFields } from '../../../common/containers/source';
-import { escapeQueryValue } from '../../../common/lib/kuery';
+import {
+  escapeQueryValue,
+  isNumber,
+  convertDateFieldToQuery,
+  checkIfFieldTypeIsDate,
+  convertNestedFieldToQuery,
+  convertNestedFieldToExistQuery,
+  checkIfFieldTypeIsNested,
+  type PrimitiveOrArrayOfPrimitives,
+} from '../../../common/lib/kuery';
 import type { DataProvider, DataProvidersAnd } from './data_providers/data_provider';
 import {
   DataProviderType,
@@ -28,66 +36,6 @@ import {
 } from './data_providers/data_provider';
 import { EVENTS_TABLE_CLASS_NAME } from './styles';
 
-const isNumber = (value: string | number): value is number => !isNaN(Number(value));
-
-const convertDateFieldToQuery = (field: string, value: string | number) =>
-  `${field}: ${isNumber(value) ? value : new Date(value).valueOf()}`;
-
-const getBaseFields = memoizeOne((browserFields: BrowserFields): string[] => {
-  const baseFields = get('base', browserFields);
-  if (baseFields != null && baseFields.fields != null) {
-    return Object.keys(baseFields.fields);
-  }
-  return [];
-});
-
-const getBrowserFieldPath = (field: string, browserFields: BrowserFields) => {
-  const splitFields = field.split('.');
-  const baseFields = getBaseFields(browserFields);
-  if (baseFields.includes(field)) {
-    return ['base', 'fields', field];
-  }
-  return [splitFields[0], 'fields', field];
-};
-
-const checkIfFieldTypeIsDate = (field: string, browserFields: BrowserFields) => {
-  const pathBrowserField = getBrowserFieldPath(field, browserFields);
-  const browserField = get(pathBrowserField, browserFields);
-  if (browserField != null && browserField.type === 'date') {
-    return true;
-  }
-  return false;
-};
-
-const convertNestedFieldToQuery = (
-  field: string,
-  value: string | number,
-  browserFields: BrowserFields
-) => {
-  const pathBrowserField = getBrowserFieldPath(field, browserFields);
-  const browserField = get(pathBrowserField, browserFields);
-  const nestedPath = browserField.subType.nested.path;
-  const key = field.replace(`${nestedPath}.`, '');
-  return `${nestedPath}: { ${key}: ${browserField.type === 'date' ? `"${value}"` : value} }`;
-};
-
-const convertNestedFieldToExistQuery = (field: string, browserFields: BrowserFields) => {
-  const pathBrowserField = getBrowserFieldPath(field, browserFields);
-  const browserField = get(pathBrowserField, browserFields);
-  const nestedPath = browserField.subType.nested.path;
-  const key = field.replace(`${nestedPath}.`, '');
-  return `${nestedPath}: { ${key}: * }`;
-};
-
-const checkIfFieldTypeIsNested = (field: string, browserFields: BrowserFields) => {
-  const pathBrowserField = getBrowserFieldPath(field, browserFields);
-  const browserField = get(pathBrowserField, browserFields);
-  if (browserField != null && browserField.subType && browserField.subType.nested) {
-    return true;
-  }
-  return false;
-};
-
 const buildQueryMatch = (
   dataProvider: DataProvider | DataProvidersAnd,
   browserFields: BrowserFields
@@ -265,7 +213,7 @@ export const resetKeyboardFocus = () => {
 interface OperatorHandler {
   field: string;
   isExcluded: string;
-  value: string | number | Array<string | number>;
+  value: PrimitiveOrArrayOfPrimitives;
 }
 
 export const handleIsOperator = ({
@@ -280,7 +228,7 @@ export const handleIsOperator = ({
   isFieldTypeNested: boolean;
   type?: DataProviderType;
 }) => {
-  if (!isStringOrNumberArray(value)) {
+  if (!isPrimitiveArray(value)) {
     return `${isExcluded}${
       type !== DataProviderType.template
         ? buildIsQueryMatch({ browserFields, field, isFieldTypeNested, value })
@@ -292,7 +240,7 @@ export const handleIsOperator = ({
 };
 
 const handleIsOneOfOperator = ({ field, isExcluded, value }: OperatorHandler) => {
-  if (isStringOrNumberArray(value)) {
+  if (isPrimitiveArray(value)) {
     return `${isExcluded}${buildIsOneOfQueryMatch({ field, value })}`;
   } else {
     return `${isExcluded}${field} : ${JSON.stringify(value)}`;
@@ -308,7 +256,7 @@ export const buildIsQueryMatch = ({
   browserFields: BrowserFields;
   field: string;
   isFieldTypeNested: boolean;
-  value: string | number;
+  value: string | number | boolean;
 }): string => {
   if (isFieldTypeNested) {
     return convertNestedFieldToQuery(field, value, browserFields);
@@ -338,17 +286,17 @@ export const buildIsOneOfQueryMatch = ({
   value,
 }: {
   field: string;
-  value: Array<string | number>;
+  value: Array<string | number | boolean>;
 }): string => {
   const trimmedField = field.trim();
   if (value.length) {
     return `${trimmedField} : (${value
-      .map((item) => (isNumber(item) ? Number(item) : `${escapeQueryValue(item.trim())}`))
+      .map((item) => (isNumber(item) ? Number(item) : `${escapeQueryValue(String(item).trim())}`))
       .join(' OR ')})`;
   }
   return `${trimmedField} : ''`;
 };
 
-export const isStringOrNumberArray = (value: unknown): value is Array<string | number> =>
+export const isPrimitiveArray = (value: unknown): value is Array<string | number | boolean> =>
   Array.isArray(value) &&
   (value.every((x) => typeof x === 'string') || value.every((x) => typeof x === 'number'));
diff --git a/x-pack/plugins/timelines/common/types/timeline/data_provider/index.ts b/x-pack/plugins/timelines/common/types/timeline/data_provider/index.ts
index 4aaa675137fc8..d9ef64c0ea1e3 100644
--- a/x-pack/plugins/timelines/common/types/timeline/data_provider/index.ts
+++ b/x-pack/plugins/timelines/common/types/timeline/data_provider/index.ts
@@ -27,8 +27,8 @@ export enum DataProviderType {
 export interface QueryMatch {
   field: string;
   displayField?: string;
-  value: string | number | Array<string | number>;
-  displayValue?: string | number;
+  value: string | number | boolean | Array<string | number | boolean>;
+  displayValue?: string | number | boolean;
   operator: QueryOperator;
 }
 

From 9119a00a606b0116f7a2fda526ff14caf5825609 Mon Sep 17 00:00:00 2001
From: Julia Rechkunova <julia.rechkunova@elastic.co>
Date: Tue, 7 Feb 2023 15:18:53 +0100
Subject: [PATCH 061/134] [Discover] Fix flaky adhoc test when removing a field
 (#150419)

Closes https://github.com/elastic/kibana/issues/142721
Closes https://github.com/elastic/kibana/issues/150271

100x
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/1873
---
 test/functional/page_objects/discover_page.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/test/functional/page_objects/discover_page.ts b/test/functional/page_objects/discover_page.ts
index 0854bfe9b9c69..b33f6401db98f 100644
--- a/test/functional/page_objects/discover_page.ts
+++ b/test/functional/page_objects/discover_page.ts
@@ -406,7 +406,9 @@ export class DiscoverPageObject extends FtrService {
   public async removeField(field: string) {
     await this.clickFieldListItem(field);
     await this.testSubjects.click(`discoverFieldListPanelDelete-${field}`);
-    await this.testSubjects.existOrFail('runtimeFieldDeleteConfirmModal');
+    await this.retry.waitFor('modal to open', async () => {
+      return await this.testSubjects.exists('runtimeFieldDeleteConfirmModal');
+    });
     await this.fieldEditor.confirmDelete();
   }
 

From b96d46c06b85c944d006a3582cfe3c56d1102e5f Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Tue, 7 Feb 2023 15:29:47 +0100
Subject: [PATCH 062/134] [APM] Service metrics/continuous rollups follow-up
 work (#150266)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Søren Louv-Jansen <sorenlouv@gmail.com>
Closes https://github.com/elastic/kibana/issues/150265
---
 .../src/lib/timerange.ts                      |  16 +-
 ...eate_service_summary_metrics_aggregator.ts |  43 ++
 .../get_routing_transform.ts                  |   3 +-
 .../client/apm_synthtrace_es_client/index.ts  |   5 +
 .../services_without_transactions.ts          |  49 +++
 .../es_client_indexer.test.ts.snap            |  83 +++-
 .../src/test/es_client_indexer.test.ts        |   2 +-
 .../server/collectors/management/schema.ts    |   4 +
 .../server/collectors/management/types.ts     |   1 +
 src/plugins/telemetry/schema/oss_plugins.json |   6 +
 x-pack/plugins/apm/common/data_source.ts      |   3 +-
 x-pack/plugins/apm/common/document_type.ts    |   6 +
 x-pack/plugins/apm/dev_docs/apm_queries.md    |  32 +-
 .../app/settings/general_settings/index.tsx   |   4 +
 .../time_range_metadata_context.tsx           |  30 +-
 .../get_request_base.ts                       |   6 +-
 .../create_apm_event_client/index.ts          |  69 ++-
 .../helpers/create_es_client/document_type.ts |   9 +
 .../lib/helpers/get_document_sources.ts       | 155 +++++--
 .../server/lib/helpers/transactions/index.ts  |   6 +-
 .../apm/server/routes/default_api_types.ts    |   2 +-
 .../get_service_transaction_stats.ts          |   5 +-
 .../get_services/get_services_items.ts        |  12 +-
 ...s => get_services_without_transactions.ts} |  30 +-
 .../get_services/merge_service_stats.test.ts  |   8 +-
 .../get_services/merge_service_stats.ts       |  17 +-
 ...service_transaction_detailed_statistics.ts |  13 +-
 .../get_services_detailed_statistics/index.ts |   4 +-
 .../apm/server/routes/services/route.ts       |   6 +-
 .../routes/time_range_metadata/route.ts       |  17 +-
 x-pack/plugins/observability/common/index.ts  |   2 +
 .../observability/common/ui_settings_keys.ts  |   2 +
 .../common/utils/get_inspect_response.ts      |   2 +-
 .../observability/server/ui_settings.ts       |  34 ++
 ...chive_services_detailed_statistics.spec.ts | 298 +++++++++++++
 .../services_detailed_statistics.spec.ts      | 328 +++++---------
 .../tests/services/top_services.spec.ts       | 100 ++++-
 .../time_range_metadata.spec.ts               | 404 ++++++++++++++++++
 38 files changed, 1462 insertions(+), 354 deletions(-)
 create mode 100644 packages/kbn-apm-synthtrace/src/lib/apm/aggregators/create_service_summary_metrics_aggregator.ts
 create mode 100644 packages/kbn-apm-synthtrace/src/scenarios/services_without_transactions.ts
 rename x-pack/plugins/apm/server/routes/services/get_services/{get_services_from_error_and_metric_documents.ts => get_services_without_transactions.ts} (77%)
 create mode 100644 x-pack/test/apm_api_integration/tests/services/archive_services_detailed_statistics.spec.ts
 create mode 100644 x-pack/test/apm_api_integration/tests/time_range_metadata/time_range_metadata.spec.ts

diff --git a/packages/kbn-apm-synthtrace-client/src/lib/timerange.ts b/packages/kbn-apm-synthtrace-client/src/lib/timerange.ts
index 18dd8178c32dc..2dd0659f9cc19 100644
--- a/packages/kbn-apm-synthtrace-client/src/lib/timerange.ts
+++ b/packages/kbn-apm-synthtrace-client/src/lib/timerange.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import type { Moment } from 'moment';
 import { Interval } from './interval';
 
 export class Timerange {
@@ -20,9 +21,14 @@ export class Timerange {
   }
 }
 
-export function timerange(from: Date | number, to: Date | number) {
-  return new Timerange(
-    from instanceof Date ? from : new Date(from),
-    to instanceof Date ? to : new Date(to)
-  );
+type DateLike = Date | number | Moment | string;
+
+function getDateFrom(date: DateLike): Date {
+  if (date instanceof Date) return date;
+  if (typeof date === 'number' || typeof date === 'string') return new Date(date);
+  return date.toDate();
+}
+
+export function timerange(from: Date | number | Moment, to: Date | number | Moment) {
+  return new Timerange(getDateFrom(from), getDateFrom(to));
 }
diff --git a/packages/kbn-apm-synthtrace/src/lib/apm/aggregators/create_service_summary_metrics_aggregator.ts b/packages/kbn-apm-synthtrace/src/lib/apm/aggregators/create_service_summary_metrics_aggregator.ts
new file mode 100644
index 0000000000000..a83e7306e3941
--- /dev/null
+++ b/packages/kbn-apm-synthtrace/src/lib/apm/aggregators/create_service_summary_metrics_aggregator.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { ApmFields, hashKeysOf } from '@kbn/apm-synthtrace-client';
+import { identity, noop, pick } from 'lodash';
+import { createApmMetricAggregator } from './create_apm_metric_aggregator';
+
+const KEY_FIELDS: Array<keyof ApmFields> = [
+  'agent.name',
+  'service.environment',
+  'service.name',
+  'service.language.name',
+];
+
+export function createServiceSummaryMetricsAggregator(flushInterval: string) {
+  return createApmMetricAggregator(
+    {
+      filter: () => true,
+      getAggregateKey: (event) => {
+        // see https://github.com/elastic/apm-server/blob/main/x-pack/apm-server/aggregation/txmetrics/aggregator.go
+        return hashKeysOf(event, KEY_FIELDS);
+      },
+      flushInterval,
+      init: (event) => {
+        const set = pick(event, KEY_FIELDS);
+
+        return {
+          ...set,
+          'metricset.name': 'service_summary',
+          'metricset.interval': flushInterval,
+          'processor.event': 'metric',
+          'processor.name': 'metric',
+        };
+      },
+    },
+    noop,
+    identity
+  );
+}
diff --git a/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/get_routing_transform.ts b/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/get_routing_transform.ts
index 8c3f5ea3b25b4..aa1e421697707 100644
--- a/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/get_routing_transform.ts
+++ b/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/get_routing_transform.ts
@@ -34,7 +34,8 @@ export function getRoutingTransform() {
           } else if (
             metricsetName === 'transaction' ||
             metricsetName === 'service_transaction' ||
-            metricsetName === 'service_destination'
+            metricsetName === 'service_destination' ||
+            metricsetName === 'service_summary'
           ) {
             index = `metrics-apm.${metricsetName}.${document['metricset.interval']!}-default`;
           } else {
diff --git a/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts b/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts
index 58fab239eab40..21fd3a0ac7dcf 100644
--- a/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts
+++ b/packages/kbn-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client/index.ts
@@ -21,6 +21,7 @@ import { Logger } from '../../../utils/create_logger';
 import { fork, sequential } from '../../../utils/stream_utils';
 import { createBreakdownMetricsAggregator } from '../../aggregators/create_breakdown_metrics_aggregator';
 import { createServiceMetricsAggregator } from '../../aggregators/create_service_metrics_aggregator';
+import { createServiceSummaryMetricsAggregator } from '../../aggregators/create_service_summary_metrics_aggregator';
 import { createSpanMetricsAggregator } from '../../aggregators/create_span_metrics_aggregator';
 import { createTransactionMetricsAggregator } from '../../aggregators/create_transaction_metrics_aggregator';
 import { getApmServerMetadataTransform } from './get_apm_server_metadata_transform';
@@ -111,6 +112,7 @@ export class ApmSynthtraceEsClient {
       index: dataStreams,
       allow_no_indices: true,
       ignore_unavailable: true,
+      expand_wildcards: ['open', 'hidden'],
     });
   }
 
@@ -123,6 +125,9 @@ export class ApmSynthtraceEsClient {
         createServiceMetricsAggregator('1m'),
         createServiceMetricsAggregator('10m'),
         createServiceMetricsAggregator('60m'),
+        createServiceSummaryMetricsAggregator('1m'),
+        createServiceSummaryMetricsAggregator('10m'),
+        createServiceSummaryMetricsAggregator('60m'),
         createSpanMetricsAggregator('1m'),
         createSpanMetricsAggregator('10m'),
         createSpanMetricsAggregator('60m'),
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/services_without_transactions.ts b/packages/kbn-apm-synthtrace/src/scenarios/services_without_transactions.ts
new file mode 100644
index 0000000000000..94e3ea20ba787
--- /dev/null
+++ b/packages/kbn-apm-synthtrace/src/scenarios/services_without_transactions.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { apm, ApmFields } from '@kbn/apm-synthtrace-client';
+import { Scenario } from '../cli/scenario';
+
+const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
+  return {
+    generate: ({ range }) => {
+      const withTx = apm
+        .service('service-with-transactions', 'production', 'java')
+        .instance('instance');
+
+      const withErrorsOnly = apm
+        .service('service-with-errors-only', 'production', 'java')
+        .instance('instance');
+
+      const withAppMetricsOnly = apm
+        .service('service-with-app-metrics-only', 'production', 'java')
+        .instance('instance');
+
+      return range
+        .interval('1m')
+        .rate(1)
+        .generator((timestamp) => {
+          return [
+            withTx.transaction('GET /api').duration(100).timestamp(timestamp),
+            withErrorsOnly
+              .error({
+                message: 'An unknown error occurred',
+              })
+              .timestamp(timestamp),
+            withAppMetricsOnly
+              .appMetrics({
+                'system.memory.actual.free': 1,
+                'system.memory.total': 2,
+              })
+              .timestamp(timestamp),
+          ];
+        });
+    },
+  };
+};
+
+export default scenario;
diff --git a/packages/kbn-apm-synthtrace/src/test/__snapshots__/es_client_indexer.test.ts.snap b/packages/kbn-apm-synthtrace/src/test/__snapshots__/es_client_indexer.test.ts.snap
index 7178720ea0a02..74160ee85287a 100644
--- a/packages/kbn-apm-synthtrace/src/test/__snapshots__/es_client_indexer.test.ts.snap
+++ b/packages/kbn-apm-synthtrace/src/test/__snapshots__/es_client_indexer.test.ts.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`Synthtrace ES Client indexer indexes documents 1`] = `
+exports[`Synthtrace ES Client indexer indexes documents 2`] = `
 Array [
   Object {
     "@timestamp": "2022-01-01T00:00:00.000Z",
@@ -68,6 +68,33 @@ Array [
       "event": "metric",
     },
   },
+  Object {
+    "@timestamp": "2022-01-01T00:00:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
+  Object {
+    "@timestamp": "2022-01-01T00:00:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
+  Object {
+    "@timestamp": "2022-01-01T00:00:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
   Object {
     "@timestamp": "2022-01-01T00:00:00.000Z",
     "metricset": Object {
@@ -119,6 +146,24 @@ Array [
       "event": "metric",
     },
   },
+  Object {
+    "@timestamp": "2022-01-01T00:30:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
+  Object {
+    "@timestamp": "2022-01-01T00:30:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
   Object {
     "@timestamp": "2022-01-01T00:30:00.000Z",
     "metricset": Object {
@@ -200,6 +245,42 @@ Array [
       "event": "metric",
     },
   },
+  Object {
+    "@timestamp": "2022-01-01T01:00:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
+  Object {
+    "@timestamp": "2022-01-01T01:00:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
+  Object {
+    "@timestamp": "2022-01-01T00:00:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
+  Object {
+    "@timestamp": "2022-01-01T01:00:00.000Z",
+    "metricset": Object {
+      "name": "service_summary",
+    },
+    "processor": Object {
+      "event": "metric",
+    },
+  },
   Object {
     "@timestamp": "2022-01-01T01:00:00.000Z",
     "metricset": Object {
diff --git a/packages/kbn-apm-synthtrace/src/test/es_client_indexer.test.ts b/packages/kbn-apm-synthtrace/src/test/es_client_indexer.test.ts
index 05ea68af97350..9b35b2d0bd29f 100644
--- a/packages/kbn-apm-synthtrace/src/test/es_client_indexer.test.ts
+++ b/packages/kbn-apm-synthtrace/src/test/es_client_indexer.test.ts
@@ -72,7 +72,7 @@ describe('Synthtrace ES Client indexer', () => {
 
     const events = await toArray(datasource);
 
-    expect(events.length).toBe(24);
+    expect(events.length).toMatchInlineSnapshot(`33`);
 
     const mapped = events.map((event) =>
       pick(event, '@timestamp', 'processor.event', 'metricset.name')
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
index 0c61004477613..9525b7345a380 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
@@ -434,6 +434,10 @@ export const stackManagementSchema: MakeSchemaFrom<UsageStats> = {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
   },
+  'observability:apmEnableContinuousRollups': {
+    type: 'boolean',
+    _meta: { description: 'Non-default value of setting.' },
+  },
   'observability:apmAgentExplorerView': {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
index c0d7e74bf0c45..245cb55368015 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
@@ -41,6 +41,7 @@ export interface UsageStats {
   'observability:enableComparisonByDefault': boolean;
   'observability:enableServiceGroups': boolean;
   'observability:apmEnableServiceMetrics': boolean;
+  'observability:apmEnableContinuousRollups': boolean;
   'observability:apmAWSLambdaPriceFactor': string;
   'observability:apmAWSLambdaRequestCostPerMillion': number;
   'observability:enableInfrastructureHostsView': boolean;
diff --git a/src/plugins/telemetry/schema/oss_plugins.json b/src/plugins/telemetry/schema/oss_plugins.json
index 7b8d7ef9386c2..52fe7853bf471 100644
--- a/src/plugins/telemetry/schema/oss_plugins.json
+++ b/src/plugins/telemetry/schema/oss_plugins.json
@@ -8910,6 +8910,12 @@
             "description": "Non-default value of setting."
           }
         },
+        "observability:apmEnableContinuousRollups": {
+          "type": "boolean",
+          "_meta": {
+            "description": "Non-default value of setting."
+          }
+        },
         "observability:apmAgentExplorerView": {
           "type": "boolean",
           "_meta": {
diff --git a/x-pack/plugins/apm/common/data_source.ts b/x-pack/plugins/apm/common/data_source.ts
index 54b7f10512566..b951677a8cb65 100644
--- a/x-pack/plugins/apm/common/data_source.ts
+++ b/x-pack/plugins/apm/common/data_source.ts
@@ -12,7 +12,8 @@ type AnyApmDocumentType =
   | ApmDocumentType.ServiceTransactionMetric
   | ApmDocumentType.TransactionMetric
   | ApmDocumentType.TransactionEvent
-  | ApmDocumentType.ServiceDestinationMetric;
+  | ApmDocumentType.ServiceDestinationMetric
+  | ApmDocumentType.ServiceSummaryMetric;
 
 export interface ApmDataSource<
   TDocumentType extends AnyApmDocumentType = AnyApmDocumentType
diff --git a/x-pack/plugins/apm/common/document_type.ts b/x-pack/plugins/apm/common/document_type.ts
index a737484b91760..4027e9d36ded2 100644
--- a/x-pack/plugins/apm/common/document_type.ts
+++ b/x-pack/plugins/apm/common/document_type.ts
@@ -10,4 +10,10 @@ export enum ApmDocumentType {
   ServiceTransactionMetric = 'serviceTransactionMetric',
   TransactionEvent = 'transactionEvent',
   ServiceDestinationMetric = 'serviceDestinationMetric',
+  ServiceSummaryMetric = 'serviceSummaryMetric',
 }
+
+export type ApmServiceTransactionDocumentType =
+  | ApmDocumentType.ServiceTransactionMetric
+  | ApmDocumentType.TransactionMetric
+  | ApmDocumentType.TransactionEvent;
diff --git a/x-pack/plugins/apm/dev_docs/apm_queries.md b/x-pack/plugins/apm/dev_docs/apm_queries.md
index 69f5953cce59c..acd20597389d9 100644
--- a/x-pack/plugins/apm/dev_docs/apm_queries.md
+++ b/x-pack/plugins/apm/dev_docs/apm_queries.md
@@ -224,38 +224,48 @@ GET apm-*-metric-*,metrics-apm*/_search?terminate_after=1000
 
 # Transactions in service inventory page
 
-Service metrics is an aggregated metric document that holds latency and throughput metrics pivoted by `service.name + service.environment + transaction.type`
+Service transaction metrics are aggregated metric documents that hold latency and throughput metrics pivoted by `service.name`, `service.environment` and `transaction.type`. Additionally, `agent.name` and `service.language.name` are included as metadata.
 
-The decision to use service metrics aggregation or not is determined in [getServiceInventorySearchSource](https://github.com/elastic/kibana/blob/5d585ea375be551a169a0bea49b011819b9ac669/x-pack/plugins/apm/server/lib/helpers/get_service_inventory_search_source.ts#L12) and [getSearchServiceMetrics](https://github.com/elastic/kibana/blob/5d585ea375be551a169a0bea49b011819b9ac669/x-pack/plugins/apm/server/lib/helpers/service_metrics/index.ts#L38)
+We use the response from the `GET /internal/apm/time_range_metadata` endpoint to determine what data source is available. A data source is considered available if there is either data before the current time range, or, if there is no data at all before the current time range, if there is data within the current time range. This means that existing deployments will use transaction metrics right after upgrading (instead of using service transaction metrics and seeing a mostly blank screen), but also that new deployments immediately get the benefits of service transaction metrics, instead of falling all the way back to transaction events.
 
 A pre-aggregated document where `_doc_count` is the number of transaction events
 
 ```
 {
-  "_doc_count": 627,
+  "_doc_count": 4,
   "@timestamp": "2021-09-01T10:00:00.000Z",
   "processor.event": "metric",
-  "metricset.name": "service",
+  "metricset.name": "service_transaction",
+  "metricset.interval": "1m",
   "service": {
     "environment": "production",
     "name": "web-go"
   },
   "transaction": {
     "duration.summary": {
-        "sum": 376492831,
-        "value_count": 627
+        "sum": 1000,
+        "value_count": 4
+    },
+    "duration.histogram": {
+      "counts": [ 4 ],
+      "values": [ 250 ]
     },
-    "success_count": 476,
-    "failure_count": 151,
     "type": "request"
+  },
+  "event": {
+    "success_count": {
+      "sum": 1,
+      "value_count": 2
+    }
   }
 }
 ```
 
 - `_doc_count` is the number of bucket counts
-- `transaction.duration.summary` is an [aggregate_metric_double](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/aggregate-metric-double.html) field and holds an aggregated transaction duration summary, for service metrics
-- `failure_count` holds an aggregated count of transactions with the outcome "failure"
-- `success_count` holds an aggregated count of transactions with the outcome "success"
+- `transaction.duration.summary` is an [aggregate_metric_double](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/aggregate-metric-double.html) field and holds an aggregated transaction duration summary, for service transaction metrics
+- `event.success_count` holds an aggregate metric double that describes the _success rate_. E.g., in this example, the success rate is 50% (1/2).
+
+In addition to `service_transaction`, `service_summary` metrics are also generated. Every service outputs these, even when it does not record any transaction (that also means there is no transaction data on this metric). This means that we can use `service_summary` to display services without transactions, i.e. services that only have app/system metrics or errors.
 
 ### Latency
 
diff --git a/x-pack/plugins/apm/public/components/app/settings/general_settings/index.tsx b/x-pack/plugins/apm/public/components/app/settings/general_settings/index.tsx
index e250f1e09276b..670826e43cccc 100644
--- a/x-pack/plugins/apm/public/components/app/settings/general_settings/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/settings/general_settings/index.tsx
@@ -17,6 +17,8 @@ import {
   enableInspectEsQueries,
   apmAWSLambdaPriceFactor,
   apmAWSLambdaRequestCostPerMillion,
+  apmEnableServiceMetrics,
+  apmEnableContinuousRollups,
 } from '@kbn/observability-plugin/common';
 import { isEmpty } from 'lodash';
 import React from 'react';
@@ -32,6 +34,8 @@ const apmSettingsKeys = [
   apmLabsButton,
   apmAWSLambdaPriceFactor,
   apmAWSLambdaRequestCostPerMillion,
+  apmEnableServiceMetrics,
+  apmEnableContinuousRollups,
 ];
 
 export function GeneralSettings() {
diff --git a/x-pack/plugins/apm/public/context/time_range_metadata/time_range_metadata_context.tsx b/x-pack/plugins/apm/public/context/time_range_metadata/time_range_metadata_context.tsx
index 8a549ee26d199..0bdb9418bf510 100644
--- a/x-pack/plugins/apm/public/context/time_range_metadata/time_range_metadata_context.tsx
+++ b/x-pack/plugins/apm/public/context/time_range_metadata/time_range_metadata_context.tsx
@@ -5,11 +5,16 @@
  * 2.0.
  */
 import React, { createContext } from 'react';
+import {
+  apmEnableServiceMetrics,
+  apmEnableContinuousRollups,
+} from '@kbn/observability-plugin/common';
 import { TimeRangeMetadata } from '../../../common/time_range_metadata';
 import { useApmParams } from '../../hooks/use_apm_params';
 import { useApmRoutePath } from '../../hooks/use_apm_route_path';
 import { FetcherResult, useFetcher } from '../../hooks/use_fetcher';
 import { useTimeRange } from '../../hooks/use_time_range';
+import { useApmPluginContext } from '../apm_plugin/use_apm_plugin_context';
 
 export const TimeRangeMetadataContext = createContext<
   FetcherResult<TimeRangeMetadata> | undefined
@@ -20,6 +25,10 @@ export function TimeRangeMetadataContextProvider({
 }: {
   children: React.ReactElement;
 }) {
+  const {
+    core: { uiSettings },
+  } = useApmPluginContext();
+
   const { query } = useApmParams('/*');
 
   const kuery = 'kuery' in query ? query.kuery : '';
@@ -37,6 +46,16 @@ export function TimeRangeMetadataContextProvider({
 
   const routePath = useApmRoutePath();
 
+  const enableServiceTransactionMetrics = uiSettings.get<boolean>(
+    apmEnableServiceMetrics,
+    true
+  );
+
+  const enableContinuousRollups = uiSettings.get<boolean>(
+    apmEnableContinuousRollups,
+    true
+  );
+
   const isOperationView =
     routePath.startsWith('/dependencies/operation') ||
     routePath.startsWith('/dependencies/operations');
@@ -50,11 +69,20 @@ export function TimeRangeMetadataContextProvider({
             end,
             kuery,
             useSpanName: isOperationView,
+            enableServiceTransactionMetrics,
+            enableContinuousRollups,
           },
         },
       });
     },
-    [start, end, kuery, isOperationView]
+    [
+      start,
+      end,
+      kuery,
+      isOperationView,
+      enableServiceTransactionMetrics,
+      enableContinuousRollups,
+    ]
   );
 
   return (
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/get_request_base.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/get_request_base.ts
index 5551736fc34b9..16e8b0edba21a 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/get_request_base.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/get_request_base.ts
@@ -28,7 +28,11 @@ export function processorEventsToIndex(
   events: ProcessorEvent[],
   indices: ApmIndicesConfig
 ) {
-  return uniq(events.map((event) => indices[processorEventIndexMap[event]]));
+  return uniq(
+    events.flatMap((event) =>
+      indices[processorEventIndexMap[event]].split(',').map((str) => str.trim())
+    )
+  );
 }
 
 export function getRequestBase(options: {
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
index b6cdfa80ff3f8..b06ab4ecb2c71 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
@@ -9,15 +9,17 @@ import type {
   EqlSearchRequest,
   FieldCapsRequest,
   FieldCapsResponse,
+  MsearchMultisearchBody,
+  MsearchMultisearchHeader,
   TermsEnumRequest,
   TermsEnumResponse,
 } from '@elastic/elasticsearch/lib/api/types';
-import { ValuesType } from 'utility-types';
 import { ElasticsearchClient, KibanaRequest } from '@kbn/core/server';
 import type { ESSearchRequest, InferSearchResponseOf } from '@kbn/es-types';
 import { ProcessorEvent } from '@kbn/observability-plugin/common';
 import { unwrapEsResponse } from '@kbn/observability-plugin/server';
 import { compact, omit } from 'lodash';
+import { ValuesType } from 'utility-types';
 import { ApmDataSource } from '../../../../../common/data_source';
 import { APMError } from '../../../../../typings/es_schemas/ui/apm_error';
 import { Metric } from '../../../../../typings/es_schemas/ui/metric';
@@ -31,8 +33,8 @@ import {
   getDebugTitle,
 } from '../call_async_with_debug';
 import { cancelEsRequestOnAbort } from '../cancel_es_request_on_abort';
-import { processorEventsToIndex, getRequestBase } from './get_request_base';
 import { ProcessorEventOfDocumentType } from '../document_type';
+import { getRequestBase, processorEventsToIndex } from './get_request_base';
 
 export type APMEventESSearchRequest = Omit<ESSearchRequest, 'index'> & {
   apm: {
@@ -81,6 +83,10 @@ type TypedSearchResponse<TParams extends APMEventESSearchRequest> =
     TParams
   >;
 
+interface TypedMSearchResponse<TParams extends APMEventESSearchRequest> {
+  responses: Array<TypedSearchResponse<TParams>>;
+}
+
 export interface APMEventClientConfig {
   esClient: ElasticsearchClient;
   debug: boolean;
@@ -163,7 +169,7 @@ export class APMEventClient {
       this.forceSyntheticSource && events.includes(ProcessorEvent.metric);
 
     const searchParams = {
-      ...omit(params, 'apm'),
+      ...omit(params, 'apm', 'body'),
       index,
       body: {
         ...params.body,
@@ -193,12 +199,63 @@ export class APMEventClient {
     });
   }
 
+  async msearch<TParams extends APMEventESSearchRequest>(
+    operationName: string,
+    ...allParams: TParams[]
+  ): Promise<TypedMSearchResponse<TParams>> {
+    const searches = allParams
+      .map((params) => {
+        const { index, filters } = getRequestBase({
+          apm: params.apm,
+          indices: this.indices,
+        });
+
+        const searchParams: [MsearchMultisearchHeader, MsearchMultisearchBody] =
+          [
+            {
+              index,
+              preference: 'any',
+              ...(this.includeFrozen ? { ignore_throttled: false } : {}),
+              ignore_unavailable: true,
+              expand_wildcards: ['open' as const, 'hidden' as const],
+            },
+            {
+              ...omit(params, 'apm', 'body'),
+              ...params.body,
+              query: {
+                bool: {
+                  filter: compact([params.body.query, ...filters]),
+                },
+              },
+            },
+          ];
+
+        return searchParams;
+      })
+      .flat();
+
+    return this.callAsyncWithDebug({
+      cb: (opts) =>
+        this.esClient.msearch(
+          {
+            searches,
+          },
+          opts
+        ) as unknown as Promise<{
+          body: TypedMSearchResponse<TParams>;
+        }>,
+      operationName,
+      params: searches,
+      requestType: 'msearch',
+    });
+  }
+
   async eqlSearch(operationName: string, params: APMEventEqlSearchRequest) {
     const index = processorEventsToIndex(params.apm.events, this.indices);
 
     const requestParams = {
-      index,
       ...omit(params, 'apm'),
+      index,
     };
 
     return this.callAsyncWithDebug({
@@ -216,8 +273,8 @@ export class APMEventClient {
     const index = processorEventsToIndex(params.apm.events, this.indices);
 
     const requestParams = {
-      index,
       ...omit(params, 'apm'),
+      index,
     };
 
     return this.callAsyncWithDebug({
@@ -235,8 +292,8 @@ export class APMEventClient {
     const index = processorEventsToIndex(params.apm.events, this.indices);
 
     const requestParams = {
-      index: Array.isArray(index) ? index.join(',') : index,
       ...omit(params, 'apm'),
+      index: index.join(','),
     };
 
     return this.callAsyncWithDebug({
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/document_type.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/document_type.ts
index 70ca95147387c..2ebee7e23b8e7 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/document_type.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/document_type.ts
@@ -51,6 +51,15 @@ const documentTypeConfigMap: Record<
     }),
     rollupIntervals: defaultRollupIntervals,
   },
+  [ApmDocumentType.ServiceSummaryMetric]: {
+    processorEvent: ProcessorEvent.metric,
+    getQuery: (rollupInterval) => ({
+      bool: {
+        filter: getDefaultFilter('service_summary', rollupInterval),
+      },
+    }),
+    rollupIntervals: defaultRollupIntervals,
+  },
   [ApmDocumentType.TransactionMetric]: {
     processorEvent: ProcessorEvent.metric,
     getQuery: (rollupInterval) => ({
diff --git a/x-pack/plugins/apm/server/lib/helpers/get_document_sources.ts b/x-pack/plugins/apm/server/lib/helpers/get_document_sources.ts
index 8631e2c0ba8a4..2b66a0b581888 100644
--- a/x-pack/plugins/apm/server/lib/helpers/get_document_sources.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/get_document_sources.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 import { kqlQuery, rangeQuery } from '@kbn/observability-plugin/server';
-import { flatten } from 'lodash';
 import { ApmDataSource } from '../../../common/data_source';
 import { ApmDocumentType } from '../../../common/document_type';
 import { RollupInterval } from '../../../common/rollup';
@@ -17,63 +16,131 @@ export async function getDocumentSources({
   start,
   end,
   kuery,
+  enableServiceTransactionMetrics,
+  enableContinuousRollups,
 }: {
   apmEventClient: APMEventClient;
   start: number;
   end: number;
   kuery: string;
+  enableServiceTransactionMetrics: boolean;
+  enableContinuousRollups: boolean;
 }) {
-  const sources: Array<ApmDataSource & { hasDocs: boolean }> = flatten(
-    await Promise.all(
-      [
-        ApmDocumentType.ServiceTransactionMetric as const,
-        ApmDocumentType.TransactionMetric as const,
-      ].map(async (documentType) => {
-        const docTypeConfig = getConfigForDocumentType(documentType);
-        const allHasDocs = await Promise.all(
-          docTypeConfig.rollupIntervals.map(async (rollupInterval) => {
-            const response = await apmEventClient.search(
-              'check_document_type_availability',
-              {
-                apm: {
-                  sources: [
-                    {
-                      documentType,
-                      rollupInterval,
-                    },
-                  ],
-                },
-                body: {
-                  track_total_hits: 1,
-                  size: 0,
-                  terminate_after: 1,
-                  query: {
-                    bool: {
-                      filter: [...kqlQuery(kuery), ...rangeQuery(start, end)],
-                    },
-                  },
-                },
-              }
-            );
+  const currentRange = rangeQuery(start, end);
+  const diff = end - start;
+  const kql = kqlQuery(kuery);
+  const beforeRange = rangeQuery(start - diff, end - diff);
 
-            return {
+  const sourcesToCheck = [
+    ...(enableServiceTransactionMetrics
+      ? [ApmDocumentType.ServiceTransactionMetric as const]
+      : []),
+    ApmDocumentType.TransactionMetric as const,
+  ].flatMap((documentType) => {
+    const docTypeConfig = getConfigForDocumentType(documentType);
+
+    return (
+      enableContinuousRollups
+        ? docTypeConfig.rollupIntervals
+        : [RollupInterval.OneMinute]
+    ).flatMap((rollupInterval) => {
+      const searchParams = {
+        apm: {
+          sources: [
+            {
               documentType,
               rollupInterval,
-              hasDocs: response.hits.total.value > 0,
-            };
-          })
-        );
+            },
+          ],
+        },
+        body: {
+          track_total_hits: 1,
+          size: 0,
+          terminate_after: 1,
+        },
+      };
+
+      return {
+        documentType,
+        rollupInterval,
+        before: {
+          ...searchParams,
+          body: {
+            ...searchParams.body,
+            query: {
+              bool: {
+                filter: [...kql, ...beforeRange],
+              },
+            },
+          },
+        },
+        current: {
+          ...searchParams,
+          body: {
+            ...searchParams.body,
+            query: {
+              bool: {
+                filter: [...kql, ...currentRange],
+              },
+            },
+          },
+        },
+      };
+    });
+  });
+
+  const allSearches = sourcesToCheck.flatMap(({ before, current }) => [
+    before,
+    current,
+  ]);
+
+  const allResponses = (
+    await apmEventClient.msearch('get_document_availability', ...allSearches)
+  ).responses;
+
+  const checkedSources = sourcesToCheck.map((source, index) => {
+    const responseBefore = allResponses[index * 2];
+    const responseAfter = allResponses[index * 2 + 1];
+    const { documentType, rollupInterval } = source;
+
+    const hasDataBefore = responseBefore.hits.total.value > 0;
+    const hasDataAfter = responseAfter.hits.total.value > 0;
 
-        return allHasDocs;
-      })
-    )
+    return {
+      documentType,
+      rollupInterval,
+      hasDataBefore,
+      hasDataAfter,
+    };
+  });
+
+  const hasAnyDataBefore = checkedSources.some(
+    (source) => source.hasDataBefore
   );
 
-  sources.push({
+  const sources: Array<ApmDataSource & { hasDocs: boolean }> =
+    checkedSources.map((source) => {
+      const { documentType, hasDataAfter, hasDataBefore, rollupInterval } =
+        source;
+
+      const hasData = hasDataBefore || hasDataAfter;
+
+      return {
+        documentType,
+        rollupInterval,
+        // If there is any data before, we require that data is available before
+        // this time range to mark this source as available. If we don't do that,
+        // users that upgrade to a version that starts generating service tx metrics
+        // will see a mostly empty screen for a while after upgrading.
+        // If we only check before, users with a new deployment will use raw transaction
+        // events.
+        hasDocs: hasAnyDataBefore ? hasDataBefore : hasData,
+      };
+    });
+
+  return sources.concat({
     documentType: ApmDocumentType.TransactionEvent,
     rollupInterval: RollupInterval.None,
     hasDocs: true,
   });
-
-  return sources;
 }
diff --git a/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts b/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
index e4de7dfc9bf74..cf95500f25318 100644
--- a/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
@@ -91,7 +91,11 @@ export async function getSearchTransactionsEvents({
 }
 
 export function getDurationFieldForTransactions(
-  typeOrSearchAgggregatedTransactions: ApmDocumentType | boolean
+  typeOrSearchAgggregatedTransactions:
+    | ApmDocumentType.ServiceTransactionMetric
+    | ApmDocumentType.TransactionMetric
+    | ApmDocumentType.TransactionEvent
+    | boolean
 ) {
   let type: ApmDocumentType;
   if (typeOrSearchAgggregatedTransactions === true) {
diff --git a/x-pack/plugins/apm/server/routes/default_api_types.ts b/x-pack/plugins/apm/server/routes/default_api_types.ts
index 629fc9c56f70a..4b58ec7e4e9b9 100644
--- a/x-pack/plugins/apm/server/routes/default_api_types.ts
+++ b/x-pack/plugins/apm/server/routes/default_api_types.ts
@@ -22,7 +22,7 @@ export const probabilityRt = t.type({
 });
 export const kueryRt = t.type({ kuery: t.string });
 
-export const dataSourceRt = t.type({
+export const serviceTransactionDataSourceRt = t.type({
   documentType: t.union([
     t.literal(ApmDocumentType.ServiceTransactionMetric),
     t.literal(ApmDocumentType.TransactionMetric),
diff --git a/x-pack/plugins/apm/server/routes/services/get_services/get_service_transaction_stats.ts b/x-pack/plugins/apm/server/routes/services/get_services/get_service_transaction_stats.ts
index f4ede557dc745..88f2e55682868 100644
--- a/x-pack/plugins/apm/server/routes/services/get_services/get_service_transaction_stats.ts
+++ b/x-pack/plugins/apm/server/routes/services/get_services/get_service_transaction_stats.ts
@@ -41,7 +41,10 @@ interface AggregationParams {
   end: number;
   serviceGroup: ServiceGroup | null;
   randomSampler: RandomSampler;
-  documentType: ApmDocumentType;
+  documentType:
+    | ApmDocumentType.ServiceTransactionMetric
+    | ApmDocumentType.TransactionMetric
+    | ApmDocumentType.TransactionEvent;
   rollupInterval: RollupInterval;
 }
 
diff --git a/x-pack/plugins/apm/server/routes/services/get_services/get_services_items.ts b/x-pack/plugins/apm/server/routes/services/get_services/get_services_items.ts
index f2cbeddffa86d..5fddc6a3d6f5e 100644
--- a/x-pack/plugins/apm/server/routes/services/get_services/get_services_items.ts
+++ b/x-pack/plugins/apm/server/routes/services/get_services/get_services_items.ts
@@ -6,7 +6,7 @@
  */
 
 import { Logger } from '@kbn/logging';
-import { ApmDocumentType } from '../../../../common/document_type';
+import { ApmServiceTransactionDocumentType } from '../../../../common/document_type';
 import { RollupInterval } from '../../../../common/rollup';
 import { ServiceGroup } from '../../../../common/service_groups';
 import { APMEventClient } from '../../../lib/helpers/create_es_client/create_apm_event_client';
@@ -15,7 +15,7 @@ import { MlClient } from '../../../lib/helpers/get_ml_client';
 import { RandomSampler } from '../../../lib/helpers/get_random_sampler';
 import { withApmSpan } from '../../../utils/with_apm_span';
 import { getHealthStatuses } from './get_health_statuses';
-import { getServicesFromErrorAndMetricDocuments } from './get_services_from_error_and_metric_documents';
+import { getServicesWithoutTransactions } from './get_services_without_transactions';
 import { getServicesAlerts } from './get_service_alerts';
 import { getServiceTransactionStats } from './get_service_transaction_stats';
 import { mergeServiceStats } from './merge_service_stats';
@@ -46,7 +46,7 @@ export async function getServicesItems({
   end: number;
   serviceGroup: ServiceGroup | null;
   randomSampler: RandomSampler;
-  documentType: ApmDocumentType;
+  documentType: ApmServiceTransactionDocumentType;
   rollupInterval: RollupInterval;
 }) {
   return withApmSpan('get_services_items', async () => {
@@ -64,7 +64,7 @@ export async function getServicesItems({
 
     const [
       { serviceStats, serviceOverflowCount },
-      { services, maxServiceCountExceeded },
+      { services: servicesWithoutTransactions, maxServiceCountExceeded },
       healthStatuses,
       alertCounts,
     ] = await Promise.all([
@@ -72,7 +72,7 @@ export async function getServicesItems({
         ...commonParams,
         apmEventClient,
       }),
-      getServicesFromErrorAndMetricDocuments({
+      getServicesWithoutTransactions({
         ...commonParams,
         apmEventClient,
       }),
@@ -90,7 +90,7 @@ export async function getServicesItems({
       items:
         mergeServiceStats({
           serviceStats,
-          servicesFromErrorAndMetricDocuments: services,
+          servicesWithoutTransactions,
           healthStatuses,
           alertCounts,
         }) ?? [],
diff --git a/x-pack/plugins/apm/server/routes/services/get_services/get_services_from_error_and_metric_documents.ts b/x-pack/plugins/apm/server/routes/services/get_services/get_services_without_transactions.ts
similarity index 77%
rename from x-pack/plugins/apm/server/routes/services/get_services/get_services_from_error_and_metric_documents.ts
rename to x-pack/plugins/apm/server/routes/services/get_services/get_services_without_transactions.ts
index 62830ace6a068..60d3bc0d7df18 100644
--- a/x-pack/plugins/apm/server/routes/services/get_services/get_services_from_error_and_metric_documents.ts
+++ b/x-pack/plugins/apm/server/routes/services/get_services/get_services_without_transactions.ts
@@ -18,8 +18,10 @@ import { serviceGroupQuery } from '../../../lib/service_group_query';
 import { ServiceGroup } from '../../../../common/service_groups';
 import { RandomSampler } from '../../../lib/helpers/get_random_sampler';
 import { APMEventClient } from '../../../lib/helpers/create_es_client/create_apm_event_client';
+import { ApmDocumentType } from '../../../../common/document_type';
+import { RollupInterval } from '../../../../common/rollup';
 
-export async function getServicesFromErrorAndMetricDocuments({
+export async function getServicesWithoutTransactions({
   environment,
   apmEventClient,
   maxNumServices,
@@ -28,6 +30,8 @@ export async function getServicesFromErrorAndMetricDocuments({
   end,
   serviceGroup,
   randomSampler,
+  documentType,
+  rollupInterval,
 }: {
   apmEventClient: APMEventClient;
   environment: string;
@@ -37,13 +41,29 @@ export async function getServicesFromErrorAndMetricDocuments({
   end: number;
   serviceGroup: ServiceGroup | null;
   randomSampler: RandomSampler;
+  documentType: ApmDocumentType;
+  rollupInterval: RollupInterval;
 }) {
+  const isServiceTransactionMetric =
+    documentType === ApmDocumentType.ServiceTransactionMetric;
+
   const response = await apmEventClient.search(
-    'get_services_from_error_and_metric_documents',
+    isServiceTransactionMetric
+      ? 'get_services_from_service_summary'
+      : 'get_services_from_error_and_metric_documents',
     {
-      apm: {
-        events: [ProcessorEvent.metric, ProcessorEvent.error],
-      },
+      apm: isServiceTransactionMetric
+        ? {
+            sources: [
+              {
+                documentType: ApmDocumentType.ServiceSummaryMetric,
+                rollupInterval,
+              },
+            ],
+          }
+        : {
+            events: [ProcessorEvent.metric, ProcessorEvent.error],
+          },
       body: {
         track_total_hits: false,
         size: 0,
diff --git a/x-pack/plugins/apm/server/routes/services/get_services/merge_service_stats.test.ts b/x-pack/plugins/apm/server/routes/services/get_services/merge_service_stats.test.ts
index d08e23ef4b49a..d06905d17bb18 100644
--- a/x-pack/plugins/apm/server/routes/services/get_services/merge_service_stats.test.ts
+++ b/x-pack/plugins/apm/server/routes/services/get_services/merge_service_stats.test.ts
@@ -40,7 +40,7 @@ describe('mergeServiceStats', () => {
             throughput: 4,
           }),
         ],
-        servicesFromErrorAndMetricDocuments: [
+        servicesWithoutTransactions: [
           {
             environments: ['production'],
             serviceName: 'opbeans-java',
@@ -93,7 +93,7 @@ describe('mergeServiceStats', () => {
             environments: ['staging'],
           }),
         ],
-        servicesFromErrorAndMetricDocuments: [
+        servicesWithoutTransactions: [
           {
             environments: ['production'],
             serviceName: 'opbeans-java',
@@ -142,7 +142,7 @@ describe('mergeServiceStats', () => {
             environments: ['staging'],
           }),
         ],
-        servicesFromErrorAndMetricDocuments: [],
+        servicesWithoutTransactions: [],
         healthStatuses: [
           {
             healthStatus: ServiceHealthStatus.healthy,
@@ -179,7 +179,7 @@ describe('mergeServiceStats', () => {
             environments: ['staging'],
           }),
         ],
-        servicesFromErrorAndMetricDocuments: [
+        servicesWithoutTransactions: [
           {
             environments: ['production'],
             serviceName: 'opbeans-java',
diff --git a/x-pack/plugins/apm/server/routes/services/get_services/merge_service_stats.ts b/x-pack/plugins/apm/server/routes/services/get_services/merge_service_stats.ts
index 10d22c730bf9d..a5c867b4f69dd 100644
--- a/x-pack/plugins/apm/server/routes/services/get_services/merge_service_stats.ts
+++ b/x-pack/plugins/apm/server/routes/services/get_services/merge_service_stats.ts
@@ -9,30 +9,29 @@ import { asMutableArray } from '../../../../common/utils/as_mutable_array';
 import { joinByKey } from '../../../../common/utils/join_by_key';
 import { getServicesAlerts } from './get_service_alerts';
 import { getHealthStatuses } from './get_health_statuses';
-import { getServicesFromErrorAndMetricDocuments } from './get_services_from_error_and_metric_documents';
+import { getServicesWithoutTransactions } from './get_services_without_transactions';
 import { getServiceTransactionStats } from './get_service_transaction_stats';
 
 export function mergeServiceStats({
   serviceStats,
-  servicesFromErrorAndMetricDocuments,
+  servicesWithoutTransactions,
   healthStatuses,
   alertCounts,
 }: {
   serviceStats: Awaited<
     ReturnType<typeof getServiceTransactionStats>
   >['serviceStats'];
-  servicesFromErrorAndMetricDocuments: Awaited<
-    ReturnType<typeof getServicesFromErrorAndMetricDocuments>
+  servicesWithoutTransactions: Awaited<
+    ReturnType<typeof getServicesWithoutTransactions>
   >['services'];
   healthStatuses: Awaited<ReturnType<typeof getHealthStatuses>>;
   alertCounts: Awaited<ReturnType<typeof getServicesAlerts>>;
 }) {
   const foundServiceNames = serviceStats.map(({ serviceName }) => serviceName);
 
-  const servicesWithOnlyMetricDocuments =
-    servicesFromErrorAndMetricDocuments.filter(
-      ({ serviceName }) => !foundServiceNames.includes(serviceName)
-    );
+  const servicesWithOnlyMetricDocuments = servicesWithoutTransactions.filter(
+    ({ serviceName }) => !foundServiceNames.includes(serviceName)
+  );
 
   const allServiceNames = foundServiceNames.concat(
     servicesWithOnlyMetricDocuments.map(({ serviceName }) => serviceName)
@@ -47,7 +46,7 @@ export function mergeServiceStats({
   return joinByKey(
     asMutableArray([
       ...serviceStats,
-      ...servicesFromErrorAndMetricDocuments,
+      ...servicesWithoutTransactions,
       ...matchedHealthStatuses,
       ...alertCounts,
     ] as const),
diff --git a/x-pack/plugins/apm/server/routes/services/get_services_detailed_statistics/get_service_transaction_detailed_statistics.ts b/x-pack/plugins/apm/server/routes/services/get_services_detailed_statistics/get_service_transaction_detailed_statistics.ts
index 0ba8bfb7da922..a410036d4c52e 100644
--- a/x-pack/plugins/apm/server/routes/services/get_services_detailed_statistics/get_service_transaction_detailed_statistics.ts
+++ b/x-pack/plugins/apm/server/routes/services/get_services_detailed_statistics/get_service_transaction_detailed_statistics.ts
@@ -7,7 +7,7 @@
 
 import { kqlQuery, rangeQuery } from '@kbn/observability-plugin/server';
 import { keyBy } from 'lodash';
-import { ApmDocumentType } from '../../../../common/document_type';
+import { ApmServiceTransactionDocumentType } from '../../../../common/document_type';
 import {
   SERVICE_NAME,
   TRANSACTION_TYPE,
@@ -19,7 +19,7 @@ import {
 } from '../../../../common/transaction_types';
 import { environmentQuery } from '../../../../common/utils/environment_query';
 import { getOffsetInMs } from '../../../../common/utils/get_offset_in_ms';
-import { calculateThroughputWithRange } from '../../../lib/helpers/calculate_throughput';
+import { calculateThroughputWithInterval } from '../../../lib/helpers/calculate_throughput';
 import { APMEventClient } from '../../../lib/helpers/create_es_client/create_apm_event_client';
 import { RandomSampler } from '../../../lib/helpers/get_random_sampler';
 import { getDurationFieldForTransactions } from '../../../lib/helpers/transactions';
@@ -46,7 +46,7 @@ export async function getServiceTransactionDetailedStats({
   environment: string;
   kuery: string;
   apmEventClient: APMEventClient;
-  documentType: ApmDocumentType;
+  documentType: ApmServiceTransactionDocumentType;
   rollupInterval: RollupInterval;
   bucketSizeInSeconds: number;
   offset?: string;
@@ -159,9 +159,8 @@ export async function getServiceTransactionDetailedStats({
         throughput: topTransactionTypeBucket.timeseries.buckets.map(
           (dateBucket) => ({
             x: dateBucket.key + offsetInMs,
-            y: calculateThroughputWithRange({
-              start,
-              end,
+            y: calculateThroughputWithInterval({
+              bucketSize: bucketSizeInSeconds,
               value: dateBucket.doc_count,
             }),
           })
@@ -189,7 +188,7 @@ export async function getServiceDetailedStatsPeriods({
   environment: string;
   kuery: string;
   apmEventClient: APMEventClient;
-  documentType: ApmDocumentType;
+  documentType: ApmServiceTransactionDocumentType;
   rollupInterval: RollupInterval;
   bucketSizeInSeconds: number;
   offset?: string;
diff --git a/x-pack/plugins/apm/server/routes/services/get_services_detailed_statistics/index.ts b/x-pack/plugins/apm/server/routes/services/get_services_detailed_statistics/index.ts
index faa12d1defe1f..932d727ee6987 100644
--- a/x-pack/plugins/apm/server/routes/services/get_services_detailed_statistics/index.ts
+++ b/x-pack/plugins/apm/server/routes/services/get_services_detailed_statistics/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { ApmDocumentType } from '../../../../common/document_type';
+import { ApmServiceTransactionDocumentType } from '../../../../common/document_type';
 import { RollupInterval } from '../../../../common/rollup';
 import { APMEventClient } from '../../../lib/helpers/create_es_client/create_apm_event_client';
 import { RandomSampler } from '../../../lib/helpers/get_random_sampler';
@@ -28,7 +28,7 @@ export async function getServicesDetailedStatistics({
   environment: string;
   kuery: string;
   apmEventClient: APMEventClient;
-  documentType: ApmDocumentType;
+  documentType: ApmServiceTransactionDocumentType;
   rollupInterval: RollupInterval;
   bucketSizeInSeconds: number;
   offset?: string;
diff --git a/x-pack/plugins/apm/server/routes/services/route.ts b/x-pack/plugins/apm/server/routes/services/route.ts
index 6fbc7744368db..d8647bf981e34 100644
--- a/x-pack/plugins/apm/server/routes/services/route.ts
+++ b/x-pack/plugins/apm/server/routes/services/route.ts
@@ -32,7 +32,7 @@ import { getSearchTransactionsEvents } from '../../lib/helpers/transactions';
 import { withApmSpan } from '../../utils/with_apm_span';
 import { createApmServerRoute } from '../apm_routes/create_apm_server_route';
 import {
-  dataSourceRt,
+  serviceTransactionDataSourceRt,
   environmentRt,
   kueryRt,
   probabilityRt,
@@ -64,7 +64,7 @@ const servicesRoute = createApmServerRoute({
       t.partial({ serviceGroup: t.string }),
       t.intersection([
         probabilityRt,
-        dataSourceRt,
+        serviceTransactionDataSourceRt,
         environmentRt,
         kueryRt,
         rangeRt,
@@ -179,7 +179,7 @@ const servicesDetailedStatisticsRoute = createApmServerRoute({
       environmentRt,
       kueryRt,
       rangeRt,
-      t.intersection([offsetRt, probabilityRt, dataSourceRt]),
+      t.intersection([offsetRt, probabilityRt, serviceTransactionDataSourceRt]),
       t.type({
         bucketSizeInSeconds: toNumberRt,
       }),
diff --git a/x-pack/plugins/apm/server/routes/time_range_metadata/route.ts b/x-pack/plugins/apm/server/routes/time_range_metadata/route.ts
index 66cbebe5ec218..eaff14fd7c647 100644
--- a/x-pack/plugins/apm/server/routes/time_range_metadata/route.ts
+++ b/x-pack/plugins/apm/server/routes/time_range_metadata/route.ts
@@ -17,7 +17,11 @@ export const timeRangeMetadataRoute = createApmServerRoute({
   endpoint: 'GET /internal/apm/time_range_metadata',
   params: t.type({
     query: t.intersection([
-      t.type({ useSpanName: toBooleanRt }),
+      t.type({
+        useSpanName: toBooleanRt,
+        enableServiceTransactionMetrics: toBooleanRt,
+        enableContinuousRollups: toBooleanRt,
+      }),
       kueryRt,
       rangeRt,
     ]),
@@ -29,7 +33,14 @@ export const timeRangeMetadataRoute = createApmServerRoute({
     const apmEventClient = await getApmEventClient(resources);
 
     const {
-      query: { useSpanName, start, end, kuery },
+      query: {
+        useSpanName,
+        start,
+        end,
+        kuery,
+        enableServiceTransactionMetrics,
+        enableContinuousRollups,
+      },
     } = resources.params;
 
     const [isUsingServiceDestinationMetrics, sources] = await Promise.all([
@@ -45,6 +56,8 @@ export const timeRangeMetadataRoute = createApmServerRoute({
         start,
         end,
         kuery,
+        enableServiceTransactionMetrics,
+        enableContinuousRollups,
       }),
     ]);
 
diff --git a/x-pack/plugins/observability/common/index.ts b/x-pack/plugins/observability/common/index.ts
index 0d3c846d3a314..c82d4fbe6faed 100644
--- a/x-pack/plugins/observability/common/index.ts
+++ b/x-pack/plugins/observability/common/index.ts
@@ -27,6 +27,8 @@ export {
   enableAgentExplorerView,
   apmAWSLambdaPriceFactor,
   apmAWSLambdaRequestCostPerMillion,
+  apmEnableServiceMetrics,
+  apmEnableContinuousRollups,
   enableCriticalPath,
   profilingElasticsearchPlugin,
 } from './ui_settings_keys';
diff --git a/x-pack/plugins/observability/common/ui_settings_keys.ts b/x-pack/plugins/observability/common/ui_settings_keys.ts
index b4ddb17b7e9da..80f94c34a647a 100644
--- a/x-pack/plugins/observability/common/ui_settings_keys.ts
+++ b/x-pack/plugins/observability/common/ui_settings_keys.ts
@@ -22,4 +22,6 @@ export const enableAgentExplorerView = 'observability:apmAgentExplorerView';
 export const apmAWSLambdaPriceFactor = 'observability:apmAWSLambdaPriceFactor';
 export const apmAWSLambdaRequestCostPerMillion = 'observability:apmAWSLambdaRequestCostPerMillion';
 export const enableCriticalPath = 'observability:apmEnableCriticalPath';
+export const apmEnableServiceMetrics = 'observability:apmEnableServiceMetrics';
+export const apmEnableContinuousRollups = 'observability:apmEnableContinuousRollups';
 export const profilingElasticsearchPlugin = 'observability:profilingElasticsearchPlugin';
diff --git a/x-pack/plugins/observability/common/utils/get_inspect_response.ts b/x-pack/plugins/observability/common/utils/get_inspect_response.ts
index 6af29c16d0457..7c5d8368bd192 100644
--- a/x-pack/plugins/observability/common/utils/get_inspect_response.ts
+++ b/x-pack/plugins/observability/common/utils/get_inspect_response.ts
@@ -150,7 +150,7 @@ export function getInspectResponse({
 
   return {
     id,
-    json: esRequestParams.body,
+    json: esRequestParams.body ?? esRequestParams,
     name: id,
     response: {
       json: esError ? esError.originalError : esResponse,
diff --git a/x-pack/plugins/observability/server/ui_settings.ts b/x-pack/plugins/observability/server/ui_settings.ts
index 26a2ea3e8cc2c..3d1198dbe9aa5 100644
--- a/x-pack/plugins/observability/server/ui_settings.ts
+++ b/x-pack/plugins/observability/server/ui_settings.ts
@@ -23,11 +23,17 @@ import {
   enableAwsLambdaMetrics,
   apmAWSLambdaPriceFactor,
   apmAWSLambdaRequestCostPerMillion,
+  apmEnableServiceMetrics,
+  apmEnableContinuousRollups,
   enableCriticalPath,
   enableInfrastructureHostsView,
   profilingElasticsearchPlugin,
 } from '../common/ui_settings_keys';
 
+const betaLabel = i18n.translate('xpack.observability.uiSettings.betaLabel', {
+  defaultMessage: 'beta',
+});
+
 const technicalPreviewLabel = i18n.translate(
   'xpack.observability.uiSettings.technicalPreviewLabel',
   { defaultMessage: 'technical preview' }
@@ -287,6 +293,34 @@ export const uiSettings: Record<string, UiSettings> = {
     value: 0.2,
     schema: schema.number({ min: 0 }),
   },
+  [apmEnableServiceMetrics]: {
+    category: [observabilityFeatureId],
+    name: i18n.translate('xpack.observability.apmEnableServiceMetrics', {
+      defaultMessage: 'Service transaction metrics',
+    }),
+    value: true,
+    description: i18n.translate('xpack.observability.apmEnableServiceMetricsDescription', {
+      defaultMessage:
+        '{betaLabel} Enables the usage of service transaction metrics, which are low cardinality metrics that can be used by certain views like the service inventory for faster loading times.',
+      values: { betaLabel: `<em>[${betaLabel}]</em>` },
+    }),
+    schema: schema.boolean(),
+    requiresPageReload: true,
+  },
+  [apmEnableContinuousRollups]: {
+    category: [observabilityFeatureId],
+    name: i18n.translate('xpack.observability.apmEnableContinuousRollups', {
+      defaultMessage: 'Continuous rollups',
+    }),
+    value: true,
+    description: i18n.translate('xpack.observability.apmEnableContinuousRollupsDescription', {
+      defaultMessage:
+        '{betaLabel} When continuous rollups is enabled, the UI will select metrics with the appropriate resolution. On larger time ranges, lower resolution metrics will be used, which will improve loading times.',
+      values: { betaLabel: `<em>[${betaLabel}]</em>` },
+    }),
+    schema: schema.boolean(),
+    requiresPageReload: true,
+  },
   [enableCriticalPath]: {
     category: [observabilityFeatureId],
     name: i18n.translate('xpack.observability.enableCriticalPath', {
diff --git a/x-pack/test/apm_api_integration/tests/services/archive_services_detailed_statistics.spec.ts b/x-pack/test/apm_api_integration/tests/services/archive_services_detailed_statistics.spec.ts
new file mode 100644
index 0000000000000..92553c9f3e076
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/services/archive_services_detailed_statistics.spec.ts
@@ -0,0 +1,298 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import expect from '@kbn/expect';
+import moment from 'moment';
+import { APIReturnType } from '@kbn/apm-plugin/public/services/rest/create_call_apm_api';
+import { isFiniteNumber } from '@kbn/apm-plugin/common/utils/is_finite_number';
+import { ApmDocumentType } from '@kbn/apm-plugin/common/document_type';
+import { RollupInterval } from '@kbn/apm-plugin/common/rollup';
+import archives_metadata from '../../common/fixtures/es_archiver/archives_metadata';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+import { ApmApiError } from '../../common/apm_api_supertest';
+
+type ServicesDetailedStatisticsReturn =
+  APIReturnType<'POST /internal/apm/services/detailed_statistics'>;
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const registry = getService('registry');
+
+  const apmApiClient = getService('apmApiClient');
+
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+  const { start, end } = metadata;
+  const serviceNames = ['opbeans-java', 'opbeans-go'];
+
+  registry.when(
+    'Services detailed statistics when data is not loaded',
+    { config: 'basic', archives: [] },
+    () => {
+      it('handles the empty state', async () => {
+        const response = await apmApiClient.readUser({
+          endpoint: `POST /internal/apm/services/detailed_statistics`,
+          params: {
+            query: {
+              start,
+              end,
+              environment: 'ENVIRONMENT_ALL',
+              kuery: '',
+              offset: '1d',
+              probability: 1,
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              bucketSizeInSeconds: 60,
+            },
+            body: {
+              serviceNames: JSON.stringify(serviceNames),
+            },
+          },
+        });
+
+        expect(response.status).to.be(200);
+        expect(response.body.currentPeriod).to.be.empty();
+        expect(response.body.previousPeriod).to.be.empty();
+      });
+    }
+  );
+
+  registry.when(
+    'Services detailed statistics when data is loaded',
+    { config: 'basic', archives: [archiveName] },
+    () => {
+      let servicesDetailedStatistics: ServicesDetailedStatisticsReturn;
+      before(async () => {
+        const response = await apmApiClient.readUser({
+          endpoint: `POST /internal/apm/services/detailed_statistics`,
+          params: {
+            query: {
+              start,
+              end,
+              environment: 'ENVIRONMENT_ALL',
+              kuery: '',
+              probability: 1,
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              bucketSizeInSeconds: 60,
+              _inspect: true,
+            },
+            body: {
+              serviceNames: JSON.stringify(serviceNames),
+            },
+          },
+        });
+
+        expect(response.status).to.be(200);
+        servicesDetailedStatistics = response.body;
+      });
+
+      it('returns current period data', async () => {
+        expect(servicesDetailedStatistics.currentPeriod).not.to.be.empty();
+      });
+
+      it("doesn't returns previous period data", async () => {
+        expect(servicesDetailedStatistics.previousPeriod).to.be.empty();
+      });
+
+      it('returns current data for requested service names', () => {
+        serviceNames.forEach((serviceName) => {
+          expect(servicesDetailedStatistics.currentPeriod[serviceName]).not.to.be.empty();
+        });
+      });
+      it('returns correct statistics', () => {
+        const statistics = servicesDetailedStatistics.currentPeriod[serviceNames[0]];
+
+        expect(statistics.latency.length).to.be.greaterThan(0);
+        expect(statistics.throughput.length).to.be.greaterThan(0);
+        expect(statistics.transactionErrorRate.length).to.be.greaterThan(0);
+
+        // latency
+        const nonNullLantencyDataPoints = statistics.latency.filter(({ y }) => isFiniteNumber(y));
+        expect(nonNullLantencyDataPoints.length).to.be.greaterThan(0);
+
+        // throughput
+        const nonNullThroughputDataPoints = statistics.throughput.filter(({ y }) =>
+          isFiniteNumber(y)
+        );
+        expect(nonNullThroughputDataPoints.length).to.be.greaterThan(0);
+
+        // transaction erro rate
+        const nonNullTransactionErrorRateDataPoints = statistics.transactionErrorRate.filter(
+          ({ y }) => isFiniteNumber(y)
+        );
+        expect(nonNullTransactionErrorRateDataPoints.length).to.be.greaterThan(0);
+      });
+
+      it('returns empty when empty service names is passed', async () => {
+        try {
+          await apmApiClient.readUser({
+            endpoint: `POST /internal/apm/services/detailed_statistics`,
+            params: {
+              query: {
+                start,
+                end,
+                environment: 'ENVIRONMENT_ALL',
+                kuery: '',
+                probability: 1,
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.OneMinute,
+                bucketSizeInSeconds: 60,
+              },
+              body: {
+                serviceNames: JSON.stringify([]),
+              },
+            },
+          });
+          expect().fail('Expected API call to throw an error');
+        } catch (error: unknown) {
+          const apiError = error as ApmApiError;
+          expect(apiError.res.status).eql(400);
+
+          expect(apiError.res.body.message).eql('serviceNames cannot be empty');
+        }
+      });
+
+      it('filters by environment', async () => {
+        const response = await apmApiClient.readUser({
+          endpoint: `POST /internal/apm/services/detailed_statistics`,
+          params: {
+            query: {
+              start,
+              end,
+              environment: 'production',
+              kuery: '',
+              probability: 1,
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              bucketSizeInSeconds: 60,
+            },
+            body: {
+              serviceNames: JSON.stringify(serviceNames),
+            },
+          },
+        });
+        expect(response.status).to.be(200);
+        expect(Object.keys(response.body.currentPeriod).length).to.be(1);
+        expect(response.body.currentPeriod['opbeans-java']).not.to.be.empty();
+      });
+      it('filters by kuery', async () => {
+        const response = await apmApiClient.readUser({
+          endpoint: `POST /internal/apm/services/detailed_statistics`,
+          params: {
+            query: {
+              start,
+              end,
+              environment: 'ENVIRONMENT_ALL',
+              kuery: 'transaction.type : "invalid_transaction_type"',
+              probability: 1,
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              bucketSizeInSeconds: 60,
+            },
+            body: {
+              serviceNames: JSON.stringify(serviceNames),
+            },
+          },
+        });
+        expect(response.status).to.be(200);
+        expect(Object.keys(response.body.currentPeriod)).to.be.empty();
+      });
+    }
+  );
+
+  registry.when(
+    'Services detailed statistics with time comparison',
+    { config: 'basic', archives: [archiveName] },
+    () => {
+      let servicesDetailedStatistics: ServicesDetailedStatisticsReturn;
+      before(async () => {
+        const response = await apmApiClient.readUser({
+          endpoint: `POST /internal/apm/services/detailed_statistics`,
+          params: {
+            query: {
+              start: moment(end).subtract(15, 'minutes').toISOString(),
+              end,
+              offset: '15m',
+              environment: 'ENVIRONMENT_ALL',
+              kuery: '',
+              probability: 1,
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              bucketSizeInSeconds: 60,
+            },
+            body: {
+              serviceNames: JSON.stringify(serviceNames),
+            },
+          },
+        });
+
+        expect(response.status).to.be(200);
+        servicesDetailedStatistics = response.body;
+      });
+      it('returns current period data', async () => {
+        expect(servicesDetailedStatistics.currentPeriod).not.to.be.empty();
+      });
+      it('returns previous period data', async () => {
+        expect(servicesDetailedStatistics.previousPeriod).not.to.be.empty();
+      });
+      it('returns current data for requested service names', () => {
+        serviceNames.forEach((serviceName) => {
+          expect(servicesDetailedStatistics.currentPeriod[serviceName]).not.to.be.empty();
+        });
+      });
+      it('returns previous data for requested service names', () => {
+        serviceNames.forEach((serviceName) => {
+          expect(servicesDetailedStatistics.currentPeriod[serviceName]).not.to.be.empty();
+        });
+      });
+      it('returns correct statistics', () => {
+        const currentPeriodStatistics = servicesDetailedStatistics.currentPeriod[serviceNames[0]];
+        const previousPeriodStatistics = servicesDetailedStatistics.previousPeriod[serviceNames[0]];
+
+        expect(currentPeriodStatistics.latency.length).to.be.greaterThan(0);
+        expect(currentPeriodStatistics.throughput.length).to.be.greaterThan(0);
+        expect(currentPeriodStatistics.transactionErrorRate.length).to.be.greaterThan(0);
+
+        // latency
+        const nonNullCurrentPeriodLantencyDataPoints = currentPeriodStatistics.latency.filter(
+          ({ y }) => isFiniteNumber(y)
+        );
+        expect(nonNullCurrentPeriodLantencyDataPoints.length).to.be.greaterThan(0);
+
+        // throughput
+        const nonNullCurrentPeriodThroughputDataPoints = currentPeriodStatistics.throughput.filter(
+          ({ y }) => isFiniteNumber(y)
+        );
+        expect(nonNullCurrentPeriodThroughputDataPoints.length).to.be.greaterThan(0);
+
+        // transaction erro rate
+        const nonNullCurrentPeriodTransactionErrorRateDataPoints =
+          currentPeriodStatistics.transactionErrorRate.filter(({ y }) => isFiniteNumber(y));
+        expect(nonNullCurrentPeriodTransactionErrorRateDataPoints.length).to.be.greaterThan(0);
+
+        expect(previousPeriodStatistics.latency.length).to.be.greaterThan(0);
+        expect(previousPeriodStatistics.throughput.length).to.be.greaterThan(0);
+        expect(previousPeriodStatistics.transactionErrorRate.length).to.be.greaterThan(0);
+
+        // latency
+        const nonNullPreviousPeriodLantencyDataPoints = previousPeriodStatistics.latency.filter(
+          ({ y }) => isFiniteNumber(y)
+        );
+        expect(nonNullPreviousPeriodLantencyDataPoints.length).to.be.greaterThan(0);
+
+        // throughput
+        const nonNullPreviousPeriodThroughputDataPoints =
+          previousPeriodStatistics.throughput.filter(({ y }) => isFiniteNumber(y));
+        expect(nonNullPreviousPeriodThroughputDataPoints.length).to.be.greaterThan(0);
+
+        // transaction erro rate
+        const nonNullPreviousPeriodTransactionErrorRateDataPoints =
+          previousPeriodStatistics.transactionErrorRate.filter(({ y }) => isFiniteNumber(y));
+        expect(nonNullPreviousPeriodTransactionErrorRateDataPoints.length).to.be.greaterThan(0);
+      });
+    }
+  );
+}
diff --git a/x-pack/test/apm_api_integration/tests/services/services_detailed_statistics.spec.ts b/x-pack/test/apm_api_integration/tests/services/services_detailed_statistics.spec.ts
index 92553c9f3e076..782434a7c6aa5 100644
--- a/x-pack/test/apm_api_integration/tests/services/services_detailed_statistics.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/services/services_detailed_statistics.spec.ts
@@ -5,14 +5,15 @@
  * 2.0.
  */
 import expect from '@kbn/expect';
-import moment from 'moment';
-import { APIReturnType } from '@kbn/apm-plugin/public/services/rest/create_call_apm_api';
-import { isFiniteNumber } from '@kbn/apm-plugin/common/utils/is_finite_number';
+import {
+  APIClientRequestParamsOf,
+  APIReturnType,
+} from '@kbn/apm-plugin/public/services/rest/create_call_apm_api';
 import { ApmDocumentType } from '@kbn/apm-plugin/common/document_type';
 import { RollupInterval } from '@kbn/apm-plugin/common/rollup';
-import archives_metadata from '../../common/fixtures/es_archiver/archives_metadata';
+import { apm, timerange } from '@kbn/apm-synthtrace-client';
+import { uniq, map } from 'lodash';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
-import { ApmApiError } from '../../common/apm_api_supertest';
 
 type ServicesDetailedStatisticsReturn =
   APIReturnType<'POST /internal/apm/services/detailed_statistics'>;
@@ -22,13 +23,15 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
   const apmApiClient = getService('apmApiClient');
 
-  const archiveName = 'apm_8.0.0';
-  const metadata = archives_metadata[archiveName];
-  const { start, end } = metadata;
-  const serviceNames = ['opbeans-java', 'opbeans-go'];
+  const synthtrace = getService('synthtraceEsClient');
+
+  const start = '2021-01-01T00:00:00.000Z';
+  const end = '2021-01-01T00:59:59.999Z';
+
+  const serviceNames = ['my-service'];
 
   registry.when(
-    'Services detailed statistics when data is not loaded',
+    'Services detailed statistics when data is generated',
     { config: 'basic', archives: [] },
     () => {
       it('handles the empty state', async () => {
@@ -40,11 +43,11 @@ export default function ApiTest({ getService }: FtrProviderContext) {
               end,
               environment: 'ENVIRONMENT_ALL',
               kuery: '',
-              offset: '1d',
               probability: 1,
               documentType: ApmDocumentType.TransactionMetric,
               rollupInterval: RollupInterval.OneMinute,
               bucketSizeInSeconds: 60,
+              _inspect: true,
             },
             body: {
               serviceNames: JSON.stringify(serviceNames),
@@ -59,239 +62,126 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     }
   );
 
+  async function getStats(
+    overrides?: Partial<
+      APIClientRequestParamsOf<'POST /internal/apm/services/detailed_statistics'>['params']['query']
+    >
+  ) {
+    const response = await apmApiClient.readUser({
+      endpoint: `POST /internal/apm/services/detailed_statistics`,
+      params: {
+        query: {
+          start,
+          end,
+          environment: 'ENVIRONMENT_ALL',
+          kuery: '',
+          probability: 1,
+          documentType: ApmDocumentType.TransactionMetric,
+          rollupInterval: RollupInterval.OneMinute,
+          bucketSizeInSeconds: 60,
+          ...overrides,
+        },
+        body: {
+          serviceNames: JSON.stringify(serviceNames),
+        },
+      },
+    });
+
+    return response.body;
+  }
+
   registry.when(
-    'Services detailed statistics when data is loaded',
-    { config: 'basic', archives: [archiveName] },
+    'Services detailed statistics when data is generated',
+    { config: 'basic', archives: [] },
     () => {
       let servicesDetailedStatistics: ServicesDetailedStatisticsReturn;
-      before(async () => {
-        const response = await apmApiClient.readUser({
-          endpoint: `POST /internal/apm/services/detailed_statistics`,
-          params: {
-            query: {
-              start,
-              end,
-              environment: 'ENVIRONMENT_ALL',
-              kuery: '',
-              probability: 1,
-              documentType: ApmDocumentType.TransactionMetric,
-              rollupInterval: RollupInterval.OneMinute,
-              bucketSizeInSeconds: 60,
-              _inspect: true,
-            },
-            body: {
-              serviceNames: JSON.stringify(serviceNames),
-            },
-          },
-        });
 
-        expect(response.status).to.be(200);
-        servicesDetailedStatistics = response.body;
-      });
+      const instance = apm.service('my-service', 'production', 'java').instance('instance');
 
-      it('returns current period data', async () => {
-        expect(servicesDetailedStatistics.currentPeriod).not.to.be.empty();
-      });
+      const EXPECTED_TPM = 5;
+      const EXPECTED_LATENCY = 1000;
+      const EXPECTED_FAILURE_RATE = 0.25;
 
-      it("doesn't returns previous period data", async () => {
-        expect(servicesDetailedStatistics.previousPeriod).to.be.empty();
-      });
+      before(async () => {
+        const interval = timerange(new Date(start).getTime(), new Date(end).getTime() - 1).interval(
+          '1m'
+        );
 
-      it('returns current data for requested service names', () => {
-        serviceNames.forEach((serviceName) => {
-          expect(servicesDetailedStatistics.currentPeriod[serviceName]).not.to.be.empty();
-        });
+        await synthtrace.index([
+          interval.rate(3).generator((timestamp) => {
+            return instance
+              .transaction('GET /api')
+              .duration(EXPECTED_LATENCY)
+              .outcome('success')
+              .timestamp(timestamp);
+          }),
+          interval.rate(1).generator((timestamp) => {
+            return instance
+              .transaction('GET /api')
+              .duration(EXPECTED_LATENCY)
+              .outcome('failure')
+              .timestamp(timestamp);
+          }),
+          interval.rate(1).generator((timestamp) => {
+            return instance
+              .transaction('GET /api')
+              .duration(EXPECTED_LATENCY)
+              .outcome('unknown')
+              .timestamp(timestamp);
+          }),
+        ]);
       });
-      it('returns correct statistics', () => {
-        const statistics = servicesDetailedStatistics.currentPeriod[serviceNames[0]];
 
-        expect(statistics.latency.length).to.be.greaterThan(0);
-        expect(statistics.throughput.length).to.be.greaterThan(0);
-        expect(statistics.transactionErrorRate.length).to.be.greaterThan(0);
+      after(() => synthtrace.clean());
 
-        // latency
-        const nonNullLantencyDataPoints = statistics.latency.filter(({ y }) => isFiniteNumber(y));
-        expect(nonNullLantencyDataPoints.length).to.be.greaterThan(0);
+      function checkStats() {
+        const stats = servicesDetailedStatistics.currentPeriod['my-service'];
 
-        // throughput
-        const nonNullThroughputDataPoints = statistics.throughput.filter(({ y }) =>
-          isFiniteNumber(y)
-        );
-        expect(nonNullThroughputDataPoints.length).to.be.greaterThan(0);
+        expect(stats).not.empty();
 
-        // transaction erro rate
-        const nonNullTransactionErrorRateDataPoints = statistics.transactionErrorRate.filter(
-          ({ y }) => isFiniteNumber(y)
-        );
-        expect(nonNullTransactionErrorRateDataPoints.length).to.be.greaterThan(0);
-      });
+        expect(uniq(map(stats.throughput, 'y'))).eql([EXPECTED_TPM], 'tpm');
 
-      it('returns empty when empty service names is passed', async () => {
-        try {
-          await apmApiClient.readUser({
-            endpoint: `POST /internal/apm/services/detailed_statistics`,
-            params: {
-              query: {
-                start,
-                end,
-                environment: 'ENVIRONMENT_ALL',
-                kuery: '',
-                probability: 1,
-                documentType: ApmDocumentType.TransactionMetric,
-                rollupInterval: RollupInterval.OneMinute,
-                bucketSizeInSeconds: 60,
-              },
-              body: {
-                serviceNames: JSON.stringify([]),
-              },
-            },
-          });
-          expect().fail('Expected API call to throw an error');
-        } catch (error: unknown) {
-          const apiError = error as ApmApiError;
-          expect(apiError.res.status).eql(400);
+        expect(uniq(map(stats.latency, 'y'))).eql([EXPECTED_LATENCY * 1000], 'latency');
 
-          expect(apiError.res.body.message).eql('serviceNames cannot be empty');
-        }
-      });
+        expect(uniq(map(stats.transactionErrorRate, 'y'))).eql(
+          [EXPECTED_FAILURE_RATE],
+          'errorRate'
+        );
+      }
 
-      it('filters by environment', async () => {
-        const response = await apmApiClient.readUser({
-          endpoint: `POST /internal/apm/services/detailed_statistics`,
-          params: {
-            query: {
-              start,
-              end,
-              environment: 'production',
-              kuery: '',
-              probability: 1,
-              documentType: ApmDocumentType.TransactionMetric,
-              rollupInterval: RollupInterval.OneMinute,
-              bucketSizeInSeconds: 60,
-            },
-            body: {
-              serviceNames: JSON.stringify(serviceNames),
-            },
-          },
+      describe('and transaction metrics are used', () => {
+        before(async () => {
+          servicesDetailedStatistics = await getStats();
         });
-        expect(response.status).to.be(200);
-        expect(Object.keys(response.body.currentPeriod).length).to.be(1);
-        expect(response.body.currentPeriod['opbeans-java']).not.to.be.empty();
-      });
-      it('filters by kuery', async () => {
-        const response = await apmApiClient.readUser({
-          endpoint: `POST /internal/apm/services/detailed_statistics`,
-          params: {
-            query: {
-              start,
-              end,
-              environment: 'ENVIRONMENT_ALL',
-              kuery: 'transaction.type : "invalid_transaction_type"',
-              probability: 1,
-              documentType: ApmDocumentType.TransactionMetric,
-              rollupInterval: RollupInterval.OneMinute,
-              bucketSizeInSeconds: 60,
-            },
-            body: {
-              serviceNames: JSON.stringify(serviceNames),
-            },
-          },
+
+        it('returns the expected statistics', () => {
+          checkStats();
         });
-        expect(response.status).to.be(200);
-        expect(Object.keys(response.body.currentPeriod)).to.be.empty();
       });
-    }
-  );
 
-  registry.when(
-    'Services detailed statistics with time comparison',
-    { config: 'basic', archives: [archiveName] },
-    () => {
-      let servicesDetailedStatistics: ServicesDetailedStatisticsReturn;
-      before(async () => {
-        const response = await apmApiClient.readUser({
-          endpoint: `POST /internal/apm/services/detailed_statistics`,
-          params: {
-            query: {
-              start: moment(end).subtract(15, 'minutes').toISOString(),
-              end,
-              offset: '15m',
-              environment: 'ENVIRONMENT_ALL',
-              kuery: '',
-              probability: 1,
-              documentType: ApmDocumentType.TransactionMetric,
-              rollupInterval: RollupInterval.OneMinute,
-              bucketSizeInSeconds: 60,
-            },
-            body: {
-              serviceNames: JSON.stringify(serviceNames),
-            },
-          },
+      describe('and service transaction metrics are used', () => {
+        before(async () => {
+          servicesDetailedStatistics = await getStats({
+            documentType: ApmDocumentType.ServiceTransactionMetric,
+          });
         });
 
-        expect(response.status).to.be(200);
-        servicesDetailedStatistics = response.body;
-      });
-      it('returns current period data', async () => {
-        expect(servicesDetailedStatistics.currentPeriod).not.to.be.empty();
-      });
-      it('returns previous period data', async () => {
-        expect(servicesDetailedStatistics.previousPeriod).not.to.be.empty();
-      });
-      it('returns current data for requested service names', () => {
-        serviceNames.forEach((serviceName) => {
-          expect(servicesDetailedStatistics.currentPeriod[serviceName]).not.to.be.empty();
+        it('returns the expected statistics', () => {
+          checkStats();
         });
       });
-      it('returns previous data for requested service names', () => {
-        serviceNames.forEach((serviceName) => {
-          expect(servicesDetailedStatistics.currentPeriod[serviceName]).not.to.be.empty();
-        });
-      });
-      it('returns correct statistics', () => {
-        const currentPeriodStatistics = servicesDetailedStatistics.currentPeriod[serviceNames[0]];
-        const previousPeriodStatistics = servicesDetailedStatistics.previousPeriod[serviceNames[0]];
-
-        expect(currentPeriodStatistics.latency.length).to.be.greaterThan(0);
-        expect(currentPeriodStatistics.throughput.length).to.be.greaterThan(0);
-        expect(currentPeriodStatistics.transactionErrorRate.length).to.be.greaterThan(0);
-
-        // latency
-        const nonNullCurrentPeriodLantencyDataPoints = currentPeriodStatistics.latency.filter(
-          ({ y }) => isFiniteNumber(y)
-        );
-        expect(nonNullCurrentPeriodLantencyDataPoints.length).to.be.greaterThan(0);
-
-        // throughput
-        const nonNullCurrentPeriodThroughputDataPoints = currentPeriodStatistics.throughput.filter(
-          ({ y }) => isFiniteNumber(y)
-        );
-        expect(nonNullCurrentPeriodThroughputDataPoints.length).to.be.greaterThan(0);
 
-        // transaction erro rate
-        const nonNullCurrentPeriodTransactionErrorRateDataPoints =
-          currentPeriodStatistics.transactionErrorRate.filter(({ y }) => isFiniteNumber(y));
-        expect(nonNullCurrentPeriodTransactionErrorRateDataPoints.length).to.be.greaterThan(0);
-
-        expect(previousPeriodStatistics.latency.length).to.be.greaterThan(0);
-        expect(previousPeriodStatistics.throughput.length).to.be.greaterThan(0);
-        expect(previousPeriodStatistics.transactionErrorRate.length).to.be.greaterThan(0);
-
-        // latency
-        const nonNullPreviousPeriodLantencyDataPoints = previousPeriodStatistics.latency.filter(
-          ({ y }) => isFiniteNumber(y)
-        );
-        expect(nonNullPreviousPeriodLantencyDataPoints.length).to.be.greaterThan(0);
-
-        // throughput
-        const nonNullPreviousPeriodThroughputDataPoints =
-          previousPeriodStatistics.throughput.filter(({ y }) => isFiniteNumber(y));
-        expect(nonNullPreviousPeriodThroughputDataPoints.length).to.be.greaterThan(0);
+      describe('and rolled up data is used', () => {
+        before(async () => {
+          servicesDetailedStatistics = await getStats({
+            rollupInterval: RollupInterval.TenMinutes,
+            bucketSizeInSeconds: 600,
+          });
+        });
 
-        // transaction erro rate
-        const nonNullPreviousPeriodTransactionErrorRateDataPoints =
-          previousPeriodStatistics.transactionErrorRate.filter(({ y }) => isFiniteNumber(y));
-        expect(nonNullPreviousPeriodTransactionErrorRateDataPoints.length).to.be.greaterThan(0);
+        it('returns the expected statistics', () => {
+          checkStats();
+        });
       });
     }
   );
diff --git a/x-pack/test/apm_api_integration/tests/services/top_services.spec.ts b/x-pack/test/apm_api_integration/tests/services/top_services.spec.ts
index cbaada163857e..91534921de4d5 100644
--- a/x-pack/test/apm_api_integration/tests/services/top_services.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/services/top_services.spec.ts
@@ -31,7 +31,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const archiveEnd = archiveRange.end;
 
   const start = '2021-10-01T00:00:00.000Z';
-  const end = '2021-10-01T00:05:00.000Z';
+  const end = '2021-10-01T01:00:00.000Z';
 
   registry.when(
     'APM Services Overview with a basic license when data is not generated',
@@ -105,6 +105,29 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         },
       };
 
+      function checkStats() {
+        const multipleEnvService = response.body.items.find(
+          (item) => item.serviceName === 'multiple-env-service'
+        );
+
+        const totalRps = config.multiple.prod.rps + config.multiple.dev.rps;
+
+        expect(multipleEnvService).to.eql({
+          serviceName: 'multiple-env-service',
+          transactionType: 'request',
+          environments: ['production', 'development'],
+          agentName: 'go',
+          latency:
+            1000 *
+            ((config.multiple.prod.duration * config.multiple.prod.rps +
+              config.multiple.dev.duration * config.multiple.dev.rps) /
+              totalRps),
+          throughput: totalRps * 60,
+          transactionErrorRate:
+            config.multiple.dev.rps / (config.multiple.prod.rps + config.multiple.dev.rps),
+        });
+      }
+
       before(async () => {
         return synthtrace.index([
           transactionInterval
@@ -179,26 +202,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         });
 
         it('returns the correct statistics', () => {
-          const multipleEnvService = response.body.items.find(
-            (item) => item.serviceName === 'multiple-env-service'
-          );
-
-          const totalRps = config.multiple.prod.rps + config.multiple.dev.rps;
-
-          expect(multipleEnvService).to.eql({
-            serviceName: 'multiple-env-service',
-            transactionType: 'request',
-            environments: ['production', 'development'],
-            agentName: 'go',
-            latency:
-              1000 *
-              ((config.multiple.prod.duration * config.multiple.prod.rps +
-                config.multiple.dev.duration * config.multiple.dev.rps) /
-                totalRps),
-            throughput: totalRps * 60,
-            transactionErrorRate:
-              config.multiple.dev.rps / (config.multiple.prod.rps + config.multiple.dev.rps),
-          });
+          checkStats();
         });
 
         it('returns services without transaction data', () => {
@@ -310,6 +314,60 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           expect(multipleEnvService?.transactionType).to.eql('rpc');
         });
       });
+
+      describe('when using service transaction metrics', () => {
+        before(async () => {
+          response = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/services',
+            params: {
+              query: {
+                start,
+                end,
+                environment: ENVIRONMENT_ALL.value,
+                kuery: '',
+                probability: 1,
+                documentType: ApmDocumentType.ServiceTransactionMetric,
+                rollupInterval: RollupInterval.OneMinute,
+              },
+            },
+          });
+        });
+
+        it('returns services without transaction data', () => {
+          const serviceNames = response.body.items.map((item) => item.serviceName);
+
+          expect(serviceNames).to.contain('metric-only-service');
+
+          expect(serviceNames).to.contain('error-only-service');
+        });
+
+        it('returns the correct statistics', () => {
+          checkStats();
+        });
+      });
+
+      describe('when using rolled up data', () => {
+        before(async () => {
+          response = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/services',
+            params: {
+              query: {
+                start,
+                end,
+                environment: ENVIRONMENT_ALL.value,
+                kuery: '',
+                probability: 1,
+                documentType: ApmDocumentType.TransactionMetric,
+                rollupInterval: RollupInterval.TenMinutes,
+              },
+            },
+          });
+        });
+
+        it('returns the correct statistics', () => {
+          checkStats();
+        });
+      });
     }
   );
 
diff --git a/x-pack/test/apm_api_integration/tests/time_range_metadata/time_range_metadata.spec.ts b/x-pack/test/apm_api_integration/tests/time_range_metadata/time_range_metadata.spec.ts
new file mode 100644
index 0000000000000..fa1230bb8dcf0
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/time_range_metadata/time_range_metadata.spec.ts
@@ -0,0 +1,404 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { apm, timerange } from '@kbn/apm-synthtrace-client';
+import expect from '@kbn/expect';
+import { APIClientRequestParamsOf } from '@kbn/apm-plugin/public/services/rest/create_call_apm_api';
+import { omit, sortBy } from 'lodash';
+import moment, { Moment } from 'moment';
+import { ApmDocumentType } from '@kbn/apm-plugin/common/document_type';
+import { RollupInterval } from '@kbn/apm-plugin/common/rollup';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const registry = getService('registry');
+  const apmApiClient = getService('apmApiClient');
+  const synthtraceEsClient = getService('synthtraceEsClient');
+
+  const esClient = getService('es');
+
+  const start = moment('2022-01-01T00:00:00.000Z');
+  const end = moment('2022-01-02T00:00:00.000Z').subtract(1, 'millisecond');
+
+  async function getTimeRangeMedata(
+    overrides: Partial<
+      Omit<
+        APIClientRequestParamsOf<'GET /internal/apm/time_range_metadata'>['params']['query'],
+        'start' | 'end'
+      >
+    > & { start: Moment; end: Moment }
+  ) {
+    const response = await apmApiClient.readUser({
+      endpoint: 'GET /internal/apm/time_range_metadata',
+      params: {
+        query: {
+          start: overrides.start.toISOString(),
+          end: overrides.end.toISOString(),
+          enableContinuousRollups: true,
+          enableServiceTransactionMetrics: true,
+          useSpanName: false,
+          kuery: '',
+          ...omit(overrides, 'start', 'end'),
+        },
+      },
+    });
+
+    return {
+      ...response.body,
+      sources: sortBy(response.body.sources, ['documentType', 'rollupInterval']),
+    };
+  }
+
+  registry.when('Time range metadata without data', { config: 'basic', archives: [] }, () => {
+    it('handles empty state', async () => {
+      const response = await getTimeRangeMedata({
+        start,
+        end,
+      });
+
+      expect(response.isUsingServiceDestinationMetrics).to.eql(false);
+      expect(response.sources.filter((source) => source.hasDocs)).to.eql([
+        {
+          documentType: ApmDocumentType.TransactionEvent,
+          rollupInterval: RollupInterval.None,
+          hasDocs: true,
+        },
+      ]);
+    });
+  });
+
+  registry.when(
+    'Time range metadata when generating data',
+    { config: 'basic', archives: [] },
+    () => {
+      before(() => {
+        const instance = apm.service('my-service', 'production', 'java').instance('instance');
+
+        return synthtraceEsClient.index(
+          timerange(moment(start).subtract(1, 'day'), end)
+            .interval('1m')
+            .rate(1)
+            .generator((timestamp) => {
+              return instance.transaction('GET /api').duration(100).timestamp(timestamp);
+            })
+        );
+      });
+
+      after(() => {
+        return synthtraceEsClient.clean();
+      });
+
+      describe('with default settings', () => {
+        it('returns all available document sources', async () => {
+          const response = await getTimeRangeMedata({
+            start,
+            end,
+          });
+
+          expect(response.sources).to.eql([
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.TenMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.SixtyMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionEvent,
+              rollupInterval: RollupInterval.None,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.TenMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.SixtyMinutes,
+              hasDocs: true,
+            },
+          ]);
+        });
+      });
+
+      describe('with continuous rollups disabled', () => {
+        it('returns only 1m intervals', async () => {
+          const response = await getTimeRangeMedata({
+            start,
+            end,
+            enableContinuousRollups: false,
+          });
+
+          expect(response.sources).to.eql([
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionEvent,
+              rollupInterval: RollupInterval.None,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+          ]);
+        });
+      });
+
+      describe('with service metrics disabled', () => {
+        it('only returns tx metrics and events as available sources', async () => {
+          const response = await getTimeRangeMedata({
+            start,
+            end,
+            enableServiceTransactionMetrics: false,
+          });
+
+          expect(response.sources).to.eql([
+            {
+              documentType: ApmDocumentType.TransactionEvent,
+              rollupInterval: RollupInterval.None,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.TenMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.SixtyMinutes,
+              hasDocs: true,
+            },
+          ]);
+        });
+      });
+
+      describe('when data is available before the time range', () => {
+        it('marks all those sources as available', async () => {
+          const response = await getTimeRangeMedata({
+            start: moment(start).add(12, 'hours'),
+            end: moment(end).add(12, 'hours'),
+          });
+
+          expect(response.sources).to.eql([
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.TenMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.SixtyMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionEvent,
+              rollupInterval: RollupInterval.None,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.TenMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.SixtyMinutes,
+              hasDocs: true,
+            },
+          ]);
+        });
+      });
+
+      describe('when data is not available before the time range, but is within the time range', () => {
+        it('marks those sources as available', async () => {
+          const response = await getTimeRangeMedata({
+            start: moment(start).add(6, 'hours'),
+            end: moment(end).add(6, 'hours'),
+          });
+
+          expect(response.sources).to.eql([
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.TenMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.ServiceTransactionMetric,
+              rollupInterval: RollupInterval.SixtyMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionEvent,
+              rollupInterval: RollupInterval.None,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.TenMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.SixtyMinutes,
+              hasDocs: true,
+            },
+          ]);
+        });
+      });
+
+      describe('when service metrics are only available in the current time range', () => {
+        before(async () => {
+          await esClient.deleteByQuery({
+            index: 'metrics-apm*',
+            query: {
+              bool: {
+                filter: [
+                  {
+                    terms: {
+                      'metricset.name': ['service_transaction', 'service_summary'],
+                    },
+                  },
+                  {
+                    range: {
+                      '@timestamp': {
+                        lte: start.toISOString(),
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+            refresh: true,
+            expand_wildcards: ['open', 'hidden'],
+          });
+        });
+
+        it('marks service transaction metrics as unavailable', async () => {
+          const response = await getTimeRangeMedata({
+            start,
+            end,
+          });
+
+          expect(
+            response.sources.filter(
+              (source) =>
+                source.documentType === ApmDocumentType.ServiceTransactionMetric &&
+                source.hasDocs === false
+            ).length
+          ).to.eql(3);
+
+          expect(
+            response.sources.filter(
+              (source) =>
+                source.documentType === ApmDocumentType.TransactionMetric && source.hasDocs === true
+            ).length
+          ).to.eql(3);
+        });
+      });
+
+      describe('after deleting a specific data set', () => {
+        before(async () => {
+          await esClient.deleteByQuery({
+            index: 'metrics-apm*',
+            query: {
+              bool: {
+                filter: [
+                  {
+                    terms: {
+                      'metricset.name': ['transaction'],
+                    },
+                  },
+                  {
+                    term: {
+                      'metricset.interval': '1m',
+                    },
+                  },
+                ],
+              },
+            },
+            refresh: true,
+            expand_wildcards: ['open', 'hidden'],
+          });
+        });
+
+        it('marks that data source as unavailable', async () => {
+          const response = await getTimeRangeMedata({
+            start,
+            end,
+          });
+
+          expect(
+            response.sources.filter(
+              (source) => source.documentType === ApmDocumentType.TransactionMetric
+            )
+          ).to.eql([
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.TenMinutes,
+              hasDocs: true,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.OneMinute,
+              hasDocs: false,
+            },
+            {
+              documentType: ApmDocumentType.TransactionMetric,
+              rollupInterval: RollupInterval.SixtyMinutes,
+              hasDocs: true,
+            },
+          ]);
+        });
+      });
+
+      after(() => synthtraceEsClient.clean());
+    }
+  );
+}

From 0958c59f0b33a0ba913f761fc5d544fa11a8b4b1 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@elastic.co>
Date: Tue, 7 Feb 2023 07:31:21 -0700
Subject: [PATCH 063/134] [Maps] fix Kibana maps should not override the sort
 field if not provided by the user (#150400)

Fixes https://github.com/elastic/kibana/issues/150184

PR updates vector tile search request body generation to only populate
`sort` property when its provided. PR also cleans up some `any` types
with types from elasticsearch client.
---
 .../maps/common/mvt_request_body.test.ts      | 44 ++++++++++++++++-
 .../plugins/maps/common/mvt_request_body.ts   | 49 ++++++++++++-------
 x-pack/plugins/maps/server/mvt/mvt_routes.ts  | 13 +++--
 3 files changed, 84 insertions(+), 22 deletions(-)

diff --git a/x-pack/plugins/maps/common/mvt_request_body.test.ts b/x-pack/plugins/maps/common/mvt_request_body.test.ts
index fd67cdeed3e8b..eef26cb526ad4 100644
--- a/x-pack/plugins/maps/common/mvt_request_body.test.ts
+++ b/x-pack/plugins/maps/common/mvt_request_body.test.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import {
   decodeMvtResponseBody,
   encodeMvtResponseBody,
@@ -23,7 +24,7 @@ describe('decodeMvtResponseBody', () => {
       stored_fields: ['geopoint'],
       runtime_mappings: {
         'day of week': {
-          type: 'keyword',
+          type: 'keyword' as estypes.MappingRuntimeFieldType,
           script: {
             source:
               "ZonedDateTime input = doc['ISSUE_DATE'].value;\nString output = input.format(DateTimeFormatter.ofPattern('e')) + ' ' + input.format(DateTimeFormatter.ofPattern('E'));\nemit(output);",
@@ -64,7 +65,7 @@ describe('decodeMvtResponseBody', () => {
       _source: false,
       runtime_mappings: {
         price_as_number: {
-          type: 'keyword',
+          type: 'keyword' as estypes.MappingRuntimeFieldType,
           script: {
             source: runtimeFieldScript,
           },
@@ -124,4 +125,43 @@ describe('getHitsTileRequest', () => {
     });
     expect(path).toEqual('/my%20index/_mvt/my%20location/0/0/0');
   });
+
+  describe('sort', () => {
+    test(`Should include sort`, () => {
+      const searchRequest = {
+        size: 10000,
+        runtime_mappings: {},
+        query: {},
+        sort: ['timestamp'],
+      };
+      const { body } = getHitsTileRequest({
+        encodedRequestBody: encodeMvtResponseBody(searchRequest),
+        geometryFieldName: 'my location',
+        hasLabels: true,
+        index: 'my index',
+        x: 0,
+        y: 0,
+        z: 0,
+      });
+      expect(body).toHaveProperty('sort');
+    });
+
+    test(`Should not include sort when sort not provided`, () => {
+      const searchRequest = {
+        size: 10000,
+        runtime_mappings: {},
+        query: {},
+      };
+      const { body } = getHitsTileRequest({
+        encodedRequestBody: encodeMvtResponseBody(searchRequest),
+        geometryFieldName: 'my location',
+        hasLabels: true,
+        index: 'my index',
+        x: 0,
+        y: 0,
+        z: 0,
+      });
+      expect(body).not.toHaveProperty('sort');
+    });
+  });
 });
diff --git a/x-pack/plugins/maps/common/mvt_request_body.ts b/x-pack/plugins/maps/common/mvt_request_body.ts
index f876caefe0312..72b78786e5046 100644
--- a/x-pack/plugins/maps/common/mvt_request_body.ts
+++ b/x-pack/plugins/maps/common/mvt_request_body.ts
@@ -6,13 +6,16 @@
  */
 
 import rison from '@kbn/rison';
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { RENDER_AS } from './constants';
 
-export function decodeMvtResponseBody(encodedRequestBody: string): object {
-  return rison.decode(decodeURIComponent(encodedRequestBody).replace('%25', '%')) as object;
+export function decodeMvtResponseBody(encodedRequestBody: string): estypes.SearchRequest['body'] {
+  return rison.decode(
+    decodeURIComponent(encodedRequestBody).replace('%25', '%')
+  ) as estypes.SearchRequest['body'];
 }
 
-export function encodeMvtResponseBody(unencodedRequestBody: object): string {
+export function encodeMvtResponseBody(unencodedRequestBody: estypes.SearchRequest['body']): string {
   // URL encoding replaces unsafe ASCII characters with a '%' followed by two hexadecimal digits
   // encodeURIComponent does not encode '%'
   // This causes preexisting '%' to break decoding because they are not valid URL encoding
@@ -41,7 +44,10 @@ export function getAggsTileRequest({
   y: number;
   z: number;
 }) {
-  const requestBody = decodeMvtResponseBody(encodedRequestBody) as any;
+  const requestBody = decodeMvtResponseBody(encodedRequestBody);
+  if (!requestBody) {
+    throw new Error('Required requestBody parameter not provided');
+  }
   return {
     path: `/${encodeURIComponent(index)}/_mvt/${encodeURIComponent(
       geometryFieldName
@@ -58,7 +64,7 @@ export function getAggsTileRequest({
       fields: requestBody.fields ? requestBody.fields : [],
       runtime_mappings: requestBody.runtime_mappings,
       with_labels: hasLabels,
-    },
+    } as estypes.SearchMvtRequest['body'],
   };
 }
 
@@ -79,21 +85,30 @@ export function getHitsTileRequest({
   y: number;
   z: number;
 }) {
-  const requestBody = decodeMvtResponseBody(encodedRequestBody) as any;
+  const requestBody = decodeMvtResponseBody(encodedRequestBody);
+  if (!requestBody) {
+    throw new Error('Required requestBody parameter not provided');
+  }
+  const tileRequestBody = {
+    grid_precision: 0, // no aggs
+    exact_bounds: true,
+    extent: 4096, // full resolution,
+    query: requestBody.query,
+    runtime_mappings: requestBody.runtime_mappings,
+    track_total_hits: typeof requestBody.size === 'number' ? requestBody.size + 1 : false,
+    with_labels: hasLabels,
+  } as estypes.SearchMvtRequest['body'];
+  if (requestBody.fields) {
+    // @ts-expect-error SearchRequest['body'].fields and SearchMvtRequest['body'].fields types do not allign, even though they do in implemenation
+    tileRequestBody.fields = requestBody.fields;
+  }
+  if (requestBody.sort) {
+    tileRequestBody!.sort = requestBody.sort;
+  }
   return {
     path: `/${encodeURIComponent(index)}/_mvt/${encodeURIComponent(
       geometryFieldName
     )}/${z}/${x}/${y}`,
-    body: {
-      grid_precision: 0, // no aggs
-      exact_bounds: true,
-      extent: 4096, // full resolution,
-      query: requestBody.query,
-      fields: requestBody.fields ? requestBody.fields : [],
-      runtime_mappings: requestBody.runtime_mappings,
-      sort: requestBody.sort ? requestBody.sort : [],
-      track_total_hits: typeof requestBody.size === 'number' ? requestBody.size + 1 : false,
-      with_labels: hasLabels,
-    },
+    body: tileRequestBody,
   };
 }
diff --git a/x-pack/plugins/maps/server/mvt/mvt_routes.ts b/x-pack/plugins/maps/server/mvt/mvt_routes.ts
index 6fd7374fb69c1..96f6bafadabfd 100644
--- a/x-pack/plugins/maps/server/mvt/mvt_routes.ts
+++ b/x-pack/plugins/maps/server/mvt/mvt_routes.ts
@@ -13,6 +13,7 @@ import { CoreStart, KibanaRequest, KibanaResponseFactory, Logger } from '@kbn/co
 import { IRouter } from '@kbn/core/server';
 import type { DataRequestHandlerContext } from '@kbn/data-plugin/server';
 import { errors } from '@elastic/elasticsearch';
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import {
   MVT_GETTILE_API_PATH,
   API_ROOT_PATH,
@@ -61,7 +62,10 @@ export function initMVTRoutes({
       const y = parseInt((params as any).y, 10) as number;
       const z = parseInt((params as any).z, 10) as number;
 
-      let tileRequest: { path: string; body: object } | undefined;
+      let tileRequest: { path: string; body: estypes.SearchMvtRequest['body'] } = {
+        path: '',
+        body: {},
+      };
       try {
         tileRequest = getHitsTileRequest({
           encodedRequestBody: query.requestBody as string,
@@ -123,7 +127,10 @@ export function initMVTRoutes({
       const y = parseInt((params as any).y, 10) as number;
       const z = parseInt((params as any).z, 10) as number;
 
-      let tileRequest: { path: string; body: object } | undefined;
+      let tileRequest: { path: string; body: estypes.SearchMvtRequest['body'] } = {
+        path: '',
+        body: {},
+      };
       try {
         tileRequest = getAggsTileRequest({
           encodedRequestBody: query.requestBody as string,
@@ -168,7 +175,7 @@ async function getTile({
   path,
 }: {
   abortController: AbortController;
-  body: object;
+  body: estypes.SearchMvtRequest['body'];
   context: DataRequestHandlerContext;
   core: CoreStart;
   executionContext: KibanaExecutionContext;

From 1e445059d798cdfdc0496eccf48cb35b8b7559ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?=
 <alejandro.haro@elastic.co>
Date: Tue, 7 Feb 2023 15:50:14 +0100
Subject: [PATCH 064/134] Unskip `saved_object_tagging` FTRs (#149962)

Resolves https://github.com/elastic/kibana/issues/88639
---
 .../functional/tests/visualize_integration.ts  | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/x-pack/test/saved_object_tagging/functional/tests/visualize_integration.ts b/x-pack/test/saved_object_tagging/functional/tests/visualize_integration.ts
index d7160a590185d..a7a03a58ba0cf 100644
--- a/x-pack/test/saved_object_tagging/functional/tests/visualize_integration.ts
+++ b/x-pack/test/saved_object_tagging/functional/tests/visualize_integration.ts
@@ -94,7 +94,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         await listingTable.searchForItemWithName('tag:(tag-1)', { escape: false });
         await listingTable.expectItemsCount('visualize', 2);
         const itemNames = await listingTable.getAllSelectableItemsNames();
-        expect(itemNames).to.eql(['Visualization 1 (tag-1)', 'Visualization 3 (tag-1 + tag-3)']);
+        expect(itemNames.sort()).to.eql([
+          'Visualization 1 (tag-1)',
+          'Visualization 3 (tag-1 + tag-3)',
+        ]);
       });
 
       it('allows to filter by selecting a tag in the filter menu', async () => {
@@ -102,7 +105,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
         await listingTable.expectItemsCount('visualize', 2);
         const itemNames = await listingTable.getAllSelectableItemsNames();
-        expect(itemNames).to.eql(['Visualization 1 (tag-1)', 'Visualization 3 (tag-1 + tag-3)']);
+        expect(itemNames.sort()).to.eql([
+          'Visualization 1 (tag-1)',
+          'Visualization 3 (tag-1 + tag-3)',
+        ]);
       });
 
       it('allows to filter by multiple tags', async () => {
@@ -110,7 +116,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
         await listingTable.expectItemsCount('visualize', 2);
         const itemNames = await listingTable.getAllSelectableItemsNames();
-        expect(itemNames).to.eql(['Visualization 2 (tag-2)', 'Visualization 3 (tag-1 + tag-3)']);
+        expect(itemNames.sort()).to.eql([
+          'Visualization 2 (tag-2)',
+          'Visualization 3 (tag-1 + tag-3)',
+        ]);
       });
     });
 
@@ -181,8 +190,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       });
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/88639
-    describe.skip('editing', () => {
+    describe('editing', () => {
       before(async () => {
         await PageObjects.visualize.gotoVisualizationLandingPage();
         await PageObjects.visualize.deleteAllVisualizations();

From 0d630d97cd39970538a1d3beeff3f484ace997a7 Mon Sep 17 00:00:00 2001
From: Dominique Clarke <dominique.clarke@elastic.co>
Date: Tue, 7 Feb 2023 09:54:02 -0500
Subject: [PATCH 065/134] [Synthetics] push pending monitors to bottom of list
 (#149899)

## Summary

Resolves https://github.com/elastic/kibana/issues/149429

<img width="1542" alt="Screen Shot 2023-02-06 at 10 03 02 AM"
src="https://user-images.githubusercontent.com/11356435/217006824-e39ab668-d1d8-4ace-b918-cdd3c225ae8f.png">

### Testing

1. Create a monitor that will remain in pending state. Ideally, the
monitors name should be first alphabetically, so you can have a valid
test that the monitor is pushed to the end despite its alphabetical
placement. You can ensure it will remain in pending state by doing one
of the following: create a private location without attaching it to an
elastic-agent or connecting to the dev synthetics service and choosing
the staging location.
2. Navigate to Overview. Ensure the pending monitor is pushed to the
last in the list

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../synthetics_overview_status.ts             |  19 +-
 .../overview/overview/overview_alerts.tsx     |  10 +-
 .../overview_errors/overview_errors.tsx       |  12 +-
 .../use_monitors_sorted_by_status.test.tsx    |  28 +++
 .../hooks/use_monitors_sorted_by_status.tsx   |  13 +-
 .../status_rule/status_rule_executor.ts       |  52 +++--
 .../server/queries/query_monitor_status.ts    |  58 ++++-
 .../routes/status/current_status.test.ts      | 205 +++++++++++++++++-
 .../server/routes/status/current_status.ts    |  14 +-
 .../get_all_monitors.test.ts                  |  41 +++-
 .../synthetics_monitor/get_all_monitors.ts    |  10 +-
 11 files changed, 409 insertions(+), 53 deletions(-)

diff --git a/x-pack/plugins/synthetics/common/runtime_types/monitor_management/synthetics_overview_status.ts b/x-pack/plugins/synthetics/common/runtime_types/monitor_management/synthetics_overview_status.ts
index a519036240b50..046f030b4d712 100644
--- a/x-pack/plugins/synthetics/common/runtime_types/monitor_management/synthetics_overview_status.ts
+++ b/x-pack/plugins/synthetics/common/runtime_types/monitor_management/synthetics_overview_status.ts
@@ -11,12 +11,25 @@ import { PingType } from '..';
 export const OverviewStatusMetaDataCodec = t.interface({
   monitorQueryId: t.string,
   configId: t.string,
+  status: t.string,
   location: t.string,
   timestamp: t.string,
-  status: t.string,
   ping: PingType,
 });
 
+export const OverviewPendingStatusMetaDataCodec = t.intersection([
+  t.interface({
+    monitorQueryId: t.string,
+    configId: t.string,
+    status: t.string,
+    location: t.string,
+  }),
+  t.partial({
+    timestamp: t.string,
+    ping: PingType,
+  }),
+]);
+
 export const OverviewStatusCodec = t.interface({
   allMonitorsCount: t.number,
   disabledMonitorsCount: t.number,
@@ -27,8 +40,9 @@ export const OverviewStatusCodec = t.interface({
   disabledCount: t.number,
   upConfigs: t.record(t.string, OverviewStatusMetaDataCodec),
   downConfigs: t.record(t.string, OverviewStatusMetaDataCodec),
+  pendingConfigs: t.record(t.string, OverviewPendingStatusMetaDataCodec),
+  enabledMonitorQueryIds: t.array(t.string),
   allIds: t.array(t.string),
-  enabledIds: t.array(t.string),
 });
 
 export const OverviewStatusStateCodec = t.intersection([
@@ -41,3 +55,4 @@ export const OverviewStatusStateCodec = t.intersection([
 export type OverviewStatus = t.TypeOf<typeof OverviewStatusCodec>;
 export type OverviewStatusState = t.TypeOf<typeof OverviewStatusStateCodec>;
 export type OverviewStatusMetaData = t.TypeOf<typeof OverviewStatusMetaDataCodec>;
+export type OverviewPendingStatusMetaData = t.TypeOf<typeof OverviewPendingStatusMetaDataCodec>;
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_alerts.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_alerts.tsx
index 6592fa7bb071c..13629e2e64c54 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_alerts.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_alerts.tsx
@@ -61,7 +61,10 @@ export const OverviewAlerts = () => {
                   selectedMetricField: RECORDS_FIELD,
                   reportDefinitions: {
                     'kibana.alert.rule.category': ['Synthetics monitor status'],
-                    'monitor.id': status?.enabledIds.length > 0 ? status?.enabledIds : ['false-id'],
+                    'monitor.id':
+                      status?.enabledMonitorQueryIds.length > 0
+                        ? status?.enabledMonitorQueryIds
+                        : ['false-id'],
                   },
                   filters: [{ field: 'kibana.alert.status', values: ['active', 'recovered'] }],
                   color: theme.eui.euiColorVis1,
@@ -83,7 +86,10 @@ export const OverviewAlerts = () => {
                   },
                   reportDefinitions: {
                     'kibana.alert.rule.category': ['Synthetics monitor status'],
-                    'monitor.id': status?.enabledIds.length > 0 ? status?.enabledIds : ['false-id'],
+                    'monitor.id':
+                      status?.enabledMonitorQueryIds.length > 0
+                        ? status?.enabledMonitorQueryIds
+                        : ['false-id'],
                   },
                   dataType: 'alerts',
                   selectedMetricField: RECORDS_FIELD,
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_errors/overview_errors.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_errors/overview_errors.tsx
index 94d937bdec241..636da377442fa 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_errors/overview_errors.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_errors/overview_errors.tsx
@@ -40,10 +40,18 @@ export function OverviewErrors() {
       ) : (
         <EuiFlexGroup gutterSize="xl">
           <EuiFlexItem grow={false}>
-            <OverviewErrorsCount from={from} to={to} monitorIds={status?.enabledIds ?? []} />
+            <OverviewErrorsCount
+              from={from}
+              to={to}
+              monitorIds={status?.enabledMonitorQueryIds ?? []}
+            />
           </EuiFlexItem>
           <EuiFlexItem grow={true}>
-            <OverviewErrorsSparklines from={from} to={to} monitorIds={status?.enabledIds ?? []} />
+            <OverviewErrorsSparklines
+              from={from}
+              to={to}
+              monitorIds={status?.enabledMonitorQueryIds ?? []}
+            />
           </EuiFlexItem>
           <EuiFlexItem grow={false} css={{ alignSelf: 'center' }}>
             <ErrorsLink disabled={true} />
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_monitors_sorted_by_status.test.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_monitors_sorted_by_status.test.tsx
index fbc5122146454..16fdc7cd5a497 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_monitors_sorted_by_status.test.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_monitors_sorted_by_status.test.tsx
@@ -101,6 +101,13 @@ describe('useMonitorsSortedByStatus', () => {
                   location: location2,
                   isEnabled: true,
                 },
+                {
+                  configId: 'test-monitor-4',
+                  id: 'test-monitor-4',
+                  name: 'Test monitor 4',
+                  location: location1,
+                  isEnabled: true,
+                },
               ],
             },
             error: null,
@@ -143,6 +150,13 @@ describe('useMonitorsSortedByStatus', () => {
                   location: location1.label,
                 },
               },
+              pendingConfigs: {
+                [`test-monitor-4-${location1.label}`]: {
+                  configId: 'test-monitor-4',
+                  monitorQueryId: 'test-monitor-4',
+                  location: location1.label,
+                },
+              },
             },
           },
         }}
@@ -200,6 +214,13 @@ describe('useMonitorsSortedByStatus', () => {
           location: location1,
           isEnabled: false,
         },
+        {
+          configId: 'test-monitor-4',
+          id: 'test-monitor-4',
+          name: 'Test monitor 4',
+          location: location1,
+          isEnabled: true,
+        },
       ],
       downMonitors: {
         'test-monitor-1': ['US Central'],
@@ -259,6 +280,13 @@ describe('useMonitorsSortedByStatus', () => {
           location: location1,
           isEnabled: false,
         },
+        {
+          configId: 'test-monitor-4',
+          id: 'test-monitor-4',
+          name: 'Test monitor 4',
+          location: location1,
+          isEnabled: true,
+        },
       ],
       downMonitors: {
         'test-monitor-1': ['US Central'],
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_monitors_sorted_by_status.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_monitors_sorted_by_status.tsx
index 76c2d270a09a7..2148b7e5eeb30 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_monitors_sorted_by_status.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_monitors_sorted_by_status.tsx
@@ -31,10 +31,11 @@ export function useMonitorsSortedByStatus() {
         down: [],
         up: [],
         disabled: [],
+        pending: [],
       };
     }
 
-    const { downConfigs } = status;
+    const { downConfigs, pendingConfigs } = status;
     const downMonitorMap: Record<string, string[]> = {};
     Object.values(downConfigs).forEach(({ location, configId }) => {
       if (downMonitorMap[configId]) {
@@ -47,6 +48,7 @@ export function useMonitorsSortedByStatus() {
     const orderedDownMonitors: MonitorOverviewItem[] = [];
     const orderedUpMonitors: MonitorOverviewItem[] = [];
     const orderedDisabledMonitors: MonitorOverviewItem[] = [];
+    const orderedPendingMonitors: MonitorOverviewItem[] = [];
 
     monitors.forEach((monitor) => {
       const monitorLocation = locationNames[monitor.location.id];
@@ -57,6 +59,8 @@ export function useMonitorsSortedByStatus() {
         downMonitorMap[monitor.configId].includes(monitorLocation)
       ) {
         orderedDownMonitors.push(monitor);
+      } else if (pendingConfigs?.[`${monitor.configId}-${locationNames[monitor.location.id]}`]) {
+        orderedPendingMonitors.push(monitor);
       } else {
         orderedUpMonitors.push(monitor);
       }
@@ -67,6 +71,7 @@ export function useMonitorsSortedByStatus() {
       down: orderedDownMonitors,
       up: orderedUpMonitors,
       disabled: orderedDisabledMonitors,
+      pending: orderedPendingMonitors,
     };
   }, [monitors, locationNames, downMonitors, status]);
 
@@ -96,7 +101,11 @@ export function useMonitorsSortedByStatus() {
         : [...monitorsSortedByStatus.up, ...monitorsSortedByStatus.down];
 
     return {
-      monitorsSortedByStatus: [...upAndDownMonitors, ...monitorsSortedByStatus.disabled],
+      monitorsSortedByStatus: [
+        ...upAndDownMonitors,
+        ...monitorsSortedByStatus.disabled,
+        ...monitorsSortedByStatus.pending,
+      ],
       downMonitors: downMonitors.current,
     };
   }, [downMonitors, monitorsSortedByStatus, sortOrder, statusFilter]);
diff --git a/x-pack/plugins/synthetics/server/alert_rules/status_rule/status_rule_executor.ts b/x-pack/plugins/synthetics/server/alert_rules/status_rule/status_rule_executor.ts
index ba5327d200b46..1e28763c60a2b 100644
--- a/x-pack/plugins/synthetics/server/alert_rules/status_rule/status_rule_executor.ts
+++ b/x-pack/plugins/synthetics/server/alert_rules/status_rule/status_rule_executor.ts
@@ -93,24 +93,43 @@ export class StatusRuleExecutor {
       search: `attributes.${AlertConfigKey.STATUS_ENABLED}: true`,
     });
 
-    const { allIds, enabledIds, listOfLocations, monitorLocationMap, projectMonitorsCount } =
-      await processMonitors(
-        this.monitors,
-        this.server,
-        this.soClient,
-        this.syntheticsMonitorClient
-      );
+    const {
+      allIds,
+      enabledMonitorQueryIds,
+      listOfLocations,
+      monitorLocationMap,
+      projectMonitorsCount,
+      monitorQueryIdToConfigIdMap,
+    } = await processMonitors(
+      this.monitors,
+      this.server,
+      this.soClient,
+      this.syntheticsMonitorClient
+    );
 
-    return { enabledIds, listOfLocations, allIds, monitorLocationMap, projectMonitorsCount };
+    return {
+      enabledMonitorQueryIds,
+      listOfLocations,
+      allIds,
+      monitorLocationMap,
+      projectMonitorsCount,
+      monitorQueryIdToConfigIdMap,
+    };
   }
 
   async getDownChecks(
     prevDownConfigs: OverviewStatus['downConfigs'] = {}
   ): Promise<AlertOverviewStatus> {
-    const { listOfLocations, enabledIds, allIds, monitorLocationMap, projectMonitorsCount } =
-      await this.getMonitors();
+    const {
+      listOfLocations,
+      enabledMonitorQueryIds,
+      allIds,
+      monitorLocationMap,
+      projectMonitorsCount,
+      monitorQueryIdToConfigIdMap,
+    } = await this.getMonitors();
 
-    if (enabledIds.length > 0) {
+    if (enabledMonitorQueryIds.length > 0) {
       const currentStatus = await queryMonitorStatus(
         this.esClient,
         listOfLocations,
@@ -118,8 +137,9 @@ export class StatusRuleExecutor {
           to: 'now',
           from: this.previousStartedAt?.toISOString() ?? 'now-1m',
         },
-        enabledIds,
-        monitorLocationMap
+        enabledMonitorQueryIds,
+        monitorLocationMap,
+        monitorQueryIdToConfigIdMap
       );
 
       const downConfigs = currentStatus.downConfigs;
@@ -138,18 +158,20 @@ export class StatusRuleExecutor {
         staleDownConfigs,
         projectMonitorsCount,
         allMonitorsCount: allIds.length,
-        disabledMonitorsCount: allIds.length - enabledIds.length,
+        disabledMonitorsCount: allIds.length - enabledMonitorQueryIds.length,
+        allIds,
       };
     }
     const staleDownConfigs = this.markDeletedConfigs(prevDownConfigs);
     return {
       downConfigs: { ...prevDownConfigs },
       upConfigs: {},
+      pendingConfigs: {},
       staleDownConfigs,
       down: 0,
       up: 0,
       pending: 0,
-      enabledIds,
+      enabledMonitorQueryIds,
       allMonitorsCount: allIds.length,
       disabledMonitorsCount: allIds.length,
       projectMonitorsCount,
diff --git a/x-pack/plugins/synthetics/server/queries/query_monitor_status.ts b/x-pack/plugins/synthetics/server/queries/query_monitor_status.ts
index 41f18f5ddd8c6..fef2eaa7be319 100644
--- a/x-pack/plugins/synthetics/server/queries/query_monitor_status.ts
+++ b/x-pack/plugins/synthetics/server/queries/query_monitor_status.ts
@@ -4,12 +4,16 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
-import { intersection } from 'lodash';
+import { cloneDeep, intersection } from 'lodash';
 import { SearchRequest } from '@elastic/elasticsearch/lib/api/types';
 import { SUMMARY_FILTER } from '../../common/constants/client_defaults';
 import { UptimeEsClient } from '../legacy_uptime/lib/lib';
-import { OverviewStatus, OverviewStatusMetaData, Ping } from '../../common/runtime_types';
+import {
+  OverviewStatus,
+  OverviewStatusMetaData,
+  OverviewPendingStatusMetaData,
+  Ping,
+} from '../../common/runtime_types';
 
 const DEFAULT_MAX_ES_BUCKET_SIZE = 10000;
 
@@ -17,17 +21,23 @@ export async function queryMonitorStatus(
   esClient: UptimeEsClient,
   listOfLocations: string[],
   range: { from: string | number; to: string },
-  ids: string[],
-  monitorLocationsMap: Record<string, string[]>
+  monitorQueryIds: string[],
+  monitorLocationsMap: Record<string, string[]>,
+  monitorQueryIdToConfigIdMap: Record<string, string>
 ): Promise<
   Omit<
     OverviewStatus,
-    'disabledCount' | 'allMonitorsCount' | 'disabledMonitorsCount' | 'projectMonitorsCount'
+    | 'disabledCount'
+    | 'allMonitorsCount'
+    | 'disabledMonitorsCount'
+    | 'projectMonitorsCount'
+    | 'allIds'
   >
 > {
   const idSize = Math.trunc(DEFAULT_MAX_ES_BUCKET_SIZE / listOfLocations.length || 1);
-  const pageCount = Math.ceil(ids.length / idSize);
+  const pageCount = Math.ceil(monitorQueryIds.length / idSize);
   const promises: Array<Promise<any>> = [];
+  const monitorsWithoutData = new Map(Object.entries(cloneDeep(monitorLocationsMap)));
   for (let i = 0; i < pageCount; i++) {
     const params: SearchRequest = {
       size: 0,
@@ -47,7 +57,7 @@ export async function queryMonitorStatus(
             },
             {
               terms: {
-                'monitor.id': (ids as string[]).slice(i * idSize, i * idSize + idSize),
+                'monitor.id': (monitorQueryIds as string[]).slice(i * idSize, i * idSize + idSize),
               },
             },
             ...(listOfLocations.length > 0
@@ -114,6 +124,7 @@ export async function queryMonitorStatus(
   let pending = 0;
   const upConfigs: Record<string, OverviewStatusMetaData> = {};
   const downConfigs: Record<string, OverviewStatusMetaData> = {};
+  const pendingConfigs: Record<string, OverviewPendingStatusMetaData> = {};
 
   for await (const response of promises) {
     response.body.aggregations?.id.buckets.forEach(
@@ -162,6 +173,14 @@ export async function queryMonitorStatus(
                 status: 'up',
               };
             }
+            const monitorsMissingData = monitorsWithoutData.get(monitorQueryId) || [];
+            monitorsWithoutData.set(
+              monitorQueryId,
+              monitorsMissingData?.filter((loc) => loc !== monLocation)
+            );
+            if (!monitorsWithoutData.get(monitorQueryId)?.length) {
+              monitorsWithoutData.delete(monitorQueryId);
+            }
           } else {
             pending += 1;
           }
@@ -169,5 +188,26 @@ export async function queryMonitorStatus(
       }
     );
   }
-  return { up, down, pending, upConfigs, downConfigs, enabledIds: ids, allIds: ids };
+
+  // identify the remaining monitos without data, to determine pending monitors
+  for (const [queryId, locs] of monitorsWithoutData) {
+    locs.forEach((loc) => {
+      pendingConfigs[`${monitorQueryIdToConfigIdMap[queryId]}-${loc}`] = {
+        configId: `${monitorQueryIdToConfigIdMap[queryId]}`,
+        monitorQueryId: queryId,
+        status: 'unknown',
+        location: loc,
+      };
+    });
+  }
+
+  return {
+    up,
+    down,
+    pending,
+    upConfigs,
+    downConfigs,
+    pendingConfigs,
+    enabledMonitorQueryIds: monitorQueryIds,
+  };
 }
diff --git a/x-pack/plugins/synthetics/server/routes/status/current_status.test.ts b/x-pack/plugins/synthetics/server/routes/status/current_status.test.ts
index b86d611edf32f..484c556339d74 100644
--- a/x-pack/plugins/synthetics/server/routes/status/current_status.test.ts
+++ b/x-pack/plugins/synthetics/server/routes/status/current_status.test.ts
@@ -172,13 +172,16 @@ describe('current status route', () => {
           ['Europe - Germany', 'Asia/Pacific - Japan'],
           { from: 140000, to: 'now' },
           ['id1', 'id2'],
-          { id1: ['Asia/Pacific - Japan'], id2: ['Europe - Germany', 'Asia/Pacific - Japan'] }
+          { id1: ['Asia/Pacific - Japan'], id2: ['Europe - Germany', 'Asia/Pacific - Japan'] },
+          {
+            id1: 'id1',
+            id2: 'id2',
+          }
         )
       ).toEqual({
         pending: 0,
         down: 1,
-        enabledIds: ['id1', 'id2'],
-        allIds: ['id1', 'id2'],
+        enabledMonitorQueryIds: ['id1', 'id2'],
         up: 2,
         upConfigs: {
           'id1-Asia/Pacific - Japan': {
@@ -208,6 +211,7 @@ describe('current status route', () => {
             timestamp: expect.any(String),
           },
         },
+        pendingConfigs: {},
       });
     });
 
@@ -333,13 +337,16 @@ describe('current status route', () => {
           [...concernedLocations, ...times(9997).map((n) => 'Europe - Germany' + n)],
           { from: 2500, to: 'now' },
           ['id1', 'id2'],
-          { id1: [concernedLocations[0]], id2: [concernedLocations[1], concernedLocations[2]] }
+          { id1: [concernedLocations[0]], id2: [concernedLocations[1], concernedLocations[2]] },
+          {
+            id1: 'id1',
+            id2: 'id2',
+          }
         )
       ).toEqual({
         pending: 0,
         down: 1,
-        enabledIds: ['id1', 'id2'],
-        allIds: ['id1', 'id2'],
+        enabledMonitorQueryIds: ['id1', 'id2'],
         up: 2,
         upConfigs: {
           'id1-Asia/Pacific - Japan': {
@@ -369,6 +376,7 @@ describe('current status route', () => {
             timestamp: expect.any(String),
           },
         },
+        pendingConfigs: {},
       });
       expect(esClient.search).toHaveBeenCalledTimes(2);
       // These assertions are to ensure that we are paginating through the IDs we use for filtering
@@ -381,6 +389,191 @@ describe('current status route', () => {
         esClient.search.mock.calls[1][0].body.query.bool.filter[2].terms['monitor.id']
       ).toEqual(['id2']);
     });
+
+    it('handles pending configs', async () => {
+      const { esClient, uptimeEsClient } = getUptimeESMockClient();
+      esClient.search.mockResponseOnce(
+        getEsResponse([
+          {
+            key: 'id1',
+            location: {
+              buckets: [
+                {
+                  key: 'Asia/Pacific - Japan',
+                  status: {
+                    hits: {
+                      hits: [
+                        {
+                          _source: {
+                            '@timestamp': '2022-09-15T16:08:16.724Z',
+                            monitor: {
+                              status: 'up',
+                              id: 'id1',
+                            },
+                            summary: {
+                              up: 1,
+                              down: 0,
+                            },
+                            config_id: 'id1',
+                            observer: {
+                              geo: {
+                                name: 'Asia/Pacific - Japan',
+                              },
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  },
+                },
+              ],
+            },
+          },
+          {
+            key: 'id2',
+            location: {
+              buckets: [
+                {
+                  key: 'Asia/Pacific - Japan',
+                  status: {
+                    hits: {
+                      hits: [
+                        {
+                          _source: {
+                            '@timestamp': '2022-09-15T16:09:16.724Z',
+                            monitor: {
+                              status: 'up',
+                              id: 'id2',
+                            },
+                            summary: {
+                              up: 1,
+                              down: 0,
+                            },
+                            config_id: 'id2',
+                            observer: {
+                              geo: {
+                                name: 'Asia/Pacific - Japan',
+                              },
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  },
+                },
+                {
+                  key: 'Europe - Germany',
+                  status: {
+                    hits: {
+                      hits: [
+                        {
+                          _source: {
+                            '@timestamp': '2022-09-15T16:19:16.724Z',
+                            monitor: {
+                              status: 'down',
+                              id: 'id2',
+                            },
+                            summary: {
+                              down: 1,
+                              up: 0,
+                            },
+                            config_id: 'id2',
+                            observer: {
+                              geo: {
+                                name: 'Europe - Germany',
+                              },
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  },
+                },
+              ],
+            },
+          },
+        ])
+      );
+      expect(
+        await queryMonitorStatus(
+          uptimeEsClient,
+          ['Europe - Germany', 'Asia/Pacific - Japan'],
+          { from: 140000, to: 'now' },
+          ['id1', 'id2', 'project-monitor-id', 'id4'],
+          {
+            id1: ['Asia/Pacific - Japan'],
+            id2: ['Europe - Germany', 'Asia/Pacific - Japan'],
+            'project-monitor-id': ['Europe - Germany', 'Asia/Pacific - Japan'],
+            id4: ['Europe - Germany', 'Asia/Pacific - Japan'],
+          },
+          {
+            id1: 'id1',
+            id2: 'id2',
+            'project-monitor-id': 'id3',
+            id4: 'id4',
+          }
+        )
+      ).toEqual({
+        pending: 0,
+        down: 1,
+        enabledMonitorQueryIds: ['id1', 'id2', 'project-monitor-id', 'id4'],
+        up: 2,
+        upConfigs: {
+          'id1-Asia/Pacific - Japan': {
+            configId: 'id1',
+            monitorQueryId: 'id1',
+            location: 'Asia/Pacific - Japan',
+            status: 'up',
+            ping: expect.any(Object),
+            timestamp: expect.any(String),
+          },
+          'id2-Asia/Pacific - Japan': {
+            configId: 'id2',
+            monitorQueryId: 'id2',
+            location: 'Asia/Pacific - Japan',
+            status: 'up',
+            ping: expect.any(Object),
+            timestamp: expect.any(String),
+          },
+        },
+        downConfigs: {
+          'id2-Europe - Germany': {
+            configId: 'id2',
+            monitorQueryId: 'id2',
+            location: 'Europe - Germany',
+            status: 'down',
+            ping: expect.any(Object),
+            timestamp: expect.any(String),
+          },
+        },
+        pendingConfigs: {
+          'id3-Asia/Pacific - Japan': {
+            configId: 'id3',
+            location: 'Asia/Pacific - Japan',
+            monitorQueryId: 'project-monitor-id',
+            status: 'unknown',
+          },
+          'id3-Europe - Germany': {
+            configId: 'id3',
+            location: 'Europe - Germany',
+            monitorQueryId: 'project-monitor-id',
+            status: 'unknown',
+          },
+          'id4-Asia/Pacific - Japan': {
+            configId: 'id4',
+            location: 'Asia/Pacific - Japan',
+            monitorQueryId: 'id4',
+            status: 'unknown',
+          },
+          'id4-Europe - Germany': {
+            configId: 'id4',
+            location: 'Europe - Germany',
+            monitorQueryId: 'id4',
+            status: 'unknown',
+          },
+        },
+      });
+    });
   });
 });
 
diff --git a/x-pack/plugins/synthetics/server/routes/status/current_status.ts b/x-pack/plugins/synthetics/server/routes/status/current_status.ts
index 94e3ba8729836..a07a250cd65bf 100644
--- a/x-pack/plugins/synthetics/server/routes/status/current_status.ts
+++ b/x-pack/plugins/synthetics/server/routes/status/current_status.ts
@@ -67,20 +67,22 @@ export async function getStatus(
       ConfigKey.ENABLED,
       ConfigKey.LOCATIONS,
       ConfigKey.MONITOR_QUERY_ID,
+      ConfigKey.CONFIG_ID,
       ConfigKey.SCHEDULE,
       ConfigKey.MONITOR_SOURCE_TYPE,
     ],
   });
 
   const {
+    enabledMonitorQueryIds,
     allIds,
-    enabledIds,
     disabledCount,
     maxPeriod,
     listOfLocations,
     monitorLocationMap,
     disabledMonitorsCount,
     projectMonitorsCount,
+    monitorQueryIdToConfigIdMap,
   } = await processMonitors(allMonitors, server, soClient, syntheticsMonitorClient);
 
   // Account for locations filter
@@ -90,12 +92,13 @@ export async function getStatus(
     ? intersection(listOfLocations, queryLocationsArray)
     : listOfLocations;
 
-  const { up, down, pending, upConfigs, downConfigs } = await queryMonitorStatus(
+  const { up, down, pending, upConfigs, downConfigs, pendingConfigs } = await queryMonitorStatus(
     uptimeEsClient,
     listOfLocationAfterFilter,
     { from: maxPeriod, to: 'now' },
-    enabledIds,
-    monitorLocationMap
+    enabledMonitorQueryIds,
+    monitorLocationMap,
+    monitorQueryIdToConfigIdMap
   );
 
   return {
@@ -103,13 +106,14 @@ export async function getStatus(
     allMonitorsCount: allMonitors.length,
     disabledMonitorsCount,
     projectMonitorsCount,
-    enabledIds,
+    enabledMonitorQueryIds,
     disabledCount,
     up,
     down,
     pending,
     upConfigs,
     downConfigs,
+    pendingConfigs,
   };
 }
 
diff --git a/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.test.ts b/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.test.ts
index cdb6e2f520fc8..33eb5bfcc0d7e 100644
--- a/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.test.ts
+++ b/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.test.ts
@@ -50,12 +50,15 @@ describe('processMonitors', () => {
       allIds: [
         'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
         '7f796001-a795-4c0b-afdb-3ce74edea775',
-        '5e203f47-1261-4978-a915-cc3315d90fb1',
+        'test-project-id-default',
       ],
       disabledCount: 2,
       disabledMonitorsCount: 1,
       projectMonitorsCount: 1,
-      enabledIds: ['aa925d91-40b0-4f8f-b695-bb9b53cd4e22', '7f796001-a795-4c0b-afdb-3ce74edea775'],
+      enabledMonitorQueryIds: [
+        'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
+        '7f796001-a795-4c0b-afdb-3ce74edea775',
+      ],
       listOfLocations: ['US Central QA', 'US Central Staging', 'North America - US Central'],
       maxPeriod: 600000,
       monitorLocationMap: {
@@ -66,6 +69,11 @@ describe('processMonitors', () => {
         ],
         'aa925d91-40b0-4f8f-b695-bb9b53cd4e22': ['US Central QA', 'US Central Staging'],
       },
+      monitorQueryIdToConfigIdMap: {
+        '7f796001-a795-4c0b-afdb-3ce74edea775': '7f796001-a795-4c0b-afdb-3ce74edea775',
+        'aa925d91-40b0-4f8f-b695-bb9b53cd4e22': 'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
+        'test-project-id-default': '5e203f47-1261-4978-a915-cc3315d90fb1',
+      },
     });
   });
 
@@ -77,12 +85,15 @@ describe('processMonitors', () => {
       allIds: [
         'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
         '7f796001-a795-4c0b-afdb-3ce74edea775',
-        '5e203f47-1261-4978-a915-cc3315d90fb1',
+        'test-project-id-default',
       ],
       disabledCount: 2,
       disabledMonitorsCount: 1,
       projectMonitorsCount: 1,
-      enabledIds: ['aa925d91-40b0-4f8f-b695-bb9b53cd4e22', '7f796001-a795-4c0b-afdb-3ce74edea775'],
+      enabledMonitorQueryIds: [
+        'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
+        '7f796001-a795-4c0b-afdb-3ce74edea775',
+      ],
       listOfLocations: [
         'US Central Staging',
         'us_central_qa',
@@ -98,6 +109,11 @@ describe('processMonitors', () => {
         ],
         'aa925d91-40b0-4f8f-b695-bb9b53cd4e22': ['US Central Staging', 'us_central_qa'],
       },
+      monitorQueryIdToConfigIdMap: {
+        '7f796001-a795-4c0b-afdb-3ce74edea775': '7f796001-a795-4c0b-afdb-3ce74edea775',
+        'aa925d91-40b0-4f8f-b695-bb9b53cd4e22': 'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
+        'test-project-id-default': '5e203f47-1261-4978-a915-cc3315d90fb1',
+      },
     });
   });
 
@@ -147,12 +163,15 @@ describe('processMonitors', () => {
       allIds: [
         'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
         '7f796001-a795-4c0b-afdb-3ce74edea775',
-        '5e203f47-1261-4978-a915-cc3315d90fb1',
+        'test-project-id-default',
       ],
       disabledCount: 2,
       disabledMonitorsCount: 1,
       projectMonitorsCount: 1,
-      enabledIds: ['aa925d91-40b0-4f8f-b695-bb9b53cd4e22', '7f796001-a795-4c0b-afdb-3ce74edea775'],
+      enabledMonitorQueryIds: [
+        'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
+        '7f796001-a795-4c0b-afdb-3ce74edea775',
+      ],
       listOfLocations: ['US Central Staging', 'US Central QA', 'North America - US Central'],
       maxPeriod: 600000,
       monitorLocationMap: {
@@ -163,6 +182,11 @@ describe('processMonitors', () => {
         ],
         'aa925d91-40b0-4f8f-b695-bb9b53cd4e22': ['US Central Staging', 'US Central QA'],
       },
+      monitorQueryIdToConfigIdMap: {
+        '7f796001-a795-4c0b-afdb-3ce74edea775': '7f796001-a795-4c0b-afdb-3ce74edea775',
+        'aa925d91-40b0-4f8f-b695-bb9b53cd4e22': 'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
+        'test-project-id-default': '5e203f47-1261-4978-a915-cc3315d90fb1',
+      },
     });
   });
 });
@@ -179,6 +203,7 @@ const testMonitors: any = [
         { isServiceManaged: true, id: 'us_central_staging', label: 'US Central Staging' },
       ],
       id: 'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
+      config_id: 'aa925d91-40b0-4f8f-b695-bb9b53cd4e22',
     },
     references: [],
     migrationVersion: { 'synthetics-monitor': '8.6.0' },
@@ -201,6 +226,7 @@ const testMonitors: any = [
         { isServiceManaged: true, id: 'us_central_staging', label: 'US Central Staging' },
       ],
       id: '7f796001-a795-4c0b-afdb-3ce74edea775',
+      config_id: '7f796001-a795-4c0b-afdb-3ce74edea775',
     },
     references: [],
     migrationVersion: { 'synthetics-monitor': '8.6.0' },
@@ -221,7 +247,8 @@ const testMonitors: any = [
         { id: 'us_central_qa', label: 'US Central QA', isServiceManaged: true },
         { id: 'us_central_staging', label: 'US Central Staging', isServiceManaged: true },
       ],
-      id: '5e203f47-1261-4978-a915-cc3315d90fb1',
+      id: 'test-project-id-default',
+      config_id: '5e203f47-1261-4978-a915-cc3315d90fb1',
       origin: 'project',
     },
     references: [],
diff --git a/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.ts b/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.ts
index 4bb52d9090906..12fe8209e1bb7 100644
--- a/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.ts
+++ b/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.ts
@@ -73,7 +73,7 @@ export const processMonitors = async (
    * latest ping for all enabled monitors.
    */
 
-  const enabledIds: string[] = [];
+  const enabledMonitorQueryIds: string[] = [];
   let disabledCount = 0;
   let disabledMonitorsCount = 0;
   let maxPeriod = 0;
@@ -81,6 +81,7 @@ export const processMonitors = async (
   const allIds: string[] = [];
   let listOfLocationsSet = new Set<string>();
   const monitorLocationMap: Record<string, string[]> = {};
+  const monitorQueryIdToConfigIdMap: Record<string, string> = {};
 
   let allLocations: ServiceLocation[] | null = null;
 
@@ -105,13 +106,15 @@ export const processMonitors = async (
 
     projectMonitorsCount += attrs?.[ConfigKey.MONITOR_SOURCE_TYPE] === SourceType.PROJECT ? 1 : 0;
 
+    monitorQueryIdToConfigIdMap[attrs[ConfigKey.MONITOR_QUERY_ID]] = attrs[ConfigKey.CONFIG_ID];
+
     if (attrs[ConfigKey.ENABLED] === false) {
       disabledCount += attrs[ConfigKey.LOCATIONS].length;
       disabledMonitorsCount += 1;
     } else {
       const missingLabels = new Set<string>();
 
-      enabledIds.push(attrs[ConfigKey.MONITOR_QUERY_ID]);
+      enabledMonitorQueryIds.push(attrs[ConfigKey.MONITOR_QUERY_ID]);
       const monLocs = new Set([
         ...(attrs[ConfigKey.LOCATIONS]
           .filter((loc) => {
@@ -140,11 +143,12 @@ export const processMonitors = async (
   return {
     maxPeriod,
     allIds,
-    enabledIds,
+    enabledMonitorQueryIds,
     disabledCount,
     monitorLocationMap,
     disabledMonitorsCount,
     projectMonitorsCount,
     listOfLocations: [...listOfLocationsSet],
+    monitorQueryIdToConfigIdMap,
   };
 };

From c967f77b0f3a3f80a4ac4103614120966022da96 Mon Sep 17 00:00:00 2001
From: Wonseop Kim <refarde@kakao.com>
Date: Tue, 7 Feb 2023 23:58:10 +0900
Subject: [PATCH 066/134] Remove a unnecessary argument (#150268)

## Summary

Function '_getFilePath' defined at line 19 takes only 1 argument, but 2
were provided.
This patch removes the unnecessary argument.

### Checklist

N/A

Co-authored-by: Jon <jon@elastic.co>
---
 src/cli_plugin/install/download.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cli_plugin/install/download.js b/src/cli_plugin/install/download.js
index ab2ed9f86357b..8dc039cd6305d 100644
--- a/src/cli_plugin/install/download.js
+++ b/src/cli_plugin/install/download.js
@@ -41,7 +41,7 @@ export function _downloadSingle(settings, logger, sourceUrl) {
     _checkFilePathDeprecation(sourceUrl, logger);
     downloadPromise = downloadLocalFile(
       logger,
-      _getFilePath(urlInfo.path, sourceUrl),
+      _getFilePath(urlInfo.path),
       settings.tempArchiveFile
     );
   } else if (/^https?/.test(urlInfo.protocol)) {

From e05797ba36d6372b75d89df3cff68e74d6dafa69 Mon Sep 17 00:00:00 2001
From: christineweng <18648970+christineweng@users.noreply.github.com>
Date: Tue, 7 Feb 2023 09:12:50 -0600
Subject: [PATCH 067/134] [Security Solution] Alert page charts new layout and
 chart collapse (#150242)

## Summary

This PR is part 3 of https://github.com/elastic/kibana/pull/149173 and
https://github.com/elastic/kibana/pull/146938 that add additional KPI
visualizations to the Alerts page.

#### Capabilities added

Charts menu: changed from a drop down selection to tabs format, with
wording that better describe the usage of each charts
Chart collapse: when the toggle is collapsed, instead of showing the
same menu options, a summary of the KPIs are shown.

Feature flag: `alertsPageChartsEnabled` is set to true by default

#### Changes from previous PR
Before this PR, each chart (trend, tree map etc.) keeps its own state of
toggle status. This is no longer suitable because the new layout does
not show options when collapsed. This PR also moves the toggle status to
be at the chart panel's level, and be passed down to each chart
component.

One exception is the histogram (trend analysis), it is currently being
used in alerts detail page and overview dashboard, hence it needs to
keep track of toggle state on its own.

#### When charts are expanded

![image](https://user-images.githubusercontent.com/18648970/216714087-a872cdeb-5d69-40fd-a392-4130ad6c925c.png)

#### When collapsed and has data

![image](https://user-images.githubusercontent.com/18648970/216714168-e4d72ca2-b214-48d8-9182-932927c0b473.png)

#### When collapsed with no data

![image](https://user-images.githubusercontent.com/18648970/216714250-628b96d2-6380-4999-a2a6-ed22eb0d8791.png)


### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
---
 .../common/experimental_features.ts           |   2 +-
 .../cypress/screens/alerts.ts                 |   4 +-
 .../security_solution/cypress/tasks/alerts.ts |   6 +-
 .../components/alerts_treemap/index.test.tsx  |   6 +-
 .../components/alerts_treemap/index.tsx       |   4 +-
 .../alerts_treemap_panel/index.test.tsx       |   4 +-
 .../alerts_by_type_panel/helpers.tsx          |  10 +-
 .../alerts_by_type_panel/index.tsx            |   4 +-
 .../alerts_count_panel/index.test.tsx         |  53 ++++--
 .../alerts_kpis/alerts_count_panel/index.tsx  |  85 ++++++----
 .../alerts_histogram_panel/index.test.tsx     | 131 ++++++++++-----
 .../alerts_histogram_panel/index.tsx          |  53 ++++--
 .../alerts_progress_bar.test.tsx              |   7 +-
 .../alerts_progress_bar.tsx                   |  21 ++-
 .../alerts_progress_bar_panel/helpers.tsx     |  23 ++-
 .../alerts_progress_bar_panel/index.test.tsx  |  28 +++-
 .../alerts_progress_bar_panel/index.tsx       |  57 ++++---
 .../alerts_progress_bar_panel/translations.ts |  25 +++
 .../alerts_progress_bar_panel/types.ts        |   1 +
 .../aggregations.ts                           |   3 +-
 .../alerts_summary_charts_panel/helpers.tsx   |  23 ++-
 .../index.test.tsx                            |  41 ++++-
 .../alerts_summary_charts_panel/index.tsx     |  57 +++++--
 .../alerts_summary_charts_panel/types.ts      |  34 ++--
 .../severity_level_panel/helpers.tsx          |  10 +-
 .../severity_level_panel/index.tsx            |   4 +-
 .../alerts_local_storage/constants.ts         |   3 +
 .../alerts_local_storage/index.test.tsx       |   1 +
 .../alerts_local_storage/index.tsx            |  14 ++
 .../alerts_local_storage/types.ts             |   4 +-
 .../chart_collapse/helpers.test.tsx           |  37 +++++
 .../chart_panels/chart_collapse/helpers.tsx   |  51 ++++++
 .../chart_collapse/index.test.tsx             |  95 +++++++++++
 .../chart_panels/chart_collapse/index.tsx     | 149 +++++++++++++++++
 .../chart_panels/chart_collapse/mock_data.ts  | 152 ++++++++++++++++++
 .../chart_collapse/translations.ts            |  29 ++++
 .../chart_panels/chart_collapse/types.ts      |  34 ++++
 .../chart_panels/chart_select/helpers.test.ts |  39 +++++
 .../chart_panels/chart_select/helpers.ts      |  41 ++++-
 .../chart_panels/chart_select/index.test.tsx  |  58 +++++--
 .../chart_panels/chart_select/index.tsx       |  42 +++--
 .../chart_panels/chart_select/translations.ts |  35 ++++
 .../chart_panels/index.test.tsx               |  81 +++++++++-
 .../detection_engine/chart_panels/index.tsx   | 106 ++++++++----
 .../detection_engine/detection_engine.tsx     |   4 +-
 45 files changed, 1420 insertions(+), 251 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/helpers.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/helpers.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/index.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/mock_data.ts
 create mode 100644 x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/translations.ts
 create mode 100644 x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/types.ts

diff --git a/x-pack/plugins/security_solution/common/experimental_features.ts b/x-pack/plugins/security_solution/common/experimental_features.ts
index 52ab4a8cb8d73..5863d525ca0f8 100644
--- a/x-pack/plugins/security_solution/common/experimental_features.ts
+++ b/x-pack/plugins/security_solution/common/experimental_features.ts
@@ -89,7 +89,7 @@ export const allowedExperimentalValues = Object.freeze({
   /**
    * Enables top charts on Alerts Page
    */
-  alertsPageChartsEnabled: false,
+  alertsPageChartsEnabled: true,
 
   /**
    * Keep DEPRECATED experimental flags that are documented to prevent failed upgrades.
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts.ts b/x-pack/plugins/security_solution/cypress/screens/alerts.ts
index 24d8ad383b73f..046962a5d9685 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts.ts
@@ -32,8 +32,6 @@ export const ALERTS_COUNT =
 export const ALERTS_TREND_SIGNAL_RULE_NAME_PANEL =
   '[data-test-subj="render-content-kibana.alert.rule.name"]';
 
-export const CHART_SELECT = '[data-test-subj="chartSelect"]';
-
 export const CLOSE_ALERT_BTN = '[data-test-subj="close-alert-status"]';
 
 export const CLOSE_SELECTED_ALERTS_BTN = '[data-test-subj="close-alert-status"]';
@@ -92,7 +90,7 @@ export const RULE_NAME = '[data-test-subj^=formatted-field][data-test-subj$=rule
 
 export const SELECTED_ALERTS = '[data-test-subj="selectedShowBulkActionsButton"]';
 
-export const SELECT_TABLE = '[data-test-subj="table"]';
+export const SELECT_AGGREGATION_CHART = '[data-test-subj="chart-select-table"]';
 
 export const SEND_ALERT_TO_TIMELINE_BTN = '[data-test-subj="send-alert-to-timeline-button"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
index 9dfb269433865..c7810db6ae21d 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
@@ -8,7 +8,6 @@
 import {
   ADD_EXCEPTION_BTN,
   ALERT_CHECKBOX,
-  CHART_SELECT,
   CLOSE_ALERT_BTN,
   CLOSE_SELECTED_ALERTS_BTN,
   EXPAND_ALERT_BTN,
@@ -18,7 +17,7 @@ import {
   MARK_ALERT_ACKNOWLEDGED_BTN,
   OPEN_ALERT_BTN,
   SEND_ALERT_TO_TIMELINE_BTN,
-  SELECT_TABLE,
+  SELECT_AGGREGATION_CHART,
   TAKE_ACTION_POPOVER_BTN,
   TIMELINE_CONTEXT_MENU_BTN,
   CLOSE_FLYOUT,
@@ -257,8 +256,7 @@ export const openAlerts = () => {
 };
 
 export const selectCountTable = () => {
-  cy.get(CHART_SELECT).click({ force: true });
-  cy.get(SELECT_TABLE).click();
+  cy.get(SELECT_AGGREGATION_CHART).click({ force: true });
 };
 
 export const clearGroupByTopInput = () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/index.test.tsx
index 8f53a3f226ce6..75f641501dc52 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/index.test.tsx
@@ -49,7 +49,7 @@ describe('AlertsTreemap', () => {
     });
 
     test('it renders the treemap', () => {
-      expect(screen.getByTestId('treemap').querySelector('.echChart')).toBeInTheDocument();
+      expect(screen.getByTestId('alerts-treemap').querySelector('.echChart')).toBeInTheDocument();
     });
 
     test('it renders the legend with the expected overflow-y style', () => {
@@ -71,7 +71,7 @@ describe('AlertsTreemap', () => {
     });
 
     test('it does NOT render the treemap', () => {
-      expect(screen.queryByTestId('treemap')).not.toBeInTheDocument();
+      expect(screen.queryByTestId('alerts-treemap')).not.toBeInTheDocument();
     });
 
     test('it does NOT render the legend', () => {
@@ -127,7 +127,7 @@ describe('AlertsTreemap', () => {
     });
 
     test('it renders the treemap', () => {
-      expect(screen.getByTestId('treemap').querySelector('.echChart')).toBeInTheDocument();
+      expect(screen.getByTestId('alerts-treemap').querySelector('.echChart')).toBeInTheDocument();
     });
 
     test('it does NOT render the "no data" message', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/index.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/index.tsx
index fc6edda0c90b9..1683bba36c1c7 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap/index.tsx
@@ -31,7 +31,7 @@ import { NoData } from './no_data';
 import { NO_DATA_REASON_LABEL } from './translations';
 import type { AlertsTreeMapAggregation, FlattenedBucket, RawBucket } from './types';
 
-export const DEFAULT_MIN_CHART_HEIGHT = 370; // px
+export const DEFAULT_MIN_CHART_HEIGHT = 240; // px
 const DEFAULT_LEGEND_WIDTH = 300; // px
 
 export interface Props {
@@ -165,7 +165,7 @@ const AlertsTreemapComponent: React.FC<Props> = ({
   }
 
   return (
-    <div data-test-subj="treemap">
+    <div data-test-subj="alerts-treemap">
       <EuiFlexGroup gutterSize="none">
         <ChartFlexItem grow={true} $minChartHeight={minChartHeight}>
           {stackByField1 != null && !isEmpty(stackByField1) && normalizedData.length === 0 ? (
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_treemap_panel/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_treemap_panel/index.test.tsx
index 0db21ee27ea75..5a3f4b3e25e0e 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_treemap_panel/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_treemap_panel/index.test.tsx
@@ -214,7 +214,7 @@ describe('AlertsTreemapPanel', () => {
       </TestProviders>
     );
 
-    await waitFor(() => expect(screen.getByTestId('chartSelect')).toBeInTheDocument());
+    await waitFor(() => expect(screen.getByTestId('chart-select-tabs')).toBeInTheDocument());
   });
 
   it('renders field selection when `isPanelExpanded` is true', async () => {
@@ -305,6 +305,6 @@ describe('AlertsTreemapPanel', () => {
       </TestProviders>
     );
 
-    await waitFor(() => expect(screen.getByTestId('treemap')).toBeInTheDocument());
+    await waitFor(() => expect(screen.getByTestId('alerts-treemap')).toBeInTheDocument());
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/helpers.tsx
index ad357b81b5e22..94246f6932178 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/helpers.tsx
@@ -7,7 +7,7 @@
 import { has } from 'lodash';
 import type { AlertType, AlertsByTypeAgg, AlertsTypeData } from './types';
 import type { AlertSearchResponse } from '../../../containers/detection_engine/alerts/types';
-import type { SummaryChartsData } from '../alerts_summary_charts_panel/types';
+import type { SummaryChartsData, SummaryChartsAgg } from '../alerts_summary_charts_panel/types';
 
 export const ALERT_TYPE_COLOR = {
   Detection: '#D36086',
@@ -59,6 +59,12 @@ const getAggregateAlerts = (
   return ret;
 };
 
-export const isAlertsTypeData = (data: SummaryChartsData[]): data is AlertsTypeData[] => {
+export const getIsAlertsTypeData = (data: SummaryChartsData[]): data is AlertsTypeData[] => {
   return data?.every((x) => has(x, 'type'));
 };
+
+export const getIsAlertsByTypeAgg = (
+  data: AlertSearchResponse<{}, SummaryChartsAgg>
+): data is AlertSearchResponse<{}, AlertsByTypeAgg> => {
+  return has(data, 'aggregations.alertsByRule');
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/index.tsx
index 666be899d2a17..391057796dd7d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_by_type_panel/index.tsx
@@ -14,7 +14,7 @@ import { HeaderSection } from '../../../../common/components/header_section';
 import { InspectButtonContainer } from '../../../../common/components/inspect';
 import { useSummaryChartData } from '../alerts_summary_charts_panel/use_summary_chart_data';
 import { alertTypeAggregations } from '../alerts_summary_charts_panel/aggregations';
-import { isAlertsTypeData } from './helpers';
+import { getIsAlertsTypeData } from './helpers';
 import * as i18n from './translations';
 
 const ALERTS_BY_TYPE_CHART_ID = 'alerts-summary-alert_by_type';
@@ -37,7 +37,7 @@ export const AlertsByTypePanel: React.FC<ChartsPanelProps> = ({
     skip,
     uniqueQueryId,
   });
-  const data = useMemo(() => (isAlertsTypeData(items) ? items : []), [items]);
+  const data = useMemo(() => (getIsAlertsTypeData(items) ? items : []), [items]);
 
   return (
     <InspectButtonContainer>
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.test.tsx
index cc2e5ca8c78d0..067b5e2e86f14 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.test.tsx
@@ -8,7 +8,6 @@
 import React from 'react';
 import { waitFor, act } from '@testing-library/react';
 import { mount } from 'enzyme';
-
 import { AlertsCountPanel } from '.';
 
 import type { Status } from '../../../../../common/detection_engine/schemas/common';
@@ -61,25 +60,31 @@ jest.mock('../common/hooks', () => ({
   useInspectButton: jest.fn(),
   useStackByFields: jest.fn(),
 }));
+const mockUseIsExperimentalFeatureEnabled = useIsExperimentalFeatureEnabled as jest.Mock;
+jest.mock('../../../../common/hooks/use_experimental_features');
 
 const defaultProps = {
   inspectTitle: TABLE,
+  signalIndexName: 'signalIndexName',
+  stackByField0: DEFAULT_STACK_BY_FIELD,
+  stackByField1: DEFAULT_STACK_BY_FIELD1,
   setStackByField0: jest.fn(),
   setStackByField1: jest.fn(),
+  isExpanded: true,
+  setIsExpanded: jest.fn(),
   showBuildingBlockAlerts: false,
   showOnlyThreatIndicatorAlerts: false,
-  signalIndexName: 'signalIndexName',
-  stackByField0: DEFAULT_STACK_BY_FIELD,
-  stackByField1: DEFAULT_STACK_BY_FIELD1,
   status: 'open' as Status,
 };
-const mockUseQueryToggle = useQueryToggle as jest.Mock;
 const mockSetToggle = jest.fn();
+const mockUseQueryToggle = useQueryToggle as jest.Mock;
 
 describe('AlertsCountPanel', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     mockUseQueryToggle.mockReturnValue({ toggleStatus: true, setToggleStatus: mockSetToggle });
+    mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for chartEmbeddablesEnabled flag
+    mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for alertsPageChartsEnabled flag
   });
 
   it('renders correctly', async () => {
@@ -177,6 +182,7 @@ describe('AlertsCountPanel', () => {
       });
     });
   });
+
   describe('toggleQuery', () => {
     it('toggles', async () => {
       await act(async () => {
@@ -189,7 +195,7 @@ describe('AlertsCountPanel', () => {
         expect(mockSetToggle).toBeCalledWith(false);
       });
     });
-    it('toggleStatus=true, render', async () => {
+    it('alertsPageChartsEnabled is false and toggleStatus=true, render', async () => {
       await act(async () => {
         const wrapper = mount(
           <TestProviders>
@@ -199,7 +205,7 @@ describe('AlertsCountPanel', () => {
         expect(wrapper.find('[data-test-subj="alertsCountTable"]').exists()).toEqual(true);
       });
     });
-    it('toggleStatus=false, hide', async () => {
+    it('alertsPageChartsEnabled is false and toggleStatus=false, hide', async () => {
       mockUseQueryToggle.mockReturnValue({ toggleStatus: false, setToggleStatus: mockSetToggle });
       await act(async () => {
         const wrapper = mount(
@@ -210,16 +216,41 @@ describe('AlertsCountPanel', () => {
         expect(wrapper.find('[data-test-subj="alertsCountTable"]').exists()).toEqual(false);
       });
     });
+
+    it('alertsPageChartsEnabled is true and isExpanded=true, render', async () => {
+      mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for chartEmbeddablesEnabled flag
+      mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(true); // for alertsPageChartsEnabled flag
+      await act(async () => {
+        mockUseIsExperimentalFeatureEnabled('charts', true);
+        const wrapper = mount(
+          <TestProviders>
+            <AlertsCountPanel {...defaultProps} />
+          </TestProviders>
+        );
+        expect(wrapper.find('[data-test-subj="alertsCountTable"]').exists()).toEqual(true);
+      });
+    });
+    it('alertsPageChartsEnabled is true and isExpanded=false, hide', async () => {
+      mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for chartEmbeddablesEnabled flag
+      mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(true); // for alertsPageChartsEnabled flag
+      await act(async () => {
+        const wrapper = mount(
+          <TestProviders>
+            <AlertsCountPanel {...defaultProps} isExpanded={false} />
+          </TestProviders>
+        );
+        expect(wrapper.find('[data-test-subj="alertsCountTable"]').exists()).toEqual(false);
+      });
+    });
   });
 });
 
 describe('when isChartEmbeddablesEnabled = true', () => {
   beforeEach(() => {
     jest.clearAllMocks();
-
     mockUseQueryToggle.mockReturnValue({ toggleStatus: true, setToggleStatus: mockSetToggle });
-
-    (useIsExperimentalFeatureEnabled as jest.Mock).mockReturnValue(true);
+    mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(true); // for chartEmbeddablesEnabled flag
+    mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for alertsPageChartsEnabled flag
   });
 
   it('renders LensEmbeddable', async () => {
@@ -229,7 +260,7 @@ describe('when isChartEmbeddablesEnabled = true', () => {
           <AlertsCountPanel {...defaultProps} />
         </TestProviders>
       );
-      expect(wrapper.find('[data-test-subj="lens-embeddable"]').exists()).toBeTruthy();
+      expect(wrapper.find('[data-test-subj="embeddable-count-table"]').exists()).toBeTruthy();
     });
   });
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.tsx
index c0b4d8bff6dfa..8dbfb949cdaec 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.tsx
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { EuiProgress } from '@elastic/eui';
 import type { EuiComboBox } from '@elastic/eui';
 import type { Action } from '@kbn/ui-actions-plugin/public';
 import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/types';
@@ -54,6 +55,8 @@ interface AlertsCountPanelProps {
   stackByField1ComboboxRef?: React.RefObject<EuiComboBox<string | number | string[] | undefined>>;
   stackByWidth?: number;
   title?: React.ReactNode;
+  isExpanded?: boolean;
+  setIsExpanded?: (status: boolean) => void;
 }
 const CHART_HEIGHT = '180px';
 
@@ -78,9 +81,12 @@ export const AlertsCountPanel = memo<AlertsCountPanelProps>(
     stackByField1ComboboxRef,
     stackByWidth,
     title = i18n.COUNT_TABLE_TITLE,
+    isExpanded,
+    setIsExpanded,
   }) => {
     const { to, from, deleteQuery, setQuery } = useGlobalTime(false);
-
+    const isChartEmbeddablesEnabled = useIsExperimentalFeatureEnabled('chartEmbeddablesEnabled');
+    const isAlertsPageChartsEnabled = useIsExperimentalFeatureEnabled('alertsPageChartsEnabled');
     // create a unique, but stable (across re-renders) query id
     const uniqueQueryId = useMemo(() => `${DETECTIONS_ALERTS_COUNT_ID}-${uuidv4()}`, []);
 
@@ -102,20 +108,30 @@ export const AlertsCountPanel = memo<AlertsCountPanelProps>(
     }, [query, filters]);
 
     const { toggleStatus, setToggleStatus } = useQueryToggle(DETECTIONS_ALERTS_COUNT_ID);
-    const [querySkip, setQuerySkip] = useState(!toggleStatus);
+    const [querySkip, setQuerySkip] = useState(
+      isAlertsPageChartsEnabled ? !isExpanded : !toggleStatus
+    );
     useEffect(() => {
-      setQuerySkip(!toggleStatus);
-    }, [toggleStatus]);
+      if (isAlertsPageChartsEnabled) {
+        setQuerySkip(!isExpanded);
+      } else {
+        setQuerySkip(!toggleStatus);
+      }
+    }, [toggleStatus, isAlertsPageChartsEnabled, isExpanded]);
+
     const toggleQuery = useCallback(
       (newToggleStatus: boolean) => {
-        setToggleStatus(newToggleStatus);
+        if (isAlertsPageChartsEnabled && setIsExpanded) {
+          setIsExpanded(newToggleStatus);
+        } else {
+          setToggleStatus(newToggleStatus);
+        }
         // toggle on = skipQuery false
         setQuerySkip(!newToggleStatus);
       },
-      [setQuerySkip, setToggleStatus]
+      [setQuerySkip, setToggleStatus, setIsExpanded, isAlertsPageChartsEnabled]
     );
 
-    const isChartEmbeddablesEnabled = useIsExperimentalFeatureEnabled('chartEmbeddablesEnabled');
     const timerange = useMemo(() => ({ from, to }), [from, to]);
 
     const extraVisualizationOptions = useMemo(
@@ -176,11 +192,19 @@ export const AlertsCountPanel = memo<AlertsCountPanelProps>(
       setQuery,
       uniqueQueryId,
     });
+    const showCount = useMemo(() => {
+      if (isAlertsPageChartsEnabled) {
+        return isExpanded;
+      }
+      return toggleStatus;
+    }, [isAlertsPageChartsEnabled, toggleStatus, isExpanded]);
 
     return (
-      <InspectButtonContainer show={toggleStatus}>
+      <InspectButtonContainer show={isAlertsPageChartsEnabled ? isExpanded : toggleStatus}>
         <KpiPanel
-          $toggleStatus={toggleStatus}
+          $toggleStatus={
+            isAlertsPageChartsEnabled && isExpanded !== undefined ? isExpanded : toggleStatus
+          }
           data-test-subj="alertsCountPanel"
           hasBorder
           height={panelHeight}
@@ -194,7 +218,7 @@ export const AlertsCountPanel = memo<AlertsCountPanelProps>(
             titleSize="s"
             hideSubtitle
             showInspectButton={chartOptionsContextMenu == null}
-            toggleStatus={toggleStatus}
+            toggleStatus={isAlertsPageChartsEnabled ? isExpanded : toggleStatus}
             toggleQuery={toggleQuery}
           >
             <FieldSelection
@@ -213,25 +237,28 @@ export const AlertsCountPanel = memo<AlertsCountPanelProps>(
               uniqueQueryId={uniqueQueryId}
             />
           </HeaderSection>
-          {toggleStatus ? (
-            <ChartContent
-              alertsData={alertsData}
-              data-test-subj="embeddable-matrix-histogram"
-              extraActions={extraActions}
-              extraOptions={extraVisualizationOptions}
-              getLensAttributes={getLensAttributes}
-              height={CHART_HEIGHT}
-              id={`${uniqueQueryId}-embeddable`}
-              inspectTitle={inspectTitle}
-              isChartEmbeddablesEnabled={isChartEmbeddablesEnabled}
-              isLoadingAlerts={isLoadingAlerts}
-              scopeId={SourcererScopeName.detections}
-              stackByField0={stackByField0}
-              stackByField1={stackByField1}
-              stackByField={stackByField0}
-              timerange={timerange}
-            />
-          ) : null}
+          {showCount &&
+            (isLoadingAlerts ? (
+              <EuiProgress color="accent" data-test-subj="progress" position="absolute" size="xs" />
+            ) : (
+              <ChartContent
+                alertsData={alertsData}
+                data-test-subj="embeddable-count-table"
+                extraActions={extraActions}
+                extraOptions={extraVisualizationOptions}
+                getLensAttributes={getLensAttributes}
+                height={CHART_HEIGHT}
+                id={`${uniqueQueryId}-embeddable`}
+                inspectTitle={inspectTitle}
+                isChartEmbeddablesEnabled={isChartEmbeddablesEnabled}
+                isLoadingAlerts={isLoadingAlerts}
+                scopeId={SourcererScopeName.detections}
+                stackByField0={stackByField0}
+                stackByField1={stackByField1}
+                stackByField={stackByField0}
+                timerange={timerange}
+              />
+            ))}
         </KpiPanel>
       </InspectButtonContainer>
     );
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.test.tsx
index a90b86dc4f4cd..347f207266524 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.test.tsx
@@ -109,24 +109,23 @@ jest.mock('../common/hooks', () => {
   };
 });
 
-describe('AlertsHistogramPanel', () => {
-  const defaultProps = {
-    setQuery: jest.fn(),
-    showBuildingBlockAlerts: false,
-    showOnlyThreatIndicatorAlerts: false,
-    signalIndexName: 'signalIndexName',
-    updateDateRange: jest.fn(),
-  };
+const mockUseIsExperimentalFeatureEnabled = useIsExperimentalFeatureEnabled as jest.Mock;
+jest.mock('../../../../common/hooks/use_experimental_features');
 
-  const mockSetToggle = jest.fn();
-  const mockUseQueryToggle = useQueryToggle as jest.Mock;
-  beforeEach(() => {
-    mockUseQueryToggle.mockReturnValue({ toggleStatus: true, setToggleStatus: mockSetToggle });
-  });
+const defaultProps = {
+  setQuery: jest.fn(),
+  showBuildingBlockAlerts: false,
+  showOnlyThreatIndicatorAlerts: false,
+  signalIndexName: 'signalIndexName',
+  updateDateRange: jest.fn(),
+};
+const mockSetToggle = jest.fn();
+const mockUseQueryToggle = useQueryToggle as jest.Mock;
 
-  afterEach(() => {
+describe('AlertsHistogramPanel', () => {
+  beforeEach(() => {
     jest.clearAllMocks();
-    jest.restoreAllMocks();
+    mockUseQueryToggle.mockReturnValue({ toggleStatus: true, setToggleStatus: mockSetToggle });
   });
 
   it('renders correctly', () => {
@@ -690,26 +689,85 @@ describe('AlertsHistogramPanel', () => {
         expect(mockSetToggle).toBeCalledWith(false);
       });
     });
-    it('toggleStatus=true, render', async () => {
-      await act(async () => {
-        const wrapper = mount(
-          <TestProviders>
-            <AlertsHistogramPanel {...defaultProps} />
-          </TestProviders>
-        );
 
-        expect(wrapper.find(MatrixLoader).exists()).toEqual(true);
+    describe('when alertsPageChartsEnabled = false', () => {
+      beforeEach(() => {
+        jest.clearAllMocks();
+        mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for chartEmbeddablesEnabled flag
+        mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for alertsPageChartsEnabled flag
+      });
+
+      it('toggleStatus=true, render', async () => {
+        await act(async () => {
+          const wrapper = mount(
+            <TestProviders>
+              <AlertsHistogramPanel {...defaultProps} />
+            </TestProviders>
+          );
+
+          expect(wrapper.find(MatrixLoader).exists()).toEqual(true);
+        });
+      });
+      it('toggleStatus=false, hide', async () => {
+        mockUseQueryToggle.mockReturnValue({ toggleStatus: false, setToggleStatus: mockSetToggle });
+        await act(async () => {
+          const wrapper = mount(
+            <TestProviders>
+              <AlertsHistogramPanel {...defaultProps} />
+            </TestProviders>
+          );
+          expect(wrapper.find(MatrixLoader).exists()).toEqual(false);
+        });
       });
     });
-    it('toggleStatus=false, hide', async () => {
-      mockUseQueryToggle.mockReturnValue({ toggleStatus: false, setToggleStatus: mockSetToggle });
-      await act(async () => {
-        const wrapper = mount(
-          <TestProviders>
-            <AlertsHistogramPanel {...defaultProps} />
-          </TestProviders>
-        );
-        expect(wrapper.find(MatrixLoader).exists()).toEqual(false);
+
+    describe('when alertsPageChartsEnabled = true', () => {
+      beforeEach(() => {
+        jest.clearAllMocks();
+        mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for chartEmbeddablesEnabled flag
+        mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(true); // for alertsPageChartsEnabled flag
+      });
+
+      it('isExpanded=true, render', async () => {
+        await act(async () => {
+          const wrapper = mount(
+            <TestProviders>
+              <AlertsHistogramPanel {...defaultProps} isExpanded={true} />
+            </TestProviders>
+          );
+          expect(wrapper.find(MatrixLoader).exists()).toEqual(true);
+        });
+      });
+      it('isExpanded=false, hide', async () => {
+        await act(async () => {
+          const wrapper = mount(
+            <TestProviders>
+              <AlertsHistogramPanel {...defaultProps} isExpanded={false} />
+            </TestProviders>
+          );
+          expect(wrapper.find(MatrixLoader).exists()).toEqual(false);
+        });
+      });
+      it('isExpanded is not passed in and toggleStatus =true, render', async () => {
+        await act(async () => {
+          const wrapper = mount(
+            <TestProviders>
+              <AlertsHistogramPanel {...defaultProps} />
+            </TestProviders>
+          );
+          expect(wrapper.find(MatrixLoader).exists()).toEqual(true);
+        });
+      });
+      it('isExpanded is not passed in and toggleStatus =false, hide', async () => {
+        mockUseQueryToggle.mockReturnValue({ toggleStatus: false, setToggleStatus: mockSetToggle });
+        await act(async () => {
+          const wrapper = mount(
+            <TestProviders>
+              <AlertsHistogramPanel {...defaultProps} />
+            </TestProviders>
+          );
+          expect(wrapper.find(MatrixLoader).exists()).toEqual(false);
+        });
       });
     });
   });
@@ -717,10 +775,9 @@ describe('AlertsHistogramPanel', () => {
   describe('when isChartEmbeddablesEnabled = true', () => {
     beforeEach(() => {
       jest.clearAllMocks();
-
       mockUseQueryToggle.mockReturnValue({ toggleStatus: true, setToggleStatus: mockSetToggle });
-
-      (useIsExperimentalFeatureEnabled as jest.Mock).mockReturnValue(true);
+      mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(true); // for chartEmbeddablesEnabled flag
+      mockUseIsExperimentalFeatureEnabled.mockReturnValueOnce(false); // for alertsPageChartsEnabled flag
     });
 
     it('renders LensEmbeddable', async () => {
@@ -730,7 +787,9 @@ describe('AlertsHistogramPanel', () => {
             <AlertsHistogramPanel {...defaultProps} />
           </TestProviders>
         );
-        expect(wrapper.find('[data-test-subj="lens-embeddable"]').exists()).toBeTruthy();
+        expect(
+          wrapper.find('[data-test-subj="embeddable-matrix-histogram"]').exists()
+        ).toBeTruthy();
       });
     });
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
index c948eb26a1ba8..de52db990d5c7 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
@@ -109,6 +109,8 @@ interface AlertsHistogramPanelProps {
   titleSize?: EuiTitleSize;
   updateDateRange: UpdateDateRange;
   hideQueryToggle?: boolean;
+  isExpanded?: boolean;
+  setIsExpanded?: (status: boolean) => void;
 }
 
 const NO_LEGEND_DATA: LegendItem[] = [];
@@ -147,6 +149,8 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
     titleSize = 'm',
     updateDateRange,
     hideQueryToggle = false,
+    isExpanded,
+    setIsExpanded,
   }) => {
     const { to, from, deleteQuery, setQuery } = useGlobalTime(false);
 
@@ -159,6 +163,9 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
     const [selectedStackByOption, setSelectedStackByOption] = useState<string>(
       onlyField == null ? defaultStackByOption : onlyField
     );
+    const isChartEmbeddablesEnabled = useIsExperimentalFeatureEnabled('chartEmbeddablesEnabled');
+    const isAlertsPageChartsEnabled = useIsExperimentalFeatureEnabled('alertsPageChartsEnabled');
+
     const onSelect = useCallback(
       (field: string) => {
         setSelectedStackByOption(field);
@@ -174,20 +181,30 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
     }, [defaultStackByOption, onlyField]);
 
     const { toggleStatus, setToggleStatus } = useQueryToggle(DETECTIONS_HISTOGRAM_ID);
-    const [querySkip, setQuerySkip] = useState(!toggleStatus);
+    const [querySkip, setQuerySkip] = useState(
+      isAlertsPageChartsEnabled ? !isExpanded : !toggleStatus
+    );
     useEffect(() => {
-      setQuerySkip(!toggleStatus);
-    }, [toggleStatus]);
+      if (isAlertsPageChartsEnabled && isExpanded !== undefined) {
+        setQuerySkip(!isExpanded);
+      } else {
+        setQuerySkip(!toggleStatus);
+      }
+    }, [toggleStatus, isAlertsPageChartsEnabled, isExpanded]);
+
     const toggleQuery = useCallback(
       (newToggleStatus: boolean) => {
-        setToggleStatus(newToggleStatus);
+        if (isAlertsPageChartsEnabled && setIsExpanded !== undefined) {
+          setIsExpanded(newToggleStatus);
+        } else {
+          setToggleStatus(newToggleStatus);
+        }
         // toggle on = skipQuery false
         setQuerySkip(!newToggleStatus);
       },
-      [setQuerySkip, setToggleStatus]
+      [setQuerySkip, setToggleStatus, setIsExpanded, isAlertsPageChartsEnabled]
     );
 
-    const isChartEmbeddablesEnabled = useIsExperimentalFeatureEnabled('chartEmbeddablesEnabled');
     const timerange = useMemo(() => ({ from, to }), [from, to]);
 
     const {
@@ -347,14 +364,28 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
       [onlyField, title]
     );
 
+    const showHistogram = useMemo(() => {
+      if (isAlertsPageChartsEnabled) {
+        if (isExpanded !== undefined) {
+          // alerts page
+          return isExpanded;
+        } else {
+          // rule details page and overview page
+          return toggleStatus;
+        }
+      } else {
+        return toggleStatus;
+      }
+    }, [isAlertsPageChartsEnabled, isExpanded, toggleStatus]);
+
     return (
-      <InspectButtonContainer show={!isInitialLoading && toggleStatus}>
+      <InspectButtonContainer show={!isInitialLoading && showHistogram}>
         <KpiPanel
           height={panelHeight}
           hasBorder
           paddingSize={paddingSize}
           data-test-subj="alerts-histogram-panel"
-          $toggleStatus={toggleStatus}
+          $toggleStatus={showHistogram}
         >
           <HeaderSection
             alignHeader={alignHeader}
@@ -363,7 +394,7 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
             outerDirection="row"
             title={titleText}
             titleSize={titleSize}
-            toggleStatus={toggleStatus}
+            toggleStatus={showHistogram}
             toggleQuery={hideQueryToggle ? undefined : toggleQuery}
             showInspectButton={isChartEmbeddablesEnabled ? false : chartOptionsContextMenu == null}
             subtitle={!isInitialLoading && showTotalAlertsCount && totalAlerts}
@@ -410,12 +441,10 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
                   {chartOptionsContextMenu(uniqueQueryId)}
                 </OptionsFlexItem>
               )}
-
               {linkButton}
             </EuiFlexGroup>
           </HeaderSection>
-
-          {toggleStatus ? (
+          {showHistogram ? (
             isChartEmbeddablesEnabled ? (
               <VisualizationEmbeddable
                 data-test-subj="embeddable-matrix-histogram"
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.test.tsx
index 5f8141ad57e8e..1d972ff929e0f 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.test.tsx
@@ -9,6 +9,7 @@ import React from 'react';
 import { TestProviders } from '../../../../common/mock';
 import { AlertsProgressBar } from './alerts_progress_bar';
 import { parsedAlerts } from './mock_data';
+import type { GroupBySelection } from './types';
 
 jest.mock('../../../../common/lib/kibana');
 
@@ -21,7 +22,7 @@ describe('Alert by grouping', () => {
   const defaultProps = {
     data: [],
     isLoading: false,
-    stackByField: 'host.name',
+    groupBySelection: 'host.name' as GroupBySelection,
   };
 
   afterEach(() => {
@@ -38,7 +39,7 @@ describe('Alert by grouping', () => {
       );
       expect(
         container.querySelector(`[data-test-subj="alerts-progress-bar-title"]`)?.textContent
-      ).toEqual(defaultProps.stackByField);
+      ).toEqual(defaultProps.groupBySelection);
       expect(container.querySelector(`[data-test-subj="empty-proress-bar"]`)).toBeInTheDocument();
       expect(container.querySelector(`[data-test-subj="empty-proress-bar"]`)?.textContent).toEqual(
         'No items found'
@@ -50,7 +51,7 @@ describe('Alert by grouping', () => {
     act(() => {
       const { container } = render(
         <TestProviders>
-          <AlertsProgressBar data={parsedAlerts} isLoading={false} stackByField={'host.name'} />
+          <AlertsProgressBar data={parsedAlerts} isLoading={false} groupBySelection={'host.name'} />
         </TestProviders>
       );
       expect(
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.tsx
index e20f10543845e..378544084228d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/alerts_progress_bar.tsx
@@ -7,7 +7,7 @@
 import { EuiProgress, EuiSpacer, EuiText, EuiHorizontalRule } from '@elastic/eui';
 import React from 'react';
 import styled from 'styled-components';
-import type { AlertsProgressBarData } from './types';
+import type { AlertsProgressBarData, GroupBySelection } from './types';
 import { DefaultDraggable } from '../../../../common/components/draggables';
 import * as i18n from './translations';
 
@@ -18,25 +18,32 @@ const ProgressWrapper = styled.div`
 const StyledEuiText = styled(EuiText)`
   margin-top: -${({ theme }) => theme.eui.euiSizeM};
 `;
-
+const StyledEuiProgress = styled(EuiProgress)`
+  margin-top: ${({ theme }) => theme.eui.euiSizeS};
+  margin-bottom: ${({ theme }) => theme.eui.euiSizeS};
+`;
 export interface AlertsProcessBarProps {
   data: AlertsProgressBarData[];
   isLoading: boolean;
-  stackByField: string;
   addFilter?: ({ field, value }: { field: string; value: string | number }) => void;
+  groupBySelection: GroupBySelection;
 }
 
 export const AlertsProgressBar: React.FC<AlertsProcessBarProps> = ({
   data,
   isLoading,
-  stackByField,
+  groupBySelection,
 }) => {
   return (
     <>
       <StyledEuiText size="s" data-test-subj="alerts-progress-bar-title">
-        <h5>{stackByField}</h5>
+        <h5>{groupBySelection}</h5>
       </StyledEuiText>
-      <EuiHorizontalRule margin="xs" />
+      {isLoading ? (
+        <StyledEuiProgress size="xs" color="primary" />
+      ) : (
+        <EuiHorizontalRule margin="xs" />
+      )}
       {!isLoading && data.length === 0 ? (
         <>
           <EuiText size="s" textAlign="center" data-test-subj="empty-proress-bar">
@@ -64,7 +71,7 @@ export const AlertsProgressBar: React.FC<AlertsProcessBarProps> = ({
                   ) : (
                     <DefaultDraggable
                       isDraggable={false}
-                      field={stackByField}
+                      field={groupBySelection}
                       hideTopN={true}
                       id={`top-alerts-${item.key}`}
                       value={item.key}
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/helpers.tsx
index 2540f0f4dda7e..a441f41094c5d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/helpers.tsx
@@ -6,10 +6,10 @@
  */
 
 import { has } from 'lodash';
-import type { AlertsByGroupingAgg, AlertsProgressBarData } from './types';
+import type { AlertsByGroupingAgg, AlertsProgressBarData, GroupBySelection } from './types';
 import type { AlertSearchResponse } from '../../../containers/detection_engine/alerts/types';
 import type { BucketItem } from '../../../../../common/search_strategy/security_solution/cti';
-import type { SummaryChartsData } from '../alerts_summary_charts_panel/types';
+import type { SummaryChartsData, SummaryChartsAgg } from '../alerts_summary_charts_panel/types';
 import * as i18n from './translations';
 
 export const parseAlertsGroupingData = (
@@ -43,8 +43,25 @@ export const parseAlertsGroupingData = (
   return topAlerts;
 };
 
-export const isAlertsProgressBarData = (
+export const getIsAlertsProgressBarData = (
   data: SummaryChartsData[]
 ): data is AlertsProgressBarData[] => {
   return data?.every((x) => has(x, 'percentage'));
 };
+
+export const getIsAlertsByGroupingAgg = (
+  data: AlertSearchResponse<{}, SummaryChartsAgg>
+): data is AlertSearchResponse<{}, AlertsByGroupingAgg> => {
+  return has(data, 'aggregations.alertsByGrouping');
+};
+
+const labels = {
+  'host.name': i18n.HOST_NAME_LABEL,
+  'user.name': i18n.USER_NAME_LABEL,
+  'source.ip': i18n.SOURCE_LABEL,
+  'destination.ip': i18n.DESTINATION_LABEL,
+};
+
+export const getGroupByLabel = (option: GroupBySelection): string => {
+  return labels[option];
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/index.test.tsx
index 5016e98140d32..776e4fffc89ab 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/index.test.tsx
@@ -4,12 +4,13 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { act, render, screen } from '@testing-library/react';
+import { act, render, screen, fireEvent } from '@testing-library/react';
 import React from 'react';
 import { TestProviders } from '../../../../common/mock';
 import { AlertsProgressBarPanel } from '.';
 import { useSummaryChartData } from '../alerts_summary_charts_panel/use_summary_chart_data';
 import { STACK_BY_ARIA_LABEL } from '../common/translations';
+import type { GroupBySelection } from './types';
 
 jest.mock('../../../../common/lib/kibana');
 
@@ -27,6 +28,8 @@ describe('Alert by grouping', () => {
   const defaultProps = {
     signalIndexName: 'signalIndexName',
     skip: false,
+    groupBySelection: 'host.name' as GroupBySelection,
+    setGroupBySelection: jest.fn(),
   };
 
   beforeEach(() => {
@@ -74,6 +77,8 @@ describe('Alert by grouping', () => {
   });
 
   describe('combo box', () => {
+    const setGroupBySelection = jest.fn();
+
     test('renders combo box', async () => {
       await act(async () => {
         const { container } = render(
@@ -89,7 +94,7 @@ describe('Alert by grouping', () => {
       await act(async () => {
         render(
           <TestProviders>
-            <AlertsProgressBarPanel {...defaultProps} />
+            <AlertsProgressBarPanel {...defaultProps} setGroupBySelection={setGroupBySelection} />
           </TestProviders>
         );
         const comboBox = screen.getByRole('combobox', { name: STACK_BY_ARIA_LABEL });
@@ -102,5 +107,24 @@ describe('Alert by grouping', () => {
         expect(optionsFound[i]).toEqual(option);
       });
     });
+
+    test('it invokes setGroupBySelection when an option is selected', async () => {
+      const toBeSelected = 'user.name';
+      await act(async () => {
+        render(
+          <TestProviders>
+            <AlertsProgressBarPanel {...defaultProps} setGroupBySelection={setGroupBySelection} />
+          </TestProviders>
+        );
+        const comboBox = screen.getByRole('combobox', { name: STACK_BY_ARIA_LABEL });
+        if (comboBox) {
+          comboBox.focus(); // display the combo box options
+        }
+      });
+      const button = await screen.findByText(toBeSelected);
+      fireEvent.click(button);
+
+      expect(setGroupBySelection).toBeCalledWith(toBeSelected);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/index.tsx
index 0baeeb8e36d08..abcfebc17a7ee 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/index.tsx
@@ -4,41 +4,57 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { EuiPanel, EuiLoadingSpinner } from '@elastic/eui';
-import React, { useEffect, useState, useCallback, useMemo } from 'react';
+import { EuiPanel } from '@elastic/eui';
+import React, { useCallback, useMemo } from 'react';
 import { v4 as uuid } from 'uuid';
-import type { ChartsPanelProps } from '../alerts_summary_charts_panel/types';
+import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/types';
+import type { Filter, Query } from '@kbn/es-query';
 import { HeaderSection } from '../../../../common/components/header_section';
 import { InspectButtonContainer } from '../../../../common/components/inspect';
 import { StackByComboBox } from '../common/components';
 import { AlertsProgressBar } from './alerts_progress_bar';
 import { useSummaryChartData } from '../alerts_summary_charts_panel/use_summary_chart_data';
 import { alertsGroupingAggregations } from '../alerts_summary_charts_panel/aggregations';
-import { showInitialLoadingSpinner } from '../alerts_histogram_panel/helpers';
-import { isAlertsProgressBarData } from './helpers';
+import { getIsAlertsProgressBarData } from './helpers';
 import * as i18n from './translations';
+import type { GroupBySelection } from './types';
 
 const TOP_ALERTS_CHART_ID = 'alerts-summary-top-alerts';
 const DEFAULT_COMBOBOX_WIDTH = 150;
 const DEFAULT_OPTIONS = ['host.name', 'user.name', 'source.ip', 'destination.ip'];
 
-export const AlertsProgressBarPanel: React.FC<ChartsPanelProps> = ({
+interface Props {
+  filters?: Filter[];
+  query?: Query;
+  signalIndexName: string | null;
+  runtimeMappings?: MappingRuntimeFields;
+  skip?: boolean;
+  groupBySelection: GroupBySelection;
+  setGroupBySelection: (groupBySelection: GroupBySelection) => void;
+}
+export const AlertsProgressBarPanel: React.FC<Props> = ({
   filters,
   query,
   signalIndexName,
   runtimeMappings,
   skip,
+  groupBySelection,
+  setGroupBySelection,
 }) => {
-  const [stackByField, setStackByField] = useState('host.name');
-  const [isInitialLoading, setIsInitialLoading] = useState(true);
   const uniqueQueryId = useMemo(() => `${TOP_ALERTS_CHART_ID}-${uuid()}`, []);
   const dropDownOptions = DEFAULT_OPTIONS.map((field) => {
     return { value: field, label: field };
   });
-  const aggregations = useMemo(() => alertsGroupingAggregations(stackByField), [stackByField]);
-  const onSelect = useCallback((field: string) => {
-    setStackByField(field);
-  }, []);
+  const aggregations = useMemo(
+    () => alertsGroupingAggregations(groupBySelection),
+    [groupBySelection]
+  );
+  const onSelect = useCallback(
+    (field: string) => {
+      setGroupBySelection(field as GroupBySelection);
+    },
+    [setGroupBySelection]
+  );
 
   const { items, isLoading } = useSummaryChartData({
     aggregations,
@@ -49,19 +65,14 @@ export const AlertsProgressBarPanel: React.FC<ChartsPanelProps> = ({
     skip,
     uniqueQueryId,
   });
-  const data = useMemo(() => (isAlertsProgressBarData(items) ? items : []), [items]);
-  useEffect(() => {
-    if (!showInitialLoadingSpinner({ isInitialLoading, isLoadingAlerts: isLoading })) {
-      setIsInitialLoading(false);
-    }
-  }, [isInitialLoading, isLoading, setIsInitialLoading]);
+  const data = useMemo(() => (getIsAlertsProgressBarData(items) ? items : []), [items]);
 
   return (
     <InspectButtonContainer>
       <EuiPanel hasBorder hasShadow={false} data-test-subj="alerts-progress-bar-panel">
         <HeaderSection
           id={uniqueQueryId}
-          inspectTitle={`${i18n.ALERT_BY_TITLE} ${stackByField}`}
+          inspectTitle={`${i18n.ALERT_BY_TITLE} ${groupBySelection}`}
           outerDirection="row"
           title={i18n.ALERT_BY_TITLE}
           titleSize="xs"
@@ -69,18 +80,14 @@ export const AlertsProgressBarPanel: React.FC<ChartsPanelProps> = ({
         >
           <StackByComboBox
             data-test-subj="stackByComboBox"
-            selected={stackByField}
+            selected={groupBySelection}
             onSelect={onSelect}
             prepend={''}
             width={DEFAULT_COMBOBOX_WIDTH}
             dropDownoptions={dropDownOptions}
           />
         </HeaderSection>
-        {isInitialLoading ? (
-          <EuiLoadingSpinner size="l" />
-        ) : (
-          <AlertsProgressBar data={data} isLoading={isLoading} stackByField={stackByField} />
-        )}
+        <AlertsProgressBar data={data} isLoading={isLoading} groupBySelection={groupBySelection} />
       </EuiPanel>
     </InspectButtonContainer>
   );
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/translations.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/translations.ts
index 514aff9fef4e1..da6b33ad60c08 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/translations.ts
@@ -26,3 +26,28 @@ export const OTHER = i18n.translate(
     defaultMessage: 'Other',
   }
 );
+
+export const HOST_NAME_LABEL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.hostNameLabel',
+  {
+    defaultMessage: 'host',
+  }
+);
+export const USER_NAME_LABEL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.userNameLabel',
+  {
+    defaultMessage: 'user',
+  }
+);
+export const DESTINATION_LABEL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.destinationLabel',
+  {
+    defaultMessage: 'destination',
+  }
+);
+export const SOURCE_LABEL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.sourceLabel',
+  {
+    defaultMessage: 'source',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/types.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/types.ts
index efc278f9b4c47..7b5b2042a6339 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_progress_bar_panel/types.ts
@@ -6,6 +6,7 @@
  */
 import type { BucketItem } from '../../../../../common/search_strategy/security_solution/cti';
 
+export type GroupBySelection = 'host.name' | 'user.name' | 'source.ip' | 'destination.ip';
 export interface AlertsByGroupingAgg {
   alertsByGrouping: {
     doc_count_error_upper_bound: number;
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/aggregations.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/aggregations.ts
index 80151de9252bc..e4883c022711e 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/aggregations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/aggregations.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 import { ALERT_SEVERITY, ALERT_RULE_NAME } from '@kbn/rule-data-utils';
+import type { GroupBySelection } from '../alerts_progress_bar_panel/types';
 
 const DEFAULT_QUERY_SIZE = 1000;
 
@@ -33,7 +34,7 @@ export const alertTypeAggregations = {
   },
 };
 
-export const alertsGroupingAggregations = (stackByField: string) => {
+export const alertsGroupingAggregations = (stackByField: GroupBySelection) => {
   return {
     alertsByGrouping: {
       terms: {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/helpers.tsx
index 6ea064bf7b7be..a6985bd7901f5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/helpers.tsx
@@ -4,22 +4,31 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { isAlertsBySeverityAgg, isAlertsByTypeAgg, isAlertsByGroupingAgg } from './types';
 import type { SummaryChartsAgg } from './types';
 import type { AlertSearchResponse } from '../../../containers/detection_engine/alerts/types';
-import { parseSeverityData } from '../severity_level_panel/helpers';
-import { parseAlertsTypeData } from '../alerts_by_type_panel/helpers';
-import { parseAlertsGroupingData } from '../alerts_progress_bar_panel/helpers';
+import { parseSeverityData, getIsAlertsBySeverityAgg } from '../severity_level_panel/helpers';
+import { parseAlertsTypeData, getIsAlertsByTypeAgg } from '../alerts_by_type_panel/helpers';
+import {
+  parseAlertsGroupingData,
+  getIsAlertsByGroupingAgg,
+} from '../alerts_progress_bar_panel/helpers';
+import {
+  parseChartCollapseData,
+  getIsChartCollapseAgg,
+} from '../../../pages/detection_engine/chart_panels/chart_collapse/helpers';
 
 export const parseData = (data: AlertSearchResponse<{}, SummaryChartsAgg>) => {
-  if (isAlertsBySeverityAgg(data)) {
+  if (getIsAlertsBySeverityAgg(data)) {
     return parseSeverityData(data);
   }
-  if (isAlertsByTypeAgg(data)) {
+  if (getIsAlertsByTypeAgg(data)) {
     return parseAlertsTypeData(data);
   }
-  if (isAlertsByGroupingAgg(data)) {
+  if (getIsAlertsByGroupingAgg(data)) {
     return parseAlertsGroupingData(data);
   }
+  if (getIsChartCollapseAgg(data)) {
+    return parseChartCollapseData(data);
+  }
   return [];
 };
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/index.test.tsx
index ac5d20fcdcfa9..f02043f3d7c55 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/index.test.tsx
@@ -9,6 +9,8 @@ import React from 'react';
 import { useQueryToggle } from '../../../../common/containers/query_toggle';
 import { TestProviders } from '../../../../common/mock';
 import { AlertsSummaryChartsPanel } from '.';
+import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
+import type { GroupBySelection } from '../alerts_progress_bar_panel/types';
 
 jest.mock('../../../../common/lib/kibana');
 jest.mock('../../../../common/containers/query_toggle');
@@ -18,14 +20,22 @@ jest.mock('react-router-dom', () => {
   return { ...actual, useLocation: jest.fn().mockReturnValue({ pathname: '' }) };
 });
 
+const mockUseIsExperimentalFeatureEnabled = useIsExperimentalFeatureEnabled as jest.Mock;
+jest.mock('../../../../common/hooks/use_experimental_features');
+
 describe('AlertsSummaryChartsPanel', () => {
   const defaultProps = {
     signalIndexName: 'signalIndexName',
+    isExpanded: true,
+    setIsExpanded: jest.fn(),
+    groupBySelection: 'host.name' as GroupBySelection,
+    setGroupBySelection: jest.fn(),
   };
   const mockSetToggle = jest.fn();
   const mockUseQueryToggle = useQueryToggle as jest.Mock;
   beforeEach(() => {
     mockUseQueryToggle.mockReturnValue({ toggleStatus: true, setToggleStatus: mockSetToggle });
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(false);
   });
 
   test('renders correctly', async () => {
@@ -89,7 +99,7 @@ describe('AlertsSummaryChartsPanel', () => {
       });
     });
 
-    test('toggleStatus=true, render', async () => {
+    it('alertsPageChartsEnabled is false and toggleStatus=true, render', async () => {
       await act(async () => {
         const { container } = render(
           <TestProviders>
@@ -102,7 +112,7 @@ describe('AlertsSummaryChartsPanel', () => {
       });
     });
 
-    test('toggleStatus=false, hide', async () => {
+    it('alertsPageChartsEnabled is false and toggleStatus=false, hide', async () => {
       mockUseQueryToggle.mockReturnValue({ toggleStatus: false, setToggleStatus: mockSetToggle });
       await act(async () => {
         const { container } = render(
@@ -115,5 +125,32 @@ describe('AlertsSummaryChartsPanel', () => {
         ).not.toBeInTheDocument();
       });
     });
+
+    it('alertsPageChartsEnabled is true and isExpanded=true, render', async () => {
+      mockUseIsExperimentalFeatureEnabled.mockReturnValue(true);
+      await act(async () => {
+        const { container } = render(
+          <TestProviders>
+            <AlertsSummaryChartsPanel {...defaultProps} />
+          </TestProviders>
+        );
+        expect(
+          container.querySelector('[data-test-subj="alerts-charts-container"]')
+        ).toBeInTheDocument();
+      });
+    });
+    it('alertsPageChartsEnabled is true and isExpanded=false, hide', async () => {
+      mockUseIsExperimentalFeatureEnabled.mockReturnValue(true);
+      await act(async () => {
+        const { container } = render(
+          <TestProviders>
+            <AlertsSummaryChartsPanel {...defaultProps} isExpanded={false} />
+          </TestProviders>
+        );
+        expect(
+          container.querySelector('[data-test-subj="alerts-charts-container"]')
+        ).not.toBeInTheDocument();
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/index.tsx
index 951aeefa1f82f..f7c8889bfc8ec 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/index.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import React, { useCallback, useState, useEffect } from 'react';
+import React, { useCallback, useState, useEffect, useMemo } from 'react';
 import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/types';
 import type { Filter, Query } from '@kbn/es-query';
 import styled from 'styled-components';
@@ -16,6 +16,8 @@ import { SeverityLevelPanel } from '../severity_level_panel';
 import { AlertsByTypePanel } from '../alerts_by_type_panel';
 import { AlertsProgressBarPanel } from '../alerts_progress_bar_panel';
 import { useQueryToggle } from '../../../../common/containers/query_toggle';
+import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
+import type { GroupBySelection } from '../alerts_progress_bar_panel/types';
 
 const StyledFlexGroup = styled(EuiFlexGroup)`
   @media only screen and (min-width: ${({ theme }) => theme.eui.euiBreakpoints.l});
@@ -36,6 +38,10 @@ interface Props {
   signalIndexName: string | null;
   title?: React.ReactNode;
   runtimeMappings?: MappingRuntimeFields;
+  isExpanded?: boolean;
+  setIsExpanded?: (status: boolean) => void;
+  groupBySelection: GroupBySelection;
+  setGroupBySelection: (groupBySelection: GroupBySelection) => void;
 }
 
 export const AlertsSummaryChartsPanel: React.FC<Props> = ({
@@ -47,25 +53,53 @@ export const AlertsSummaryChartsPanel: React.FC<Props> = ({
   runtimeMappings,
   signalIndexName,
   title = i18n.CHARTS_TITLE,
+  isExpanded,
+  setIsExpanded,
+  groupBySelection,
+  setGroupBySelection,
 }: Props) => {
-  const { toggleStatus, setToggleStatus } = useQueryToggle(DETECTIONS_ALERTS_CHARTS_ID);
-  const [querySkip, setQuerySkip] = useState(!toggleStatus);
+  const isAlertsPageChartsEnabled = useIsExperimentalFeatureEnabled('alertsPageChartsEnabled');
 
+  const { toggleStatus, setToggleStatus } = useQueryToggle(DETECTIONS_ALERTS_CHARTS_ID);
+  const [querySkip, setQuerySkip] = useState(
+    isAlertsPageChartsEnabled ? !isExpanded : !toggleStatus
+  );
   useEffect(() => {
-    setQuerySkip(!toggleStatus);
-  }, [toggleStatus]);
+    if (isAlertsPageChartsEnabled) {
+      setQuerySkip(!isExpanded);
+    } else {
+      setQuerySkip(!toggleStatus);
+    }
+  }, [toggleStatus, isAlertsPageChartsEnabled, isExpanded]);
+
   const toggleQuery = useCallback(
     (status: boolean) => {
-      setToggleStatus(status);
+      if (isAlertsPageChartsEnabled && setIsExpanded) {
+        setIsExpanded(status);
+      } else {
+        setToggleStatus(status);
+      }
       // toggle on = skipQuery false
       setQuerySkip(!status);
     },
-    [setQuerySkip, setToggleStatus]
+    [setQuerySkip, setToggleStatus, setIsExpanded, isAlertsPageChartsEnabled]
   );
 
+  const status: boolean = useMemo(() => {
+    if (isAlertsPageChartsEnabled && isExpanded) {
+      return true;
+    }
+    if (!isAlertsPageChartsEnabled && toggleStatus) {
+      return true;
+    }
+    return false;
+  }, [isAlertsPageChartsEnabled, isExpanded, toggleStatus]);
+
   return (
     <KpiPanel
-      $toggleStatus={toggleStatus}
+      $toggleStatus={
+        isAlertsPageChartsEnabled && isExpanded !== undefined ? isExpanded : toggleStatus
+      }
       data-test-subj="alerts-charts-panel"
       hasBorder
       height={panelHeight}
@@ -77,10 +111,10 @@ export const AlertsSummaryChartsPanel: React.FC<Props> = ({
         titleSize="s"
         hideSubtitle
         showInspectButton={false}
-        toggleStatus={toggleStatus}
+        toggleStatus={isAlertsPageChartsEnabled ? isExpanded : toggleStatus}
         toggleQuery={toggleQuery}
       />
-      {toggleStatus && (
+      {status && (
         <StyledFlexGroup
           data-test-subj="alerts-charts-container"
           className="eui-yScroll"
@@ -108,12 +142,13 @@ export const AlertsSummaryChartsPanel: React.FC<Props> = ({
           </StyledFlexItem>
           <StyledFlexItem>
             <AlertsProgressBarPanel
-              addFilter={addFilter}
               filters={filters}
               query={query}
               signalIndexName={signalIndexName}
               runtimeMappings={runtimeMappings}
               skip={querySkip}
+              groupBySelection={groupBySelection}
+              setGroupBySelection={setGroupBySelection}
             />
           </StyledFlexItem>
         </StyledFlexGroup>
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/types.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/types.ts
index 6e25ac136281a..8d3821ce1db62 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_summary_charts_panel/types.ts
@@ -6,8 +6,6 @@
  */
 import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/types';
 import type { Filter, Query } from '@kbn/es-query';
-import { has } from 'lodash';
-import type { AlertSearchResponse } from '../../../containers/detection_engine/alerts/types';
 import type { SeverityBuckets as SeverityData } from '../../../../overview/components/detection_response/alerts_by_status/types';
 import type { AlertsBySeverityAgg } from '../severity_level_panel/types';
 import type { AlertsByTypeAgg, AlertsTypeData } from '../alerts_by_type_panel/types';
@@ -15,10 +13,20 @@ import type {
   AlertsByGroupingAgg,
   AlertsProgressBarData,
 } from '../alerts_progress_bar_panel/types';
+import type {
+  ChartCollapseAgg,
+  ChartCollapseData,
+} from '../../../pages/detection_engine/chart_panels/chart_collapse/types';
 
-export type SummaryChartsAgg = Partial<AlertsBySeverityAgg | AlertsByTypeAgg | AlertsByGroupingAgg>;
+export type SummaryChartsAgg = Partial<
+  AlertsBySeverityAgg | AlertsByTypeAgg | AlertsByGroupingAgg | ChartCollapseAgg
+>;
 
-export type SummaryChartsData = SeverityData | AlertsTypeData | AlertsProgressBarData;
+export type SummaryChartsData =
+  | SeverityData
+  | AlertsTypeData
+  | AlertsProgressBarData
+  | ChartCollapseData;
 
 export interface ChartsPanelProps {
   filters?: Filter[];
@@ -28,21 +36,3 @@ export interface ChartsPanelProps {
   skip?: boolean;
   addFilter?: ({ field, value }: { field: string; value: string | number }) => void;
 }
-
-export const isAlertsBySeverityAgg = (
-  data: AlertSearchResponse<{}, SummaryChartsAgg>
-): data is AlertSearchResponse<{}, AlertsBySeverityAgg> => {
-  return has(data, 'aggregations.statusBySeverity');
-};
-
-export const isAlertsByTypeAgg = (
-  data: AlertSearchResponse<{}, SummaryChartsAgg>
-): data is AlertSearchResponse<{}, AlertsByTypeAgg> => {
-  return has(data, 'aggregations.alertsByRule');
-};
-
-export const isAlertsByGroupingAgg = (
-  data: AlertSearchResponse<{}, SummaryChartsAgg>
-): data is AlertSearchResponse<{}, AlertsByGroupingAgg> => {
-  return has(data, 'aggregations.alertsByGrouping');
-};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/helpers.tsx
index 165bbef35fcfc..86b4a5f0eae28 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/helpers.tsx
@@ -9,7 +9,7 @@ import { has } from 'lodash';
 import type { AlertsBySeverityAgg } from './types';
 import type { AlertSearchResponse } from '../../../containers/detection_engine/alerts/types';
 import type { SeverityBuckets as SeverityData } from '../../../../overview/components/detection_response/alerts_by_status/types';
-import type { SummaryChartsData } from '../alerts_summary_charts_panel/types';
+import type { SummaryChartsData, SummaryChartsAgg } from '../alerts_summary_charts_panel/types';
 import { severityLabels } from '../../../../overview/components/detection_response/alerts_by_status/use_alerts_by_status';
 import { emptyDonutColor } from '../../../../common/components/charts/donutchart_empty';
 import { SEVERITY_COLOR } from '../../../../overview/components/detection_response/utils';
@@ -35,6 +35,12 @@ export const parseSeverityData = (
       });
 };
 
-export const isAlertsBySeverityData = (data: SummaryChartsData[]): data is SeverityData[] => {
+export const getIsAlertsBySeverityData = (data: SummaryChartsData[]): data is SeverityData[] => {
   return data?.every((x) => has(x, 'key'));
 };
+
+export const getIsAlertsBySeverityAgg = (
+  data: AlertSearchResponse<{}, SummaryChartsAgg>
+): data is AlertSearchResponse<{}, AlertsBySeverityAgg> => {
+  return has(data, 'aggregations.statusBySeverity');
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/index.tsx
index 04ad4cbed8572..aa2583cd9d5c5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/severity_level_panel/index.tsx
@@ -13,7 +13,7 @@ import { HeaderSection } from '../../../../common/components/header_section';
 import { InspectButtonContainer } from '../../../../common/components/inspect';
 import { useSummaryChartData } from '../alerts_summary_charts_panel/use_summary_chart_data';
 import { severityAggregations } from '../alerts_summary_charts_panel/aggregations';
-import { isAlertsBySeverityData } from './helpers';
+import { getIsAlertsBySeverityData } from './helpers';
 import { SeverityLevelChart } from './severity_level_chart';
 import * as i18n from './translations';
 
@@ -38,7 +38,7 @@ export const SeverityLevelPanel: React.FC<ChartsPanelProps> = ({
     skip,
     uniqueQueryId,
   });
-  const data = useMemo(() => (isAlertsBySeverityData(items) ? items : []), [items]);
+  const data = useMemo(() => (getIsAlertsBySeverityData(items) ? items : []), [items]);
   return (
     <InspectButtonContainer>
       <EuiPanel hasBorder hasShadow={false} data-test-subj="severty-level-panel">
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/constants.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/constants.ts
index 6df717c6b541e..8dc25558f4b6f 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/constants.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/constants.ts
@@ -34,3 +34,6 @@ export const TREND_CHART_CATEGORY = 'trend';
 
 /** settings for view selection are grouped under this category */
 export const VIEW_CATEGORY = 'view';
+
+/** settings for group by selection on summary tab */
+export const GROUP_BY_SETTING_NAME = 'group-by';
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/index.test.tsx
index 6731bee771a3d..1787955fb1b52 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/index.test.tsx
@@ -27,6 +27,7 @@ describe('useAlertsLocalStorage', () => {
       alertViewSelection: 'trend', // default to the trend chart
       countTableStackBy0: 'kibana.alert.rule.name',
       countTableStackBy1: 'host.name',
+      groupBySelection: 'host.name',
       isTreemapPanelExpanded: true,
       riskChartStackBy0: 'kibana.alert.rule.name',
       riskChartStackBy1: 'host.name',
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/index.tsx
index 5ac129b6368e3..4af424c0ead8b 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/index.tsx
@@ -22,6 +22,7 @@ import {
   STACK_BY_SETTING_NAME,
   TREND_CHART_CATEGORY,
   VIEW_CATEGORY,
+  GROUP_BY_SETTING_NAME,
 } from './constants';
 import {
   DEFAULT_STACK_BY_FIELD,
@@ -30,6 +31,7 @@ import {
 import type { AlertsSettings } from './types';
 import type { AlertViewSelection } from '../chart_select/helpers';
 import { TREND_ID } from '../chart_select/helpers';
+import type { GroupBySelection } from '../../../../components/alerts_kpis/alerts_progress_bar_panel/types';
 
 export const useAlertsLocalStorage = (): AlertsSettings => {
   const [alertViewSelection, setAlertViewSelection] = useLocalStorage<AlertViewSelection>({
@@ -42,6 +44,16 @@ export const useAlertsLocalStorage = (): AlertsSettings => {
     isInvalidDefault: isDefaultWhenEmptyString,
   });
 
+  const [groupBySelection, setGroupBySelection] = useLocalStorage<GroupBySelection>({
+    defaultValue: 'host.name',
+    key: getSettingKey({
+      category: VIEW_CATEGORY,
+      page: ALERTS_PAGE,
+      setting: GROUP_BY_SETTING_NAME,
+    }),
+    isInvalidDefault: isDefaultWhenEmptyString,
+  });
+
   const [isTreemapPanelExpanded, setIsTreemapPanelExpanded] = useLocalStorage<boolean>({
     defaultValue: true,
     key: getSettingKey({
@@ -103,12 +115,14 @@ export const useAlertsLocalStorage = (): AlertsSettings => {
     alertViewSelection,
     countTableStackBy0,
     countTableStackBy1,
+    groupBySelection,
     isTreemapPanelExpanded,
     riskChartStackBy0,
     riskChartStackBy1,
     setAlertViewSelection,
     setCountTableStackBy0,
     setCountTableStackBy1,
+    setGroupBySelection,
     setIsTreemapPanelExpanded,
     setRiskChartStackBy0,
     setRiskChartStackBy1,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/types.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/types.ts
index e909fc66f11db..88a73579c764f 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/alerts_local_storage/types.ts
@@ -6,17 +6,19 @@
  */
 
 import type { AlertViewSelection } from '../chart_select/helpers';
-
+import type { GroupBySelection } from '../../../../components/alerts_kpis/alerts_progress_bar_panel/types';
 export interface AlertsSettings {
   alertViewSelection: AlertViewSelection;
   countTableStackBy0: string;
   countTableStackBy1: string | undefined;
+  groupBySelection: GroupBySelection;
   isTreemapPanelExpanded: boolean;
   riskChartStackBy0: string;
   riskChartStackBy1: string | undefined;
   setAlertViewSelection: (alertViewSelection: AlertViewSelection) => void;
   setCountTableStackBy0: (value: string) => void;
   setCountTableStackBy1: (value: string | undefined) => void;
+  setGroupBySelection: (groupBySelection: GroupBySelection) => void;
   setIsTreemapPanelExpanded: (value: boolean) => void;
   setRiskChartStackBy0: (value: string) => void;
   setRiskChartStackBy1: (value: string | undefined) => void;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/helpers.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/helpers.test.tsx
new file mode 100644
index 0000000000000..ff03ddb279b72
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/helpers.test.tsx
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { parseChartCollapseData } from './helpers';
+import * as mock from './mock_data';
+import type { ChartCollapseAgg } from './types';
+import type { AlertSearchResponse } from '../../../../containers/detection_engine/alerts/types';
+import { getGroupByLabel } from '../../../../components/alerts_kpis/alerts_progress_bar_panel/helpers';
+import * as i18n from '../../../../components/alerts_kpis/alerts_progress_bar_panel/translations';
+
+describe('parse chart collapse data', () => {
+  test('parse alerts with data', () => {
+    const res = parseChartCollapseData(
+      mock.mockAlertsData as AlertSearchResponse<{}, ChartCollapseAgg>
+    );
+    expect(res).toEqual(mock.parsedAlerts);
+  });
+
+  test('parse alerts without data', () => {
+    const res = parseChartCollapseData(
+      mock.mockAlertsEmptyData as AlertSearchResponse<{}, ChartCollapseAgg>
+    );
+    expect(res).toEqual([]);
+  });
+});
+
+describe('get group by label', () => {
+  test('should return correct label for group by selections', () => {
+    expect(getGroupByLabel('host.name')).toEqual(i18n.HOST_NAME_LABEL);
+    expect(getGroupByLabel('user.name')).toEqual(i18n.USER_NAME_LABEL);
+    expect(getGroupByLabel('source.ip')).toEqual(i18n.SOURCE_LABEL);
+    expect(getGroupByLabel('destination.ip')).toEqual(i18n.DESTINATION_LABEL);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/helpers.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/helpers.tsx
new file mode 100644
index 0000000000000..c6ba7ce42836f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/helpers.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { has } from 'lodash';
+import type { ChartCollapseAgg, ChartCollapseData } from './types';
+import type { AlertSearchResponse } from '../../../../containers/detection_engine/alerts/types';
+import type {
+  SummaryChartsData,
+  SummaryChartsAgg,
+} from '../../../../components/alerts_kpis/alerts_summary_charts_panel/types';
+import { severityLabels } from '../../../../../overview/components/detection_response/alerts_by_status/use_alerts_by_status';
+import { UNKNOWN_SEVERITY } from '../../../../components/alerts_kpis/severity_level_panel/translations';
+
+export const parseChartCollapseData = (
+  response: AlertSearchResponse<{}, ChartCollapseAgg>
+): ChartCollapseData[] => {
+  const ret: ChartCollapseData = { rule: null, group: null, severities: [] };
+  ret.rule = response?.aggregations?.topRule?.buckets?.at(0)?.key ?? null;
+  ret.group = response?.aggregations?.topGrouping?.buckets?.at(0)?.key ?? null;
+
+  const severityBuckets = response?.aggregations?.severities?.buckets ?? [];
+  if (severityBuckets.length > 0) {
+    ret.severities = severityBuckets.map((severity) => {
+      return {
+        key: severity.key,
+        value: severity.doc_count,
+        label: severityLabels[severity.key] ?? UNKNOWN_SEVERITY,
+      };
+    });
+    return [ret];
+  }
+  return [];
+};
+
+export const getIsChartCollapseData = (data: SummaryChartsData[]): data is ChartCollapseData[] => {
+  return data?.every((x) => has(x, 'rule') && has(x, 'group') && has(x, 'severities'));
+};
+
+export const getIsChartCollapseAgg = (
+  data: AlertSearchResponse<{}, SummaryChartsAgg>
+): data is AlertSearchResponse<{}, ChartCollapseAgg> => {
+  return (
+    has(data, 'aggregations.severities') &&
+    has(data, 'aggregations.topRule') &&
+    has(data, 'aggregations.topGrouping')
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/index.test.tsx
new file mode 100644
index 0000000000000..1327fadef7f7e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/index.test.tsx
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render } from '@testing-library/react';
+import React from 'react';
+import type { GroupBySelection } from '../../../../components/alerts_kpis/alerts_progress_bar_panel/types';
+import { TestProviders } from '../../../../../common/mock';
+import { ChartCollapse } from '.';
+import { useSummaryChartData } from '../../../../components/alerts_kpis/alerts_summary_charts_panel/use_summary_chart_data';
+import * as mock from './mock_data';
+
+jest.mock('../../../../../common/lib/kibana');
+
+jest.mock('react-router-dom', () => {
+  const actual = jest.requireActual('react-router-dom');
+  return { ...actual, useLocation: jest.fn().mockReturnValue({ pathname: '' }) };
+});
+jest.mock('../../../../components/alerts_kpis/alerts_summary_charts_panel/use_summary_chart_data');
+
+const defaultProps = {
+  groupBySelection: 'host.name' as GroupBySelection,
+  signalIndexName: 'signalIndexName',
+};
+
+const severitiesId = '[data-test-subj="chart-collapse-severities"]';
+const ruleId = '[data-test-subj="chart-collapse-top-rule"]';
+const groupId = '[data-test-subj="chart-collapse-top-group"]';
+
+describe('ChartCollapse', () => {
+  const mockUseSummaryChartData = useSummaryChartData as jest.Mock;
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  test('it renders the chart collapse panel and the 3 summary componenets', () => {
+    mockUseSummaryChartData.mockReturnValue({ items: [], isLoading: false });
+    const { container } = render(
+      <TestProviders>
+        <ChartCollapse {...defaultProps} />
+      </TestProviders>
+    );
+    expect(container.querySelector('[data-test-subj="chart-collapse"]')).toBeInTheDocument();
+
+    expect(container.querySelector(severitiesId)).toBeInTheDocument();
+    expect(container.querySelector(ruleId)).toBeInTheDocument();
+    expect(container.querySelector(groupId)).toBeInTheDocument();
+  });
+
+  test('it renders chart collapse with data', () => {
+    mockUseSummaryChartData.mockReturnValue({ items: mock.parsedAlerts, isLoading: false });
+    const { container } = render(
+      <TestProviders>
+        <ChartCollapse {...defaultProps} />
+      </TestProviders>
+    );
+
+    mock.parsedAlerts.at(0)?.severities.forEach((severity) => {
+      expect(container.querySelector(severitiesId)).toHaveTextContent(
+        `${severity.label}: ${severity.value}`
+      );
+    });
+    expect(container.querySelector(ruleId)).toHaveTextContent('Top alerted rule: Test rule');
+    expect(container.querySelector(groupId)).toHaveTextContent('Top alerted host: Test group');
+  });
+
+  test('it renders chart collapse without data', () => {
+    mockUseSummaryChartData.mockReturnValue({ items: [], isLoading: false });
+    const { container } = render(
+      <TestProviders>
+        <ChartCollapse {...defaultProps} />
+      </TestProviders>
+    );
+    mock.parsedAlerts.at(0)?.severities.forEach((severity) => {
+      expect(container.querySelector(severitiesId)).toHaveTextContent(`${severity.label}: 0`);
+    });
+    expect(container.querySelector(ruleId)).toHaveTextContent('Top alerted rule: None');
+    expect(container.querySelector(groupId)).toHaveTextContent('Top alerted host: None');
+  });
+
+  test('it renders group by label correctly', () => {
+    mockUseSummaryChartData.mockReturnValue({ items: [], isLoading: false });
+    const { container } = render(
+      <TestProviders>
+        <ChartCollapse {...defaultProps} groupBySelection={'user.name'} />
+      </TestProviders>
+    );
+    expect(container.querySelector(groupId)).toHaveTextContent('Top alerted user: None');
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/index.tsx
new file mode 100644
index 0000000000000..a09397cfbd485
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/index.tsx
@@ -0,0 +1,149 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { EuiFlexGroup, EuiFlexItem, EuiHealth, EuiText } from '@elastic/eui';
+import { ALERT_SEVERITY, ALERT_RULE_NAME } from '@kbn/rule-data-utils';
+import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/types';
+import type { Filter, Query } from '@kbn/es-query';
+import { v4 as uuid } from 'uuid';
+import { capitalize } from 'lodash';
+import React, { useMemo } from 'react';
+import styled from 'styled-components';
+import type { GroupBySelection } from '../../../../components/alerts_kpis/alerts_progress_bar_panel/types';
+import { getGroupByLabel } from '../../../../components/alerts_kpis/alerts_progress_bar_panel/helpers';
+import { InspectButton, InspectButtonContainer } from '../../../../../common/components/inspect';
+import { useSummaryChartData } from '../../../../components/alerts_kpis/alerts_summary_charts_panel/use_summary_chart_data';
+import { getSeverityColor } from '../../../../components/alerts_kpis/severity_level_panel/helpers';
+import { FormattedCount } from '../../../../../common/components/formatted_number';
+import { getIsChartCollapseData } from './helpers';
+import * as i18n from './translations';
+
+import { SEVERITY_COLOR } from '../../../../../overview/components/detection_response/utils';
+
+const DETECTIONS_ALERTS_COLLAPSED_CHART_ID = 'detectioin-alerts-collapsed-chart';
+
+const combinedAggregations = (groupBySelection: GroupBySelection) => {
+  return {
+    severities: {
+      terms: {
+        field: ALERT_SEVERITY,
+        min_doc_count: 0,
+      },
+    },
+    topRule: {
+      terms: {
+        field: ALERT_RULE_NAME,
+        size: 1,
+      },
+    },
+    topGrouping: {
+      terms: {
+        field: groupBySelection,
+        size: 1,
+      },
+    },
+  };
+};
+
+const StyledEuiFlexGroup = styled(EuiFlexGroup)`
+  margin-top: ${({ theme }) => theme.eui.euiSizeXS};
+  @media only screen and (min-width: ${({ theme }) => theme.eui.euiBreakpoints.l});
+`;
+
+const SeverityWrapper = styled(EuiFlexItem)`
+  min-width: 380px;
+`;
+
+const StyledEuiText = styled(EuiText)`
+  border-left: 1px solid ${({ theme }) => theme.eui.euiColorLightShade};
+  padding-left: ${({ theme }) => theme.eui.euiSizeL};
+  white-space: nowrap;
+`;
+interface Props {
+  groupBySelection: GroupBySelection;
+  filters?: Filter[];
+  query?: Query;
+  signalIndexName: string | null;
+  runtimeMappings?: MappingRuntimeFields;
+}
+
+export const ChartCollapse: React.FC<Props> = ({
+  groupBySelection,
+  filters,
+  query,
+  signalIndexName,
+  runtimeMappings,
+}: Props) => {
+  const uniqueQueryId = useMemo(() => `${DETECTIONS_ALERTS_COLLAPSED_CHART_ID}-${uuid()}`, []);
+  const aggregations = useMemo(() => combinedAggregations(groupBySelection), [groupBySelection]);
+
+  const { items, isLoading } = useSummaryChartData({
+    aggregations,
+    filters,
+    query,
+    signalIndexName,
+    runtimeMappings,
+    uniqueQueryId,
+  });
+  const data = useMemo(() => (getIsChartCollapseData(items) ? items : []), [items]);
+
+  const topRule = useMemo(() => data.at(0)?.rule ?? i18n.NO_RESULT_MESSAGE, [data]);
+  const topGroup = useMemo(() => data.at(0)?.group ?? i18n.NO_RESULT_MESSAGE, [data]);
+  const severities = useMemo(() => {
+    const severityData = data.at(0)?.severities ?? [];
+    return Object.keys(SEVERITY_COLOR).map((severity) => {
+      const obj = severityData.find((s) => s.key === severity);
+      if (obj) {
+        return { key: obj.key, label: obj.label, value: obj.value };
+      } else {
+        return { key: severity, label: capitalize(severity), value: 0 };
+      }
+    });
+  }, [data]);
+  const groupBy = useMemo(() => getGroupByLabel(groupBySelection), [groupBySelection]);
+  // className="eui-alignMiddle"
+  return (
+    <InspectButtonContainer>
+      {!isLoading && (
+        <StyledEuiFlexGroup alignItems="center" data-test-subj="chart-collapse" wrap>
+          <SeverityWrapper grow={false}>
+            <EuiFlexGroup data-test-subj="chart-collapse-severities">
+              {severities.map((severity) => (
+                <EuiFlexItem key={severity.key} grow={false}>
+                  <EuiHealth color={getSeverityColor(severity.key)}>
+                    <EuiText size="xs">
+                      {`${severity.label}: `}
+                      <FormattedCount count={severity.value || 0} />
+                    </EuiText>
+                  </EuiHealth>
+                </EuiFlexItem>
+              ))}
+            </EuiFlexGroup>
+          </SeverityWrapper>
+          <EuiFlexItem grow={false}>
+            <StyledEuiText size="xs" data-test-subj="chart-collapse-top-rule">
+              <strong>{i18n.TOP_RULE_TITLE}</strong>
+              {topRule}
+            </StyledEuiText>
+          </EuiFlexItem>
+          <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
+            <EuiFlexItem grow={false}>
+              <StyledEuiText size="xs" data-test-subj="chart-collapse-top-group">
+                <strong>{`${i18n.TOP_GROUP_TITLE} ${groupBy}: `}</strong>
+                {topGroup}
+              </StyledEuiText>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <InspectButton isDisabled={false} queryId={uniqueQueryId} title={'chart collapse'} />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </StyledEuiFlexGroup>
+      )}
+    </InspectButtonContainer>
+  );
+};
+
+ChartCollapse.displayName = 'ChartCollapse';
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/mock_data.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/mock_data.ts
new file mode 100644
index 0000000000000..0b7ba68c99ec6
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/mock_data.ts
@@ -0,0 +1,152 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+const from = '2022-04-05T12:00:00.000Z';
+const to = '2022-04-08T12:00:00.000Z';
+
+export const mockAlertsData = {
+  took: 0,
+  timeout: false,
+  _shards: {
+    total: 1,
+    successful: 1,
+    skipped: 0,
+    failed: 0,
+  },
+  hits: {
+    total: {
+      value: 570,
+      relation: 'eq',
+    },
+    max_score: null,
+    hits: [],
+  },
+  aggregations: {
+    severities: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [
+        {
+          key: 'high',
+          doc_count: 78,
+        },
+        {
+          key: 'low',
+          doc_count: 46,
+        },
+        {
+          key: 'medium',
+          doc_count: 32,
+        },
+        {
+          key: 'critical',
+          doc_count: 21,
+        },
+      ],
+    },
+    topRule: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [
+        {
+          key: 'Test rule',
+          doc_count: 234,
+        },
+      ],
+    },
+    topGrouping: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [
+        {
+          key: 'Test group',
+          doc_count: 100,
+        },
+      ],
+    },
+  },
+};
+
+export const mockAlertsEmptyData = {
+  took: 0,
+  timeout: false,
+  _shards: {
+    total: 1,
+    successful: 1,
+    skipped: 0,
+    failed: 0,
+  },
+  hits: {
+    total: {
+      value: 0,
+      relation: 'eq',
+    },
+    max_score: null,
+    hits: [],
+  },
+  aggregations: {
+    severities: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [],
+    },
+    topRule: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [],
+    },
+    topGrouping: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [],
+    },
+  },
+};
+
+export const query = {
+  size: 0,
+  query: {
+    bool: {
+      filter: [
+        { bool: { filter: [], must: [], must_not: [], should: [] } },
+        { range: { '@timestamp': { gte: from, lte: to } } },
+      ],
+    },
+  },
+  aggs: {
+    severities: {
+      terms: {
+        field: 'kibana.alert.severity',
+      },
+    },
+    topRule: {
+      terms: {
+        field: 'kibana.alert.rule.name',
+        size: 1000,
+      },
+    },
+    topGrouping: {
+      terms: {
+        field: 'host.name',
+        size: 1,
+      },
+    },
+  },
+  runtime_mappings: undefined,
+};
+
+export const parsedAlerts = [
+  {
+    rule: 'Test rule',
+    group: 'Test group',
+    severities: [
+      { key: 'high', value: 78, label: 'High' },
+      { key: 'low', value: 46, label: 'Low' },
+      { key: 'medium', value: 32, label: 'Medium' },
+      { key: 'critical', value: 21, label: 'Critical' },
+    ],
+  },
+];
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/translations.ts
new file mode 100644
index 0000000000000..adc53e8859f39
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/translations.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const TOP_RULE_TITLE = i18n.translate(
+  'xpack.securitySolution.components.chartCollapse.topRule',
+  {
+    defaultMessage: 'Top alerted rule: ',
+  }
+);
+
+export const TOP_GROUP_TITLE = i18n.translate(
+  'xpack.securitySolution.components.chartCollapse.topGroup',
+  {
+    defaultMessage: 'Top alerted',
+  }
+);
+
+export const NO_RESULT_MESSAGE = i18n.translate(
+  'xpack.securitySolution.components.chartCollapse.noResultMessage',
+  {
+    defaultMessage: 'None',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/types.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/types.ts
new file mode 100644
index 0000000000000..1dfa7ea316372
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_collapse/types.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { BucketItem } from '../../../../../../common/search_strategy/security_solution/cti';
+import type {
+  SeverityBucket,
+  SeverityBuckets as SeverityData,
+} from '../../../../../overview/components/detection_response/alerts_by_status/types';
+
+export interface ChartCollapseAgg {
+  severities: {
+    doc_count_error_upper_bound: number;
+    sum_other_doc_count: number;
+    buckets: SeverityBucket[];
+  };
+  topRule: {
+    doc_count_error_upper_bound: number;
+    sum_other_doc_count: number;
+    buckets: BucketItem[];
+  };
+  topGrouping: {
+    doc_count_error_upper_bound: number;
+    sum_other_doc_count: number;
+    buckets: BucketItem[];
+  };
+}
+export interface ChartCollapseData {
+  rule: string | null;
+  group: string | null;
+  severities: SeverityData[];
+}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/helpers.test.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/helpers.test.ts
index fe4cf26fd2c7d..60f55d79c895e 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/helpers.test.ts
@@ -9,6 +9,7 @@ import type { AlertViewSelection } from './helpers';
 import {
   getButtonProperties,
   getContextMenuPanels,
+  getOptionProperties,
   TABLE_ID,
   TREEMAP_ID,
   TREND_ID,
@@ -99,4 +100,42 @@ describe('helpers', () => {
       });
     });
   });
+
+  describe('getOptionProperties', () => {
+    test('it returns the expected properties when alertViewSelection is Trend', () => {
+      expect(getOptionProperties(TREND_ID)).toEqual({
+        id: TREND_ID,
+        'data-test-subj': `chart-select-${TREND_ID}`,
+        label: i18n.TREND_TITLE,
+        value: TREND_ID,
+      });
+    });
+
+    test('it returns the expected properties when alertViewSelection is Table', () => {
+      expect(getOptionProperties(TABLE_ID)).toEqual({
+        id: TABLE_ID,
+        'data-test-subj': `chart-select-${TABLE_ID}`,
+        label: i18n.TABLE_TITLE,
+        value: TABLE_ID,
+      });
+    });
+
+    test('it returns the expected properties when alertViewSelection is Treemap', () => {
+      expect(getOptionProperties(TREEMAP_ID)).toEqual({
+        id: TREEMAP_ID,
+        'data-test-subj': `chart-select-${TREEMAP_ID}`,
+        label: i18n.TREEMAP_TITLE,
+        value: TREEMAP_ID,
+      });
+    });
+
+    test('it returns the expected properties when alertViewSelection is charts', () => {
+      expect(getOptionProperties(CHARTS_ID)).toEqual({
+        id: CHARTS_ID,
+        'data-test-subj': `chart-select-${CHARTS_ID}`,
+        label: i18n.CHARTS_TITLE,
+        value: CHARTS_ID,
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/helpers.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/helpers.ts
index 9166e73331413..24d85b251e1cb 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/helpers.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { EuiContextMenuPanelDescriptor } from '@elastic/eui';
+import type { EuiContextMenuPanelDescriptor, EuiButtonGroupOptionProps } from '@elastic/eui';
 
 import * as i18n from './translations';
 
@@ -92,3 +92,42 @@ export const getContextMenuPanels = ({
     ],
   },
 ];
+
+export const getOptionProperties = (
+  alertViewSelection: AlertViewSelection
+): EuiButtonGroupOptionProps => {
+  const charts = {
+    id: CHARTS_ID,
+    'data-test-subj': `chart-select-${CHARTS_ID}`,
+    label: i18n.CHARTS_TITLE,
+    value: CHARTS_ID,
+  };
+
+  switch (alertViewSelection) {
+    case TABLE_ID:
+      return {
+        id: TABLE_ID,
+        'data-test-subj': `chart-select-${TABLE_ID}`,
+        label: i18n.TABLE_TITLE,
+        value: TABLE_ID,
+      };
+    case TREND_ID:
+      return {
+        id: TREND_ID,
+        'data-test-subj': `chart-select-${TREND_ID}`,
+        label: i18n.TREND_TITLE,
+        value: TREND_ID,
+      };
+    case TREEMAP_ID:
+      return {
+        id: TREEMAP_ID,
+        'data-test-subj': `chart-select-${TREEMAP_ID}`,
+        label: i18n.TREEMAP_TITLE,
+        value: TREEMAP_ID,
+      };
+    case CHARTS_ID:
+      return charts;
+    default:
+      return charts;
+  }
+};
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/index.test.tsx
index a666a64f7941e..a5110a96a56e9 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/index.test.tsx
@@ -4,42 +4,82 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
-import { render, screen } from '@testing-library/react';
+import { render, screen, fireEvent } from '@testing-library/react';
 import { waitForEuiPopoverOpen } from '@elastic/eui/lib/test/rtl';
 import React from 'react';
 
 import { TestProviders } from '../../../../../common/mock';
-import { SELECT_A_CHART_ARIA_LABEL, TREEMAP } from './translations';
+import * as i18n from './translations';
 import { ChartSelect } from '.';
+import { useIsExperimentalFeatureEnabled } from '../../../../../common/hooks/use_experimental_features';
+
+const mockUseIsExperimentalFeatureEnabled = useIsExperimentalFeatureEnabled as jest.Mock;
+jest.mock('../../../../../common/hooks/use_experimental_features');
 
 describe('ChartSelect', () => {
-  test('it renders the chart select button', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  test('it renders the chart select button when alertsPageChartsEnabled is false', () => {
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(false);
     render(
       <TestProviders>
         <ChartSelect alertViewSelection="trend" setAlertViewSelection={jest.fn()} />
       </TestProviders>
     );
 
-    expect(screen.getByRole('button', { name: SELECT_A_CHART_ARIA_LABEL })).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: i18n.SELECT_A_CHART_ARIA_LABEL })
+    ).toBeInTheDocument();
   });
 
-  test('it invokes `setAlertViewSelection` with the expected value when a chart is selected', async () => {
+  test('it invokes `setAlertViewSelection` with the expected value when a chart is selected and alertsPageChartsEnabled is false', async () => {
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(false);
     const setAlertViewSelection = jest.fn();
-
     render(
       <TestProviders>
         <ChartSelect alertViewSelection="trend" setAlertViewSelection={setAlertViewSelection} />
       </TestProviders>
     );
 
-    const selectButton = screen.getByRole('button', { name: SELECT_A_CHART_ARIA_LABEL });
+    const selectButton = screen.getByRole('button', { name: i18n.SELECT_A_CHART_ARIA_LABEL });
     selectButton.click();
     await waitForEuiPopoverOpen();
 
-    const treemapMenuItem = screen.getByRole('button', { name: TREEMAP });
+    const treemapMenuItem = screen.getByRole('button', { name: i18n.TREEMAP });
     treemapMenuItem.click();
 
     expect(setAlertViewSelection).toBeCalledWith('treemap');
   });
+
+  test('it renders the chart select tabs when alertsPageChartsEnabled is true', () => {
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(true);
+    render(
+      <TestProviders>
+        <ChartSelect alertViewSelection="trend" setAlertViewSelection={jest.fn()} />
+      </TestProviders>
+    );
+
+    expect(screen.getByTestId('chart-select-tabs')).toBeInTheDocument();
+    expect(screen.getByTestId('trend')).toBeChecked();
+  });
+
+  test('changing selection render correctly when alertsPageChartsEnabled is true', async () => {
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(true);
+    const setAlertViewSelection = jest.fn();
+    const { container } = render(
+      <TestProviders>
+        <ChartSelect alertViewSelection="trend" setAlertViewSelection={setAlertViewSelection} />
+      </TestProviders>
+    );
+
+    const button = container.querySelector('input[value="treemap"]');
+    if (button) {
+      fireEvent.change(button, { target: { checked: true, type: 'radio' } });
+    }
+    expect(screen.getByTestId('treemap')).toBeChecked();
+    expect(screen.getByTestId('trend')).not.toBeChecked();
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/index.tsx
index 307dfb24f0600..c31e04afeb301 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/index.tsx
@@ -6,12 +6,12 @@
  */
 
 import type { EuiContextMenuPanelDescriptor } from '@elastic/eui';
-import { EuiButton, EuiContextMenu, EuiIcon, EuiPopover } from '@elastic/eui';
+import { EuiButton, EuiContextMenu, EuiIcon, EuiPopover, EuiButtonGroup } from '@elastic/eui';
 import React, { useCallback, useMemo, useState } from 'react';
 import styled from 'styled-components';
 
 import type { AlertViewSelection } from './helpers';
-import { getButtonProperties, getContextMenuPanels } from './helpers';
+import { getButtonProperties, getContextMenuPanels, getOptionProperties } from './helpers';
 import * as i18n from './translations';
 import { useIsExperimentalFeatureEnabled } from '../../../../../common/hooks/use_experimental_features';
 interface Props {
@@ -22,6 +22,7 @@ interface Props {
 const ChartTypeIcon = styled(EuiIcon)`
   margin-right: ${({ theme }) => theme.eui.euiSizeS};
 `;
+const AlertViewOptions: AlertViewSelection[] = ['charts', 'trend', 'table', 'treemap'];
 
 const ChartSelectComponent: React.FC<Props> = ({
   alertViewSelection,
@@ -50,6 +51,10 @@ const ChartSelectComponent: React.FC<Props> = ({
     );
   }, [alertViewSelection, onButtonClick]);
   const isAlertsPageChartsEnabled = useIsExperimentalFeatureEnabled('alertsPageChartsEnabled');
+  const options = useMemo(() => {
+    return AlertViewOptions.map((option: AlertViewSelection) => getOptionProperties(option));
+  }, []);
+
   const panels: EuiContextMenuPanelDescriptor[] = useMemo(
     () =>
       getContextMenuPanels({
@@ -62,15 +67,30 @@ const ChartSelectComponent: React.FC<Props> = ({
   );
 
   return (
-    <EuiPopover
-      anchorPosition="downLeft"
-      button={button}
-      closePopover={closePopover}
-      isOpen={isPopoverOpen}
-      panelPaddingSize="none"
-    >
-      <EuiContextMenu initialPanelId={0} panels={panels} />
-    </EuiPopover>
+    <>
+      {isAlertsPageChartsEnabled ? (
+        <EuiButtonGroup
+          name="chart-select"
+          legend={i18n.LEGEND_TITLE}
+          options={options}
+          idSelected={alertViewSelection}
+          onChange={(id) => setAlertViewSelection(id as AlertViewSelection)}
+          buttonSize="compressed"
+          color="primary"
+          data-test-subj="chart-select-tabs"
+        />
+      ) : (
+        <EuiPopover
+          anchorPosition="downLeft"
+          button={button}
+          closePopover={closePopover}
+          isOpen={isPopoverOpen}
+          panelPaddingSize="none"
+        >
+          <EuiContextMenu initialPanelId={0} panels={panels} />
+        </EuiPopover>
+      )}
+    </>
   );
 };
 
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/translations.ts
index a170be5b29720..fb5bcb630eba6 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/chart_select/translations.ts
@@ -32,3 +32,38 @@ export const TREEMAP = i18n.translate(
 export const CHARTS = i18n.translate('xpack.securitySolution.components.chartSelect.chartsOption', {
   defaultMessage: 'Charts',
 });
+
+export const TABLE_TITLE = i18n.translate(
+  'xpack.securitySolution.components.chartSelect.tableOptionTitle',
+  {
+    defaultMessage: 'Aggregations',
+  }
+);
+
+export const TREND_TITLE = i18n.translate(
+  'xpack.securitySolution.components.chartSelect.trendOptionTitle',
+  {
+    defaultMessage: 'Trend Analysis',
+  }
+);
+
+export const TREEMAP_TITLE = i18n.translate(
+  'xpack.securitySolution.components.chartSelect.treemapOptionTitle',
+  {
+    defaultMessage: 'Multi-dimensional',
+  }
+);
+
+export const CHARTS_TITLE = i18n.translate(
+  'xpack.securitySolution.components.chartSelect.chartsOptionTitle',
+  {
+    defaultMessage: 'Summary',
+  }
+);
+
+export const LEGEND_TITLE = i18n.translate(
+  'xpack.securitySolution.components.chartSelect.legendTitle',
+  {
+    defaultMessage: 'Select a tab',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/index.test.tsx
index f87b1b3fcbbf7..d777ddce738b8 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/index.test.tsx
@@ -16,6 +16,8 @@ import { mockBrowserFields } from '../../../../common/containers/source/mock';
 import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { TestProviders } from '../../../../common/mock';
 import { ChartPanels } from '.';
+import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
+import { useQueryToggle } from '../../../../common/containers/query_toggle';
 
 jest.mock('./alerts_local_storage');
 jest.mock('../../../../common/containers/sourcerer');
@@ -59,16 +61,25 @@ jest.mock('../../../../common/lib/kibana', () => {
   };
 });
 
+const mockUseIsExperimentalFeatureEnabled = useIsExperimentalFeatureEnabled as jest.Mock;
+jest.mock('../../../../common/hooks/use_experimental_features');
+
+const mockSetToggle = jest.fn();
+const mockUseQueryToggle = useQueryToggle as jest.Mock;
+jest.mock('../../../../common/containers/query_toggle');
+
 const defaultAlertSettings = {
   alertViewSelection: 'trend',
   countTableStackBy0: 'kibana.alert.rule.name',
   countTableStackBy1: 'host.name',
   isTreemapPanelExpanded: true,
+  groupBySelection: 'host.name',
   riskChartStackBy0: 'kibana.alert.rule.name',
   riskChartStackBy1: 'host.name',
   setAlertViewSelection: jest.fn(),
   setCountTableStackBy0: jest.fn(),
   setCountTableStackBy1: jest.fn(),
+  setGroupBySelection: jest.fn(),
   setIsTreemapPanelExpanded: jest.fn(),
   setRiskChartStackBy0: jest.fn(),
   setRiskChartStackBy1: jest.fn(),
@@ -78,7 +89,7 @@ const defaultAlertSettings = {
 
 const defaultProps = {
   addFilter: jest.fn(),
-  alertsHistogramDefaultFilters: [
+  alertsDefaultFilters: [
     {
       meta: {
         alias: null,
@@ -136,6 +147,8 @@ const resetGroupByFields = () => {
 describe('ChartPanels', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(false);
+    mockUseQueryToggle.mockReturnValue({ toggleStatus: true, setToggleStatus: mockSetToggle });
 
     (useSourcererDataView as jest.Mock).mockReturnValue({
       indicesExist: true,
@@ -148,7 +161,7 @@ describe('ChartPanels', () => {
     });
   });
 
-  test('it renders the chart selector', async () => {
+  test('it renders the chart selector when alertsPageChartsEnabled is false', async () => {
     render(
       <TestProviders>
         <ChartPanels {...defaultProps} />
@@ -160,6 +173,34 @@ describe('ChartPanels', () => {
     });
   });
 
+  test('it renders the chart selector tabs when alertsPageChartsEnabled is true and toggle is true', async () => {
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(true);
+    mockUseQueryToggle.mockReturnValue({ toggleStatus: true, setToggleStatus: mockSetToggle });
+    render(
+      <TestProviders>
+        <ChartPanels {...defaultProps} />
+      </TestProviders>
+    );
+
+    await waitFor(() => {
+      expect(screen.getByTestId('chart-select-tabs')).toBeInTheDocument();
+    });
+  });
+
+  test('it renders the chart collapse when alertsPageChartsEnabled is true and toggle is false', async () => {
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(true);
+    mockUseQueryToggle.mockReturnValue({ toggleStatus: false, setToggleStatus: mockSetToggle });
+    render(
+      <TestProviders>
+        <ChartPanels {...defaultProps} />
+      </TestProviders>
+    );
+
+    await waitFor(() => {
+      expect(screen.getByTestId('chart-collapse')).toBeInTheDocument();
+    });
+  });
+
   test('it renders the trend loading spinner when data is loading and `alertViewSelection` is trend', async () => {
     render(
       <TestProviders>
@@ -315,7 +356,7 @@ describe('ChartPanels', () => {
     });
   });
 
-  test('it renders the alerts count panel when `alertViewSelection` is treemap', async () => {
+  test('it renders the treemap panel when `alertViewSelection` is treemap', async () => {
     (useAlertsLocalStorage as jest.Mock).mockReturnValue({
       ...defaultAlertSettings,
       alertViewSelection: 'treemap',
@@ -331,4 +372,38 @@ describe('ChartPanels', () => {
       expect(screen.getByTestId('treemapPanel')).toBeInTheDocument();
     });
   });
+
+  test('it renders the charts loading spinner when data is loading and `alertViewSelection` is charts', async () => {
+    (useAlertsLocalStorage as jest.Mock).mockReturnValue({
+      ...defaultAlertSettings,
+      alertViewSelection: 'charts',
+    });
+    mockUseIsExperimentalFeatureEnabled.mockReturnValue(true);
+    render(
+      <TestProviders>
+        <ChartPanels {...defaultProps} isLoadingIndexPattern={true} />
+      </TestProviders>
+    );
+
+    await waitFor(() => {
+      expect(screen.getByTestId('chartsLoadingSpinner')).toBeInTheDocument();
+    });
+  });
+
+  test('it renders the charts panel when `alertViewSelection` is charts', async () => {
+    (useAlertsLocalStorage as jest.Mock).mockReturnValue({
+      ...defaultAlertSettings,
+      alertViewSelection: 'charts',
+    });
+
+    render(
+      <TestProviders>
+        <ChartPanels {...defaultProps} />
+      </TestProviders>
+    );
+
+    await waitFor(() => {
+      expect(screen.getByTestId('chartPanels')).toBeInTheDocument();
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/index.tsx
index 1ee5bbf7cfe9b..82e10d884d0e2 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/chart_panels/index.tsx
@@ -8,7 +8,7 @@
 import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { ActionExecutionContext } from '@kbn/ui-actions-plugin/public';
 import type { Filter, Query } from '@kbn/es-query';
-import { EuiFlexItem, EuiLoadingContent, EuiLoadingSpinner } from '@elastic/eui';
+import { EuiFlexItem, EuiLoadingContent } from '@elastic/eui';
 import React, { useCallback, useMemo } from 'react';
 import styled from 'styled-components';
 
@@ -17,6 +17,7 @@ import { useAlertsLocalStorage } from './alerts_local_storage';
 import type { AlertsSettings } from './alerts_local_storage/types';
 import { ChartContextMenu } from './chart_context_menu';
 import { ChartSelect } from './chart_select';
+import { ChartCollapse } from './chart_collapse';
 import * as i18n from './chart_select/translations';
 import { AlertsTreemapPanel } from '../../../../common/components/alerts_treemap_panel';
 import type { UpdateDateRange } from '../../../../common/components/charts/common';
@@ -30,11 +31,12 @@ import {
 import { AlertsCountPanel } from '../../../components/alerts_kpis/alerts_count_panel';
 import { GROUP_BY_LABEL } from '../../../components/alerts_kpis/common/translations';
 import { RESET_GROUP_BY_FIELDS } from '../../../../common/components/chart_settings_popover/configurations/default/translations';
+import { useQueryToggle } from '../../../../common/containers/query_toggle';
 
-const TABLE_PANEL_HEIGHT = 330; // px
-const TRENT_CHART_HEIGHT = 127; // px
-const TREND_CHART_PANEL_HEIGHT = 256; // px
-const ALERTS_CHARTS_PANEL_HEIGHT = 375; // px
+const TREND_CHART_HEIGHT = 280; // px
+const CHART_PANEL_HEIGHT = 375; // px
+
+const DETECTIONS_ALERTS_CHARTS_PANEL_ID = 'detection-alerts-charts-panel';
 
 const FullHeightFlexItem = styled(EuiFlexItem)`
   height: 100%;
@@ -46,7 +48,7 @@ const ChartSelectContainer = styled.div`
 
 export interface Props {
   addFilter: ({ field, value }: { field: string; value: string | number }) => void;
-  alertsHistogramDefaultFilters: Filter[];
+  alertsDefaultFilters: Filter[];
   isLoadingIndexPattern: boolean;
   query: Query;
   runtimeMappings: MappingRuntimeFields;
@@ -56,23 +58,30 @@ export interface Props {
 
 const ChartPanelsComponent: React.FC<Props> = ({
   addFilter,
-  alertsHistogramDefaultFilters,
+  alertsDefaultFilters,
   isLoadingIndexPattern,
   query,
   runtimeMappings,
   signalIndexName,
   updateDateRangeCallback,
 }: Props) => {
+  const { toggleStatus: isExpanded, setToggleStatus: setIsExpanded } = useQueryToggle(
+    DETECTIONS_ALERTS_CHARTS_PANEL_ID
+  );
+  const isAlertsPageChartsEnabled = useIsExperimentalFeatureEnabled('alertsPageChartsEnabled');
+
   const {
     alertViewSelection,
     countTableStackBy0,
     countTableStackBy1,
+    groupBySelection,
     isTreemapPanelExpanded,
     riskChartStackBy0,
     riskChartStackBy1,
     setAlertViewSelection,
     setCountTableStackBy0,
     setCountTableStackBy1,
+    setGroupBySelection,
     setIsTreemapPanelExpanded,
     setRiskChartStackBy0,
     setRiskChartStackBy1,
@@ -157,18 +166,45 @@ const ChartPanelsComponent: React.FC<Props> = ({
     [onReset, updateCommonStackBy0, updateCommonStackBy1]
   );
 
-  const title = useMemo(
-    () => (
-      <ChartSelectContainer>
-        <ChartSelect
-          alertViewSelection={alertViewSelection}
-          setAlertViewSelection={setAlertViewSelection}
+  const title = useMemo(() => {
+    if (isAlertsPageChartsEnabled) {
+      return isExpanded ? (
+        <ChartSelectContainer>
+          <ChartSelect
+            alertViewSelection={alertViewSelection}
+            setAlertViewSelection={setAlertViewSelection}
+          />
+        </ChartSelectContainer>
+      ) : (
+        <ChartCollapse
+          groupBySelection={groupBySelection}
+          filters={alertsDefaultFilters}
+          query={query}
+          signalIndexName={signalIndexName}
+          runtimeMappings={runtimeMappings}
         />
-      </ChartSelectContainer>
-    ),
-    [alertViewSelection, setAlertViewSelection]
-  );
-  const isAlertsPageChartsEnabled = useIsExperimentalFeatureEnabled('alertsPageChartsEnabled');
+      );
+    } else {
+      return (
+        <ChartSelectContainer>
+          <ChartSelect
+            alertViewSelection={alertViewSelection}
+            setAlertViewSelection={setAlertViewSelection}
+          />
+        </ChartSelectContainer>
+      );
+    }
+  }, [
+    alertViewSelection,
+    setAlertViewSelection,
+    isAlertsPageChartsEnabled,
+    isExpanded,
+    groupBySelection,
+    alertsDefaultFilters,
+    query,
+    signalIndexName,
+    runtimeMappings,
+  ]);
 
   return (
     <div data-test-subj="chartPanels">
@@ -179,15 +215,15 @@ const ChartPanelsComponent: React.FC<Props> = ({
           ) : (
             <AlertsHistogramPanel
               alignHeader="flexStart"
-              chartHeight={TRENT_CHART_HEIGHT}
+              chartHeight={TREND_CHART_HEIGHT}
               chartOptionsContextMenu={chartOptionsContextMenu}
               comboboxRef={stackByField0ComboboxRef}
               defaultStackByOption={trendChartStackBy}
               extraActions={resetGroupByFieldAction}
-              filters={alertsHistogramDefaultFilters}
+              filters={alertsDefaultFilters}
               inspectTitle={i18n.TREND}
               onFieldSelected={updateCommonStackBy0}
-              panelHeight={TREND_CHART_PANEL_HEIGHT}
+              panelHeight={CHART_PANEL_HEIGHT}
               query={query}
               runtimeMappings={runtimeMappings}
               setComboboxInputRef={setStackByField0ComboboxInputRef}
@@ -199,6 +235,8 @@ const ChartPanelsComponent: React.FC<Props> = ({
               title={title}
               titleSize={'s'}
               updateDateRange={updateDateRangeCallback}
+              isExpanded={isExpanded}
+              setIsExpanded={setIsExpanded}
             />
           )}
         </FullHeightFlexItem>
@@ -213,9 +251,9 @@ const ChartPanelsComponent: React.FC<Props> = ({
               alignHeader="flexStart"
               chartOptionsContextMenu={chartOptionsContextMenu}
               extraActions={resetGroupByFieldAction}
-              filters={alertsHistogramDefaultFilters}
+              filters={alertsDefaultFilters}
               inspectTitle={i18n.TABLE}
-              panelHeight={TABLE_PANEL_HEIGHT}
+              panelHeight={CHART_PANEL_HEIGHT}
               query={query}
               runtimeMappings={runtimeMappings}
               setStackByField0={updateCommonStackBy0}
@@ -228,6 +266,8 @@ const ChartPanelsComponent: React.FC<Props> = ({
               stackByField1={countTableStackBy1}
               stackByField1ComboboxRef={stackByField1ComboboxRef}
               title={title}
+              isExpanded={isExpanded}
+              setIsExpanded={setIsExpanded}
             />
           )}
         </FullHeightFlexItem>
@@ -242,13 +282,15 @@ const ChartPanelsComponent: React.FC<Props> = ({
               addFilter={addFilter}
               alignHeader="flexStart"
               chartOptionsContextMenu={chartOptionsContextMenu}
-              filters={alertsHistogramDefaultFilters}
+              height={CHART_PANEL_HEIGHT}
               inspectTitle={i18n.TREEMAP}
-              isPanelExpanded={isTreemapPanelExpanded}
+              isPanelExpanded={isAlertsPageChartsEnabled ? isExpanded : isTreemapPanelExpanded}
+              filters={alertsDefaultFilters}
               query={query}
               riskSubAggregationField="kibana.alert.risk_score"
-              runtimeMappings={runtimeMappings}
-              setIsPanelExpanded={setIsTreemapPanelExpanded}
+              setIsPanelExpanded={
+                isAlertsPageChartsEnabled ? setIsExpanded : setIsTreemapPanelExpanded
+              }
               setStackByField0={updateCommonStackBy0}
               setStackByField0ComboboxInputRef={setStackByField0ComboboxInputRef}
               setStackByField1={updateCommonStackBy1}
@@ -267,17 +309,21 @@ const ChartPanelsComponent: React.FC<Props> = ({
       {isAlertsPageChartsEnabled && alertViewSelection === 'charts' && (
         <FullHeightFlexItem grow={1}>
           {isLoadingIndexPattern ? (
-            <EuiLoadingSpinner data-test-subj="alertsChartsLoadingSpinner" size="xl" />
+            <EuiLoadingContent lines={10} data-test-subj="chartsLoadingSpinner" />
           ) : (
             <AlertsSummaryChartsPanel
               alignHeader="flexStart"
               addFilter={addFilter}
-              filters={alertsHistogramDefaultFilters}
+              filters={alertsDefaultFilters}
               query={query}
-              panelHeight={ALERTS_CHARTS_PANEL_HEIGHT}
+              panelHeight={CHART_PANEL_HEIGHT}
               signalIndexName={signalIndexName}
               title={title}
               runtimeMappings={runtimeMappings}
+              isExpanded={isExpanded}
+              setIsExpanded={setIsExpanded}
+              groupBySelection={groupBySelection}
+              setGroupBySelection={setGroupBySelection}
             />
           )}
         </FullHeightFlexItem>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
index 8cc5c6ad0afa9..6b51c12607e38 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
@@ -217,7 +217,7 @@ const DetectionEnginePageComponent: React.FC<DetectionEngineComponentProps> = ({
     [formatUrl, navigateToUrl]
   );
 
-  const alertsHistogramDefaultFilters = useMemo(
+  const alertsDefaultFilters = useMemo(
     () => [
       ...filters,
       ...buildShowBuildingBlockFilter(showBuildingBlockAlerts),
@@ -437,7 +437,7 @@ const DetectionEnginePageComponent: React.FC<DetectionEngineComponentProps> = ({
               <EuiSpacer size="l" />
               <ChartPanels
                 addFilter={addFilter}
-                alertsHistogramDefaultFilters={alertsHistogramDefaultFilters}
+                alertsDefaultFilters={alertsDefaultFilters}
                 isLoadingIndexPattern={isChartPanelLoading}
                 query={query}
                 runtimeMappings={runtimeMappings}

From cf9707b215dd24c365bac0959717ad9e694bd26a Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Tue, 7 Feb 2023 17:19:54 +0200
Subject: [PATCH 068/134] [Lens] Fixes problem with timeshift in formula and
 breakdown (#150406)

## Summary

Closes https://github.com/elastic/kibana/issues/146200

This bug can easily be replicated with the following scenario:
1. Add a date histogram on the x axis
2. Add a formula with shift (use different timeshifts) i.e. count() -
count(shift=1d)
3. Add a terms breakdown and switch off the Aggregate by this function
first

The fi is easy, it fails on the each look as it requires the agg to have
buckets but it doesnt at this scenario. I also added a test.

How it looks now
<img width="1049" alt="image"
src="https://user-images.githubusercontent.com/17003240/217195447-3b6edb8d-0814-4148-888d-9bd64e924c76.png">


### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../_terms_other_bucket_helper.test.ts        | 32 +++++++++++++++++++
 .../buckets/_terms_other_bucket_helper.ts     |  7 ++--
 2 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
index 3dae2099de9e4..e39c858f3e903 100644
--- a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
@@ -325,6 +325,38 @@ describe('Terms Agg Other bucket helper', () => {
         expect(typeof agg).toBe('function');
       });
 
+      test('returns a function for undefined agg buckets', () => {
+        const response = {
+          took: 10,
+          timed_out: false,
+          _shards: {
+            total: 1,
+            successful: 1,
+            skipped: 0,
+            failed: 0,
+          },
+          hits: {
+            total: 14005,
+            max_score: 0,
+            hits: [],
+          },
+          aggregations: {
+            2: {
+              doc_count_error_upper_bound: 0,
+              sum_other_doc_count: 8325,
+            },
+          },
+          status: 200,
+        };
+        const aggConfigs = getAggConfigs(nestedTerm.aggs);
+        const agg = buildOtherBucketAgg(
+          aggConfigs,
+          aggConfigs.aggs[1] as IBucketAggConfig,
+          enrichResponseWithSampling(response)
+        );
+        expect(agg).toBe(false);
+      });
+
       test('correctly builds query with single terms agg', () => {
         const aggConfigs = getAggConfigs(singleTerm.aggs);
         const agg = buildOtherBucketAgg(
diff --git a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
index 8f82a2df86e5a..d4542d1513f16 100644
--- a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
@@ -196,12 +196,11 @@ export const buildOtherBucketAgg = (
     key: string
   ) => {
     // make sure there are actually results for the buckets
-    if (aggregations[aggId]?.buckets.length < 1) {
+    const agg = aggregations[aggId];
+    if (!agg || !agg.buckets.length) {
       noAggBucketResults = true;
       return;
     }
-
-    const agg = aggregations[aggId];
     const newAggIndex = aggIndex + 1;
     const newAgg = bucketAggs[newAggIndex];
     const currentAgg = bucketAggs[aggIndex];
@@ -209,7 +208,7 @@ export const buildOtherBucketAgg = (
       exhaustiveBuckets = false;
     }
     if (aggIndex < index) {
-      each(agg.buckets, (bucket: any, bucketObjKey) => {
+      each(agg?.buckets, (bucket: any, bucketObjKey) => {
         const bucketKey = currentAgg.getKey(
           bucket,
           isNumber(bucketObjKey) ? undefined : bucketObjKey

From 0156d6ffc0bd91bcbf6847a2b24333c1e193cd6a Mon Sep 17 00:00:00 2001
From: Patrick Mueller <patrick.mueller@elastic.co>
Date: Tue, 7 Feb 2023 10:33:12 -0500
Subject: [PATCH 069/134] adds an example rule type example.pattern (#150068)

## Summary

See the included help file for more details:
[`x-pack/examples/alerting_example/server/alert_types/pattern.md`](https://github.com/pmuellr/kibana/blob/main/x-pack/examples/alerting_example/server/alert_types/pattern.md).

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../examples/alerting_example/jest.config.js  |  17 ++
 .../server/alert_types/pattern.md             |  70 ++++++
 .../server/alert_types/pattern.test.ts        | 202 ++++++++++++++++++
 .../server/alert_types/pattern.ts             | 150 +++++++++++++
 .../alerting_example/server/plugin.ts         |   2 +
 .../examples/alerting_example/tsconfig.json   |   1 +
 6 files changed, 442 insertions(+)
 create mode 100644 x-pack/examples/alerting_example/jest.config.js
 create mode 100644 x-pack/examples/alerting_example/server/alert_types/pattern.md
 create mode 100644 x-pack/examples/alerting_example/server/alert_types/pattern.test.ts
 create mode 100644 x-pack/examples/alerting_example/server/alert_types/pattern.ts

diff --git a/x-pack/examples/alerting_example/jest.config.js b/x-pack/examples/alerting_example/jest.config.js
new file mode 100644
index 0000000000000..eb7daf136078e
--- /dev/null
+++ b/x-pack/examples/alerting_example/jest.config.js
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../..',
+  roots: ['<rootDir>/x-pack/examples/alerting_example'],
+  coverageDirectory: '<rootDir>/target/kibana-coverage/jest/x-pack/examples/alerting_example',
+  coverageReporters: ['text', 'html'],
+  collectCoverageFrom: [
+    '<rootDir>/x-pack/examples/alerting_example/{common,public,server}/**/*.{ts,tsx}',
+  ],
+};
diff --git a/x-pack/examples/alerting_example/server/alert_types/pattern.md b/x-pack/examples/alerting_example/server/alert_types/pattern.md
new file mode 100644
index 0000000000000..68eb53327b28c
--- /dev/null
+++ b/x-pack/examples/alerting_example/server/alert_types/pattern.md
@@ -0,0 +1,70 @@
+# rule type `example.pattern`
+
+This rule type will generate alerts on a pattern.  The rule parameter
+is `patterns`, and should be an `Record<string, string>` where the
+key is the instance name, and the value is a string of tokens, either
+`a` or `-`, used to indicate if the alert should be active or not.
+
+The patterns progress through each step, and then cycle around to the
+beginning when they get to the end.
+
+For example, the parameter below will generate alerts on the following
+runs, with the cycle repeating at run 7.
+
+    {
+      patterns: {
+        instA: ' a - a ',
+        instB: ' - a ',
+      },
+    }
+
+| run  | instA  | instB  |
+| ---- | ------ | ------ |
+|    1 | active |        |
+|    2 |        | active |
+|    3 | active |        |
+|    4 | active | active |
+|    5 |        |        |
+|    6 | active | active |
+|    7 | active |        |
+
+The context variables available are:
+
+- `patternIndex` - index of the pattern being run
+- `action` - either 'a' or '-' for the current pattern action, so 'a' :-)
+- `pattern` - the entire pattern, as an array of 'a' and '-' chars
+- `runs` - total number of runs of the rule
+
+There is no UX for this (yet), so you'll need to use `curl` to create/update
+the rule.  The following also uses [`jq`](https://stedolan.github.io/jq/) 
+to create a connector and capture it's id to use with the rule.
+
+```console
+SERVER_LOG_ID=`curl $KBN_URL/api/actions/connector -H "kbn-xsrf: foo" -H "content-type: application/json" -d '{
+  "connector_type_id": ".server-log",
+  "name": "server log",
+  "config": {},
+  "secrets": {}
+}' |  jq -r '.id'`
+
+
+curl $KBN_URL/api/alerting/rule/ -H "kbn-xsrf: foo" -H "content-type: application/json" -d "{
+  \"rule_type_id\": \"example.pattern\",
+  \"name\": \"pattern\",
+  \"schedule\": {
+    \"interval\": \"5s\"
+  },
+  \"actions\": [
+    { \"group\": \"default\", \"id\": \"$SERVER_LOG_ID\", \"params\": { \"message\": \"{{alert.id}} active on run {{context.runs}} step {{context.patternIndex}}\"}}
+  ],
+  \"consumer\": \"alerts\",
+  \"tags\": [],
+  \"notify_when\": \"onActiveAlert\",
+  \"params\": {
+    \"patterns\": {
+      \"instA\": \" a - a \",
+      \"instB\": \" - a \"
+    }
+  }
+}"
+```
diff --git a/x-pack/examples/alerting_example/server/alert_types/pattern.test.ts b/x-pack/examples/alerting_example/server/alert_types/pattern.test.ts
new file mode 100644
index 0000000000000..a9e48cdc7925e
--- /dev/null
+++ b/x-pack/examples/alerting_example/server/alert_types/pattern.test.ts
@@ -0,0 +1,202 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { loggingSystemMock } from '@kbn/core/server/mocks';
+import { alertType } from './pattern';
+
+const logger = loggingSystemMock.create().get();
+
+describe('pattern rule type', () => {
+  test('throws on bad patterns', async () => {
+    const params = {
+      patterns: {
+        instA: ' a nope - ',
+        instB: ' hallo! ',
+      },
+    };
+    const state = {};
+    const options = {
+      params,
+      state,
+    };
+    try {
+      await alertType.executor(options as any);
+    } catch (err) {
+      expect(err.message).toMatchInlineSnapshot(
+        `"errors in patterns: pattern for instA contains invalid string: \\"nope\\", pattern for instB contains invalid string: \\"hallo!\\""`
+      );
+    }
+  });
+
+  test('works as expected', async () => {
+    const params = {
+      patterns: {
+        instA: ' a - a ',
+        instB: ' - a ',
+      },
+    };
+    const state = {};
+    const services = getServices();
+    const options = {
+      logger,
+      params,
+      state,
+      services,
+    };
+
+    let result: any;
+    for (let i = 0; i < 6; i++) {
+      result = await alertType.executor(options as any);
+      options.state = result.state;
+    }
+
+    expect(services.scheduledActions).toMatchInlineSnapshot(`
+      Array [
+        Array [
+          "instA",
+          "default",
+          Object {
+            "action": "a",
+            "pattern": Array [
+              "a",
+              "-",
+              "a",
+            ],
+            "patternIndex": 0,
+            "runs": 1,
+          },
+        ],
+        Array [
+          "instB",
+          "default",
+          Object {
+            "action": "a",
+            "pattern": Array [
+              "-",
+              "a",
+            ],
+            "patternIndex": 1,
+            "runs": 2,
+          },
+        ],
+        Array [
+          "instA",
+          "default",
+          Object {
+            "action": "a",
+            "pattern": Array [
+              "a",
+              "-",
+              "a",
+            ],
+            "patternIndex": 2,
+            "runs": 3,
+          },
+        ],
+        Array [
+          "instA",
+          "default",
+          Object {
+            "action": "a",
+            "pattern": Array [
+              "a",
+              "-",
+              "a",
+            ],
+            "patternIndex": 0,
+            "runs": 4,
+          },
+        ],
+        Array [
+          "instB",
+          "default",
+          Object {
+            "action": "a",
+            "pattern": Array [
+              "-",
+              "a",
+            ],
+            "patternIndex": 1,
+            "runs": 4,
+          },
+        ],
+        Array [
+          "instA",
+          "default",
+          Object {
+            "action": "a",
+            "pattern": Array [
+              "a",
+              "-",
+              "a",
+            ],
+            "patternIndex": 2,
+            "runs": 6,
+          },
+        ],
+        Array [
+          "instB",
+          "default",
+          Object {
+            "action": "a",
+            "pattern": Array [
+              "-",
+              "a",
+            ],
+            "patternIndex": 1,
+            "runs": 6,
+          },
+        ],
+      ]
+    `);
+
+    expect(result.state).toMatchInlineSnapshot(`
+      Object {
+        "patternParamJSON": "{\\"instA\\":\\" a - a \\",\\"instB\\":\\" - a \\"}",
+        "patterns": Array [
+          Object {
+            "instance": "instA",
+            "pattern": Array [
+              "a",
+              "-",
+              "a",
+            ],
+            "patternIndex": 0,
+          },
+          Object {
+            "instance": "instB",
+            "pattern": Array [
+              "-",
+              "a",
+            ],
+            "patternIndex": 0,
+          },
+        ],
+        "runs": 6,
+      }
+    `);
+  });
+});
+
+// services.alertFactory.create(instance).scheduleActions('default', context);
+type ScheduledAction = [string, string, any];
+function getServices() {
+  const scheduledActions: ScheduledAction[] = [];
+
+  return {
+    scheduledActions,
+    alertFactory: {
+      create(instance: string) {
+        return {
+          scheduleActions(actionGroup: string, context: any) {
+            scheduledActions.push([instance, actionGroup, context]);
+          },
+        };
+      },
+    },
+  };
+}
diff --git a/x-pack/examples/alerting_example/server/alert_types/pattern.ts b/x-pack/examples/alerting_example/server/alert_types/pattern.ts
new file mode 100644
index 0000000000000..1cebdf7f3f5f5
--- /dev/null
+++ b/x-pack/examples/alerting_example/server/alert_types/pattern.ts
@@ -0,0 +1,150 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema, TypeOf } from '@kbn/config-schema';
+import {
+  RuleType as BaseRuleType,
+  RuleTypeState,
+  RuleExecutorOptions as BaseRuleExecutorOptions,
+} from '@kbn/alerting-plugin/server';
+
+type Params = TypeOf<typeof Params>;
+const Params = schema.object(
+  {
+    patterns: schema.recordOf(schema.string(), schema.string()),
+  },
+  {
+    validate({ patterns }) {
+      try {
+        buildPatterns(patterns);
+      } catch (err) {
+        return err.message;
+      }
+    },
+  }
+);
+
+type Action = 'a' | '-'; // active, error, not active
+interface InstancePattern {
+  instance: string;
+  patternIndex: number;
+  pattern: Action[];
+}
+
+interface State extends RuleTypeState {
+  patternParamJSON?: string;
+  patterns?: InstancePattern[];
+  runs?: number;
+}
+
+type RuleExecutorOptions = BaseRuleExecutorOptions<Params, State, {}, {}, 'default'>;
+
+type RuleType = BaseRuleType<Params, never, State, {}, {}, 'default'>;
+export const alertType: RuleType = getPatternRuleType();
+
+function getPatternRuleType(): RuleType {
+  return {
+    id: 'example.pattern',
+    name: 'Example: Creates alerts on a pattern, for testing',
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    producer: 'alertsFixture',
+    defaultActionGroupId: 'default',
+    minimumLicenseRequired: 'basic',
+    isExportable: true,
+    executor,
+    validate: {
+      params: Params,
+    },
+  };
+}
+
+async function executor(options: RuleExecutorOptions): Promise<{ state: State }> {
+  const { services, state, params } = options;
+
+  if (state.runs == null) {
+    state.runs = 0;
+  }
+  state.runs++;
+
+  // rebuild our patterns in state if the params change
+  const patternParamJSON = JSON.stringify(params.patterns);
+  if (state.patternParamJSON !== patternParamJSON) {
+    state.patterns = undefined;
+  }
+
+  if (state.patterns == null) {
+    state.patternParamJSON = patternParamJSON;
+    state.patterns = buildPatterns(params.patterns);
+  }
+
+  const { patterns, runs } = state;
+
+  for (const element of patterns) {
+    const { instance, pattern, patternIndex } = element;
+    const action = pattern[patternIndex];
+
+    element.patternIndex++;
+    if (element.patternIndex >= element.pattern.length) {
+      element.patternIndex = 0;
+    }
+
+    switch (action) {
+      case 'a':
+        const context = { patternIndex, action, pattern, runs };
+        services.alertFactory.create(instance).scheduleActions('default', context);
+        break;
+      case '-':
+        break;
+      default:
+        options.logger.error(`invalid action "${action}" from instance ${instance}`);
+    }
+  }
+
+  return {
+    state: {
+      patterns,
+      patternParamJSON,
+      runs,
+    },
+  };
+}
+
+function buildPatterns(stringPatterns: Record<string, string>): InstancePattern[] {
+  const result: InstancePattern[] = [];
+  const errors: string[] = [];
+
+  for (const [instance, stringPattern] of Object.entries(stringPatterns)) {
+    const pattern = getPatternFromString(instance, stringPattern, errors);
+    result.push({ instance, pattern, patternIndex: 0 });
+  }
+
+  if (errors.length) {
+    throw new Error(`errors in patterns: ${errors.join(', ')}`);
+  }
+
+  return result;
+}
+
+function getPatternFromString(instance: string, stringPattern: string, errors: string[]): Action[] {
+  const result: Action[] = [];
+
+  const runs = stringPattern.trim().split(/\s+/g);
+  for (const run of runs) {
+    switch (run) {
+      case 'a':
+        result.push('a');
+        break;
+      case '-':
+        result.push('-');
+        break;
+      default:
+        errors.push(`pattern for ${instance} contains invalid string: "${run}"`);
+    }
+  }
+
+  return result;
+}
diff --git a/x-pack/examples/alerting_example/server/plugin.ts b/x-pack/examples/alerting_example/server/plugin.ts
index 06e3e9bc772f4..32a55020ed524 100644
--- a/x-pack/examples/alerting_example/server/plugin.ts
+++ b/x-pack/examples/alerting_example/server/plugin.ts
@@ -14,6 +14,7 @@ import { PluginSetupContract as FeaturesPluginSetup } from '@kbn/features-plugin
 
 import { alertType as alwaysFiringAlert } from './alert_types/always_firing';
 import { alertType as peopleInSpaceAlert } from './alert_types/astros';
+import { alertType as patternAlert } from './alert_types/pattern';
 // can't import static code from another plugin to support examples functional test
 const INDEX_THRESHOLD_ID = '.index-threshold';
 import { ALERTING_EXAMPLE_APP_ID } from '../common/constants';
@@ -28,6 +29,7 @@ export class AlertingExamplePlugin implements Plugin<void, void, AlertingExample
   public setup(core: CoreSetup, { alerting, features }: AlertingExampleDeps) {
     alerting.registerType(alwaysFiringAlert);
     alerting.registerType(peopleInSpaceAlert);
+    alerting.registerType(patternAlert);
 
     features.registerKibanaFeature({
       id: ALERTING_EXAMPLE_APP_ID,
diff --git a/x-pack/examples/alerting_example/tsconfig.json b/x-pack/examples/alerting_example/tsconfig.json
index 4e9b080673049..21967255756a3 100644
--- a/x-pack/examples/alerting_example/tsconfig.json
+++ b/x-pack/examples/alerting_example/tsconfig.json
@@ -25,5 +25,6 @@
     "@kbn/developer-examples-plugin",
     "@kbn/i18n",
     "@kbn/core-application-common",
+    "@kbn/config-schema",
   ]
 }

From 0a9d122d8f0469c4a754329ecf4391ad040d2a75 Mon Sep 17 00:00:00 2001
From: GitStart <1501599+gitstart@users.noreply.github.com>
Date: Tue, 7 Feb 2023 20:44:38 +0500
Subject: [PATCH 070/134] [Fleet]: `Unenrolled` status label color is not same
 as available in status bar under Agents tab. (#150258)

[Fleet]: Unenrolled status label color is not same as available in
status bar under Agents tab

Resolves https://github.com/elastic/kibana/issues/149661

### Loom/Screenshot Demo
* **How to reproduce the issue:**
https://www.loom.com/share/fe09755fd3954bdb974e6523c9bd21de
* **Fix:** https://www.loom.com/share/a73131aa16b949d690cc984418715b52

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../fleet/sections/agents/components/agent_health.tsx           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_health.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_health.tsx
index e8acd25e05f3f..9674480ab8bfe 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_health.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_health.tsx
@@ -37,7 +37,7 @@ const Status = {
     </EuiBadge>
   ),
   Unenrolled: (
-    <EuiBadge color="hollow">
+    <EuiBadge color={euiVars.euiColorDisabled}>
       <FormattedMessage
         id="xpack.fleet.agentHealth.unenrolledStatusText"
         defaultMessage="Unenrolled"

From 3e963b64c104d52f676140797207a700cd6734a4 Mon Sep 17 00:00:00 2001
From: Cristina Amico <criamico@users.noreply.github.com>
Date: Tue, 7 Feb 2023 16:55:05 +0100
Subject: [PATCH 071/134] [Fleet] Hide cancel button in agent activity panel
 when upgrade starts immediately (#150425)

Closes https://github.com/elastic/kibana/issues/146112

## Summary
When upgrading agents with upgrade set to "immediately", the cancel
button on agent activity panel is now hidden.

To determine whether the upgrade action is set to immediately or not I
added a parameter `hasRolloutPeriod` to the `ActionStatus` response, so
that this information is easily available in the activity panel.

### Before

<img width="1004" alt="Screenshot 2023-02-07 at 13 04 19"
src="https://user-images.githubusercontent.com/16084106/217240273-d5b69edf-1ac7-48c0-bdd5-d44ab8f3c6aa.png">

### After
<img width="1002" alt="Screenshot 2023-02-07 at 13 03 29"
src="https://user-images.githubusercontent.com/16084106/217240298-37eb4a7e-7f15-4864-ab84-c0b245091ecd.png">


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../fleet/common/types/models/agent.ts        |  1 +
 .../components/agent_activity_flyout.test.tsx | 40 +++++++++++++++++++
 .../components/agent_activity_flyout.tsx      | 28 ++++++++-----
 .../server/services/agents/action_status.ts   |  1 +
 .../apis/agents/action_status.ts              |  5 +++
 5 files changed, 64 insertions(+), 11 deletions(-)

diff --git a/x-pack/plugins/fleet/common/types/models/agent.ts b/x-pack/plugins/fleet/common/types/models/agent.ts
index e530ca152addd..537d0f250e828 100644
--- a/x-pack/plugins/fleet/common/types/models/agent.ts
+++ b/x-pack/plugins/fleet/common/types/models/agent.ts
@@ -154,6 +154,7 @@ export interface ActionStatus {
   cancellationTime?: string;
   newPolicyId?: string;
   creationTime: string;
+  hasRolloutPeriod?: boolean;
 }
 
 export interface AgentDiagnostics {
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout.test.tsx
index 85ab31cfb9398..f143326e4c7b0 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout.test.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout.test.tsx
@@ -79,6 +79,7 @@ describe('AgentActivityFlyout', () => {
         expiration: '2099-09-16T10:00:00.000Z',
         creationTime: '2022-09-15T10:00:00.000Z',
         nbAgentsFailed: 0,
+        hasRolloutPeriod: true,
       },
     ];
     mockUseActionStatus.mockReturnValue({
@@ -107,6 +108,45 @@ describe('AgentActivityFlyout', () => {
     expect(mockAbortUpgrade).toHaveBeenCalled();
   });
 
+  it('should not render cancel button if the upgrade is set to happen immediately', () => {
+    const mockActionStatuses = [
+      {
+        actionId: 'action2',
+        nbAgentsActionCreated: 5,
+        nbAgentsAck: 0,
+        version: '8.5.0',
+        startTime: '2022-09-15T10:00:00.000Z',
+        type: 'UPGRADE',
+        nbAgentsActioned: 5,
+        status: 'IN_PROGRESS',
+        expiration: '2099-09-16T10:00:00.000Z',
+        creationTime: '2022-09-15T10:00:00.000Z',
+        nbAgentsFailed: 0,
+        hasRolloutPeriod: false,
+      },
+    ];
+    mockUseActionStatus.mockReturnValue({
+      currentActions: mockActionStatuses,
+      abortUpgrade: mockAbortUpgrade,
+      isFirstLoading: true,
+    });
+    const result = renderComponent();
+
+    expect(result.getByText('Agent activity')).toBeInTheDocument();
+
+    expect(
+      result.container.querySelector('[data-test-subj="upgradeInProgressTitle"]')!.textContent
+    ).toEqual('Upgrading 5 agents to version 8.5.0');
+    // compare without whitespace, &nbsp; doesn't match
+    expect(
+      result.container
+        .querySelector('[data-test-subj="upgradeInProgressDescription"]')!
+        .textContent?.replace(/\s/g, '')
+    ).toContain('Started on Sep 15, 2022 10:00 AM. Learn more'.replace(/\s/g, ''));
+
+    expect(result.queryByText('Cancel')).not.toBeInTheDocument();
+  });
+
   it('should render agent activity for scheduled upgrade', () => {
     const mockActionStatuses = [
       {
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout.tsx
index e7095e7af5a4c..b57e1aea8b39e 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout.tsx
@@ -532,6 +532,10 @@ export const UpgradeInProgressActivityItem: React.FunctionComponent<{
     return startDate > now;
   }, [action]);
 
+  const showCancelButton = useMemo(() => {
+    return isScheduled || action.hasRolloutPeriod;
+  }, [action, isScheduled]);
+
   return (
     <EuiPanel hasBorder={true} borderRadius="none">
       <EuiFlexGroup direction="column" gutterSize="m">
@@ -592,17 +596,19 @@ export const UpgradeInProgressActivityItem: React.FunctionComponent<{
               </EuiText>
             </EuiFlexItem>
             <EuiFlexItem grow={false}>
-              <EuiButton
-                size="s"
-                onClick={onClickAbortUpgrade}
-                isLoading={isAborting}
-                data-test-subj="abortBtn"
-              >
-                <FormattedMessage
-                  id="xpack.fleet.agentActivityFlyout.abortUpgradeButtom"
-                  defaultMessage="Cancel"
-                />
-              </EuiButton>
+              {showCancelButton ? (
+                <EuiButton
+                  size="s"
+                  onClick={onClickAbortUpgrade}
+                  isLoading={isAborting}
+                  data-test-subj="abortBtn"
+                >
+                  <FormattedMessage
+                    id="xpack.fleet.agentActivityFlyout.abortUpgradeButtom"
+                    defaultMessage="Cancel"
+                  />
+                </EuiButton>
+              ) : null}
             </EuiFlexItem>
           </EuiFlexGroup>
         </EuiFlexItem>
diff --git a/x-pack/plugins/fleet/server/services/agents/action_status.ts b/x-pack/plugins/fleet/server/services/agents/action_status.ts
index c50630784619a..a1a86d5963f60 100644
--- a/x-pack/plugins/fleet/server/services/agents/action_status.ts
+++ b/x-pack/plugins/fleet/server/services/agents/action_status.ts
@@ -216,6 +216,7 @@ async function _getActions(
           newPolicyId: source.data?.policy_id as string,
           creationTime: source['@timestamp']!,
           nbAgentsFailed: 0,
+          hasRolloutPeriod: !!source.rollout_duration_seconds,
         };
       }
 
diff --git a/x-pack/test/fleet_api_integration/apis/agents/action_status.ts b/x-pack/test/fleet_api_integration/apis/agents/action_status.ts
index ef74514c230d2..84fb3244aa044 100644
--- a/x-pack/test/fleet_api_integration/apis/agents/action_status.ts
+++ b/x-pack/test/fleet_api_integration/apis/agents/action_status.ts
@@ -195,6 +195,7 @@ export default function (providerContext: FtrProviderContext) {
             status: 'IN_PROGRESS',
             creationTime: '2022-09-15T10:00:00.000Z',
             nbAgentsFailed: 0,
+            hasRolloutPeriod: false,
           },
           {
             actionId: 'action3',
@@ -207,6 +208,7 @@ export default function (providerContext: FtrProviderContext) {
             creationTime: '2022-09-15T10:00:00.000Z',
             nbAgentsFailed: 0,
             completionTime: '2022-09-15T12:00:00.000Z',
+            hasRolloutPeriod: false,
           },
           {
             actionId: 'action4',
@@ -218,6 +220,7 @@ export default function (providerContext: FtrProviderContext) {
             expiration: '2022-09-14T10:00:00.000Z',
             creationTime: '2022-09-15T10:00:00.000Z',
             nbAgentsFailed: 0,
+            hasRolloutPeriod: false,
           },
           {
             actionId: 'action5',
@@ -231,6 +234,7 @@ export default function (providerContext: FtrProviderContext) {
             creationTime: '2022-09-15T10:00:00.000Z',
             nbAgentsFailed: 0,
             cancellationTime: '2022-09-15T11:00:00.000Z',
+            hasRolloutPeriod: false,
           },
           {
             actionId: 'action7',
@@ -244,6 +248,7 @@ export default function (providerContext: FtrProviderContext) {
             creationTime: '2022-09-15T10:00:00.000Z',
             nbAgentsFailed: 1,
             completionTime: '2022-09-15T11:00:00.000Z',
+            hasRolloutPeriod: false,
           },
         ]);
       });

From 6d96f51dfa702ebad95f1b8ea362e74ec9eb3fab Mon Sep 17 00:00:00 2001
From: Anton Dosov <anton.dosov@elastic.co>
Date: Tue, 7 Feb 2023 17:00:10 +0100
Subject: [PATCH 072/134] [CM] Setup client side content client (#150171)

## Summary

Partially addresses https://github.com/elastic/kibana/issues/149216,
https://github.com/elastic/kibana/issues/149939
Closes https://github.com/elastic/kibana/issues/149217


Setup basic client-side content client (client, cache, react content and
hooks) based on the latest API from @sebelga's [server-side and rpc
POC](https://github.com/elastic/kibana/pull/148791/). We assume that the
POC isn't far from the initial version that we are going to merge to
main

Initial content client implementation scope:
- We start from using tanstack/query for client side caching, content
queuing and mutating . Also use it as a basis for the API. We start from
their defaults and will adjust defaults as we go. Basically our content
client would be a helpful wrapper around tanstack/query (at least
initially)
- We start from exposing minimal query lib API surface, but we will
gradually expose more as needed
- For content retrieval we support promise based, RXJS observable based
and react hook based methods
- For the RPC/api I copied over the latest from [server-side and rpc
POC](https://github.com/elastic/kibana/pull/148791/) assuming it won't
change much.
- no optimistic update or automatic invalidation after updates yet (this
will be later)
- just get and create for now
---
 .../content_management/common/index.ts        |  2 +
 src/plugins/content_management/common/rpc.ts  | 72 +++++++++++++++++++
 .../content_client/content_client.test.ts     | 62 ++++++++++++++++
 .../public/content_client/content_client.tsx  | 54 ++++++++++++++
 .../content_client/content_client_context.tsx | 30 ++++++++
 .../content_client_mutation_hooks.test.tsx    | 41 +++++++++++
 .../content_client_mutation_hooks.tsx         | 20 ++++++
 .../content_client_query_hooks.test.tsx       | 38 ++++++++++
 .../content_client_query_hooks.tsx            | 32 +++++++++
 .../public/content_client/index.ts            | 12 ++++
 .../public/content_client/query_observable.ts | 45 ++++++++++++
 .../content_management/public/plugin.ts       | 20 ++++--
 .../public/rpc_client/index.ts                |  9 +++
 .../public/rpc_client/rpc_client.mock.ts      | 18 +++++
 .../public/rpc_client/rpc_client.ts           | 30 ++++++++
 .../content_management/public/types.ts        | 10 ++-
 src/plugins/content_management/tsconfig.json  |  2 +
 17 files changed, 491 insertions(+), 6 deletions(-)
 create mode 100644 src/plugins/content_management/common/rpc.ts
 create mode 100644 src/plugins/content_management/public/content_client/content_client.test.ts
 create mode 100644 src/plugins/content_management/public/content_client/content_client.tsx
 create mode 100644 src/plugins/content_management/public/content_client/content_client_context.tsx
 create mode 100644 src/plugins/content_management/public/content_client/content_client_mutation_hooks.test.tsx
 create mode 100644 src/plugins/content_management/public/content_client/content_client_mutation_hooks.tsx
 create mode 100644 src/plugins/content_management/public/content_client/content_client_query_hooks.test.tsx
 create mode 100644 src/plugins/content_management/public/content_client/content_client_query_hooks.tsx
 create mode 100644 src/plugins/content_management/public/content_client/index.ts
 create mode 100644 src/plugins/content_management/public/content_client/query_observable.ts
 create mode 100644 src/plugins/content_management/public/rpc_client/index.ts
 create mode 100644 src/plugins/content_management/public/rpc_client/rpc_client.mock.ts
 create mode 100644 src/plugins/content_management/public/rpc_client/rpc_client.ts

diff --git a/src/plugins/content_management/common/index.ts b/src/plugins/content_management/common/index.ts
index bc5dde9968d6d..3746f26a2cf3d 100644
--- a/src/plugins/content_management/common/index.ts
+++ b/src/plugins/content_management/common/index.ts
@@ -7,3 +7,5 @@
  */
 
 export { PLUGIN_ID, API_ENDPOINT } from './constants';
+export type { ProcedureSchemas, ProcedureName, GetIn, CreateIn } from './rpc';
+export { procedureNames, schemas as rpcSchemas } from './rpc';
diff --git a/src/plugins/content_management/common/rpc.ts b/src/plugins/content_management/common/rpc.ts
new file mode 100644
index 0000000000000..8e03dc886a3f0
--- /dev/null
+++ b/src/plugins/content_management/common/rpc.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { schema, Type } from '@kbn/config-schema';
+
+export interface ProcedureSchemas {
+  in?: Type<any> | false;
+  out?: Type<any> | false;
+}
+
+export const procedureNames = ['get', 'create'] as const;
+
+export type ProcedureName = typeof procedureNames[number];
+
+// ---------------------------------
+// API
+// ---------------------------------
+
+// ------- GET --------
+const getSchemas: ProcedureSchemas = {
+  in: schema.object(
+    {
+      contentType: schema.string(),
+      id: schema.string(),
+      options: schema.maybe(schema.object({}, { unknowns: 'allow' })),
+    },
+    { unknowns: 'forbid' }
+  ),
+  // --> "out" will be specified by each storage layer
+  out: schema.maybe(schema.object({}, { unknowns: 'allow' })),
+};
+
+export interface GetIn<Options extends object | undefined = undefined> {
+  id: string;
+  contentType: string;
+  options?: Options;
+}
+
+// -- Create content
+const createSchemas: ProcedureSchemas = {
+  in: schema.object(
+    {
+      contentType: schema.string(),
+      data: schema.object({}, { unknowns: 'allow' }),
+      options: schema.maybe(schema.object({}, { unknowns: 'allow' })),
+    },
+    { unknowns: 'forbid' }
+  ),
+  // Here we could enforce that an "id" field is returned
+  out: schema.maybe(schema.object({}, { unknowns: 'allow' })),
+};
+
+export interface CreateIn<
+  T extends string = string,
+  Data extends object = Record<string, unknown>,
+  Options extends object = any
+> {
+  contentType: T;
+  data: Data;
+  options?: Options;
+}
+
+export const schemas: {
+  [key in ProcedureName]: ProcedureSchemas;
+} = {
+  get: getSchemas,
+  create: createSchemas,
+};
diff --git a/src/plugins/content_management/public/content_client/content_client.test.ts b/src/plugins/content_management/public/content_client/content_client.test.ts
new file mode 100644
index 0000000000000..74be9a7c6aecf
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/content_client.test.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { lastValueFrom } from 'rxjs';
+import { takeWhile, toArray } from 'rxjs/operators';
+import type { RpcClient } from '../rpc_client';
+import { createRpcClientMock } from '../rpc_client/rpc_client.mock';
+import { ContentClient } from './content_client';
+import type { GetIn, CreateIn } from '../../common';
+
+let contentClient: ContentClient;
+let rpcClient: jest.Mocked<RpcClient>;
+beforeEach(() => {
+  rpcClient = createRpcClientMock();
+  contentClient = new ContentClient(rpcClient);
+});
+
+describe('#get', () => {
+  it('calls rpcClient.get with input and returns output', async () => {
+    const input: GetIn = { id: 'test', contentType: 'testType' };
+    const output = { test: 'test' };
+    rpcClient.get.mockResolvedValueOnce(output);
+    expect(await contentClient.get(input)).toEqual(output);
+    expect(rpcClient.get).toBeCalledWith(input);
+  });
+
+  it('calls rpcClient.get$ with input and returns output', async () => {
+    const input: GetIn = { id: 'test', contentType: 'testType' };
+    const output = { test: 'test' };
+    rpcClient.get.mockResolvedValueOnce(output);
+    const get$ = contentClient.get$(input).pipe(
+      takeWhile((result) => {
+        return result.data == null;
+      }, true),
+      toArray()
+    );
+
+    const [loadingState, loadedState] = await lastValueFrom(get$);
+
+    expect(loadingState.isLoading).toBe(true);
+    expect(loadingState.data).toBeUndefined();
+
+    expect(loadedState.isLoading).toBe(false);
+    expect(loadedState.data).toEqual(output);
+  });
+});
+
+describe('#create', () => {
+  it('calls rpcClient.create with input and returns output', async () => {
+    const input: CreateIn = { contentType: 'testType', data: { foo: 'bar' } };
+    const output = { test: 'test' };
+    rpcClient.create.mockImplementation(() => Promise.resolve(output));
+
+    expect(await contentClient.create(input)).toEqual(output);
+    expect(rpcClient.create).toBeCalledWith(input);
+  });
+});
diff --git a/src/plugins/content_management/public/content_client/content_client.tsx b/src/plugins/content_management/public/content_client/content_client.tsx
new file mode 100644
index 0000000000000..72c9ea9f88929
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/content_client.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { QueryClient } from '@tanstack/react-query';
+import { createQueryObservable } from './query_observable';
+import type { RpcClient } from '../rpc_client';
+import type { CreateIn, GetIn } from '../../common';
+
+const queryKeyBuilder = {
+  all: (type: string) => [type] as const,
+  item: (type: string, id: string) => {
+    return [...queryKeyBuilder.all(type), id] as const;
+  },
+};
+
+const createQueryOptionBuilder = ({ rpcClient }: { rpcClient: RpcClient }) => {
+  return {
+    get: <I extends GetIn = GetIn, O = unknown>(input: I) => {
+      return {
+        queryKey: queryKeyBuilder.item(input.contentType, input.id),
+        queryFn: () => rpcClient.get<I, O>(input),
+      };
+    },
+  };
+};
+
+export class ContentClient {
+  readonly queryClient: QueryClient;
+  readonly queryOptionBuilder: ReturnType<typeof createQueryOptionBuilder>;
+
+  constructor(private readonly rpcClient: RpcClient) {
+    this.queryClient = new QueryClient();
+    this.queryOptionBuilder = createQueryOptionBuilder({
+      rpcClient: this.rpcClient,
+    });
+  }
+
+  get<I extends GetIn = GetIn, O = unknown>(input: I): Promise<O> {
+    return this.queryClient.fetchQuery(this.queryOptionBuilder.get(input));
+  }
+
+  get$<I extends GetIn = GetIn, O = unknown>(input: I) {
+    return createQueryObservable(this.queryClient, this.queryOptionBuilder.get<I, O>(input));
+  }
+
+  create<I extends CreateIn, O = any>(input: I): Promise<O> {
+    return this.rpcClient.create(input);
+  }
+}
diff --git a/src/plugins/content_management/public/content_client/content_client_context.tsx b/src/plugins/content_management/public/content_client/content_client_context.tsx
new file mode 100644
index 0000000000000..0685c6acf74ed
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/content_client_context.tsx
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { QueryClientProvider } from '@tanstack/react-query';
+import type { ContentClient } from './content_client';
+
+const ContentClientContext = React.createContext<ContentClient>(null as unknown as ContentClient);
+
+export const useContentClient = (): ContentClient => {
+  const contentClient = React.useContext(ContentClientContext);
+  if (!contentClient) throw new Error('contentClient not found');
+  return contentClient;
+};
+
+export const ContentClientProvider: React.FC<{ contentClient: ContentClient }> = ({
+  contentClient,
+  children,
+}) => {
+  return (
+    <ContentClientContext.Provider value={contentClient}>
+      <QueryClientProvider client={contentClient.queryClient}>{children}</QueryClientProvider>
+    </ContentClientContext.Provider>
+  );
+};
diff --git a/src/plugins/content_management/public/content_client/content_client_mutation_hooks.test.tsx b/src/plugins/content_management/public/content_client/content_client_mutation_hooks.test.tsx
new file mode 100644
index 0000000000000..a7b9d4a5dfc7a
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/content_client_mutation_hooks.test.tsx
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { renderHook } from '@testing-library/react-hooks';
+import { ContentClientProvider } from './content_client_context';
+import { ContentClient } from './content_client';
+import { RpcClient } from '../rpc_client';
+import { createRpcClientMock } from '../rpc_client/rpc_client.mock';
+import { useCreateContentMutation } from './content_client_mutation_hooks';
+import type { CreateIn } from '../../common';
+
+let contentClient: ContentClient;
+let rpcClient: jest.Mocked<RpcClient>;
+beforeEach(() => {
+  rpcClient = createRpcClientMock();
+  contentClient = new ContentClient(rpcClient);
+});
+
+const Wrapper: React.FC = ({ children }) => (
+  <ContentClientProvider contentClient={contentClient}>{children}</ContentClientProvider>
+);
+
+describe('useCreateContentMutation', () => {
+  test('should call rpcClient.create with input and resolve with output', async () => {
+    const input: CreateIn = { contentType: 'testType', data: { foo: 'bar' } };
+    const output = { test: 'test' };
+    rpcClient.create.mockImplementation(() => Promise.resolve(output));
+    const { result, waitFor } = renderHook(() => useCreateContentMutation(), { wrapper: Wrapper });
+    result.current.mutate(input);
+
+    await waitFor(() => result.current.isSuccess);
+
+    expect(result.current.data).toEqual(output);
+  });
+});
diff --git a/src/plugins/content_management/public/content_client/content_client_mutation_hooks.tsx b/src/plugins/content_management/public/content_client/content_client_mutation_hooks.tsx
new file mode 100644
index 0000000000000..372b05b2ed093
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/content_client_mutation_hooks.tsx
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { useMutation } from '@tanstack/react-query';
+import { useContentClient } from './content_client_context';
+import type { CreateIn } from '../../common';
+
+export const useCreateContentMutation = <I extends CreateIn = CreateIn, O = unknown>() => {
+  const contentClient = useContentClient();
+  return useMutation({
+    mutationFn: (input: I) => {
+      return contentClient.create(input);
+    },
+  });
+};
diff --git a/src/plugins/content_management/public/content_client/content_client_query_hooks.test.tsx b/src/plugins/content_management/public/content_client/content_client_query_hooks.test.tsx
new file mode 100644
index 0000000000000..07a22bb5154d5
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/content_client_query_hooks.test.tsx
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { renderHook } from '@testing-library/react-hooks';
+import { ContentClientProvider } from './content_client_context';
+import { ContentClient } from './content_client';
+import { RpcClient } from '../rpc_client';
+import { createRpcClientMock } from '../rpc_client/rpc_client.mock';
+import { useGetContentQuery } from './content_client_query_hooks';
+import type { GetIn } from '../../common';
+
+let contentClient: ContentClient;
+let rpcClient: jest.Mocked<RpcClient>;
+beforeEach(() => {
+  rpcClient = createRpcClientMock();
+  contentClient = new ContentClient(rpcClient);
+});
+
+const Wrapper: React.FC = ({ children }) => (
+  <ContentClientProvider contentClient={contentClient}>{children}</ContentClientProvider>
+);
+
+describe('useGetContentQuery', () => {
+  test('should call rpcClient.get with input and resolve with output', async () => {
+    const input: GetIn = { id: 'test', contentType: 'testType' };
+    const output = { test: 'test' };
+    rpcClient.get.mockImplementation(() => Promise.resolve(output));
+    const { result, waitFor } = renderHook(() => useGetContentQuery(input), { wrapper: Wrapper });
+    await waitFor(() => result.current.isSuccess);
+    expect(result.current.data).toEqual(output);
+  });
+});
diff --git a/src/plugins/content_management/public/content_client/content_client_query_hooks.tsx b/src/plugins/content_management/public/content_client/content_client_query_hooks.tsx
new file mode 100644
index 0000000000000..09ee31bdd14f3
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/content_client_query_hooks.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { useQuery, QueryObserverOptions } from '@tanstack/react-query';
+import { useContentClient } from './content_client_context';
+import type { GetIn } from '../../common';
+
+/**
+ * Exposed `useQuery` options
+ */
+export type QueryOptions = Pick<QueryObserverOptions, 'enabled'>;
+
+/**
+ *
+ * @param input - get content identifier like "id" and "contentType"
+ * @param queryOptions -
+ */
+export const useGetContentQuery = <I extends GetIn = GetIn, O = unknown>(
+  input: I,
+  queryOptions?: QueryOptions
+) => {
+  const contentClient = useContentClient();
+  return useQuery({
+    ...contentClient.queryOptionBuilder.get<I, O>(input),
+    ...queryOptions,
+  });
+};
diff --git a/src/plugins/content_management/public/content_client/index.ts b/src/plugins/content_management/public/content_client/index.ts
new file mode 100644
index 0000000000000..329df9c596452
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/index.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { ContentClient } from './content_client';
+export { ContentClientProvider, useContentClient } from './content_client_context';
+export { useGetContentQuery } from './content_client_query_hooks';
+export { useCreateContentMutation } from './content_client_mutation_hooks';
diff --git a/src/plugins/content_management/public/content_client/query_observable.ts b/src/plugins/content_management/public/content_client/query_observable.ts
new file mode 100644
index 0000000000000..f486befb87d5e
--- /dev/null
+++ b/src/plugins/content_management/public/content_client/query_observable.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import {
+  notifyManager,
+  QueryObserver,
+  QueryObserverOptions,
+  QueryObserverResult,
+  QueryClient,
+  QueryKey,
+} from '@tanstack/react-query';
+import { Observable } from 'rxjs';
+
+export const createQueryObservable = <
+  TQueryFnData = unknown,
+  TError = unknown,
+  TData = TQueryFnData,
+  TQueryData = TQueryFnData,
+  TQueryKey extends QueryKey = QueryKey
+>(
+  queryClient: QueryClient,
+  queryOptions: QueryObserverOptions<TQueryFnData, TError, TData, TQueryData, TQueryKey>
+) => {
+  const queryObserver = new QueryObserver(
+    queryClient,
+    queryClient.defaultQueryOptions(queryOptions)
+  );
+
+  return new Observable<QueryObserverResult<TData, TError>>((subscriber) => {
+    const unsubscribe = queryObserver.subscribe(
+      // notifyManager is a singleton that batches updates across react query
+      notifyManager.batchCalls((result) => {
+        subscriber.next(result);
+      })
+    );
+    return () => {
+      unsubscribe();
+    };
+  });
+};
diff --git a/src/plugins/content_management/public/plugin.ts b/src/plugins/content_management/public/plugin.ts
index 1650d95955d44..77d0bcc6039bc 100644
--- a/src/plugins/content_management/public/plugin.ts
+++ b/src/plugins/content_management/public/plugin.ts
@@ -6,21 +6,33 @@
  * Side Public License, v 1.
  */
 
-import type { CoreSetup, Plugin } from '@kbn/core/public';
+import type { CoreSetup, CoreStart, Plugin } from '@kbn/core/public';
 import {
   ContentManagementPublicStart,
   ContentManagementPublicSetup,
   SetupDependencies,
+  StartDependencies,
 } from './types';
+import type { ContentClient } from './content_client';
 
 export class ContentManagementPlugin
-  implements Plugin<ContentManagementPublicSetup, ContentManagementPublicStart, SetupDependencies>
+  implements
+    Plugin<
+      ContentManagementPublicSetup,
+      ContentManagementPublicStart,
+      SetupDependencies,
+      StartDependencies
+    >
 {
   public setup(core: CoreSetup, deps: SetupDependencies) {
     return {};
   }
 
-  public start() {
-    return {};
+  public start(core: CoreStart, deps: StartDependencies) {
+    // don't actually expose the client until it is used to avoid increasing bundle size
+    // const rpcClient = new RpcClient(core.http);
+    // const contentClient = new ContentClient(rpcClient);
+    // return { client: contentClient };
+    return { client: {} as ContentClient };
   }
 }
diff --git a/src/plugins/content_management/public/rpc_client/index.ts b/src/plugins/content_management/public/rpc_client/index.ts
new file mode 100644
index 0000000000000..da7d96888124b
--- /dev/null
+++ b/src/plugins/content_management/public/rpc_client/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { RpcClient } from './rpc_client';
diff --git a/src/plugins/content_management/public/rpc_client/rpc_client.mock.ts b/src/plugins/content_management/public/rpc_client/rpc_client.mock.ts
new file mode 100644
index 0000000000000..ad8cd384dd0e5
--- /dev/null
+++ b/src/plugins/content_management/public/rpc_client/rpc_client.mock.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { RpcClient } from './rpc_client';
+import { PublicMethodsOf } from '@kbn/utility-types';
+
+export const createRpcClientMock = (): jest.Mocked<RpcClient> => {
+  const mock: jest.Mocked<PublicMethodsOf<RpcClient>> = {
+    get: jest.fn((input) => Promise.resolve({} as any)),
+    create: jest.fn((input) => Promise.resolve({} as any)),
+  };
+  return mock as jest.Mocked<RpcClient>;
+};
diff --git a/src/plugins/content_management/public/rpc_client/rpc_client.ts b/src/plugins/content_management/public/rpc_client/rpc_client.ts
new file mode 100644
index 0000000000000..1cfb2b12f02a5
--- /dev/null
+++ b/src/plugins/content_management/public/rpc_client/rpc_client.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { HttpSetup } from '@kbn/core/public';
+import { API_ENDPOINT } from '../../common';
+import type { GetIn, CreateIn, ProcedureName } from '../../common';
+
+export class RpcClient {
+  constructor(private http: { post: HttpSetup['post'] }) {}
+
+  public get<I extends GetIn = GetIn, O = unknown>(input: I): Promise<O> {
+    return this.sendMessage('get', input);
+  }
+
+  public create<I extends CreateIn, O = unknown>(input: I): Promise<O> {
+    return this.sendMessage('create', input);
+  }
+
+  private sendMessage = async (name: ProcedureName, input: any): Promise<any> => {
+    const { result } = await this.http.post<{ result: any }>(`${API_ENDPOINT}/${name}`, {
+      body: JSON.stringify(input),
+    });
+    return result;
+  };
+}
diff --git a/src/plugins/content_management/public/types.ts b/src/plugins/content_management/public/types.ts
index e06d6e48bba40..dcee504cd8d6b 100644
--- a/src/plugins/content_management/public/types.ts
+++ b/src/plugins/content_management/public/types.ts
@@ -6,11 +6,17 @@
  * Side Public License, v 1.
  */
 
+import type { ContentClient } from './content_client';
+
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface SetupDependencies {}
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
-export interface ContentManagementPublicSetup {}
+export interface StartDependencies {}
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
-export interface ContentManagementPublicStart {}
+export interface ContentManagementPublicSetup {}
+
+export interface ContentManagementPublicStart {
+  client: ContentClient;
+}
diff --git a/src/plugins/content_management/tsconfig.json b/src/plugins/content_management/tsconfig.json
index d0ad9f31d30c0..0c998149f88b8 100644
--- a/src/plugins/content_management/tsconfig.json
+++ b/src/plugins/content_management/tsconfig.json
@@ -6,6 +6,8 @@
   "include": ["common/**/*", "public/**/*", "server/**/*", ".storybook/**/*"],
   "kbn_references": [
     "@kbn/core",
+    "@kbn/config-schema",
+    "@kbn/utility-types",
   ],
   "exclude": [
     "target/**/*",

From 887089128f526a5fbb1f379f5fd89ef79b2eb0b9 Mon Sep 17 00:00:00 2001
From: Mark Hopkin <mark.hopkin@elastic.co>
Date: Tue, 7 Feb 2023 16:05:29 +0000
Subject: [PATCH 073/134] [Fleet] Add feature flag for FQDN toggle (#150441)

Part of #149059

Add a feature flag which will remove the hostname toggle from the UI if
we need to remove it at the last minute (e.g the agent work doesn't make
it into 8.7)
---
 .../fleet/common/experimental_features.ts     |   1 +
 .../agent_policy_advanced_fields/index.tsx    | 135 +++++++++---------
 2 files changed, 70 insertions(+), 66 deletions(-)

diff --git a/x-pack/plugins/fleet/common/experimental_features.ts b/x-pack/plugins/fleet/common/experimental_features.ts
index bb28867d3bf05..37acc7b056917 100644
--- a/x-pack/plugins/fleet/common/experimental_features.ts
+++ b/x-pack/plugins/fleet/common/experimental_features.ts
@@ -19,6 +19,7 @@ export const allowedExperimentalValues = Object.freeze({
   experimentalDataStreamSettings: false,
   displayAgentMetrics: true,
   showIntegrationsSubcategories: false,
+  agentFqdnMode: true,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx
index 396478451d6ee..033359ff8f414 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx
@@ -39,7 +39,7 @@ import { AgentPolicyPackageBadge } from '../../../../components';
 import { AgentPolicyDeleteProvider } from '../agent_policy_delete_provider';
 import type { ValidationResults } from '../agent_policy_validation';
 
-import { policyHasFleetServer } from '../../../../services';
+import { ExperimentalFeaturesService, policyHasFleetServer } from '../../../../services';
 
 import {
   useOutputOptions,
@@ -67,6 +67,7 @@ export const AgentPolicyAdvancedOptionsContent: React.FunctionComponent<Props> =
   isEditing = false,
   onDelete = () => {},
 }) => {
+  const { agentFqdnMode: agentFqdnModeEnabled } = ExperimentalFeaturesService.get();
   const { docLinks } = useStartServices();
   const [touchedFields, setTouchedFields] = useState<{ [key: string]: boolean }>({});
   const {
@@ -521,36 +522,64 @@ export const AgentPolicyAdvancedOptionsContent: React.FunctionComponent<Props> =
           />
         </EuiFormRow>
       </EuiDescribedFormGroup>
-      <EuiDescribedFormGroup
-        title={
-          <h4>
+      {agentFqdnModeEnabled && (
+        <EuiDescribedFormGroup
+          title={
+            <h4>
+              <FormattedMessage
+                id="xpack.fleet.agentPolicyForm.hostnameFormatLabel"
+                defaultMessage="Host name format"
+              />
+            </h4>
+          }
+          description={
             <FormattedMessage
-              id="xpack.fleet.agentPolicyForm.hostnameFormatLabel"
-              defaultMessage="Host name format"
+              id="xpack.fleet.agentPolicyForm.hostnameFormatLabelDescription"
+              defaultMessage="Select how you would like agent domain names to be displayed."
             />
-          </h4>
-        }
-        description={
-          <FormattedMessage
-            id="xpack.fleet.agentPolicyForm.hostnameFormatLabelDescription"
-            defaultMessage="Select how you would like agent domain names to be displayed."
-          />
-        }
-      >
-        <EuiFormRow fullWidth>
-          <EuiRadioGroup
-            options={[
-              {
-                id: 'hostname',
-                label: (
-                  <>
+          }
+        >
+          <EuiFormRow fullWidth>
+            <EuiRadioGroup
+              options={[
+                {
+                  id: 'hostname',
+                  label: (
+                    <>
+                      <EuiFlexGroup gutterSize="xs" direction="column">
+                        <EuiFlexItem grow={false}>
+                          <EuiText size="s">
+                            <b>
+                              <FormattedMessage
+                                id="xpack.fleet.agentPolicyForm.hostnameFormatOptionHostname"
+                                defaultMessage="Hostname"
+                              />
+                            </b>
+                          </EuiText>
+                        </EuiFlexItem>
+                        <EuiFlexItem grow={false}>
+                          <EuiText size="s" color="subdued">
+                            <FormattedMessage
+                              id="xpack.fleet.agentPolicyForm.hostnameFormatOptionHostnameExample"
+                              defaultMessage="ex: My-Laptop"
+                            />
+                          </EuiText>
+                        </EuiFlexItem>
+                      </EuiFlexGroup>
+                      <EuiSpacer size="s" />
+                    </>
+                  ),
+                },
+                {
+                  id: 'fqdn',
+                  label: (
                     <EuiFlexGroup gutterSize="xs" direction="column">
                       <EuiFlexItem grow={false}>
                         <EuiText size="s">
                           <b>
                             <FormattedMessage
-                              id="xpack.fleet.agentPolicyForm.hostnameFormatOptionHostname"
-                              defaultMessage="Hostname"
+                              id="xpack.fleet.agentPolicyForm.hostnameFormatOptionFqdn"
+                              defaultMessage="Fully Qualified Domain Name (FQDN)"
                             />
                           </b>
                         </EuiText>
@@ -558,52 +587,26 @@ export const AgentPolicyAdvancedOptionsContent: React.FunctionComponent<Props> =
                       <EuiFlexItem grow={false}>
                         <EuiText size="s" color="subdued">
                           <FormattedMessage
-                            id="xpack.fleet.agentPolicyForm.hostnameFormatOptionHostnameExample"
-                            defaultMessage="ex: My-Laptop"
+                            id="xpack.fleet.agentPolicyForm.hostnameFormatOptionFqdnExample"
+                            defaultMessage="ex: My-Laptop.admin.acme.co"
                           />
                         </EuiText>
                       </EuiFlexItem>
                     </EuiFlexGroup>
-                    <EuiSpacer size="s" />
-                  </>
-                ),
-              },
-              {
-                id: 'fqdn',
-                label: (
-                  <EuiFlexGroup gutterSize="xs" direction="column">
-                    <EuiFlexItem grow={false}>
-                      <EuiText size="s">
-                        <b>
-                          <FormattedMessage
-                            id="xpack.fleet.agentPolicyForm.hostnameFormatOptionFqdn"
-                            defaultMessage="Fully Qualified Domain Name (FQDN)"
-                          />
-                        </b>
-                      </EuiText>
-                    </EuiFlexItem>
-                    <EuiFlexItem grow={false}>
-                      <EuiText size="s" color="subdued">
-                        <FormattedMessage
-                          id="xpack.fleet.agentPolicyForm.hostnameFormatOptionFqdnExample"
-                          defaultMessage="ex: My-Laptop.admin.acme.co"
-                        />
-                      </EuiText>
-                    </EuiFlexItem>
-                  </EuiFlexGroup>
-                ),
-              },
-            ]}
-            idSelected={agentPolicy.agent_features?.length ? 'fqdn' : 'hostname'}
-            onChange={(id: string) => {
-              updateAgentPolicy({
-                agent_features: id === 'hostname' ? [] : [{ name: 'fqdn', enabled: true }],
-              });
-            }}
-            name="radio group"
-          />
-        </EuiFormRow>
-      </EuiDescribedFormGroup>
+                  ),
+                },
+              ]}
+              idSelected={agentPolicy.agent_features?.length ? 'fqdn' : 'hostname'}
+              onChange={(id: string) => {
+                updateAgentPolicy({
+                  agent_features: id === 'hostname' ? [] : [{ name: 'fqdn', enabled: true }],
+                });
+              }}
+              name="radio group"
+            />
+          </EuiFormRow>
+        </EuiDescribedFormGroup>
+      )}
       {isEditing && 'id' in agentPolicy && !agentPolicy.is_managed ? (
         <EuiDescribedFormGroup
           title={

From affe498cfdf7b0149b0cc64bc13071379ac42b7a Mon Sep 17 00:00:00 2001
From: Drew Tate <drew.tate@elastic.co>
Date: Tue, 7 Feb 2023 10:11:24 -0600
Subject: [PATCH 074/134] [Lens] dimension buttons and message list design
 follow ups (#150381)

---
 .../config_panel/buttons/dimension_button.tsx             | 8 ++++----
 .../editor_frame/config_panel/dimension_button_icon.tsx   | 2 +-
 .../editor_frame/workspace_panel/message_list.tsx         | 5 ++++-
 x-pack/plugins/lens/public/embeddable/embeddable.tsx      | 1 +
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/buttons/dimension_button.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/buttons/dimension_button.tsx
index e1ab7cd5ee9a9..ad3ae44a2b3e6 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/buttons/dimension_button.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/buttons/dimension_button.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { EuiButtonIcon, EuiFlexItem, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonIcon, EuiLink, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { css } from '@emotion/react';
 import { euiThemeVars } from '@kbn/ui-theme';
@@ -39,7 +39,7 @@ export function DimensionButton({
 }) {
   return (
     <>
-      <EuiFlexItem>
+      <div>
         <EuiToolTip
           content={message?.shortMessage || message?.longMessage || undefined}
           position="left"
@@ -63,12 +63,12 @@ export function DimensionButton({
             </DimensionButtonIcon>
           </EuiLink>
         </EuiToolTip>
-      </EuiFlexItem>
+      </div>
       <EuiButtonIcon
         className="lnsLayerPanel__dimensionRemove"
         data-test-subj="indexPattern-dimension-remove"
         iconType="trash"
-        size="s"
+        size="xs"
         color="danger"
         aria-label={i18n.translate('xpack.lens.indexPattern.removeColumnLabel', {
           defaultMessage: 'Remove configuration from "{groupLabel}"',
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_button_icon.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_button_icon.tsx
index 9323369f57e68..489e56c09055c 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_button_icon.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_button_icon.tsx
@@ -65,7 +65,7 @@ const getIconFromAccessorConfig = (accessorConfig: AccessorConfig) => (
       <EuiIcon
         {...baseIconProps}
         type="color"
-        color="text"
+        color="subdued"
         aria-label={i18n.translate('xpack.lens.editorFrame.paletteColorIndicatorLabel', {
           defaultMessage: 'This dimension is using a palette',
         })}
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/message_list.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/message_list.tsx
index 74a30b1e1551b..e1858d0f22b57 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/message_list.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/message_list.tsx
@@ -25,9 +25,11 @@ import { UserMessage } from '../../../types';
 
 export const MessageList = ({
   messages,
+  useSmallIconsOnButton,
   customButtonStyles,
 }: {
   messages: UserMessage[];
+  useSmallIconsOnButton?: boolean;
   customButtonStyles?: SerializedStyles;
 }) => {
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
@@ -85,7 +87,7 @@ export const MessageList = ({
           >
             {errorCount > 0 && (
               <>
-                <EuiIcon type={IconError} />
+                <EuiIcon type={IconError} size={useSmallIconsOnButton ? 's' : undefined} />
                 {errorCount}
               </>
             )}
@@ -93,6 +95,7 @@ export const MessageList = ({
               <>
                 <EuiIcon
                   type={IconWarning}
+                  size={useSmallIconsOnButton ? 's' : undefined}
                   css={css`
                     margin-left: 4px;
                   `}
diff --git a/x-pack/plugins/lens/public/embeddable/embeddable.tsx b/x-pack/plugins/lens/public/embeddable/embeddable.tsx
index 14aea8fb0ee55..1a22222155677 100644
--- a/x-pack/plugins/lens/public/embeddable/embeddable.tsx
+++ b/x-pack/plugins/lens/public/embeddable/embeddable.tsx
@@ -282,6 +282,7 @@ const EmbeddableMessagesPopover = ({ messages }: { messages: UserMessage[] }) =>
   return (
     <MessageList
       messages={messages}
+      useSmallIconsOnButton={true}
       customButtonStyles={css`
         block-size: ${euiTheme.size.l};
         border-radius: 0 ${euiTheme.border.radius.medium} 0 ${euiTheme.border.radius.small};

From 82c0dfe5bec3ba345119a05d01efabbcdabecab2 Mon Sep 17 00:00:00 2001
From: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
Date: Tue, 7 Feb 2023 11:12:49 -0500
Subject: [PATCH 075/134] [Security Solution][Endpoint] Remove
 `ENDPOINTS_ACTION_LIST_ROUTE` const and replace it with
 `BASE_ENDPOINT_ACTION_ROUTE` (#150349)

## Summary

- Removes duplicate `const` `ENDPOINTS_ACTION_LIST_ROUTE` and replace it
with `BASE_ENDPOINT_ACTION_ROUTE`
---
 .../security_solution/common/endpoint/constants.ts | 14 ++++++++------
 .../use_get_endpoint_action_list.test.ts           |  4 ++--
 .../use_get_endpoint_action_list.ts                |  4 ++--
 .../mocks/response_actions_http_mocks.ts           |  4 ++--
 .../services/endpoint_response_actions.ts          |  4 ++--
 .../server/endpoint/routes/actions/list.test.ts    | 12 ++++++------
 .../server/endpoint/routes/actions/list.ts         |  4 ++--
 .../endpoint/routes/actions/list_handler.test.ts   |  4 ++--
 .../apis/endpoint_authz.ts                         |  4 ++--
 9 files changed, 28 insertions(+), 26 deletions(-)

diff --git a/x-pack/plugins/security_solution/common/endpoint/constants.ts b/x-pack/plugins/security_solution/common/endpoint/constants.ts
index 7f6dd418c5202..d005f449d76a3 100644
--- a/x-pack/plugins/security_solution/common/endpoint/constants.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/constants.ts
@@ -60,13 +60,18 @@ export const AGENT_POLICY_SUMMARY_ROUTE = `${BASE_POLICY_ROUTE}/summaries`;
 /** Suggestions routes */
 export const SUGGESTIONS_ROUTE = `${BASE_ENDPOINT_ROUTE}/suggestions/{suggestion_type}`;
 
-/** Host Isolation Routes */
+/**
+ * Action Response Routes
+ */
+
+/** @deprecated use `ISOLATE_HOST_ROUTE_V2` instead */
 export const ISOLATE_HOST_ROUTE = `${BASE_ENDPOINT_ROUTE}/isolate`;
+/** @deprecated use `ISOLATE_HOST_ROUTE_V2` instead */
 export const UNISOLATE_HOST_ROUTE = `${BASE_ENDPOINT_ROUTE}/unisolate`;
 
-const BASE_ENDPOINT_ACTION_ROUTE = `${BASE_ENDPOINT_ROUTE}/action`;
+/** Base Actions route. Used to get a list of all actions and is root to other action related routes */
+export const BASE_ENDPOINT_ACTION_ROUTE = `${BASE_ENDPOINT_ROUTE}/action`;
 
-/** Action Response Routes */
 export const ISOLATE_HOST_ROUTE_V2 = `${BASE_ENDPOINT_ACTION_ROUTE}/isolate`;
 export const UNISOLATE_HOST_ROUTE_V2 = `${BASE_ENDPOINT_ACTION_ROUTE}/unisolate`;
 export const GET_PROCESSES_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/running_procs`;
@@ -82,9 +87,6 @@ export const ACTION_DETAILS_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/{action_id}`;
 export const ACTION_AGENT_FILE_INFO_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/{action_id}/file/{file_id}`;
 export const ACTION_AGENT_FILE_DOWNLOAD_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/{action_id}/file/{file_id}/download`;
 
-// FIXME:PT `const` below seem like a duplicate. Delete it
-export const ENDPOINTS_ACTION_LIST_ROUTE = `${BASE_ENDPOINT_ROUTE}/action`;
-
 export const failedFleetActionErrorCode = '424';
 
 export const ENDPOINT_DEFAULT_PAGE = 0;
diff --git a/x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_endpoint_action_list.test.ts b/x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_endpoint_action_list.test.ts
index 0afd8788ad335..f588f96949e5d 100644
--- a/x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_endpoint_action_list.test.ts
+++ b/x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_endpoint_action_list.test.ts
@@ -8,7 +8,7 @@
 import type { AppContextTestRender, ReactQueryHookRenderer } from '../../../common/mock/endpoint';
 import { createAppRootMockRenderer } from '../../../common/mock/endpoint';
 import { useGetEndpointActionList } from './use_get_endpoint_action_list';
-import { ENDPOINTS_ACTION_LIST_ROUTE } from '../../../../common/endpoint/constants';
+import { BASE_ENDPOINT_ACTION_ROUTE } from '../../../../common/endpoint/constants';
 import { useQuery as _useQuery } from '@tanstack/react-query';
 import { responseActionsHttpMocks } from '../../mocks/response_actions_http_mocks';
 
@@ -55,7 +55,7 @@ describe('useGetEndpointActionList hook', () => {
     );
 
     expect(apiMocks.responseProvider.actionList).toHaveBeenCalledWith({
-      path: `${ENDPOINTS_ACTION_LIST_ROUTE}`,
+      path: BASE_ENDPOINT_ACTION_ROUTE,
       query: {
         agentIds: ['123', '456'],
         commands: ['isolate', 'unisolate'],
diff --git a/x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_endpoint_action_list.ts b/x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_endpoint_action_list.ts
index eba9b162d67f6..c59b422b04028 100644
--- a/x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_endpoint_action_list.ts
+++ b/x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_endpoint_action_list.ts
@@ -10,7 +10,7 @@ import type { IHttpFetchError } from '@kbn/core-http-browser';
 import { useQuery } from '@tanstack/react-query';
 import type { EndpointActionListRequestQuery } from '../../../../common/endpoint/schema/actions';
 import { useHttp } from '../../../common/lib/kibana';
-import { ENDPOINTS_ACTION_LIST_ROUTE } from '../../../../common/endpoint/constants';
+import { BASE_ENDPOINT_ACTION_ROUTE } from '../../../../common/endpoint/constants';
 import type { ActionListApiResponse } from '../../../../common/endpoint/types';
 
 interface ErrorType {
@@ -36,7 +36,7 @@ export const useGetEndpointActionList = (
     queryKey: ['get-action-list', query],
     ...options,
     queryFn: async () => {
-      return http.get<ActionListApiResponse>(ENDPOINTS_ACTION_LIST_ROUTE, {
+      return http.get<ActionListApiResponse>(BASE_ENDPOINT_ACTION_ROUTE, {
         query: {
           agentIds: query.agentIds,
           commands: query.commands,
diff --git a/x-pack/plugins/security_solution/public/management/mocks/response_actions_http_mocks.ts b/x-pack/plugins/security_solution/public/management/mocks/response_actions_http_mocks.ts
index ba108fc695b3c..ab586a2b35a46 100644
--- a/x-pack/plugins/security_solution/public/management/mocks/response_actions_http_mocks.ts
+++ b/x-pack/plugins/security_solution/public/management/mocks/response_actions_http_mocks.ts
@@ -11,7 +11,7 @@ import {
   ACTION_DETAILS_ROUTE,
   ACTION_STATUS_ROUTE,
   GET_PROCESSES_ROUTE,
-  ENDPOINTS_ACTION_LIST_ROUTE,
+  BASE_ENDPOINT_ACTION_ROUTE,
   ISOLATE_HOST_ROUTE,
   UNISOLATE_HOST_ROUTE,
   KILL_PROCESS_ROUTE,
@@ -107,7 +107,7 @@ export const responseActionsHttpMocks = httpHandlerMockFactory<ResponseActionsHt
   },
   {
     id: 'actionList',
-    path: ENDPOINTS_ACTION_LIST_ROUTE,
+    path: BASE_ENDPOINT_ACTION_ROUTE,
     method: 'get',
     handler: (): ActionListApiResponse => {
       const response = new EndpointActionGenerator('seed').generateActionDetails();
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/agent_emulator/services/endpoint_response_actions.ts b/x-pack/plugins/security_solution/scripts/endpoint/agent_emulator/services/endpoint_response_actions.ts
index 5d47c57492b26..40bf70a9b0179 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/agent_emulator/services/endpoint_response_actions.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/agent_emulator/services/endpoint_response_actions.ts
@@ -17,7 +17,7 @@ import { sendEndpointMetadataUpdate } from '../../common/endpoint_metadata_servi
 import { FleetActionGenerator } from '../../../../common/endpoint/data_generators/fleet_action_generator';
 import {
   ENDPOINT_ACTION_RESPONSES_INDEX,
-  ENDPOINTS_ACTION_LIST_ROUTE,
+  BASE_ENDPOINT_ACTION_ROUTE,
   FILE_STORAGE_DATA_INDEX,
   FILE_STORAGE_METADATA_INDEX,
 } from '../../../../common/endpoint/constants';
@@ -51,7 +51,7 @@ export const fetchEndpointActionList = async (
     return (
       await kbn.request<ActionListApiResponse>({
         method: 'GET',
-        path: ENDPOINTS_ACTION_LIST_ROUTE,
+        path: BASE_ENDPOINT_ACTION_ROUTE,
         query: options,
       })
     ).data;
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/actions/list.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/actions/list.test.ts
index 6c6098e2c97f5..5829428db2eab 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/actions/list.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/actions/list.test.ts
@@ -23,7 +23,7 @@ import {
   savedObjectsClientMock,
 } from '@kbn/core/server/mocks';
 import type { KibanaResponseFactory, RequestHandler, RouteConfig } from '@kbn/core/server';
-import { ENDPOINTS_ACTION_LIST_ROUTE } from '../../../../common/endpoint/constants';
+import { BASE_ENDPOINT_ACTION_ROUTE } from '../../../../common/endpoint/constants';
 import { EndpointAppContextService } from '../../endpoint_app_context_services';
 import { createMockConfig } from '../../../lib/detection_engine/routes/__mocks__';
 import { LicenseService } from '../../../../common/license';
@@ -136,35 +136,35 @@ describe('Action List Route', () => {
 
   describe('User auth level', () => {
     it('allows user with `canReadActionsLogManagement` access for API requests', async () => {
-      await callApiRoute(ENDPOINTS_ACTION_LIST_ROUTE, {
+      await callApiRoute(BASE_ENDPOINT_ACTION_ROUTE, {
         authz: { canReadActionsLogManagement: true },
       });
       expect(mockResponse.ok).toBeCalled();
     });
 
     it('allows user with `canAccessEndpointActionsLogManagement` access for API requests', async () => {
-      await callApiRoute(ENDPOINTS_ACTION_LIST_ROUTE, {
+      await callApiRoute(BASE_ENDPOINT_ACTION_ROUTE, {
         authz: { canAccessEndpointActionsLogManagement: true },
       });
       expect(mockResponse.ok).toBeCalled();
     });
 
     it('does not allow user without `canReadActionsLogManagement` or `canAccessEndpointActionsLogManagement` access for API requests', async () => {
-      await callApiRoute(ENDPOINTS_ACTION_LIST_ROUTE, {
+      await callApiRoute(BASE_ENDPOINT_ACTION_ROUTE, {
         authz: { canReadActionsLogManagement: false, canAccessEndpointActionsLogManagement: false },
       });
       expect(mockResponse.forbidden).toBeCalled();
     });
 
     it('does allow user access to API requests if license is at least platinum', async () => {
-      await callApiRoute(ENDPOINTS_ACTION_LIST_ROUTE, {
+      await callApiRoute(BASE_ENDPOINT_ACTION_ROUTE, {
         license: Platinum,
       });
       expect(mockResponse.ok).toBeCalled();
     });
 
     it('does not allow user access to API requests if license is below platinum', async () => {
-      await callApiRoute(ENDPOINTS_ACTION_LIST_ROUTE, {
+      await callApiRoute(BASE_ENDPOINT_ACTION_ROUTE, {
         license: Gold,
       });
       expect(mockResponse.forbidden).toBeCalled();
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/actions/list.ts b/x-pack/plugins/security_solution/server/endpoint/routes/actions/list.ts
index 5423ca8866155..5ce5cf1b52276 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/actions/list.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/actions/list.ts
@@ -11,7 +11,7 @@
  * 2.0.
  */
 
-import { ENDPOINTS_ACTION_LIST_ROUTE } from '../../../../common/endpoint/constants';
+import { BASE_ENDPOINT_ACTION_ROUTE } from '../../../../common/endpoint/constants';
 import { EndpointActionListRequestSchema } from '../../../../common/endpoint/schema/actions';
 import { actionListHandler } from './list_handler';
 
@@ -28,7 +28,7 @@ export function registerActionListRoutes(
 ) {
   router.get(
     {
-      path: ENDPOINTS_ACTION_LIST_ROUTE,
+      path: BASE_ENDPOINT_ACTION_ROUTE,
       validate: EndpointActionListRequestSchema,
       options: { authRequired: true, tags: ['access:securitySolution'] },
     },
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/actions/list_handler.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/actions/list_handler.test.ts
index b8f6166818807..7c48c97ab4dfb 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/actions/list_handler.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/actions/list_handler.test.ts
@@ -17,7 +17,7 @@ import {
   savedObjectsClientMock,
 } from '@kbn/core/server/mocks';
 import type { EndpointActionListRequestQuery } from '../../../../common/endpoint/schema/actions';
-import { ENDPOINTS_ACTION_LIST_ROUTE } from '../../../../common/endpoint/constants';
+import { BASE_ENDPOINT_ACTION_ROUTE } from '../../../../common/endpoint/constants';
 import { parseExperimentalConfigValue } from '../../../../common/experimental_features';
 import { createMockConfig } from '../../../lib/detection_engine/routes/__mocks__';
 import { EndpointAppContextService } from '../../endpoint_app_context_services';
@@ -77,7 +77,7 @@ describe('Action List Handler', () => {
           SecuritySolutionRequestHandlerContext
         >
       ] = routerMock.get.mock.calls.find(([{ path }]) =>
-        path.startsWith(ENDPOINTS_ACTION_LIST_ROUTE)
+        path.startsWith(BASE_ENDPOINT_ACTION_ROUTE)
       )!;
       await routeHandler(
         coreMock.createCustomRequestHandlerContext(
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_authz.ts b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_authz.ts
index d5fbdadda74f4..0d578e46fe569 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_authz.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_authz.ts
@@ -11,7 +11,7 @@ import {
   ACTION_STATUS_ROUTE,
   AGENT_POLICY_SUMMARY_ROUTE,
   BASE_POLICY_RESPONSE_ROUTE,
-  ENDPOINTS_ACTION_LIST_ROUTE,
+  BASE_ENDPOINT_ACTION_ROUTE,
   GET_PROCESSES_ROUTE,
   GET_FILE_ROUTE,
   HOST_METADATA_GET_ROUTE,
@@ -79,7 +79,7 @@ export default function ({ getService }: FtrProviderContext) {
     const canReadActionsLogManagementApiList: ApiCallsInterface[] = [
       {
         method: 'get',
-        path: ENDPOINTS_ACTION_LIST_ROUTE,
+        path: BASE_ENDPOINT_ACTION_ROUTE,
         body: undefined,
       },
     ];

From 71360393057d20896821791f583c9bdf013e942a Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@elastic.co>
Date: Tue, 7 Feb 2023 17:14:26 +0100
Subject: [PATCH 076/134] Introduce the SO versionModel API  (#150149)

## Summary

Fix https://github.com/elastic/kibana/issues/150297

First step toward managed upgrades

This PR adds the types that will be used for the new SO model version
API, and adds the new properties to the `SavedObjectsType` type.

The implementation is outside of scope of the PR and will be implemented
in a future PR.

The PR also adapt the `check_registered_types` test to trigger a review
when the attributes of `SavedObjectsType` introduced in this PR are
changed.
---
 .../core-saved-objects-server/index.ts        |  12 ++
 .../src/model_version/index.ts                |  23 +++
 .../src/model_version/model_version.ts        | 100 +++++++++
 .../src/model_version/transformations.ts      |  81 ++++++++
 .../src/saved_objects_type.ts                 | 100 +++++++++
 .../src/extract_migration_info.test.ts        | 161 +++++++++++++++
 .../src/extract_migration_info.ts             |  26 +++
 .../src/get_migration_hash.test.ts            | 167 +++++++++++++++
 .../src/get_migration_hash.ts                 |  13 +-
 .../migrations/check_registered_types.test.ts | 194 +++++++++---------
 10 files changed, 779 insertions(+), 98 deletions(-)
 create mode 100644 packages/core/saved-objects/core-saved-objects-server/src/model_version/index.ts
 create mode 100644 packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts
 create mode 100644 packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts

diff --git a/packages/core/saved-objects/core-saved-objects-server/index.ts b/packages/core/saved-objects/core-saved-objects-server/index.ts
index 33b9dfd64f6f8..2e6d3837cfac6 100644
--- a/packages/core/saved-objects/core-saved-objects-server/index.ts
+++ b/packages/core/saved-objects/core-saved-objects-server/index.ts
@@ -89,6 +89,18 @@ export {
   SECURITY_EXTENSION_ID,
   SPACES_EXTENSION_ID,
 } from './src/extensions/extensions';
+export type {
+  SavedObjectsModelVersion,
+  SavedObjectsModelVersionMap,
+  SavedObjectsModelVersionMapProvider,
+  SavedObjectsModelChange,
+  SavedObjectsModelExpansionChange,
+  SavedObjectModelTransformationDoc,
+  SavedObjectModelTransformationContext,
+  SavedObjectModelTransformationFn,
+  SavedObjectModelBidirectionalTransformation,
+  SavedObjectModelTransformationResult,
+} from './src/model_version';
 
 export type {
   SavedObject,
diff --git a/packages/core/saved-objects/core-saved-objects-server/src/model_version/index.ts b/packages/core/saved-objects/core-saved-objects-server/src/model_version/index.ts
new file mode 100644
index 0000000000000..ec35e07e4f674
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-server/src/model_version/index.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export type {
+  SavedObjectModelTransformationDoc,
+  SavedObjectModelTransformationContext,
+  SavedObjectModelTransformationFn,
+  SavedObjectModelBidirectionalTransformation,
+  SavedObjectModelTransformationResult,
+} from './transformations';
+
+export type {
+  SavedObjectsModelChange,
+  SavedObjectsModelExpansionChange,
+  SavedObjectsModelVersion,
+  SavedObjectsModelVersionMap,
+  SavedObjectsModelVersionMapProvider,
+} from './model_version';
diff --git a/packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts b/packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts
new file mode 100644
index 0000000000000..3094a1ccb3e09
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { SavedObjectsMappingProperties } from '../mapping_definition';
+import type { SavedObjectModelBidirectionalTransformation } from './transformations';
+
+/**
+ * Represents a model version of a given savedObjects type.
+ *
+ * Model versions supersede the {@link SavedObjectsType.migrations | migrations} (and {@link SavedObjectsType.schemas | schemas}) APIs
+ * by exposing an unified way of describing the changes of shape or data of a type.
+ *
+ * @public
+ */
+export interface SavedObjectsModelVersion {
+  /**
+   * The {@link SavedObjectsModelChange | changes} associated with this version.
+   */
+  modelChange: SavedObjectsModelChange;
+}
+
+/**
+ * {@link SavedObjectsModelChange | model change} representing an expansion.
+ *
+ * A model expansion can do either, or both, or those:
+ * - add new mappings
+ * - migrate data in a backward-compatible way
+ *
+ * @remark when adding mappings, {@link SavedObjectsType.mappings | the type mappings} must also be updated accordingly.
+ *         Overall, the type's mapping represents the latests version of the mappings, where the model changes
+ *         represent the changes of mappings between two versions.
+ *
+ * @public
+ */
+export interface SavedObjectsModelExpansionChange<
+  PreviousAttributes = unknown,
+  NewAttributes = unknown
+> {
+  /**
+   * The type of {@link SavedObjectsModelChange | change}, used to identify them internally.
+   */
+  type: 'expansion';
+  /**
+   * (optional) A bidirectional transformation to migrate the document from and/or to the previous model version.
+   */
+  transformation?: SavedObjectModelBidirectionalTransformation<PreviousAttributes, NewAttributes>;
+  /**
+   * (optional) The new mappings introduced in this version.
+   */
+  addedMappings?: SavedObjectsMappingProperties;
+  /**
+   * (optional) A list of paths to mappings to flag as deprecated. Deprecated mappings should no longer be used and will
+   * eventually be deleted later.
+   */
+  deprecatedMappings?: string[];
+}
+
+/**
+ * Identify the model change associated with a given {@link SavedObjectsModelVersion}.
+ *
+ * At the moment, Only one type of change is supported: {@link SavedObjectsModelExpansionChange | expansions}.
+ *
+ * @public
+ */
+export type SavedObjectsModelChange = SavedObjectsModelExpansionChange;
+
+/**
+ * A record of {@link SavedObjectsModelVersion | model versions} for a given savedObjects type.
+ * The record's keys must be integers, starting with 1 for the first entry, and there shouldn't be gaps.
+ *
+ * @example
+ * ```typescript
+ * const modelVersionMap: SavedObjectsModelVersionMap = {
+ *   '1': modelVersion1,
+ *   '2': modelVersion2,
+ *   '3': modelVersion3,
+ * }
+ * ```
+ *
+ * @public
+ */
+export interface SavedObjectsModelVersionMap {
+  [modelVersion: string]: SavedObjectsModelVersion;
+}
+
+/**
+ * A function returning a {@link SavedObjectsModelVersionMap | model version map}
+ *
+ * Ensured to be called after all plugins executed their `setup` phase.
+ * Similar to what was done with migrations, can be used to defer resolving the model versions
+ * associated to a type to after all plugins have been set up.
+ *
+ * @public
+ */
+export type SavedObjectsModelVersionMapProvider = () => SavedObjectsModelVersionMap;
diff --git a/packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts b/packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts
new file mode 100644
index 0000000000000..5af4866ddd576
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { SavedObjectSanitizedDoc } from '../serialization';
+import type { SavedObjectsMigrationLogger } from '../migration';
+
+/**
+ * Document type used during model migration.
+ *
+ * @public
+ */
+export type SavedObjectModelTransformationDoc<T = unknown> = SavedObjectSanitizedDoc<T>;
+
+/**
+ * Context passed down to {@link SavedObjectModelTransformationFn | transformation functions}.
+ *
+ * @public
+ */
+export interface SavedObjectModelTransformationContext {
+  /**
+   * logger instance to be used by the migration handler
+   */
+  readonly log: SavedObjectsMigrationLogger;
+  /**
+   * The model version this migration is registered for
+   */
+  readonly modelVersion: number;
+}
+
+/**
+ * Return type for the {@link SavedObjectModelTransformationFn | transformation functions}
+ *
+ * @public
+ */
+export interface SavedObjectModelTransformationResult<DocAttrs = unknown> {
+  document: SavedObjectModelTransformationDoc<DocAttrs>;
+}
+
+/**
+ * Transformation function for the model version API.
+ *
+ * Similar to the old migration system, model version transformations take the document to migrate
+ * and a context object as input and must return the transformed document in its return value.
+ *
+ * @public
+ */
+export type SavedObjectModelTransformationFn<
+  InputAttributes = unknown,
+  OutputAttributes = unknown
+> = (
+  document: SavedObjectModelTransformationDoc<InputAttributes>,
+  context: SavedObjectModelTransformationContext
+) => SavedObjectModelTransformationResult<OutputAttributes>;
+
+/**
+ * A bidirectional transformation.
+ *
+ * Bidirectional transformations define migration functions that can be used to
+ * transform a document from the lower version to the higher one (`up`), and
+ * the other way around, from the higher version to the lower one (`down`)
+ *
+ * @public
+ */
+export interface SavedObjectModelBidirectionalTransformation<
+  PreviousAttributes = unknown,
+  NewAttributes = unknown
+> {
+  /**
+   * The upward (previous=>next) transformation.
+   */
+  up: SavedObjectModelTransformationFn<PreviousAttributes, NewAttributes>;
+  /**
+   * The downward (next=>previous) transformation.
+   */
+  down: SavedObjectModelTransformationFn<NewAttributes, PreviousAttributes>;
+}
diff --git a/packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts b/packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts
index 9dee63c355676..b9fa8e6365114 100644
--- a/packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts
+++ b/packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts
@@ -14,6 +14,10 @@ import type { SavedObjectsTypeManagementDefinition } from './saved_objects_manag
 import type { SavedObjectsValidationMap } from './validation';
 import type { SavedObjectMigrationMap } from './migration';
 import type { SavedObjectsTypeMappingDefinition } from './mapping_definition';
+import type {
+  SavedObjectsModelVersionMap,
+  SavedObjectsModelVersionMapProvider,
+} from './model_version';
 
 /**
  * @public
@@ -128,6 +132,102 @@ export interface SavedObjectsType<Attributes = any> {
    * An optional {@link SavedObjectsTypeManagementDefinition | saved objects management section} definition for the type.
    */
   management?: SavedObjectsTypeManagementDefinition<Attributes>;
+
+  /**
+   * A map of model versions associated with this type.
+   *
+   * Model versions supersede the {@link SavedObjectsType.migrations | migrations} (and {@link SavedObjectsType.schemas | schemas}) APIs
+   * by exposing an unified way of describing the changes of shape or data of the type.
+   *
+   * Model versioning is decoupled from Kibana versioning, and isolated between types.
+   * Model versions are identified by a single numeric value, starting at `1` and without gaps.
+   *
+   * Please refer to {@link SavedObjectsModelVersion} for details on the API's usages.
+   *
+   * A **valid** versioning would be:
+   *
+   * ```ts
+   * {
+   *   name: 'foo',
+   *   // other mandatory attributes...
+   *   modelVersions: {
+   *     '1': modelVersion1,
+   *     '2': modelVersion2,
+   *     '3': modelVersion3,
+   *   }
+   * }
+   * ```
+   *
+   * A **invalid** versioning would be:
+   *
+   * ```ts
+   * {
+   *   name: 'foo',
+   *   // other mandatory attributes...
+   *   modelVersions: {
+   *     '1': modelVersion1,
+   *     '3': modelVersion3, // ERROR, no model version 2
+   *     '3.1': modelVersion31, // ERROR, model version is a single numeric value
+   *   }
+   * }
+   * ```
+   *
+   * @alpha experimental and subject to change.
+   */
+  modelVersions?: SavedObjectsModelVersionMap | SavedObjectsModelVersionMapProvider;
+
+  /**
+   * Allows to opt-in to the new model version API.
+   *
+   * Must be a valid semver version (with the patch version being necessarily 0)
+   *
+   * When specified, the type will switch from using the {@link SavedObjectsType.migrations | legacy migration API}
+   * to use the {@link SavedObjectsType.modelVersions | modelVersion API} after the specified version.
+   *
+   * When opted in, it will no longer be possible to use the legacy migration API after the specified version.
+   *
+   * A **valid** usage example would be:
+   *
+   * ```ts
+   * {
+   *   name: 'foo',
+   *   // other mandatory attributes...
+   *   switchToModelVersionAt: '8.8.0',
+   *   migrations: {
+   *     '8.1.0': migrateTo810,
+   *     '8.7.0': migrateTo870,
+   *   },
+   *   modelVersions: {
+   *     '1': modelVersion1
+   *   }
+   * }
+   * ```
+   *
+   * An **invalid** usage example would be:
+   *
+   * ```ts
+   * {
+   *   name: 'foo',
+   *   // other mandatory attributes...
+   *   switchToModelVersionAt: '8.9.0',
+   *   migrations: {
+   *     '8.1.0': migrateTo8_1,
+   *     '8.9.0': migrateTo8_9, // error: migration registered for the switch version
+   *     '8.10.0': migrateTo8_10, // error: migration registered for after the switch version
+   *   },
+   *   modelVersions: {
+   *     '1': modelVersion1
+   *   }
+   * }
+   * ```
+   *
+   * Please refer to the {@link SavedObjectsType.modelVersions | modelVersion API} for more documentation on
+   * the new API.
+   *
+   * @remarks All types will be forced to switch to use the new API in a later version. This switch is
+   *          allowing types owners to switch their types before the milestone.
+   */
+  switchToModelVersionAt?: string;
 }
 
 /**
diff --git a/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.test.ts b/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.test.ts
index 47620aee90b3c..c94d7fe3ceb94 100644
--- a/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.test.ts
+++ b/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.test.ts
@@ -158,4 +158,165 @@ describe('extractMigrationInfo', () => {
       });
     });
   });
+
+  describe('modelVersions', () => {
+    it('returns the correct switchToModelVersionAt', () => {
+      const type = createType({
+        switchToModelVersionAt: '8.8.0',
+      });
+      const output = extractMigrationInfo(type);
+
+      expect(output.switchToModelVersionAt).toEqual('8.8.0');
+    });
+
+    it('returns a proper summary of the model versions', () => {
+      const type = createType({
+        modelVersions: {
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: {
+                up: jest.fn(),
+                down: jest.fn(),
+              },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: {
+                  type: 'boolean',
+                },
+              },
+            },
+          },
+        },
+      });
+      const output = extractMigrationInfo(type);
+
+      expect(output.modelVersions).toEqual([
+        {
+          version: '1',
+          changeType: 'expansion',
+          hasMigration: true,
+          newMappings: [],
+        },
+        {
+          version: '2',
+          changeType: 'expansion',
+          newMappings: ['foo.type'],
+          hasMigration: false,
+        },
+      ]);
+    });
+
+    it('supports provider functions', () => {
+      const type = createType({
+        modelVersions: () => ({
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: {
+                up: jest.fn(),
+                down: jest.fn(),
+              },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: {
+                  type: 'boolean',
+                },
+              },
+            },
+          },
+        }),
+      });
+      const output = extractMigrationInfo(type);
+
+      expect(output.modelVersions).toEqual([
+        {
+          version: '1',
+          changeType: 'expansion',
+          hasMigration: true,
+          newMappings: [],
+        },
+        {
+          version: '2',
+          changeType: 'expansion',
+          newMappings: ['foo.type'],
+          hasMigration: false,
+        },
+      ]);
+    });
+
+    it('returns an empty list when model versions are not defined', () => {
+      const type = createType({
+        modelVersions: undefined,
+      });
+      const output = extractMigrationInfo(type);
+
+      expect(output.modelVersions).toEqual([]);
+    });
+  });
+
+  describe('migrations and modelVersions', () => {
+    it('generate properties for both', () => {
+      const type = createType({
+        migrations: {
+          '8.3.3': dummyMigration,
+          '7.17.7': dummyMigration,
+          '8.0.2': dummyMigration,
+        },
+        modelVersions: {
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: {
+                up: jest.fn(),
+                down: jest.fn(),
+              },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: {
+                  type: 'boolean',
+                },
+              },
+            },
+          },
+        },
+        switchToModelVersionAt: '8.8.0',
+      });
+
+      const output = extractMigrationInfo(type);
+
+      expect(output).toEqual(
+        expect.objectContaining({
+          migrationVersions: ['7.17.7', '8.0.2', '8.3.3'],
+          switchToModelVersionAt: '8.8.0',
+          modelVersions: [
+            {
+              version: '1',
+              changeType: 'expansion',
+              hasMigration: true,
+              newMappings: [],
+            },
+            {
+              version: '2',
+              changeType: 'expansion',
+              newMappings: ['foo.type'],
+              hasMigration: false,
+            },
+          ],
+        })
+      );
+    });
+  });
 });
diff --git a/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.ts b/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.ts
index c2f1c0b7aa9a2..329b8f23b4a0d 100644
--- a/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.ts
+++ b/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.ts
@@ -20,6 +20,15 @@ export interface SavedObjectTypeMigrationInfo {
   schemaVersions: string[];
   mappings: Record<string, unknown>;
   hasExcludeOnUpgrade: boolean;
+  modelVersions: ModelVersionSummary[];
+  switchToModelVersionAt?: string;
+}
+
+export interface ModelVersionSummary {
+  version: string;
+  changeType: string;
+  hasMigration: boolean;
+  newMappings: string[];
 }
 
 /**
@@ -37,6 +46,21 @@ export const extractMigrationInfo = (soType: SavedObjectsType): SavedObjectTypeM
   const schemaVersions = Object.keys(schemaMap ?? {});
   schemaVersions.sort(semverCompare);
 
+  const modelVersionMap =
+    typeof soType.modelVersions === 'function'
+      ? soType.modelVersions()
+      : soType.modelVersions ?? {};
+  const modelVersionIds = Object.keys(modelVersionMap);
+  const modelVersions = modelVersionIds.map((version) => {
+    const entry = modelVersionMap[version];
+    return {
+      version,
+      changeType: entry.modelChange.type,
+      hasMigration: !!entry.modelChange.transformation,
+      newMappings: Object.keys(getFlattenedObject(entry.modelChange.addedMappings ?? {})),
+    };
+  });
+
   return {
     name: soType.name,
     namespaceType: soType.namespaceType,
@@ -46,5 +70,7 @@ export const extractMigrationInfo = (soType: SavedObjectsType): SavedObjectTypeM
     schemaVersions,
     mappings: getFlattenedObject(soType.mappings ?? {}),
     hasExcludeOnUpgrade: !!soType.excludeOnUpgrade,
+    modelVersions,
+    switchToModelVersionAt: soType.switchToModelVersionAt,
   };
 };
diff --git a/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/get_migration_hash.test.ts b/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/get_migration_hash.test.ts
index 2ac9e04172e86..ab9a6aba7b6e4 100644
--- a/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/get_migration_hash.test.ts
+++ b/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/get_migration_hash.test.ts
@@ -131,6 +131,7 @@ describe('getMigrationHash', () => {
       expect(getMigrationHash(typeA)).not.toEqual(getMigrationHash(typeB));
     });
   });
+
   describe('schemas', () => {
     it('returns same hash if same schema versions are registered', () => {
       const typeA = createType({
@@ -321,6 +322,172 @@ describe('getMigrationHash', () => {
     });
   });
 
+  describe('model versions', () => {
+    it('returns same hash if same model versions versions are registered', () => {
+      const typeA = createType({
+        modelVersions: {
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: { up: jest.fn(), down: jest.fn() },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: { type: 'boolean' },
+              },
+            },
+          },
+        },
+      });
+      const typeB = createType({
+        modelVersions: {
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: { up: jest.fn(), down: jest.fn() },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: { type: 'boolean' },
+              },
+            },
+          },
+        },
+      });
+
+      expect(getMigrationHash(typeA)).toEqual(getMigrationHash(typeB));
+    });
+
+    it('returns same hash if same model versions are registered in different order', () => {
+      const typeA = createType({
+        modelVersions: {
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: { up: jest.fn(), down: jest.fn() },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: { type: 'boolean' },
+              },
+            },
+          },
+        },
+      });
+      const typeB = createType({
+        modelVersions: {
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: { type: 'boolean' },
+              },
+            },
+          },
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: { up: jest.fn(), down: jest.fn() },
+            },
+          },
+        },
+      });
+
+      expect(getMigrationHash(typeA)).toEqual(getMigrationHash(typeB));
+    });
+
+    it('returns same hash if same model versions are registered using record + function', () => {
+      const typeA = createType({
+        modelVersions: {
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: { up: jest.fn(), down: jest.fn() },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: { type: 'boolean' },
+              },
+            },
+          },
+        },
+      });
+      const typeB = createType({
+        modelVersions: () => ({
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: { up: jest.fn(), down: jest.fn() },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: { type: 'boolean' },
+              },
+            },
+          },
+        }),
+      });
+
+      expect(getMigrationHash(typeA)).toEqual(getMigrationHash(typeB));
+    });
+
+    it('returns different hashes if different model versions are registered', () => {
+      const typeA = createType({
+        modelVersions: {
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: { up: jest.fn(), down: jest.fn() },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                foo: { type: 'boolean' },
+              },
+            },
+          },
+        },
+      });
+      const typeB = createType({
+        modelVersions: {
+          '1': {
+            modelChange: {
+              type: 'expansion',
+              transformation: { up: jest.fn(), down: jest.fn() },
+            },
+          },
+          '2': {
+            modelChange: {
+              type: 'expansion',
+              addedMappings: {
+                bar: { type: 'boolean' },
+              },
+            },
+          },
+        },
+      });
+
+      expect(getMigrationHash(typeA)).not.toEqual(getMigrationHash(typeB));
+    });
+  });
+
   describe('ignored fields', () => {
     it('returns same hash if `hidden` changes', () => {
       expect(getMigrationHash(createType({ hidden: false }))).toEqual(
diff --git a/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/get_migration_hash.ts b/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/get_migration_hash.ts
index 7e23ec35bb9e7..bc6155f6bbc76 100644
--- a/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/get_migration_hash.ts
+++ b/packages/core/test-helpers/core-test-helpers-so-type-serializer/src/get_migration_hash.ts
@@ -8,7 +8,7 @@
 
 import { createHash } from 'crypto';
 import type { SavedObjectsType } from '@kbn/core-saved-objects-server';
-import { extractMigrationInfo } from './extract_migration_info';
+import { extractMigrationInfo, ModelVersionSummary } from './extract_migration_info';
 
 type SavedObjectTypeMigrationHash = string;
 
@@ -26,8 +26,19 @@ export const getMigrationHash = (soType: SavedObjectsType): SavedObjectTypeMigra
     migInfo.migrationVersions.join(','),
     migInfo.schemaVersions.join(','),
     JSON.stringify(migInfo.mappings, Object.keys(migInfo.mappings).sort()),
+    migInfo.switchToModelVersionAt ?? 'none',
+    migInfo.modelVersions.map(serializeModelVersion).join(','),
   ];
   const hashFeed = hashParts.join('-');
 
   return hash.update(hashFeed).digest('hex');
 };
+
+const serializeModelVersion = (modelVersion: ModelVersionSummary): string => {
+  return [
+    modelVersion.version,
+    modelVersion.changeType,
+    modelVersion.hasMigration,
+    ...modelVersion.newMappings,
+  ].join('|');
+};
diff --git a/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts b/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
index 3bde565c75ce6..bafc64776b6dd 100644
--- a/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
+++ b/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
@@ -55,103 +55,103 @@ describe('checking migration metadata changes on all registered SO types', () =>
 
     expect(hashMap).toMatchInlineSnapshot(`
       Object {
-        "action": "7858e6d5a9f231bf23f6f2e57328eb0095b26735",
-        "action_task_params": "bbd38cbfd74bf6713586fe078e3fa92db2234299",
-        "alert": "f2e81863be0b50966b876b88b906c962e30b8c9c",
-        "api_key_pending_invalidation": "9b4bc1235337da9a87ef05a1d1f4858b2a3b77c6",
-        "apm-indices": "ceb0870f3a74e2ffc3a1cd3a3c73af76baca0999",
-        "apm-server-schema": "2bfd2998d3873872e1366458ce553def85418f91",
-        "apm-service-group": "07ecbf25ee4828d2b686abc98656b6665831d1a0",
-        "apm-telemetry": "abaa1e9469e6e0bad76938309f0ac4c66b528d58",
-        "app_search_telemetry": "7fc4fc08852bf0924ee29942bb394fda9aa8954d",
-        "application_usage_daily": "6e645e0b60ef3af2e8fde80963c2a4f09a190d61",
-        "application_usage_totals": "b2af3577dcd50bfae492b166a7804f69e2cc41dc",
-        "canvas-element": "e2e312fc499c1a81e628b88baba492fb24f4e82d",
-        "canvas-workpad": "4b05f7829bc805bbaa07eb9fc0d2a2bbbd6bbf39",
-        "canvas-workpad-template": "d4bb65aa9c4a2b25029d3272fd9c715d8e4247d7",
-        "cases": "a27d57e75e358349a6ba835152fd4de0033a7bff",
-        "cases-comments": "d7c4c1d24e97620cd415e27e5eb7d5b5f2c5b461",
-        "cases-configure": "1afc414f5563a36e4612fa269193d3ed7277c7bd",
-        "cases-connector-mappings": "4b16d440af966e5d6e0fa33368bfa15d987a4b69",
-        "cases-telemetry": "16e261e7378a72acd0806f18df92525dd1da4f37",
-        "cases-user-actions": "9570938b5832f0e91ca489d8e1edf7dcaef59e55",
-        "config": "95d8ecc452186201a691e72ec154ba65dfc5cb98",
-        "config-global": "b8f559884931609a349e129c717af73d23e7bc76",
-        "connector_token": "fa5301aa5a2914795d3b1b82d0a49939444009da",
-        "core-usage-stats": "f40a213da2c597b0de94e364a4326a5a1baa4ca9",
-        "csp-rule-template": "d6104585d0b032355c64a7dbf2a834163351cb1c",
-        "dashboard": "7e37790f802b39c852f905c010e13674e893105a",
-        "endpoint:user-artifact": "f94c250a52b30d0a2d32635f8b4c5bdabd1e25c0",
-        "endpoint:user-artifact-manifest": "8c14d49a385d5d1307d956aa743ec78de0b2be88",
-        "enterprise_search_telemetry": "fafcc8318528d34f721c42d1270787c52565bad5",
-        "epm-packages": "21e096cf4554abe1652953a6cd2119d68ddc9403",
-        "epm-packages-assets": "9fd3d6726ac77369249e9a973902c2cd615fc771",
-        "event_loop_delays_daily": "d2ed39cf669577d90921c176499908b4943fb7bd",
-        "exception-list": "fe8cc004fd2742177cdb9300f4a67689463faf9c",
-        "exception-list-agnostic": "49fae8fcd1967cc4be45ba2a2c66c4afbc1e341b",
-        "file": "f5d393602a4c103eb0ace983e6810f7f3666544b",
-        "file-upload-usage-collection-telemetry": "8478924cf0057bd90df737155b364f98d05420a5",
-        "fileShare": "3f88784b041bb8728a7f40763a08981828799a75",
-        "fleet-fleet-server-host": "643d15dbf56edb96f7ca65f98409d83ac5792fb6",
-        "fleet-preconfiguration-deletion-record": "7b28f200513c28ae774f1b7d7d7906954e3c6e16",
-        "fleet-proxy": "2bbcd9e6d5e30ac07b275c8d489af07a0d550df5",
-        "graph-workspace": "3342f2cd561afdde8f42f5fb284bf550dee8ebb5",
-        "guided-onboarding-guide-state": "561db8d481b131a2bbf46b1e534d6ce960255135",
-        "guided-onboarding-plugin-state": "a802ed58e9d0076b9632c59d7943861ba476f99c",
-        "index-pattern": "48e77ca393c254e93256f11a7cdc0232dd754c08",
-        "infrastructure-monitoring-log-view": "e2c78c1076bd35e57d7c5fa1b410e5c126d12327",
-        "infrastructure-ui-source": "7c8dbbc0a608911f1b683a944f4a65383f6153ed",
-        "ingest-agent-policies": "a94bd53b8f81ca883de8a75386db04e27dda973e",
-        "ingest-download-sources": "1e69dabd6db5e320fe08c5bda8f35f29bafc6b54",
-        "ingest-outputs": "29181ecfdc7723f544325ecef7266bccbc691a54",
-        "ingest-package-policies": "0335a28af793ce25b4969d2156cfaf1dae2ef812",
-        "ingest_manager_settings": "6f36714825cc15ea8d7cda06fde7851611a532b4",
-        "inventory-view": "bc2bd1e7ec7c186159447ab228d269f22bd39056",
-        "kql-telemetry": "29544cd7d3b767c5399878efae6bd724d24c03fd",
-        "legacy-url-alias": "7172dfd54f2e0c89fe263fd7095519b2d826a930",
-        "lens": "236ecd358ed3a4ecfc03ed676d958b64acf0b697",
-        "lens-ui-telemetry": "df2844565c9e18fed2bdb1f6cc3aadd58cf1e45b",
-        "map": "00ca6c4cf46ae59f70f1436262eb9f457b45eb14",
-        "maps-telemetry": "5adbde35bd50ec2b8e9ea5b96d4d9f886e31ecfb",
-        "metrics-explorer-view": "09e56993352b8ee678e88f71e4410d9aeee72f3a",
-        "ml-job": "2836da98a81bd220db61c0549e8e28da7a876cb2",
-        "ml-module": "95055522c8406afa67a554690a43506f6c040744",
-        "ml-trained-model": "e39dd10b2da827e194ddcaaf3db141ad1daf0201",
-        "monitoring-telemetry": "af508cea8e22edaa909e462069390650fbbf01b7",
-        "osquery-manager-usage-metric": "fbe3cbea25a96e2ca522ca436878e0162c94dcc2",
-        "osquery-pack": "a2d675c7af4208e54a5b28d23d324d7c599a5491",
-        "osquery-pack-asset": "de8783298eb33a577bf1fa0caacd42121dcfae91",
-        "osquery-saved-query": "7b213b4b7a3e59350e99c50e8df9948662ed493a",
-        "query": "4640ef356321500a678869f24117b7091a911cb6",
-        "rules-settings": "1af4c9abd4b40a154e233c2af4867df7aab7ac24",
-        "sample-data-telemetry": "8b10336d9efae6f3d5593c4cc89fb4abcdf84e04",
-        "search": "c48f5ab5d94545780ea98de1bff9e39f17f3606b",
-        "search-session": "ba383309da68a15be3765977f7a44c84f0ec7964",
-        "search-telemetry": "beb3fc25488c753f2a6dcff1845d667558712b66",
-        "security-rule": "e0dfdba5d66139d0300723b2e6672993cd4a11f3",
-        "security-solution-signals-migration": "e65933e32926e0ca385415bd44fc6da0b6d3d419",
-        "siem-detection-engine-rule-actions": "d4b5934c0c0e4ccdf509a41000eb0bee07be0c28",
-        "siem-ui-timeline": "95474f10662802e2f9ea068b45bf69212a2f5842",
-        "siem-ui-timeline-note": "08c71dc0b8b8018a67e80beb4659a078404c223d",
-        "siem-ui-timeline-pinned-event": "e2697b38751506c7fce6e8b7207a830483dc4283",
-        "space": "c4a0acce1bd4b9cce85154f2a350624a53111c59",
-        "spaces-usage-stats": "922d3235bbf519e3fb3b260e27248b1df8249b79",
-        "synthetics-monitor": "7c1e5a78fb3b88cc03b441d3bf3714d9967ab214",
-        "synthetics-param": "53dee203042c238888247084336f2dba777f4a65",
-        "synthetics-privates-locations": "dd00385f4a27ef062c3e57312eeb3799872fa4af",
-        "tag": "39413f4578cc2128c9a0fda97d0acd1c8862c47a",
-        "task": "ef53d0f070bd54957b8fe22fae3b1ff208913f76",
-        "telemetry": "9142dc5f18123fb6e6a9083db04e5becbfde94fd",
-        "ui-metric": "2fb66ccdee2d1fad52547964421629c5a485c38f",
-        "upgrade-assistant-ml-upgrade-operation": "408120d386c04ab25fe64a03937597aa0438c10d",
-        "upgrade-assistant-reindex-operation": "d9e18b3d9578ecabf09a297296dcf7e36b2481fd",
-        "upgrade-assistant-telemetry": "a0c80933a9f8b50a2590d19e1d1e5f97d28f7104",
-        "uptime-dynamic-settings": "9de35c5aeaef915c5bc3c5b1632c33fb0f6f1c55",
-        "uptime-synthetics-api-key": "df9d8418ddc210d832a069a0fb796f73e63d1082",
-        "url": "d66c1f26ed23a392be3617a8444d713571f58380",
-        "usage-counters": "33e2081a52215293041da1100e6602fb553ff446",
-        "visualization": "f45d06858a5634c9ed0367e11eb44f7f7dde0be2",
-        "workplace_search_telemetry": "45bd03e12b060c08381b0fd325d939f80d08c914",
+        "action": "6cfc277ed3211639e37546ac625f4a68f2494215",
+        "action_task_params": "db2afea7d78e00e725486b791554d0d4e81956ef",
+        "alert": "492f749af60bed1cc7022519ddf5fe4c482b62c4",
+        "api_key_pending_invalidation": "16e7bcf8e78764102d7f525542d5b616809a21ee",
+        "apm-indices": "d19dd7fb51f2d2cbc1f8769481721e0953f9a6d2",
+        "apm-server-schema": "1d42f17eff9ec6c16d3a9324d9539e2d123d0a9a",
+        "apm-service-group": "2801c50332e3bf5726c923966c1f19f886e7d389",
+        "apm-telemetry": "712138c3d5e36d865e67c7fc0171c8a779446e58",
+        "app_search_telemetry": "9269643c9a5894998b44883f7f7d07a453fd6a95",
+        "application_usage_daily": "9867f6e1355124f822beab051e0fbac4cc117eac",
+        "application_usage_totals": "9469a48ab887761a73ee3719b8d401ac627f1eb1",
+        "canvas-element": "ec334dd45d14291db4d74197e0e42dfe06526868",
+        "canvas-workpad": "ab0525bd5aa4dbad2d6fdb30e6a51bb475254751",
+        "canvas-workpad-template": "c54f2a188a1d0bf18a6cebd9d6f28a7337d41bbf",
+        "cases": "74c00dfb25f4b109894971bd1090fce4a7c99490",
+        "cases-comments": "b94072c8f0cb642dd6da43c833bd2d391e175ec0",
+        "cases-configure": "25099c9e4bbb91e01e334848c605b4a5de5c9fce",
+        "cases-connector-mappings": "8de3b77dc6ae8ee62cce2b58a222471dfc3dbdad",
+        "cases-telemetry": "fdeddcef28c75d8c66422475a829e75d37f0b668",
+        "cases-user-actions": "cfd388d2ca27b3abfd3955dc41428fb229989921",
+        "config": "97e16b8f5dc10c404fd3b201ef36bc6c3c63dc80",
+        "config-global": "d9791e8f73edee884630e1cb6e4954ae513ce75e",
+        "connector_token": "fb05ff5afdcb6e2f20c9c6513ff7a1ab12b66f36",
+        "core-usage-stats": "b3c04da317c957741ebcdedfea4524049fdc79ff",
+        "csp-rule-template": "099c229bf97578d9ca72b3a672d397559b84ee0b",
+        "dashboard": "71e3f8dfcffeb5fbd410dec81ce46f5691763c43",
+        "endpoint:user-artifact": "a5b154962fb6cdf5d9e7452e58690054c95cc72a",
+        "endpoint:user-artifact-manifest": "5989989c0f84dd2d02da1eb46b6254e334bd2ccd",
+        "enterprise_search_telemetry": "4b41830e3b28a16eb92dee0736b44ae6276ced9b",
+        "epm-packages": "1922a722ea42ab4953a96037fabb81a9ded8e240",
+        "epm-packages-assets": "00c8b5e5bf059627ffc9fbde920e1ac75926c5f6",
+        "event_loop_delays_daily": "ef49e7f15649b551b458c7ea170f3ed17f89abd0",
+        "exception-list": "aae42e8f19017277d194d37d4898ed6598c03e9a",
+        "exception-list-agnostic": "2634ee4219d27663a5755536fc06cbf3bb4beba5",
+        "file": "d12998f49bc82da596a9e6c8397999930187ec6a",
+        "file-upload-usage-collection-telemetry": "c6fcb9a7efcf19b2bb66ca6e005bfee8961f6073",
+        "fileShare": "f07d346acbb724eacf139a0fb781c38dc5280115",
+        "fleet-fleet-server-host": "67180a54a689111fb46403c3603c9b3a329c698d",
+        "fleet-preconfiguration-deletion-record": "3afad160748b430427086985a3445fd8697566d5",
+        "fleet-proxy": "94d0a902a0fd22578d7d3a20873b95d902e25245",
+        "graph-workspace": "565642a208fe7413b487aea979b5b153e4e74abe",
+        "guided-onboarding-guide-state": "3257825ae840309cb676d64b347107db7b76f30a",
+        "guided-onboarding-plugin-state": "2d3ef3069ca8e981cafe8647c0c4a4c20739db10",
+        "index-pattern": "cd51191712081278c2af83d16552c3438ef83353",
+        "infrastructure-monitoring-log-view": "8040108f02ef27419cff79077384379709d44bbc",
+        "infrastructure-ui-source": "2311f7d0abe2a713aa71e30ee24f78828d4acfc1",
+        "ingest-agent-policies": "e5bb18f8c1d1106139e82fccb93fce01b21fde9b",
+        "ingest-download-sources": "95a15b6589ef46e75aca8f7e534c493f99cc3ccd",
+        "ingest-outputs": "f5adeb3f6abc732a6067137e170578dbf1f58c62",
+        "ingest-package-policies": "f20a00d14ba0651e0dbdada40f9762926819e298",
+        "ingest_manager_settings": "fb75bff08a8de3435b23664b1191f9244a255701",
+        "inventory-view": "6d47ef0b38166ecbd1c2fc7394599a4500db1ae4",
+        "kql-telemetry": "23ed96ff02cd69cbfaa22f313cae3a54c434db51",
+        "legacy-url-alias": "9b8cca3fbb2da46fd12823d3cd38fdf1c9f24bc8",
+        "lens": "42793535312de4e3e3df16a69cb85f5df3b14f72",
+        "lens-ui-telemetry": "d6c4e330d170eefc6214dbf77a53de913fa3eebc",
+        "map": "7902b2e2a550e0b73fd5aa6c4e2ba3a4e6558877",
+        "maps-telemetry": "1b2e468ec4dd1207e417b98f84b24cd87e1efd14",
+        "metrics-explorer-view": "713dbf1ab5e067791d19170f715eb82cf07ebbcc",
+        "ml-job": "12e21f1b1adfcc1052dc0b10c7459de875653b94",
+        "ml-module": "c88b6a012cfb7b7adb7629b1edeab6b83f1fd048",
+        "ml-trained-model": "49a1685d79990ad05ea1d1d30e28456fe002f3b9",
+        "monitoring-telemetry": "24f7393dfacb6c7b0f7ad7d242171a1c29feaa48",
+        "osquery-manager-usage-metric": "23a8f08a98dd0f58ab4e559daa35b06edc40ed4f",
+        "osquery-pack": "407f82b8f05f02a04627993e6d2a071b4d71f816",
+        "osquery-pack-asset": "e10ca4b6ac5dff1954b5140ed97c3187d353a029",
+        "osquery-saved-query": "86bd3e1d39c470375263b28437c67b4f96667bc2",
+        "query": "495b96d251383d44b48ad3ccd831b857f909ae41",
+        "rules-settings": "9854495c3b54b16a6625fb250c35e5504da72266",
+        "sample-data-telemetry": "c38daf1a49ed24f2a4fb091e6e1e833fccf19935",
+        "search": "928589cf4b2497623faa48d22f406bab4721704c",
+        "search-session": "e0f495ac1b3bb40ba3eb3aea90b2d11e6c8d4c32",
+        "search-telemetry": "ab67ef721f294f28d5e10febbd20653347720188",
+        "security-rule": "1ff82dfb2298c3caf6888fc3ef15c6bf7a628877",
+        "security-solution-signals-migration": "c2db409c1857d330beb3d6fd188fa186f920302c",
+        "siem-detection-engine-rule-actions": "dbf3747aad2b986534b052703063a7026b25f485",
+        "siem-ui-timeline": "e9d6b3a9fd7af6dc502293c21cbdb309409f3996",
+        "siem-ui-timeline-note": "13c9d4c142f96624a93a623c6d7cba7e1ae9b5a6",
+        "siem-ui-timeline-pinned-event": "96a43d59b9e2fc11f12255a0cb47ef0a3d83af4c",
+        "space": "9542afcd6fd71558623c09151e453c5e84b4e5e1",
+        "spaces-usage-stats": "084bd0f080f94fb5735d7f3cf12f13ec92f36bad",
+        "synthetics-monitor": "5d0a69fac9d6cfdacfa1962274344aecb596167a",
+        "synthetics-param": "9776c9b571d35f0d0397e8915e035ea1dc026db7",
+        "synthetics-privates-locations": "7d032fc788905e32152029ae7ab3d6038c48ae44",
+        "tag": "87f21f07df9cc37001b15a26e413c18f50d1fbfe",
+        "task": "ebcc113df12f14bf627dbd335ba78507187b48a3",
+        "telemetry": "561b329aaed3c15b91aaf2075645be3097247612",
+        "ui-metric": "410a8ad28e0f44b161c960ff0ce950c712b17c52",
+        "upgrade-assistant-ml-upgrade-operation": "e20ff1efa3c4757f5e7ff5fb897c557b08524c3a",
+        "upgrade-assistant-reindex-operation": "c7442ffe34954c117a74bf138e48e4c25095a6cf",
+        "upgrade-assistant-telemetry": "12bcbfc4e4ce64d2ca7c24f9acccd331a2bd2ab6",
+        "uptime-dynamic-settings": "9a63ce80904a04be114749e426882dc3ff011137",
+        "uptime-synthetics-api-key": "599319bedbfa287e8761e1ba49d536417a33fa13",
+        "url": "2422b3cbe0af71f7a9c2e228e19a972e759c56d4",
+        "usage-counters": "f478b2668be350f5bdc08d9e1cf6fbce0e079f61",
+        "visualization": "3aff13fbc2223de74167be6a78537812c8b9d236",
+        "workplace_search_telemetry": "10e278fe9ae1396bfc36ae574bc387d7e696d43f",
       }
     `);
   });

From 8693c622dbf0b26ae5ba0435217c64fcf843da81 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@elastic.co>
Date: Tue, 7 Feb 2023 09:15:44 -0700
Subject: [PATCH 077/134] [Maps] fix grid resolution ticks without labels not
 visible (#150385)

To view problem
1) create new map and add "Clusters" layer. Configure layer and click
"Add layer"
2) Under the clusters section, notice that there are no ticks in the
middle of "Resolution" slider. This makes it difficult for users to see
the available selections.
<img width="200" alt="Screen Shot 2023-02-06 at 1 42 25 PM"
src="https://user-images.githubusercontent.com/373691/217081316-2cdfd50b-1a7a-4c1e-9037-349f124466a7.png">
<img width="200" alt="Screen Shot 2023-02-06 at 1 42 19 PM"
src="https://user-images.githubusercontent.com/373691/217081350-7bda07ad-1431-4801-96f7-2235e610ed17.png">

The problem is that empty string does not render the tick mark. This PR
adds a react element that renders an empty string, making the tick mark
visible and providing visual context to users about selectable areas.
<img width="200" alt="Screen Shot 2023-02-06 at 1 41 49 PM"
src="https://user-images.githubusercontent.com/373691/217081507-391ebb4c-d9a4-422f-85e1-61982c2604eb.png">
<img width="200" alt="Screen Shot 2023-02-06 at 1 41 43 PM"
src="https://user-images.githubusercontent.com/373691/217081524-a799d435-99b5-46c0-82d3-b15a913594a1.png">
---
 .../resolution_editor.test.tsx.snap           | 28 ++++++++++++++-----
 .../es_geo_grid_source/resolution_editor.tsx  |  4 +--
 2 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/__snapshots__/resolution_editor.test.tsx.snap b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/__snapshots__/resolution_editor.test.tsx.snap
index dfff4bdd6ca44..073e368293a04 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/__snapshots__/resolution_editor.test.tsx.snap
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/__snapshots__/resolution_editor.test.tsx.snap
@@ -24,7 +24,9 @@ exports[`should render 3 tick slider when renderAs is HEX 1`] = `
             "value": 1,
           },
           Object {
-            "label": "",
+            "label": <span>
+               
+            </span>,
             "value": 2,
           },
           Object {
@@ -63,11 +65,15 @@ exports[`should render 4 tick slider when renderAs is GRID 1`] = `
             "value": 1,
           },
           Object {
-            "label": "",
+            "label": <span>
+               
+            </span>,
             "value": 2,
           },
           Object {
-            "label": "",
+            "label": <span>
+               
+            </span>,
             "value": 3,
           },
           Object {
@@ -106,11 +112,15 @@ exports[`should render 4 tick slider when renderAs is HEATMAP 1`] = `
             "value": 1,
           },
           Object {
-            "label": "",
+            "label": <span>
+               
+            </span>,
             "value": 2,
           },
           Object {
-            "label": "",
+            "label": <span>
+               
+            </span>,
             "value": 3,
           },
           Object {
@@ -149,11 +159,15 @@ exports[`should render 4 tick slider when renderAs is POINT 1`] = `
             "value": 1,
           },
           Object {
-            "label": "",
+            "label": <span>
+               
+            </span>,
             "value": 2,
           },
           Object {
-            "label": "",
+            "label": <span>
+               
+            </span>,
             "value": 3,
           },
           Object {
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/resolution_editor.tsx b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/resolution_editor.tsx
index b7ab3bb334f44..ff5aee4eb1932 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/resolution_editor.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/resolution_editor.tsx
@@ -53,13 +53,13 @@ export class ResolutionEditor extends Component<Props, State> {
     const scale = this._getScale();
     const unlabeledTicks = [
       {
-        label: '',
+        label: <span>&nbsp;</span>,
         value: scale[GRID_RESOLUTION.FINE],
       },
     ];
     if (scale[GRID_RESOLUTION.FINE] !== scale[GRID_RESOLUTION.MOST_FINE]) {
       unlabeledTicks.push({
-        label: '',
+        label: <span>&nbsp;</span>,
         value: scale[GRID_RESOLUTION.MOST_FINE],
       });
     }

From 33b6dc9b1b8575955f5ff2e6968d6411474d0192 Mon Sep 17 00:00:00 2001
From: Ido Cohen <90558359+CohenIdo@users.noreply.github.com>
Date: Tue, 7 Feb 2023 18:23:22 +0200
Subject: [PATCH 078/134] [Cloud Security] Telemetry by rule

---
 .../collectors/accounts_stats_collector.ts    |  22 +-
 .../lib/telemetry/collectors/register.ts      |   5 +-
 .../collectors/rules_stats_collector.ts       | 258 ++++++++++++++++++
 .../server/lib/telemetry/collectors/schema.ts |  16 ++
 .../server/lib/telemetry/collectors/types.ts  |  14 +
 .../schema/xpack_plugins.json                 |  40 +++
 6 files changed, 342 insertions(+), 13 deletions(-)
 create mode 100644 x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/rules_stats_collector.ts

diff --git a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/accounts_stats_collector.ts b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/accounts_stats_collector.ts
index 1402b45f3d223..53e7aa66f5e3c 100644
--- a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/accounts_stats_collector.ts
+++ b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/accounts_stats_collector.ts
@@ -6,7 +6,10 @@
  */
 import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import type { Logger } from '@kbn/core/server';
-import type { SearchRequest } from '@elastic/elasticsearch/lib/api/types';
+import type {
+  AggregationsMultiBucketBase,
+  SearchRequest,
+} from '@elastic/elasticsearch/lib/api/types';
 import { getIdentifierRuntimeMapping } from '../../get_identifier_runtime_mapping';
 import { calculatePostureScore } from '../../../../common/utils/helpers';
 import type { CspmAccountsStats } from './types';
@@ -15,11 +18,6 @@ import { LATEST_FINDINGS_INDEX_DEFAULT_NS } from '../../../../common/constants';
 interface Value {
   value: number;
 }
-
-interface DocCount {
-  doc_count: number;
-}
-
 interface BenchmarkName {
   metrics: { 'rule.benchmark.name': string };
 }
@@ -40,8 +38,8 @@ interface AccountsStats {
 interface AccountEntity {
   key: string; // account_id
   doc_count: number; // latest findings doc count
-  passed_findings_count: DocCount;
-  failed_findings_count: DocCount;
+  passed_findings_count: AggregationsMultiBucketBase;
+  failed_findings_count: AggregationsMultiBucketBase;
   benchmark_name: { top: BenchmarkName[] };
   benchmark_id: { top: BenchmarkId[] };
   benchmark_version: { top: BenchmarkVersion[] };
@@ -53,8 +51,8 @@ interface AccountEntity {
   };
 }
 
-const getAccountsStatsQuery = (index: string): SearchRequest => ({
-  index,
+const getAccountsStatsQuery = (): SearchRequest => ({
+  index: LATEST_FINDINGS_INDEX_DEFAULT_NS,
   runtime_mappings: getIdentifierRuntimeMapping(),
   query: {
     match_all: {},
@@ -225,7 +223,7 @@ export const getAccountsStats = async (
 
     if (isIndexExists) {
       const accountsStatsResponse = await esClient.search<unknown, AccountsStats>(
-        getAccountsStatsQuery(LATEST_FINDINGS_INDEX_DEFAULT_NS)
+        getAccountsStatsQuery()
       );
 
       const cspmAccountsStats = accountsStatsResponse.aggregations
@@ -237,7 +235,7 @@ export const getAccountsStats = async (
 
     return [];
   } catch (e) {
-    logger.error(`Failed to get resources stats ${e}`);
+    logger.error(`Failed to get account stats ${e}`);
     return [];
   }
 };
diff --git a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/register.ts b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/register.ts
index 9eeb3338a9035..8e8482fd5a495 100644
--- a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/register.ts
+++ b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/register.ts
@@ -12,6 +12,7 @@ import { getResourcesStats } from './resources_stats_collector';
 import { cspmUsageSchema } from './schema';
 import { CspmUsage } from './types';
 import { getAccountsStats } from './accounts_stats_collector';
+import { getRulesStats } from './rules_stats_collector';
 
 export function registerCspmUsageCollector(
   logger: Logger,
@@ -27,16 +28,18 @@ export function registerCspmUsageCollector(
     type: 'cloud_security_posture',
     isReady: () => true,
     fetch: async (collectorFetchContext: CollectorFetchContext) => {
-      const [indicesStats, accountsStats, resourcesStats] = await Promise.all([
+      const [indicesStats, accountsStats, resourcesStats, rulesStats] = await Promise.all([
         getIndicesStats(collectorFetchContext.esClient, logger),
         getAccountsStats(collectorFetchContext.esClient, logger),
         getResourcesStats(collectorFetchContext.esClient, logger),
+        getRulesStats(collectorFetchContext.esClient, logger),
       ]);
 
       return {
         indices: indicesStats,
         accounts_stats: accountsStats,
         resources_stats: resourcesStats,
+        rules_stats: rulesStats,
       };
     },
     schema: cspmUsageSchema,
diff --git a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/rules_stats_collector.ts b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/rules_stats_collector.ts
new file mode 100644
index 0000000000000..b4f21061893e5
--- /dev/null
+++ b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/rules_stats_collector.ts
@@ -0,0 +1,258 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
+import type { Logger } from '@kbn/core/server';
+import type {
+  AggregationsMultiBucketBase,
+  SearchRequest,
+} from '@elastic/elasticsearch/lib/api/types';
+import type { CspmRulesStats } from './types';
+import { LATEST_FINDINGS_INDEX_DEFAULT_NS } from '../../../../common/constants';
+
+interface BenchmarkName {
+  metrics: { 'rule.benchmark.name': string };
+}
+
+interface BenchmarkId {
+  metrics: { 'rule.benchmark.id': string };
+}
+
+interface BenchmarkVersion {
+  metrics: { 'rule.benchmark.version': string };
+}
+interface RuleName {
+  metrics: { 'rule.name': string };
+}
+interface RuleSection {
+  metrics: { 'rule.section': string };
+}
+interface RuleVersion {
+  metrics: { 'rule.version': string };
+}
+interface RuleNumber {
+  metrics: { 'rule.benchmark.rule_number': string };
+}
+interface PostureType {
+  metrics: { 'rule.benchmark.posture_type': string };
+}
+
+interface RulesStats {
+  rules: {
+    buckets: RuleEntity[];
+  };
+}
+
+interface RuleEntity {
+  key: string; // rule_id
+  rule_name: { top: RuleName[] };
+  rule_section: { top: RuleSection[] };
+  rule_version: { top: RuleVersion[] };
+  rule_number: { top: RuleNumber[] };
+  posture_type: { top: PostureType[] };
+  benchmark_id: { top: BenchmarkId[] };
+  benchmark_name: { top: BenchmarkName[] };
+  benchmark_version: { top: BenchmarkVersion[] };
+  passed_findings_count: AggregationsMultiBucketBase;
+  failed_findings_count: AggregationsMultiBucketBase;
+}
+
+const getRulesStatsQuery = (): SearchRequest => ({
+  index: LATEST_FINDINGS_INDEX_DEFAULT_NS,
+  query: {
+    match_all: {},
+  },
+  aggs: {
+    rules: {
+      terms: {
+        field: 'rule.id',
+        order: {
+          _count: 'desc',
+        },
+        size: 100,
+      },
+      aggs: {
+        rule_name: {
+          top_metrics: {
+            metrics: {
+              field: 'rule.name',
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
+          },
+        },
+        rule_section: {
+          top_metrics: {
+            metrics: {
+              field: 'rule.section',
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
+          },
+        },
+        rule_version: {
+          top_metrics: {
+            metrics: {
+              field: 'rule.version',
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
+          },
+        },
+        posture_type: {
+          top_metrics: {
+            metrics: {
+              field: 'rule.benchmark.posture_type',
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
+          },
+        },
+        rule_number: {
+          top_metrics: {
+            metrics: {
+              field: 'rule.benchmark.rule_number',
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
+          },
+        },
+        benchmark_id: {
+          top_metrics: {
+            metrics: {
+              field: 'rule.benchmark.id',
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
+          },
+        },
+        benchmark_version: {
+          top_metrics: {
+            metrics: {
+              field: 'rule.benchmark.version',
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
+          },
+        },
+        benchmark_name: {
+          top_metrics: {
+            metrics: {
+              field: 'rule.benchmark.name',
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
+          },
+        },
+        passed_findings_count: {
+          filter: {
+            bool: {
+              filter: [
+                {
+                  bool: {
+                    should: [
+                      {
+                        term: {
+                          'result.evaluation': 'passed',
+                        },
+                      },
+                    ],
+                    minimum_should_match: 1,
+                  },
+                },
+              ],
+            },
+          },
+        },
+        failed_findings_count: {
+          filter: {
+            bool: {
+              filter: [
+                {
+                  bool: {
+                    should: [
+                      {
+                        term: {
+                          'result.evaluation': 'failed',
+                        },
+                      },
+                    ],
+                    minimum_should_match: 1,
+                  },
+                },
+              ],
+            },
+          },
+        },
+      },
+    },
+  },
+
+  size: 0,
+  _source: false,
+});
+
+const getCspmRulesStats = (aggregatedRulesStats: RulesStats, logger: Logger): CspmRulesStats[] => {
+  const rules = aggregatedRulesStats.rules.buckets;
+
+  const cspmRulesStats = rules.map((rule) => ({
+    rule_id: rule.key,
+    rule_name: rule.rule_name.top[0].metrics['rule.name'],
+    rule_section: rule.rule_section.top[0].metrics['rule.section'],
+    rule_version: rule.rule_version.top[0].metrics['rule.version'],
+    rule_number: rule.rule_number.top[0].metrics['rule.benchmark.rule_number'],
+    posture_type: rule.posture_type.top[0].metrics['rule.benchmark.posture_type'],
+    benchmark_name: rule.benchmark_name.top[0].metrics['rule.benchmark.name'],
+    benchmark_id: rule.benchmark_id.top[0].metrics['rule.benchmark.id'],
+    passed_findings_count: rule.passed_findings_count.doc_count,
+    benchmark_version: rule.benchmark_version.top[0].metrics['rule.benchmark.version'],
+    failed_findings_count: rule.failed_findings_count.doc_count,
+  }));
+
+  return cspmRulesStats;
+};
+
+export const getRulesStats = async (
+  esClient: ElasticsearchClient,
+  logger: Logger
+): Promise<CspmRulesStats[]> => {
+  try {
+    const isIndexExists = await esClient.indices.exists({
+      index: LATEST_FINDINGS_INDEX_DEFAULT_NS,
+    });
+
+    if (isIndexExists) {
+      const rulesStatsResponse = await esClient.search<unknown, RulesStats>(getRulesStatsQuery());
+
+      const cspmRulesStats = rulesStatsResponse.aggregations
+        ? getCspmRulesStats(rulesStatsResponse.aggregations, logger)
+        : [];
+
+      return cspmRulesStats;
+    }
+
+    return [];
+  } catch (e) {
+    logger.error(`Failed to get rules stats ${e}`);
+    return [];
+  }
+};
diff --git a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/schema.ts b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/schema.ts
index b7ed05f4532ce..47bfaca74e457 100644
--- a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/schema.ts
+++ b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/schema.ts
@@ -81,4 +81,20 @@ export const cspmUsageSchema: MakeSchemaFrom<CspmUsage> = {
       pods_count: { type: 'short' },
     },
   },
+  rules_stats: {
+    type: 'array',
+    items: {
+      rule_id: { type: 'keyword' },
+      rule_name: { type: 'keyword' },
+      rule_section: { type: 'keyword' },
+      rule_version: { type: 'keyword' },
+      rule_number: { type: 'keyword' },
+      posture_type: { type: 'keyword' },
+      benchmark_id: { type: 'keyword' },
+      benchmark_name: { type: 'keyword' },
+      benchmark_version: { type: 'keyword' },
+      passed_findings_count: { type: 'long' },
+      failed_findings_count: { type: 'long' },
+    },
+  },
 };
diff --git a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/types.ts b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/types.ts
index 58e2932c231bb..fcbd6cd9c36e2 100644
--- a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/types.ts
+++ b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/types.ts
@@ -9,6 +9,7 @@ export interface CspmUsage {
   indices: CspmIndicesStats;
   resources_stats: CspmResourcesStats[];
   accounts_stats: CspmAccountsStats[];
+  rules_stats: CspmRulesStats[];
 }
 
 export interface CspmIndicesStats {
@@ -46,3 +47,16 @@ export interface CspmAccountsStats {
   nodes_count: number;
   pods_count: number;
 }
+export interface CspmRulesStats {
+  rule_id: string;
+  rule_name: string;
+  rule_section: string;
+  rule_version: string;
+  rule_number: string;
+  posture_type: string;
+  benchmark_id: string;
+  benchmark_name: string;
+  benchmark_version: string;
+  passed_findings_count: number;
+  failed_findings_count: number;
+}
diff --git a/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json b/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
index d65ae5a95231d..cdff92e13ba43 100644
--- a/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
+++ b/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
@@ -5183,6 +5183,46 @@
               }
             }
           }
+        },
+        "rules_stats": {
+          "type": "array",
+          "items": {
+            "properties": {
+              "rule_id": {
+                "type": "keyword"
+              },
+              "rule_name": {
+                "type": "keyword"
+              },
+              "rule_section": {
+                "type": "keyword"
+              },
+              "rule_version": {
+                "type": "keyword"
+              },
+              "rule_number": {
+                "type": "keyword"
+              },
+              "posture_type": {
+                "type": "keyword"
+              },
+              "benchmark_id": {
+                "type": "keyword"
+              },
+              "benchmark_name": {
+                "type": "keyword"
+              },
+              "benchmark_version": {
+                "type": "keyword"
+              },
+              "passed_findings_count": {
+                "type": "long"
+              },
+              "failed_findings_count": {
+                "type": "long"
+              }
+            }
+          }
         }
       }
     },

From b14af4b24315d2ac3382eef438155e0beacb9a1c Mon Sep 17 00:00:00 2001
From: "Christiane (Tina) Heiligers" <christiane.heiligers@elastic.co>
Date: Tue, 7 Feb 2023 09:28:13 -0700
Subject: [PATCH 079/134] API docs: Add deprecation warning to all deprecated
 Saved Object APIs (#150267)

---
 docs/api/saved-objects.asciidoc                         | 2 +-
 docs/api/saved-objects/bulk_create.asciidoc             | 4 +++-
 docs/api/saved-objects/bulk_delete.asciidoc             | 4 +++-
 docs/api/saved-objects/bulk_get.asciidoc                | 4 +++-
 docs/api/saved-objects/bulk_resolve.asciidoc            | 4 +++-
 docs/api/saved-objects/bulk_update.asciidoc             | 4 +++-
 docs/api/saved-objects/create.asciidoc                  | 4 +++-
 docs/api/saved-objects/delete.asciidoc                  | 4 +++-
 docs/api/saved-objects/find.asciidoc                    | 4 +++-
 docs/api/saved-objects/get.asciidoc                     | 4 +++-
 docs/api/saved-objects/resolve.asciidoc                 | 4 +++-
 docs/api/saved-objects/update.asciidoc                  | 4 +++-
 docs/management/saved-objects/saved-object-ids.asciidoc | 2 ++
 13 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/docs/api/saved-objects.asciidoc b/docs/api/saved-objects.asciidoc
index 8a598fec9c47a..c2f630c91cdb8 100644
--- a/docs/api/saved-objects.asciidoc
+++ b/docs/api/saved-objects.asciidoc
@@ -7,6 +7,7 @@ WARNING: Do not write documents directly to the `.kibana` index. When you write
 to the `.kibana` index, the data becomes corrupted and permanently breaks future {kib} versions.
 
 The following saved objects APIs are available: 
+
 * <<saved-objects-api-export, Export objects API>> to retrieve sets of saved objects that you want to import into {kib}
 
 * <<saved-objects-api-import, Import objects API>> to create sets of {kib} saved objects from a file created by the export API
@@ -43,7 +44,6 @@ include::saved-objects/export.asciidoc[]
 include::saved-objects/import.asciidoc[]
 include::saved-objects/resolve_import_errors.asciidoc[]
 include::saved-objects/rotate_encryption_key.asciidoc[]
-
 include::saved-objects/get.asciidoc[]
 include::saved-objects/bulk_get.asciidoc[]
 include::saved-objects/find.asciidoc[]
diff --git a/docs/api/saved-objects/bulk_create.asciidoc b/docs/api/saved-objects/bulk_create.asciidoc
index dcb402ee1a1dc..9639a70d4387b 100644
--- a/docs/api/saved-objects/bulk_create.asciidoc
+++ b/docs/api/saved-objects/bulk_create.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Bulk create saved objects</titleabbrev>
 ++++
 
-experimental[] Create multiple {kib} saved objects.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Create multiple {kib} saved objects.
 
 [[saved-objects-api-bulk-create-request]]
 ==== Request
diff --git a/docs/api/saved-objects/bulk_delete.asciidoc b/docs/api/saved-objects/bulk_delete.asciidoc
index d08c5874477bc..9a06cb7ea9f9d 100644
--- a/docs/api/saved-objects/bulk_delete.asciidoc
+++ b/docs/api/saved-objects/bulk_delete.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Bulk delete objects</titleabbrev>
 ++++
 
-experimental[] Remove multiple {kib} saved objects.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Remove multiple {kib} saved objects.
 
 WARNING: Once you delete a saved object, _it cannot be recovered_.
 
diff --git a/docs/api/saved-objects/bulk_get.asciidoc b/docs/api/saved-objects/bulk_get.asciidoc
index bec503eb18fe6..78e1a1e60ca25 100644
--- a/docs/api/saved-objects/bulk_get.asciidoc
+++ b/docs/api/saved-objects/bulk_get.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Bulk get objects</titleabbrev>
 ++++
 
-experimental[] Retrieve multiple {kib} saved objects by ID.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Retrieve multiple {kib} saved objects by ID.
 
 [[saved-objects-api-bulk-get-request]]
 ==== Request
diff --git a/docs/api/saved-objects/bulk_resolve.asciidoc b/docs/api/saved-objects/bulk_resolve.asciidoc
index 0779b30a308ea..637e268f49cbf 100644
--- a/docs/api/saved-objects/bulk_resolve.asciidoc
+++ b/docs/api/saved-objects/bulk_resolve.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Bulk resolve objects</titleabbrev>
 ++++
 
-experimental[] Retrieve multiple {kib} saved objects by ID, using any legacy URL aliases if they exist.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Retrieve multiple {kib} saved objects by ID, using any legacy URL aliases if they exist.
 
 Under certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new
 features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that
diff --git a/docs/api/saved-objects/bulk_update.asciidoc b/docs/api/saved-objects/bulk_update.asciidoc
index 28695b55cd298..529f9bbb406aa 100644
--- a/docs/api/saved-objects/bulk_update.asciidoc
+++ b/docs/api/saved-objects/bulk_update.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Bulk update objects</titleabbrev>
 ++++
 
-experimental[] Update the attributes for multiple existing {kib} saved objects.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Update the attributes for multiple existing {kib} saved objects.
 
 [[saved-objects-api-bulk-update-request]]
 ==== Request
diff --git a/docs/api/saved-objects/create.asciidoc b/docs/api/saved-objects/create.asciidoc
index 73339946ea0c0..e955cbf61693c 100644
--- a/docs/api/saved-objects/create.asciidoc
+++ b/docs/api/saved-objects/create.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Create saved objects</titleabbrev>
 ++++
 
-experimental[] Create {kib} saved objects.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Create {kib} saved objects.
 
 [[saved-objects-api-create-request]]
 ==== Request
diff --git a/docs/api/saved-objects/delete.asciidoc b/docs/api/saved-objects/delete.asciidoc
index 6cc31b6563aa3..d0830a8002eb6 100644
--- a/docs/api/saved-objects/delete.asciidoc
+++ b/docs/api/saved-objects/delete.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Delete object</titleabbrev>
 ++++
 
-experimental[] Remove {kib} saved objects.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Remove {kib} saved objects.
 
 WARNING: Once you delete a saved object, _it cannot be recovered_.
 
diff --git a/docs/api/saved-objects/find.asciidoc b/docs/api/saved-objects/find.asciidoc
index 275bd1c21f9ed..12955c807c299 100644
--- a/docs/api/saved-objects/find.asciidoc
+++ b/docs/api/saved-objects/find.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Find objects</titleabbrev>
 ++++
 
-experimental[] Retrieve a paginated set of {kib} saved objects by various conditions.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Retrieve a paginated set of {kib} saved objects by various conditions.
 
 [[saved-objects-api-find-request]]
 ==== Request
diff --git a/docs/api/saved-objects/get.asciidoc b/docs/api/saved-objects/get.asciidoc
index 3f4b6037cd806..7f375994d98de 100644
--- a/docs/api/saved-objects/get.asciidoc
+++ b/docs/api/saved-objects/get.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Get object</titleabbrev>
 ++++
 
-experimental[] Retrieve a single {kib} saved object by ID.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Retrieve a single {kib} saved object by ID.
 
 [[saved-objects-api-get-request]]
 ==== Request
diff --git a/docs/api/saved-objects/resolve.asciidoc b/docs/api/saved-objects/resolve.asciidoc
index 785ae54b4134a..9fec2b1724f77 100644
--- a/docs/api/saved-objects/resolve.asciidoc
+++ b/docs/api/saved-objects/resolve.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Resolve object</titleabbrev>
 ++++
 
-experimental[] Retrieve a single {kib} saved object by ID, using any legacy URL alias if it exists.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Retrieve a single {kib} saved object by ID, using any legacy URL alias if it exists.
 
 Under certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new
 features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that
diff --git a/docs/api/saved-objects/update.asciidoc b/docs/api/saved-objects/update.asciidoc
index 0559c49625fee..bc99e264db122 100644
--- a/docs/api/saved-objects/update.asciidoc
+++ b/docs/api/saved-objects/update.asciidoc
@@ -4,7 +4,9 @@
 <titleabbrev>Update object</titleabbrev>
 ++++
 
-experimental[] Update the attributes for existing {kib} saved objects.
+deprecated::[8.7.0, To be removed in an upcoming version]
+
+Update the attributes for existing {kib} saved objects.
 
 [[saved-objects-api-update-request]]
 ==== Request
diff --git a/docs/management/saved-objects/saved-object-ids.asciidoc b/docs/management/saved-objects/saved-object-ids.asciidoc
index 0f6a2a74c2344..97ab0daa95343 100644
--- a/docs/management/saved-objects/saved-object-ids.asciidoc
+++ b/docs/management/saved-objects/saved-object-ids.asciidoc
@@ -77,6 +77,8 @@ be broken. For more information, refer to {kibana-ref-all}/8.0/release-notes-8.0
 
 If you are using the saved objects APIs directly, you should be aware of these changes:
 
+WARNING: Some of the saved objects APIs are deprecated in 8.7.0. For more information, refer to the <<saved-objects-api, API docs>>
+
 * When using the <<saved-objects-api-create,create>> or <<saved-objects-api-bulk-create,bulk create>> API, you may encounter
   <<saved-objects-api-bulk-create-conflict-errors,conflict errors>> that **cannot** be overridden using the `overwrite: true`
   option. This can occur if there is already a saved object with this ID in a _different_ space, or if there is a legacy URL alias for this

From b1d88ea0df6b3356d13987fe3e60d49dd8bf0042 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yulia=20=C4=8Cech?=
 <6585477+yuliacech@users.noreply.github.com>
Date: Tue, 7 Feb 2023 17:35:55 +0100
Subject: [PATCH 080/134] [Guided onboarding] 8.7 copy updates (#150186)

## Summary
Fix https://github.com/elastic/kibana/issues/149436

This PR updates the copy of onboarding guides for Enterprise Search,
Observability (Kubernetes) and Security (SIEM).

### Screenshots
#### Enterprise Search
<img width="478" alt="Screenshot 2023-02-06 at 12 18 38"
src="https://user-images.githubusercontent.com/6585477/216958616-893eaa98-2d8d-4209-8739-22d70d0fb685.png">


#### Kubernetes
<img width="429" alt="Screenshot 2023-02-07 at 15 36 05"
src="https://user-images.githubusercontent.com/6585477/217282936-fff4943c-3ff5-4d1d-b1dc-24bd98d67dca.png">


#### SIEM
<img width="478" alt="Screenshot 2023-02-06 at 12 18 20"
src="https://user-images.githubusercontent.com/6585477/216958745-29c648f7-70db-434a-a568-e174245526da.png">



### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
---
 .../public/components/guide_panel_step.tsx    |  3 +-
 .../guided_onboarding/search_guide_config.ts  | 50 ++++-----------
 .../kubernetes_guide_config.tsx               | 53 +++++++---------
 .../guided_onboarding/siem_guide_config.ts    | 63 ++++++++++---------
 4 files changed, 72 insertions(+), 97 deletions(-)

diff --git a/src/plugins/guided_onboarding/public/components/guide_panel_step.tsx b/src/plugins/guided_onboarding/public/components/guide_panel_step.tsx
index 447e0453e84dd..1ef7c1f455abb 100644
--- a/src/plugins/guided_onboarding/public/components/guide_panel_step.tsx
+++ b/src/plugins/guided_onboarding/public/components/guide_panel_step.tsx
@@ -42,7 +42,8 @@ const renderDescription = (description: string | StepDescriptionWithLink) => {
   const { descriptionText, linkText, linkUrl, isLinkExternal } = description;
   return (
     <>
-      {descriptionText}{' '}
+      {descriptionText}
+      <br />
       <EuiLink
         data-test-subj="guidePanelStepDescriptionLink"
         href={linkUrl}
diff --git a/x-pack/plugins/enterprise_search/common/guided_onboarding/search_guide_config.ts b/x-pack/plugins/enterprise_search/common/guided_onboarding/search_guide_config.ts
index 162a83e2e98d8..b7926bc01f349 100644
--- a/x-pack/plugins/enterprise_search/common/guided_onboarding/search_guide_config.ts
+++ b/x-pack/plugins/enterprise_search/common/guided_onboarding/search_guide_config.ts
@@ -13,11 +13,10 @@ export const websiteSearchGuideId = 'websiteSearch';
 export const databaseSearchGuideId = 'databaseSearch';
 const guideConfig: Omit<GuideConfig, 'telemetryId'> = {
   title: i18n.translate('xpack.enterpriseSearch.guideConfig.title', {
-    defaultMessage: 'Search my data',
+    defaultMessage: 'Build search experiences with Elasticsearch',
   }),
   description: i18n.translate('xpack.enterpriseSearch.guideConfig.description', {
-    defaultMessage:
-      'Build custom search experiences with your data using Elastic’s out-of-the-box web crawler, connectors, and robust APIs. Gain deep insights from the built-in search analytics to curate results and optimize relevance.',
+    defaultMessage: `We'll help you build a search experience with your data using Elastic's web crawler, connectors, and APIs.`,
   }),
   guideName: 'Enterprise Search',
   steps: [
@@ -26,17 +25,10 @@ const guideConfig: Omit<GuideConfig, 'telemetryId'> = {
       title: i18n.translate('xpack.enterpriseSearch.guideConfig.addDataStep.title', {
         defaultMessage: 'Add data',
       }),
-      descriptionList: [
-        i18n.translate('xpack.enterpriseSearch.guideConfig.addDataStep.description1', {
-          defaultMessage: 'Select an ingestion method.',
-        }),
-        i18n.translate('xpack.enterpriseSearch.guideConfig.addDataStep.description2', {
-          defaultMessage: 'Create a new Elasticsearch index.',
-        }),
-        i18n.translate('xpack.enterpriseSearch.guideConfig.addDataStep.description3', {
-          defaultMessage: 'Configure your ingestion settings.',
-        }),
-      ],
+      description: i18n.translate('xpack.enterpriseSearch.guideConfig.addDataStep.description', {
+        defaultMessage:
+          'Ingest your data, create an index, and enrich your data with customizable ingest and inference pipelines.',
+      }),
       location: {
         appID: 'enterpriseSearchContent',
         path: '/search_indices/new_index',
@@ -47,27 +39,12 @@ const guideConfig: Omit<GuideConfig, 'telemetryId'> = {
       title: i18n.translate('xpack.enterpriseSearch.guideConfig.searchExperienceStep.title', {
         defaultMessage: 'Build a search experience',
       }),
-      descriptionList: [
-        i18n.translate(
-          'xpack.enterpriseSearch.guideConfig.searchExperienceStep.descriptionList.item1',
-          {
-            defaultMessage: 'Learn more about Elastic’s Search UI framework.',
-          }
-        ),
-        i18n.translate(
-          'xpack.enterpriseSearch.guideConfig.searchExperienceStep.descriptionList.item2',
-          {
-            defaultMessage: 'Try the Search UI tutorial for Elasticsearch.',
-          }
-        ),
-        i18n.translate(
-          'xpack.enterpriseSearch.guideConfig.searchExperienceStep.descriptionList.item3',
-          {
-            defaultMessage:
-              'Build a world-class search experience for your customers, employees, or users.',
-          }
-        ),
-      ],
+      description: i18n.translate(
+        'xpack.enterpriseSearch.guideConfig.searchExperienceStep.description',
+        {
+          defaultMessage: `Learn more about Elastic's Search UI, try our Search UI tutorial for Elasticsearch, and build a search experience.`,
+        }
+      ),
       location: {
         appID: 'searchExperiences',
         path: '',
@@ -82,8 +59,7 @@ const guideConfig: Omit<GuideConfig, 'telemetryId'> = {
         description: i18n.translate(
           'xpack.enterpriseSearch.guideConfig.searchExperienceStep.manualCompletionPopoverDescription',
           {
-            defaultMessage:
-              'Take your time to explore how to use Search UI to build world-class search experiences. When you’re ready, click the Setup guide button to continue.',
+            defaultMessage: `Take your time to explore how to use Search UI to build world-class search experiences. When you're ready, click the Setup guide button to continue.`,
           }
         ),
         readyToCompleteOnNavigation: true,
diff --git a/x-pack/plugins/observability/common/guided_onboarding/kubernetes_guide_config.tsx b/x-pack/plugins/observability/common/guided_onboarding/kubernetes_guide_config.tsx
index 239a5fcb36ed9..b5894732d6b2a 100644
--- a/x-pack/plugins/observability/common/guided_onboarding/kubernetes_guide_config.tsx
+++ b/x-pack/plugins/observability/common/guided_onboarding/kubernetes_guide_config.tsx
@@ -11,10 +11,10 @@ import { i18n } from '@kbn/i18n';
 export const kubernetesGuideId = 'kubernetes';
 export const kubernetesGuideConfig: GuideConfig = {
   title: i18n.translate('xpack.observability.guideConfig.title', {
-    defaultMessage: 'Observe my Kubernetes infrastructure',
+    defaultMessage: 'Monitor my Kubernetes clusters',
   }),
   description: i18n.translate('xpack.observability.guideConfig.description', {
-    defaultMessage: `We'll help you quickly get visibility into your Kubernetes environment with our Elastic integration. Gain deep insights from your logs, metrics, and traces to proactively detect issues and take action to resolve them.`,
+    defaultMessage: `We'll help you connect Elastic and Kubernetes to start collecting and analyzing logs and metrics.`,
   }),
   guideName: 'Kubernetes',
   telemetryId: 'kubernetes',
@@ -28,30 +28,26 @@ export const kubernetesGuideConfig: GuideConfig = {
     {
       id: 'add_data',
       title: i18n.translate('xpack.observability.guideConfig.addDataStep.title', {
-        defaultMessage: 'Add and verify your data',
+        defaultMessage: 'Add data',
       }),
       integration: 'kubernetes',
-      descriptionList: [
-        {
-          descriptionText: i18n.translate(
-            'xpack.observability.guideConfig.addDataStep.descriptionList.item1.descriptionText',
-            {
-              defaultMessage: 'Deploy kube-state-metrics service to your Kubernetes.',
-            }
-          ),
-          linkText: i18n.translate(
-            'xpack.observability.guideConfig.addDataStep.descriptionList.item1.linkText',
-            {
-              defaultMessage: 'Learn more',
-            }
-          ),
-          linkUrl: 'https://github.com/kubernetes/kube-state-metrics',
-          isLinkExternal: true,
-        },
-        i18n.translate('xpack.observability.guideConfig.addDataStep.descriptionList.item2', {
-          defaultMessage: 'Add the Elastic Kubernetes integration.',
-        }),
-      ],
+      description: {
+        descriptionText: i18n.translate(
+          'xpack.observability.guideConfig.addDataStep.description.descriptionText',
+          {
+            defaultMessage:
+              'To get your Kubernetes data flowing, install Elastic Agent in the Kubernetes cluster you want to monitor. Once Elastic Agent is deployed, you can optionally add kube-state-metrics for a more comprehensive metrics coverage.',
+          }
+        ),
+        linkText: i18n.translate(
+          'xpack.observability.guideConfig.addDataStep.descriptionList.item1.linkText',
+          {
+            defaultMessage: 'Learn more',
+          }
+        ),
+        linkUrl: 'https://github.com/kubernetes/kube-state-metrics',
+        isLinkExternal: true,
+      },
       location: {
         appID: 'integrations',
         path: '/detail/kubernetes/overview',
@@ -60,10 +56,10 @@ export const kubernetesGuideConfig: GuideConfig = {
     {
       id: 'view_dashboard',
       title: i18n.translate('xpack.observability.guideConfig.viewDashboardStep.title', {
-        defaultMessage: 'Explore Kubernetes metrics',
+        defaultMessage: 'Explore Kubernetes metrics and logs',
       }),
       description: i18n.translate('xpack.observability.guideConfig.viewDashboardStep.description', {
-        defaultMessage: 'Stream, visualize, and analyze your Kubernetes infrastructure metrics.',
+        defaultMessage: 'Visualize and analyze your Kubernetes environment.',
       }),
       location: {
         appID: 'dashboards',
@@ -79,7 +75,7 @@ export const kubernetesGuideConfig: GuideConfig = {
         description: i18n.translate(
           'xpack.observability.guideConfig.viewDashboardStep.manualCompletionPopoverDescription',
           {
-            defaultMessage: `Take your time to explore these pre-built dashboards included with the Kubernetes integration. When you’re ready, click the Setup guide button to continue.`,
+            defaultMessage: `Take your time to explore these pre-built dashboards included with the Kubernetes integration. When you're ready, click the Setup guide button to continue.`,
           }
         ),
         readyToCompleteOnNavigation: true,
@@ -93,8 +89,7 @@ export const kubernetesGuideConfig: GuideConfig = {
       description: i18n.translate(
         'xpack.observability.guideConfig.tourObservabilityStep.description',
         {
-          defaultMessage:
-            'Get familiar with the rest of Elastic Observability and explore even more integrations.',
+          defaultMessage: 'Get familiar with the rest of Elastic Observability.',
         }
       ),
       location: {
diff --git a/x-pack/plugins/security_solution/common/guided_onboarding/siem_guide_config.ts b/x-pack/plugins/security_solution/common/guided_onboarding/siem_guide_config.ts
index 6d47988af1d92..707595d0bd8f8 100644
--- a/x-pack/plugins/security_solution/common/guided_onboarding/siem_guide_config.ts
+++ b/x-pack/plugins/security_solution/common/guided_onboarding/siem_guide_config.ts
@@ -11,7 +11,7 @@ import { i18n } from '@kbn/i18n';
 export const siemGuideId = 'siem';
 export const siemGuideConfig: GuideConfig = {
   title: i18n.translate('xpack.securitySolution.guideConfig.title', {
-    defaultMessage: 'Elastic Security guided setup',
+    defaultMessage: 'Detect threats in my data with SIEM',
   }),
   guideName: 'Security',
   telemetryId: 'siem',
@@ -20,22 +20,37 @@ export const siemGuideConfig: GuideConfig = {
     path: '/dashboards',
   },
   description: i18n.translate('xpack.securitySolution.guideConfig.description', {
-    defaultMessage: `We'll help you get set up quickly, using Elastic Defend.`,
+    defaultMessage: `There are many ways to get your SIEM data into Elastic. In this guide, we'll help you get set up quickly using the Elastic Defend integration.`,
   }),
+  docs: {
+    text: i18n.translate('xpack.securitySolution.guideConfig.documentationLink', {
+      defaultMessage: 'Learn more',
+    }),
+    url: 'https://www.elastic.co/guide/en/security/current/ingest-data.html',
+  },
   steps: [
     {
       id: 'add_data',
       title: i18n.translate('xpack.securitySolution.guideConfig.addDataStep.title', {
         defaultMessage: 'Add data with Elastic Defend',
       }),
-      descriptionList: [
-        i18n.translate('xpack.securitySolution.guideConfig.addDataStep.description1', {
-          defaultMessage: 'Use Elastic Defend to add your data.',
-        }),
-        i18n.translate('xpack.securitySolution.guideConfig.addDataStep.description2', {
-          defaultMessage: 'See data coming in to your SIEM.',
-        }),
-      ],
+      description: {
+        descriptionText: i18n.translate(
+          'xpack.securitySolution.guideConfig.addDataStep.description',
+          {
+            defaultMessage:
+              'Install Elastic Agent and its Elastic Defend integration on one of your computers to get SIEM data flowing.',
+          }
+        ),
+        linkUrl: 'https://docs.elastic.co/en/integrations/endpoint',
+        isLinkExternal: true,
+        linkText: i18n.translate(
+          'xpack.securitySolution.guideConfig.addDataStep.description.linkText',
+          {
+            defaultMessage: 'Learn more',
+          }
+        ),
+      },
       integration: 'endpoint',
       location: {
         appID: 'integrations',
@@ -47,17 +62,10 @@ export const siemGuideConfig: GuideConfig = {
       title: i18n.translate('xpack.securitySolution.guideConfig.rulesStep.title', {
         defaultMessage: 'Turn on rules',
       }),
-      descriptionList: [
-        i18n.translate('xpack.securitySolution.guideConfig.rulesStep.description1', {
-          defaultMessage: 'Load the Elastic prebuilt rules.',
-        }),
-        i18n.translate('xpack.securitySolution.guideConfig.rulesStep.description2', {
-          defaultMessage: 'Select and enable rules.',
-        }),
-        i18n.translate('xpack.securitySolution.guideConfig.rulesStep.description3', {
-          defaultMessage: 'Enable rules to generate alerts.',
-        }),
-      ],
+      description: i18n.translate('xpack.securitySolution.guideConfig.rulesStep.description', {
+        defaultMessage:
+          'Load the Elastic prebuilt rules, select the rules you want, and enable them to generate alerts.',
+      }),
       manualCompletion: {
         title: i18n.translate(
           'xpack.securitySolution.guideConfig.rulesStep.manualCompletion.title',
@@ -68,7 +76,7 @@ export const siemGuideConfig: GuideConfig = {
         description: i18n.translate(
           'xpack.securitySolution.guideConfig.rulesStep.manualCompletion.description',
           {
-            defaultMessage: 'After you’ve enabled the rules you need, continue.',
+            defaultMessage: `After you've enabled the rules you need, continue.`,
           }
         ),
       },
@@ -82,14 +90,9 @@ export const siemGuideConfig: GuideConfig = {
       title: i18n.translate('xpack.securitySolution.guideConfig.alertsStep.title', {
         defaultMessage: 'Manage alerts and cases',
       }),
-      descriptionList: [
-        i18n.translate('xpack.securitySolution.guideConfig.alertsStep.description1', {
-          defaultMessage: 'View and triage alerts.',
-        }),
-        i18n.translate('xpack.securitySolution.guideConfig.alertsStep.description2', {
-          defaultMessage: 'Create a case.',
-        }),
-      ],
+      description: i18n.translate('xpack.securitySolution.guideConfig.alertsStep.description', {
+        defaultMessage: 'Learn how to view and triage alerts with cases.',
+      }),
       location: {
         appID: 'securitySolutionUI',
         path: '/alerts',

From 6f908219060ceac5415421061642d90cadf76cd5 Mon Sep 17 00:00:00 2001
From: Lisa Cawley <lcawley@elastic.co>
Date: Tue, 7 Feb 2023 08:42:09 -0800
Subject: [PATCH 081/134] [DOCS] Improve index connector, automate screenshots
 (#150126)

---
 .../connectors/action-types/index.asciidoc    | 194 ++++++++----------
 .../action-types/server-log.asciidoc          |  28 ++-
 .../connectors/images/index-connector.png     | Bin 157290 -> 143315 bytes
 .../connectors/images/index-params-test.png   | Bin 70194 -> 153671 bytes
 docs/management/connectors/index.asciidoc     |   2 +-
 .../stack_alerting/connector_types.ts         |  44 +++-
 6 files changed, 136 insertions(+), 132 deletions(-)

diff --git a/docs/management/connectors/action-types/index.asciidoc b/docs/management/connectors/action-types/index.asciidoc
index 87751a10328b7..0cc306765f077 100644
--- a/docs/management/connectors/action-types/index.asciidoc
+++ b/docs/management/connectors/action-types/index.asciidoc
@@ -1,104 +1,107 @@
-[role="xpack"]
 [[index-action-type]]
-=== Index connector and action
+== Index connector and action
 ++++
 <titleabbrev>Index</titleabbrev>
 ++++
 
-The index connector will index a document into {es}. See also the 
-{ref}/indices-create-index.html[create index API].
+An index connector indexes a document into {es}.
+
+You can create index connectors in {kib} or by using the
+<<create-connector-api,create connector API>>. Alternatively, you can use the <<preconfigured-connector-alert-history,preconfigured alert history {es} index connector>>.
+If you are running {kib} on-prem, you can also create more preconfigured index
+connectors.
 
 [float]
 [[index-connector-configuration]]
-==== Connector configuration
-
-Index connectors have the following configuration properties.
-
-Name::
-The name of the connector. The name is used to identify a connector in the 
-management UI connector listing, or in the connector list when configuring an 
-action.
+=== Connector configuration
 
-Index::
-The {es} index to be written to.
+Index connectors must have a name and an {es} index. You can optionally set the
+{ref}/docs-refresh.html[refresh] policy and the time field, which contains the
+details about when each alert condition was detected.
 
-Refresh::
-Setting for the {ref}/docs-refresh.html[refresh] policy for the write request.
+[float]
+[[define-index-ui]]
+=== Create connectors in {kib}
 
-Execution time field:: 
-This field will be automatically set to the time the alert condition was 
-detected.
+You can create connectors in *{stack-manage-app} > {connectors-ui}*
+or as needed when you're creating a rule. For example:
 
+[role="screenshot"]
+image::management/connectors/images/index-connector.png[Index connector]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
 [float]
-[[Preconfigured-index-configuration]]
-==== Preconfigured connector type
+[[preconfigured-index-configuration]]
+=== Create preconfigured connectors
+
+If you are running {kib} on-prem, you can define connectors by
+adding `xpack.actions.preconfigured` settings to your `kibana.yml` file.
+For example:
 
 [source,text]
 --
- my-index:
-   name: preconfigured-index-connector-type
-   actionTypeId: .index
-   config:
-     index: .kibana
-     refresh: true
-     executionTimeField: somedate
+xpack.actions.preconfigured:
+  my-index:
+    name: preconfigured-index-connector-type
+    actionTypeId: .index
+    config:
+      index: .kibana
+      refresh: true <1>
+      executionTimeField: my-field
 --
+<1> By default, the {ref}/docs-refresh.html[refresh] policy is `false`.
 
-Config defines information for the connector type.
+For more information, go to <<pre-configured-connectors>>.
 
-`index`::
-A string that corresponds to *Index*.
-
-`refresh`::
-A boolean that corresponds to *Refresh*. Defaults to `false`.
+[float]
+[[preconfigured-connector-alert-history]]
+==== Preconfigured alert history {es} index connector
 
-`executionTimeField`::
-A string that corresponds to *Execution time field*.
+preview::[]
 
+{kib} offers a preconfigured index connector to facilitate indexing active alert
+data into {es}.
 
-[float]
-[[define-index-ui]]
-==== Define connector in {stack-manage-app}
+To use this connector, set
+<<action-settings,`xpack.actions.preconfiguredAlertHistoryEsIndex`>> to `true`.
 
-Define Index connector properties.
+When you subsequently create rules, you can use the
+`Alert history Elasticsearch index (preconfigured)` connector.
 
 [role="screenshot"]
-image::management/connectors/images/index-connector.png[Index connector]
-
-Test Index action parameters.
+image::images/pre-configured-alert-history-connector.png[Select pre-configured alert history connectors]
 
-[role="screenshot"]
-image::management/connectors/images/index-params-test.png[Index params test]
+Documents are indexed using a preconfigured schema that captures the 
+<<defining-rules-actions-variables,action variables>> available for the rule. 
+By default, these documents are indexed into the `kibana-alert-history-default` 
+index, but you can specify a different index. Index names must start with 
+`kibana-alert-history-` to take advantage of the preconfigured alert history 
+index template.
 
+[IMPORTANT]
+====
+* To write documents to the preconfigured index, you must have `all` or `write` 
+privileges to the `kibana-alert-history-*` indices. Refer to 
+<<kibana-role-management>> for more information.
+* The `kibana-alert-history-*` indices are not configured to use ILM so they must 
+be maintained manually. If the index size grows large, consider using the 
+{ref}/docs-delete-by-query.html[delete by query] API to clean up older documents 
+in the index.
+====
 
 [float]
 [[index-action-configuration]]
-==== Action configuration
-
-Index actions have the following properties.
+=== Test connectors
 
-Document::
-The document to index in JSON format.
+You can test connectors with the <<execute-connector-api,run connector API>> or
+as you're creating or editing the connector in {kib}. For example:
 
+[role="screenshot"]
+image::management/connectors/images/index-params-test.png[Index params test]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
-[float]
-[[index-action-example]]
-==== Example
-
-Example of the index document for Index Threshold rule:
-
-[source,text]
---------------------------------------------------
-{
-    "rule_id": "{{rule.id}}",
-    "rule_name": "{{rule.name}}",
-    "alert_id": "{{alert.id}}",
-    "context_message": "{{context.message}}"
-}
---------------------------------------------------
-
-Example of creating a test index using the API.
+Index connector actions contain a document in JSON format. For example, if you
+have an index with the following properties:
 
 [source,text]
 --------------------------------------------------
@@ -118,51 +121,14 @@ PUT test
 }
 --------------------------------------------------
 
+Your test document could contain the following properties and variables:
 
-[float]
-[[preconfigured-connector-alert-history]]
-=== Alert history {es} index connector
-
-experimental[] {kib} offers a preconfigured index connector to facilitate indexing active alert data into {es}.
-
-[WARNING]
-==================================================
-This functionality is in technical preview and may be changed or removed 
-completely in a future release.
-==================================================
-
-To use this connector, set the 
-<<action-settings, `xpack.actions.preconfiguredAlertHistoryEsIndex`>> 
-configuration to `true`.
-
-```js
-  xpack.actions.preconfiguredAlertHistoryEsIndex: true
-```
-
-When creating a new rule, add an <<index-action-type, Index action>> and select 
-the `Alert history Elasticsearch index (preconfigured)` connector.
-
-[role="screenshot"]
-image::images/pre-configured-alert-history-connector.png[Select pre-configured alert history connectors]
-
-Documents are indexed using a preconfigured schema that captures the 
-<<defining-rules-actions-variables, action variables>> available for the rule. 
-By default, these documents are indexed into the `kibana-alert-history-default` 
-index, but you can specify a different index. Index names must start with 
-`kibana-alert-history-` to take advantage of the preconfigured alert history 
-index template.
-
-[IMPORTANT]
-==============================================
-To write documents to the preconfigured index, you must have `all` or `write` 
-privileges to the `kibana-alert-history-*` indices. Refer to 
-<<kibana-role-management>> for more information.
-==============================================
-
-[NOTE]
-==================================================
-The `kibana-alert-history-*` indices are not configured to use ILM so they must 
-be maintained manually. If the index size grows large, consider using the 
-{ref}/docs-delete-by-query.html[delete by query] API to clean up older documents 
-in the index.
-==================================================
+[source,text]
+--------------------------------------------------
+{
+    "rule_id": "{{rule.id}}",
+    "rule_name": "{{rule.name}}",
+    "alert_id": "{{alert.id}}",
+    "context_message": "{{context.message}}"
+}
+--------------------------------------------------
diff --git a/docs/management/connectors/action-types/server-log.asciidoc b/docs/management/connectors/action-types/server-log.asciidoc
index dca6eee379b52..a7568acfdf3db 100644
--- a/docs/management/connectors/action-types/server-log.asciidoc
+++ b/docs/management/connectors/action-types/server-log.asciidoc
@@ -6,9 +6,9 @@
 
 A server log connector writes an entry to the {kib} server log.
 
-You can create a server log connector in {kib} or by using the
+You can create a server log connectors in {kib} or by using the
 <<create-connector-api,create connector API>>. If you are running {kib}
-on-prem, you can also create a preconfigured server log connector.
+on-prem, you can also create preconfigured server log connectors.
 
 [float]
 [[server-log-connector-configuration]]
@@ -18,9 +18,9 @@ Server log connectors do not have any configuration properties other than a name
 
 [float]
 [[define-serverlog-ui]]
-=== Create a connector in {kib}
+=== Create connectors in {kib}
 
-You can create a server log connector in *{stack-manage-app} > {connectors-ui}*
+You can create connectors in *{stack-manage-app} > {connectors-ui}*
 or as needed when you're creating a rule. For example:
 
 [role="screenshot"]
@@ -29,11 +29,10 @@ image::management/connectors/images/serverlog-connector.png[Server log connector
 
 [float]
 [[preconfigured-server-log-configuration]]
-=== Create a preconfigured connector
+=== Create preconfigured connectors
 
-If you are running {kib} on-prem, you can define a server log connector by
-adding `xpack.actions.preconfigured` settings to your `kibana.yml` file.
-For example:
+If you are running {kib} on-prem, you can define connectors by adding
+`xpack.actions.preconfigured` settings to your `kibana.yml` file. For example:
 
 [source,text]
 --
@@ -47,18 +46,15 @@ For more information, go to <<pre-configured-connectors>>.
 
 [float]
 [[server-log-action-configuration]]
-=== Test the connector
+=== Test connectors
 
-You can test your server log connector with the
-<<execute-connector-api,run connector API>> or as you're creating or editing
-the connector in {kib}. For example:
+You can test connectors with the <<execute-connector-api,run connector API>> or
+as you're creating or editing the connector in {kib}. For example:
 
 [role="screenshot"]
 image::management/connectors/images/serverlog-params-test.png[Server log connector test]
 // NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
-Server log actions have the following properties:
-
-Message::   The message to log.
-Level::     The log level of the message: `trace`, `debug`, `info`, `warn`, `error` or `fatal`. Defaults to `info`.
+Server log connector actions contain a message and a log level, which defaults to `info`. Valid log level values are `trace`, `debug`, `info`, `warn`, `error`,
+and `fatal`.
 
diff --git a/docs/management/connectors/images/index-connector.png b/docs/management/connectors/images/index-connector.png
index b3a81a7c0e7618697415b64017de941b3906884d..438aac772c409b0f265dd9374aa428e7c116f26e 100644
GIT binary patch
literal 143315
zcma%jXH=6-*RE1UK~O{lrC0!^D!oX1EPzz$9h4G!4+tSd#7YsQN)6IWAV8?0i_#&|
zJ5lKb5~+cNBqx5~`}{d)@p68^%E~>-%<S2-XJ6O8CLav+G+54ZpFMTz6pNPTL&H<2
z7%fkoqH8$AKz#?u%++%0)M*#j2M-Li9z5VT@bh+d^>8|M>h>q#r%G*_r`Nh#dH*pM
zHyj%FkybEYw@7;!VW~CDZ)xwj5^VixdZFpPa}XtVnkMB;-q0iNR|PIn(-&Wv5?c@k
zQDLg{L@<^Z)`W`<dU<j5P0@=EwVLJ0L!BpLyw^(D;RZj$`A)wM$Q6%om=(XG3cRnv
zH`VvTJU++?hxEpk6`%$&_>?H!O>c_1PVxY<eR{!<`I*woLY=`(rGNaQ?z{Wn_S2}6
z`6<+se;PlV)f~!g(6p%L`nv2wx#?iEx1B;I3bx5<9%X&5`)8u-7aI2KmwaA1tmfUV
zjceo1foUxZo6&J6(LFypdo$+J@7aaPf~ro$8Ce_WF4ZiNazNTg8qSI}r(b8z8_$b>
z_B+d=RMg%k`N}ayk2`0ZaukODGX8==cA6AM2`qA&X#+BUMsm4@1KV)4iZ)+nkRm;t
zhW(fR-0Qjrf0@c@k5mWR@<LAkd1%KdHlkKSHNCu(xt6o8?kQpF>occLzjHlBM}2jg
z`o~TEJ9UaCo95ql7%j7D|9wr@@b@7EV*TgTDYa8t57mudoZgtDujhDlwQVaUKJIc}
zBS)gaKLUAlbad=&21kjqZC-3TPoDmBn#1^^aqlU5CV@wm57)%+<R=|0+srzl8UXsU
zATP>F@Slyr{=t57Ac~Z=0z&oYDR{@nv8kOpP50mbeZ8!CHBeXh#>-PQXZZi?KXV#7
z%is(D{oANd!_Uy4seXLsG4O<r+0<UDiQrD`m7nd)sqpbL?L{9?Y|7@c#B=h5Z(QR4
z!F~P8*o70D(v&sPo?sLHmuj!6X1Ph1t9X+6_|>wLf=*lxw)X}v)!bj(8*7}{^i1{k
z`TxFRf1h4B%jOcp7QKGrL{5d9&Y$EgY-;@foTe$e@aiegiB0)`^eX*VfBK)XKfJA$
zE%VRalA9+qRr`H*c8(n8ivD$4A!OGa#+WnVc6APkk2JYTXX)_0^U+E3i~CH2k@Kj2
zl~>7ByDr0RKPEc}jh(Zh8YlCr+4YlpzrhrJZL1*hj!o~`M7K8Sc>7YN?h;St7rAyY
z>?<{Q*kt{glMHfEo8PJyb}`+)6cT4L^P~28!kOyM$1(0FZ7BYy^fy>)A4_$Y$mwOv
zJmpi(JkeGj^k1o;ppI}s;0O0iVJGlJ<E+wrc~!P`!Er2I&woDeVJnE?1dC8N<2Q9R
z+7g>a<r`OJz2d8!p7g!{^#C@G1mXm!hE9~s*R~)cI|KDiDPJzQ>~a3Oc9MbO^It+L
zOuTQXyn;=Ohnt%4pSUWKY(9)udv9};6UH7tk2SS=rGHY)(Y!$8I-KW=?Er5$KK@1B
zX_wesX-*p0MLRVB0*QAVn}Q(&DwbU>q}jvAUEGE*pS0y~MZSc@0T<uPJ)(R!t4LCF
z&$;ic_~?X<9qz(Jcecv8FWF?*E|lJisroTyZRq@oUDdxdiyPzB{GU%ue+@k;o~u<|
zJj3Bw<1MK2s*KLk(?;c_aL7M(=Ji$T2X0Tdo6?lkib7BHDN(u`ELGET90T_5X*+^b
zEIS`gjNrF`;f*tBiN6j-^`D;Z3*M0o1~;|1i#De>FO<f(nTY&#vKtMvC4JH3?|bS`
zFy(2wi&p%#>ZUw(AZK@v!hFeGnM(92!bzbu+)=14dfXA;edX?nX0N3lPT#_4c4JSP
zTaO;q+p0j0%vVlyH!Et(=c=dwf5sW7G8Oar^t(%w)vk#C11$07UT>nfSj<&9X7glg
z$#=0Y%m$&Vd_MI-b?zbx{>x{~9}Au^rJ;+O4m76WH%*7u!vil`+mEi|^Yzi>)5J2%
z{HjnHPs6sV#dwP%O)b<H@dMY7mn3Za5g9Zm?7N)nRD-(Q9%lI4`ODb0p<In6yy`e{
zaY~5(++xZ<Z_Z8?{uh^x6Q!mUf_+_`*;FqL&lAg5A2%(-ossW;{wS*ZEBy{l@~7i{
zOU>_sX1X;)ul)abxZ&Hjtpy>&&KMugV;#8IlDYsTVMnv~Pq5XQZ;z=hJx1#pPFhpL
z8mgZdlMWh!Pp}l*`xrICr1dwMJKFXOow||>jX2tQ;~4I-rD^vP1*dbIV#(BX?D@!}
z<Tz12=Qrh)(vxIn8dv4i*IP4Tn(&JLtUU0hf_&)Wd!0-|(yDo_$J7nvJBRO)W>4~;
zaFjvJjBoR4`9B*|4m+yv&p3?mn61_d#Lf!L)Zya%R|d7nM~8WupS~I*16&)5eQ)-p
zN@@Jq58Rl%V^j!UvRG-+!)qpsTHNp3YYEzz<*GP(i-9NfCc)2}UryI)ZlyoR*|R?8
z4qGY2ga7<g@5xk3S?o*EKYLk}zs4QSKUQM;soK?nq7<DVq~8nUTkd|#a@7fsoinxT
z`p6?ydzkO@>mS1+1NCAD!X2wxoyod;<Pp^3k1r2SWAGb813jvt2NgP5lDgw?H2+Mk
zCnt|~s$~9Bq=>L)gP&9W<2`o)8)SeUNsUqKm(rJoX+#iw@8i0XGh{{5sn>=1oE7Q`
zItB@J>k~+^zPKv;b#Mn_OR)LT)D*m9j(fEA`+MHA2!dgWaZk3Vxa|?*sLCVNL<21b
z4`^%h$1z|1Wn>Na;=w5461aXYqEuPC`z=(>QGs}@a&nZZh+*D)CqtO|Q`gy|@Wq}4
zp|-Jmh+UPgCd#vZngpZb=Z}i5>S|2_f3}@ITwTz28c35__WrKdlck)Vc>Ad}154<f
z@QUj3KB><?5S(C$_AJ~`;*}wQ*GB3fZRxQ8-IMY9Q@d;E9#W<RL&@wL)P2(H-PQTA
zv;BKvyIK}_A`bieN*BCkSYNT)TZnr6eRz8L_QL8=?sn(P_H8nw11*PAu;<L|9g=Ox
zQ%S&}=$ptFjG)U$(i+mYFNwOcX%R=-G8wEM<d2tG_I9xDRlfp;ue;sFA+N5}3s-G>
zbf|I2dQOW1*JYTE9haK72qJz#jj~xwzb>zW!z9CAg&zEppK`{k8uvQTtlA*&^Rv#P
zwIm(8*-DT`<?S*xq=N+gj;gWj6=i%tT(X$g`NP3k^VUk3T=<Nd>%_+azvX@|j19MJ
zsAIOU-aN3zt^21sEzBO7uoe{e8O_AgJ8YNSvpU4rJ%J9z$W?tVOtB3q4%qmi7qY*~
zyRC7WY=+q(_-x2?;fD??vdrFWFD-rO0%<RFhNGw2AI!(AN1(THg0P)%?<Qf-nfWD)
zps8&RN#}mXWepZP(6}$>D!w-1@KXfYh2MPm)cTl72_wv~>LJtNS{EOTFFXKu=+mZ1
zz<xS5kuxk*+bD$P>%onKCsaw&c4_mW+THx6zweX!cZOR!nxD~o2I8h}mU%aeI8swX
zQoz@Tu0z|hLsOByT8NeYq_;8Y9~g2wn5x|D6qTy7n6|;PTTw4<Fw96sP#~*$L8><k
zkD$iKBaRB|h<;nG2+N?k;6^jw$wRAJucT!$OKo(D?Rk;z5*AE!M~YprZklZ4_cShU
zJ%Hj!Ls*C4HWrlIQERikW4JcIaD8o@)LsE+l1?@%)YF>qQWh|dGlARGyL=dJD*xzm
zSElw(OA9-pG3ARlYr@|kO#R-43H*z1-A{)ro*G%SJa?L`llGq1AKw{v?;we<vWh8^
z;0PzugdODFoSC(7$%nx(&)`1KXN(p#s-*dK8G_!oCH%wnMGnW9KCrLYaUoZ2o0I=X
z+7a|w(|mh4E#ne|l`d;@eQe8`{qq&sBOCa05xbPLUenc1=IvIE*IBlkMsXZO>EEa!
zXIblaAMtN^jJI*w_+0(&m*L^Gxys0(3z_uXw_VxXM_2FNi!_B<b4Y(4Z?)sof~tU{
zF*kb5s}=zb#aic3so7tq4R@5V9ssejYp`;L@|mEGOYSr97V`L62Haeugt=Un6SruF
z%FRF96SkbnvzU8BPA)ffxAroBa5Yf#<J<7od$)(LTkHW-e_a;yu1VfMKlXA^(QAU7
zC9e!8@~z$|)TgkQl*%W~2*O)r`Nub#w%4zk^4rZsN@psA9%q4C^z%}l@*Q`^@F$&N
zbI}!GRjjQ$oG-dpdA74jW|wEmW8ZS`iA3sDlA^ohu=LiB#Leb!C2){N%VeP)tQ=^!
zyKIGfKj^cgKUL+F0LTg+R-I9p!0h8FBMK7{X8qAm;iEahQpFZhfBXt;Ck|FH^QD=M
zyYI(#{Oj^j#h#5H{nkfagKGU@#QhL4lTG8Z3u-C!*fFB7J9PGL3DKBK-sL?iSYC+x
z6oeEL{>yl;nB5Nj;n&T17VZ~#u7`06;?B-+2Ak&iFwQK<7x-U)Rg^lITCqLT80I0|
zBIV&|tRo%AH|PPN+*_BNX(xX?oLD&)MDPQds7A0sDXHTEyW{F;_v`F`-T2_yCT$;a
zU6Mj37VU=q`NUT9Fre6WPRbbH#GK5#I;{NjVrLzC+)~)2X?VvlC|e_CYD_K3ECf4M
z*c|zF5VBniaNy`aKN`-EE~uY%F;_F?A=cUX+1rFB=OZMXG$d+7`ZXClYq1pq(>C;;
zt-oVS^pV5vWtumK=$cDez?%!wj9Uo8K?(Oh%Dg=K(-GU*JrV8GdhWEu`8Y0UnBu~W
zJ3|BLHUZ4CmpMj2>flREO6OAiqL0lb)iUU)pz(tQ&}O!>V{Uu@N4w;o7_<C|n_nW_
z`;x`Zo!MP0gwpp10aT`m7Y+%fJyjlSH&XA0Wk|O+q&CXuIM@ivOft8g-<;_|)|5Jq
z_j@}Hr$Br7Fs6M!)xBRZcuU90Y?gXIkG@VlN4E{_a9m-?fGujWv9vLTaHfn*I9PiF
zR+~A+t-DoX##VB^YyTsjKhtc*nJNb;*qE$+I$myZ9i_^7zn-|S)Zx%CYcgXml^|13
zn0g)SH1ZZ$<+fya=(P4v0|k=#YCd7G)_7quFJ9n@CMAW?ogEIh!mUx``)d#9O>fLU
z<69+cWw?i}<o1+rSp0BQ6&S;iDtYLCxQw||<x8?$n=eC5R6K<AXZNWP3-93|S9Tk-
z_ZV4T3=rlwXIr$wY>yJEJ^c$IQYtG*A$Vp8KE!-iktF9d{7^}$v#^CTP??DEoM{YQ
z-#b^SQ_qkIK&4%8rPTHk<bw9`<E#Rq+*?X(l<m?mg-@BXMUdRxjUnBvU;@)xfVaj_
zE6=UtQn~O^5w<!Oej~V5N#l;IQEQ@`N$J5X-qV?(5KCF(xHRG<2W0Jv=92I&R|2jl
zQWKg11=fJO&ZC;t!@1HZQ5B-nKqg@F)LM_6;UoCWBcJosEM9_LC=6?15|P#nQeHI5
z64d2xzzojhJN8^0F4^NzaoYdD5QSTtoL2#=l%{i4A~)dTCfv81565SgZQbaZU%7%=
z)PS3QkZkRnz3KOZ-F^_b-+TB^d<XTVO1)ddpT1)Y`#hCU=icVN7mS^4(2l$;_B^R{
zlhf{n#1agj6OJ*=f1<d_(G9gDG#zBP7)<kI`wJfh-E|-LXjn?VOrBClc{kS7G;I<3
z;_ny<7S3lbE41tr)P|gbn}?IdtePWVEo)$uD%~f_vk~d4P<h+(Qj-yYXsQ$-82}A_
zLOtg1AQ@e=rCo=OjS8EL@=%x^RIAS*i8a7<m9qd|T3)hvi9^^}lOe6meH><?+zL`u
zn#tTHItUO)Y*rNm*BiDs9)MBFM@^$DF<Zq_sIC|uhnPNbQKN$DP-!gKozEHW4!qnD
zf&o8@4=5n;?<_=#z>C;=oJNnu<eI-|`dxH?vC4DT;lJ*nzMZLZYZQp&WL1nX!febo
z7^!CD5rY}D6}9_$9BVKIy6NL-z7`v;{LoCkb^m+|VPo3Y;ql@eM?WIwXgMr`6&<kH
zKu?-v_#v=tWj==c)Xo!j6{0n7Xi=S6<x;AE_GQ$z&spiu%1-NMStgj#mUf};_41<q
zJ#QFha9d%%e(kqpW1kspw|Xp!H>|!;KW@xRlh#B3KDlTm`dJzNdrHE_`ZKVbK^>%3
zMMd4T*?<<wt;4!M?=fAi08^Pw$~nyZbGFwVf(Nc&x!JwWtFgjJ7E+9oGf0ykk}E3F
z-U<P8?uL-W>my)TS!l@iJ=97*;yY05w@ZPVROj3#rr(!^Ob}wZ%$ROczE=q5IM84t
zdrqxPFHf>|u{qYLA3Qt`llxFZm*S;sFPN$u`ao+x1m$cpg1J`-U?QIA`0lJ5eVTxq
zT(&x5F!N^mX2b1nl_D`q>4e?22>tbPqZNim;uUDRocD)Mg<Ov!FP(RHb)rPcRLoR4
z`BOIDqkwm;;TE0K=CQot0N6B7joaApSsgc@VG8=ogLj*5RgOKVLEr3%@iK3wM9(Fs
z-ozog3%D&&sHd}5mQv6lVzyNcQ0|P%8c>~4oM=gtalcrhBL#fxkas5y{ek}6<&Z!=
zx1J4VE=kQfWDTt?Tw9T{H-XlhdXC5ls2C-C;hcPc$rV`j4T{R-3UPn)+<3q@r*oG@
z|1>?u7nNOclyDR~R~x(e_09ZzxFVQP+$CVw(nrhj>D_UWKCYMkl}4(e!udMLvpX}_
z6skamtMLfM1rc+56nKl8|I8JtbSX;dr%;%axn+waP%8N66~Zb`?KEoM%vVG^-hw3V
zl(Nt_!f7GAf7bfIIemY^c83nKi77}7rV`u1<)L6gA=s|8V=dstCQ=72`A9lA`CQWe
z#uUcl5#al>WZyJ{b_}-++Z=vOghwURTwF@Zq(ck4^nrFv!m`>Wd&7KbZDYzMOei4L
z8Xkbz^t=y<pPrxtYp`DP>EzxB9+PUfB#AR>!<&u_D}EOxd!k!L5Y6cwlkmgk^z_I<
zXV%15!Hgw#`P*aRRXq=m^BOg^&qKZ1Y{uDY;YaFyHFrU^ZBk6MHZR)f!kP>}T>Rb~
znQ_!7fx=vS=U)NBXJwB`YjSMZRYc*jJDFve^3uLE74Ky0^Kv!rpcLa0<9oB~>X^-Q
zlH!@+MN$#DpZ2kPS>LY=@_s&i(0_5Zj)JOq$F<)4evyY|%(c3eol0afPdioMrOe|@
zu98Of9A4U^N;N;7BVrkNG-)n-&0l;`TYvtGK|9TL4a16;L76t!$$|%RwzHz2^!_<^
zO8jwDGC)muQGsUYZ0{5c@BJ6uD$!e9gWDM?)_z*uTw&O^_%zbZ1rZ);Z3KgMU0S~X
zxkXl<qH$SXNIwWYZV#ptK6kl)kZ<_~O$`Rh*}uQt_dud1P0ssI_F+4}dN8H()?%=9
zE4z?>R`kRdKE=>2;^m1I4md4PhPU^Y_Z8LJ?gY8m(nshAEPC(OJHU^S0Y|93nFxnt
zPqZkSBh_wBG5IH_!lSvQLiR6u{kb_RsuIMAeCKqOzoVW$Ukh&BV3PXLxVVz9J`<UD
z7aW2EsrdeWcuSYQtP}(d$*1CpU=D@DLcPqukF-3F-9B2`8<&ze2eLi+KkuwawB)vD
znbo74)xZyxBoejcapS6#BlZCEFZ<5tL+-sf78sv75^CcuYdXs$94FVUgYencyC1r!
z`EWt(ieu{2IVu9moW4-AQf}Q68jN?1Uf{Ib;Jk?vSx`XWU|9DOhe-FcwYPA~Vpa>&
zP5xl=(R?3*VTN_oi+|L%DrM!I%EFkJkOE{{s=7Jsz7Gjl)6ZMlj@M%eq+nCOw`Wb1
z+sqTcF}SO$^!}5&ajwd-MmftK2gO!iZB=cn&}bJr7R@~Qi)MzQJ{KEX`*h+uL`b#R
zAO$diujlg+NN}N(jc7rr<MB`(D9j4g!D0epDFROwpnDx2htKviDrOYzldp#nGcV-)
z&-klL7<SL|sfafCEp2Z+#=jtu@TxS)6EKU8V3ot2m2>7AQWL2FE@994CIOeErr@R&
z2usK_NfA+toO;+H(6jAntNs3AnfX@lOQ%oH3?N&~1S49=lt@^J-Mi=lo#;=M(%M^}
zc&wO_y%&-CdV0k4>O9*b?%}VmZ(i-|UO#S*r)YjrYfmg@ks(hnoT+6kWjNh>xNp@^
z0~A5Ebb_Vl5uyg_?XT!*ovec0$B))6E~n7gOz*zoBs`w|HiKhMQSxdvd6Fc|wN-;X
z7kNp1LnX%dXzlff;byCpD~ExdpYf`R&pI@w3ss;G(A>A`=BB56MJ%h|>!%VO=Wwlk
zR32)vq*S;80saWQW~&9*r&8(zrSgxK+<&4(ejo?wnsPZ@SoWHd#q6$AiK(sXP0}iR
zmEYL<%cUqz^6f{FbPybk?dm6srWg106ZAXv<Ak6ujHyJ@r9W;Yatvh`@zN>Hf=c+H
zB+niT{n_3>e5q`Cb126vgWm1+=R?`h1JLi9pcSgaISw!0xe)WkwplT2PbiF>53_4+
zM_8XzNk4cq>kF`IpoEuiPcG<dQBv%Z{(|kw1(jOo1A62^^HT@MnSGw{$UHUjk)P4R
z+tYp02z~UQl&kx0dDab8hN7BmyK_MrQ4_Xh+#6ZaJu~$$wtnl?v2f3>USm`|_}Sqb
zURBm4W>wcqC9qy3ql3FVvz+dfWk0=%!#|^fr+$1psMTsNVlS9|)O)5pH(+hrC@X}Z
z5WF-d=Xmfw=n-waB4|qQOV&iivzr?w_f&wj4Q6pBB8=$@yt(%hzDU(a<Wp0j7nd<g
zioofKtR>3=V3T1*ZFBkcV?pexa5ZWjm9{vJ)0;-o3gP(SV%8=`r&|xN%y!ct=djEQ
zy%wBlrq0BE<uB)DR(YQ=nNS6xKu`B^id%{*MtT3r5s(CT;&Y_#YD8ZXph9lVtl)k6
zsfv5cex*nhEE$x~X&0(TXx_~+tL)E`(r+Pp6##<k>4WBg?*Jw&esg05&DZ38+6q51
z?D9f>yG~KbLu#WuoweaX*LE8Ehj_NVC*0j(?yE}oB7<=AVnJx0(4J*0OW9aon<oSH
zRI(IhHS!Wn<yvZ!N6#B;0n}S5?dFGDg@@aFa_C+SzSuhFo2^H^nC))~r~_-x^<Xfb
zBr0M6qS9N?@_>e);x-`%iw*k1cHpEueLjER*J{C7OfuYjO=VBPYqX*T)j;_WCIOMe
zZ$OtN%w50$($3rp%Y!4eHk*`VBll^#S4`iIAYBn-1<c{M&s2MXqnNpm3IN*N(nu^J
z#IVkb=Pw26A=h4@xv#Y6T~7r>-$aUX59LOSB~Z%5M2@%tDvP_i(JY{yY>6->%~YXw
zJ~umGmGN+aDndzw*7a*dK9{z-!vS3Z-8AWK7u>s;b}O<8YzF`ZJzXDdP^VIg*DCI3
z^qbaIC(1D}@54&)bJ@>~TwQ6>sBE;vyZ-(zeU-yef5CFuzl;MWxc+K$qs>)|3ZG9(
zeJkc&+1k<=#Av>4U0Ny(3f_P8!@iv1cd1F~`iR~W6)HjfuG(wNP*6Yh@*mkQ@a_ju
z+op%SAXrMGgqhxOfwqW9|Bh9?PbJ3@>x)l4qbp0T67EGS`Qg(^B4$)7N{mX|Qj_DU
zG#<>@yX87p_5(&X<dJv9XwFiZA*B;ZWuvc4brAAat40HR;{~DuT+oAOugwILp`QJs
z^LqHeL~4kN9Ne&J3@l?(1fg=qF;ozyqK6it-19kBvJi))7BmX5E703P=wc%cu0w3m
z6@=+r#E?abonG3;VB}t<_ygj1&ID@Ws!dz_r7v2A$`zjOYmx-*t_pKW+5R?yNo@p}
zelc4gSqY|6a7#9dXbFd|uxma{CYeu5qyQj%NOx&*+#!;6X$Pe&)=tyv218u$(49jD
zetc>|Tf@!IT+3WB$S@B1Rq*8jqxN)lv3nKCAEhFOMjf^9C{>1aJYKuzXzI#8GpQmm
zCo%4hGN*(ENX*T6H&y`P5R38*g-4J$Hjh;M%y!Sh6haF>cR=lkk-m!fNFjuCmtfy#
zG_yGgRZJG*g^a2!u^-1?oeGyfmsjrcIHSRZpPPpJCD$K<$dHRLOg4aN<cl}UWtOv#
zZkm+5$gh?{IL@s>A>?~~Odts+nD#HzQp@iR54*O%o<qs6kQo&hf@W$r$x|0HRedPn
zi*EX}K37L;%Vo8{5ri@`m43#U<vJ4&9Gdf=ER~WPwYF9icXl(sJje-z62d~1;S+Ws
z1vixYYI?-0LAEj*BB283Isk7ajE-ev{``6X-u~?;>9?q)5<XjB{k`V+bfoC7jw0gW
zg?cI`&S`Jd9LYWnw?Hi3XfCJLHnw}Z_&V1ugY1xeORx1+lVKJJBx0$flCOt)AcStu
z3Mnd~RBOC|Q7$0cVw^UK%0l((r-)}pbM2ImmRc#n2)0RHZnHluEvHKFd(YpO1oo~N
z!dx!Eg`X{{P9hq2rKR2&xx0B}px=LGWeW)YIbpjO7PP(8XkDN~wm!Rv;uCVqyf>Gp
zwUF)E^ydii46<Shw`I>2o1;CjVdsx=55dhnGc0wEsh928JARG_RKjuZ*Uwwm>Hksz
zHBFxNV3nO+cE1Umpx0K)kDJ}$#exWDJx-SSZ-Q$Vzb&Y8aXOgJ&NmbDaM}_e*{NKR
z*&S~FGsS%i>waHt*BWtvo(%>6=E#oTiKz|;)oVBB8i7ouEf4`22yX6I4&qfr{@JCz
zzB;r{0>hp+v*`fBV-(b}R4l}IZYmZ)dnZpVA`cy=EMTf`kSS31mfLZRA5@V?+#Wn4
zr<>FN0y53B&hrV_G~Q=}oh#kg?%RnRyu~84)`AE(+(}RGVO<7YO;>BNl>&`3H#As`
zsOcsg3(Q{rhk}cZGU3<H>brlv3edM~Q9#cPOI0FLVQot$K$#^@FP)I@(q@=a@;7z@
z=3o{P609(UglhVqN}W{cr_;3!BM6=#b-Y)m(^~wYq~o7cJ)dqiHg+qL1HOK{5*+xJ
zp*3LERtu+_!m<D4=74RPuP*m3@P4Y0)7Do$D&5EWHse`QxODSMu)njV11q(V-&LsH
z{PC*N;})`;Uvz%brXp6KWpG`x7BgNR@2s0%AC(i9q1@(=Q1Zo{b6feoCnb(%ve^!5
zKWY$cQ`T8Wo69X41US3><>4Zoq8<V0-!-;+mRmRUi{dJ`$EvlSQF(#jHQOp`jWDq@
zhWquk6dQFwe7S9dv}1*;E;o*%AZ*u?aU_pp6luGvch?T%a@QPw$E+NteCfYP3*MKg
zQKbQoY94Vv;7_KZ!j;6$nV{~EnMwi=2+V%LElq|<<2yZZ*B^*lF@sb08yvdyrs}+*
z8*_DNy5eEY0-e-6`}S9c6>6u4+C1vROMf&A#BfvDUiijz%?xry8MNO!<qs$ex5<)&
zH=vsgYdunnW)ahW>8*Y2oJgatDwkwloySgkn|(OVvfZ_ma$WAUE!D^ljgQ^pKxy16
z6={ogT~qLr$GKF~d>7KosF*)T49?ew4)))bML&=dsfjyOp-W5RS(}3@1?l}|&j}y-
zR07PY^`qO!MBh(0-rSs)8~5}(_;bPi3N=AbJUZOgx{lDPA6yhXUf;rorY1uRR-gAz
zRAqc;dI2B%{M#$(>hXB<Um%)uld82+{8;_!IM(4`%}=o=wX7{1GC3=Jd~W~0(cz&6
zwPnCHSNdba`+pu7e)?Mg->qmcISym~`wj0uQd_Rd51&1$@4OpSDO&OBGyl@#Bh~-v
z<JfqpEr)#bI8N$Y^AXkVMnfITrY9O+k=inMK~v<UzT+b4hJ}`!P2s@~&ja~ZS|GOf
zg$6x;oU{aIZmFJjt`=+sbiO}vD4+hSBerR?K_^Zxj5_E9w3NfQ6Gz=m^8u+*N@*6_
zQ`S!)W>t~rGj6gy`MFxTP~|zJS8UKyou{25ZVc>AC~m_l6BkE|ji@!zO2-gJ=Bxj%
z<o_eE41dk3X&65Kx|NhTwIDYF=tH6>w9~3x^8gci@%I)4KKSMGMH6+-^WGN?-mw+L
zSGV4L+Q|mZB;N&u!^|5x*K+`MdQ@_`^I$`~eP+G}1m6V*zaR6)S}QEokoAQQu3RkX
z7~%^R{#y(U4C3fb`IMe6>$5IFa?0-~x>f?`m%`7-i(&HhEDTjYOL>0@RrD>9>BqR+
zB;05%)!O6IAre3qt<MmSGB|Cso%!SSv+*fZCtciY`pQkMRFLCX(rYb&`k9KEF5%;L
z6XffPH@8u=j2+xTex=pGnLvwH-zb?4DZt=o)GC8z9d1&fD;Anq?K<+Lp-O-~1F*La
z)Pue|&-Y1{a^Ho1AhZAWwIg!ZV+DvUOwH)iSNfbE&o|NzoDSU-g0R+;oQ0^L#6thl
z)IImsa~iR{+LGbpw9D_#6K188M4w9kM8C32F7v~J4kPWDsuj7nAQhoY@EpX45vnKy
z`nwen^8c*MzYF&M?I{Y*OZt*4ZTJhegVh8Hr*x)Tw`}0z47~FJYkNBEX>MdFk>v50
zsJLTP@?tasHckBbB^RciC}#5yFJ?^U;N`_4X|utN>!4nc1vU;C|IeGlbC6_jK!5Gq
z?O7vMt)Uxlo->y|BTWyoN^#2+vFBzm{}-=4BT9`}73Uhx<b|BJ5kD9R2R{P1Ecahf
zJotREEuaTIVHYMVF#BW@Z;<czh)Z!*!2PjzvS?~Y%g4y$Jv=Y)Z`>fU{3KsEb0coB
zzd%<^eVm{9PRs55O^J-(d{^Y&AGbT>Zc#~W!4F+=J`v`4;$w^Y7sX@Gh_!V+)Kg}u
z4tUjZ(;L#AT&8rZ&_cGx{L|OrY%)u{vekGtty1uMVn5Nh5{9m@IDhT_EiOsNI1%B*
zB*h7{SeI0bISs$TS^6r62``1v1Br%>Dr>_$pX<dI&5@UcKdW|L5!A^L?$Xbw*iM&o
zzjY{%V$U7ChmhL<*y;FhE6s!7aoIV-8?jRjqZ@V&UpI2=y(y;^K>M&nS?$&FlBc@8
zpYy#sbRjUb$Fzm(^nuaGYll|i&C*eq?ij1BkCwY)5!w1u09_~_Wcy9VJ@BT?p3Itj
zXXrt(5!|Ft(9Z&EJ=g$d(^B1+X;(p|4;Xdne-<s&gC-jaL~1u9Yckf~#U2SH6ok5G
z%GFoaHpJ2_D^EUe*1+_)l)Bl#T%I+wjMq3fSfW9*jX3>7XM$*<nDV5@yfTp&*xC!4
zM*lMMg06yOgXV8cwfLv(l{?Bv8Jt^ewRW?!d+_9v#B($4c<4UfiOPB`+sM1@7br_K
z_${+#KD8vJ^`6G-1JT{(bD)7BV6(@3m2TkXJYbU+)DVpKhJnD$3v1|sdmsq5#(Gm$
zg&3N)IG8!2Smx_#QvAY60W(Pw^{y{RPO;V}f<K@NiJ*{;Nv56i%hKp~7fngOzn>+J
z?x}uo+#pX(dtH_DyaxfCk79Tel`0S?Vgma)8$pr5`V$G7vvY!kFuN?gBnH=3#o_MQ
zH8^M5O2!q1=|e1PElta9-8ZAsWo<0)JcYea6t?K+c9(DW*u+zd&sM15*u$*F!K4R~
zoFc+31Ly^x@*uQa*RlS)CBbH~c!%8efOSjs4`v$e)H9r9Dlw2I9Vf>S8@JFUK_@2T
zkIw>|{sb;>K=b-2*yK_;^2X2i<41%>W>64}gD$}A2miNzzOY1%5Hc!rGx$EZ^IGcB
z7&Fw5#m(&xzA@Ebmu*e4q0B_8VKJUrFOy0D_H6{8EAwY*x_{^rRM@ZbgTE9Et#LDs
zk?$s~KpDl-TgfVJa;{*vI3M!Y{NZUjr3V7du|v4nx_yg1cw=y1V5%JC1Jkr=k{%Dv
zFA|ldAad@qg#X|sEzx$jDXjTwC{0=AT9=pHWFZ3$FgoocpXwUB%NzpGx?r`|dsg!M
z{Rd!YY#v^|>wclL?z(pAWjTdM#F!{zSoKfp==8F%S{S}>!-}@J-hzP{7{G98T_hhv
z%X5oLNmwdt3Gfg{y<1|pz(c1N;maE5p=o@q_lb)Ury=Iqa*_+g21(cT04QiU$hV`Q
ztjc~!Vz|kb)^)0>(ntj|WGFJZ;`o`iOe9@=@lrPw#bk(t<}>Wk&|A_@;bv<zOv@|)
zGLzjKJ0Zj}ImYVPfDO*aFMhQW7Q(N4$435gZnjbtzc@F8ZvjoqpLWF8gj}-<s?%za
z%y(QYie3Ei>!#ig;e6u=8p4;*BEg!RyUfUo%~Q1<YBfRL0^;5&fmH08A1f1EWk*+R
zWxQ(+t%!55hHd*gJ;PcZt)QK2$I8KPRjI|Fucl@mxvVHu)XG5yF@<>P@vm>Kt+%C9
z^U|)!JLYjXj<qEZUL)brkVg@6Y0`gWzS40rwCp!gci`PQEm}A4*n_rA0fj06!r9vO
zhdv;%`Ec+GbX!eG8)C7<PQ@L*-}=|9XfJaYDLr$BlX3I4dh7$~G8N8Cyt0S~GTpUq
zd)_Lie{CuSDyTP7OWvPqgKGWCSyt2{N+tIBJh&$JfXPne(BLw)>Us2{s}wA?IIw}T
z(n`tt)K1kyDLz(OBP9txHP*|x@8o<7TT{g;X5r;5vz%xuCP8<j=A*Kd|IEIP-jDBt
zBmB?BrTPZ+DmS}YRJftg&lYe+cY}mM@xjD<xv7~=U0lREDQE4&s{H)WhI3K^2&caF
z*<6Mk>0<a`<k%&b;@<+Q@IS$3yWkOvw;KJ3;q3YXj?(eS!9XvNnImcjDbGtmbkhxz
zAUbhf{nO*hK6R-<d%J58SkPuoct;)tDg?vDgXE1`2zsMG^ay$>Vm5{!c~rdy{+T#}
z7gG4mY@ZIMDHpFS>8R<o))8Z3NDt0}A=IoO@4GXD$90TU21S&bsGtru0l@wvwT{{e
zKIe`3MtxrFFCuN!Wb_<w0$FUEwQ5~?73STD-n&}Yjfr^MBO;+Jur{2Jkf>2vSoe~X
zoo_NC;0+R{-G3MZF3$XAOp+!TS%b*Vt}QBdnV!x56Sf#j5@;MZR=4<J-X`Di!}I<8
z!NOWq`#+i(rCji;=;nfuo+7>&*In_+!Ktkjb$GP;&GjYiap!dS!wZ_j;o}c4Xg$hY
zryRnylLK9X(h(lT3~~(3hvhC6PiZ4ZbYHG~oJms><~F{v*ZyLqX*g+VX>i6$z7OxF
zX1`i-kJA~YQ1hI3b-NH7hz!EsP7*d@n`1W~;ls%FDBV=8er2FY+#*<xWvXQ|7%NiX
z%}f={b?YCcv^QJAz9R(9gRcMBZm<7f+Cp9lW6zEW=o#?kOV0;U&cPNXwePsw3Fy8w
zj>u5#^B*4N8uzeLdbt#^taybo<tWshreGu(Tmcd)Wnsy4o3^KUNUM`=mB5g&sa87Q
zF%pZf-nNrP%t*5pPD}=yhGSHz4mS2MgH@*6vO-N|ZEDk&-M-herZ5=ykvy5Yr1)#6
zczC5@-ZYgVW|O!!yPzck&+7rf%qCts3<W*wpJdXrh!w{l(2WBx@3mdWS+>tBI43(~
z-A~cVWvIy{d<f2#D(_0ekLa;@H>sydw>+%^pxm6+@U90S2QeWM7IshSq4!;F@5YfP
z=w+)y0`L8OO-}bix5m)i)cg{}u*@3XDVyor8a{VnuFfhLtF}VQoPK=CevF}-^pwxq
zx|U#z$lC$dlvhsI_A#clauVvEmsxC^LezfRVwGeaCIV&Nm!iEr&5U*mSn_>46bFM2
ze}3uM-v7f2<5O9U<thLx8(E@<zm=3yKD=$5`%D(=c7H{f>-Sju>fGZUG~CLFi#}>&
zdcSV?Gxq+AR*vYg5P}X`4p&Y-qlR;umXjLrpb+PD<+})(4SUH2enz>-!G3$vP<OT*
z8ZqxF26dnJ1|EO;;}%Q!xu?*)dzT-7YNO%4MnpGzX7HB=!lgQqK<v+GYH1{Mu##6)
z4s>by^y5sE$tCi>UYtoEP<A|5@Je3z2m2l#W^jEM*zj;&B$L0?wy-Y+Nqdo<%FGuk
z%;EnKC^RbEcgL5sWY$DwLA9$U9DPK(McCQv<XrW18RuXpC1sCSH>OjXua$+(kCznJ
zu$I{f{Q%5O*TA-lhuC8S5w9Eq<4iCZUO3XDLXahUHLI#pi)l>1qH+zq7qWU<sJjFx
zQ$M>$K0mHwqFe`fg7M9Bojs7q)DGxzrYyl^>c<A?);D(#^WbHtQoy`Dg)Q1t*Sfvh
zTFIwdO@sYaU5enFnVla#`(tfqoKIkqD)X>S`PKq=xLR1On_j2b6;c7fg{=@x%bo~8
z`Ad^AS?xiy)7Ir>AxYIzQgw5<&&gdfV0-MCp3Oke9FOBz=q6=<d|*RZvQPA?S7CiL
z$(=o}nldOY6TX%_a8*Iw)YA@sJ8ZiWJ4lov5fzrZE&w*m%hUkYvzc%E!v}wY*DHDN
zy@FY4q!>_0vAU)}QaV1`f@}e8$lS$!5%+|l8Fi7|ZFZ1DaSgAD=1M&=_Sf*0qq3pU
z%-~S(cTq$RB1O3temqCa?@RZ2C`}%#l{4{p4|8w?CG2MhxN5VAuj+`~oSn?PEMbGq
z2$TiYBk_7Q=cFe`dN(-NvX}rVYlVZ45i?^;j=-J~H7(i<#ROx#1M{V##y+}=FpHMy
zvn60<aI!UMU`#UX_odQ1JQQUfEc2+xk0z%+GleB&T@gbrZGL*XOd=oW(Y2!PUJ+YZ
z#U+WrdukVpo@1>WGCWwaUns~Y(OkP_ta=(5SXE+Le#N1|N^CUs+mddZHJ*QLDip$}
zEI2h#)&A+0&5dzeLDLk0aW&)YJlrP+N#Gr4T@f>Q68D5Dld+8Bd=*FQTi8hXK-sfR
zVrh772+;j-!yAJ>$WL(&tg7|cAw7#A5^D$(z#J+2x!{mzp#$^EK7ZmI;Hqs!ZZyr|
zhO|=Ja`4ngFqAofeWpiwP_wJ$o2VH~tF>$2!@JRjXcUn$;8o)7{2|QSX>*2BD3vZ-
zjt%4^SS(EUs<aygO?~~|DqqMwSp!&9N?lg#%8{zaf6h<Zd&iAk*({%!>~~~IEce??
z;914lXS;VFE8Eb#5`K%vg{4Nrt!Vr8b)A;xOSgR*R(=Bc3|M^DRKl^<eH#icg%`g^
zO~1RRB4THA?{QY<GhAQsN=kZLziI2wcpH7yP5T%IFmSvO3vv-+S)7~L5_gxdVA;Np
z4ti;Gi)VU%o$H#fFunW_Cznm*a-BQGyPW`PQ396Q6xb&J_{}LUZu?rAcZ}y#n`P?y
zo+EHYnbI#Wmn9mICKrGb9PTSqP;Bae&_`&r{Ezjl_QF2n8L6nv{W)lou&EDCnU#)@
zN^Q6)OZ1y3g0`12d3`-@27g`#vr7BaK41FYhApPvhnOBqO;1T{HU$P2+Tyzxz<IWt
zY2*EdK-T47BL<>+wd6WTxvgdCV;R)t0A?~Gy2j6=s~qo!avuAM#F}hm4k|rr48r--
zl<5^<_%8-cIH}K!;wlA6zFGoO5%VHTD5%-4T}2*fpWz92(^z)ZU}&8U&Dc%Wf8qN7
zjpO-$(Z>g5%luL>G>dKD7iW={(gp^&n&={Ll{X8OB>loenYo6Q5YI`Gi`}1EGek2v
zxILVUjE1hQ8s;Gv%au&-A@0D73_7RI8TSQT_9#o655JDzBX_;CaX5EbZ4?u5*{(vZ
zlp&C+u(J-6#Me7a@B&)3C@KpfSq7vRF;XLtz8nT&d`K+K7)xTIw!(~7%9-=YvqS*z
zA?7!*y?jez#L14anfwY8n1R~sqT30xbab93U-qql?SO;&;_5Uk9DeX!>razH6ABT^
zz|KFwWt)kqf+1VkNl&<xr9;AVsX#np#Hr0Lcww^wIbQ>STZ@<xM`NNI=M2)MT{k<f
zKs91BE4KZXyLod(<C($9?XQ+yM}lLo$A=X~9f#`KZ2r=NdpcWXYyD4k+h0}7{=>k2
z|3_OKWE)zuVuuBWZ7&wTeB|^bX_u)wS<FV#zS&1|PD)z}&{6@<nE-N0IsXxkfAB80
zyARF+q!}S|_%HQ~Q;tA_zq8XJN=#$1kX9yO7-9E2SJqUOO~$~rA_#u|bD{MFeMx#;
zFj|MAUJwR;7HmZclW8-}^EoZm5&X_1QP#7+xQfbQC8uOTbOLY|cyc>oZrCYx4=R40
z<P%G=K-iIp?>8G}R2({^E8PTT9b(7P@9L57{5$s1bp{ZTudY#w$HK@SeJXRi4RZdV
z_#DL4r#eto*gi}Zi<ISy(~k9cId@DK1EU1}_QuR63)NMDcMK_c2y6=>ut0x5I@Lda
ze{bx2vqzc!8-5{0qX|7^;d3gnvoUf7%E-#|;S&JB%(LIZ?l_kEb`N7KwA8=RLA~Oo
z>4gwQEQ^`f8+V3nzX5B(RM<<P<}Bi8IUAr|R1Pse$3kUNWGxz?)Bs29TwL%kV|s;*
zfKla^_q4gqYMgCW`ck?qFPe6ZVLr5|M_`c~8xeC#7JZD~ll2y16o&-ZUE+^v;>3FY
zKp4D50KNxNbgNsF9VJ;hq~G9a1o5FGohi#R-pvZI^0~f9jXq`Lu6=aJ19kG{*KQGh
z$ELT7B5@_OWmKXqAy`#BE_i1-ounH3Aq$SK7z#;q>Pt-an5s%sR!2OUL&|B+DNYEX
z3$K0uw9@@);B5AKzp0J08D5wraaLV|;)l0=E!5u<LA~>~1HZU`$haUVuYE}4!~5@V
z0c@{t7a&*i3-FzxH&7~j29ukU9CHpc4gRr!Y!e(B!wbBFo&)V$=(_P2*g?B!vAXNF
z1(R6Sc+~54q4;}`8nI3(OMz*#EjK4^GjCu?K#4x^mSSP}L-_;XCZ8T$%-c(piq3on
zHzN?sHrr`so)eX-K#DnwEJl?@ja(UqXp-@Wmhra+$YBh}k#JY(_!(RLjWYiSG4e83
zv6KEta>1(P*UCd8n`aRG>O?b4AFJR*(mk3vq5@UT4Is<mu?}}fgWtsKh<YFG$=Y~x
zinPn<Kep@mG^X0Y6zW;4sBQ{w;`SN4FE*lRnR3g|<ont49d*uH#&GEcqJr(Czfc#T
z+QSF26vZxukR*mJpdw~vHO||IDWs~<8X1KC4)D%ACluo;_N8QHM#n&J=A*QU-yAx?
zpOu^LTw=1g6^D<G<;3}_b>FdGvk(S5(^QgThZgrJi}XhqJo}*e@6y2@BhHjFf%q?=
z?P*Z#`i{zr)r!VRg>eDvIh-}eLe`~tC3)%vu(FpArkjG(cO1g0wJ_r7kUe2t2IIIr
z%C!x*aGO?560tH||2#DlXi4Rf!B-Y`7JJ${?+KGrp4Rq1BGN~NU0}Jz@I<k6|4j-*
z?+%!;n=_%sx8z&k2C@~=%!kuM)NP&LiC~21Nr6_<mE$M`Vv&AQJ(4JWc`>hdj3d*~
zresn?_h{R_Pa~#j{u$i8=h*A4nn;>r;U8{{=8b!+PV`R`unt<to24d*G^zUFos@%(
z7&p$NTCWIEa_}24_rgxRwxniFFDK0<p@HaeU+2SFweW9`qEalhG3O!P8TXGSqf~&q
z$Vxs4wi*m642&NX?IN~<W)y>|a51Tsyv@=k|Av=wsW0i`oSad@;CU)y4~b6WzMcB#
zu$n5^di>?p;pT&>26wpshRVUS{ZNrB8-qKl<6L8b(=E!&9)m7>4){-3ptXBcF7NMs
zgL`kY)$80#ZJd_e+YU1?@I{JiZ$djEvfukF$TPj;0=b)NnULn!DiRhspGTIw{A0;$
zxYpR7Rn|@-Kxu_A_X4o^E=QdrA!x_^e41nQpNLO^!WKD2U>C46D$w`N1~peEB)(A`
z0vM6fN;BOQ^(cIgTqrjmgB=HMP2l>LI_LF#xj+#ioMvoS6bLsFzuSBpEmn*mE`OGl
za-FCd`_fh+F-jcjQCN?h*?diC8r;MC3^u*Vg0KPx$UOv54r)f(UB#IAE0J1&NMgPw
zIebLbuAtD}KIQqxUg%bvr868DZjX4!oWKPA?y0H+ar2}~k$A~dcL>%IAer(qQSIdN
zYOMe2AN+vm#I|ACx{04_a{oB<2o7>^FRz`N!6xzus^w{u$VYuors`cwrM;)s&R*^p
zVr1n_wi}pFj!G5{njUJ4Vldp?EoOqPMJwn|m^NAlEawW^$kw<nTrF!$WLWNuCK-pQ
zj!p@mTTxX6RXH@yERuYo7Grz1vL4gVH%p7P+1(Aa@vm!$=SK?|;-ff4Jm|v$oHwbQ
zL^`JQbJLBgiH)1czqu+x>Op?5nVqYGOS2rBSB%B0i7nJE#E449IaU*xWIi5<!ULQX
zES@=wVi3d1k4x>0EF@Exk}(sFgKM=5b3x_^ZkdXL(^Dz7!6PANe(A~}{S5i*+&?Wz
z7@R5CCToA_T?b@dPl&>EP1V;>MGnFGAV0&I0hr4G{Kq7rRM;dA=RAN||I1tzn>7}!
z!q%vzm+rSQRs)lq@}NTow~fb$I{0ALcpm-`wKg)ohit+k(Q@XvPiZc_$$N&rjA$8s
zu+R}6^!kn+7!da2Pn~uAz1-1~r!p{sU@HCIxW|jZ8v|nZ*Hksrq)PxTg@;ZFsUI30
z*Uk$4C`D&-kCnRBnMU?a!b^cM9@AC2VUh?FVCM!qs^tbXB;TSQaWYaMN)o!i8RHQI
z_Lg4T{z}M17+KG42L3};^S5G1n@)?Xv1KLP2V=zXW+$LWpINyt+0^aL)d5hZpl+JM
zz+0Pg(8@=Ggh6ZA!ex>7R&z(-;|t8UqW@(EW51%Jz$v+V68PebQ$pPJbN0zs!WQ<z
z#>2{)emKRi{>IAIrM;X`5oyb5f1TvaWKCMpqpG%UYV<Qdz;D-L{a7xlY`Fvl4~Z&-
zjP{$3kOY9vmf6PRbWg2nJbqvDynC7+)Cn6zx`WI_3Uyd5KfmlhdZTK!>E^S_$zFu)
zq;u%dmC<E$%S|QWb5kozUHis)##QlqDYj{kgzbQDR^v;;hd0Z-liMF?ShQbe(Ogrd
z<f%W)q+d;<KF$wSS#uXDDwTTCO7?agriw)5!<Srk7sep}EV>&!p)E_>wHdO{E<o0}
zYa#>IU=A$8s^g`lJLN9+TQ&$rIAmB2&EDMj-L*5j1tm4G(P5yKQgUAChh>T5J(1M{
z)oVYNVgLiF-X#AzI4&MLR04KCHJ<q-Mc7M><tUd)-p$h9IT%A75jvurHQ*2GG7DYu
zZQF0bkd>qQ?vey?8%x)*-vw9pNK(~vT`|StETKmSObYg4bX!}md&pxji=V9c1E@>(
zjGiwKh+0SL{nY`nP?a@k)G~4y6rX63Zkt6|2{l?_q{^`>F>mCHE%W26y@nnNLS#Bh
zickBJR-h%H`Sey}wQ^GTajL5$851o-DoOI{|Cap!Z(-{Dw6^beUOjb}1j^(Q>(|5J
z8p`_;Iv==GC7luhS*v$q)+Yk@Q32>eEZ3m{o|qx3WWVfq6cjf`_c;r^eZAN;KL_#&
zm^Ib!(L}8dta&=$cB>fB<2#a@F-FbI1xL9kVG~urico>qU1>{ZGVeL4KQ^V$D1|VI
zuqSJ!05<Vo9pVN2oeOVgu8m{{@J(|<HwA*l`<4c4Kgzrq>*-(hoUeWsEgAH9f5Rf5
z%BX&WC`=Am)hdnU48@L^-?&B<^;u?xz#411${RtHQ_U(1fUM9TXT2IRQ(cPbTU0)i
z-J{1I9yHAxODb+hGd2drcRKHv@)8TrE|ZD(XJ*n^uy)SSIyu}ktDP)&wINm4bmZ(_
zDJjeE6^;y)J_v12y}pixAX3G+y@tb}!A*rS{&N&=Pa`y{#TnvA6~d{0ciK?gL4Z;~
zqDrK}1EI}E+f2*hl|v1OP*k;OIhIVKSMr`-eC+DqC3c!(TLfiz-U!65ifZ%1$~1e0
z6D7pHM_#HD9|~Ll%r$cS9kSQ#nhyJuQ4PPI(d^+=Z_12Dj~Og6NpHNIGcL8Xc+AXq
zu|iY;Kqlh25J$K$#A}RJ4^^IMfs}^os|n45Ch}k4DZy%F>di-)gnRl~vwo=-+_GtX
z9&eQ{2Pu<6HfDm_HYkTF92;V8uecSj%Ejj)p4NHIx$f5;X>6x1y#orm=i&3E2>Tl(
zBgs^*2sidsg3B&@515){en=2nY76g(zX_7<`LytRK8H+N1+Pmf0N1OTtn;Oaua+;c
zJQ3Q<!^MlYm-cD6pKA5_MWfPAFj$zt03r4^mR7A2Z_aVV%{KVIMfTsRLoe<4*>0x=
z-8T3$T)g3%jnV`>Eon~U?1lul1r1TQ>p$AyadY0uY~x(zX#s1_bF8u%p!cPXlx8}m
ziI(%%<Q)foOxQPxzrm8#A6K|97#5V$tj1oTA=$jwZnQog_gPaRkPr0zlbKmy`V^uD
z@NmL_>o{=z?~aOx{tca-$^KK4hz##o+Y5HQF<gk7Z&^OMjR|Ya%5k3blT2#c7v49x
z+HZ3;u4rn+a$zhkqv=0P1%;xoZXR37`OkN@(T88+bfNwXO<yuxr+TFnjJcwDY`*=U
z2XTJ%hSu4@(baG118%K?TF;pG&5ysN^&d(heDz#jks4+wx6AP`@*7mQ#NkKf@nVSo
z1Q~v(vwuG{8@!XyZ}jAegO=oNX1f1w&hSe&;&N!pcEWTN!^iWalP_(T`&~U@Mz^@a
zFLAgi2kyRz57+(w?nUJeT4OIwj=+pt`R*S&Na_QhrOi07<I9fJH!UKx6I27El`X+{
z6^@OZ|7#h3dZxT0uCo8b-g`zxwQb#^CNLnPA|gmqK_n|V2Ne-Xl5@^kax4&0K*>3S
zN)o6d6-5pzNDh*7kW{1sNmW2m#hsk*>~qgKce8mvZfmc#_x3-+s#<H!Ip&ySj?sG`
z(o2<~kpGB@II#G{>ArC!hjuMG`@dcB|B=0M0jSE*9HdURbFRBpqS=YCpJIZjZ5r4o
z^z$8#^-)+ntA25BANO!to@b=5*QaGKSCdOX733x~f%CYN?H_aVyy*;+)iZ0qGkZ}T
z8PES84=I>9)qFL1&Ts~%P=?lz53inZAEhAi50^>@^Sz!#d9X@bvPu)a^E+YmA|9Vp
zQu)XObhDHYFJ`)}1|BVHoNV!&1mHuev^{4rQ_+hG%uFG7dam6%F8T8Z=8Z{%?gxPu
zfR(3wfor+&=7;&cJ@F&zM<3ZyWLOC4ZCn+auge~%I03XKEkg%UqLc@gcz^lT%&2d2
zwVg4q^=DBD!DCNx|1><qb4qg|gKs}=p(NukuTA9V*xxrlVWrST+&!|rU&V1ux-ST8
zdN?kz^_)B50WZ*>2gxu8?-zp6N5WMMVCWre-nXA<i~yn|V6WszVWZO|;NBv{`3uf5
z+xs-c+C@PvjwtNg<9{gs{KbGW>Cp|G)7p_{*Dh0f7D~ecNUkA${sWp&l5yW~m3%b;
zdDN>%CqBD^p9+};f>zPyY{5AVTZz9wp8jK0pHH00<@{+SwwWOn-U|Gd>E326sJ4j$
zg}E;_!xgQ}?8;R!BW^s&Hy%VN<f*|}ca|r=ib8p*P7=S$bo5i9wve0eP8&O6UQhXH
zT*?fcchL#>i^2JydCt^2!Y!eDoMum&_p93A%Hr5r!4p>G)#r#Kydx?D*>vIrmw_vd
zS(;CllCwIZHjGMjhn}>XiQ9lHo7BQqPV|fefJY{W2v56x;$RLRsU5<ohK`5U{?B?B
z&m#l;J1bfdzGFEWe>jF>a3!U-K*6!Kj(<9GKNXe;(Sb>Uqi<xApDxT`oL@I)oNsLP
zo$DBJVp_vj+&O3Cx4qQ+BCaF;IU1VCAXV1k%6q&iU3?I+P$PYDm{#}bZ4}9OF&&yC
zwd+AtLJoq<wtaMGq;=`6<3f}k>dUuAi0UfQGS43Oj7l-5WX|V&X>RSLix4DmT@!d3
z!Q&$8xi)%Xk>oP?HH6@}r6qob2#meKtEwlb{1z`!?TxXLc`r{b^1iUXK+okznuEWF
zV?RDJxPByh_Fc1&6sQIIf7O>#Xnc~-{a$>Nbh<j?AdTYQvp=G$|1bf+IW_?M^AHnz
z7A~Gg&hL^m0?oxUocelwy83JIAJg*RYk(dK5SedxviZ(k4J!GX2uFS%zuS2yLYQEe
zoxU5{^ySYDoNn*PwCcLUB2To|yGH^e^zK!1wP%ps>G6nq9J?20Etvf6a9O=^GyC3b
zIPnJOead5{1dhx^DM@@k#`Vd#f~;R(jzT+z3)!L|#uk%W?b^CF;dLau<*1tV!SM&#
zd?zw?q2^@=QR{nhzj%F$2Yq$>gH~R@KdR3MtXK=;WE1y84-U3CkMLQ&$R9bW2hXq6
zj1HZ$0razIU;LhWo_gVZm|f+FC3<X$3kbNWL$|`HM_+W)q^5FSQ40H-8_j46!2e30
zO)Qx-^JLp9AFUl9tNA^>3RcU7#fu~J7%ua6mclDBq>S?W&iP#A6L4}`-&MoPS+ts{
z3;%l^gT4ir<LdAuX~0@hsVRB<mCy|Lu(>r|%r{cuqf2X){#@XQ6Kr#sP^)%S%x$g4
zTL|ZskCIK~+&`zqbHP4`)+gciy`NQw-DiO#*2@O~*(?U-Y+2Wx8;6x9J>GlntGAG%
z=^mfzZ#-DUHM|8f8Zo9a@fth&tC*^}R<BAYTO(TG-YuWR!#*ABTcmZn&zSX81&RZ2
zWE`T#%35Bl>wkzWq!=kNk7p^UX*<ZLpKsH@6K~c@S)^yf8NKNg+=+WdeC%R40E;2i
zclPOu;dX+<=HwR=?|lx%nuHsy8sbM9X=9yYLd3Ur<Dk0L@@bwW>Uozwk6>tF-ENZ}
z>Ni<+ST##b;ws@B9a=l~)y9FYoSPGm)KatMZtsyd?+Npwri{$WM^8_d*{%mY3P?12
zwypgnP<t;u>`?qgEGtch{EN=r?O77ju2rJbR<+H{0|l{In#DDb>iR=;zVczKIo5qJ
zIQ-4Jxi_1Tn@xFA9j1;wYVh2_#1bDDuMq6eSU2i&=`sn~_$1mL)orO<S9FD=c3X*J
z=hwN)<>fqA#S~G}t;!#k(>lir&_q~(U4S%H)JJGA5xPcay`sjJ`2@?WRPjn8XBMP^
zTjpBzTYr{IX?X~aJ%a3SZ;r#mg<SZ9>b^o!N83^56L$f3%?NKA;(5N<vfeDz+GH|i
z$#HF5v**;!r8i$A8v=nQ&5|fpbX~$#?w`xb0)7fjb%$wCt;&vN#B41|<AqW*>M$V0
z-8?9U&Fvkx<she@6uF1nK6~5)4~O@&6V+~QpZw250|0)I9kph0XSPWpE^kOByvCv6
zpKkh(p!eT?r3(XZHG3i928WpY?+AoWkw_UJtu<a+9YLazS(+u!vDNEQRs(s@%h$p+
z+KE;sKTT9ma8x=WOY%1;NY0GF&4UBgICv?N(Ol;8BJHR3V=nn@H*`=uVz!wmksidA
zJ!95UWO}Bl)Ll{hP44qyluVv(x!+}Pr?=g&FzaLYa9B|mxH-gpzFuIFi~_TCBV91%
z_`o>g>d_oL7VyI+aPC-}D-7Q3OeVNoQWdE3$y>9sP+7{ue7IVzj8J>M7HQ{3hIF68
zi<wp>?p0a#sR8m#{l%7rn7fjffd1J|mh6&}ya?tSsQY!Uj*`G0spdMy_QRZNp?YvN
zAlbqMqOhp%?=HRASss`J`hzdZY{=0%!mg_o0F4h&tvdJWab@zCZnSWyCy6L%msv0a
zSo14Bd+I_hTz*FyF2iLUwgQRbwH1WlSQFMPUn3bQGR&CkNK}3i^WZ+;ly~$EP8r6)
z7xhV|F)oMwsX}h8c-;Ap9f3@h-0Opo<<0grXOIY@5H$)(5pZf+mT7lZ7{6n$r(vbu
zJvIf&nd?lJBKaXQ=(TRi2)H$+n`d#z!g@SVNc80-tZyHLjfFlDWdiaqr52M<9p_qT
z7Ndej%WwajKBx%4uaQH1docP1Sz%FFeG0c+nf;XIj{Oj|h$mFX$3t(W)NW!W%PKbC
z6rDnAI*>=y-n(owaaXbi^ANW%wr+~s4;|bopBPm7kc4TLH}6h^n+*_pHo2z0JxCGs
z_}r(94LghuZ`K{ocWL75o4H{j;=LHbs<|CKf^jYPK*HNqWAk4u^_m)Yh!1qR1T5<*
zD=7O1$jxmp^=)oN5tN{ZcpMRx1+EkOn`5IqCB|4aIQ=efej47qX}b`*{$Y*Lnxk;V
zE<fy|kr}U8*-vg{;QHJVJ91q`KG#Fnb`QDDqzN~Rh3Zv~*Q8fw>AYikJh`s9g)h{s
zeH@1?>DP&F*D|Vn+S)r<;q0Ac)nB9Mn1r5*V((TL*Sr0@jN8&Zm8aSTpd}sm`=whG
znBW6Y2*;6DkKhhv)1p<w{*)=ehpFLRhK3$t>lT6(n_2EfA<fDix(*=2WiG*cW526+
z!1e4*TF?p|?OL_3NL&5p;{_3Vj|366(-j-<rHDeZojUzRgoK*EU9q#BcszM%kU~b6
zBDj<M+Ha7fE`{0tvOAXnmvM7wyta0E44~yd?FE!ZW#o9}7Uu%aK`o744tl!b*S%)~
zE<U_c(f1Wdi4E!w@vj6N4&FMiZAPq));8y6oY(i|dU9Vrg}xz>IIf+2i+GS#zwU)-
z>hDTb{j(5U$MsxLVnkQ!DLf0OU`eH2q(7`Kd=lbdwYMhXW%~7XITWI{GoHH8g>9`0
zuO6FVA`$EFWD;~*fO>Cl<N&<9LAX?RGGBe`#nS!o0iZZwJ9fn*b0}K$3LqZKra$Uq
z#Rxy%$9U;c^5xmPA-w~}>YV%ph7HfOq1^$sX6c-kc}IfjnR4<sCaw@K4s{U@or(yM
z`0(6LaDv<<ty$^a)2puP&LPY=f7!cl?~eEoJ4Rq0Nagln$OM4?=l0spM=}++OQgRH
zaxQ9FT~$!txSo}X^{-78Uzw98oxihX)0>D9=;dCh{l#fA-TsKZ&(tySim$#^f7Q2~
z)xL1ih{F0Ln|X+^;fGTDzBZ<z=|Vy+sVlc<I)0ZDrF*VQtboOwy}3}-Ggw>=qYz__
z`L4-+U?IM;tW=}giHFDQL@5fES=;i>dQZAaX?vjG;T@%$61dXEZi#%S^e_7*Z<XoS
z<Q8zHw4~V=ubOfeHv00Wu}dcp&m4BWu6R_}9GwQ!+0j}Vu8SX!pO2&^Pvi*ErxaU*
z?0L^Hs;y-fn!Tg82;Hu<JdZ`M#Wj1mxJ}-}yxdNuG%;I=%YT(6l>G0sczpMyZnLH$
z;xv`7L2g#{wU?Gl&n(F@&yk&7k-SQDI*aUvgyQ#83{QWYJIi$Ov}Me*$BzllEyZ*(
zOnP*2!kyM9<#-pC*S$sC0pxh0BXPZQg;o@s;{PAVwsVo<ZFH0@PeR|lCPV@rg0a?M
z9W1W3G31AB)FWd;O@7~Os7{^ueFaL|r8vo8-wmMY_^`mx-&3hhr*Sivk`>p|<{DBU
zo4%1jYQm=YIU%-H>xX5XF>-2ivmKW;yEP&EO7Uz&`C#6irM^J(Jj*AxTi=2nb&2>f
zL-Z-8&uQ|wYiBt!q?=W_p}zDOL%No}{RlSfg%7a+F(^n`U5;1EY?CjeerRxu^W}@u
zOfFDXU7SPsfT((*oo#F61m8odrC+Dzol)p0aDUyrw~OJ`+e<>?&K#4CtYpkFJnQpa
zf-s%jH(Pal6Dp0ubw0JDT@QiQ!=0obR9`HvYQQ0gBVRk-PUgEmqP_sx*$;{|{=9nc
zW&L{xJ9NjAd^wx;1V<vwMuAw%st58|y+CJKC*0Qbd-?1cLd_i?Vx=;#gVUP(Tc00P
zuWajJUk~*XT<{qs?#l|Mx`im*^Tlsq%{&%br4AI5XWx_7#dV8??w-9^-Lp-5zje%C
zpKrFjdnCPKike>ee&FHhw-EMEqCD^+b_y7Dx{-Awv79SMK_<9*dGDMi(ajGn0YeO5
zcs|;$3nVAZ=GY&1TJ~$a7UU(UHWT8nNBUemehVSfnKZDv>;l1;Il!IQdzzP?!26tY
z^{Xv@Z~Y+mN~TLR3t8w)W^A)*G;R({&T<r^+^U0{KnVlVSAW+mBC^`m66|Oz4)vC{
z50uT8ly#Hb29^=MxlV3QwoM%)y;<#WP$Ze2ZZos4oE{(Ktfj3vEW5$v=wB)2udxNq
zdZ+JeTqJ;B-73tKz>O;PYVnS+Q@+N{hW}=ebn*D*cNQzXVZ;Z@y9k?-xOH3XQ}_ET
zjqlaWJ|U=zZg%!k1Ffyn8UulY66eZ`6{E<GckTxn?367uobInlABydFKT3RPSP~04
z$XarkPJYrE)vjpzqiMESv|Jdo8ol5?zI&0=#(h_*WunR@F4>NCrcWO8c3@SD_<%;x
zyOEU#DkFj=cQdGvjuwKj0~kz$06^e-U$jI%<y5(^us`UrOdXn>u&>*>7FQ{TvsmWx
zNw~{nJ>W3fsG?csTwF6)9%z|8lAmOnr<r)?POi!1xMpw85Yc^&kzen5Io*0*v?dpd
zXR`A=$kBviCJSZc&E4X9Xb#q%_oN4|+Z)DF4&ENJ9c9Wr!wRR)RUW#C6X_|g6|;ga
zmQ>}y3_cOc@U-Na4hz}0lA_WbI6V#zjDv?0;hs24>q6vB*cv>pf}Jj3og<!I%|L_8
zpR~#%J@{r9&xF-N9(#3)21DIeHfDsPZXj<csyr|hfPb8V*u|iJOH6|pnL-7`nI2m<
z<zu<4;=eCO^iX;`-9!b2Yk1j?GPo7!xb9Sm29nUC#;4%TL`R}+A2l;@SgCVHJPAu(
zyiRs?Y93RU`m4C;5tB=MLE`>2Zfo16q)#thych`z%Np%C(FJFO@6_oWnlGChQndWw
z8w$SNo0!`14VN-mftVApPGmV`jLjEI(U!d7<!dW4^q0gGAOLr-Kz1qWb337Rk7=kv
zny~5e`yB=MBKIHw+(OQ^q;+b=mBU)M2aG%M{aJ5oUnY%{UE@y`vNz1Uv*c#9Rzt8*
zQ>XoI^V-Ny&&^hJxO97U@_VyW^@HnKuVsX!mboM4ZAL33xMyF=EODA<y^6dor;Fi1
z1QWJ(rHWY7Hth<y7(KnYZ9aQHiO$x_I&m^)5Q7bSCYKc-+i4q53llLo8_OGB8mkA{
zmnoiMU@$KjkNPpX&h@GNW4TzwKJo2D5e28Y4u%OBtG%1RD>@_Tb+UFJ2X>x%tlrXa
zRyE?#LQy*PeyB%%B<;IHiPwD(!eaY!<hA@pb%%WLal|XWWS#7`#so1aM{Sg+5kzyf
z;oM=!dd*0?{K{*s(wgpbnuxT{HoJA(PQ&m?oJq`l#?XWR&N}=nO#j9NQWpG3wl+oD
za&&pAOdP8pmndqbcu)A%^hdaqIZz#jLNt=k*T7cUvS63H&!<|ms6ic;*FF#qe;}`J
zg|q>JQtlV00?(bi`!f9k4lu{){LXJr0&yHd%~kX;5M44;cJw{6NUS%AeEaU5KqvRt
z(T&P0ocMeN?=#=z&*n$1jMjSEVfBT^<FD7?hmCFNZAVKZ_Xk8?VQZ+;Ci2P2Sv9Wb
z$~mU|WHt9%noAVxifoTB+`asyo)lg3jZK?3K86W$xRv3AR$4FMbbsl4F@|`hPxCJA
z0Y4;f>+OP@)Vc4EVK{T1j~4Ooh>U3G^bl6>Dq-I5+LZE2?IScf#z!g=CtwF<J}_lB
z^`x?(8n-;G=i`3+eBG&>+q!W>dYqaZRL%rieD<T$rKsP|j5&7d%-R&yKV;&{NM;ZA
zwxZtkRv30#iy<=QRu=BF4C~pcAHJU1D5IVkx7V=?TCbV!*8l0zu^8E4vfuyS5wEjb
zGC~0jK{bzxTB3&r40w-aq0{jbc;BP`ws$3Dlp$jB(z%g&S*jA$s@H*7xo!A``)cJS
zFL+wWRdbap-#9IG!^Tpos+Ee3p5Dgn^;;?l1%eZv%ktWb{hu$9KgEKOIz`L~>mf(l
z{eER_ncTSQvO*{!&N*>xvCVL09~dT#!GT-@8{k8q?)zxc(&yKA$(*!Xu}M66k|VZZ
zR3nn{e1j!E4fcv<GHpavZyi}!Ugt^1`{~tBy6HIiBq1;7^rT)({M02KuEMTgWnwD#
z%)}@z|E1y;TEWEwm0Ya`ilyz`=oC-q*bJ#F+Nawf*{%C7)^l+)1b1;Ng*S@NuYdFR
z<0^B~XrH@p)??~^mW|KbsW_-ux03RjxIT8p%AB9?2K!9^L~QTrH*ISx8!*0#+Q^QB
zC2}UkJX!DRppCkf#PaM;?L=8mND#Zrc)k~7t`gqNWA#%Ur_t`%W^<g}BhhriW7opu
zO@nYX`)-94shrdN)fI4Ul#>JQpm~(EpItKeW^w*$F(Umj5>*Zw7dFFHyA(l}$B_Ag
zs_LCwWGgi!U|5citT?WSxL)$?8`rN&-6>+edN<kdl4hMrEY?FXH_nF;nuw?8E1jfh
zRaiiXr1@PVFhjyvD4F|x0Qv7nRR^0D8^2`cmN&n}GRN|vxEJl$yYsMJH<?xFrg3`w
zl}39UU6V<IG!q!^ywBLTRu9>;p^XqM`ssk=*DXf*rzY9wZKflm(fEAIkHp1iP<|iG
zQk%-hO;EM_bIR1IWA*z+P@4nWQ~`F++0I8*LVQhdN0F^;nR5yWoZ5t1?RnN_1-j1C
zhB%6yZ$iBV4NkqeGT{$^u^nG^{hcj7eaN-eS<IQIaiQWY44kSp$FXKjGwA1XUAo%K
zN*pGkhD<Z8iTC1|U8l%%`<{wki(;l9Wi%;`LzT8ms;ezW-jkZI4AV7j?y5(%i>6Z!
z3!4*gyP?9ge|F?V^HW)%ZJimO1O#Dz;uLDHTBzQefU6Um<N3Aq7B`_I)|hzxIHAJc
z@llqccGHDYCI`yN6iu$VPf~btln9@eghaJUo{p+#71|ilT`kt9;gv%8Bv-9A4yseE
z;><KfgzQd)=;E4d?d=bI^_@9J%?h%Th;CL%(0CMOc{DN_KWo8}h%ysgy1D6VQrawa
zC~zI+g88wM$~RHyy3IH{7ZLlZ#%$-(o^69*qL^D*>#G6eqL4{<+7qC}#e^}=JvKRe
z?mfu*(j|Twz5-7`bblcn=Wf_&)^y6$9zrtE)9-)HK*MA<uF!0z0V~rgG3&ewgui*i
zJL1^#w=9Ssj#7N+l2$jxq}6sQy0Rp*RJIixGk%6_hf!biQ^AOq71jv;yjYU=D<fQ(
z-n2a~@~&F8-IW!{<Ht%`iA6;7S@HV8WruI8zKk@2o(w@H)u^#@p&=l5HP;_q-TPTm
znS$3lbMH!l)=qwZp6W!a*+B6?p}J6I;4PrZlqPTwgsA3oRvAN6o_y1ymDTu3ruBNh
z;cYIL&9}GC!YDY+u6K5g*P#>y9A@4k&chH=*4*u{qy)b5>r{C1EJN4%ok?x`9Lbmy
z#q)XhExW>dp+7`KQQ<fzm75*uvrcQCSD01utkA)!*uL=W<ZBIqZC}4Ncvp2KFa@_h
zADjjXi@xN<gQN4yu`DG<Bi(4jko1c@_LW<6vDHbFwmwxmi}&<>@Wq!s^6NeD!YjI<
zTEkDq{cnl0|H$48GXWjOw3N7Ak{58g+k90G&L6)GN=N53=fQu-_(ZlUXKVU35;$%c
zHBM$!>bC#J?+kTWU>(mtG}c1%j)oO%&7e`fl4A|7Lv?UhI_3DwdbJDcPU-9n!Y*xm
zy=(8Kva|+XL<z+sSn~jD_4+_m%YxCF!>xE0y49&2G8ThUk9OLHQo;sfQd!LUz2dO-
zij2BG1Yx#9iZD|!Y(4?OUA5)f8pCv#bjWfs@&h}8P5h|K?dR=YYi?&uTtCW+jcLo&
zjmpd{E0qc1FV!#>PsIDE<x$lk3kbD+6E<tHQMn3-hEXbo8akt5_}8+DH?FOQ_CHJ_
zMPpQw4>qt17Fzc^vN+3QoCGNk7OYEbt#{p&6w=B|e(C$7Op%_CRe{WTU|+1D-N<S+
z`Kw~1AE_(KjB-~U2vWo-xO&YsEpiOGV|Tl>%h|i1!=Jfyq%70ayGmQ)e#vApU&C_f
z*W5DGpE*`Xi>?Jo6A+HP{b5$ImZceZ8KQt6E#?{><8ImQX-*fg)tVx&<IYKYpqrNo
zr$>?WnYH|C@Qa_gOhgo2SYP~xatI{(R9CH{e8X;IV6mUP1g4#Q$0{@j?JtmYEOM5+
zKFb%nT`uA8Iip87GSRa+pFbX`ILOmNJ#g!DP3!u1H`4oisqgtyM2*XwUY2*+%8M{D
zKVl<-`7LSj<R^au`3{+*L-XZ)%f4sw6TxI|r$EP=psBNm#mhdKm@>QBlr#~iB<1kD
z&6ZhI%Jiy?NOeo~lk;s=`s%IB)=Rp?r_jsjnu}-H%Q@L+ldtK0GEzlu_)o1ePK6yl
z2CCyrDKd*M`~yNWef)*w%9A8UODxZNR82JW&R3!x&HX7kvCRp(GlKU!FWW&58@g=Q
zuTU)ZBa}9@#I;w_L#f$1DTiWztzVA1VoMu^ne<RrXwGePn^e*~J&-C?mMnl8L1eHd
z@M*i+Ox>q^>5EW!TD05MBsa@VLwT%katGQt`ECn$zdcjRc9yo>`iYbGRVejR^KnH*
zE`b<AyWBRu`4CfTGj=nLK<ksYK+ma6U69CPb1SznyTaqXJNjDU^GFQdv_lF=wENod
z0Hz{~HF{~=K3b(Y5NhyySfT#Ib_Lg9Nl{_VW|b4Zpy^j)z2{88<7-%9u)40~gjRFf
z?z8ThS~lustXaEG)b=~dp0>lLeG%m$a-KYpjAUP*tX0?Zz2`lmRqO86;2AkezkN|x
zeiT&U4=mL)4s3eqg?F=w11=NmkE+_{spa097pYR&Y*D0bPqwcmouxhhbfncq=O?s*
zA^7f_?=CA-G`99@r$*kcH(^cW39A&(zBLxbjaFu2otAwvY-w$633R7kby;66c1<Ph
za?oMkp?vC{<EsmQLAbrbrtgDx(5VVi)+XjB@o>wGh26e3jq_-I+>-_2`K?v=*wkbC
zQ}ax}xecY*j?QlH!l>&KNANuI2T{rx4Wy>lq&u=tV9)@W(9<ASeOJ=Hq$Gy+Rl$$!
z>r)<H%a!c%2D+GH2tJW9b5GYrP8`>5J<<e1&#=;QN1LXnw~ssgpSHh{x!LsamgHk1
zVVsKgh=Hk{-FWGb)!03wp-D$L!q?h=--RJQ*1>)HtHg*An@F|u$R%V?(tC^b&gGO+
zW}u;%X){qZ!3wK(oVQx)&&nzF_$}HRE0hEBoX^ZOMq<TelP&FfL?@|s^RQ@>T<d@}
z8td-iG5bP}D&M8HSZkAoj*$|#DIYExU7FoVuQk`EI9^-IT!=QCCg|BgDvKJxsvh;0
z0ldU$i?aMR9>HJOR(b3fW*#dQvd)?Q-V7=I%0v8b5tbcI%F;0FC7hC&$7)YtrWS&E
zFfNU04w)X`3LOy>m{?2z_?J~GMm3<3cS(LIi2?G@O5TV);^n6^T|CvFXE!-IlPAbf
z*PD;DLcGNsK2)O0Lz7Jo)YEs}BEK{TlXp4o*TWT+TVn+7R;=p0QsoZ%a$1D=0gZ5x
z0<Zn#gDhCBx^kBMZ0QSAg1Zxv>wDe@^wEZuW-g8EX=O|rUy6kHRHQ1Ab>|r*+k)!-
z-WQ0uO=%4=Sc>hhT6@6kIY!`EdnXUvK0+S;W&cGod%uZZwnF+h%iCiws(!xQ+lAYk
zpbGO%2ioTE%kbGx9(=}@msMd-?->k747-x$>Lzhti(3o!*dmK?9o+1sgbs2ZOh`Ct
zr|xH`i9R7re7Gm&Q9IS%g)b6R*nxia2s9UL9ny!`jqV+i#)g&!ch`{BZkX+v&B*S(
zYV_iSB(3`jISY3tl}E{QY~R?)_}78(zoX-GIpQDk)h>2@;#y8P=PW&qKTDVlQ8%{I
z&hS*F_*owgk16oQ0*z!DETd3cSn98Dw+~l5fr)(a7Icld!KO5f+?;P$&s=~JcUGFo
z-EL=rc<t*9o$bVX|Nd0AaG*>*s)fyX*7Zia%K4qMM{&I6Rvd!X1lXpm?&01x+=0`|
z*?nQMPXQ6#L;H+6v#+BKXyP&du&ZmW)MrVCe%yBIcH{B0OeZQh+qtV-?&B}OHGYY1
z;J5bOy~g*^o4@a&p2DprBz3v_G=jaLq>SDSYvQKs@p|wQ4e}(2p>~-KyRqng|3s*Q
z?pfqI2`w|wjMx&ORXyzKY^d6)mk!JkO!V1DFEIiB5qe3P1Vk6Js|YLo)$t`wj|w?!
z>`&y@4qpKOY4_TXe#+ENDp|%kYii=&2!OQ9s&w+XdMIxC(TmS^f_$+Q*-ec_(h4{~
z6#kul&z!y0kYH;3^xz7_kF+_wHCLID!EH@A>b`B&3W|LagDHvYM4S!nGh@3>EPh}0
zA{?D8>b)BQ`cjE~vzg_xM|Pzl@D--%iQ%{H9^BQ0n<{X>;ry}5s5Rw$Y#nr(<!U7F
zyjNO=uitAks=5tNeTt25Lie@%4r93!RCBsuK&05*V`#Mc=VW1jeJYLlk>Wg~w&u5b
zaY?RQVpKe=N)bFS$Hb9JIUlsk%$NHW%j+B3j3Dc&<&Cu=g*c!|M41S=jq`_k*2*R-
zZ4QvrwzCc9`1aHh)(+^?`0yJ^n;r6cLId<6d&T|m62po4Zn5%85@S{SskKL3e1Z!2
z`N%+8?)Fdn=QVL-409WFEETX3#M;II-mAa;0-u$0^_IJCm|zuMKCk!Ouk$H&Lc$}w
zY7%P5(-Io3aU#_*4^*2D<~m}9zMb*om5hUq$i~?i5o+=zV1MM$O3wxWA?!>v9Muhu
zphB8i9#Gby%*!Rqx0JLgiuZ_a$i5ug?a;Q^-(Hw#k1dS(BB3^xdTeh-zszfN89bIL
zA{#M9MGpm>7mHGg(OR801oB%8ouq{hOL{OYl)=4QlLDUPkRYZ%Y2jbG;rX1({!+}3
z+}6=*SJb0+0_%?|@kE2BZ;h3=sa+07iOAVs06Zgox@l}LBE{Nf|K)nE7e>ayLXai@
zVZ7!(A1`LFywZEGWaJ5Ec!N}JFoR5(<>gn<MT<Q*Y(N#M@AL~0w-^)&YRNe?nJ231
zZ342s9SmX+Ar3*ykey{RIIBZQXd%yq!H~h>y7c%lHk?PKv-{^zu0~e{QI-MgNwc^h
zy)x(bvdMz2tocylQQ=-SJx5gJ>iAOz34#_2xtH>S$DwsTA0dv|NXY#q>0W;1(P+Zk
zQ{@mEk0E@!R<A+V`K%Y{Ti41P9Uj;60mMsGh`tzY4d2se;ocmh$t<b`%ul9nGk_pI
zxQv>-Q2({~%FgZHv&SGBu4?<K6x%)*0-GNl?-`Jck9;5P^Xd)Mji>Hj&l_kl1&Qr-
z^^eB!Yf6<`E}H!7jGCpd(pE>Pi^I3rOj%k`ZsQELV`6M~)X+l5=3Y+u`9_~QL}I77
zlWU01v_2?u=)1WzieiwarL>B(E(_eOKNPW1-#duE)DKma+RkyCI_+q1s0Z(G?MkU+
zFn!)qza8qqcI@_i?kVVl%Ldv4p1Y<|=N(HW<T`#ZOnt?BR+ULBvj~##AU*f7Qd?HL
z`t>Y(!O&{)NpFG~A5u5^px1czm;V7f`gdeN)Ddv0S92@#>5T_3>FWDI702T-=!r+V
zA?-{Z3v{>l=FkB<K=8OfibG%2a&%6fN#mifN+;>6cU5Wb{PqaZ#X(x?J6EA+_N&E@
z#S}jm^t+)Bi*gR1l?K~|`1eaGf)G7d)FGpxP!`|0H!r6Hyhj+6o17*19RrT@Mdxx(
ztz0HV);zL0ceUdFN58C)rB<T_qK&DWEirefB?b@C>aWZH95?4@as=zSyeNDfG|E(?
zvoBzcx-0n|Ep30{T(J0ymG*QFw?P96_SxfFdf<7^uu>lsCce-E&>{I0K}JS}^k_Je
z{b;mLNlfdrL@?85Ws=C<OXLc85hwfUa1=B5<G3N`0MMG9&DDpz$ItZteDrrFz_NKc
zYTdeVj8Xp!A?B_L0`PeAz~Yn8fUg+=64CSTul$Pv{d+9`HlqIyY5y7P{=ItsuX&<n
zgDHbQv;bcJJ+A-P#`W*9{C{b;q#MYFVQYj%n@*-TxXZr|QR|kwc=kjg>q4T;3M;Zg
zlBkW7eDbL?de`YP24vvhG>(fq{s=ed9vtOQe{er~{>NYbBfI@?AO9T%B>p)%35}19
z>;9P{_xlLqE6N*vjdXtwKL6i0_$mW1oweMzLynK4{~4XWc?<&6m$Ib(#|35odQc94
zSKsNid3f`r_qlKhutg*u$z29v;J-for$5!ui+}ukF#q?o{mD;%59Z&N`6p)aKOW)l
zW&XF%Jk~h=-hlr9xB=0rI)-mfe|xey@pj#GV}_x`xOvKPv!Cfm=>znuRBVf5V<BE1
zidD&tf+VzdHg265N<2BkRG`IB*~EqJ>&{wdDU`(S3L@;IBku)B1M#iTw#`3U&d@@H
z)!20^4A?<aAt}4cEZMndDJMoV{6zHHA63snDJ??fTI2Z&L$J$SOp2e~ZIb#HlEgQn
zOy_|T_ku;sG+$Qd6B2{}L`MHfUF0HN1glqRR}v4SQpC<iGfgCrmU;m9O}TF@N@d7K
zt25$Ji#va%F=20+JNv|zB^QpwuFXsJs+^^n)pMDo!f0IdP+Q%iabvf6Uxgt)vruAI
zcS=HTABH;Nkqlc|7Lj+migg97c6PQn+D)eFaE|kBrc4oH^(uvma@?eY^%nJT^Fw;W
zLH<%OM%tk5AH9$po(&-8A^^|n`NqtTOtaAC>y(tsP5^S}+LA4&-BAfJY|^IIv?D+m
ztTjo0sIAIng#iF70k~V!slGeZ=RAOUMrO&xw@yN^^iKjVXQxLo$TU`vqxQDQp_l_n
z*Y(kR=3Qx#y;(BSiM?4c<O15`dmiXx_|?yUbDN7gbqiBor%uWJh2zd0rmR-o(9|tg
z2KE5ZmL>*3EO^U7Kb*%&yp=MbVfTHao9t0Q;WMf!bgdLURQqF1uons1i_gDC@D;{s
z+cDWLYy-MT<UEU75;hpLdL|gnf9lC$Yab7C@a?ZE4{ELBsYLd}fm*(dUER{NTrI>0
z&<hWXIlH!zEuE@G$y3#!rL^}MFol{rw3n2!G6QxX4&9hEz>P@Uf$)3p7TsWRh4<&`
zYWHT#8H<VbntLO;m84RRgOB`A<ayzeA3aGa5Ux`4nEob3mC}_e_#%9bL$G<R4Um)o
zizTmXvz)`(L$AsO@@?X2Kpn2220MurMXsLhjH3Q|sLE1t%P2hxZr=T(`1&=8uL5xM
z=k-1~)1?wJ`P;A?b)O<aXm<Q!;Ae7NDTL>!DR>XgI=L(4$Mx2DC|hD1qtT|wt=uc9
z`K(EiGlcR0MIkkL`{pE2R7A8*OPrnm#Y?iE&f5&||FL1Idaqc=L)R*5Kh=mGP?J6!
z++x#4+$1i0rs{fF+sSx~LcKvUIPQ6}6pdR|y6}d!rHg%INuz!3UX}3v^V`TO-z<+{
zuel+_O2^Wt!Kfx7C><s!G6R>~`rFXHy%tmY!Py6Nh};~tw%<Lsf_lbxla2XFU=7ni
zzB*jty;lw8a2l`6XYP9J<ny>bp9K1O=&21-R9ckB7CAr0I;(=rhFZu~_N%zBH?kjj
zn(9y1-@m1E&c%x7WzwJke+EJ`@~hQVw0X_nd8xOx<ywQRYjzrkO3_Db$z@;Pr!hbb
zcz2InKk;(cX&iQM94WeJYT7v}A%@wjcSG@>E@ucv?wJUV+Va|sKcM_gq#{bSRXpx)
ztmrZKE6|%AbVO`<0D#9uQr+=SxqNuUSJ{&^N6K{1W0=zS6`YXLL@clPe^qZp0U}+x
z^&@Kfx4+=sE@4ZL6!mBicgj!Wb^_#6tCOG;N(?fB7+>rJX47bhrmNUj5+1f*xh|22
z=?nj?`5iBbf!ZF<aYeoX80RN}=2@;N?Rx~8JEQ5^<<dh1BBnE#splVVFm1;$ZKNt=
zeNNB`c%%H)Ep&k1JrMMh;#XkulA&l#;t6)5`tn)klJ!?5-({`#gHh9&%vMf|-(%=c
zDtQ_blQe?QpVb_uX<iwwdx-AiFzH_mUu}4v4qB73Hk+sUDA9Or8>X*R@vZjf_IY=W
zoTqf}bF_vf_2!%N^|(32gNjOiwQS<1e+`et7pLWK=e2^(-pD6zr!JP%xq2+ktIHB*
zLuv**yCAT8XUYTz{p`2-M#?&qc#D%0#itvkfB8-M6rv;Tn|y!i^tDB!(jOwXYidjF
z9#iB+#|>g8?&<2U8olXQc*=?|_8(8G%%f-*aGLvFY2E)NsIrgFa!Os#slXb&?6rO+
zmeyQ0R$bp?M4&Ks{l4tBfGe%V!!mi)SVxUzcAoCG$hIht4>~a?BykW`Vl>aZw^B%r
z{?zCupL*rX304O?a@lKBv@|iw#oyl%HQ!!Kwy$$q8>rQ&FFO+iWL3G5NxZc(&K{#v
zymp+;`aXNH7c&L<Dwrvsj}_U)TA-nEQZR!RYPWsDhq|4RyuzIo7StGm2bs3M3l-jR
zmP!;g&K4LHu?VLYV;?Co<7o!$7u5LJV%M15%VE(^*bjPj-jdwEbLZO&n*=20DY(o>
zIy;c7ntdtr)}Ygh5!x`7SL7funo)sFx2)pvyUlD^T{0mfVzCa6fK7j{rjIdvV!b{@
z0zKsh&`skL%~hh-3nX1>1ywQ5i6yZq4)&8&b&LhBt{XFwOB4CkBMO-Hdbig6!n#$B
z#p~VqYOu&eu>h|n(IQ2%&Rc^9h&aYkQFeez*|8KfA9Q9?qCcqCEP3j%G+G<)q>Fi5
z+d4|5CIeRVQpm9sgMSc`#D89*_jtDQj)<HZ3dHUNcPdnzJ#;Z?c^tL<4S;kc2K0;L
z;`Lq6H@hZ(H2-KWygiKrD(Qvs?5axK%DqR-c6ffIs5ZC#f>VLVR?sP!UXgzre%2N;
zRqMFFZJC~alPyUQ!lt(wtgH_=3soLEW!Q69GQ}9Sjq1~$q~ia2P+E+3s|6L-?wv1J
z4w{`s0;-zry#1j`iduuC<OA%2ZflpPbgSLQ;^_f)pcm~M{+_Tx47+`=d1iNm)J$O%
zF@%N;+;-KJ5tCBYLR5`aW`0{#W7Fnu29mf=Z=jwf4ztg?cwi~Q4!u-Z><?3Uh~V6@
z!Sz4>LHB?lN;rc@zfQPh9y3Ke$j&14P;@?AtbBi5trroP1NroHW5#vB+wQ>DI5R}P
z_SKjz!h3W{0^o?B#>Wph?rkz`Eggoh-A)p6V^8lZkJ-=_-EBjB%&F}tny7#Tny*@Y
zRp@*y;){QiDIKk)1`TQHV6`VWjg#>^LvWYPV|D8OPlv~pldl?x{b;V`I|2S_cz+iz
z&GlJ9b)=6kpiwd9s~1MPtnl%V6t40149M)ECX#lv28$<^D~i^upCU?Kz$U6&wTp9*
za9(fV`O_rLA1NHaO!DWO;?{cBiTc$xlbh8RW(FXhB$)-GTi0*8N-Jev?PKTWRylyn
z;xIe?c(7%fi8XnzjlhSH!=lg0uJ4VYX|i3D#nUbOvfn!kzPrLHJ_7ercn$AK7xY4h
zqzI+=G6p3uI4vyNe`pwZ%MCdEzrC8x`0t!P$Z+h(?~~kmKpVEl&#T*<-wArH8oB6u
zBV)v^q3)J{DXinJN9P#xC^FC+ctcM7ihZXtx3)uDzop|;E$oaaAR_1Y{zf-#Vi2YV
zF7MSRh)UlgroL3KPQn?LTyuR55O4KwW?=D+1>`I~@a}t}lw3-jx?>81$TutEm}I%=
z`=J(BH8EZTj?>c;>cK1dgvp=kQ0Z#-;X*BWUR#q+3NpEBun!}AF2COV=tai*44o%!
zubvgkDPB!8`?n4APaGS~(QvPz%K3iZ@mPV~aU6po=s}B4QRI#R*vG-*3I~)gQCtK-
znb232XV*ekfjm=|W7da-BwY80*!<PJz5ZJD==>W@I>Y8Q06h~A-gWOXa^^>{S*5{Y
zt-O6LB3l+`SY;{Xw7|MIH5<M^UJm-ha_%>TcT{dKaRm`NoFzMy?KI%(cS{nouiLT`
zJS1A^jsp`TfUFY}Y|UkKo%dYeE^dBy_}8!Uo+E;DgZ3BpTxb94zL7a{4uAH1rhM(#
zd^4?i`+HKx&ON|uYc2Xk`#h&hH`O(%R-?TwVBoV%`(Q34-w7qhqET%-=8D_}=bBzj
z>`=<=rNPN;(4)jDEV}CREKC(1u%)4kN6)n?cNG&#q_1y(j$u~TyL6*Uam{zy5UItW
zerhj1t9=gpK04L9DttwTqn??Fob8bq9@`pFHR+LMU8s(t8@}w)QC(olYh5dj_x?P^
zP)#M~^SEw**&6$>N376Xo)q#*_ymX0bL0?Irxy3Zy4z|zh)gE-i5CcXxDa41%TA=`
zTFL8R&3{k(UB7;PCS`d%H{*ccI?PF@98c}oj3Q=mS?=fDYS!%XfNd`iOd$CMuB7?m
zHTNvngtsgp>!U7|EjYD+f-tw9&p*Q6@&060s~&e-7vZ!UAKF9?+AgRd*>z1nli748
za^-ZSZAC{9<dXx3Yc^#jDiia7T?#r4je8$`za5Pl%gRK&-5h&zKGEr$*%#yTU{B|@
zUOB75FZaozHq#`cx8_-kZOWxryLY=RjlzTRe|<*0u20v>rL_~wUBT}&PTpH2fqQOm
z!ExS3|EI_c5O&=K$4$6GVt0wDedNWdP>ev1pX?#sN&<=0bJW<~5`cw!{{5`(=x*|c
zKEFagL|rOu|EI~?=xOs>jU2RXFNhxHt3hAemZ91D8=Z@Yb|dRb16{Qd+nuLl&6%3;
z`>v#0dtcA~l3^QT+!2`a7Lou5Q44v3WW(SExz02M8f)>pLOXnN(=lCLk}D&ad~1Se
z$Sz(ZeIvE6k&*;=_h04xKUsqp=u^c@fQ-~miAgJKdKmS+3@HfRK)!0|c2m;G{^C7b
zlZ6l_rAe)QzL!1o?)A6@7I4mX%xpKcXS!!BhJOhTPb|HNij?QE%y{W~JZ7-$%@;}=
zVs1U+2le}H?M?LD-2LW3RlcaV7iY67_32b^FL_<@&Zxh<IHhoq4ki~i2jkPnT$EoH
z5prAWCsB_2{?kXzTXe_EAbxdlvW&F;@Y(VJ%r>1fo$~G4z7hG-NJg@gp8uY-;*3y^
z^dsIhzyIJ9|Mx3Kxc}pDzflzq=>{S+e46ib6jI};1e~6OW)yb`u4JspVO&JKcY}1Q
zyhp0|ax}I0s?e<v)bPfv<JY$Dm!&E0j+B^2QwfyFw8cDXuI)|}VZowN@xg|MN~O;Y
zH%QtDJvma1Cd$#PmGCG=H#>*(91|%2)|bsyprc%ClmHw^oqWYnwyK4%r`#WV?eXw0
zAOir=QbQn2Y7vUL{p#LdUU&4)5shaa<-EMV@!Fm0#A~NrK*d5Y{Z7;IZF>JXjA^8F
zKbI?+48{N2;a#Bn`z!xHGnUWiW3TDfda8D%*3%=q16zN{#Lu^pMdt65oLF7Mlb&Hx
z%8rSMxDh3&8k8xM{Niz6R@4n9CHKt<WsTEa`K<yaEb0Yqxqakw{fR^~a-Zk=e~p}A
zTL*3g+!2XPPqbQN9>G8k1!iGXLa5cPU%`4vCAMNxkS$Gm*HS4bsz3J$y=q=eTEqUj
z&pQvNzYOjGU`t;-nwvwn>aL+-{JhaHL#6vhiN_bSDzo<MR-8JdzBh`!9+wbkDWsK@
zXegxfWyn%QDV3PXo1cLe-{yt=5hNa0@tdAvzk1VEGAvz~QJp=|UI6sS5{#Z$eut5d
z6JHr|GIZ={0~{R6q^9rBXGajRwGX93P9OJO|FZ}C9p=4Wd+WKpEeV>Ke!kNZ$5RWS
zVX3QBOwpd_$f4Vl#*AHw%~laSPT8gBG^0JQyVIQD2PE!B0391r<^JK%Hz$&|58lbN
zitdB#QJR30MB@j+6~}LsCRzXOLI2O)<I%-M=1NLqSwkLSFJ9qlo@}q{Tb@ybS}t3o
zPRNE1>|z@9#tC!r5A<ZxNYand4AtN!Djsw~3WM}nm@5!jOS&qZDo8Idm27@2PvoDE
zC?0V!vv?*XS1B-%A2n?3So;_}M7Q49M_w1^H_%p|U&7=kjIhDY=h1?(6nJ0epPr9a
zKX@#0o4^UT+~SK*xOIfh8CU4W_aE)8yo8WfQD&ujwUl-8ob7~+D=AyAPI&h>YG1>6
zMvI&0JR|9eOS3D`aZJjih&fN&v}1L5|Cobs4-A?qqlIP?GW`Y(QXVuN2XXx0bGUm1
z5+wh1>#qj_{5MDfl*uoP>-@RE+`oVP06_otgI}F|??yVn@Ft{VKVdMz%i%#WA1BFw
z^1Y3Y@BwG9#{YG^cC=P~!G?#wdwi?Me+|*2BN5rtLG35_B)ZqH>j8?v_gdJA_x8I5
zfDuin8ck0ygsb9T0opjf{=)ICOaFK%@ylR@j8DyQp0L8fw#)$#2l{XSUB~6mT^Ai8
z7@<d}98T14zWN&o4J~tgKT%AS?yA3d-mQZ3^YiaXb3iKpHoa-vjoxZEJ|JzUTT;^;
zbj|oEFCWF>tLK4EWQ;bwEPUhN4eQUI^Sa)&K81yDwQFsMeo>2s%Tn*7kuxx$_7hJn
zbQpJ?;lulLnjc*n0z#WOK#o}{vxWHLVW-S%8h^u(i@%c&-?QWQt&ey^T8|$;&IH7O
z!}o3r41Y0$bQJ{nSiiyPwCnaE_$70}WIt}3mkNZJ7gs_h_CoL8YFgwoxsn0eTWsFb
ztg@-hRG?*c@=c<VWRd?%E1$du2;S=*1ouv?8PQz>7EVw4<KbUC<UjU@uR>=IE3^Dv
z^t;~?#V1fK{`>^fsdSVaEIgDOEEuEH<~_Uv1lMAc?Wz=$c&u5g#4Mdbj}Rw7wiO-$
zOv2SE-<P1yz(U3n7caE-g~MZWE^JLL-TJ8Dk_c25K}BSK`qPsrF?~HIt<o?3Ft7X@
z%ql-~U^F4r*sPImr4^WVd6c)B*P-L)9Mj$^yfCFtL2N<~(D6`I=kr#_%Ju6GeLi$&
z=?@h||7ws*bjk%gwt2>|H5xN@7z64zM*@zZ3woc@@aWJ^_U&M;o5b|W*&(8!RW^`o
zXw6f#o(mT%YhCv}U^<H23CqWon#R{@FgqbVhn4u|HMa`)M;$d!mXsJWLDDRWMP2@I
zL9{uZLq8JGep)_|<(sZg;v7L95dh8WV=A*s$0v*QVzB4**D)K5J-#O6751GPpa+%-
z#Qu`@R5M$N-Gu#u7tHlYWsTbc1n_E&rNL|I6+YxREN4BbSZBFUd|6B6y~6|`*AdUo
zzyO1MU{PUZWCD$+?T(lc-n+jvDxH_2Y{tquQ--jp_2e}7#ZQB$Q6$uYtZ*|NNMhvU
zyG**{<SyN0rgIzDo2n_?x~l$TiWwx>2EAcXrtNBNw7zz+ltB1k59jLggzT@D$HRY|
zY;sxAYhs2pv5aonPa!7hqBv9h8_5L<u55)E&}B)m8+)*|vH2@Op<@FO;+Q6?cH(r^
zUj3|J6e-;C(#%uIo%3y_I^16oT<U>`TNt#|FN#L5*WltVQ*MW?4)2x66uprJ$3oOp
z2bDt7w*O^_m&R9X&yoq!@b-J*p!K>#AHQwg-hvke9yIxY`_u|<Hr*~199sQAm|wSt
z_Hz32Ee|OqYODWY)2TBFvFV*-r>I9#>YGiNH|1_zbYMYHdxp$qwRcZ|^dYgc?pZG&
z%0x%`>avQX_USH;y4{wGp3UYVe)}%zeRNA-{S@o{>oBkJkSw##<+ZVt{f$}1xk{wo
zLnl;<v+6d!CnJF1@+rM_jN;+*=|uDDgdAcTZt<I}8dUQ-!c!X*EU!G$txf6%cD>0b
zL@ZvHJH@Y^_GK*91)Q%exAlUkJ5LCm#y|!*%g4WZT=!|7@5WxjbGt{OaMSjMBYsl)
z#{$>YGS7)oHz4V=ZqgnnmSVoVtLKX&Lni!HcG+Ehdis;H*(-ugQ|U5^fNl5-B@tZz
z648Pp1y`nAzm%0(79l@EczogXMPfOmu!27uCA6=^bEj|<Q!sIVrQpSUTa=JG`-t!K
z>&k4+*x;LotS~La?~9JhlBn6rFpd`*!wh|Dhn0H^x8=}Fpc77q2k|xt>YDn2PrSpn
zZnsd1U^()cK83`kB&iOW^06<t-E&M)qdShj4hVAfYV-OEVq#5mF;)SS@+%@dvz)$o
z?=F|l%@wg}HYccGo1cBn{alz$e?l8j_LvVEF#q+PuZ6u`GMMlMNXgrD#j<HXv#Uh}
zDDY)G^JS&nEeRGa^xkuH{Po>Kz<4JoEJ;EKIxLq>Ql09vytQVHD+1k$x&>g}c|aK}
zMF7%d(qu)8MN=1Xa;_xtZct?OdEAKYq1~^00-B_O=EEh91DEcm^LzAmd@^H4wkAt`
zAg>?EA&1o4P3V`EIFu)CQK}5AEA@Pqgl?pBt`|;4zYC7jNQCV$7&rZ<%a~~0@uA(p
z@)|d>_Dw8w*0&c9VkCoo811Syo(b%CD<ZwB0Mm3!q%Bn_-f|YtST`kEP14Ejv%G`^
z{Z0izd8)^oV<+h*E>*__LJnMp4TP4bdOy!*tggYEBaBL5CIk)&W}O15fn%`C13!Ph
zbgIY0O<Fm++_b}YFa>XRAnh>%(O=%(?35j>8F?{?Y0({5OZrylh0$};tcOcNWerlb
zad^c)+X4Uix3AbU=3P46{v9bycdsP$XM_pt$MxTP@f~S7jr7B=$L6GYe%BmT^?zLJ
zS#QK<x*va$((>xYM)MedMlWj(-xSp{6`!?de5oxq2<}}-IH~6gDT-EH;oi=-Fpxj%
z>`H;2G$6eNB$6KGfJ!7QWWVNqAT&gwQ+7anmTi!;RI603FikfLMG9oZ+@^5iqUD^2
zfb6Zs)({ZR4N8&eq9Twpon7xvk?9(_{?x{G#%h)Gav$}Ej5w`^*8jNKK*BW-$~ceW
zxgVgLZsRh85GF;s+1jVS`kf6-Xpr!qioHbErk$93ZKQ*87tZxYySz>+%_lFFOHEf^
zjT(8t-L27;TK)Ch#EjrGFIGi}e4-#|`gcaHXdhNis39Xo&eO>=q8;z-)6nKRz-iSl
z<)}U@6jD!PeIFXu)74}<{4vdWee#Egl<xJtc8>bUaIrmEu*tD=)D6o#3#Xx(S8ChX
z6J6$CEg9NhQ!7wW+()A<+5D(!WL2liVIh`6vl{WskV9P1df}v($dqKQethnr8yvX_
zfEaOT6s=ndFa%~1uN|I|j3ki)-?u-Zmd0BUM7{k)RV}MbJR6^{jX`=}-GrnsqbK@9
z3;)0rg`0uO;o`^Y9igl%=^?o9T6IF<nrFr*0(FP>9;mO~1O>2UvVJy`^o3(Z430v9
zAcT0EM)?6bZ~sS?9Qke_X9bb$ybRgPqUjp58!Ma0wKo0nA+}4YAxUlsVa*8I=??W}
z$uJhy4mO{2*yhjMoGiN5l@)n!lIQe2kklvV{vv4cb45N`L3HnXuC-+Ry+MX|2#eQt
zZ81yPbuDcv{Wy69x4o-+j0|lu;m}67SzH~@qHUi);e$Zp+cQ85i-=OzYvUbK?l!TF
zrNN-C&z@<e({6n;tt%)(Dfu@6zg{!qwDpdiI!iY3HyzyR$r%;yS@+-5ZYgP^2frcU
z0U2GydVtJt;&dL(iqK+On(N-q5JFyDm)KcT$Bj-C&dYN_Ki|y#W|3Fgs_1w+n7FES
zJ{c-)2?y{3L)$v#cDgC^@bUwEHTI@*{p9-0+l$euQ}3H;tc~%nzTtGc61f7mJp^Xl
ztY)50L0;b@e(-^mHe~l_W$%P1qg#Y3$Bp7QxWc;qs6I0w=mzar{>|!%oI`vtvmz<;
zslQON-~N~9pJK9Ih4WhLl{p@n5Gpcx{{+gQ9^lJ$7y9t#J)hH2d9BPY>#0`y7l5K*
zxE|4)QRH}f6-O>RMgDx35T#aP+WdHYYE@W<UFulJM!I%Ge6|a_R&3d!SHIR8e~v&_
z`_$T$uQ+$LYH-+LB{Ge3r*YRDDDlgehl`Fr<4(BwrPOAm;~aK-6d1U7QYPX}ud8Ow
zE_wB`x7AN2|3MJBmAo18NZGoms#(T**J8A8;*j18ZF9PM%?9-dJ6Y}Dp#Xa0r0^0!
zO<$pU^VQW?MEb@8yK)Gvc}`i!r!RCJl{#m)AkJ>Ra|O?$c&z7KT3nV^wT95~1JJ(c
zLB|$X>7ex)sHT&w8)d&O5OQ!G5={qEMv=woA)En}{NdIDK;<i10NQ?c1;hNZN9^U#
z`R}L_N7G$e>fvUzx$;W*sc{Jhtnl$-@8D<z^ziY0GUtIz*TWY%pkHRv<!Aqkz4r`j
za$C2CmjzJ}P^5!m1C=V$JL<v$0t(WbbOaK5FA)(CX$k^T11ciD_Y&z+0|E(<K<EJi
zgx*5=X4ZGsKIiPc@p}Kh*Smj-To9gTmV4g!7~>vugmS>Jtm=-z{uaTdJR3-GNIe-#
z-BDd}g86pko0(x*UsV!O2EXi-3_lNC<oNZ+u(F_QoPglENJrVIH?C1tJYfY7B^W$P
zZ6~5PuMaE%4_u~2Y4eVRfiPnJMQPs@qfAptTNpZX278&e*rhEh{d4^T8W~C|y<Ke5
zACyaDt|L|B#}*Yvvdl_tKH!}@V&5+G0Ak>bOSWX(wTEsOYS3I>u8(aD)g^o))p7b0
zU=X)by$KIAS7*8i22$WcppB8Ab`kko)!%*R)NAzsXK`uKJ<q&t;+vt*0gwv3#eJ|r
z5o1pkeBl8!Yn<aGLNpFsLnHtUw%+xx2eIo2NYGQ=_{~XjS@rngoI<w18oTCWM*2?=
zwj2h4r5(om^Qrl3pgog2`}v8l2h+3itw|cdj!Sj@hL{C1rB)s2#Ngl9{^<9;zbGrQ
z@!7H-m934*FucdfQMx%&qP%s<cfqCv&SqWXG!1l5tSOHS5q^f5#`YihbSeh18Qw1Q
zk+F9ylpfbsm3GzTfO10&Pru8#C2jpfI&Zost#KxnJtwuM+ubGIqcE|{==<;tV6~$N
zdfY{%lx-hQGj9ZB2@3QI`vM1(y8>X&e;`OFr4R7%x418#6{#O$@}<Xo);V$V9}DcC
zTzN)mvnb~CTk50t%w9$uZ3HcMmTlE~R_s~UJAV!|Ny6ns`ZKF}@p&8La?FXlmCobH
zO?zMwa0{+c<zr(S*Jst;LO2f~#3Ygkuj8xI3~O*Ks*DX+zR(nd3}3zWAmW48mW=rw
z!x1!n){<Yag0e#EI*0Vz6k)6F)vn%B<b>WY^Z~6RS}rrskm$Yw6mZ>7MH{6G-;t`}
z(|Tgi=g6XB*Nxqsn|@ZGtK!!FMgaaD%K_H^@eD}I=F;Jd>f<|W@#*SdAuugsjBC9H
zbkzqCX|;#hDMVCh@$+20A;jY!lYsId24t}Yf+TIK&*;QQvY&H}=LJ7w4bt5zjyyxT
z9gnZ(ou7K;!Z!Ql*EEFr^-HWx{Wced00>GD-{S`9q-Y0?tra-sV%$glG;I36GeK~U
zwX=S~*R+D52Eta0#0F5XouB;TzO;>bIhg{(o8QsInuQ?Udwmc61A^%n`LW0$h=rSW
zNi1bVmi0`zVUbnjcFHjRXtOV}0FIvA#lgV{TFlLke@}?{PAaboa9zq1v1ZY9#C_Rk
z;9)rA(gwBb^vUbInmLydd4^V(q+MnmSf$p(zXv&t;GHXrBm|A?d<=;%=)S$E-}@{d
z&L;XX0_pl*t;O$(F-*4Jz^LGb<7-O2wW$c5C=b#mVuHhZz*o%`rk;GC#se5uclpIU
z0t&#&0m-;q8Vj#~b<>3CRE`o&wQLU!t1Gs0N|9Xs8Qz)GKt}cevj~!vB*GFYDf;<u
z_9AG)KKEj7Oya6mHq!@Rsh6vC&qifE+e>cd&#5DTVXYvqjO)BerNg-CM+hEid=n(w
z=eOu{-6lb)_%jJU6W<6RkT&2?IbEi2n_xCVSkHjZU{ogeSqJWvLxX{4<>AmF&`+AL
zPQ3)=IVVtLFv8uy9ojKKE7UPRfY?n!2LK0cWs=)rU)C+e0ox^ovd9tmv+&*#?x!RB
zw8lO=uBqHJSYWX_O|GcmpthD;B&YfshtP)W8B4~x6%HXBz{WJGZY?6{vog1Lx&hJs
znefL&V$xE5wPn}vtNd^E+jYK_ERCSFr?mTW!&RU(7j{cC>+71dFl6_Mq)%5L!ca%&
zlMhg*b-&!=kiL=m4|ML|E&nrQTruLUD*@%Uw7uRZ2&~0%NoLib@pU`gG8g*f@CW_-
z3W*>~SAF?lYPOe?@~ptiS9y_)fRIiP7P0k%tFhBOq5%bN9|R~RA3b{Xwr2U>Lp(OM
zp7^#l^1Jh$SVr$m)CRlQwhX$i78t9OnLcL;vl+YIR}QInOq*C(@2tzdL?7tRp#`rt
zYJs$HtiE+B+&>^)o2dQd!S};`@2v-X$Mo~C{0DJd--I4i)f4}0i)v1;H4(QPym^89
z$)@cUr-`P=wqf@>We7D)0zLtK-|hxfsqTjgwsZ`a5|Y8|9IHp;Sj;(<`o4uHRWb9N
zSuwO5tqED<A=a$<{kS|^;fQOKAxM7?ioav!G>nM>)&8L7nU958$3}p^eS+BT2y8#R
z9t30iF(X00y*B*kW5)cu$+w&qrEOG~>3#<!zJGQ6%6?ANt9?bx03dEUH^NwdJ-{q^
z33kH~kK7i{;x4QKUFRd<4UwTtvp%Tno=ddl0#`M-<yG<uTXlZ`BIHlrrF7NiT?vZa
zNs_$m;t;V6P==eAO5fDZH;94dq`wgjT`xVbAMWb10zdI}dZf#zTQlqVT|Z1gn~YiC
zH~!D@QSo;y--j|c<|y>S??8ql|4LJ3)k=H~c(lR><DB|u)y$jQ2WGqosI5n9Gw$(K
z0?O=cY&^WVe1ioA%1%?u&oZ?IuSzVqu-qp@L8~MpEJ02z2X_<Sog4=sMP2{4#Lnb|
z7~O0w*R{F?h%`=b*d5L&qM9rf1N^-1YUS-|wnQFkeLJ|_=&2sLWSHb@CTga6!nE3r
zD1_9hhSnMs-Z9$n^UbrYuiNi-a8{AF#w|I*FK48Lz6=}YuKG-TT5RbW&6q<>bxtL|
z=h1viHr2E2+I<{E$N6$bo0JKJ9awMTh-w_T2H-t79orTp$90>57l&B=lE}+nZ%;*O
z=jcFQceLid$c@c_+t^bK5?z+i?Vz5e(<6QE{v_0~uA8x$t6sC+CAW{EB%mPYq<Odf
z2&AYX#)TRXoW>ghr{0y`D3qH7$LSsKO@qgr38N?P0i&O*lP$iy#?=SQsov$?6Ns<G
z=1^t}|LF{i^o?4SY{bUaXO9)rmgh(isap;f#R=|~hsT7~5D+Y%ZZ6Jvzix53^x--k
zC-)w_mJ|_P)WZJ9C8?WNc`m;=L7n=V;!hdm>qnaBt6vanlT$VpHu{TSG#eRv6W`Td
z+Z^Skx|u?A^4NHCShqy7p`*LyR^5(ItY^w~wUntu-Gd!Sl)fKzY`HClJIQzRWm`<|
z%Fw4Qn+<))A^l~ASAQHke)9CWfBGVZ@3uv|y>v@i0x?qJ1!N1&nhU$<gEn-3l2b+E
zJ3q^jh@BUKCMQ<=F1@cm(SSBqqY|v$Q>qtlig}Zf<YX{t7P%jFcf6t$YEY|pGZ&L@
z&mv^H=JG5jQBR0n+qLDgx#h5Fs7h3QIg4F{J~bW3px}9ieX~SNXH|0^CEYyd(zY*Y
zQX;5d0)WMFv_7u0J#tCDsFx<Bi*Cwd&akVuSz%P^`<o-eITfanIiL48F}yV~r<<BJ
z%N?JrWITQ6KXq?EUx|~tG%g-px8E=>p8-!YaAaQ#4Zm{gIi37oYUjgfbarl;jl{%q
zKx11*Qp%n{60E-2)77-4h25T|3<LeMzR1a{yUSf@U@O^uSRhRKWY<IaJsl^xNuHT|
za|QS5s5<!3{Q2MAiAGmWJ)C6faE#gd`R6O?Z<l0a)zFdIdZ6MPTqi!ks!JbCeXHPi
zKU>ry@9_R##`+(lFUs|TFeZP6UHfN>+wd8atr0g>ID7n1=OzYnF+yVEy^GdlOW@>?
z<HpOgry)gcoY~j==(q%!<_52Dc>VMb(fn{oCG_*7l2wW;bp8&9%UIo&vgr5;(u8xS
z%kWDpuCl`}oTaFy(X24E+N*i`%RO{nhdCqc!|87p-z;Kvc?{g<DCV4{ggYi&^HX?(
zKZFR;a@OfWpXs>tMvVVb7C7A)WRbtAqG{kY#|2z2FR~su{um9>{I(OMxoDPEYYKN{
zpL)g|aaL$BF41(^zJp(k2A}NxK*u_b!Z|d0i{0+F#1OJyt35u(^s*09){TbJ(rzwE
z*XR}+wpsmY9@ZE{a{;##5RISz*3GFJ(~OkR#>3q$2OS#a%UHYlB6&N2&D=!6rk<_2
zWiXxG_DzD^0MZl}?_spCgHN{T7~>Na|HoMV(-#UVr$rvw^-5NAvkCOi#7)8;SqfqW
z4#QgRZ4mAmVdu91mO=$&wrBYD%g%=Kmsy)OTWw6D9SOr{LipcKqOygo8MXCV7(G|2
zuyc4gOch!^47w}UE58Tsu1`kFbCtU$gMj1IfeK`XY8UxgvOC&NoC(QIn2fCk;35^c
zTBMyyzzW6hVmKhj<RvCdL>%r5NYbsKuXf)p9J84b&LnI<!KR2sT=}+xhsy&KB8U3R
zj`Q(Kdr27LL>Q}ZRFFJZ9bGv6u~n|Pg^z>uyOHt?pZY#ct~u(@Zd1~L@Im7kiobU&
zWq_^RD`G#~f4icgYEWw|FeUEczu)60Pxl-8hZrAzT-dvMaYhhx`J`UQ17h>vBlkl|
zN$77cfPWJqPM+Rl^;bGw5(}%Gf`3>$`|qO2-ye1SWc$s_J$es(^0|+QH-G(PDwOJU
z398Gp&-UN`y}x7Be?IHK#`^z}@#?opb=@RBD7H+`o99k2y6{g&)qgKC5LusI@^{H8
zyc@9UGPYHYvPms{_627o?mUxkaj_)s_rEDlp<dYXAp9Wscy3pMh*CEyjJ0@vCTC9c
zw=3I%@li8dqSyidrcPdW|NJ`?z}arJN;bYjIdzq99eKWjhyLDoJX6Q4*b>ovsYCRW
z9!-hZp>IK-Up%Yd{(xlebb<?!>o=R_DKmv>m{1FwnG*TeBgnrF#oliE>4fFqspj+(
zK!2)@`?n|ie+`$v)Xj5dVM3_E&z{je-=F0MNv)OG>@Vi(m!5XyC*%uT1;V)xqtI7a
z|JU&T%LDyn+<v*bZccs@eI)K`c?F7SE8D}ST`Dl>l`^FOJMi?{Udb?SSQsihpSKae
zb?<jO+g0Im3q5SxQEz((k7IId(J^Zbax}E{)Cl;qwVi%C>=+8pt)?7NclY?!JQrXt
z|IAagCi%B7`R@EDp-FVphp!rq3%ZCv5xnh?Oi4n%uHt&Woj*!qH?z<3fL53{q_^N%
z005YydrBUEG4Cm*zuL<vq%3v!sJICt(HKl&3~g)`2nxTzxsX2yf_+wRbP)$kFCab3
z<%Z6Q;@L@oi54^^EyR0GyK;s7?!zUlhbN3_?qC0xG5jCvIaTU-SEBgig$Rs{h|P0C
z#^=}t%b^pwnWOu6WFMqk1<i%P<3q*>IZdm$e)_TJ7vaC1oql6~k11>HMw#Q)@53dJ
zCwp>qCo=9ua^`+gu-)I6VqyL5%HB{(EkdDD;)at~e*4Hq<e=U0QuOBUruL+bx<YCx
zw`-}&Z^rbMLM_8N>)g0Lo2S2jude{TP?@(${O#O(-2z9BV8%e|(Fqs$E8ia<^G7B0
z4~YGKEXYr9q?&#A{QsD&e|eLq(Z`SHie_d*emfHL>EP*Wle7Y^{&rZoDNgFys%v9@
zKN8B|>AfU#PbvP(!~BmAS5P5O(bv4PGk+hU|87XW$APEcaMGiB_uFAjAWzX_L&)!g
zsUUcI!gL86!*7RGlsrYzRl~o}3jVXe{+`_bEU<r!#D5mp-y8h@G=il%)^fz$J^wxU
zxLHfhxx9+i`Q<gFMk7j}hA!X~&G+ChBG-?MTM8rRtZz$yXdf8>%~*kymppFDERWqE
z2NES}V8i^fNLkr!i6K_kGX776OxSF>D(*H?X6<8j_NZDa-*Nf9Wiy>Tl9DdbZ=$f*
zWG+3fz1{i#-!u95Yy5X$eJXw2!noIKAGq<FMMw*Q_8~6&Ci|Klt+(>!BYqEcOjnv4
z2DA+Y3O;5$cV?A8+;jFIEV>sN74%0XH@>D8_!NWZHXZ|)Bb+I=>{4Pbf%I{^%$NMR
zE4TKU$JLlcT5RpZ)W&QukTAT@xEgR|up>W)ey@~SOPIs<`G<i7`-;r=Ysug$)yD7C
zNR>Qj?&^J>gO~m+<`*Tb_jB-qmD{fiM&H-#dO}wzm~`#haypaUuyRQbdqTRNnTc8b
z$x^O1I*!wt#Rr$i=Q1wQBul$0iB3iz`S%r4nJCy$6V*jVuA4udvl-39=~^}OG0<|2
zij6W%@vzhV)H>=C>)xwaUwp0!+R%*(1F3ecnA}XH&?S(*vU464dY|?lw-}Pz4rFc#
zDt?#}N7-kY7TAziy~N<<LcEk9ZXb&k+r~Nzo{p~D7t3B6f5>t16b;8Yy)wJ_7-Eou
zFVpOBsj|f8r)z|@bK&7fKK@gylkN1@vRgIOtFLx*hNTTe=J$HaAc-!zaJlRtelZ;1
zS&Vhx@&P61x3$T3l=M=Kv|aJWTNk65W>Dv|UGf-9TLzVIFt|^X+wt4%ag$y}W*Xbv
z(g!-WU846UTXq@`mPo|LpGjlH0}}DVjPglm+>@jWq|RbwV4RVcqzGhKgs&W1WHK0Z
zzmZ;<FJ)(VYU9w*{r>jlFZsOrC8jK5cGjOnUaEU6?Jze)tI08PtL{ndEb!EN1*P3b
z)6uZU8tKSvHpeyGrwdmNvohG8NwlYb0EtG@vEI4aw2A*XA=VWsx9j1t8*kMZXY9wy
zt(HO`YwTB9@arA#o28LBI%WQt+OEazGZz{ZnGF*boS~SNCnL;89zyZ8=#=VUx5eQZ
ztuwHgLumCPM}pW(`UjDI*Rk+VNb(*Fpp(13Zj`P)Dot%sv)^4kUQhY(M(f@V-uMl;
zh$cvpN%y*^*8GD;v9pU9L4(;smr=kwG=f!q1}Q7f9mc+8VXC+>)g*lJ9w6@<g6@l-
zCZifv(3<THv~lCyp(O7RGUs(u7udoVB2<zTIr?@9G_<nbc?Q!}wch#kRKD`%gQmp=
z*rJgrNZsZzVSH11Ny(@crdMji2>NOLu0SRCOeaWdQyR!O?l@m@zMAERwo05&v5L|`
zTEkRZ^aZPHIM$X3-&=Fch-<vub%Ke|qGzjH_>w;4*%j{?rTeGo&aP~Uigzt?OqJnN
zj$TN&j+gp9AiOzq;eP%otOMAR=SR>`b7_?@DGBKazZmn<Rb;m>F_9o*i;GuH9jsfE
z-Dr^9$IY65(T55$L2JejS6`dk*Q{8w)Qkq{M#_@bC&%AhP*Xj%Q$*#5VD;Q&H7QmR
z@8%hPi63bQpp#AN#@IB)n*2FoH5-)pb?uIz>DX4%2P;d8Pa4yXG8hQLnI&51m;v9u
z?*@VkF32Pjb{E$r#`&R~N20hEQa;4v>1Q4N=TqTtKtm*T7H3o4$wQG(L~L~zG*HR@
zvVfHyE|!n7Yz})Lo;!ia6q#>WYv`dVLQrQG_2acCTZ8Y@$zGM&9lVg4^BV5GRA>tT
z%KOx(s&KHwfPx(+{TLUF1^!~=c<{w21K*3r=K>Ox-F556s_zI-X7z7BJg%9`UQR8r
zzF#v@6x#U1e?MBq*lUP!{F9m5BgD7+q|J~&HhfL?H-ZC^^mk{l3@|zYiNmA<b$^9@
z(B(+~;QEaG!QJ~%y)ylBhfUp#;Jf#OEE$tsCLB$I7t2-f`;5--p`8>*g%*X>;}lAQ
z={f$i@|%N`p1GIa>qzSH{bb{9)$|ssU<!Db3CBVLCT+kRjn<mK7cFB9P}Qf!NmXWv
zjK(QhCHt!OUbgjt9-g435;|?b<GV4SZPI$tonLRd?a!xc-@in5@v4PqJby1L$Dln-
z%T{yOG@bCZMyzhz6w48ivyx_;S1YhkFexw&ZU<<${gTC+c@RtG)LND`30u9DVL_pr
z{VNXcw|mR3Y-m~Xl&+aRb41m34p>8*XIINWzB5%(OR%YfGv3fmInTVy_G>4rW9gic
z_oDXgpKR4kc#}B8ttY2~g{yZ*y@|mz!4N(0eL`)t4r8^|=MnX}{7(Vui@ewV^+fxx
z?>v94kV~o8%2k%vrE+37KQS@Jom2bHsLSMGI_$u=-5yiW@~$oQ*C>fAAfl2^V5rg=
zs&(h5h)<JP+oH}ImGB*C-E>)4bweCL*losN<D5BR6PZ!jSItVRiIsv)nr|{i0Hs`j
ztfQO?zma0XexhqdSh!i(j!tHFtTSgSwoNEC$-54sl^&Kjh-8rny9JF*B1JqO@WdyJ
z>oS3zRd>AX+umes+klE=x0AL*i(IRMFTxeoZMzhuEJ!DGIa$dudv1H=r)wy$g7%?4
z{2ZqJN$=u>vVfYUsCCa}NVM(^*Na^f;Oy_bkfkBM;o~Z2c4&4E@%$ZcV1C7FLJkk*
zC6`Ai-?T&^7yJ6uP0AjMzdZ7u`sloag1X-;RTO$LDN)L8;Zve!E{XCIM{=p5y-!8Q
z9p&J-7CGh=uhkFB<0SjQy9oQj1RIHz9j}*He~M*@m~JzTgZl`T?8JQ_69y=n)vVUV
zmw<Rqj)TXa53r3hyu&jT_a##5Y7@lJxsQ-v`=Q%wtUh>E>(^2lp?f?~2zmWPmtgI-
zfyC^O{l1M!#f691C9#-p$*sMbS7v9e5j!m%<Hc&DbZA3wO(XfGI#SBi<VsE#nqFU0
zetoPqbLJP^5i_X61XITcpuWP+I;04%hB+Wd%7bn5>#nXpO1h=b)4cY`xo@^f!Zh_D
zp=m8rZchQ~=&`UOU&bOZ<yP-`t+5y>a~>Gr>@GK~sRd)@&$5WlPn-*w1TcXbW~$CS
z<6^m59He$&*=C>%k}b96m^hIE_Y!FmY7+Kz?gPraq;4;e9W`W!6dO7Bu^vi_`mEPu
z#*@p9s2w+Ul73;k>yw7HRgcWZzMu4ODIE#9r;jazU@Y^h90|GQcv)EQ_qF@;*k4Ti
zde@Q8hM89I9R6n@#>W2nWA)W*E0>m2X0O)!VQ>aEQ5%NX$0woaZPNVsfVOc5^$XRc
zZP#5x&x?=EIlN}&8^`KTL@QPk%apAV%MB*^zC|a}IeqsWcY86=>TA9i1-<fW)FtMB
zHumk?VJjTBTaS?fTj}cu;*32-fuDpok&e<$m-`9OOJZHta_9Cu&bQu~Z*Y!2R_B4(
z9JURDU2;*7m>p}JfZS;wTg!m^F#*o-YK&$&GGR6H*c{~&;zo&$sBz5hd0tWI9!9b_
zp3X-IYM^5p(j2V|Sk1?$Ah7sN<xhgWOFsPiL1GX;{VN7PA;j8EK!?z%h@-1E_QrFB
z)u>0bXJfiUvmY9>kW5XR2{v;zN)>PMEUjyXW}tIhV|Jukdv?SsJSVSqYm~Eor}qnI
z8&9bCq0B6&$#!hwjWx5&J7cg*EI_e0>42==njTQG=<MS7I=uY&=(%z6*P|<8qDoLn
zk&)~aHy#LhS@|6)x8<Xyb@qwd<C7f18rVEnaJbQG8~Q?|q@l@DFMpM%8CI9g)pUlc
zhz;FjHSg-gSbs4wnUcg?SO$7<Tkw2O)LbTYy~hRQWER!=u9X+;gY-(Hd3??)McKGD
zbk^C#bif=6dLXp4P^}0`+exhojc-rdcrb35++TN5&+7qu#-MlIfL_^2LpQ|JI=(J%
zUQuO-Skgy30OIRGUhO8^I0{pAf(QaXcV&a;Vkw$R){Bo*%fKYCU{#5Ch9>{LzKHDM
z>t~*>lS~cqEkX*0Fa1$8;(ON=I4I9)N3`O?JID5#@)4?$i^WJeW#bHiiFZrbk}k1p
zN~iSjmb6Z|>EEOina4{nS@Scz-<!_{2L@W6**ZM?obU;w^HO<wd><#W`myU>Umq);
z$j#3AC0y<`n{eSrSN8kp^T@Y`FZ?NrobYgj=3D)VnG`NIUPd-GgO^_9qowrOtmQ-#
zuFT?KH_?9e9q7LP7>CZ$?R$;6g4g8x@a#JR76ZfE<mH5q7<lK3M&rNF_}%zyviCTB
z7O{c4cF(|sL;G~=^Ph_cl&j^As-+)xShYp9^>`Sb82Rl?7ah-y_f7e@ZTM3q(9bw-
z0eh=l54Df&ysLE|`tPuu|G$`G<a<i6Dk-x?3q($Km5;V}baZ)e6<XLENbX?Q%o^5^
zi1)NiD#=p(<u-SEV&md}zSTdC{{}QUlH$C+xUWCNO6D4Pj6`fvIqyVa*;>{znvk&!
zIQNb0nNzH0mT86Br6cMaR2$-Xn|vRsHqt)Autk+snJS55<87^+syPCS8mql5QxWwb
z{tQa`9PZP#RRv;|#G;<**l@58*lYj?mH8c&#Mu4n=XRHX!bH!B!&#V;i(Tu{(M$fa
zzn*b#l^$GkEeN(bgy+)IqE*S~>&#sqamNMH1VNKxM!aK;#v?HH0u`lp23PcNs(f0;
zyhC;t_3tFbdrsE~l$1JwGmUnilrP;1<*yif-6jROP~U=muE8rny-|)maAcg>KpS32
zQ9e1tsgh(yYM?f2%+9Y(QI4vC?S*7C(1?#RY!3ROrzFcNW88*3TMMS5lAVj!mg4lG
zLp3#3vAt!GO{QU?Wgs@{uerScrYRQVtORqTo$1eWI{K(fKMjsL*FZ+EHx<cCt#F?x
zvA5_Ij?Vop%#GwYPsd$YcYBSBQGVqNE*eh5Ci2sk7;*#7!*ZETc6YqSZCJ3z!N^Eb
zm@526-Z`vaH6#n0OM6jjYQT3kEx0j4+Ac2U5QQPW2^VjZ3s_r{w&$<fa6&aAa18VI
zT-&XSuh0h0;Ztf0HrR>nQZ()~_^;t8YhEw+DLqWNJzTtrMPbA#v}<*hVD_LjVh5M#
zy;Li2S2x71+gLl<U0u8sI<glpc@q`u^P4w3)4z+VKmQ^lxeVznvA8bWXyi>~9tDZ*
zZIHK^@7#d<v29`wQym5d&@%%#(>3|m#_Z4vKP^v#5b^oX${@YJ&F`)``KpPh_a0`*
zQdTD@u|9y(vUcNJqCE|<cFRx8h+}e>-Ht)aAk$qZ1NWn#?VEm(bGNL#ZU%^YY4~<t
ziviebW(K)XYHOD!EjUNxF)d~4@}M|ZLWkT1dw<lMbILMMX(dwskB7krCs5Sc>qfFJ
zbEs<^K0n9X4uC3Aq)D^KD#g*p=n%0pQ(pXdlBe_1NF0)fQ*sq+-XkY0?Dz1Cx6eZ#
zG?P9w*(y<2-UvZjs;<;kBxY-rTVI2HzMPVqkf<uN@^N`45oWizKNj$%QIXl|5NaVO
zT<-jSDE4UnQ-O=RfA<~gZQ)3nelYk{dB>UgPkf2e#Ht%j@J|yv?}fItZ!T6NjZ6xg
znN*k|RdX%l3m@?5#K~q@w*)VcyyDZWkTDnF#&4(vYHnuBjM|ltpgcWe-WRrUH?HnV
zy9|CChf`iWS9RmKzoU%!h>Nn6gUlSpK6+%-i!eU7)XHzaHEeab?prfx(rVaPhOuLm
za<S$F$xq#~s_L@+WVqPbu7rKZgPDeqR}g5GLw~c$L{mtbMTckOhr?a|x4O3ua`lm%
zetRn!IgW<z`{5xmS=7OGzGzy2)=;_cAMCetXwQ@(^zCJ@a=2}On49p3CH%O{{^kVj
z;El?Ojok84T4rM(-AD0}hraA1eX6pO`%h|Si#mUegF8N-;G2oNm%NuQOw3OKb%=D+
z3lAR64Cs7(!nOgVRIY6?TEi@q_!b=iu9Q>etJ5*nTn>BBW?#5<$msku2eNY{+U~DJ
ze^Z%ECq6Kl8nSu=l7B4`2MxZTUOoPlZ(tk+_OT||ciTaPJle+c_E9$Ryp!Sbfxkj-
zaIo*@_LV<<HnbMIh~k%QDW>OD)wt!w;lB4c6H|j^In7>G&&lfzr2YwmDLZ}Uz%g)D
z6m1mendn+OpanZ=V^)8Un*SrSN9g{e(!#A#?;r}ja#iSv!L5Vpg_`^1)TXG#bw(He
zW?O@Au?*8a_xXHd`RQ_;pA}2A1X?s^0)=w4a4i(^>FBx-Zuc^0%&(ZB()CB_cx=gT
zaS?K2bR?x5esEeXX=OlB$_EpP+$srg*1BbRiCZ`8xKAZ%WZpLoomM}Fu1pT-_x3rO
z(d5xh<<qBp_#TMlgL=OZl}}2e^NNr#RcS7c?a2LmY5b5$&m@p^XDLB0IxYKq;$yVt
z>h*FMkl9_b8l{5-v-caZiTQMn-q=ot6ThmLiZm>>>IoHI0C&lw&OU^c)~o`QMov&L
zW@U!m{+mFwRhri8!{t9yO9pijbKM7i=UaWd2I7K^LNt+?3`oXW>;9cIWLB+)E|)wd
z%>t*Y+}xWQDar+ey_2S!(cP<)00=?0=c$h5P}+`hA6zo@S_xFthen^SGxqLcRO~RT
z$9CUsYhnD&8~>R~W)Tl6*jBT61*yqpfR6povCr2Xo5x1nN0=Uj4Hj7^>zqT1)vg5D
zhMuz5R?4{}V>QL9N!ug}jY5o-Kknn^BK3TI>{cM`%sbji$u0^+SH&`U0%6(E{HoPo
zJ?@Kp#lmJIEbCHBgI@qTfsH<EU?m5ylH2`$ts(PJ?p9?Cghz0L^+X9kR~#z{5&Bf1
ztgYQZvqznlNr^KkP4E)f*qM$qP8W!VmyW|X8m@{9y}xv#b>-~ny;~8|ei<o#tG%zY
z6EJ0v=)FtiLZ4#9G;yWcWknHx!%yJnFjR7*uA*TB_2;s8?w@0K#C;ETDspn>`@4J!
zdbWg%YkJ)I{PJf$2AySP81>mtcW78?y^i3#Pmj>{UaZuw*qrBW042;NCf%=-NeQQ&
zr74|#{Hc!KW_PGXJ|#c0Sh~Nv0kn^2jbZz)rux4^(w;R2rHwQ!-orG-$7-ITO=sWP
zp9tpkJ3HALNryYwLYN$A<woJ7T5=r-Ht#0m-%HSmq{Oqf_7$217mU58*0PlVAEmPD
zGjL18kJhkS-~yA*3x6Bg!~HG!>ob-<)=8)7Ten&n)0)-Ox789im7O|Q42A&G7HC0l
zmC-GXlxeOqye(hVOq`~ZKVTUyg(U6?lme0Hi;;Wr;MP1Ep_{V4Enz)!E6D<)_5+#v
zvxYDWqY~TE8eOAk&g<PNix~SCS_eZ``#1hNGyx)vFr`(8>>N!8KYyp7NTJ6|p(uZP
zPms!Iy|;C|;Tdyqr2N74CIU;p{8o~1BR9MK$7aX9GdF@m1?oh2iDmlG)4sbo2{HJf
zqwzF2nVVZ%U}N{UIsF7w4(kTf_9pEgZ|SNvLu$1RU1OHbOcjY>U>HU{w?=YSD*`vD
z%~Ebv1UhLc9x1T;!{6&VAoC)*`<|Ze%vCVRWYf;kx?$+J!(}q|ssTT)m2uJaX!_Ch
zajJ>od`=zx<)_8R$;BWU^vYU~5(rs?a(YkQy^G>`nfd2YSz*8UF<w0aCX9{FAEEF9
zTOrt}scn1#cwq%DkCHgAmtROBqxMc6Zqy^yf}B-ui}Yd`m&u;bilK-xNWy;;5C06@
z^veQvwMyK|>q#n#!m{(zc{Xt<2ODT+CJ;A|7BVPs0k&0ZB4_r(ktiAYMHu<V!cgy0
zE+rq07Xh|5l^#qMucOv_$dU62p4$H%6Ch=0=XxcNOuop!&hreg*z{J4@S{rxG9zvc
z-ugce_Sa(j&xrkF4gcT2#!?-*+_LJnKr)K}#lqp;PqN-_v#3&KAW#jQC%r$kY5_vA
z&gJ@G&LGeU|AzMBaIi(Jk(3B@0lfg5p?;Bi)T#C3FznUor~GOglK2!(RoTU`obpS1
z$P<mnNW|zE{I{hu<lt>W^xdQ*vzS$D9c~1s2ZkO{9k03cU!DTL*^Tpc3IR=7?L(!a
zVd58#eZP_7lQm1wni~*apDVWMUG02LT7q5nS#8UR*PSDT2hq@k@)bSWt?O_89x8AK
z0n9q;c|ry2JXosgy(l^kp3LNyk6a>GSg#{fd{MB5nM8<s!4u1A>b=#D^&Z%d_sc6c
z;8U({ZQaSBLRz8*AY%t_HZLo)fyXl^3b(WaXzjq;9)NfSzMDE)2{WIokeg?{e-O;s
z0Cd$_49-8t{55GyF8QvnnC!hdLxHgYo#lfsTNkNgEiC;Gc9_X@Oj~Dr)e=bJVJ}lR
zBBYnvZRFQxz`qRET_-cm(D{g!2lbb2IUby?t6P~#OxxnAoge&uFuU~l27I?wrF#I7
zSLdy}gdCNRJR@NKKqHs;E88V?t}P>lObt`fu#55CI&8~;Gtm^aP{Msy=Xfaej6J6Z
zqKK@wQ(<kZ^GtqgU0**(`fLnrf3`3)_Q`yq+Y!4KR3Qp6d_t@v83FOzR83xMrLku^
zBYykhPw#?GR{84(Z&RNqJU3lZmdyw|I&7!jp|BC{VJlY+&(<Qs#?oH10UYfNr_Ztp
znP9D7eLk~>41a9Mw8yc(e9fdKj5Y0XG&e<uM!cC3OJWt@_E0%dk7Di6&T?z1!zvjU
zKh*t>H}Ab?VqJu^w0+6S%p3_DT4<I+3;L%zyYjY4lM(W_WOn-dC`g`UT)CiW6X|-(
z6>#=ZBa3Br=%{I`qtEA)^RWtZ>0d-|$NKG~ZVk-?sz|*^hACDGFS@Zz#zw06c6Xke
zQb02Mv#pTo%>x1$dt7Z}&02TjmO&>5cIdmhnjN*$u|B7nsg*JRgftx|HGmr&YGyX(
zTd3+#r6AQ#(qaOE+d3m(^wEIl<)`8lHnKfcGi)%yTN`_8f*<(~$#mwINZDsas(hfj
z{grKWLnYz)`jf8hJ+J$xf<Xq?(t+S>eu4c$Cx5PN(5J7!9GK(7J@%LHZ=Gq{w`iZX
zot^y>aoQ^BfY@U-Fq+nNkD5zfO@8sC!=B^AxO|P#Cr2$Qpf<gBytK;Ifur6ult1C@
zZO|5UgMxCs>4F+lr<z6GT6gsosE|y?`c$-9pzqdDwsk2$t#hq)`E<&Saoa0#8GshP
zp5!_+2lK3E<3lLO7`tsR^GC@~6T>h4Myb{RRUtRuIy`_iNg|_ECt-cDd>r&SG4j$P
zyG+t;=IgC4;42RH){x}-ve3-9v!kO^$GPhlue~s#>bFX(F_>~HO1tF2D5%D%$b0_T
zT-*hGNlQ$Apt?b(-oW}VWx-%kw857b8&+`Nycd3*3t-2Zd{AV194Eihq%j^Yj(dX3
z5MUFtV<;Q3{PUB2-A<Hlq}--Q1+k8@0i^2;z+;$cxZIv|VkgNqzt*y-Mn}5PAz%Yd
z4N%ArIa_3UyLzeah9_`3UzoBggb7rPeJ*IC56uYm-k4`SDAR+l`xb^)@OZ4xJ_H}=
z%g_=|y3^ziE^*-P#Ro=jDht-Su!uM)SdVxen5sPIg#lY^lYYgxuW;b0gZzcAWG=@#
z*^;UJUqii)02)`t#Z`F#=%_JTP4;5lu8ohA0ca>Y4cY*nbXv9c6q>abJTZk*t`nJo
zGQub;-X;zJrlJOJJ24b+eUI_LMi4`zG?@_B=w!B^Y8lOgyTCQ?6E(fkp@6xO<-DY9
z7q<^q`5QsR9uMEg!B`JajL{fYxtsyl0aIO+c6o%(?QV9*!8n&{)|RHWHlmxT*2pCa
zIaBpopH11*g$_XnUgjye9%c~@_sqfo)Kfhx?LO>CB5Q0I_#-C|Oby26XLTlt*}*Yd
zdWEyaR7amE&r<pPQJP-+=l|ppp#cHy)>(Ejk^I>><8Rt?KB)cxqzuWY9yph6*6a=w
zGHpEJCr+&++e44_D+^X%<rQ=--kt~zDn;uFFO;l7Ltg1@Ru+)YG##_>fj)nf`r_X9
zq}uq~M!LshB+sj<ZtaNdvf5==H15;9(yDWGxHu0ha0eUc$gkjO!e<pxthKO1ST=F?
zaPwDp2#NzW@sew3p2%BLmU`XN#2T&>xk4<y=#j0U?7S-OFi(>O4sRw5Fk#4TpvBlT
zPiS?+6yL?B&)6-e9-DjR<AbB*^wBBt+q=}HKp^BJ&eO`w_AGZ-6K7l<*Bc|huBl4y
zy!rD7EW0Q5Zh(tXW+<5nPIB9gZzJA?)^1nFDP5z-T!sU|P8#T~&&-kE-_eE<CpalS
zu0}9<6H6b~ANY|E@_gS-K^-PxHR%m=f7EBGBS+i+qk?W3EfkgWl11H=G*+=%{M2i)
z6x@O_Bew>IY08p|s7#@27U+u7tsZj@1Xfa?bZ`IE`wp#KGfgc&{ISu%6=!6We%W?`
z2rfEi+}&hnf!55$I=LgpNH^3{I5r2JaRum6lIE?SZ0sR-d#QmJ$L<Cv$2+il>vEWc
z;YvB}7mE%GUf)Gwp&Wiq&rA{_?%#hU`HA}Z40=TKQ=igx#?&4JB?A3{I1SEs%Mkjk
zbjfzYn_1g2PAb3?a6-YLO(pGxyxIFo9kL>zV45irI9#b684({*f8^?6!_`3%uD_Ch
z)^1A_hR>CU6ze%_7^LYXGiZNoS$yW)H&_VE8SdZ@-ICQds(k8JUxR@ngl#u0>XjJZ
zvuaO4t4CBdsahE4m;5O&(yJb-t^A>xW@RH~-|!|RL}8439I$>Qjr@1V(79zpb+b0p
z@&mKR%K$~e1tq(W6zlQJrfg5XS-XIF6sNS}Zu0XzO*TV~O6djdzDt1V&&1fkP*Yn_
zVyzpvTpDweS;-M9Sh-$Q^I6--H+O1ly6Hj$O*ng;MH<Y=*y6}A9K-*#Ou@FWSVO}=
z5V2}Ae`kLO#Qksi*<LFRpZ0RiTf;olW+w?WtQ-^XFj?OoUh>V!((KS8f(UoImBYKi
z0C5O#S<OzWo(k6mKN2U)sG429bos5}KffqFW;S*jf>XVXl)=}WJA9O;BXzJH-SG7|
z?8nm_Kb}JXcB>d_5sJSd+*j<Tu0=?cSi>i_HVFBL5(IHAnVl&ZbFREgz(#{jcCKED
z!Lfg&@c;b9WeqZZ<smi`l`L(w$wk-=WH#!oio`2frf|mVdTg6e274@7rme3FBP}h+
zmNYW)gR!MLdf@ajRV<A~I8?jAhN>rq@<|KcKR7U<`rkHnOWmKfK0g6sINHFTE78Ul
zDkoUI*S-u?SzU!8rnpcn<(FR2e)lQS5Wj?!B4A(pMrgsrUg#CnOPZrlTTn7vDO)9I
zTq2G)zRhE}IcTQ#(ZJVl3PG!ec0F2<|0!Al7}*t?1t=%=?b@lH%hdtml0Lygnw6mY
z=*T$Fxs}#pZO~S_DedWcM;K+WMvN~Xs4^l;3Ez(Ezqv*$f1Qj{M&Wz%YF3p7Y_4e;
zS;nUWS(gt-i|@g+?TO-Fykc;_`Cju{9r1%CZ`IAsx;SG;O%{2Rd%bdY)m>VDQR;M&
zb%IzoLil*CyAd7W2=sbi*<zzM@~Vma!$yU#XSxzCHk@-s(Koe3cMkeJCh#O;-3Lwa
zln$>2#~YT@)1wO&jcz6jpE9D6etYB9;{Xs9tm?A!5o1%#R#GPG`<zq{oriCYb5bry
zw=UJLtB*qpfkLiDQqG$UM0+pQ$<~N$Rys7gY6sJxjO`<k4B1chan%pP*#ajcrK@zr
zqcHbiE6o+lAV3C1tICyH*Gg<|w{p_|^Wyl&9#73WZXp}ykPJ98W&@pVgEnnrZ`n#;
z8ym$5XC$K>Tr{P(!md2;N}20Ejrer9G&Fs8V0$IaESR>fh}qanGGCSFi}KYUl|Qe-
z1O}aEuTTccy5U4cAbJ~+U=1Sw<`9U+ri!{d&GTI;veH<WzAjx?VS7`DTc_R#YuMR>
zHbQD;fgwpdkkZC0&JkEjFo50qwWV2m6NS8ojLRbR%m!1-Ms;H#=;X%UhZoPQLz;3^
z4?(J6e%UixrJS$Icd1JpM^8HlgReW!o$7FLL?@RA8OatSsYgW$Upx1Vr74y(9W1N~
zHV7h~AcqgUhD%<O<!(HZ?>YonV>W{6fX0sF;9zUue(;6i8{Ja1HB-fvfu;Mk`l5yO
z(omB3mTVw$Ue<f6GNf=XcXp^`<?uatNiKJmrK59dE{gW5&!yVP6fSAzfZWXW<;KWw
z0>yG@eS3#Hw>P&2w2|$|8qb3rp*c(^!DWWXe1ekpXIIuQ-?QC|<-}3g%lD;9f+_dY
zXPHmf2dZOvJP^KHJkLLN5^9z53pTVGsbdi<Gx}V}<NVt_#-BV%i|$Mi{!=q_vQu!1
zfOKX4Qu9H1A?;@M60hk2^gBkhjo(=YJOGa=rQGMAJ5gBW2t%<I+aFYsOgq;Cp9fa#
zmiNrB2GOtweTk5fX^I&hcs#v5x=(o9_|9!5h~1u+wB-JxceUcGTZ-q*Exo*dte=1R
z;_0K*9Dh{BFNa4Vivg_>`w;eivdFXM@a{Oj3u%Lp$e~R@tpyJpqHcI5laRv5J-1jq
zaCE1~7t2NKC)E)#?z!u(nu4Y;>=C}9l*FuIRh544rAqnZot2Ap7psh{u@&pDXG&2#
zb+tqw1dGC$=VDv=UjQ<<RF`kDWODNgRKtJ|QnONEs@S#%x;fL#Jt2&=IH%Ch`D`-Q
zFM5k~Zm$sXi`(UQXD4$=*hKa0=t)#f^`choKni$i{<6W(n!|dM?h7k)RAN|%0Ic2C
zQP{vA{*qK5BTBkfRx0xgpc6g=Bu<a-FYcSQ>@lsgtu+k3o)!{@o=H>!bToSk|2cyv
zxk2H_GCW$W3!ht4m=soJ?hODuw^YTJ2SG0fF51#5Vb4hRvy?b|-GC9xxWr>2I+yr3
z)24KH2Y2YFz3O}7RE~a;k3TB+KCTpfHd21&dA*l0{^Tuct*r6RikQW{wQ`=_*zJcD
zLO+ac{O)k3h=ApV$suq_yQ`+0Ns5Vg?t_i^jT=9_6dkR<S7v~#u5jG~Ils1x?d&~S
zx$$i?sysh|=h~N!j2GZkSpcbEHaFa7e(tvK?)q{kI6pQeeJ`G{B&XFl;FOgxN9YWF
zjPqkReZP?o<~2{;d>KBxTdo|JE^Ms%3~lTyT4xT+V*Ae9|MN}AP&PO9KxRmdJ$DT4
zvfHC1eyNP-^Bki9r0JYnVG|_wr0sLydTr`<vd&xcLs6B^8IpC`fbVtAiPlX6Z?Fxk
ze-^?Yw<SN8+PTC~I|}5TX%8cp6gwD?Jl;<#o%!fW7#l2PS)VU@vhreD-yU&6ombtN
zl3u&O@>`x^^&8qnYRb$MaNg+ISS(cS?^=p!P7}cX(5!?)w3BY9&Abl6alb}SKf+xv
z`ydcAT$b$ow7@syg<a;rr}R;hc5L&a*I_%T-VXVPu?^Jayn3-b)*$jYQ9$PXRN>Qm
zqmZaUwyMFyW0m`I+wf*2q$`(jw65hn@6$~M+l8K2$M&5`F?EQQmc+*GtH&BkQJr%4
zOYR1oGI97IYz$XQ>SBYvOIPQ$4VBfH+fhjn$*dRX&Z{pA6(13C%(Kq~y6F=2=C-0t
zjZpN<UtbqOYw&}I^IF!ZobC8hz;xuQI}hmY8*~##tl%)C^}|rCf9!5!D7NZ1p|0{c
z<9W?_ux*<>)4n*7VrvjH!vv}s!NP4*lg#wkPF?~!-@am^J$r4HSh-bKQ}g_R!7~h~
zz4{@wI}3w__j?PQgyljZr3UM1VXvVhRTkKRQHyHH9G!is!U@;9rn0K^U)w9q<<FOT
z(hhv-hRYxtAI$&}5E`3KRYy7?^;^Wqb?nqi&wRR&)!(W!_p_<8cps$QdfBeo*ot>Y
zZC-_1=I?J6Z1YoOvuR|ldw#q|=Af(wUhkyep`_(_npM#q8zV(nE4Y8i>IUjDDe*E%
z2n`2vf}i0Pl4DlizBU=KxP~_R<2mnKXMxC`iDwv7j`I}%3vJ73QW~d|-!7P43#4k_
zsP*3d@UZb(q@31wWs0?lp)P!iyUAMw^>2>ls^g4>t`28cbHvRZN_Q`5e`Zu#>l9Yg
zDaT0#zI!**%vic16r-0;0(vY|+m&)4a%*FJi#CLrwK>+3_1ydP{*BESc+&~`Jg&61
zSo-Zz(!2c42qtY~4G&FEp$sP<;zVrkLr!0VLIK7uc_8G!ceY#ksG<79f1c`j(>v7Q
zoGWRAW^3e7A%=vj-r`XtfX)J`0lgtqHojdElePZ(R&)l#qG{$It199+woR;Ac~5%B
z9Yr`|<(qy3e>s+I1_+RPKyQ5$axYCYTdR#!;Zy-6Op5U2#MkhQJ%iO174e~)=l4j6
z*RBub_a1F;N2@h}43?P>v6^K|HIs2?(mkUtT`qf5K=LcKK!wCgFzx+&Yco4ml@B^V
zrSWBItuhcqaYLUr3vjy|;^(5$Y8?<pn*=ge1ygc*RlL|KY)w9wSGoJ{wZ)yI&+q1w
zJlp_^N`MKXT5I<1o*><LeXnb6RfBav(i>#oXlfvYQjyhjB#U)!4rKtMRm_E0=Tk2Q
z8b7E&<#VfMuRWWhgKig}HeRGGNCi6hyLe%nmH0+b_C&?O+bgX5J)Ie?A;1GTE3*dK
zdI@%Qp<>d_b0;$_Tzt5|I#m=kWSMxeK}Fn%naR-QL;tll<XSi4cGDlug(av2+czv9
zv+Zv|(>YEcg{<{%)~+p8n~=rvaYjxiD4X$5@;=*TftPN@Yh!TL9^DI>8OhH|)LJ>5
z%_p{AG=KI-J>>MhDziN{d)xY{FLJ))Z!ds-?7f<sVaJbRnqK7nH7-A|hQ1N#;4^g6
zNB2J>Z5fNZ>Mj>+WN;~+ioL_Bm+_OSDc-f+x7My4dgW9tRr&=rDK4xtvNnX#Tebl-
zQ!uIm1nzyM=EB?a`b?mU_KyWN+YRc62ZRE11-E(%=F=;k-9lz902rt%>mfvWLg=mh
zXlHQ<Yfnw8SR=2@&)E@^l8I#LPE+O1N-MlUOrMU<miu*TW=T6wtx~tW!BEA)DfU2#
z&F*CBz<6P+pc`->DXg>o9KTcfu#Lw&<HnNnWO#6(aJNkLY()w<$_jRIBmjLF@fO;6
z)-8KB6iDHdXT%H=an%=8Ww^FB=1AMYr`U7kuQ$o-kQKuhPF?G>h-W^OTK!aj(zAU7
zw6f-w)kgzx42<7FU+%&<aPZ7xuny;?!+$(QcZo%yV)?VACbg}m8P_5Qdv+RGD`_m!
z!)Cl=GlA{hzR*XouQ`8;Z|~t{uh1@W6}v-keHM^cn0qeCuY`3sMoRFAS5NJadK1r2
zR8~1h&y*}KgN~GY^ECs_O#0V(dxi^48gDyIv6_Hx2ZqIluYep`+3U*sR-xoIdy1f0
z>Xn?$tbIDNYBuT|zFOy<W%;O^cj1K1G#a(F1Sr{x=YQ-2vlk_hIO5%LkT{0{O>~e%
zH<kfm|ChEN6je^4*rS_8si;KwKIwn!RJW4;R>h!QI|Gs-o{qg78+|fv?UQpgf0C*@
z>l@k_b}idxvL(Dx@*1*pm|iUVo~XUo^|D)|Jca5m&^{&Jyr<LLMm{UkHC2x36L%>u
zy^lMzx-$d%wH$^sZyd%yBy<W>mq0J7<~IwWTDG9O>vQ98VHY)AXoDaXcYn&jB)iu@
zuzObGXRtyVvVt@7YyUGH{NKsKPloT`6>Ke^UN4T0M}y|M&KiC%kabH^-k78su6kdF
zH7#yx$4KT+gqwNpOlz+OF`Vc-bYG0Q0^N}ozjf-NeZ|2rurchYe966IXVANg3^;g}
z?$%Pbt^W3IDYgVx=N;&~IVvn(t+z!MDUoFz_Y%b*SsMn1IWl&GJp}{-Y0YW^8MBt(
z7|EO?j>KpiYOG_2Bz`v1%1YShu-l6ON#-i2`(B7A^5@YEHv>KSMf$#}T)^Lo9j$Xs
zuCrxiduU{Y9d=WNXj%-|8Z}z{e4BmZVT$jAw|DC$(+fie;D9=5&qhfX@@$UxZUrOq
z56Wwbvdo)uU*wYz+4n)}uAS}`GvB1}5?fTxGY518KeL$(Y2_Ej9Dt?-AEU`-rZAC%
zBQ4ePx)4yMJOc#9WV1-gI~=Z4<C>Q`&IfbSmtmdOc+kjP9SvOdnG4)OWa?teb&gcK
zHGGZFXl#oMDt)p1f<WvgpV{%{S+hvy-(ynGpQnm$+JFL9)m>ogDs+FS7~ftwq(}s{
zhJFbj({l?7NZTo!!UB*oju$?B7z~3unYIlCLYVY!lkrRnZxrZTbC{$-2T4P#Z-uec
zDb`C>#*^hOEYdS`4ygEy;2peujJ}Na7I49%0@oTkl65aid3VCrjOOinff|Q?)RR!^
zFpp590_2}qs~lOe??42d0KEAXQ-UCASZRit1d2i4<*PzPaXwtQlGdf_pjJ-bn`CT3
zk<k3doT2+Do9T}tawZ1?;7z@9AgK$DZGN2qjxt!IiXx5`Ay|lOR_D;iYE|g4#Ykjp
z9^GNy`8c(H;m-sOuIZQ?%OhL3V8K>j))uu-@6Wy|wZ({ex-Ei6N}cI$VBRI_1K@(&
zjuTC{O(xK3CXJ`kJlAHfr08P`?+2T|;>-IZC->t#k{q)wJCj(MbW&Y)%s)h=ffKb&
zNUM~y*L-jLjLE$TXOP+g7ArnvrG#$r!eY~+9dJW@Ht=oUx7He{5&=Tq5>BncCVpm-
z2?|>8Y%&3$7tO}*ZIi+~?X7KgV&L{s701(jvY=&SosHwDpZIGhi(Yx^-N9)4d29G+
z%?){rE3lpfMmVpQVvbC8$bY6ELe_@J!n}?KL;v$x|6>IIGhTl$&i|~hzt5xptcm}u
ziGNPA{@+*=<es|y47jJ5fzOIX8=8Dsxq(;P_nrciu2ygRij^4$oG;yVTy?*?GVnk+
z(1y^Bkd7vGL74r1gWT10QGBUm`RA9&^c|pk(B$<;f&O%f{ZXJ)5!m-*{vXl!zf;-2
z_u{$lc?w;ET)EK5{u}>1C;#iG6#}V&ym9;F+|dXi8S#y|@syxX$$X70vhrB2?=@-Z
zjBn%dMH>lsf*WD}a*jaC%X9l2Hqxaj$5}Msv<MgUKthlce_MEE57adA9y5Wr5BG8#
z$PM`bZ)3=X>z*qYx+J~XOg0S&s;FHq0*X#@C%-jFU@c3}k-Uh$TQ}rj9ZMxm6J&r-
z*LBnnKXR^|S2Z1!=fOaG@D1vFw456Z@Y7%lP}Bq4@cx3eJnyf!IK7rf9To~(gRS7~
z(cPiU<ZPV9b=(tR1zzUUt%(3mxCWXOp8X}CwK$Y`fy*J?6BoK!)fiD71bSSr=U0H9
zlR%K<UFR$5xz|>7iiYh?H4%_R&P3lfl32)|72H#%6L8&aBy!h35b)m$gWta5i2w{L
zpk-0YMx@}QB}72^Sta<iP@j_1Z4j~gI_Cok;2Ec-7i+xV`VVz7XcsJ1<NQ7EqIB>%
z#Yh@*Gl%6y4uPCe^9S2&faYc1I)Fi#6n8y*1GGiyaA|U%C7SH}U;ui?=SYC3m%3;k
z9^cC8?o#!eu5a>$yBepO0=~Y2Rr~EyWow>EHKe>dDuP!L`0FmYfF2(bu3&^#Is-JK
z7<n&U5~!Qqa{!Fh^)<8GB~RZS!<^TLB+`bp3}oWNWUk409FDXhJvcS6svf}b^Ram0
z?B~!o_i5#B`@)9jtb*+8;u-2xYVd$T{kC@K*&}}sbT)h?8vd_^`p?7mbc=$=k}zh_
z&SLJnKTt@{V%t80&M(xl6NiI-;-};^<_6G4NWC^Ma+;2@lf9~2bKrHqp=hKk$j}WV
ztSL)aD@Bh!I`vE=9&O~TxLY$oHhGY(a;GEYNZ-`uz^#!Rtfu4i#XJ!tX!RR*`x?p0
zb}`E^GL2i#s0uOUD3^@zH~qbocbDsFA+O%Uv$(5Z<fl6LG5ma>5nS&OwDKw$gH}Pz
z9Kl1#eECNX3Fro-336*Q;Hi~y0+?L=S!|`oCmBzt-3+r<TCzs&m#fj^oD!9EmXmS<
zX8L3QAA9c^)l~PbkG?i62>ObMf;1Hn5Kw8-K~$uxK#&qp=_M5DT~ts+K<T|GH4r)k
z2t`49CnSM{5b1=FM0yD!cl$fzoN-Ti@!k*ramO9wd~y(Xve%w_tu@zt=A6$XTG}XY
z9^7tJH0`#x(rF#V5B~Z3zgp@4zV<`q#eR<k^VDiXam)xrOi|VVs;%tudx28={&la@
ziQ?-t@0Oyzi)X<ACkMcxp_I|171F#uB1$CrOa{q%g1y7mgK{E&XLm#cR2g1v4RrL$
z7{%SEp#AJnx;n#)W;0iRFuPdr3B%<N=#HpWt8Xk^7bp~COL|3v7XTXHxFZSF$Qa*b
z08Jrc$(A?PfJ{%HC};8s=sdvvTxpD&PedHJlVwv*&1y)Jem+gqbr!ums2@e#S?GKV
z2=WLGYV}|4`4KTL`q;qccW3If7CL!4u?^=6*M%1Tw0p<OUAY>vODu5PCED4}wWk3i
zkajNL|8#aRHR0f0+Vb$ml_6{sZIx(}^1E&e2#!zuZZcl@T~zd&Qin+Ei%bBp!Qaiy
z-6gz$SXW8P*o!-|fKtkt-#t|70P%@Az?0zep88Rk-S9W(=xr*n48lUV-R)gG4#41l
zJBgXYVO!HMt2d^>JIj#JK_%*Ipz+StuI_jF)E;e=@%G~0jd+lGj)puf#V(5(sG9fL
zRkmmZB(0zC@QA(>koP(H8&dliy#3j82S;t>5^vZZS*PF9V2EB0==)5h{q8Aiq)`Hh
z0S9}V(KDfY0;yhZ=C__=fp*R3%aIZS0U<PQpD-Yf6adt$MH_eK(|$K}-H?Y~%*8*W
zZ?r0HO(vC8VU%e?rPMQ`B|}PqzrJgjh&~U|ab}yaLm9<wy!dPD{ncnKI08Twp96Vg
zZ5I=uauX9SI~gcy;ypH{5sq_dx^-T`QU?F(pE(D9uZX3Os!dOafru69Mik%(XC>nb
zrc`Kqk#0D$PwtzNH%y!QNj4Tg$gc)3`PnYQ2e8ED-<7!ar#8_zmqF8$0sDS-??AA5
zZ8Tyh5jPTwPj(-P=oExsa2YLpd}r#dl@$nRM|Uj|{pTv$-`*(X=#q1`^j702&~^Bh
ztF%S%H}+s(HFTGF$@F*W0yms+*?)_YG2jGX#JlppTXm((1BZ`2hl73evZ_)|o&%+~
zQ~Lqb)4%B^`l9WcdA!!$i6U(>6MXB$HJlbE`I0fl1?b`=u0EAjzIyOzRE~1?>E-U;
zidT8?H++M>UNzXd2Qv)|yZyQ}Wb}HlG{BT}^Lgu!U&z^RU~{$YHmVdet-ikh>fAp;
z#sA6-?=Ku(vdP{Eak;>feBfqe%3fGyb{qqZO*(Lxs(k7IpZ$@xIYyNa$IxT26IZ7t
z-^oL-kNWudh=$e1Ux1F{@f(}9O*Lh3G7O>MWh!DQeBM;#(FcUW_l%>O54SfFLbTaF
z>sTGW2de}p-G#cnflCzAt!{+uK`ih85*0lg@t2y@H7(~i|C7GNfBJ0u=n2!Hi#i8N
zYW$0>|MQ8n)epY>kolje`~TBtuk>GKquzbL_P>MtcYW9YWS+kc|DUj=s^K**_8&4p
zI`ETHz*g^MlW=UKiqXi(J=Vn#`~PzP|MusjD@U~w#KmlS;$s&JZ=W-h(dub`pjq@J
z@55|U((OYFp{<RT)zwETMcuQOwXj0>;|gzj-TBib6fjnO)AxbBN2|TA5>S~L)?#Cp
zwg)_=QLPJsY*gCuBmQ&p;`NAV@vDy?=S5xybq9sj|4Hk4)lxN5YKy8L7awn^sW&ds
z-CeYqYf9v_tWSrz^)rg!FP{#(P)(Vzfj(v1!WQ2E=T{pRop(Bd?h;S?qttVD9dmAO
zZue$Jz%?=Ho3r+LA1Z1aYOYWC<Q#<|wsN~<47#C!7U#t`e;ZiSK;oy)L^!Gbo22tU
z$vI}{o?3iZh&UGqDD7BlpS8?ujF;d5FJ8`L-aWOMvN{P-*c?MTc9|BvFu99<9eg7F
z%s>6ozuhOa?OwKF(GwYiQRl~Lthx<8g#EiMyNA!1#>H+%B#)XPn9-jS!vE9q=KCM!
z;Ow>Rrdh|1r#;Sf0Y2Fc(gi`Q9zmf@FnM2cW|Qz{u%`})^Z&u(eFdro$yil8BKsa!
zb+$Sm<E(D@BrTu+@t#JKa35`c;=fI^|1uP}<dZ*=({G8$pLK6ot|)iOQGJ8P6OW8O
z(D=LZ0{X~8;~#$D^1$I+!;d#twGD?-(_?L2<-;A(Z9Dim>>ngnuS*?DlBQ_uiB&rd
zv2obnCxspf4UQ$s)IG|Q6Vf>Njs7fWcQg6g%fn21a7xNvEFm~4Pa9Fx+5j2&qsa5S
zudjMJnHAh`3}tV)1wJyD{IiKgREIc4S{46z;iosiZqKS(@@JvtyT?wLs^3rk!&3q_
zczKr3zW>mB)F0jfAl6j~+`I6^fr3W=nvtrkhmXSK{;J?Sc#Z@AdxD+Mo`wB6&mS-B
zQhSvxeVh+;phoY%o*)Ofcg~f*KVK*Zc)9t%emMS7<C)KpPsH=kA0PWs<<ZzU18aJR
zSfyjXzoyQFXoM!h#(0D$@=?WIxrpLN7Sq!&@}ASNPY|}!5fKsMCaTXViP_SpPemT2
zF9ew8`pLr)5dqd6>0y<=CU+Cz#i7M4VA&6FaAf{Qt_KYy7$}xB7u+6nOwGwXq;-P#
z53`8>u<3VstAQ&ih-de^QoC%WlTrFftYW#4VnKn*)`VN8R|Aa4P96M8LSOJ_^OFiI
zLU=v9mNb%;11gjfd8%@yU!z}a{y1~_4&U0m*ryGW?D;B%8SjH1kJacIsWxM^z019_
zJ#fJYX+^xXF(y#-clCv;0{ZsMU{``Mp06Owy;&#umru?F_{o#li4aBz*>1GZ^3)vX
z9pM8XSGD{VC}V%U_a5LxcpI;rnO{%d91|$4tQm_QmUlv5rfC^M4K;x-+vMYA8k4+N
zR7%~K>j;g^^tG~<JXgZxWT2YvV$3L5BSXH1d8s=6_<?reV?Kldy9K{3p~U+;lVg2<
zeVY_`(T9FvHtbLKg1--*^s`G2sJ%~7P$^w$Wge*7GHDK!yA-%rai5Y|&v)QV41LW3
znE7$0H%B^(+g`TSgF}4K(W}DL!dcWb5@pcS-Vcam9D51Gh!4jrZ_OLXa0FET!8GpY
zAL>k8UAs_vz1%GARzO9y{fO%HbPxNO9P`Y*_S!EsH*ZGv$cY+3A9k4<@-SgS5ArwX
zE5EIeGc)g<IyIAiEGVuW`o)Wk^#Zh(WYxlv`GcPT0*!w0$Pdx6q%wqveN&oA`LoX-
zxnwOsWfoTv-U3=zB}<*E@^!6;vaNDowBLc7j8VxrpRRaeq|NYjdnF*C6%qX*v0-EB
zVarv2?HC?>F5n+0gWtW3npCSy8FIG_p^?uZ+V68@2(7FbEw6_jIX(+PMy+Pz19CkU
zSVvkyR7`4}!}`+Y%m7r5KO#bNq|wj7qY0d6H%J*z=Pw6R{knk0sY;sFjU?SPS?#DL
zR9?VV>C3&9BOVi&7B!a%AIgLP(4FuZ56+sCHntQ8PEjko1A3%e8ZkUh1x_fa@It!B
zgM7%-|Kk4s^PllY4{@h?b+5j?>{_G0<vr4@YhY6CSp#5jSC=<6Hpo}RQc+2AYf0Td
zggx3^W-ctr1$a3bmvlOcfz(Jqk<wh%)YXZ#Dgr>Cu$4%x%ga%7GBr(A++B=YMHb#t
zqdBM+lQVqYb;IBj&yHZSSw`%n#u^tUkKZ3;!#?=9ZOW9ax>nK2v)YP&Q{OQ(V=Jo?
zw0naZtgk>mFJZ5%t-uGgCgtFzMMSh}T?xWKIj7E0jv!sqM0wx3?y{_XHXwJ@QW?0S
zLic>zxc-u_ag+BMuwrJ@J`=h_`kLix-ne75@X}7_W(QjYv27TriNU~~nbB;6y!`xb
zHhpEMBd*|;SvCfX>EP*uR_>$NqiENObHilEE-1{VifL0p%Gry*xO5caamv(7LCL3W
zx5lgTY3&R4YEY@UX0+n!30n64_KXA##-2gO!K;ucs8Rp=S<8@_jO<S}woyy@l~wgO
zOe*imxL}=+i~?m>qtSj)qwIYdKv2DYv%#$KKIiNv5#P%cKNG?*@J?HLOyA!nQJ3qA
z8m7LRfAx8-n0irZmm|Q{zYYX5eW=U!RNSmV=bX;{^4ejm4z0)w{j;x`2P)R~8G(B%
zZa`0`EIl&Upnx?tKHj=7as1U<GmVGUl-Fhc8Q!&pE+}CiMBaeUCR;K2KCjGNc*py|
zkDv6-Dmpfpz8kKf)O*mb8G4St{N={(dx}A^Vbv)!I)5>b4m>KCSbx&=>SvL|I4Rdj
zolIZFv#T3QSBAnM81am`7DkiGGAf8hj#(Yn$Qt(o^4_--U}rR~kT&H`gtQ?_MQ3JZ
zmA>LmI`Jhu&fX}`>1*dlkGR!u^sQtl=4(@_v+H=hL22`@povYxmEheJ4rian4H8D0
z--S{-tf0oDXaA}s6j(q632ud2xCZ(ZQljOu@SqZ-G6QqdsQA8>l~t2unR&hZb?YX2
zZQ5+z43obgR&13FCqSs<IN`n@Idzy)ur{TRZtFKc&H?#E2f)o<FrxvLc^`2hcqPx6
zTpd0M$9r2PS5=)jXdk{VcQ_*d=FQlAcBqZj3unx?hNfa?F@d~Bn})!Z5$V5;s+MX$
zXPUv4E}IeCR=%uFr}|JQ$zB;|WiH%)Q(*<K?}C&%HHBC&u&~uQV7_sl-NlVnv|z`>
zS(bVMp*Vm3V(}8gqFBXW-;{1!|Kj6n?dUY#q?#@w&nUZ<aa1m~$BTna2jodoI8+6q
z?(JLEu;Mg;swqI$LBvx(L2~f&QdmjDms0mYat%i#q*Zq|j5d@bq?slITb=?4o)pSn
z8zCN`MP5LBCf$n-VVtf7I|s_WJ$iEN9NSf9Q`7?dBogvzsYJ>db;|^d{A2`=sLs1a
zjqyaby+oYjs@@0CzsVzr#V>1l{u_>yjUji{m0;1MwSdw$Lqyn8yxhDPlq6yKceS1!
zP|zy2MF@ejJQp=A{Nxa%$6S3^lK(lRmX};93)g)!B@R{y!}k+Vlm@R$YQV|*_^cgr
zu3ToLZY8|9jZy}dwsZ@g7k`KE@SC#8*SS=`Kv9_Bhp<y(1+;Cp7c8+hP5zsoW@645
zN(FG;I?%PmtA_r_?Ro>6JIP|kZQ`O1!n^j?X1Hv<*a4Sx*!TCdnU=d%!2N0*S1LUn
z+}<z2q}W!BpkrFyHvG>Wvy_{xe<TscbS3J3odU!pt>vC~xsNn>X-9mJ_rwC!$O86z
zPZ`qnM4*rJQEBtiZCS2ipE$v&s)<r>a_VHmj~^e;`T+B?7HVt^@Y=}~YCm^<w;rJ!
z<lobob@~k0d10*;d?puslhoA0*w?rXoGI$JV?X}fDn+;?Jjv4vQ&M3*I81pd;ik$u
z8(i?BxihCA^quffV!v6VC<6oD@<Wd6-jJFqiMD~_mmLv%tC2Q<=3wlz4nb5ter!p@
zjG){!xA>KoHuyRJaCIX%5y!A+chJ)<6M~D0i<6d2eOz-oCmOsE@IsTS{7KKc2!I^(
zt(kMuTo^)OyB%<qRu5t}_Ppw&38n>l5co;LK|z3O#D(|8kMv#|p!^L9;%fL~3W~C}
zr0tWE6JIX36t^4qxTm%Gy#Z#KpdeYfa3L|a(y}Kps)7b8dSVjJ5`Z*x4R$#K;_gJ%
zoMdBMpa*VG39W9=F#4tTi*e!zSMK9AmMzNTkSjose3y5S1#AK!f%7S>yWF4_9VJGB
zaLIq>piq)4Dk?@QZ6dR?YrqH@pm6En5p%qcj8wE|VKJ#eJcGETqbI^)!?)TMKHQk}
zN$S@xFs*@3VgVggqv`4C#+_xs7caiN0Xfwy85vuM05w&g0e7J@Kae4T%<uo?-VzPR
z5w~FrmToD54E%{AQ)y*;Lb@%`TkIq=tUo2ok^p9w<$;+M5YmEBt^0HG8O9X<lJ2;I
zp0XBtX`DsCbhq6c8E)}6cjv*Od%S08-Rj(xD~rgc435Gj)*P$K-8S^>?D>>CHZIYf
zQR@?OJcaLF9=&*j=0p_-#9Wh>HsX{jT<GWRd&?96Xn&Pw0UX=+(PacaM!?=BE~cfG
z{T(~#X`aC4@0S}ME*rFeG$3K8+qEaG$Ebh~>059q^IA_3b+T!7Hg3>wfjC+OsMO1u
zRR=6gwY9{r4XWVGI*%Ucte+g?lr9w0P86E;rIB&gr@1e2R_@C@Z@?46U=5IKYQ>p|
zJMeGMzP4|(0$VNHCdGeqd0y=Ip6Dv?`GT=eU){hEy7zXN1*D~|6b)JI0D0hRS04mk
z1(+aN@VbteQh_A%z-D;hW_pPMy`*#)SARms-ltp1|7c&e)>c+X{@W%IZe#E5g{!Tl
z$gp=y6xKaT0Ixro2_UpKSzR}X(FzRYI~}}}AZxv`l+O6>);Y~}pbIHIT;l|aTtv_J
zS=z#xSxoQ)oV5+5Z}GJ*U=V?Y#8z!<W00GK7=p}~m<aOe_ItvBE{0gaD6a82mA&mM
zfDYX(AL994w5(BBUy0sm?moA%I;0-sj|1{xN9*@KkY>jhEN)wsD_?bRxWr$Av)@@Y
za(S{Im?Ku;bQ<4WzHppHz60@=5wIOn8AM}soz%6LF7nPvH&QV4Q7Q$&fWBb6&GU}F
z?Q<NO$0S{rTPTg~3S>5YMXt>hU#^=6Z>WDA;=WMj7ndI3jXH&bEAQ!<Z#drJ1Q+1$
zJ?ZD{mTSwHaWe(Y^CM3!z4j5HR26(Eek4QCPx(|n07}o#T~0EQT<FSF3a|l=SimV-
zGJpbXbee?bCO~@F{R@65nzrF%g7D6`r=ii^97NM;pO@O1jhni?isNl`Y9d*}v06sp
zM+JJ^JJXS6_hMRH=>8`4FKbvfb<_%o;=ZYYo8ug--`{2V0(}&vxIFXvpUUMP4G&xw
z%ysOy>J18*df<cdYf?q#^|5#}QC)(hQ8w1J)?S=W<9%MB&iD%EVc5U6g8+@>YmJ`G
zCRKvBpSKc#;#ZK9jBVf3@d~S?i&`Fx;*XdGwXG7G=knNO@mti6x))|>uQY^USEd%T
z^^NYM-J96&^@KC+XW(RGSbpoB@5*ri2Q9WVovgKgAle@PDAaK!!Dg~`?wJ495!%*S
z7QeM(0RaJ=x-s-(nq@)PN?p76NA&kjUQt5eTE?+tc}T;eMjFUw$rp-U8Z8nVRN2Zk
ze@R4n?-x9_x~DRQ?Uw}$$+H$ZVG}5A44<rtoifJQeJkDjCBdyVG%CUj3W^%67KwH0
zt2W>le<a(qkmk~${`;J((x$xqbbZE^Q$%HDwrc;r8uH!r{#?>k$o*oTa@VZMm!pq0
zn7C=1IM?{9flTY9rtOj9kpg}FqQ_UQ6eqKzQq&GY$+TXnnw!fJCvw92lAG#ODWJi;
zg&PzY5L!bM;;BtE|NIXfsA9}fCFBLM)NTdW77=>%B3t!Dzb6TM-@<oaQ*LWQ5`Tq?
z00QmRT_=f$S(8nTHv18!V0oO=ML<wBq(YXPDDAIsJ~V;}ID6qbNTUY&J)Y9oDC*Z3
zMLwYnsUKz>HX?7^fT)82G+`++T16+PqzqXg8%wAJr?UDHadd?%U}XG|?!i!)R=O$z
zq?>CRm@PEA*XXD8F0=Sr^^<&U6XZDLd-Yqd&|6AQsFJ5Qg>+PUDR_iUTX+;O=h@w7
zzJw!Q0aA<IKx8H$EUej+Bq34bi0bnWVBGRv9uvlrDF8d6GrScLJHC}r^?70Jv&C0N
zdYDp1a`Ls4C!KV+x`m%q*|N~&lAYwwZ@rP@rTtGp?tgqH@R(0d?tb${Ilb8aq2!(6
z7dnR~O$vD8%D_wr(qy@NQbvh!L8Y1DPlCV|doed7z4r$N?Et9v_xZ5~NWtEE?+?W@
zX42N&FP(XdO#d>f>M=e48r`KW9{Dr!n*jfR4q^XeH2>~=Rc8-#zI8-7Sa@G8=^U}T
zVA#dEgP*4+9)<0YdWR1_{+zx3<nXOq!?%5(xdJn(o!>HvM?EI5^M->MG#7t!>knwF
zswT(Kvuf>ki6dV$kEAFE<lHdH{3IGXue+2&H`6pXuQw+frvn8M=;?K-dX57TmP1Eb
z@BTI}5O!V>H7-l~fe*MQ;Md}OYo^{2SsMD)>dUp#Kskre?Ap;%6WEaG)5z9~FvDt|
zACVp6|89tXF!p(&LoheU)0SHL`2t$cV8HW_=)KXou|Ir^@6ina#EqP@n#(^Z82s(V
z_*8%^*9?-Z{)Bs~R-EUv7fXyuNV|K`$_DNix(8g@uMdun`iF=5k6F<E<W+XfQ)Q6L
zA3(!HM^_C17+1whPUfJ)#P7LwUi%OLCGI?}7yiR5JKLoXT>1Z<F|Pv{zpDIm)6_JP
z#Qcf#e|oOjxK~Nii6RO5cJG(Vfjmm0FxwscKE3EOnA_}6i|nt%%0N0JQP|-1YjowX
z%?&jzt<;#;ntw8oD&KA3YaREFRd#l5_RwIbs=r7J3ieE@onnXiF|Ns7`NNn6RKM9o
z+4M41cD6Rm9cD4LLb`fWo9VHsJ$GPX8$)sufA~I-4YB>0D(&boZuK0m0VJP*B;frx
z8?u-mE*c-^HJHwE&^hdP-i=lLQ2#|~ryCqxK;rVe{b-72@wY*XyeD$Qrsz?+1CXq=
z%x8Xa=nvyK!FN`qT=drX@4<kI%*8#uLI*i~hoD9<qvCkDY(s!g<?=+0KI`RduBpQz
ztLbMC9#&|Zs%q5_ZiTHL3O@9TUO%UH61oB13d!pWW7p~_Iz%e{(X>g?zH|cS85JRH
zP{*0heee$+I{M+Gs+Jb?Qmkjp<%i7oQrTx-<UMJxyg$8rO3WUGAXNE;$m^uGUkB&M
z$45mZCNJKW@f16y>G|1L%lyF8Ik2DvRQaT(b)P&Lxi)^ZgcfT6<UP-pCyH<{O3T(d
z4+~G+7|k{!9BaqAXa#LibcGL<F~R@fIQ}|Z|M&Z-D4C|24y}~i$CO1JYm-bC)rt`f
zLEWiZ)FkV*ao1Lil)*kp>lI!m@Q?e_3i}YhMhymcoekP?PeXIOa^B$HJ6^HdYECOb
z+;x(Fn&sDB4&N_suB{`!RQcas^`E@;|8I8H{{t?H51LIC5fjtR^rx@{U;!#6wNz<H
zJXzo)4f0wiQ{G?+Q!K`j9$;FFyRg|~XX$VDqPL@K!`RY%Ea}|J4r9-$a&Kenyu(Oc
zXnIhG=HFDGI+r_+eZDDjPMOs%<2rguJ9TXvGIcHoPSnu57p`w-Z+tss(qs#3B1dt_
zE?lfG1-E>6Y4I?A!EZ1ZxXUgIT4;PMW2TcLuMH9^iF?38(!>mqtHy6rK`>nT@NWJx
zA<O5uSgVHCQ^e$?>&|M${cVwYse|wPMO+p0{oSv(^8;qrwv@Nu-Y{us<q-fd{`IfA
zNkn<P;E0SvkLM*CDeJZkw&bDDbA<zc57^1B9}PWRW-s<Opbu^kO(#o?*GoRm4B6o(
zPQt$0!@IDPj78?*B|}JqE}~Y9EX6o5kobMvnC5pII}Ypa7OoW?V;9AAMQ0##O;I8v
z`CiOLCSOex^%q|en|-Ig<W)Lun2skTU#oFKeahG6)XKn0S4{{_eBdf;y0?GRDm{8H
zxSFG6$(ysX<HwJ#A|Y-e4W8kv6QydsiDH%lBw6QJ-849Mj!PEu`DBQG4N~6Qv5qt%
z?#3ZzA#MhTB%NaK(SGCal?zF`@C0gDlx?-(ZHwFF-mLTA`{2&*j2Uob!;U_p8XzuH
zCMsa@!Uhj6+%Uhw{1He1t=wKr4pu|t{tl6=79zckN(M{(YoH@JL81|5Pvq<oLzl?6
z{r6uBRCXs{E67b=;Bp-_u7BA+r2A$bQ;K_5YFFeu-k>XD482Ci)x<Y=IUa+=p+1H$
zR4s^~4PvdRu*tK)V@IGi2EtC64)(|``(8BJ`=eQq-tK9y6p9(94}NPf_hsI487f3a
zdZGdH&M>O%2Fy%)t86u2)^*%AbNIFbp?l2uy5)cw$F57U>zZv;?(;YPlQR1!edsJ)
zqtY{cn3b|hBnj;rKbNoV+;p75d%BLkPA@U4YFJcI44~Wv>Q!UX1JJ@isgHI0Dy^R;
z>46R$7H{2XvUiNe)aq)l(IQy=TY3rzRv^rbxT3HFyibanvVUrKoicync+kT9PQ#i}
z*#!wPGb#3rEa`wyXKdyDXr<kU9#qt9mars%X93v>Xx5y<eDKV!0ulAqV`$^%K_U0M
zf^W~cs~!JZ@8N2*rcMT>tj8$LKfL6>>YkG5^nRm{*|i6V!X#m&7ajMNw))~AZYd5n
z$;UVaS?*LO8J0X%o8*>Jw2x#SR1lkX2X%g=<HHRpf01;P*SdeXE-yP2oMt^`YG7ah
z<aAVSKDXer_n<Ap!ym&5fi)+ii)kDhib@Wvo;$zd%5Fo-`0)@~u<-EkrLxHI7j4Qs
z&*7+SDz^ut^b0)y<m8@Ov3J%UIw0#qxa0ojP7=^VIr$Pz6x!v$IVhpumxaU=80qm2
zcn-@T35_$0qIRdbV;wS>qNu^Y>UFYi3EAV}DjyU1JGr^5Z%p)^QHhGndca6^NMI`E
z$na^fFDJV4rY%&Xj>6RYJ$C02S(0AtFlyJa1y<=PQx1lUiJpG4ly1Im76g$Uyct1j
zV@mwmw?U^5dLl~gw)7?|*73o+I~Yhp4g6-%m&a|pFV|R-Y)(buH+X%V8RcrEZI%5*
z6(OBOf5EpK$6+olae8+^>rKOa6E#)+uGeFez2>0Os}tJPqfHzw(HupF!g?-s^XI7a
zkz0}Ap;XjHoreUtc7#TL%WUdF3&ih8*=IRs_FA$P)EQ_dMU$6Z$t2g1#CvPUx%$(j
z6U|&3Tg|91J~LSVoeLmqi12Pd?dxD@HcFyR>YvYi@5)rK`91vHh}htg!F?MIE8%=*
ze`3DlA>C$zx3+a8WF=sW%zVm3)VTB-w?efHd$Q58E$2Yf-tJ9?__&^gMWs29-*lc1
ze=#NZdvPfe^3u^Xw3xpv+z(sL30m0r%Km15bD(^%@sp9dBCOJbf0Tj`m>uUJoQECm
zhv4emt2ipr((LKL+FQHZY*frPOWsoHU;QL*je4cimY>+4=8G$}r~*y;E?7zE7?3)e
z14j6qM(yKD!>T1(c7(56Lmsu1HW|am%VvbS>Ii~$CRAD)^}+G55`U##m%;?5!m5QE
zziL@BhR*f_*`y{)F>eNXOQ&tRB(oqqi}QMMX!ARNJqYJTCtor&L4EL&Jc02()BAJy
zh{u8iD;N?ZYlC%0G&&`1PSTnK1}$hVPBr;5K}qX)x0d59(v|^h>Jq2nTyx(;f-g%C
zgqQ3NEP0^xi6@{?ID{Z9(YTtqWl@;MRKE+``ZeN2UHFbV#ykBelR7OR>f8mTz78Mo
z&oY7<RthcR5C}TjJ!M1oBDPw7g8p2C5!`gwSTg2-u<~7z>Vt^s=iW!+3I=|aZhvP?
z2ueeZYt~GMw^vD2+|AWC{gy-x-rXcPUeq=4*^x6WK-zFlMB+4(Md}xAx|r8l_J`?r
zfZ=5TyuWX|IlN@R@~*UQ)|~75QblR~^kIXkofH7=tp0T@ra`&dVfza&Yyjo*QhK&=
zI@aT^Y#cS@vJ*lK#V*7m2V!DbwnHqV{9u$IN*)|Cw6+}S+Wls0GPT&{t@K$#K!K-j
z!keR{bJT{wkODnmtRh(c4&hltTvjP;DLv)bfY0N|wCOC`C>s({fju4F;AA2MEo|g#
zPpB3)xms2Ru8(76&eQh`EOk&WEM=yK>YhP7*y>bJ8Q=<3;Z1-FBX7v#+BETKp?yi+
zXgO$^PftqKeD|0oqk1hvp(a6F{7!FiEB@JQYnU}F$6F$+>B$}9!c}rJXFRmU-=6vH
zYigG*Qmj0@Cq~h?fa4jKr7uM4JxT<J)aPEVclx!9HRHwVK49FQG_1{>ml<3|m>?gZ
zwaPrEbA?B8z{S~+8U<_POM%t|)$7Gvjn1z%Ip*=6c$?Z{D{$#1wy6em$m#4hu#w?P
zgS@~NQcBIu2vcwge)<76Gk_?DG;*uN@0H@pSeCHcTn7BR+PfYf*L~#xUdTaXssW*$
zRNCC-T|`zP{2kPgMtJx$<`}R$U8Ub`V8$$2L3WkBq(c<d)c+Z*01ggkAI7q_1q}bZ
zXXeFL-tft2!RzBluY|IO=iVp-L6repr-A&$WoI5bA~t)N-`oX(^TA_F7YnfaH-XY=
zavxGJp6&RV_;<W@$nZF9Mrp9r4Wvzj9=y9)=KE1sY-;Mv8D$sMN9B15Wp-KavEZ`M
z?C70TTt5ChsRoh%eW*L%>8Wh<LauP=w=S3ufwS6+iXQIwC#?1Reihd-@BlKxOq}VC
zTRrZ!m!CpH=o!NT#oj@Ci|RfpzbHrRR~odNfJ`ltZjM@D@`&LqLCAD}OeoTg@f+T;
z^96FvNcVdZE!)l+r*Y;<<z9VvO7}k*$wtd2L>gNLH{<o&W^8(m?c~Ej8Z;m^swyf~
z12x29y|~CedW_*MjM2k^6vRVMXR{Ebn@QT_*8q^|A*fL&wp!GZJdc(R3dc5ib+SU1
zuW;<vZ@k-uwWyGH<z)Gbqi+@C#hetj`V1PkdcnOz2GL2_`pXjI<TTV)j<Tf^WdmcL
zE^LjOlNYZBg*v6(6uwzonW4#u@rISaJPN$ksMfoV%?AKiKX0<%aejkt5Il>_&-vml
ziNMRwJBFQ_(>1bR%Z9cAXTULXO{4)wA@*1^V|{sYe8AxqhbHnbm#!5JO+$ZyEKn0s
zBTXFX)u3x31xxnCw`TfJXP3Vl6*0#cEuS)&0$x#qUykmZ7PTWW)sZy;&wWDn$)ob-
z9?$ETYIM`2`l>Ze)^0@eN_`Xe8SI1@*1x=Oz>n4FNs9D}bS{MQ;~Q8)hn|!P00$U&
z@ElZitT3mZN1>YN)!>q-juA8a`@|IO(h=kCCBg%OEX*8T>q2K@h$!GI@3WP~qFO3H
z*ZV+lwZ~uIXEc=L<2{CGY0?4B@bO?t<uVZ2(F3=*{vqMg;I6ME+OaM_v|a`lj;b(U
zgVspnEl3KnX|+9`R?FDGgCtu#8U|E4%5a;Hn$K+PIA&kA+Xr_;>wj4uaSg%XO&uuE
zLcEL#_nWx`B40P(llQnSlG5C3fKCz)^0aZ=b?!0)6=_F9HkRN9AM*7at2A-#vR9~6
zy$V#nYcs0N!mtOZ{O9q}e#A37foV2!ek;f9tm`R{j2ADam7=uEGCkJzsq*>f9(CRa
zHw5Ob6Y>2mA~*-wr;ia4tcWN^ps6tFt_$3~e!ap5-$=7awNRVL4(5hmNBSI*oXnG9
z`Fc**e(6k=lp!5w=;rvWc*eZpTTjSY<3Z@)fL8{o#ez{Q4@-!pfZa$^-$uV#q=j!1
z=-ZKI?Ca!?BWS0S5F?SWGow~kN7UR+QxPLWN|J+4VYL<o-r6vuK750BITvxeQhagq
zIBdYAv!!2Tee{C`rn(a082B^UW&C?E!adBRim|$`;y?83b}<RHb*IeKLJ`Ol9hnib
z^U^gPrUULAi;64gix1TR5=%n)#&wS0%4X;z2Tbbh?Gxu6hf?QBo6@2qM~LiSa!55#
z*7=dr<>6dw^AfeivJfnw17y{)HJZJ&TPz_H`osp|GBe*l$#4E_UhITqPC{%wi>dU_
z{<2zOr4yr$z00jIUyl~fY8M@X@(8J0#2Q5h3l!+NN}@jHs1=K!!PG*S4c$8mVtP4U
zxX3RtH2~wCzZwZRC01CqHF#0XM7=ls%`sIjJ3vG=k!z?|rnqroTX0$=ey#tQ;6|o7
zl25W=OZ~{y5D4l?fy%3Ioyowg7<-wc!Xgv9Cxd9$&_{#BtBdVg9YSRL(qvpK5XMF4
zd@%q>zeZ^q4!~KbGgm>z8~QVwU$m=+xz#xd8;h@boPvX|^{!6u%zN?#DPxVQqkD_-
z3Qj{%ys3VQ436S|kNPVCA;+DxaloW~<az9rqP>{a>${jMmoz--;i{@oE01s)mNY3H
zJY2#g@dlWmnM0zA{gdfVA?lSx^KPl4FBMknSgO|KpU;IpCX<UG=NI2S!!A{3<c%tB
zKQ1P^e94#{s+R4|zkEi8j+xg1=M{#4y^#?SDQ)WTrWVn;2CpMv8HCq(5XrZ|RH<IM
zshHq~bM*O9TJJ8m&<9=&D=|HJ$9L$lt>Q?yZ90lm#u`m|n&mg83s0kOsz^xNkCq1y
z`O8+>I6Wv_N+be{B_pV#8wg`PWVtrY5cvaCberKr#~~<WcU^9zM*BGR%&EJGY{*kf
z0(oZ|e!58+w(WK3Wu4EA>IHUqgr;WBJNeliri~>mX`{tB=QzGu39v3+a3ZkoY-4t&
zE90vFc(xIPJnp#P^$eL0o4nYrk?hjsaFAUaj{<f@oi#ud>FVgj%B@}KAr`O>RMH-?
zgjdTOq<I&l8X?buio4e(*Jo#DX9k-SHRJ5YD9>tWCV03*9Fw;X%Xw+vld`OKpiYTX
zy)_?(YuNL-rlQGa2otIqLeU%iQ^pnBWyaI}*1M<#wEt~{41ZzsY}o)N7&VyhI0B(I
zr%5|lzd;YJ7~}ov7MaS;g&?a2ccTTd6NcAGJ3K*);t|oT!Md_8Jtyq&73)ne@#Li)
z|Bc0IkRO58r&MZ|<QHfZ#36Ma?S<G{?%o8iu_g|(ao%+LsSxu0+)l5jikW=S<!4F|
z`#H}JM22<Ss2lqr#V3~r=;>^WEmo7x`Iue!J|CMW>Q$u(iQ+_8bs|;X4-tIpNZ@K;
zzcG&nk{ABoJC|zv?#iM2n{bP>gT`4&%~iV!qah(O&Zj?am}5LQxG6pf#JeW{gtz_9
zki1J!ec<PC$ih3uC1ZKKx|m?used}amh8Rub+CE0BX^n1JWwr)iqT2-Coq)6kahzs
zSWES)OuXb>8J4p(^`|soC%C0;1BaAd=GP=zk_s{d)H~=h-^E0RTxBitT8a&P4m}pM
zN8S>v3EFIbXds;Q+eDUu8*dg+xti*(ez|NabVYGwJ~nK%i>iT}8;=S~b<n8FHt`=T
zo}vPQmo@fY@&4~~D|m9$r-{?s5&4(62=rryH*k7*F`et+BD08a|EkJP;tio&LG6$5
zCxyHrF!nmvRwOVE96B+a^fc})Sx@?dwNmBvMUU0t0?TfBgNmnT$qx<qiy&b|Kj}M3
z-xL7y9xk?MCSxCjj~Sf)GfrYdw2-L4$N{)3Ie&s~@?soQ-J@#yZ_l(i+SIi;Bu(rd
z|Jx65J_PNg`)<pou$ECb#|Zm9)#e;^BoxWCM*i3Fzg*OVvH%L81=}~x%+otdElNTD
zUNsA-m9GUUTGo&p_Ac+7otXXFJ+K90?jQ*I+Z6w!>uRLzPz@{;B(Uo^tG^0_&SOLO
zL|Nl>64F3bbSlxfY3SaYTs>}_{}*7l0p~exeQ8tX<QLTqD`0Ztyzao!nw84;B#p^S
z{PHL<n27h;zvGy`crjbNWWwfd8gIzHQ82?JRtdcq7WzSp`u3RAaPDKi%cv!FmS!MP
zEZ{heB^I2njl+8V0s`P`y*ltle*))C;s)ZT0U`x9%|#m}XCdLBsh~ByeSn@4WyD5w
zE<slLSA&X@`>$Ja+*j;_(m?&rd4=Mam8TT~g0MACj*d|Bi;Z?;Le-$o5$N|fOun>Q
zS6q*tQ?d;D?c~5ST6D%L<#-m(ZW*$icE?uLvh2yu9Om74srQCCtzSbO{h2^t#>xAx
zCV!3o1^t^hWS5=Bvv^@wk4W3t>vhFBPPH&nT>9T^4P@1C=HE3Fy;f82651B#&DqF$
zrxK3W3*oSgx-8(LW65%r5X>+r8yRm>_qJNgn%CvRY0}@kEztGp+tq_fCp4*~eA@xQ
z6}PlGBHX)aBF`frppPgyKSr2Fue-n800-}-7&rNdum8{uMAhx?FYa@`)=yOg^Z4xv
znCWsh#0+qZu6Z#!?Au|@3fP7;mu&U4=q4JKwlBo+`=x0{=WNLII{?zWzI*t4Q00Z8
z4G{FA(AK2aSH+!WlFSX1+e4KpQztewH~@9u;#EG*es1BCy8fp#x*M6^$ReXcPPBu^
zRJdMNB9G2eb*;yMqDgh+X#LuSaV;%a{>NK6uws7{MCy~$LZ5+W<u|hhJ;>a<$5v!N
zLg0cGEeL>p{P|Nsl1q)CQt{g}!^%#|{)GJiw99jereA&LfGA)p%7%m{ulCldEDNpw
zr5<I2lM%biVW&{WKLwMu;Ez#W`ND0yi5%4U5PTOGg|WEerHg4Qt$`p%Ko*XeN<yGQ
zPq2AXNkdc!mi(3A|4~#zL4Q<F-IwK*dXQ8#=BHG(!`28K?-_Q9wjoCPgi?_HwHU01
z;q*^$OvgA;QD3V#vPlRm)TXMu;Lch#n+|5sjEqnkFnqHlv_5&9*C&2mudL4VIFV3R
z082zYGDGMEZ??lHL})ns;l>K3eE7{6!F6sF)JmyfpLJs<q!f#%U~5Q{8M;{&;nkew
zj_@|>X)d1Xejxe_u-Iomwh_2-MxmO^S+=9Z+m6SqwuJFyd3}^v)o8<cj^vSlK$7&^
zl)%}CLd;XC;4v)ftsv)#Fd3GFXz3g@3&#8k7UE)$d^WwRJ@C1Qn2^RP)9~%_8&;NW
zDbE#I7W=Y>y+Fi729meZ@zYLL2*KQbMi^ZLMq0qVsY|J#gxxfdc;@rF(i_9`6qACQ
z*o}NA2^LZjsme*-g%YwK6lW+sgV{}!&$wfq?RP<A8vq1h_)&m>O?u>uUz`qYu?n&K
zfjQSEGGC1Zgck|NDfRa`WeOL>Fsk4*CSzj@|5A9PP8Z^<6~@As;xJj4HK3vE+Oi|!
z@JQt*8j^C88XsOR%h|$7#1nT3!W;EJ({ltHRVEdDuCdwNZBUN3=4Ht21NyVzt&x3*
zC$<U4ncLul!y}lI0SE&f$P`WyTyh(1aXI17)X)+w>)$D6>}RzaPGhl^e=2@q(a*Jh
z|Msv-u3Nv-3=dwR+eq-{AQb%a`=!m8GZR5e-YiR)8U|0bB!3V{OeNE`&Vzd#UI6!1
zZBfmufb#`?@frN)F%ocbNMh)|=c3F(%~z_!7p~hhyjOZOmXsV@N$_OUj~j-PrM~Ms
znEegvHGFEzE)r%@1}a*r0~{8VQt<tWp6*}~`zv|97jkUNMr9yr<XDm%_f-`Pbt1vO
zv+rX}*<~4f^jXMSA|(HbXHq?-(tEjQs6ye)=593?2FS2z-Z${OTx54`;fa&9zOJt1
zU|p<X)EQQ<Hg5G!7I0koKq=G;dP(|iRBq8=hpt)w#jg=hzWPhEbs2xOmUZRgR`7^i
zLCyTG!am%o^><6mq}uAUyNKc76_gM8GX+7rPy{aakJdnmSI9ypuK*%4(qPZd6j}^C
z)KO2tk)s!AZqc06a<_PzhE(>eut3D2S5i0Vs2)cauMO_NpHl_oDd`j5;8(Q40){7%
zdQbF$2aU3@u*U7sK;W?wY1@e5&-B}CzCqxk%RVHOO;{iZuN)5A$`nJ>*}4zc)h;ex
z=gNJ{Y;Z*`sIll7O5Y_l(?IlLq$Bc!Ww#*Ls8(HS{^}DIKRh(m%^3K{(^-!`o9}P}
zRpRh<V)+H!h?h(2!C9Sf1>ZR>cHN)J{YOr~4U})tMm|0-(JgkqdeX!Tmz=y<{yn#}
zx76WVQRquG_?<PqMIpE@<Lu0{tjEDhmSms+mRM_I#%lmh$MZ%mwx}JHr@9k(Y&&H4
z48g85fx{paz)Y=a(cs&V4rk4WW%DSPNQe8zs+~c4dYYdfTXo<>j9^fesqL?klw%$?
z2OM_Yx`2+rcRF2%&UTrF4z}#7fl8i|xeYsQA(JH)vV-@A&png|i?^%{bgIn=Sb7he
z)R#_*oBFh){-eI-zyG+Z-tP{_lNCInhc67>0$Ex0YPB(K<Qm5ejKH+t9d3Tzs*>Sd
zPwFs5SLj8)M6OuRO!xExWga87y39oU*T`xYRO5Ba+n9qoc>VYuExmH^bGyuXU@hmr
zMj3xGbVOiYum14?^Wxt+nE7G=7J#)Av26!D-M@fY)$YH6EUesMs>1z$#@_x_(GaS5
z4k#45`jGXY49&l6D4+op3e74yQO^IV6k_!uP$(3`CwE|r(C=e+{AHm0Cw8r*-r!G<
z-gOnYQt|cd&Hw&7|1%Q(=p|qx?SZO!y+0JLss67q|JRuRxQ_nc%*@b2MR~mld7Ym9
zBe(s=K`Ax<h~>#75tibFIJSn-gw<O%*59$<N^A8mr=5)rdQx`2Ov+FuMA<GtJ~xXM
zYxZkZ++Tf(WPM-X(Z7k^tt}DH(`N7Po&9nEPz5Y%txu{s$6;LF%L)2IC5aKtGTl(G
zh}hUz5pt?=f}ZYl9%5(R)!^$xrD%wz@Jn)9oXvhLObsKQ4be6ERBj+1v@3yV)W&h%
zUJkcV!=0~5`O#GLvh_`i*2|aBAIXolV}znbW2b%<TP1d-UFCS%Owx0@is8oHAP5(v
z^3mI~F5uSEQShAf(LBB8tT;BlM~@Dx^goqYJLhdJ4}Rk~XX92N|D?z~hoP^Y?__mA
zeb;^6>_-g3`c{WT(t>hUTDSFXqwbfit^QQCpru}`1<&}(;rm~cW;B{J(}b-d6WOt&
zg-<~p1LHsOy%V4K&}NU{3d)eNPU@hhYb<7LwdBw9HPau4*qOv_x_7~o(*0&}a+g;@
z^HV?Oe^}F4m-quxL`+RrIEGYqxA&;1%?ANeFp(xRL(y7U`u2OdN(gSUe9QQjjA^)M
zDYrNGLG3?$>e)lD(VY(lk_I10^w*t}%ri=eS~7}HIEiTd%dPK+bfs^<o*%~W9Z2@M
z?Q{6aDjENzUwt)7vlo%~-C~K#PjTH~Qul10nN9odz54m>3zOdWy}oEhoqCB9hRrTG
zkY=|_y*^lXLA^1&n7g%Pt=f;WEG{O7a`mNc=Ff77n>3g!2Nv;Au43*vJ3yyVWy!Pm
zB6?5SqiGqBP(j8Oa$4#I2Uusr1NW|W`XlAtamSH1%ehAp&ZRq6Os~;=JhuNl$4-d;
z4yt+c)1HNN`M*86Q_4AJC@)=d#isACba}yr7)f;Z*Q|lW++1su3jcz}HQeo;t!_x`
z<UKX9(VOaJ8fIiucI!v)OueyQRVF#km;B~i2fW9pR<qJ{_)4<AOqimhMOX1RIc!u)
zVcX0ToBN(A&LT?z)nx(@ov<K#r)M3X2cY$zyq=Z$Ta2ZmYHu7sh7fu>^zKPh-d*Qf
zpJR|d-x3Ln5u-0(wfuT@(2kuyoK34<r_;u$-a8yKpe~5IsiuzMy!cyqs*6R4>=dLG
zt#rkfz+}|h`<G;`)7<Lt<SqOUf27i)3K74%d3&MMNDc&Y9Ty9c7{9{hvm7@sI7&i(
z@gKSvRwTH?Z6ng|P0@6Jcgw0fzZ-6V!R`po%PU9~-sq+wm%SUxgHbO>P#<q`VOf*U
z`h6yz+8PW?vk7rb^@LoO!0X87Y0@@(%RG*tDq%~Yc#xL}7EH(BiXO8&7&ZkC@oy!I
zhjjL_dYYIcv`W^UL8#I#OKnLHeFzB@dyM4Wy}iR_vp_jt|J^Xc@n*?Z9xgFT{A#Dq
z>7$+gf596++!}R%xs^i8sC|*9W7e!YEqYJ;INJx3k{xEVfTx_MbGvqh{Y7pP@k31*
zG1Ye`|5{3u$j~vj77!}W(Ok#--RF|id%ahK5_5z`9IeT#ehGfZzX0SjF2upBo`{lp
z4%dh0xd*-In?WOW5B!L>nf1{gm$1Q^HQz5XiDb1krD^xM&!_Z2Ao~j!{nOpn%=&0$
zA&uG85V<uSg_MPn{9qelSCJo8PW}VJM2yAo$L{eu|6@c#!-FB$VRG44@~27Ea)fOo
z7AV&5eqEzLrV5Jb_R%<nf^<20ci)}cpAR{+0Y}wZ2n@SNGj1gi8d{nM@%^;2mZW9V
z+<~0VUj!@s_EXxVqZ_qFZ;LCnLD6brPEORvw}t99s2y@<*L9$$A3=6Cj)86E7)?*5
z(v*xuIK(tkR?;vKf@n)W?z*UqP&ZL&DWGM`jrO2YM;*kXm4&F&zLpk%+XfPLa4UbK
zV)!Ap1CAx1@>D~Q!>Wv_pLEl_am>(Xt#C{k<!_m>VHT<QOJl{&MU|#jh;!)j>3A2f
zH!kz-k0a;E)Wi57CfH3$+00>3sdB!<&<hq+=JvI->&iZ0{rXNF{ad|zx@Dvy(S{G<
zuduag&sH<x1-r7J#RNwisCWnO@k^aj6*)6nZ0LF$`C4cDp<UXZ?kaUFKftJh@(QoZ
zj+N7pTHkD%A4OaInr@k-Nl@a2?NOilGpbyZuogp0Er}jX(g|=MK{E}X0qx^bwQ8iG
z{BwGpcBla5{qC6wNB7<|8K`p`xi~9p5$3_R>%8w{p%K9%8B7uVn$#7bBDUG^%A02H
z*kFy?+&>e!ycOWHF0JOoce$3ibx%n22xIkORvzOQr{3gdN4ySZ40&`wT_-sijQne5
zeygDSEs-P%0ks`1ZF8Zpo#)YeTCLf<?-hpMj6W1L`?*TNm*(&(gw7RbLl3`(ST1t%
z_a(hd?V`{_fUME&>VPJlcSE0kB|e`j0~6lZl`h-fMgCmTByhFd4bG}W^Ayi8xW$s1
ze!=N1+h<CtJ=(^e%%@W6)TyvHX=!fmagF=^feaV#UBNZ8CXrb<RP-fjnKd1+1T?FI
zEM&o-;gXDId*n?tJ$zz+*Y!2cXKDr!6VEy)xnKA!edo=4L|@DCUBpSq5&zMI1@Wa9
z>H!S-t$>l0bPRRuYD|z+uNgi^jh(th5mS60;cp~)d~cjvP|CXB#SDD_MxtsP+BcVz
z0`Eo&v~1t)Z{~KwE_E&Ixe<tvxvOlRiv{}mzwG=HfqwF}If;dCJ2qn*zipxBR8pAm
zepGe9PczFbXHlxBpMybD61do0SrCEp#@{v2^{1s7+y=@}o*c>0Q0_fp@lx@rxa@Xt
zYijl<X<3BpSfhqZ;6_$C!v3#)tc3P$7}qU_n#Nl%)yDX=j-bmJ<|z(Y>fp1)D$fNI
z>yBX-AY;B8qO(CnUY)Pkl?-yipy45Ru3ooBt%QM*D%b8%i7JqU5;O142pA+8wnm7y
z6y8;?+a$g<vgm^Hm$g)mLD(n(V^q<~AO`Qvoc&^}*PUwUM_V9C9=p0%PX}|T`~79~
zt83>DqiUuG0y1_Wi@cm~Yi;sRty^~7FRpE?vCJ=H=Biw(l}I5h{b)CP?X7UpPU#iJ
zr&HtmU}wlr?);Z@MFU}#=Z}8|?k|BD-tw@)n!Dp4TQr8D6tjLRzj+rF7n9Wp+NTry
zZm^(JZ{m3?mz2YXPna;PXL$T02itks(2qxRUQwK364`)BFjfAVC>?m^?n#K%f^$4@
zxFLz59S5y&nA)|kwxw~5pvx!3rALQK&0}ujQ^RFoe2N{Oa6gPNEYG(6Dcid9W~(gA
z6RE!t!H*=lm<Ijlt|7gC1rvQ1t_LKu!l2!q`Hr_@^HE;L&FgTE0sCa{wx1V9h9?-e
zkx>+Gs&3WH(1VvHZ^j?ARXOH6p%H_QLRfk^=p;yXi%Sz3B<(yR()(41qctKwa;8&b
zASp|zq!!V#MZZ!%{&8ig6}sc()7{3~x6TSP`e?W1z_$U7m&Nxn1xhdWkS-9bM%R|;
zmTNuNsDAeMSEAHYakpM4x#+|y=;lGAnbVB|=HDH&@G1bgD|@R6IY1h0^=@?r+4P+=
zgB5T2rufabDEfXR+8R3>k8Y(SCyUbq*L&+%zehEZ6*d}AUIGV<IkRaZp*?otgDWzq
zB@}<gQt}eX`jSIKHCpBN&?Y4&a(4A=s;^OJOo)QzeroMNDY6I0NJmYAT!fr)S9#O^
z+FP?sG)WTGX<veGo%zJc-iw9M8JbU%u4A$$9}G}&T_6|7^8IzYP^T2QZ?TT-b8CBP
zIHhdxp{P8sw1p|Gl)B#%uFJt<U(>X?_5um<c_2Xkeuw0qxf|TP6}a9MGQV27*<|V5
zy5SQHo^L{w#Q<zBJ{zX%TQK$o*=9w}GyJB0L9~-%<Z4<BCm3RGj(FxKDF@fTilc8^
z=8OK)2p_CHw4NN{G#lo~K8xm0=~VVUM26V`n~Mc1cJX#zKjL$Jq=!%R-u8gFb(Aca
z&rUYeDcJl>=e>Un>VLYiU;p(19cAl$7lTc4zjmfJNXah>PJ#$l-zhde!u5V>J7-}7
zavj48nSt@j34Bl6)R!u;)Xc0euNs9t8DM&#k-8#0$UXK0XH5+M2vv8TQqx%+D-<^$
z{kagPjnLv?^L4yaWR)1~scp$+%kv}W>f{{VY&Th}8~X(JQ4=?GbdX=&!8RaWLxSX3
ze4{s2{I&FY@XwFlYPhnMumvo4nG-f@2`mJ!wF+6f*tkUNVNt>_Dbfe}t41B47=JDr
zoVo82A`dvdGu$nb1q-(VmtO{u8>lzg5*;5EWG;Q3N)O+{R#zHzs(R@nnkZxPXRi$;
zw~Tv#rHu?mHh$Zhm&A?x3`4T;TgD9QMn-AmGo_Yjxe~k$F99Bk2ftAYVc)^zr=n{X
zbY)vQtBV~F;pmF{49RMk=dGD{j>uPZeL|HdP$BA_5JdiFE2D^Ze<q<^3GnMYX$Nf5
zaS!Nup4LTz;n8H$BweA8SFWzs*T}6dsC+;^v&xBg0^1qh?B9&GU7qP2AYKQOnn=6s
znY{;C&(k&>@s6^1hH`xrxyKAKz%$mIuLx;%!8Gq#g{Aea)8C&Amf#)wvCm3Mc2Dps
znSJdz4ipTs%<#&A28hV=Z1Hz%{}{0Hxjkh*?>p3>BHe#Pbb;i8GP^kSqi@~iK@D~_
zcK^~;A&#CJs*BI<dm8(<w;yx=4?aoO0;Ze$GP&9v7t2qk`Ou8H*ViXdxTc^ossD?;
z_l#<)`@2O|iWRUS4<LdCkS<+7nhGjis+0gq?@~gf3y77X^xhN@5<(9p6tU1kha`{?
zKoJ6@AOr}6cDK*}J@<|?#w(8d;f(X;{lo_{lD*en`?uC_&bj8~%q?iwDe}87QyX#F
zC#yMkexf+IxC-R&A0H_cORIlfb-&Q85ne8v5)SXPP4TTz<Twfk5-x(}D};Dn&w){W
zHQ7iZBh6Cm<IUwhK}m({^TR}6<F;Q9lb-iTdh!m}<eEz6HS+kn(ixMKJ{gD8Tlk0p
z%6#9XLq{i{nsY{uMG}ftZXGi#_kA*g&u8@~oO=m|UuttcF~+~AG8oRtdTNaqm3>}`
zT;C;-aGyrJDyFQ0LXby0Kv`8XGnP$G4Almce7}h{^4AO84(&poZ2Yzeuls1$o!uQq
zrj9?BQvDo>tE)mpgV(3t$0xzi<lW-PJqrlm!nmot!>~4xX@{-D8}>Z*Lp8~lixP$-
z#27C)vmh}Q6Kc{gmLmwuD-4yAxAGMOoy&jjp{`O7u}p#=vzfHd;(-0DY>cWmC~%4w
zLR}NRZJnXh^cFTsEjw5iNGc;Fx~CQ4C>5-(yTxe7g7VT*vcFe^yTGb1?eLZ=o(oY2
z14)w~T4ex667J!&iQM;5M+*ykm|qM9$EMB&gT+m}N?SFRh~j-m-fyP{ep%hCl_7M(
zt<KoA%-cm=8)*zmt+8-=mS@$@19w|<Xiym8QVW-Je>E?REM6*WbDRAbs0(#KyI0O<
z2A1&hFp%JaDb1ybU?+ePuyV4TGM!)mt$&!yT5H{}AiaSf9B18QHVJYS8Q;_ALio3d
z6(;i6S4Y9Y18bzOL4?C48Es##wJh|sD{n1Td7a~=@x;G4-nE0}@y6`|+F*C*ZI$m+
zh`6BolFS|puV4u)X|fL^<n^l37F}i3?Iz|Hr(?vQAwd~nrfYe`>2N!!^)Iu$&5)8H
z2_D7Ee1>Kg<ELPm5rifRw^^EZNcptbOGLM#kXvZ_vhx~GPbc$>Pb|KmO<#7bpif|=
z@n-0}sJ!BUUrxo3YWH;MyJ$hEuWa2T8AXX9=IsKB+DoQTV?4322fMdxp#XBagTr|C
zH3aT04YsufvXF6Bw8O`~TZt$&@Ea`HY<u`u_V0$k&ab@S{7w}dcFN@Quo%Quhtxy2
zcEf0Px*v$$36$rCHi8bqf?XOTMQi?CE&)Ddb*!N*26dkvw<h&yKg&J8lUIKQR2aTl
zw1t$KaQW1MVw^3$uK^`*HfdE_+UEie7vF{}G}o^CzOrVS@V@DDJ=`rW_BHan-byGK
z`8=g%abV3k7B}Z?gBe6%ush!K%8Gf_Q^{K~wV)8$!$B9b&dz&g&6zp1mOdMG?`sip
zD@;i#ka*~?ZFHdtE-+_}t+;A3$6V%X;i*?W^YeKw<kmR{2%;=$nVJI$l~o$Tq66lo
z1Jr6gtk}pGcKo~ti*bGAN_F!wUzKQcN9mb}2+USTXWt`#A77F(H%OtPr_h>Q{)*cS
zVI^VvfMTDsLvQF;ys%m@`GR#5e$#e}LU1NqM_i@ExA~c9UndlMKd-m8`)3NLO4E0#
zO@a1~wOGni3_?7Z_gJ0k)KPzid#}DalwndCYCgDpiI5(P3nR}=^$)DX;s_PbVLYDm
zF7{g*irLD=&Z;AXj|vo?>o#Kz5+dIMxncO)Ymx8b`yM<1EU;rgEt0xDKHGM1n4JDB
zNq?c#HZYa!mes9W?`UP7eq5RHxpAq)sa2S5#iq;h0d~9}TLg=k(BE6zmiDQMz+_P!
zn-;+m-OncYcuo7)&)~wA6iqN)<d{g8;+g8Esn4{$ft0$3WpF~{_LQ==H^nLv?y>ej
zC9q_}0>9uSq_G?DS#)d2&5KWedI>iw-o%pIdda~C)2}~6m}A)m79YxQ?l>;*%=~9;
zA9CrHbEu0;QiCE|qJJ6bUsE=zARB7nUGRK<mzs*tfV{sd$5*0&d|P+b<}&ur0+>(V
zuNqBjLgVQ{Yu)8Hpx+%*yF+Hu@IB@}1sM-~M2|^@%=-A8M*%fhrw@1=%K{ZrlHjUx
zkK(gdTbK4i5sHLH%kM1O!Ke6moS&&X2*KYil~mB+`d>0EI>eVdKCYU7FqD(K_{!r<
zaYenPcX(W>bEwa%v7+^rRu%c4%J4bVX0^SS_P6B=CM-{uTxyQ(DB~GT3utL`;uieA
zl=otFx#jbAG{9@)&=m-u&Whx3yr(I(d+NYpOI^l<yp?2xSGAsP6WY2ca{hguV{_Vo
zEym1SI^{WB_1X<u2pJO-4q1r_m)dQ<>I!zp9c%>B(N@|LT*e3HKwD%+*&Gg9lz;~W
zx0i*=*>Q$YIezY3->_X5?%Ib3d(XrC!6TftA!=_@y^@A%m{L&G#JZlfOrmhGg7O8J
zM^RX`>VQqIG^WyeYMiTD-Eq>Pd~ChmPzaXH31xENAn`|S?A`s`25NBIp;JM$rD<3+
z*+6wd+HyZ;X;aK-8g!UMvGFxM!>!`qLV09P%#%fjR)p4Q1P6W;k<i1!Q2H#BK6{R)
zx7^WFY@PLk`YnOqhV-3cxgpoapWWiIopimKFr$n~l}oaT&#W?#OCBwr5wXR!y{fl+
zsOPE?8n>{%!RDWUqlSf)H4{Eok4j%$9DbH#JL}cp;qkC31igjb8V#IiY3sVLO3IMF
z{oawB47NSV=RNiLfx-t9ug$VB30_lo&Xw_m__X+P=sg&BbRc!uOY284uSJD`stRVM
z$-i}i*~f+5)lpOp+BF>aYGu*F(!vtDz*kbAa(FV!J7^$eo1?M)2A--9?J3ULa$JS2
zt<2;>$;#yuUQfagtCa6;PIYZg`rmLdGI6t1F~~&21itJ&5V0cc48YiAdbTBRc0OKX
zpU!IVHuB#D_gIBAONCo{_vd&br41&sE=?I2{5qu0#<zyELGIKdR`MXlxbYY2=^{1y
zmDmb1wjt@*JKJ?S6aOG_EUO1h!fexlBDJIjZJBTgcfe6Y!>Vn9AL%YQ=2Chj?ybaB
z1$r6fF^v0x4CLcw0lD?}ayPtNN6TysBp0!FYeW2Z=(AxoBwCcQ=DdwNZksMpvgU1%
zc$K2g<(*g&0s77^2x0F#GT0Jhsponv9QVF0q%CfMN|Ev+Ic@uDpF>vtvk&cd%rf67
z%A8GNvJsv(q3oH-73lVMgE$IaDRDFnDT@ny$5>};`D!;_iUMc%C<39CX=-a}{XI)U
z0mFu_A$ZUCAeVE2$aZE2>ofFM&mZCBU_%KCY|#TM#jl!o2sc%h_7Ygju(`ulw&&kT
z!%NhkwJs)`uVCsk=rsQKz@3b@`e|7-{`&T+`bkheFV6D#A<*n1c>a2tmmU{Fef!jr
z%g0x66O94QeO!_hQ5Utf7gu1qwFj}4{9H)%`qoQ0_-BP%`%)p^-jyC)jegbz6zA4@
z#*0JWaV=bdwHLF2?#`U+(;}@Ed{+$lCRjDp_VAMGuDVG~@NMW~A%V#So0<7^JuWM_
z+i5_rGHXHQdxTU#0qd$^`j%YDFI@Lrs{+N{r2@p|etn+f2sp#sp%v_9D8lO;3If>~
zQS7tVa0X=KJD5zJ?`f^sE>ded{83`z;DTMG-`1;07kfpSy;l_{z4oqtYN_B)IA;2W
zE{FcY6Y3tbh{VzpYjSr@0Ly)^sU_i&DPPEm9So7$q(qk*aJPbbt|gqd$!hdd(S&}P
z{<CXQ<R$TG()Akq3gb@8u$eOI$~-55{7+ed3-)!>n-_9v71YH%5l1jS5WtOnCUL^3
zohjt|idvOtJ(Yt%NU2c3i$N+c&Oohc>u%%js={!Q7n`+N(B{2z$Dd(4MfwWZQqE62
zldc-X%y^X$Vk2etb9fx#(yJAE^rA#x_$6iK_k{y(PUff`e8a;0Tbg^yv~c}uiiHnV
zf{Wc-(#zU3#UU7-gdcE|vYVJR{NZ=x6v3CaqOxjfe$`rgvau>HKoMQPTm1c}Dpx@A
z@dVGG67dQI&<h0Wuv`_s5&mR{v_?ROsMj0b@>ymoR(Xh}O0x%tV^>wx3heBy*(Pi+
z@SSHgQEs*&Gjz;U6P{xW^r0`+WtXg`QqeapUfFIDiia`aD$<k&v}g)hT3?>NF2xbn
zu?sF3xxeeE7~sTCE4sC-)l*)h(j0%UtSw<MWOVASd3AUY_MNd*Yc_sjE1Z;>D^qC^
z=3^^7SAKL`^O=DM9R<LPmv@@bL*x0yOP`szAjg8K-qGZ6L*@7i6_+@k+1Y3P83~m5
zBm(3!5D>sWec#mjKqp7(m5ZyA0s>~HnJfnnA`2hng6@mkFR>UMJg#MQ_O|KC(5N40
zLYTfuzGl-B5giVxI4$t@&{8h1vkY>4mEg#=i<Qa<C-(a|pKHrjrF#={uyZ%+`|Rp&
z{g|P#Q;C)bdH=kdxz5beLsk?#54Y}I8tsMG#)b`#1(cR$gvW>|v(K`QfT5{Y#bSnR
zFK-(M?Y!WWA%EJ)3DY}CE@K~$R9gbigWU(AHy^<u;M;wGAalukeHqErbk`v%$0pMW
z4-ZJ1ZM69DsHf|@S>lIl%K;-KsOPmAkHxSd7xQRHk*`lSQC&?)hsRV`ba3lE2(vhr
zpJg)q0oH9>ZlW|Ke847?{&jCc3mgddMfJ-K`PwnDSnLcGp@OsHBePu({Xq9NR7Cdl
zt7bUo5fW1y4a<Z&@9B^9J-(=p2rVPL%X}!Cah$fT#5rN#!IWG7<jwh!hSzcx)(ze-
zEPU>zRD@f4MYX)>e(7PQVkWbXv>`H-`LobqrlHE^VE^Eb@C@aUa=pw}8!H9a)g39%
z@BXShqm4ZQbzAhp^1z)t2|41*@vc|Sv01gQ(R4DlDSitf_l_%##Cj}9@C@Dv`GiHF
zKz)+i3*EBKSs8Z@L|!`L`gT3{Xhhe9mNjr<HTEVpUlY?Qsib^I$iG1B$ALe$F6<W%
zGG2>EX0@ow>$7H5DS~ed#OT&{SFa&w6VH%z)>eF1P>EhEoBSSxWvjZap}TC=qDApi
zo7*9@@<k?xh$K5hkE=PEW=U6*78S#GwKJSMPMaN;0O2-RA5wI}FFw^MU<nW>ruitr
z2RnWLcWK1`zRx=gdK!x<#B(lo4G_KFZgp;F5~VZ0Z<6&pdzSB*_WQRzp1Mw+*<4}N
z3I-{dbf$;FU93w%(!}c-K^MBT|9pr4cEg`Fo@#g;oqWbZGX6PZ>G2b(uGq6;rZORG
z0ZqNy2{hC#NclGnz|oR7zp^&HcZD`XCxbU1PHK-o>Szkk36l-~Sz7MiO>vPE9lT!H
z@2mIc*Wq7b%n{*(hsuir6a&OZl2sRs--lYhN{ACJGEeSx!+Pqb$T)qq^{8FAnI5&@
zfB<$%AC8}NjayZ@yY-jf)5!nI!cH~qIZgceY#-+5-vNJo^~gzA)w5I?>|Z@OG&uzZ
zc}xvN_c<^3AI;7!&8Hfqg2!o%e|rumkCYvV#N_)KbN~6Q?SF3I{INsKRva<NUim-5
z+y8|<X&A8_sbx(`>iIM7@gKF)w9!d{!QiVCPViIvY+e5SmMBpmgXLqk>3$pEf3NdJ
z6mUPczDxSY{cYS&ngVk|bM}MGU#9BG>t~sd)Lu9S$?*6ytok3kH8TI$Nmn*e;go$i
zntx~5rvd?u{57Knl+ES8jXSd$@TM3km7e(95V5lW_w(X2XpZM^lT+X$@F=5u?(L_m
z`=6=#KU4Gn!qkk+W>NZIUI71prs>z)pS1wxxwV4NxTp$*n!GdD)*GvLPgl1_KOrtI
zX?`B|#P`vo#4A^>=-AlUT(L<_7P(wZ89L3$=@i~`*HbUnEhN^`N5SZCB}>5bKbtG-
zdY2_zz|}I2jH}a?kr_UY{+gctK*U->Q`Ef7F*+?q`TB`K%qL$P8`zcPxEjr|Yp$pD
z|5Nq;NX;BLn4mGnVl^@{;?##*t9Ba^s?W$Q$jr7e5H%~iDm^5va9mDWy4`!K1=!oj
z$_ieVy@l|?ONxl75Iiji1&_Yz7#H09_LA*EssyjptE0>|gcp(Ae<^OCH3U2lm2a(6
zlIlnbJ<r)lTEsfQdEe3<^YNmAQC+?*PbjGEVYH_-fz4wG9t8L)xJT7>vy@*VuV0?#
z39Ns{x__xV|M}3vQ?BUAHx@7(igT6wx_dP1nqX_XL%I7Wz)QkR0cEyS<y>!GW@_nj
zxjI=MbW~U{)#(KGWpjw!erV@OjcNPSSJyN=w6&j$+g497--0~AvaWHYm6<`A(NBPU
zifYfzW7aN>ezW?;o+&RWI@g7StVELyFOBhx3P1bX(sVUjqm<Q3J_+3ZSx}*ihmTJ%
zj#s|gq3Rs<^f5$zJfX>T`H^fcNo~m91F(ZU7HIzuRjX3|gwHYk{eAbYe_$@up}D73
z40?w_Ub0$d$$Rls3qWn(2i}1Z2mL7%jkf?>e)G&UTbRF#qhk-85c1mW@ZrDOYYnmJ
zNW2FFCz`8+`*`px&iYx;<hmAThk7v)=frEFW#;AH{aIwf`TMll9>Kfg8x1er{qOUt
zEDf~HR<zBbR%XQnFBZT6-LkPV*xhb)k-cd~PGx&(^Y{mySslQ@GA^3RXxKNwLSTaV
zk<NR~1pq#-BVoo(Na?UlFDqj$z%z7I+PdDGAb#)Oy;CZ-r2d@J(_Fk~R@WnbeK*Ze
z@;CoveVUI?0`Qto0&GNeX><C$PpW2_s9dm=jEsyG@<(Zz%|1wInN6b~_$#xO{1L|2
zK^HxtHAy!@Q<06|@}?U0bZkuft>>sa{1K0!!E+139~@o;wtqwzfq%c8tQ<kO3nNuC
zuZGviBgervRQ4UrcUO!=BQb!hX%FCR>-iLTxT1p8BH~1|)0+jvlM?dSas^;0Q+n5{
zVP_pl@xAqeU16qGh_jTPt#ysERjJgPeS%N<;~@A0^<L74uhlVXk`+who3o0WizFW!
z?i&G95T+9JsOz#Z!t*hHI(wP|QR_P8i1sSU#eEwWB$ohhVj729_9HxyX3?C%sy@h=
zwU}yPmv!DY1+J^MHozBmA8M{&uX-5Oiv!XkkW1lj7e-vh2I6DhoWtvS3}5%~T<FhH
z$()WjTpD)LcB|cwqmlj3MIcJV=tm?5NE+*z>&v3Z%efj&8R*Vfv^0T%i9tjmysQOF
zZK}U^oQ)}r6$c@DS#{o=_5?@4bkii#-p9M&zw&%^v?b9<L2}-*+`vI@OR;}Mb=lxd
zwr!1q7_TLL^LuCBY;FjDa>)yhcVE9U6D#xeUABMKSX=Cchy7d~X-fBqLpV^Hc+=l`
zz*~(wV#CHKqiedauq~b`IEY!E5$;JY9XW&{G26K8s9EQ7OI!7;62%wBYYrd8KDC1V
zc|SHied?-CK-B|_wnyJYLqbzTQv}uEs~ueE{CvbiRBCy382((TdHJsyD|c4+sn(s>
zXFb<gEqN7O1(+D>rjA&G(3q8^$cCnY*I+u=9UZ_6HVjux*zC`sm7IuhP8PRqHkJGI
z0W`xNy8SS3C#vdq>?I;|5nZNJ?>}%%JLRwwAJz^F0#a#1Uny!XZ#?PCEMmSjZJpG@
z*!Wa{z`K+i%9_hZ*Lh``14)aQLte)m=fXoYnBbYqWe3N7N+NtF7g~qEIW`*avm#AT
zpM5F1fWoz?pmVF8<31l&h$fhqumOiuB#hBGP$jFiyiu8DDUPL*)rcmxt7%^T{v(Kk
z)HpmMyQ1P`R8PA8+toUmE06!Xb5*$d%warVfRW+PQu6%!gcWgV-n;psn~qViNc-0f
z)ESYH50Jdw^&Ibs`6EFTw6Dx|x2B&%g-4MW-W);l=c8E?!8zU|VF7kwoof%uqxWm2
z4wq=Wa;~LbBlJ5ve$dVCc4X61tchvS!m)bk0%<2ZLz|z^36EI~_G0W0Th_H?WNcme
z;+WBqe!%r!D&XIRnoR?V?}g3E4;^4s&x*~ye7@!{r-?5Cogj@>0G8r)cwPlhfxb-n
zcP54lj!g&Gz35RaZ+<2jw*4w4($$?&FW*Tukb*PdmO0a_qlRi+eWEa{x@sH3j^EHs
z1S6<;dt*lL9wABe7OUzdFzLeF1*j}-&+@8W_+~lqL0oKo#-%lVuI@YMhcx<c%$V|O
z(8kAoE~=`6!ZVamxh}iv$8R&ODN7QE?$lRyc7FTD;CttPUl!>ykRcqgEq!Nq2l8UH
z)IVKyx7I|3tCV+M$$u{y$h7UxoyT3UXtM0uqA#VTb?8^pOTZ)t&*!s=MJT6rawCvF
z;Cbfcgh-s8{jZG~ybkhAeBZcHn>??AccO^UlLp6bneke;nr`L_(M~?BcE1`)u1(e7
zPMl1ubhz`nd3y@$8B<jy?T6}9{Q1N=U`Bl|H(Z&bi?jm{BF?@>Ng-%jn?(nQBcq>>
z-wK%={K9IyLmHBdse97t=;dB*W0xm4nVAp~R9Jp1y2=s3AXUZwv0c{qc|6%QA8<wX
zGS_3`_-<S)feU-=zUa*xAfbai#^cGR^%m{sV`cUH>y-^w@f@#$Yz)+*v)q;`dpFXY
z?b76vksP5T$j<~rm+<WcF61`uL&tFaK+EutE@$d`P{gi;k6t()gvkILIJRKOrY)!O
zNK9#7w@*!YS}}0?^r=%`D^qAZ!J~sE@OLHGv#9){CqVaiNy%}icUpDC<q6Oy{gG_x
zIL`1kh0N(6Kr)b||6D%}e+h6VH*th<3$Fpm#Hq(-QN%GSY-0uLGh6V2-~Sw8A<L&l
zY^iNZhn0gzAVti=56k5^N1q}#sNrHNM+h|F$MoN>m|1JZa=&=8wI1Qrb>>T0+4g3d
zozpNWsZTynXlH9pVM%jZW0|xUVx7yE!bc7i-2{H%XA50j1~j|wYd)(i(L>A6Xo6Z)
zyjybFb|sbHf8PWwbu4Pc!D))UKZtR{oqKoGK93S(Ie1|4<-7Nki;+<<U`RUEgc)io
zMHT}deQE5He$lI$-^(<~-9D`z$P3=Xj?IP|7^V3Aa-(j;HC_es!6FY!7@WL%ek>b7
z#^vzIiRd7+?LE8+M_$Nul>zU*iSBz>M1e_9ssyPQw=mh_wxY4LtEP$3j^oKBcRLVb
zo!MeRkR6HY@EunAgT9kwAaY>G*L*R|50ewP*zNrmJq|bNGXN@Xg6E_uPr9C&FwKk}
z^!?kinx;A5R^6?wz(NxMS)-`izvTujAwcW9xVn&fAVXXp_&`f4tqGj+1vmhUbQcJm
zA3QbrC3H@{279!+Oe?KlI3srWIaQ747vIjdF4gavi`o|XxMEkCrrTNouAI0@rb%f<
zw?y`MBnc6ZR3qGjV)2132^?x0uKBkJV6CtVwNZzuZ6m-ZxooTH-JplgYPl<=ypCw%
z`;mK;maOCQ>iv!fNLyu~10J77t>wCuAN`~ShGb#NZ%5R+KDEV$ykRBhct5K%IJQs!
zbl&EWVCK-`;J4dpJ#IN8TYAysK*d{}imS{u>hwYT+Q^@@26(<O$>~o~&XTDCL*8yV
zRQI)sI(Mf8Bov?f52JSB0tD`5j;$GZt3qwCEIZ#dI+~xws+!Y_F8HF|)phC?rImuu
z6JWfb-3S!MyWtheox1F&^vsa$G!*w9eRqqR{ASnRHlFIFzVW!MnStY7Kf?BjotM$D
zAk&a*9nDH&We*;f^uXh5y+tzh7tT@`V@jP)X|`ADCx=Z=pRSHVadUI8jLm%UtXzRs
zw51HRUBB0VedjFE2vQbl!^YzQ=}<<Ln6z$D?=-g2zXbaBjJo;tp)EFQ`^GD-o3I`7
z&<Of9edoihw57wO`|~CIQmBBTIxV}L(KzJbh4`rG3MZT=1($qWvUJIv!@(?(2Gk~K
zJxnf=I-%p63rMD&`*?)Lg41ruZ(D|NbhNI%?ta$VnQIWeb2+c?n4ddjnofY+@$Tz_
zv^duQ#~)>Zvy}(K{K*xBYaT<(uX48PKLuEat;x6CUc#$FrskaM7Q?Mxc#kNDWaO9E
zXFVhs>|<*g*~NKvC>A3pizrHM*l4Ic<==6b;L>z~P1`rBe6kl~1gu;Ho@-*=g^|NR
zEe~KS&Ey{c;Cs3LXlBMjzyLHO2`5;7#u1(Kqfhqn0HGciYXHK)pVgtJf21O*&1RA<
zKR=(>H1E>}H}#?sYU+%I^O3#Y#9RrU+oOdC@3Zv=qhh($8{Yui3<6vAq7Eh1qDE4_
zA$Y0<(lvCa?lFBWk9*^Ry5e1;Cuy{_#U_G)?k_yrvlUoJ_P#pTJ2N+7@YW3a`t|EX
zl;loA2!8+}Q=Sy?Bb7e6H<r`3QFt6yp?IJ?cgD8o*l3dqqmOweXk#FTaJweC&eh^u
zrWVv`8&%PC@Yf{A#0)KaobTAO2P0C?Im{W{Z00j0;5i}`H=7N2VN9qmg)5s^*3T=H
z>%K9mhp6lqwRp1ekRXq1pPXfc)sLCa!h>bpkFADBM#ysiv~5S17xX%UalB<3B%lTh
zpAp&}*x{C4Z!7j7wEGQxv&g7Y7gjD&91q53Ogpd7toA8RA@SaAYaQn!4P9o~ur7zW
z(pWAwJlPEb<&=dLtMAB-fT%+=qNP@KuaV@OA^TjKo;awf7kRJQGB>j69A<h3$dvb*
z9?l|=%5O&}cJfbQkUcr-%U@>*oAMr*23mV&sYQJ}km)UB4;Bt;!l6%?mADEm$^k)1
z=fI7$_^fPwHIu$!N;rB}jnsU+{mF$@-BTRu+fS`2ze@6wwBDqp`x;GEk#ISWv$Ml6
zZq)U{UcJ2CXw}}WqJt$D`n36IKaK=_l^QXVwaPJu2I{+Da+JYJU?gw)eiQTMxtFiz
zF)zYqS_qrL#4oMiy_xp5dOWD1-m=Q)oUk>9^zj>z$vogFH5BRi%4cwRJbj`2D_YY1
zjfvbCkuL#ljaA<h58#5DmS%f|1eEA-is4Rl3x)#=vvDhpdKhtmVzu$R@pvPtY-d%k
zrk!~D41qz*bR%~&)}{=RonRdu9n6!Ce!pwQzteu|c$OM-s*=G(J`oY>laF^Y#6dol
z<89UK#Yp143d40fue9j38}sQUnVZmo+3ZHz&oZhifwo2osQ~O(J3x{>K&xY^IfwA7
zMuPjHxt2A~D5fyRIB=|&T=*2k<N=zo%XRGlv+b((LA^Zp0mmZ;j{&<9z#rWlfNY$A
z?Z=p7ow9>>$G2~X^@EB1AT@_-_isRJQ$u>r&X?_Rt@1kCprpNSlk4*tyicnrz)j`t
zIsrj~)G{&T)O0^lekM;d6Wba?Km^gw(cc1z?Oizo9@@xawBEzc^-&XLl!!1Sv7&9W
z|HAs01obz&u1aNE{z~JXBk*XC(U0C(7DkG-zyo?5`?6{;pxN_u^g-5p5vY<1%7q0g
z{I117j8~*N9^4*!0Z#EP0)kW0e)Kh?m#w3vcNZ9Iyq+Oh8(`k^^PkmnW%^<lRC>LK
z1)$;I1&n+bts1VX(BuchVfzh7*XgT6^ERF~F!VjynULqY-MziF`XXn{n)R*|gSVq$
zKzn<7XE}bnY>OFrz5SCtc5CQx(k#+P9UP&S!+_)K;H;(oB&tQ{bqUX-F>gkm=OAA@
z=jP_333ZtF<B7Le)h}_VK53J4|H&J$O{>^knV7E{rfj41ib)CmZkGXPvL#zO&&sjU
zMFS_)+^$oMy&6ZR8NSxdp&q2{4}_O6#9st!%EspicmVyPA6xbFCce@AoF$8djS9KT
z4X(;wmQ{IT7Mzv~p0h^?8ofmyHE^q}^O*|2i1Lg(W}H8^7yh-ga|@W`n(!>2CQYET
z#8H*~MgbARS6{W6nnhN=H>R@eVCBW}l5Hqk!+9?Lrm7IAdH01R@MkfHD~&ddPrZKG
zaYLq22m6EBT<sq3Dy_S$E!N2Zkcv}(c2MAX6JZs`?j#4Q>(rMIEiS!g#ErXIz}fV6
zua)5<6k$_CHtUAvmtB1H<_#c>3DqYW*f0C@)pwciZBlc}=PGOL!c8bQEo-c}GJP%Z
zh`yFBdjebwDMJmUS_YYu2#N!I<NMJ?rv!}(BY{w<6=yPv5ZHT%@38Fo*GX<^$?2xB
zxu2Yl=-2YoJU#Xv0RaJ3IJ@*{spkAFy-YbvAXP^E4VP5PfZCpD=Rf5<mBSj)-BCEG
zX6#_)=US=3)=6rd{F_E^!k0r7^N(Qg;^?^@r7hUV&v+H@#NYiou&G61me;T&9Elnp
z>mf~#zZc#J^W%MC!Ep>jt8^K-FtqHOGh8++EfdmjGvu8+mA)Mx(6%V!V)CvSuzaqL
z#8|cs^ve!fp>B+LS=FEBt5<9*1iRfcFzENOK<tCvXfPj5cEz@Hilx@e;V8}xXG<iG
z9(|?dZ5*y?Uh+tIjOVrYvzZ?{lFk==WDI>;*0hP$KV!ITPy2AyG!@)>5lCHk%L|+B
z-x_eOT#x1`=_xbw*j8i#Z$3K{4<?1|?IaL__A+8)PXy6h5`F^6*cDm-ya8vg_wgtt
z8g?oSL%M1FsBmJ8qzu`CSw=L_-raalXKc*Wkj>#%66$*^)}K)0Z4qrp16uhWXTeWk
zXxDaUEeKVX70o}4xtDuS0$#de|J+z?l>QbTuMDBuS6pmcHU-}pla`9VM&GtVM%cDx
zH)S``aA{uqFk2^;elMUBc{T=*9z7D2kmz$n6sI;NA~f-*&z!mJ>#IdVAo4ZMiH~lb
z@{Eg*PfS1E>x%YJqQ#mJe0Ag>FxFN0mD5~HN^*z4fx_K4?g9z6MM!e5>th6DDZG%-
zY8!A5!aE&+U<nC!q!kb6?|w(%L`+J$)9k`{f1Q1w%PaOJ_xweyEu?0Z|5_KprDoxr
z1^(lV-#T@~5aCUj^Y(W(ujpn!SMM2ATciA=#3k4FbqHI+4dn+2A0QJi&{;0av?j}6
z3|K4WJl4?I$;y(!Y4?g;>|G!jcy%ExA;c;yb)7<EdyC{f4ycy>?;x>|sU3mi>;W9-
z=dbNVbp+H50KgcNS0L7n&noR)i8ti3?0y3_^n1X}O8sW5W$s{o#*7vp8}Ob!b6ml;
zBqI7auOm2~Bd`)3asEE>MnSgwWBNMY+s{yXclPMYQk%-etW}+Rm#m@s!!-H)u!UJw
z$Ls|wx?<9T(q3MS(6z0|311hVETu9PK_Q_o?h=>7s}rxI<lZ|#<NuK!?F$c`|K9m?
zs5AF1xB9mDn{!g{4ApjSUI+?!sTWS;qsOM%1{bK<)wy#jl{$nVVOamAFb>?O$_r3%
z>_3}Pt4+)7kUdF|fgka5STSkb<?cvv9L34i0#B%*0uH_#)!Pg_|H@24Te`;Ph|CI*
zxz*hJLyZGRpygj2ci3592&(}0jrR<d8j}`^H<?4iDaG{n3F>_{5<y<0dT9TqTsH{!
z^~Vq3$jML?Vdd#&;!~@ioStFZ%LNGbauZVVpN|?m{nUQh$Zx0b!ZoOMeSF_be6<sF
z6n6g$>zGcoNwgD=Rbp1m^s4b0#(LO;R7q<|9A{;GTiL<UD4+)d0{7HSI%T-!=8sz6
z(M*7>i<xL&De!Erc~CgAE_^}C3txMh&AXKN)ne+cO5cMbg9X<n4(e1zefOcTVK|Rs
zcvOu@r)hL`x6q7IvKA9)Adbg7+95a>7~6?mW@RD)LJ%$At~Oq3+)~&CVxTGie8JUK
z?lOy}fr8)7*YS&Mb?))qaDBQU$+(~*S>b%mF#US>?vsk;_E!34Y~CWFnD#B`g50$V
z?s6;TS|67vXlo=H=on2To99K5VLxjIbhp-p@2<I<QT!f8tjQ1#MyP~6cTH=Pipx4#
z8DcNoP-cgyBqU&af>K?yV-cF6eNAX(k$tA<<HtvnpJ;oGZ#)4I%S<zyMt8GPH)SH+
zw6ywbCOrC$dCysquElKBQG|PbU>^5O_0=NS(Q0k23|9}46ub{|NR{>hD@>d>N8lS>
zP;c848o1w4`wu(+hEjvJ`Yej{NvXS8H>)Q;ET5A3o+9lXShjaB-V3j-on=o>v9S5k
zcJFs=*_mAxZOP_*>v*rG!u#)^%edM{G%iizy&$6pA+HBh)_S?Fj7kjFc__9To(MAS
zCt=VnO=Dx9mQ3&GzKDR3PqJAl&xW5dU6XpjXKwA?Qj`WN*W8nKuw9=j`h?<n8{w#7
zhuqsp6UOOz?nQ$=F$(3@-2l*c1+a2mnexP|04x9{xcrSL=KO8gpP4j)AHNB@q7N09
zR4?BG!W~^Yj3<0L`$oMjb*tx}WT8?kDi8JmX<k`wuR61${TiM0ls#s3X0>XpE*H28
z{p^U#A~!T}>Yei~&n!wCg4wDBe&|w`?I?B@6cQBFiQ_>N;4w6so<89+2~&~QmxZ_s
zc-j_eMl+nVr^dF~RjwkSSRhAEP(l?{W>Fy|-)neZr$Lot7yD~D*)34d7BmI)fD2P?
zhM)4w=-2s@%#i0Xo)07dQ0N`d+|3eV_VY2jewSHCa1b~S0@(MXp%&I1zlok^`~zaR
zn_}Lc_yboi=zo|V&({rZetv~t`7gD%yhJL=ZRDRElzhf7I|BnqQk1PB(SWb$RkuA_
zvW7Q{>?-l*oJ1ADMM_Q+voO_HNvcKK_c>CA8{dQGxc0*^LJt+4b2aOk6*KP!Lbq>s
zJ{`69c=YJz-IzMv`)t+D&d!;=-+GLz9u>XKl}b(#zVcPq_|dpgZdB7LjZa7BpTK5%
zAC#M@Z^AS#5Cc?4;=6Sq?JPeY3ICa`xMZGh%2Zxf4DzC0bGYVSS?Bxy^3BxovJ4nd
zJ*zY^ezQFpzK=X^ll4cIrNojAUyrSiJZ8RhAHdZ|^q-Sf7u4_S=)B&!F+}QOOz5Nn
zJV|<9d~7GrE5$U0KW{CJm?MojYKu!;x_$_vdaq}QAU4?+`6b&g)S$VO%nSi#7r@VI
zksDz5?>p%Uc~{@o>iGoIdU92Xd4I`9<YO*?!Gs>7Otnn~UTzMeIg?TVvUd?(ZcPS&
z0O)iI)I5V+lY^MNyCivCP0hSVQ1C8y6l^_w<@jH|dHD2^HyTj?WdMJ@Hggf45(Z=d
zngM?8?=t1fxRj^M4q^b`d;q?)_EgPev1;^_ACd5__Ah&xC6sZ%<K}q7OAkdh?R|)9
z;1NyRpFIKvuD+zG1O*@mU%S20U|(Nfg}YXz##*nW9U2#(z+b&O+H_CuV`fH%2=|-|
z9zh8tf32;RL+VGko%7gS;k<-^PH${n_b*>Q&Br-wduG3d`d>kcQPZJ^T(02j>ty{T
z0DSF%gOGxkFMqKF<-6(W#U3?CO<Lg;y$j1os4WCB;elIeK6*0kRqfn}?Vl&rzXS_=
zaAYN0ZSXAQ133|h7e@hk66D3+-mt_}1hyYQ@O3ko+Pgk{y>jpF-CFL-$(b);+ZR^o
z{4&}ZUf#>gzE!~PiVv<|4BDrR|9b=W%$F_=_T=o(692AlpYJ`5RR6NzJ$UXfSAO#4
z5kU8I$~VjP%0BPvziaigBtRSWxQVxxW&i1OkonS0Ky-9_LWt+p9})il`p5SxfG{hY
z%IdWbBJuC9MZN^YUOcDjUupkUKX&~nprR^4YFh8Zef>K*1ug-~EbXseh4210?k53D
zFRT9<&i!BM{~6BznVtJ=>JJ?HKl8GGeP-gojzN$ob42k7pS0xUvmvjzxib<oGu?@2
zPM^LaB!uf178cemdd(>)E&biTXu9byh2i>D=HC+di3&#)JYe(Ta+{0`+Q70dC;>Kw
zut22ewS>rgK`hikweD>(?)!ayc;8qOu2+EL26QN#`k(56T&l!u8@N$twd`L@s;z)0
zQ#r5k@Xr)(l4Hj<1)#jBgSyNMC+^*I`uQXE{xIAiu=;U8Kr&l)M`x#QP*Po)R&=SA
zjBHKRHx)euX|g563E3Um*E``-zfkd-Q|xX_Fj!DcvLDp>cXvGaZ@rlOC&mv&4@cYp
z@0H7!$w^*eR9me1&~W*^z^8RODLq1Bb?yZ<#wNyrJ;i-lPJs5odk4q`NDBs&8c@Ca
zK5n3>YAhUmrk^jL$ONkr8eeTqa+v*f?Ebm|tJra{k5#6)HDV%`(lmnM<<Aq4i1+;A
z{3UhL;Y-F}1gO_*Sw3GH%zW2q#~NCxr?%&G>nkCyhx7f<cy?*ykpONOh*{Bl^y45m
zY!g(=Y6T>Bc_Poo%ikvm#U;G``t{j1yMxMKAI#nSQKoV{#N}><#T=@d)6z2QVpIQH
zQ>Z59F!Jl&#s-<hw{Hc2NGuM^0|9iZsik|hH4p(M*b}>iYj#U|n<IARf$8i0SHDl1
zSB%OcF}-11v(;R?$+KdYrMk)pEF23wL_pf5cswkv6_7B=09b&+7!NP6*d2cG6~Ynz
z+ftX)_ESdyQI<-FETdni8i#DPw8>qHhV_6UM6w<x@ksTe(tG(NG;@G_h=QsrffWQ+
z{p(t;V=hqaXqXm;u!yjdvfHkf4$)%n1AB2wu!(79Nrt}ngtYS<kSHxA4oki!N<FZb
zwFb0$5-+e&6XO!8HQM&p68q*_{nRXf(m2us>s@MD^E^OxD*)(4%g9r0cDuQ48fB(%
zM{HWK!>!S$d@9C{%ZWw9fT=Y5V(i>+sy<>z-Y!+j&aKtP$lR*lT_i`juD*<+6&*y|
zO$EsMd&b7bFF)wE;hInAw1I2?yhKIbvd%X>RGt-BjH2;NCEVTo@IeNc=I5-FwBvM~
zvPS`Z(UAXMjeUXVM8gm>Csa2ydjWO*?(A<guQ#LS5XKzPRE>VTe+y{LL;>MIVlY@&
zvJ2XdMp73p;}KqTH~eyEeO)Bxe~HQJRcWhdhO2I=<n6FOj{&0lx&_lf4pOsSbNWsI
z3e5f-wbIB+xwJKY-@$PuYiR=p+@ooJq&Xpc!AaGz4+jq1DlwT#5j7LtB3oz2ysBuu
zc>J7rA|O%hYN1b<e<;&dRW!#`ObOI^V3UDHy=oBr)5U21n38}+q@qxpL-abQXmXlb
z%ThnMEpg0ff>?Y7*QNBw+E>j2G>42{7coIuhloJ2ORm%(sg^Ag7C-=6ViGFF3bi)D
zNJ^|W0X&KTIV0bxTEzAW%4Y?QojUii72#!d4}jTpvJ@na*GAlj^mKK-1!y+wz$F7P
zbnvOaQc~X-%*_EwMOC!=*7v0^n|x)lf>0(U0JOLcYXqcg^WF%Qn*S8*OjFjXfhc;8
zxgMHA=a?P-w)$Thx8o{nqmt{4)GYfNfcE693D1*o$qs)_I2UWj*xpkhK}t<aAH8EL
zSKt1XByQdM*>OTa(iq4Sj<&ZE20I=N-P<vw?nqKJJbd$bscs9$&;Imp&M&t?dbfnq
z2^=zEj1yZvJD;`QPzr!}x$3=L2z6p8bn`>>d>hx<|9%gBl`rx%M=gA!$)YuzI|Iau
zg`X3oEIPgeTI>1%YB~|d#xt7M2xxOC_`SM_XKY&2^_n|h1SQqPtj%l4m`w4TK9wfX
zHZ^(&R{K@F-$CKcw|kOBX51eBa^7QX@za~jtu9;!2#~zd3cCTge}51_e)ptTN#Vt3
zYV;wW-<j9GnXpxye3(T5q%A9X$C0xQ&m`wKNN0rf663NIP^BdSO7l^$;C9*Yjqw&L
z;7rlAPy&AU@uTaAz8@y-JdeV4n|Srz2T9<atn=o`)LNDA*CBh+PD1L@(X+~c?2la`
zGAcBl2<hXo=Ti?a1VSezrr`#k%=UJ|oWHs%(X(ql0Ej%Z4U>D->Hn@J_|2C+$p`-=
ziuFCnENJ-{HF_cMq=bWy`$cFy^<8*{q<GiG;ev4UllPG#Y|a)fEXqMob86XeKx2vc
zz1rMLe5f+_?VUo+fKp3*beU$W6Uw|xS8B&%SI)uJoqKKK&1s)Q)oC`Nku@GhB{(m@
zb+TdF2GCkK^|^z4*0A8TH&V(|h|6kfla^sd`gJOJ4)t_#Wpghl*>jZk2Xar#iki3~
z^#H6j+i;r=mT+M$IgBb#k`ombJCNnjdBpZzo+h&$k3MiB>jrbH{5Uj$<NR-Vcy)+d
zN11b_`_d`>Ou1^(IY}E&*-iQBGVThVw>yChx=enA-H_DGAJpLaKbduI3^M3|(H*kM
zrvE3iWkOlb6_HZzMskY(+VTr6d<weEysxn;8RKd#H&|v_E_h$A%M5Ux-tq?`C1+EP
zR-kleY^zEDfW5|V+t+LM*O%x#O4hq~3%0gN9gUDAo7T{3<W#%z89u(SK~~Ea`oD@i
z$+>inxdxb$C`S_KCik;@vTm%0jxcLZ1JXRl>HLQXAwG8dPfuHiS2Z4^ty|&~;ObWA
z((_3(2^=W^)qHnJZAUBQ;E`1p&ZXr)czA34V%CuxY<gl+<~iA{_@rFwrv9V=$qw)l
z+^LYfY9x^&rhN}sIT2gKMgc?C`P$55_wa?FGWYscTv3JM7uio#O;FLnwp>LUhv;UX
zmYv-4kRQ-JSxfmaKh*^1F9tabfctHlh?lZL2I{+wRYnFZ4BrRvj-;6eqTN5jZf*-J
z^$W^lB2s&F`BLww7OQwQ#$6@Kr?DJ=J;fe7AX^I*;guj3CgWQYzS8J=&InzWGP_7k
zLkW$<t2+;*Ohx2f7Bh#*aaX@Uy}P531TRKCY=JkwR*qQTv{*^&o&zBRTav}nuEg=k
zCp+j*H|mo<Czz@D&xr#<RXfkDY??vFN~s%G6#3-qDYl=@-Y)o{zN_JG6U-qM;B7;%
z3X^7R1gZ~<4-3%4X2?b;wr@zRbI^E>U}v%mBeL^ULvq1)_4Vtpz8%~pnJ3C7qR0EI
zX!@zkX?Eda05qonvM70Q%ZrpTxAD34^6#|(K&3yI;tV4891y=jeIz_>fybo0?mAso
zMC86V8C(t`?uh|RlkbjYKrb3l9pL&HFyPPE0OW+o)E3z;4`P`Y2{2b85xbl9Fj+#V
zJ1dws$v1G0yX0)63h^_~b;@$Y1^Jro$}jG}f$4Pbl!QLO&R#lT@~G;bq542Fe?+!O
zX^62?SN@$30I!!la@KWmD)n<Kukzfll95)qfl(fscX>*+6H3QxM0NEyqm3y~=w7qR
z?g$!a1Bh>0Q2JE~E4j3}xm?n+f#OX6Ze%gz8|RMaApK@%8)kr~?+Q7PI-dB}NMZ0I
zi!B$7s4ctQw!LUQ(u!WE)ti^|_yMC$Ax1j45G|UQo(CT0=R4!o(d7L|ofm+im8ZeV
z1G=_L6S=A(y~L5*TT4Snfn|Cif8-oEY^|<4@IF%{z(XSPR2bZK_U(_97C+9-$=1eg
zo>0|(^r(6l>-eQZ|F?9~Uuv#r5$#bFxuCGkOw)rXm$sOA!AA;1)s(RF&1YgZA%)lS
zW+HhgY}M<{1$RCT$Wx3Tyn*PMvwdw<b8Fs#JlsZ|@ya(>kLdPf`_QZW-!3XqQbrxj
z-a4?$Q$tg*)T4RMED2E&BAeKGe#aKyUb|{Vc@-0x3ZACgmx(B=uQ+%xufoSXEL^Zv
zKiVmCsO;cTzMATW+4dI~k}6tvG3K=KlBF$XaVB(mgogT7_L~X)DZ{<qz$p^^`ZZcV
zlD{X(FmBb3B1vBiD!1`p<5cSmR4Rh9{nG@%<$z)^X64fk1Xq^{+WL{c9JouU7v5xk
z<=sM2+w{ULDZCwADmeUe@q!`)om}@(v+Ln4e){Gu1mq4ybaP#WimKBu$qBBW@TZp>
z_XUJl56bk%epB?`er5x~Rz1l3XXPaUelYQjO13)@Y@_C5gb&&AF~}8Aobs#p#3NMi
zv?QE(V${D7{JdGgt@?&yuxC7_=|^kG(px}qWcbMokh;r)tl4EFhX$CuvDDC|7Gfap
zW44A{Pg6Ekd4s!zO(vxyS6~8({_1Nsj93O2#cH!7i<%6?;cfU-qk{9m=O@kyHBjwV
zpw>+4bk$!*pIkKB=6{j9gq^zHeqWym&czC~{)~A26cr;ssIwAsVQpI~HeASl8sBI@
zATmhsRJE|f8?~f}BwIuzBrhdM{3kZGc`~jgWJHfX<M5LL@tf2oCQBqJS>^JsePC-<
zCN+<2_g5_4Z+o$n_TdA}zQrFllRq%5>!5uvf#iMciBFxF2QckFdEM8!mdhKqCqE-y
z4>822*l9b2FFlV(?Tng4`-LulBb}Yk8S$^MuGj2u`{kD-ANiR?=JF*+ZOVuA-`Fx(
zTrn|ZPoz)nJ@_qtb*WLI1bSQevvG7SMf6tXJ*2V@#H#56L2t+Zc_P(MO!ALo7@S?7
zdi6OpK1A|czx#o@Ewri^r2W4np}V}_1B79R7uwR&>;m5nAj@a!48m!kt(fF{6>$S=
zQ__31nm-76wYaVhwX+dnW0tF_=V)C&m@U^v@0g<sk9Ah5%X{d)app|b9+I^AO<~hV
zGuh_soB?gW;af8%V~XJo&D8{k!I1sTaVcjOogA<*m@J^Ioui01>ns}qGyHp{C9*-s
z<<PJel_jbd9i3l`@dYSlYE{!tw=mP;Xl#0~)Sdtop~a+O@UJ{}a*My38`R&lUA(r4
zuA;c2SN?%mfQJwZ3C=p_5I25lsPj6S5!osDP3CF-knN*EjEo`gw`TaI7FJd4$iNL@
zR9eM}Csr+YCN&aR^H<L+qYK*!yG*PZ(o8PQH`E4o`Ud^r*l~EIluHh)dA6syONh4#
z8%}i)*#_K_Y<vQ+(^8xXiEJFef+F6)?Ak8YyB~sM?S~}l2{UJ2jx^<jlyJX+WDq^R
zbi^G@81Qg<$R<Y`*}4Jbbk+eoGrC-G4u{%y`iGJdBx&14?(#UW(V=VRwM7McgnbKB
zl=CO3ca`OF00FQkJThb<x$|inhdB3WB<aO``h*B$_T2^SB-wu{+e;ZuT&IRG#whMV
z#+~bGOEJzfbdtK!>ZYjYQH;MVW3x(aDOU}`qp=<y?=G<JlJt%5qbq(%F^_Fh3dkfX
zY-}+Po2s2hc=U4JUmZVc7St2^z2j*0qUuUGYs8J&Gu+Ca&wy+5ps9`Egm$vg<Pi<Q
zfAS22DKR^c!s~f6GkQ`iJh#!*s2$l=`TtM<s@LIz0bEU&is1BfJ5g^i1z@+FKkU4Z
zwEUJCH_Hps)z@FF7{B3lTtk$H`fbD=Ec3DwBQ^JlFK>3_!kz2H04<@q)l|q-G_`E#
z{d2sxXO3hrF@tKsANuRmkVXe@(p2h*0qGLZT7Mu!OwVxO7ye6DjgBMl(5D3N$ibE{
z7GvDJN91P4azgquye$fGF~0z<wQICE&w;^DccH1{2S<~WbNsNN7J@+BuIAP@t=|_p
zHYzE^AGCTjOCE}aMx0*?M?0~&X9m_m)gv;f@8ma1W@VB}SAk7C=lq6-O1WHnjYo)$
zpd#T(4&{;sGWEjNFmuK=-$cSrU;SiVM$db_^&)2<w;_*z)+Qc|NUWp<ZUSU`ipo+$
zcfU%T8lb>k*rl-{KOQ{U_X}#*mRn<~rU1IYaenm!DE!g<2tsT&DmDvBm{?3mox$gL
zmH;$(>c!}=8ga_=8{uwIt+|l(Y?yt-|0@RuI`V{JjU?7bt4bq<2Xo$CevaGR4qvE>
zX1B?rLNg$W6OZe%<ckT#YU>-<6nSs7F}CZuIy7X*mYPWi=|Rmi>sh^Ne3HJ%TNs#D
zpYm>aM?x`ae#)`yj3J&()Bq9PA3s3t&<P@3JH#9H?0f682%8DW%$*Uh^`DAUzR(E2
zF%6|Ef-geF8C1$mtDg+4U_0P$G04acmhFI$?=A-^R#1irH|W?VYys%V)ZV8rEA(xa
z!lf8in>yZU4J{@_=0a%uCb3~WQ8!gGZL2R$I3Q~`RGD%dsXDkEiD4l%29YTA*|ohE
zC&L1}8-Rw!C=a#+=;g1_GXmX*TyDwow1A#^6ch8?4ac9>QQt?BJNZK%WYhhZCR-3t
zDj;<2QnO%iug_l|&%+1nRlW|#@Z%A2-PwFs?;UQvx=Ns{<F-B!2Nhg{$U`q?$u$Nw
zG)8u-OSSzSReB)^0~w1DAGQxy;{<ANVR*cU0tq-vQiJ{APz|hAqPD0v0|~#l)7BO}
zg1doJOnMy0>Ng$h-1(aHNo1!cGkTz`r`V4_@T<&b`L|`Q>Pyb5ow-{PI4H00_?gi8
zl2z}xbrh##d8%olX-tbAGD2Isy-8Ejcy{yr2ZwTHAWN#eAC}|3{=uXpJ_zHOQ3s9|
zXtIqiGvwg^K|Z~rcb-jck$=8LvqZtms;9hu)em0@92tSwx=e<WRCzxPZK~)`8z4Pb
z<FOwj^S&1&^@YXskeYp6U4sPOqWSbxK=(ZY#^fVx>yyA`aZOur{Dc5hk|e)M2}$V3
zRr{euT`&d!Cg61_@C&8cnMqxp;g%-=^&UKs%1W+v&A-XSFKFq!qlWL>03^xL3sJT8
zK$!`g-zdV>`2))Rac4Ip5YrBeh;n!->te0zIgh2o)Rm);=ARS-s~x>NO8jn%);JM(
zq3Si&Rn2R{z!MLNZ;m&?Z^o?1*lY09gGTdF6G0IR#ZPD9Dn2Q?QjLQp@lRD)A6QO6
zZgr}+Y{9K5HP=^Pb&|&tCv%zP9Ci`-Y9zzfzQbz$+|uS6ilu(iFM0s%3K^LMu36k)
z4Ce(6Z@(xix<#{X8y)Iow#)gkH$Dv;@ZyODcClw)sH^s<etUZ{fx&DE{&J7cur^P>
z-{AdD6HA^`tKN^$S2tzH@-C>20YV#T_i#F>zF~YRvkt!W`0DF$gWzabFgqW_40#LE
z!$Qm>v08$2oJAmQi^fAIY<}Y^oJ(DY+jm1nd)m$*9>#3T?`X`mh1)JXfld}`juq?k
zWWgr~0-|9}1Y};kDpdlQSi?U?DTMwT|2;U$Y$32!(cNCIXz!)+CVj~2;zjLvpm7D-
z`THO3Jt_g9L0UekXUt=TRrZjrqX;Yjmz<fIl3{*K|81FBbw~fGzt2?b7q2MiJf-m%
zK)97z>zzVSg(H(PhG06v8+G;%=bK=o{_aBV`F@X(GXwxesqiI&oin>10VU{A-}w`!
zawi{uS;IDDVPGOH;xqk+554ks=+y(z@$*5B=5KFe`SA)aX<z>z_TDqDscmZ?-HIIn
z8=xSd+l`1ck>0@qDpe7X8l^)Z^n@PKjfE~qFA))t-dh4hX^|Rg=!70>LJI*x$X&c=
z?{m)oy~?@Y?(cW+`L-a*T62yy=9ptV;~8Tnn9jQQRNGtW>vUyJWg@I)OS<cilqRh{
z8I3+}Ev_@;PC>e7Iei;~<DZMb*V`$O=nA}dn)bK$(dX8X$~}9S%V04p(br52@1JN&
zskcr7F%9joOVrLL2<#dh_wyPm&4uXpRcRwo3^-7#ub0?$JAJ7^<m>(>`pb3f;sQGR
zTPv_31Lt?b9$||6L{1#J$>HD;1b;ps#W48NFrczEY19{>HuuK9Ki|~y)dt~;J~3WW
z9}vhWA}!TvFGC!_5xtk~t8VdL#D?~?=cgE8W;d*}y@y>JXJRWsDZp{sAiu-uAh^Ql
zD0wz9pJfX&7kgAyNoqva4$BZYuQ-%f{hL^_oQJ!ZVGT+Oi1ti-MW&D3Y)`Za&&iD+
z);hUK(0#m@>^$@&ZXO^t42&j<Z|>Is{EIQ(N40uwlp-P{L-1H|U4Y`me%=cwV4Shx
z2)bni9P&Q&X72!SEC>aSR5n9a1#&vn*e&gcE2O3N=f@0_p|{#i$MIZ)@RiLy7yqu$
zyhN3<HlEP+mSb+k1LDDtPz)Z(Qg?w9-5QWXbqjqtRW<`f*L>t(v|o3-eTg$s=?#H3
zZr%D>-tF&0^(+O8IKxOWpg@n=6IogL3|156w;#|<jVLWc28{Q%ZBkKR0}39CJForS
z3!s{41*Cr*DQW7Dq&sB+_Bw=9B2BtN(mDb1G`Se4@wAb|&ez=^jJFsIxlMnqwGzU(
zfEK#gI;2+seUX#yRg&@fP~S)pC721Gn4iVK>c^bq!)@zhws?mOnWLg{CR1+!<_~pq
zn;lfuK2Ty)AV(^*g`1<~mBbQ!UU@=}`ioWhNzTO@iU%8yRyc{6#Ml5HzLRs6<4chT
z(y^%l{(gI<R97MOSYephRr;=gfSWNxw^yIbz>Bi`@H>VHK243ADSVQW)b%Xa^ju<X
z&9KMV_PMtmKKQBUaK)KT!RbxXpXHf1td^0vFhdMg_(8k`xLm$76EUjiqkp1Tq7Wys
zH}l>)7q<k*oO&Wf{dwj_dEzL5;3Sv`t8NlknZ_=BY36vkA9o&QE`Rg;59Et}|Ew3q
zMzq)3NA2KWDK0}FBO=Z$=*}3SkKIptQsoNW9Awj$sylyO%N29NW3$~cTcw3f&DutI
zrX2L5pTK6)>uqlSnL)q8V^|Va69)5Y)aysJdbQjBRshsodo7<Ub`<UU4lnb_RnL^R
zP?2q|(v%oav$*SxGH-XpKhMS69(L2JDyA}ZIHdHvvL2PiRzf*1pN~Qn94jHqFzQtR
zd_ila@K6q}4}>zi-}F$yI8jk4$CmQu^-p&kPUBD?;;Xc++js6}_-&@oN#`CdTQ>qK
zDW6?6N^vu&u^A&a&?wH{%qt)S-W7O1Bou6Gg1jbgRsV)*WZ76A8?+AT#S%Oz<7Yai
z$$J+TO06}lGd)9tsM}9J!ugV*7obR>WX<OtG&LEt?b#wOc5L$&DiJWuxhu+zS*@JY
zETue)KL_AHZ5`$v@^DU{PBL|5+c=l>d>=QfiqGTFA&aE$CvGH(Egdh{m24^n32Zk6
z-*0-MdUA~<<T{Z)ur8#S@PbQfC9d~(P(4vcJhOLUqzY{Cp(8mZ<?)xPAXgm~2KO<f
zgh0uaMz8CwywR;NO2Zld`4`v}1>&}Vew#vK-(c30ncTK-qgUsQ<S&v`y}gn0I|Juk
zsmYX9!257LVki-{;i(<t{Pd~56w%wyEV!YexP$j?pEzKnD5E(#iZa;69NQ*>M^Hb;
zOR9yJ;8*SD@I|vmHPFuIA>ia>nC?;SH_OjkF5?Td^HuceQ_p_R5CTBs>694OSL^x@
z!=ficYUhs_yDh3pKUL8eX$<>#;h|QCQs<<?_1^WNjBY_63NgB3%pdP~ClMz!>g8mu
z18n)_qee*1^|&m3A)mH>d8oh#O(6H;jCCW**fe|eLt(M&3H+dm@l&>*n2F?-mWvOC
z4GJmWhD}|}%)SrIx|6bXxx!1X@Ctu>mJ<->wqRCygQP9GtT;43B&DO!Xll@9X(ns6
zy{6aU@GZ;wyxiyyZ;T96rQ2EkV^gD^j@^lCg9H%L2E7qU|50SE(R)q9+8QAK-AC|n
zEp8`4WH73mMnL%2m3J-4`qk=)C%y*g7x0L-Q)N?@|16%S;i&{qhUTtv!e!(1`O^pV
z^7?O>C?O6T_U9Vj70=N_z3s?Rx5=c=HC+#`0if%n*)67o(SFnBU*voLy!YuILtZ<x
zdL)7X5yAydvpMuV!i;^C2+Ogqu{WqkIu*98EmLRa7Jlb=db*<62c|!3>B?_)vxe63
z7Q$xqc60g5E55WAxsGIOD8MbNCMu}c*GAgpDlezpK38z{BBW1)y;Q4<m|fqc@|ulf
zx)%W)F8k;)%Eu$WN6upbNALua#*xP3PZ(aL3Pvjg-~t)fnRoK#I)$>zGs{mZ9!DLS
z8r>rI8$wFV61O779TVJqUpTRUCw5q?Vh%$A+!hP7uD9R!m>4>=49k7*rv&JeDjWK;
zt>G`y_49H?t;wUEqGjtG!~HU`um#^2cf>5nG?opB7v>?E+xXo2hn4LMKT^x9L^y1d
z$<!rzhP<*if+0|H`9(8vN#yp?Z0&wKQ=><V^pi`?+krnz+J3wGyUu6R;|PzZn>>EO
zQ;SE8YyMHq>PYkQ!aZ{yuAmzyWxSn!w){jVSZeM}<oTmt-Ep~tw*jU%F{ZVx(q#;&
zJ)Vt>i<5vZQAu#i!+myR?TYIle{$Y_{YIvo4ub2EoeINg0QvZyLL-3uqi0$TW``p8
zGoapFjec55<6ilEHv^gYlALpWZ~(e9kW4`|18FuGp85dDqJBGK`KY{gnK?z&CDU&+
z8s0Nv#Z|KLS1H1X$9B7C0X-R})aC)J+0=;{7<jf%3->w2grsftw3%p2d99&{lC*R8
z3e|6og>KUY3){PY%K>=J=y>d<%%$O21>wvTd{JlHC<soiA8fbD4ggR_e-lXcys+0w
zD#o`w(EBQ23o63sG}5vO<`k&JI?s1wm2WdrJh9AWYRN@O4%${r2TCXW^J8gvgX@NT
zW!)O)nVt+}z*qIqr)t2(rxs)MS2+S(3A!qZ7$DK|ym^gNy9}C_aC^4#?0&a^bzUgo
zk91IegZ`Yt8}R#n-FVsKvLjhW616`<$=q{14hq@O$UlFN>XRYhmZ_EoJO0$;5Wd2B
z2Z8qa@?|aP<By!3fIXcXfMdhFA495^xm}vB>|z5659PFPX$_xsLRu*RsV>JT@u-Du
z_NJq!&-v2YDc8@e#c^e>=H}B+R%$;qF@O-HN!9tpjQ!+q7#BaWSS(EiCD$e$<;`W2
z<Pk8<7UH}~L3oR`?d>e`(A(2%eg7_i;F68WIQEet`Y|>%`h|8_1h@cYxWjVsf^BR>
zo*en3Fl1DliRaR-8~KLwH9nN6tJ<eygN5fIuj_~^UTsMu=}{>1488Vd38Bp`Hu;h%
z1uZq^%63<htQa1yu=nSYmaW}Y3~0K&qWEy$j@4V?WVttA6voOg%#2FU&ZRk^+>;2V
z$BWl%nEC{pU8X>*`D^h?^lG<}nTdJ?E7NBx`*O+_khB%0IOKoC+JxxRErL;(LkJmO
zCD*%wWcct$88<>Rz^4DvCCGGLX=gwOMuQ8><1Le|>F41K{K=z^Q%%|tGH!eB`=gTr
z3W{)cJsFychQk1ndw5VY#oxM=T2&xWhFTJ}pbLQD>&YnXhuA*>C3vBPk>l|cK~ssx
z4WA=fI`Zb|Fbyecu4#p0h3S%a-rfCx#gTpMr%U#?!&lGV=*oXhJ~bqf^M|hWH0^EO
zE3>Tg4t=7=Wk*n`=XB_9v8=9^-I;5Nl1|KtE=FaXYC^0ErnWm3DCyP$I!Wl^qesPh
z0N&R6NNf-P`M&x+vH9xzB`w72DQnVA*k0JMQzWl?%n<Q3A9_2iO(NhGaa1H0>A_s0
z@<C}YP9Vw*u|&jACFC52s?QU3PKjkEjXVSj@uD^2wve`;rXpMOKO{n`%@V}z{;;#N
zyX~_nzdc|XDWgKL7%q2VxOUVL0&pD~FR85p<<SxW-(1Um#%8a7^Kux*9nHILNxgsn
ze)GGtcW01`PDQ5ofokZc5X5w8kCvo`oxT{h@yT|h<u1^mfw6+=AEhAY#DIP@5jH9Q
zcZfA46(14dn(DV30PtT5@eA<_ql;g{fP7a&+spelZGT$}>Cxub>0wr?&Np${=3Q%=
zu2|lK;d|78h85yn8eOh4k(R`2rI|o>4ExvoNn&r6?(wRL9q>Jd+MP?zcd^4?3<?(8
zDl^EuJt3_->sa*A%XqgGn>R{V$5v&N$=~DHD5JLhMCmRK7e5%Jb_OC-U~C{WJI7XB
ze<WtMgQjbixbcQ+cGTV}Q)}6jk!FJ2Nie&<NRmzDLb*&`r-m%BGbBwiot9g?Bg53>
zrkkO0$!jO;s_QaYYM7e$U8h}AVX>{}4^e&<Nr!<y3KGV1{3Y$WY>Ej?22_(6sFJ*E
z!>ulYzIs6-u@HdPv+}TQ+Df$FN$`l|EdSL;_MqBzEt&1<sJ2+JSz$0oVQn^*sk>}3
zzSxZ*e7-apjOX`5Bw>{am5~W={-LQ7y5!4K(&Q+t<@mQ3x97`T4mEF#J}dQnPs@$p
z81n3zIvkDR;juRWCs!?>pOgN@IZVo3`^jPN`iEsRJqW1>)~ZlS_<gW9?lFhMvZy)4
zCHuxoky0G-wYJ?AsIO`}@qKu(z)Df-fJ?#2mHB5MjI#CGxs}A?2;Stfq<GyuGTyg`
z>G}z;bS%$I4b@hEF{=L9Bdl4)@Naog{u~vg@=U3&b_~Eg5bw-*0)hdZJ>G?NWvg&9
zL72EUHNHvO;RtEriWi-Y{RPSvXZGt&P<|^D7v%arJ(NCTR3^IfmP$}%iX|FQN*$@w
zJ=pv3!_g=bQqQPNUbZtMB7gC(;+oR{5DBDkNi+K5HxiRfge%%*aKO;W#SVk6Qn$Va
z@H;s_Vwv;ayj1KmWxbzVk_ls(J+*x2DF)j6Tc~v~U{@ku_OWmbpp~a&kI7fQ6bN32
z*cR%%ULPVC?8%pn4_>x$1Q7j1t1M37*ox_au^bzg9;OZZ?cLylWmMLszJQjyEMp=7
z$&Afb_d);Bsj4oKvmqSYUra`)REKfE9@=SXL0GCYLV>vDZI!=?<diC{dd}0njjm1W
zUUTHCs^J`x`<@<aGH&siv<HA+?r4oq*d&T4Q!%sOq)XL${&C+hf#yKxZQq+q1W%E5
z;r~^(6Q##6Ty79*Bx6O!Gcz?U#HN-0s>8#dW>@4)c{d2fHeZeT%{oXI$3_0+b>Evz
zvR=L(#b18CUO)AFOt-KW=S}@wov+UyyA0*QHTs1G<>EtRnXLWR`z}=NA&FH$)a_<>
z3%uc0KQkHZOZOx>^lNk+r;hP4@R0aqiJ##oOFQ5Q9TBkpARro>*GvJ$41Ke27JYtH
z#->Cq^aZhP0WH*xcziZqAg1VX3VgP)YzFT{jyJ^r=Jl!juVNqKK-?bHR+40UKBQ(X
zNPSl-dcYNEVFX~yJk1_$SU0SU`k4Q^UYA2{-N!%wEMD7K`404tQDA`f`8kFYXKQ}6
zT<rC>u((4pWg~d?w%Pk_?grOpa%|nSZOW&w1{y+#J_l3+$z*`79~s*e5?O+kRT$^*
z^IrM1cc?-}KqB$6Qn+}OM8y48i!jM4<FJp69ay6EfK2%x8Q;Aj;_r4^T16@?RH+rT
zb5Vgixy?pQmg7r4tM>`5Y2orW$O||Z{VH8r<hx_$)Xge2cfsfM&xW)evu${77HK^V
z@u7aPkF4}Xr&To27i4bkRtuU~*?u~JbzwTAbo*0583%ps-uZ7SarK($XI&W{0$s?&
zgp>=r!N&~w(D8kGmAG_|Uvyx)vT@j|ZNUEfLm{Di#=4u9Erxfko6W>ROCvu%Reghq
zVtr|kD}DI>s5C8EJZ%PXlyP~%B1|T`w**WZj_ofFBOyC1Cmr#71x%f|T*G?HY5iuY
zXNd;MyfvDbyCxNo*A8RF_gmuV;?JIzSd(9VfB(5$vm{!=C(FL<X5`1XXTA1!fS$>E
zsE&|JUzar=JrXxPVZd_HmeKCoT9yfBsaM#tESPW#sD=<)ubyFj*ODm<b2BnRHveG?
zE>NgSg07ojY&0}rm~(MmkQ#FGBT>q=dig|&cE3)a#~kU>BvqiZUb{EG)GoO9tC=Q%
z=;+SDTEM9Rs5cpMGs-IU-GyCl#}=!)a=qJKM{JNZO^pW;L$j?nIXZ=GyQVg31}uv=
z`X1&nuFIs6_G0pk9i2`AggEIK=PloxZG<h1ZbrPu?u(e>hf}KEXgK1fie5okSaY^1
zGgva0jrLg$P{K80-7lcbKXvw*fZhrudeOsU=nv$#-_MwV9%K`TZW<va-WQpQ*%wM&
zR7tE8e~S6mb0z1PI6(P>6u)z|zRn6HJpRJM0=n7%ttd(|!!0umD!8&wgtO>Le96Ye
z=Z7PeSf!pU)}lk+m}ZV11z!ipc5p4<M*ji<usrfes53iOYC4K_ZL9*UKKtmkZ_JoY
z!-LmBUDsdVP)U#ipL3S4zJlo1&-~s8xac2yd!PCc(~QJf8tuNG|BHe3NJUvJ8WUe+
z<gq*R>f?SHCdM)yHU7%Bh~=la?swK3eabmdBj3h2C9BoqkK<-~Cwtkz-YouG8`4=X
zkmrQ6p637!a4a0{BP3*Hkw@}lbpHa6lpmh5{pNvec1~8L9S8dJeE@hu13gj@_dhR{
zUoqUTLiU%v%?*AycA?{^F4{}Pew)NHA!BHIYdW?g8eWmPEg`haE?^K6`Bp3J!<T{F
z=V0LI^t-swLMVH+`=D!LGY8Oev)DHA&63H4i1tB;=k60hZ<y|vUM<YnSQ29o@d!p?
z;e$Fzj{DN6W5%SVGZtdTX&O+w^NDs(@=r+2_&<2mqGf2?WI0?RqHAtpkq)TV5kohE
zIpa^|_OFtWtL*<%Efrlrt2R@uL2Hz%PdvCe6uP2dTHNH&2j%07jXK7(pk6&cRv`^^
zjYtp_GtA|%?R)aX^a6Wk`{m%D1)Tr-AJFUfjDCRrQBX0zUXwpcKZ9QT@U~_K_>buP
zywB;zQ5P$k_bapP^>PNj<)Dgx6B{n43jlP~Sb#)V>0?k}X3AV(fHAc`_A`dwzyI%%
z_LZf>dCZMSc+d29fk7)f8uGC%<j2X%>%7q)f{pJ#MAa8F<acGLzi4;W)X@02*4(^#
z&LcUdtxZF2^h4zDC>W`HFsDOyRHw-NXcn+wib^b&AO6ZY|Cjhw&Yl=n&Y>*$8>jrP
zI}3?H>o0#yMu}O%?B6U6MqR=k8W`&P{N*m~w(Ff_+lN6yQ#DDxgtW9YjhAJgo8ROa
z%{dJC3fLU~DV^ruR@#kn<$Fhrg8ib?O}-OHvx*(5(5SowbK}SlANaGfvY=)d)6n<L
zEf7t~!Te~AmlC3)sUMBo=Klj1UHOU#P(I}~U&!?DqWrhV{wq!ec-gGaxpIE`*}uNE
zf3*gbIwc%uPW+Ew4NwNkk{GfIng8R%f7}Hsvbd!k{&VHn;r;5VFLghsC;j_~uCVOS
ze7x}FFCQL2uYmD9hw72XUebHIefTyyBRdbLQht}bz}Xn&egAB=?<q5~w_fjJV=xmZ
zo5QoJO)aNx<Ci*jUPfqf%=_Jr*Ql-Om`+L(6N~>N!j6x$7N1npKV-EGLo`p-i-3g=
zA31RbXoSssNCm8Zb7BAb<!^`n@z4L;MQ6~<Pi3r^HUH-)|F=*7{-Nzd<<6nVAlYBs
z<gc%l{(i;Q@u=GQUp?y|Uo$#)rnLOa=dfQ6>3_bKcjAPR@%OHKzZ}y3qyl1&9LW>P
z`g-lJ0sMTX$^wU9;q;xw&mJU)|BCDHxAtFg{k0bUt6hJaj=U33E4p#~iEKhf7vOXZ
zxeMsHBE3#72<BGsc5m^AsApbR5R*yqootR1gF#Mn%S(sJoBLjN?+kdXg{>4~4!e55
z0`2TOG9+P}EM}wSyMq>n8>;s2EvY@$(_>}#UHR;3S(jD?Zi^EYQ}iFinBmB>YhQMD
zcD6=lKp~*L1u5Q9Pb><5$zYE}Us|#8wO%W6nTZCqj^-2>-}ZNJr+hZ9fbderx;q-)
zYd7fOcePSwl82+~m+M{+9AphvPVJA$w8mR=#2=F^l7r%uf`nYq$>_WVO7Wb`+O>||
z*=^P?aAYgaI4-@nH8nJSiM_V8u%RYDACmYQ$EzM2lQi7f*_oc}5p#f@Q#L-~o+V+F
zlan*0PN!{OjMOZVvnSO|rSZ@x<+tqC!DDXNnn0hW+vfLtw}a?mBws40OWjG#{VI8j
zi9?P*H+TPd-i^BfP_8Z{hTEsXv0|(<WOXu_4w46eDH9rJhp(USl0`d1?*-)y*Rd)a
zOckM8sKWH|;}6s&d-(2RzRxLBe>xQ#PD!B?>->jqytNVZx*~Vb7SW>d$@DdjTLFoQ
z>q<*JyGg>Mb)=lfU$TWa^Q`>1cHVsNRjey2O?8>;co<jIaEhd#H_#VJrb5AWT3B>%
zrQUq7c*cd!z|sIz6ivlhgay53k-a5lF3$Ba<D1`R6=5p%I8WG*wITQ9v@qG*u)UbQ
zXO+&6N8oe@Q5)jO+$ai0<W5uL(W#t`>1gf8yS6$O2`83URJNti%y*{{p%d$iX4Hj|
zvht0PMnWGB*Q7uhi&YrTeTJ@8Yzme8gIQsEd=6k%tiBj7Q}9?Qt)$daEk=<ZqQuU-
z=DS<<6^p*d&mW*M1BUwwGkW$bot7?wu?W|0GhM(dxjw#XOPk`MpTqBU^i}Ot)Xubv
z`t5{l&0!SHTwBF8Nx-YQ$p6K+o)dp=eHJTX2XD^-vEorX!(Amd*vOsI^|Aus?;YqA
zIZ@J|EC33F)vPaT<|Hn|C!-Ky_k-DEd+7`P{r7hsT1{H8U^-LpnyX{ulvbNKox;M+
zc6f@s$qT-E6YI$&X^}ljD`;qTMJjn~sRY}I_8Y$|>V{jY^XP7x&rIfU@>xt&UsyUw
zrLLUmnt6qD^s+n8r+5~=*9uDHN_f>5Zgps;E|4)XFn4}DvE*zfp8j28b+uJd-<1d}
z*xO^fi*q06QzC;NgFtwPQ{$1rOP`XdJf63Nw>s||R}Xp6DX3>CsH5*<A_$*R=%FGh
zyERJkf(LU~;9YFwR~w>?t7DHH<afyBC|k)WdM2n!M^_+VTE5ehESQMzuNlL=79A@v
z4TAEQ%P3>3^Yq<&)$_Sh7lyi<MBv+rku>xkndCBKP;2&8y??hA;m;1It&<qRjTue!
zowgYlgRY^R!1F<p{;TVV2B!k5)nm<uMt0M<9Cb2nhb&+RMvCzoV>XlA@P=O%cMDxs
z7eQv6QfBmuk&<c7y-4!*B7RHXzoHKtEL{8L4@*t(w7(K(pHCy*SG4=Yc*Zqn<C-|t
z1LyT#*)YsjlSF*0R4F^Q^`@U-HU+$?b506A>%F!7%GHaY3RNpBiw+Z0)AR71b&xA2
z<GD*?P_*IPpi~7tadA(C62JFAmk~a-2;yJj@tQtc^y2Q_i4hQON6KZbnU8HK5fZ`)
zv+c<q>BaD+c-|@5iMg4Np2)c4VRUVi1&tQ=-kAH4Blm|fLgHu(54{0Cy9tLbixhvT
z;t5SiNT`$1l<Ia<+*r95xKL5Oox4SZ)m~y{9sFEo=(P+s<C+SWFYkoBKEVF{7N8nX
ze7P%uds#0NVdRP7KO@B5w^LqGlYXW+<8_DZVq0C2oyANGYZXnLYlX%l|I}8FuvF0q
zl=?mL55m?^Q>dpf<&8}i;R<GzOLAlW5D0Q|a<5vJ@zpwS9zFq=<(MZ=8FAxnck-=|
z4~&qI2)QUKAEu<$Y4pnS?EwQ*zOEB<%?QKg{a|Bhuw>;`&yPNFAt!&1kx>{vuQNvS
z7!$|SVg%kxF)_QMvb0>%URF3Tv8-&d_;JQ)u=eoPVJ0S~)$zM5?D^y<gc;|2W?8Xw
z*XIE^omTGoqbDkb-%f5}?wa~$Psc;P<TI2}x^js(>p}JvY8_C_)ipGvK3eHw0d5a0
zXSYE=8yLfdN`Up97E^~kM%HFp-BgI1Nu~BP+4?L9CAdneg64hsPjGsjzrV%C9K%|o
z;>m-S_rM?fbB6T}k2=x))P>1YJbp?$oAbI)`rR|J`a_A_=sYUJappEncoI)E6<FbH
zYTPcKIho;r)$iM+1*eFFHUWJ!jh0X(MP7oSQE8<mp80R5@~5)4lJ!^#^DgpPuCn>^
zA%*`>4J&8K#+5EL9zEA>BoaB|{vB9pLRn71$-oPi-CM<Sy2j>bXNR2EmQNjYj1e~F
zU^sUAh9S6YP$ltZQ^+OV?u~D+StJ;ZoRIS|krw~Km=)=2aaHGu)PDZ_dzjp2T;0U~
znC>7}0Y<9bXs`Mn-b!@#+g*$PQMJY@LQPI5j*aszkN>lYVi0Xeuj=gAz#xaIAq4$4
zv#h1>QaMJ^Wn`5PQ@y<&oS5iHLSer~A`!GDLJ`oZ@6M=F0s1OXAF^3j%XH9^Kf-ZT
zgR45)sg5_+#N-4gpW>=zl4rM_3$e;ZO;b~I#G`-o!@}Ck)>L@AQ+YGN7{8XW)mM-o
zY}b=X$cK0H7X+>2*YhumntRIcZJiJF&uAKj4humqiGJ?$cVEN_0e$o9w)R-^o4F{v
zAK53j&TEJEXer3V2pV$i>tGH6{Ko-~T4Bkl6GjzlvlyGS2XLQJk*Q^pyb{dP=$ZtN
z1{=criDW40t>RX|WHwi=g5{5htx+d9t4+=PQk`wzzN^+w6ti3z-)b?)x7Ei#Y0OmI
zUX6=9n!EiW$1Y)dccWo`s~=4)bEyxNDs#_1Fw&IEQ_hT&t<1=9Bh=Ul^<F6F_G;L&
z27SC>@4vT(Z75TsKHguphSae9i!!d3yAv$^jhy(E9X1i#cg8&-NbNkLh+^hbHZWFN
zj6}-TQj>FBuNkW?*T7O`@-(T@0tN4ag?DsPg&m*jLxT!59wH7@C0nO}pio0QQX+JQ
zDr8zNIBNq&=<De>ehXl*SQ%I0VpGgFEV(}0p2)Mfu<#j<t`+s&T6yq&UVz`uw10<8
z9_+10sT!r}ALJw}f2soF^s4t92ddAB(won@2lTzf&mG{Z0LZ}q!+QbIe6-rN1DEiT
z1jZ9aiHTni9Q#Y4pAis&|94pbZ%9jL)E+D+2^pyr#o=&jj>|h=bMR-Fn9g$c@SHmE
z)yf4b-?y@Qs;75P(?f4#&WuaJ=cyWyThH{}3=$k48Tg<8wjH=AV2~Faozs7x@W;Xf
zF3R<T%*XnvFIP&ONW`uRZOYf&B@;XIx5x5;^N|`Nt-z<Q8K7*k+$oSg!$+o<BqXAf
zC6mXz&@CxRKixV0u~jM$pZp^Fd9h!r;SCd0QGUK6E-wc=Dj4d{HGsB({0SZ&^`qvG
zyifsiG$PHd9P=xp4GU#Ifx-n%@`h^1<Pr|J^=|>itPfHbi&?>GR~gN8=kWzL8}p-i
zy7EqMkK}=I`Qhn<4{%StH<x0V$jjCn_L*C<b4LykXFvyUglbj3i5@$+A2%Z_>8xBZ
z*H@BJFK0M7rtr+5;%baAC=um&%8*K47PfRG#g6+Q<PIR;DFbgpSXX1v{HC2<_mHOU
zDcJP2QlCzwHyQa(&_k=|Xl8`o!He=6?nt*_6~9I94`!2+3>RR3=&)<ugfba%a!57}
z4Uww|55dJZ4;saZGXrb^;>Bffd{c<1RT#g|(vR+Z6|kaZ-n>4mgoGZ~_6Sk)AOKI9
z{rp_aOh}(Z=vf;@pQW#Aw*8+x+B1&YgR=v3xyW^+u?M^&WdpW3ecj~6JuTK!T%OYp
z1$U`5L)03~0Dq91;~uB12sSaONUh(AfQ;l{Gm?ThB=HTFe&^ch7(GzgVp)IKgl;bt
zrEz}&Lfs%uZ9~I&{K8iZ6m+0XMt%k!xHQ*L1pFv}>+?qZ0aF4#(mZ-3PxJoLL9yl)
z<>&i|X5Mdh2Q4??Bv4%d0M<QA{SU7Y0DwINloJjT8i2b$1pwfu4T=Y-IPg(90057k
zim*OVASc9G&y-5C7HJ=(8NUVW1HcuBzx-ER|DPAv$KY=ye@f;SjYO}m=K(5+ox(UF
zl~!*-6=I-5q!>&K|2Gc#Q%xQaJ<NZawh606pawqji!|6Mt~YbJPSCdz1r1D6l5cXa
zsh$q5XW^;1n?F1#Vtx;71HZeYc7XCdKh9_ZuWxs0WCi&(8VE5P_B7768?OWv4C)DA
zv0c9D^hoKT#ZrAZKn&}vS-s~`AZ&7#r##=JDqE)_k8?hWzKd;Tyk^+rH9s`ZEvJ6A
zlql#l<aU6swzP2=h#@i)0`p=`)>a2n3MIG_JF51h-V}aI&Hl0Ypidq)-oq);zqTpQ
zGua;m%vBL;%f?rH%gq+c-{fsaNF+yz@N8AA!;ldY3aC#Kbf%Su2ML7l?ACyq(mBL-
zfi_zT)VK~8a|h=h%Hlg-6S%mf!TAc8Jn!hEf6%H=Jksr*J<L%K;kO)($5}e=G@kuW
zHsCqm*@2iskFo0Qs;t1^Oh&Ck%N>`CGYZrin{rG0DV818GgZb+Jh+M)$h_iDHREq5
z*x~;8zETO)?)KF^_S@MA%R&3-LFjmqDnb1`BU9VO(^nT?#p=)Qlq?F<7-{w-CKa$x
zFpB2@V;7)xqw~o?0y3V(5a8N#**W%i+=?s{JCfIzyu!6`?tot&I=n0xak!VZIn1ZH
zMv83&C?Jf7zzeFU4AC&MUJ-qdTJBaLOIptD8uG%2rW};CvNZ^}@Fhdpqv72|AT`7B
zDmWmm@WsOT;lP7~%*byo(K(Z=7{1wC%yJGU8_UC)y5E6#O1FkN`9PQ9%E>R!$zP(h
zUUmh&%zFLb>>Tix|C`MG%j5t5MebJ_bu5ol%HvDwRdnAY?0-rqzgNBr&i!iJ-Cc`X
z<|x(IlNigd^}kD1Oh+BGsITa-9p26@%C_e_WrXT~I%77rLuRsCJ*RL`cmWs{fe0)I
zN>9o<eA$Q64g>d}%^OAP5s1}e?{Mu--`EbcNW+5rKZZHAaaU|NaQQw5rl}yQ;INF`
z87TZNn<uwrioATl4FZbU9$d0$;m~ci3Fjhz+n=m~f$F1}9*1W2*n;`5Hvh>*{-oS;
zQ5QE*qNe#&uMFHfsF5>DQv3wMKCm#9>Xm9}(OXRLcmSNkeUOz;IF)On7uyQlNBR>S
zo6){pizfn+U!Sb4a>2;!d_!G!0sZ{oP)^NjBSfb$rh|5H_d@|6d4)lbIl(w_=1C1h
z3o9#*{-L7u-xr^~{gTB0+_WlNlCr^i=^n@YP@b_K#=cVSz_BH(KBw(44Mu(eTUgw+
z_%c|b9X{7z;gdNBdV4f)e!d@vb9!a><Hb{by?YdhL|0zMO?D*o%^yhJYTo3(_pqNK
zw}t0VI1F^20RrHArfh}zImSFpoE!|epq3^>Hy?MBJcE>+xUD8W@Xs<q&IMy*lt15=
zz306HrC6@^Ni96V0Xo9{Sg((m^SOMeotedGy~fxe_R0Lt*H-_9l9jTnoO_8phm(|=
z_zs-*j6g)pWzCW?eVbJKiiCx^F$L=Um)3A-!lyD{G;>PGubmcv+2MMA&SVPQs@cE(
zvzh-BX3&WNBB5g6Jno<a?^b>R;GCrAgAWX={(G;#RU_cP^7>1i{;L!J)rtRYSpc2r
zOP<N%C=LVY1B%qFU=IL&RHP0L7|Ley9Fa{`zK_dHXla=<Gi0UN+q){sEuxd28G?9V
z)#6G-khBO}z8PzoM_JK}`ZrozIQRF;gfm~Wvx8DbeVQW7YNobcpc=C7s@=mcXsyFf
z${vq2`>6#4Fd$aWlHzEKp;E8AP-<+kj%70vDOnR9e1724kz*btwt6J_U3Sog`WU$3
z(+c7IWJO-?L^%PDVt7*OnJX)6M{btDCB|%QfBQ}7)x&!#PfJDp`xPere3seoB0b<<
z>@Gj|8KAcVn3;@vZj=s!^*O7MQGWCCkl|Bb-g#6wd^AGe=1JZxxX(DLrmd6`YLe$<
ztYg4ec>W}SB4dso4-4)oKAZmw)VWl+^M%Ty`l7wX1kxjqq9t(Xu!!;VXW`tUrKi<0
z(ywkQC2gAQ3UD@O189`w;mmN^D~gpA|01`LP$$m22E6~=68?4ZY4@nC<wMNOpi%A}
z+#220t1gVyGpk%O#tO_GYrIXUmbrs-^~p-f>^V7-LbG^-?noY;-$}pwQ#WHy<M1+f
zX?{n>wy(=_LWkuiks~eo&pU?7in2p8aDL9spSRkl-&;{@<u3+w{IP<vL4;6a1(!5T
zyV?I<LjT8Z>3%Z+%3{QxC|s%QcgQ_s_h`(=F473dT01<HvuFA{ASFkk2><>)Ngq{X
zd=vSn{z|9S(S6oQ1Wj!?noKrjQ^%ZizaOw6X8<}jG5r}}uUK@w%HKM*5w9G}`T*_5
zSb|pw{NLLA4{;?hmV!Hx)&73#+(0hpQ~Oc<kKajSTq5mGZhTVv8KZB>{*;8YpXYg$
zuXom}fK9pF4<C_LetzGypRUGCX+!iJa)ms6`Rz3$?b>nt;hzej^p8#eFkXJcBt%x>
z0%j~&2))~nDE3*+W_8S+UIUIH_~RCQyE`Vk@24&^0B!(?aoLMZ!ZGDf7DrkpU<IkE
zms37ljG<BIJb4fMQ_S9{xcy9YH*5j`q`UP}cgfi+o#lr)rA`?Q>kssuEEODw6<D#C
z{Zs|cl<qM9bS?f9J9#b#z_-IEXPtjK+kgJ{gpuFz12L^Dg~@<lvwXx&`v1_Gf8OBl
ziz9ip3_l&}Ki$RwtwSn{&{r}CLEC^zywb-X{G<~OnE*~K_x-ZgKPUUs3zZzw&o%6y
z^DWm^?nEX(XXg9YLjB2|UViF>{p8>Oe(zy^0BzQ~_4YugPFcBgLGHjO{T8qcc!v<a
zxcZ+d%0C5p<%%tt>tBEU?3Ul4`w8;%Z4(E-lCP>dHw#l!uW~2f=FRAckD|4O&5PNn
z>Urpe3|U|=mMs!pz7bK4scD=13U++M#--+7Bb1FVp3vEixYfy}i?WsvE*E0VT&54D
zS<rz5f3vu}a6mr4PKCE#TjDLz7>#7MU_|1%*6T{_qi>i)Q!QBDeW#Mx>zTPZ88(MX
zz=}y`zYtjf^vu_RxM*mlHjyo=_+`FWEGy6@N6Mc97qx0}%Y&}}s1JV^Jhm}A_qZpo
zZ>puprQ`Gc)kcKL`JD0<VWo{tSR?=2%R52berrpHT@gpevX;bLEi>Ko^Kyc-)@NsT
zp6MB~ror$E6{GQV=|T{_W27c;bGdq$Ue#xDxzO>jdM5TAN*Mk7!fd+}`Omu|+s>C)
zGQ^A(RHr(wuAqAGg>Ld+Gk?la_y#?3u?u+;JhbcOGJ}PeH~v;Mu<-$Ny&>u7`cw}A
zEpm*qY%uZ^Hw?z*1-HVtXwOjAeQbzzH8f50^fF$FdBm+ih`YzA{#CmAq`Fci()mZf
zFx7G?AvA8;VW#$>Hb$GiGHg=ey}58+iMBM8oEN-v_tX7=co?3Yg+_@MDwoLfokS^x
zH0owF6~+4haWgwRL2~$4N-kIS@{@!Q%}$2|qpwgSBP2qN{6@PlO~S8_H3B2BnC#73
z{qZH!yd${86%<$HW)=b(b#?PyawIH?gFcCOmr7eIEQa(qfy3l)TGy0b@!udQHFom`
zyRxw;uD7)^8^Jg<SRQ?1ID)f=$4W36s-a1yMTBO)d*ORD^ZDL+QPL`(`Hm1w)lbq}
zA)4I@DUlH_C#_nu(91kmWc&+AI-o;9XV43U^H)fW%)=m`k0sSHVdZIkF7tzg*^JlA
zcoYmW+U2ILD6>bYXKxI!V7YmjvXT~l&(zQF1$sm(B}FoC<sHffTwF`*?J<9jP^^*w
z<9&DL1IwFx%x*Xg0~^iyiMGmhVq{0s23cS-0)|%Du>ottNc|$Jm!Y<oH=PKW#e!{p
z_hGAh69ep!>as$|UlPo0FWmYp;TBg?=`yXqr@jiX#9EzVeD!U>E-7v;cB1p~nT+J%
z7?JP~uaC2Du5+%(3WlN(-oIP7BY4#H1%n|HqZTVK_eA~aw5hKQP4_&y#FK#Iof<?S
zRs7vHH`PM8&reZCMc`SH*wU~i`lyR>DzV`%OK1^_WH_MBnF9t-b-X`66)00;p$GNV
z^zaB71d}e75K@XL@6LWmnVR{CBrh^%hT7gv2AY>G1`WMoEwAvH0$L@t?d(1iG%fl(
z{Sjm(%uw>%jp%+ZKaC~P((N*KL1T^zrOjt;rj@sFmRQAGobgiD1vTbv5FZDRp$YMX
z?dD58=0hV@q6$<myXMFd+8Y**%Y0VlX{t+4x)E@N?R)Z4U~7$dnKT`Q>b4nBfzH0E
zw1N~<A9G6mek_2Q?U|_0y3&pLA_BLl`N&nF&97>bG|F5>t!T>bSh(AA&TJcaweo4z
zRu#bl=f~32vJ_V~i1!&S!J}&p9{?v0V=xh-$3G@X!Rn?&VE}m>85Gnaz59v+ad|X(
z;gm>Ae)1ztY>LaA4?cQWc+Y~Y&S){@2y0j~bTg+d^mT!Mj9>H~kGm+l`Eo8XkCglO
zPWR94;~y9Qh)_St`An!AC+$E1GZ?%G!24_+_PN=nAa<qNJ;ds_dX{oejcjeOxBp%p
z3;Uh=3rNN7-Sr}86$`+QzB+1r+K9&+;yU6%uL%SrTpB(EE|;!0lxDf~iNLuR7bTA)
zs&)i7G_6)TCtT)-@n_SZgL`KtzdiQBBvT~9-X(5r=oZa}It7`HqA+a^3*%_^K=c&z
zfD)`=dHY)6Xd^aSiPD^jXme`%kcMGvTZ=}c7xT9k+xrPHMuZo=$bvaUeGCfSAoZa-
zWAM+)01_-k1Rj(bMEo$s!S^<-66m%!Igl3iJ{arm_Eb-jdC&jmdOJuCp1ff=LZQ^o
zmc7E6Umi|=@(DVd`?bK7y-xvIF@WxJk`d^}#<V0j*iWF)8-342?OaRlnzh(x>`jP>
zj(5JEDy46mJhf4=yUDq*U_Qh{j~Uj2FZu6^iY|RB3Z&JkZn9kAM$Hb@Z8Tmh&I(P8
zd5EUFY3y{BY35kWDnZ)%nB*n~q&JJ<*w9`_XvC>s_&S9QM>u-YxSUh-ecvm*Wf7U*
z6LG4(YGzcM`vqbQ+oSZO?M2@SC@O`%+?|wA3b`*3!=A0pjh49ukO&_MnwDjE>Q}FR
zi_&I=zGcRzTQ<y;Zm%1iHe}?p<P2sPeuwp^7>nBU>;yMD8V@TvV{1;m{c?q(Hh81s
z_;sc8v2glA-B2F?Jw;b^_hW~^D6<JwO^^A0a=F712lcDqRmYTgdH&j!9>l#<--27;
zym_<LOQ{_ev=maj?wF}VCP+yglhPb6F9pSi_UfK+R}BalREoJF9KJVaQ&m`22{A5T
zEJh<ByDRBJZ*m(6B0iH@Tm9?>A)$$?i{bK<D_@uTE+R9gtVey|s}q6Cjk;zx{>;rP
zp5H0#fuKqnBg&iu9H!EJc-{>wdU!cJGuR2&3JNd!6<fmWy>cIW@!BKdLIr~G(ii%7
zlv9D3=tN*vk-2VVf}#_Wl=3VxbaSDr#`yF?zf?J|JZdqEujFwAjP1eZkk8ZVsWz#m
zqfXxHm)+(nzb<r%WjH3dmMb#u?QHT~NTUo~gY9-Y7)@}JYBHUP5e`8keriM`z=#R-
z=Y}HaGc18fF>M)%rll@v$CWyVQ&U)A(<;h`I_B5Vzp1QtNTsln{OS!?k>|C7R9?Sr
z(8VekOT(T>(w1|=Ws!wwAx;H*WaFC!$f^U|k<8mRV<Vnh&F{Mk`R_fvy2vhqlzv0z
zDHMtokg<;a{(5r5A}sV8v!XaLWyLvlS&ZH6G9hVo!IO594`Ws@Rd8v0fKjA@;!g{%
zbD=JkfU4zywm&v$4%%(1+xghKj(Cxdma+n~vfKJn4k7hH85Su?3UndLn4UD9oSA%<
z9#fM!En$tOSxjV06xpuUnNT;D26Rj8f_<QiDV+1ZO)eNU^r6=l-Rq$#^Hl{qTYRn^
zHdeao6yjK#^Jqt@Xl~Rd*f?}gy2gcL&{1K`rTwTk^Q8+SBhGFPCiu$ojWt3>L$5>7
z7}FqL&8`K{J%}y;cv5NCPO$w>ukYYgTYpn3d#w^Pdb;i+bgS}fd&Y{H0vMX_wLIb_
zy7uQ1#isMq*EUsBfl>7zF$%+5!Uk=oXDmAW-JU*uIxP}S^(8t<HAH4!pDEY9<ui>@
zjFgkoYlH8;_Z(k0m>%lpdEFEqTra%$oH*uFvl%iFrx{)AzUEf7NgjOKMCRl)kImI?
z5jZbx)4Pd%y3#_NbNK1{b@xAXmsAY<h!dm@R5@Wa=Z$w;y2YyuOx9`A^b$lEeY;O&
z5{KalodN5!^E@dYt;vvOmYItf@#wx#gYd#qCmR@8g8U655;GS3=wJ}L-39yF>J@W~
zGaokJZY=Uptq*}}N6>cJ_+9^<q(c6I*8XJAm02<?+-+DW@Nv3dG1zb76-(o#x1r$^
z498|)VWlju&hjZazu4=IlOr@fSo{oe@>+b)_fh`t-tL8^jQI#y>*3K@-6!u7Pah-C
z>$>i|9P@J}zn04DN#N)~W-IMZkxpTFE3hf_T4`w8z}&vK;yuAw5+M_qx$WBjnxbav
zXHofaf!hn}HdhTUk6A>4JXDut96X6A=gt%#j1?gzHqqLPqOcisK3qm|VSxj?9HkkM
zurruxV;7gO(5<bmdx1b5k5X1++-Si?DQ=1(Zp^EWR&R^WW6<vs@$kpH^GlS5*Z6AL
zS$X-ZQteL70r%yArFQOhaaUH>(q=->RGhj}q%o;1!=~V(%Rs8jhMLGtSy^+S(`_K_
zaVElKV64!=5E9yd=l;+Sf3%JDgj4NOyeT@{SaS-3gVGIZqn%pF6TKpS!ce)*uOk<}
z(_na^u*$ht7inWKwy^k}ip3HeL(o8l$}fT|=*O25Mp6%nk)h=~P|2ICLk<Z8F}QIJ
z-OdaIxMWKAB_-y(R>+vbqxy1-Vu^b_+BX+VbPBF>8upc5{ur8F?bc(I+hZdYR@uhm
zX3rK<dn?`Li@}aYD#XPZ29h+F1Z}ov5H!D=-Q-vHt^T?^BG}25aulK2TIsj>-hJ#N
ze`s0_cS{CM6WjsO_LAmgO$4czZ&hno6KdLV+CmWghhePMq1EiqcCjM<J;R@U+B2?X
z%&FQSd|gMpNuyO{`<|y5?e;jcXVmhmj1Fs7T9RuX-@AEvt@(9m#B?4k&t#PH;E5&g
zjSs5{VE7ppKkD%!hsjyAZZ|{5xEqcvMexr)cKTg?@#AbC1l0AZ<+aDbtpg4h?01^A
zPnwLxl>1l`HaW@+a^oeh^_N;MY>e3KSp1k{_&h9p?f0YAS#3zl_lvi!-63+cBFlx+
zJH|uW6l`oGR+~Tm$yS`YNXMN4$o6a<A%IXTkwUKreZHD_^a`zdW8;rBBSu-t|K;ZV
z6_Y<#J1MSx7}gt&8uxfo32jcqa}W@#36*k;!aOM(?qA4H5@R@tl@i=>Tb?FftGrzm
zwl&`;r=I*U!WUj;v(z={0F{fgS?N+U&gQZJ{njT6$>j93+^`N+%e~4@j@9w$=GBB%
zwP|~O8{Na1pQJ!qGPy3|hC>LHrHimeTSfX=M0jmyH9o5bX}>N2x0~P0yG!k-5`*y|
zdd05eBSka~g>Rz!Z%xki)%fJ^Z7#{!v^kxAqQxa8EcLl!`cH#GF%RNMWC=mg@WOm%
zdba{&z3z{MN8ZP`U6m!R)*ZK#m)5%rOfOAgxXxmDTy-u-ggSE#SXw%ErAnT3_X-eS
zTkiv*f7fq|=M*DW3RvUmI=R9e9tqsH0`t$;uC>Qe=NhCZbYoQ|(M~0Vj^l-PT)pmj
z5{&GP+1nzGulNwcf96(!S+zM4rZ$NF+MCxw)Ws2U2Hw}_vj2A<#(r(T=GY5AGM-C<
z*tFwg@NItiNn#?vdQLAkAesC~7<z)f@KY;!=1O7OQOQh*+)j(>mbcx`pp>=lat2}u
ziS%^c0gA|)`ONP~dN|h#w!f+=*uxi0sq<_-uf0i$4@28@N4XIGJSloj&dKM|DgN*u
zs%5jJ^>4b`tgmn<bsxR%xzIA(+8r&ho>+wi(+j<fMkC)`muuCBFmor0OAOa+cb(+D
z3QkDb0=COw^r))^aX`F<%xO5V10wlrKh@K3;tE$h*OMus#qQlU(C+65orry0<USJ=
zSyH=NGU<u@l4WT#AJk4rw|nE%k#V^r{EF6bMOl|SL_SBB%i@28alxJ?xip-unvc~@
zzVm71$j-9tZDud5oU2k9K%=F6SmJrGyEyi2qw`vzTC&e@^6Ewk3Zp`j&eVyO#0i>R
z?kOqHsu;OcCZ?`Nh`l^e*I|~K^6Z3>?kCg@V*%)oxu&e1OuV<vM9767Y{#q1)MMFz
z(kunUu1WJ=3>0TgAHV-AGK!qhH;z2xv&$be)xCNTrA-yPbp$*4uk{r5kENZm`O=lY
z9=yk}*WwV=g5BGC>$1$_j|Lnrn}TkM2aN2)r7o^r5BdlQ#O3*ftPzm7g!3tj^=oRn
z#;0H)tt?}-f1*|n5JL3REY=_3HclhZ<8{)ckGfOs1zvs=98rkm3rgtijFAUp?7=uV
z*9Xnk>T9h-lU**uE)(L(ZnaOX(-stC^HLKt0`li^(x;^GF^akoDXPNoHDiOuhOET?
zSV6@m$pF`L4|-@}vQwqf%R#MEAD#Sov)?+HIc;yFM|IY|+T9%IES50s8Oj$5%#9v=
zK;I}y?}knPn1hYS-C19va{q7?Nmfj=92y6t7fVjuQxwb}j#*|BSttE)tSYzog&iTV
z-umnzH%41I#4vTuNk&f5rO$xTMga)4WXwCijqFJnUX+1#1P7My4a#PzU3PzP8Hug^
zfP1MKFvX=UAH!(QcwAyo+P(Md1C?2zeVnThi`9!o7a)+yOz|&vwsg6ec#}$*H?>vg
zjIANPn(M0BPDtlHZYB46X9H~1H@P=*KloG+DT6^+o-i`tp?kuO*qqrga-VT(!r=(`
zW(9t|z?0vYB(7xYl+8H;8zx4DjmC7NZH@4j9`in9B|@2v#Jg{zFUMxU{3$sd?<x@9
zM)C?4s`7GRYk4KGzC3kAEO4sZ&6k|n-=Ifdov-r|79YBzlX1A7nS=9fE!}i=uD>?f
zr*3D7^im?2O|9VSYak_mcVs)Om9b|ngJCC3=E|o0eC3EZ+D|p?o!RT-7#fJGUmd5(
zSe;&s&Cw3W@M(5PXrsv>mjQG#PYKDV(Ao2px$YHX6YtZuCb6=8=@OROyLFkti4~Qj
z@bG2hVDDh|?w_HB`%q>O(7)hP)7$*&-*J7o*=HTn6JJcW^evwj%lPVkO(<y7wn)U?
z_sh0r>g&;#mr(@b^!2x_im`$s$+H!mg?4Gk;+tWuI4jKntD6+1RZI7R`Tbb#%X87d
zqQ-Q)i1=6iG*zOJ?+<|?v*KdWjdsxVcnzh)X;x8bEu*5LPSB)Xo7Lp<sqpqYlU$~6
zHu0CszbJbzar@loNZoN&_t4V|8MZ-;Xd_iQ?(bGmN$sJw?V$B8ek>+ljVBpTe)y^N
zq#%N3KC<(n^%PB!xTcNyagAAENosVi!gwBk6<i{btlOD@GuP~)&9<%%o)|C<SG<ij
z-ZCkvB+q+Oe!LpQpuIeZTNkE<J8<uk{fE(~2$@&P?dB!i*KZ8>zD>1IQ@byzS9RwX
z-iqv<Z}8NPUdosScH~5xxc6$U0~fBZEVPGQzHx^Lw_dl!^eXy3pR&bS<ru_<Ov+0b
z<4e-l8a@(?vW2tcJVq+({5ed$7V8t$ywcA|0#f4*E#;DT_e@<NQN|1gAjs8WInujD
z2wI2;pPhdOK(RfuY!nLkT%~+e=#HSUo#h<7c71mQnbAnLqgMBnNU(ua3}ZEoM@lb8
z27Ydw!C@o|l8sH!vW!^x3I&Zp5Nr6j{a!qpsKH4&yxR{|;nh^)RtJK9L3g%|Ur}hs
zS~sOuU=e2YRuW`w4eo?w_4YdrUuZLy1t|n<o_VlXl+hhQyZdTmy)Lxko+Vw`Qr)Tv
zO%%3U5c9Q#z_;55dC7pyAcMgc&3|GZg@KVhHBR`8{*x|&3w-`Arnx>Y>!e9;K5k>%
zR;Li@rHEZ?qT5g&?BfyvhAS{VAMQ(16W!K^hkAu;hLFLy=|taO!GT=Yuh_QVVBs#4
zsWeUrZQHHG`f~uCYW7(69{QM;r_6_j%U@QiCK~W=9bcBXS)ud^MjEm0@ttbO>RC$+
z#Deh9MYev3(B+SgAwyP{r@3m?Qx^gq#I0(Ro?NJ#UF;_0gpFN(BoFLKyEC;u=659<
zZCth&{U}X%ryBk}FRG9Wxd48NMf_xFaJbMI5uXDK8Sz-}P3+%YrHJ}{-<`Z`-i|B-
zN~yymk)@mSKbB1pWlqq7$+aJDSSv#vyNe%HSGc7&Kh?dkqYYg6!WR2xDapx-R!#Ws
zGo>xHdkxqpc`&=_iE0D1X>E9j5`F{g>0Ec$#RF<Wd&AV2iP_j*H`jZ7#!sgU_6L{r
zSN!aJgsw7uqivp-FnqOh@JRO$><hIp5qI#ODW!?Qz)wnw*E#j}@Yi<LAg!$lZHpby
zp5a%mo-HVTBbi6q9(%`c=-KWrBQKR)wm6wDVruxLB0c%BO_GtV(T2{{##EO1z)1`n
z(Lnmj@LW8tK4#K+b5&47Q^nrpp)Mz$-sfaPqpQi2UnBl!AI(jw__TFq_!r5D=WkEM
z$x2)JlFzC&DV*mCA1tw+)*)Cf=KJq0IH?&~cnn0OK1M-I+pw=HCOy=80-XGoIX{C6
z%&OdO7H5H3xa1@miQFB_^wl?LOnp?!|JBZUzBQF?ad<|sqA-q%lnD$nA`TH0AruLq
zQsgp0Lz4g@(nN+{LJI+-7jQ(1(nASF0wMvWn^4qI7z6@H4JAPl36c;>LV!^2aqc+J
ze2Dx5_nxokdG=msm$QF+t#_@vPZ5S07aBc?7AFxcnxR)zqH|Ic9AV!&2bdMv^4l*A
zr@uk8$;qCr)+bJ!PBU=aN?I8L<WB?#{`8E1@o<`uRBSGJ!~&+kl#cTgNA5e|Fs$vq
z4i6Y7@;t1*S<Ui89T9L0ly-S|DN!9(EaSfoTwELRi<Tuox7M#0`Pchrf7YI?G+uZs
zw>5vwuYOFb-c8XG!(|>st@p&7aqCm=OKN84tT;;MsAg)N;5%6+le_f=ubpW4MDwfV
z_u3KKxu|K#xK}4rL@dP9X#S+B{2?uRxI=}kSaomN(M`^gfceZbh?^q@N-%7}Jn|2I
z(0a3AN-K!q8p0@Y+v*rv{}E8T(OXdqQxZ`P54*&1)MNfDarC2F(8U|h*a4arU1p|)
zA0;sAX2~0uBddM_^!5tmR2*uae!<3Gt5(;cNC(Exe#1VB!i$;g=Ct^!*5va4aD{7C
za^+nPTliL;S-i6V&r105vZ8l<hrUOSZKFdKmKD9;(tzH)<!I0se)1AXBg%3ANGQRs
zI?N25IUm;E-+D3WobE2RmF{?W`%d=PJgONdukd2Z8#{yQ1vN2<Ycy$d8^~L)b!P9v
z^M@XVknBKp)S$c79yLUjwk;SXc>rdj7d77)3UR0ovXivdoA0-Rw|J6Ar)c47otct-
z*Qs}a;)EYmF)IaeZH=(Lo{(9(B0ZC|chpiEa?NlobLYL+Q@j%d8CO0S1WWh3e4eu+
zB7SGO`WqK#$w*?=bzWH}?>%em@<LE?GH>aq)8UKN7;i6Hbp3cChSR*zACw|i0(NRt
zcItdN<lX^EIt)uVc@yUI=wWwpEgJCJiv$Wr7foT3brxZt+Fus5pXEgpz&FRS%qNc6
zdOTkH({qu@<`M#RaL8xBXF3t>;?dQ)`jK&7S399~qn|=gA)y_t8a{rDVaZ+Y&I8Tl
zSifBe`q<UgRLN~#I*vdt&Mmoe4rZH5mDJT#%of&qxqf6JRxbu&f03-zU2b5)Ybt!-
z-4v%wrDGZ7z|~1^mm-C-7!>Trpzvl6T?7P4_1rTxNJXVuu=~b?;-^Xu7)`8X#^KVu
zO_B<5rQC>rtVl}Jot_iyLqGOtl8Tp$R!=w3Iu0qfKVm~;oVqQpa~eq5$_b=IOMaNk
z+nEP5cVEWT{48dg0i~>t6DN43<_6zCA{AQ#)yV<(Zts~%`tCsfzuL;XZjB#LQEGeR
zdDdl;$g8u$5=55cQw+8U@Z62u!bWvmkV#t9ZYSD6j!=IjZt*)HUK)`Etu|z9w*7EO
zWS7KmGfN+jyrjGz((~_0mZEGiSLSKctt%V&Ez@Zn;!Z#$q?S`1G~HTN==p1(=I0pN
zQMYM!N=%f5{zBMXRa5oEV&`O{TC=e;<*MXe=>3@3lgzFRF$Ulrr<#QLKC-s8ZtZn#
zZH+Dal-YFcyu$n`{ms-#i+ko&XytcylJ!15=VC|{P93Ja^l`im?NZhI(`R$DO%kH?
z#Evr}*Y`dRaeb8vE3))(bN=uITsjtH=X!};D`4q>WuIlk+SfZfvyQ*u&jaMm3yhy!
zRyv(_A2Cc0+=$I=@~rV$s7+bTriQ^B!v?bpFDK=_hCR#YHry6Z{N!EsUK;VdpNn|=
z%vD?pM2PIhOx|Q=Is9zu_AbDES)Zt-v(?k<>S|Z#>+7L%YmmBZqDwSrij#=Pc1IxH
zet+d^24VXJOyD{2eafNGnFj55XSWVwL#6Lmsz!<rdnHLltTbfuxgUm;6Mj@v^$cd2
zq1G$y>RpV%;h(Y``|`nK<GfPEyAmqip&djdA)t>GvjKJDe*&jMiBA}BO@L6#Q%qf~
z7ZOs8*%z9fewZuA-3)yVmw$HpEidgVkk5jhimebPPYqZ1TD#4nuHUy4q?#FfIn{N8
zP@70wkD@}SHzp8O$2z^W>x$*eGWvR!PwGj<5LpGCpcm$}k>c83gKQ`5gjeN{d|R^c
zvp~eG&|Sr4;ms5rjyNb%HQ|40YqQs9_p-t&nEEpHJXX-!vnf)jE^9+6GT(%9yKbee
z*St72UIY<~wu-i`K%`*k1shcd(TJ9}H>OBwHR<dJX)3Pp<&E;kD0zx|pK%HLT73za
zY67n8G-(i@>r>-nX?a1Tv%?}<Fv^${f3%mc!&&a~ik)M6aXN?0am=!vVnq-^n?h6E
zfrKak&Q2R$;2R+!x6pukda57*v2@)0xeV-51eN^`KlpEClfQGnJI-&7QZdw1K(nt9
zDRdE2bQvwWJQbG2$lZ($j0ATJtyG4)`V%n1#*r3EJ!nAcBd3uwCvj9jHnF|^jG~2I
z(wO^qILOZpNk=@A_{zckmlS3i0fdMJS3USEM9*JwvI+&DGZ~JV+O}}R{~P<q1q1g#
zH)f5;aDgkvm8HsYC1J*uz3rm9M)_rB<co8&M4^k2$=bojJN8>!2Zu;(D1PQ4)7Wc|
z=}NKV6trK;ELj<-fGEbDrwr*P3(X1(vB!nLP!ZNP?3y0A97EH6!D_ej(MF6YkQtLM
z3cM|760mBz=Uxb1v_1IGc^FNPVFtq^9X%%bB+<40{+fZ}Q8sz^fgj%b@&grjh(g5f
z$?JJ9CH_?m@gLLsr%zRR55T*Pl#plRpgVPBMajvA4D}UL@iqy$k(gKLG{e<BKd9X}
zMaY;j6Shf*3w8iW4#XLA%vI?D@<m2|{K4V7hWij+KacRPVpX6K;ax>lGv=Y7pS-c*
z5!7P<Y`H9>t{1|lEluUJz(QS#sm}~4C2Euvi8}Yqw8gMo*fqCqr(BY`8pU9%c?$=J
z?<!d6*yVo=7jpPgi&sXXeglZZv=u%*_McHjBAjH>7EDt6jUIx;A*+*X$%Tcp`i3ca
zC2-R8-Y9(O@Ns~n<VayJ-DA>=d{pPkgf^xu@|jaiq20v$o~gm`)hCwri0W1vu7PB)
zSVheqYjOWD7x0EIKs$v&6|d~tF%!yyDTb=tKC!SzXmdBt{aGx7(or8Zb%e)Tc#j|G
zbq3vN!r1Q(Hp6K|q4`ctili=k>QrLP(&UL0rPkO3ys7ofyaYqaK5O^c(r9M>@9$H+
zeQdw--?Kl;?8(<elk_{nr^}It9#{1MdGHfyd%5i|2Lb`wQuBWJ>|m=+3gIpy9`!5x
zw2$Z>@7vGiZpXcLcNI@WlKEq?MWC<v8$fb3A5kyx2V`B)5Op8k+L~R<Q-wh-4XGJ?
z+k#pCPMk(yt&+o11F=v&!se<m;S-)|V>9sb{uD~nnf4&_i5vVEM6*Wv^)3IRx(bNw
z47p%ke(ccqVOcu>L3acS@VYpfE>*BB|DCD0jEw1iDXx0uM-8FNg_W}-SLw#M&MH)M
zTW}8v&#zJmu_p-KNq?XFJ@<jbB(Xo#PiS9XZVcpyKn)V}W=QU~dFT0x00Rkn#GwnF
z|1Shxuo;k?o)PJzD^y~B`6S@iu*d$KC8KFu^O+9->s41rg14{ekO*LYArG4|UxDBL
z+h@;lz<T6j?Tp438~%wL{{2ZHfIVbi!fspe!Z6<)u%7b4tIu=WVb!&q*b))Z=#-g_
So9h1tc+89~j4Cc%yY(Nf!+&-F

literal 157290
zcmaG|1yod9+Xke2qy(e}2}$YhK?Es5Qo6f4l@<vJr9ncvyVIh(OLBlAgrW04-0yy|
zelN~i!<?D3d%y9#?|u$%l@(=hFv&0x5D;)=pFva*5KzGg2q?VhsK74|B1?-95HNpQ
zN=YfpN=Z>GJK39A+L$6BJbU{g0qv!#CGqQ<6For;RvIJ~N&5g7q-PkJD9Z0~v+l==
zOTMK+AtGlA#Ee2A0<q8vGG!T%hEL&R)k;*HAd(`-yOtYB^@|!{a8;SR4=y-g&+X04
z-F&=hzDc`4_ylpFi?z`tc>S<Khm7KW`!jhtv!C7wNZ1IVM8w42I9bgXFF*(%9IrIa
z9Pq?x&ug!q75m@Zw1xBPQ?DQ*eEyXBEn(kD*-m1TS_%B&-s^`FJ7(~;SWs&qr$RV!
znA0M<dBpxCNRiw$Vm)8UhMU~f83EmdO(Pi*VH#A!b>Km2@z9B|C(5YxS%ec}PpdFZ
zLNsSGiF|i=5?|*%##h<b_YoMm<C84?!;|(CPAv;hb?idIzn_y4Nq%}p-@VRuDHgr%
z|6H-wNH~<P@rR_P1$UwAFx>k+54+CS<!aKH6_(}b^XN)t5E<WqFsYDd>e*bo!}!8B
zDQG2?4Rbwz`G-Ko3d?(xuMt%)deuxCjq&|t=A|y+GBC5EDG4Tj;ptiDRFLBU!PmhD
z=346Vr$KnHOcR*0)Q+&e&>#|c2CB6{e_W51g=Nn$lY9#)^nxmmvEx_K8}-~*tJz0+
zBS9eQ$mIW4Sp38DSc=aFBqpKx+m+1^#`Ofw9Tc}CRniRU`B<z{C6Lh(vGLI=-#mPV
zNP>J1gn#diPPw?~2)1{+N#@IVns_eFjYxtg{6^_rgdtVgRRjpMC+^!Z9x_xd3HVoA
zLAItm2%-$}a%<ffucj0bqH>YM3p2{K22sVUNM85md0<*DB;s%#1fo3pglHj-_aM_A
z&DsDj^^MRk)N5+=pf}I(v0~dFw%?O{AE+)$#e&)^0b)cXZzonpbbBN66M-K)>djLJ
z%+z}c?K}<yb12ag3>%1L?bN3TAvEZnQiNfcn-bsNqnMxxNXh>o!3+R@vS7rJ3+ANe
z$azgH#hiIRpRn+?o7DKwiw$HK+(sl<alA~nd@3(2-#4H{>`?=$sr%`eT!zFCaldy~
zEn)MM41{7WxjG2wpil*n|8)MvbILY{(H0Pj|2m(><qL9!Od>k@TS#n-3nZLHIy{Cm
z2eUvrIfi$YcjPTLbp{7NHc?mmlyNghW+Fc}UfesaaIJR*!1TBc*bMB98=nLw?rCC9
zAXtYUbvl*5ox<Msu>sX$H{rdCZV797x6|R*zU1JNN;GhfB>Z`&=`!)s#IoDZEeF<m
zTpd0;^yu%frJY}*r_Y2**uRr3)h*#I4KCX+dH>2lw?Z}!;G#)<FON^4j^BfhhGC9g
zhu#uom_<Jvupu4s=-@5ZTi9FgxBXwpzfdkek$q<(eL(XymQ%J@b}dJHM0$i^M2Lrn
zN0mpZCdmq1gH+>GLu-{V-Z&;2SJPc<!YdG5OkGC1$58j4Dt7S&BjNLKF}fshUUBwI
z)dAJ?7or8K;}l~8TRumoTOYP?w(7?8t?_wSxHZX~xes`HxTCD+h8_$(veLGy<Y`EL
z&cn>3WU(;$a3sr0z*5?3&7x#nFyB?WNQu16wtyn1f0Au%A=_84DJ5LFKi`Hax-qsf
z!7FA)s%yB|;-NNuNswFOgd+La@Py;|+exiYss+y4d2vxgteX$Lczs2#9$Zmg^*-v7
zEtU<CwWc3eY~<O@-Zjzn*L`DGVVAb6JJ0Tg-9p{M(h}(v>7{hUabA1Qbp(a&jkV>A
zJxSu7_U5#A+Fvz}qatlbtwkM1eTRMgK!@)ECpRZHNBjdjE@69q0|?&%Uk~?;jmx+E
z#YC%ZYZlH08=r|&I;qeOBNMJ3Qj!OO^r-Zi^q6t;^gHxjx$3!&xy<q~`HbY4zC^Q4
zvy^`Ae$@WR{=5`+-ZBn<6NzdAZFJUJ?P@Kb>gr1QavjrYi)r)E)?X`n>Iy5oj1(%4
zs|IRHD_e~Ns|;sMrnk!*EU{)Ar!j4rZSAKz+;-i-O%!evs^zM}d0}}k6&mc7YR#vi
z)00!~0z(wwhwA*?g3akxqCB2k-wJG1+k_eg%!GDbeYSIU2-mAS3#K<qs!F&98%EBe
zu)fkwnI=7t>m}C^(s%<?oJ6yGS+{9dG^ah^+TdOPeBOHgLZnYbMWohy&U_^CMPE%{
zZ@T6n!k}q-p0JpAgLijJl;_ow?OxiN?@*I{@;G-#b<1d@ue@))Xp^s?FKKH*tJs;_
zdD5xlRpDj&Mamic>g4RC(nd3>SgLpuF$!_y_4(^)8}{S-ZqKRjKe(^?aEdaAf{^4T
z=#XWKo1eCx-s8y^R+AUco-^`t3%eL^_(su$elJ+Z4)F|P#c0A;#Er%%L-(gNB&UhA
zNXJ#eOKG({k0T}K`ocv<EAfcINp*FUu_%8oKaR_hE89$czz4KL*uvk)8bZd!w{FlE
zI`w+$s3Ll$c!kihWS?yR@&5Qe6#)`~9DyJ~9zC0E^T(WwM{-tj-x$6#>^-MUCgQg4
zElww_i_ePpt|~EOPxLj7x=!5|$b(w-tqq8zhbt&N6G=S(K;B)ljQiPfq&5%dV5+&K
zS;NQw+RU%5T}GK{L*Yc0U16{HSNBx>F#93FM+`KG&5Pg-1v88F(!OY|7_Ez{_-Tx3
zSAn3^u~Y&hTgQ*5ox<6kSnICOwjW8y4(OE4u{H#bIBbfNK1yM=jvXD6*lg_7-Ve-T
z9^@<I+#9_-J^M~#!HUmb-#X;BlpNf0)^R4r-pR7eYNcya>2bDPN>@zRlpy(h^kXd>
z*DLk<;ymh{pY2W~2gPe`r4BkT8ketnf<E*IhXkVp&x-|JDy!z`Jz{Na>+v2h9Zww3
z8sD+jnXq{UZ%NemsrgcoQ@je(UYIEo6TH&A&UVs0Z#+KQg}K|c+v3~T*A3gRyiq9`
zxg6P580F)!F|%P?xb*9tW7X)<>2<TEvsJU%VToq6pD}B-?W!#!>I`rCfcU|67N@ps
z`q~lA|9eT=wUD(t=`Pds(Hg_B5}sS=wq1T@G1F||Y+N1m>%wV^tr(Yo=|WyxnaN_^
z)$&yuS{9y8{&9Y(sD*=rFOE)j{-#*G)5iKzdzV7ZaZM9!!<9~^9rQIOK}I!tL5SF|
z_=q3wvBOT>W>c0oLBc1FgGG)?9vqpbAge&Z(5YC>>&-Wr;lkf=6W?9XGb)%jnL(5G
zSU6ia#osModW6$~ZAHf&HaGDdN-((C@B}V-@%7ic1a=gC!NqS@Lf+HRg92tf4MiPO
zJ=^AWzmlcK*`ss)dA|~ScYFK#CCBW|TxkD#lqH3^-PydLyU?%W&qAp}le+`;vySY$
z3xOApPlTv`Q5}l(`JJx6Sjb-bj-phq6rN!v%Ia<Qt9XkqWpPVzUP#Fu#ZA|r5`O8(
zS9USJSGm}BOxXIVnGwdbTe9oCD>P0u=MP^iP7o=3R2G63ew}#~y;D}Ae{&FeLp6y;
zfabmMY>{!X)Hm<M?#6raq(th4)S&39&x32tOWD2AH-mkHw)*#54{--?!f&*%``2H=
zPk!ww#S6%N4q{%5ib6tf{CVhtu&^rwU3r9%zkw~0%)_f6jmdqi@I>yX*!~o@DAO*&
zSeBIuw^1E}1G4T%6a<UYdrvrtzn<Tl`YK&>O;_nc0<F+AacTVGr^2*IiuBqZ^=Hb<
zf`<#4Fa2iU5ntfH{y10B;0K8qvX9Vm64&%Sz=+gCxTZJey2<dmY(k|ast;&``6Ep<
zP|423Tsi=dH{4WH)=WVGfeE-qM?gj-LqGwp5P`QSBKd!=pCU3M-23ZyBm{&|O9bS<
z%P0b$x3BlW`?k)%KJUebAfN%??gMX+Pe}hRjSBvB@88!byudvK2~{asS>RLE*vZt?
z&e_7=rQ0%c5%>Ya;hB~*0s=AJ?Hf^6<<T#o{VB_rnl73O@`A?pwrqwb_C}^`9=5l0
zKtK@o5Ckr5O<fGBJ#204oCQ5Zz<-qx1g>v?W(QOMRm8<w1gxo`Of6;aWJ=A$#?AHw
zEQ(1@O)czXVkW2pdHQ#C;F}28!o|fwke%J#-JQ*yi_PB2oSj2JK!E)TCp#x6D^P;f
z+0)L&(1X>^nf70e{JR~9sk5<@rGty5y&d&!yM{*gt}Y^A@NGx`dHrjgrXH66?a9vh
z?`Z)OWWT+`&cXJC{XcC3RfTVV6;!tLFtyQySlR+>2J|7y!Nd1N_^%4T-TH5r|Ej9y
zZ0aOsZwu6P5&iF~|6TciZ~p&^fAy*LKYem>asO|h|8wi_s>1BIbN`>U_}4=J^((N_
zqL{+$|JgNB%=HlBC%{HNw1g<V1U>;VyL}<00Dl<&^$A=f(u*A}uB{*-h$F~CBwl(T
zZqK865Sli9+h;J6lJHVU0E5x9@(CY<r^=~`2_?i(KIgxlLiwzP0Ae8|mwbYP#7oG`
zM4gp|&XoU&v84$8J7#y1c_&L%6<1S=2_HtvO)71Zkgp$C%3kAw_u|RhULJZwNd!b>
zeDOQ}fEk~-ZEF_1sw@2hf<Tl%=+eAKKtiYf$3L%ES66@J$i_XQp?O0c07d*$v&^3Y
zITVsOrLD#brSU;p+Q%VxHj98XLu)iw?}*+1CHo)y{k!HcXk)Rh?PZB}BqeBg$+YZ_
zQ39po^$>SJj<AwCxf&~E(C3rKKYKuTEdYL4R{N-um_o%C<9Vg^-3ujG@|w6Po!c^Y
ztW-B8Gf8eowLO^j&f(%qzj;f*a32C0PSCx(l(H2{wagb)B@w!}Z{Hq<G1e#{l0@CP
zPU3_>X^5mGk_3b>a+>F^T|z+mtRn6WdBUw)(0ruBeRr{8k{{jOG3M!>Pj5FVI&8z)
z8Tk+M&$wMC*8Tnc`*qtXH4UHl4jPQ^E{-4evHgV%#bc^wxSU=jdO(;3N0t8F#pUwE
zlQ=`WJI|cqUXbGRU9>8hAmXU<Tpi<W`ZTA=8)o-yjtLvRyLVCi6Cvi8uV2q}YmT(^
zclPjvwx7VArz=fOzeSM7CMGgETKnl(o8WuW1ht+oP@&WIB#2GeLw)X)3UP!tQzYd`
zsL&5H(AhwA92%FA$u2xGom{1ibP~vArClH?M3W}ysE`?Uf%*NzXr27s;z*63jdbkL
z0lS|Do03AmxZpJH3A;Yot{Rl<Pv)Vs>-yH;nwgYJ6GRz7-T5x{?CyrXw7%wgJ;Yp#
zhBq)cLn{dnnXWQ_?&MVY#de`mO)Q10pYI#-@nkqr4@@-iPL0PGr~ZaACy91JCzLQN
zCe($21GbthWp#X2XE)g2Eux%yE>4{(H2y^Lrs(B9{{@Ff^qmq3h?;ymCBJ6EZmRis
z*wEU!C^Pf(*x1-dcD)m}Xdz}jvtyXl#d;uQ5b@(bsO#;t3>@?-W}U3lTetj^IV|vF
z5)&;B!=`GbnnV*XI2IDIjsgdI0BL3Vz$_TuVScwD;WL^dsZSZS*+7Mv!-iZrIXN%?
z+PxkaD27CG<DyWFDG7dt_6O4?7y8#|YD65$KMK_Cqkv}Jw>b|&n$z(;%LM#d!02EW
z$v+4pV++#2r;b>MfjY_X1U)a=<&_mWyV>J3G%Lsh!ypdAxZ{W)SdR|8WL_3&PtTD2
zVOgk^F_BZ30%qxiCM%H8bu|_T6FF$hG>@Xv+LA@U)s#Vs>U-!{#e3E-%d7^VRDW8N
zd8C0~9i>Y;xguZ{6_rPdf#}RG<&x+Z%o0IqF(-c(xR<{gjmnN({Is>T^(w52WP(I|
z$``D~UsOHiDZApL`qN5gzScm<By5zwfdkTEG~U>bNp+}p54|V>Qj$FG%0Y0qZ9<Rd
zd}Ht?Fs`$;)C`A|lvJh3ZKwG!B{|aS3Y)31;y?NNCn*qb-#+{K?UR6%msjJ(ko@ri
z{<&zYn?jxM6TCkUxCI(Gxdszd&6STiJ@vSu1P$Oz5?}?Ovp-$G+m7SELRt#K&MehD
z$@J{n7|w==n9Vf6_-O5ae7L$ex!8hiU<xYf6D(T?&oK1<(S~91-^1>I;9`**6omYC
zl)95rQWG(V=qWxVewiWkxy&6-9ACU$s-0AHN@Fylg9Ku;Ske1~(n;4_YQrZ0U5H}u
z?j9L+kvfn<4epQTDJ86~n%t0q1{Uy>H6PKB;nq@p`~ws~K=MOMX75YnkOJfh&@kOk
zH(DZ((7~5;r+4~9;D#Z(1v};rC?-CBl?pOtEv@+mSp?jPZ%XtB;r&H0L<ush*rE{f
z=MfZNO%|ak{?&1wS|r6q_wB;=2ihO1inlAY>nVX*Srq^+#5)cf!tbPnSnQ!2N6-hL
z^U1E?JwfFjl<myGI7uPl=F{bOXx0#ZDRdZ@L{MDR;2*T5R=oT*jhIF$4>&e1j?NBR
zx)=dUy!4hj6(xtq#oj-t(w~sNa|;pPsIYw!0dt2vlb1iFO77Mmm$ZKRK#FVAJRnTv
zy4v9neqmKrTu3-4FVA~2Y>22@xu%t#fnnYGr1)+u0a$KbgPCf}r{<xL03mOsNs36v
z2cXgwXzBb;aS50D<Q=V-<w{1c^pJh6H-UNR@%D6;#`!VTqqW`-aous>NGzy==br_l
zS3Ug#SgCU>NTLW0cThP_KO{P=Q>9AeZiQdMvcRt}>sL}~^P5Ks2C1W0cpXKLY{%1c
znjQrG!lTUO;jw@A{CO`7RN>Witg~}fzF3SwV}_n70a<|RSk6$>Nrsy8-Mu%|_;TWb
zL84cv#EcQ;q4-Bz<1vrp=n3mJr1Rm}H9FpqoSd9zb9k^iOA_=p>P}Gzfdqt6?&BYH
zUh7Rj5Qy$^&=4*jpgv*`Aeu+i5oexVoD_^NOPB%Zcf4e1fA@fbXy0c%$$AuwKT%_e
z52B*Vn4|@SQ_~e(tPz0zE<)pOu?|<KP6cX);3snc3V7=g@L;uM6jV-h>>ls$l}$h&
zX3IdVh6|mz?`{MC7X~sGt(*~hCPQh`t&s#!?d%4~5DV<&RILM9@b~OMmI&HYgrnYR
zF5ej4cfg`Oe0jV5MH)AZUv(2_y0f$bkHenH$sOQ=kM|bsZSr`)8=xiRRj#{tUYhkM
zHtpdl9Y@d*e1!T|S??1N1fqc&8U&nr-hPMi{s~zr_aPlWkyQGea}-qW!5x+;=vp{d
zti`2?Uoj}p0(ffPKY40BL~jLjk+}0CSkLO)mCrtBPG7x^*ktUdD?i)J)enn=4H+g?
z^99ipBZJty`tA;+K82xd(*zv{4O#XlXUN$+7|xQ$ny$7~HNel5E-aB8M+Qk>5<2qV
zy&F2nsWe~WWeNIf&JW2ojk*8{1haeGIuE#)1U{sG&eZG=rV1O$jwXnQFpiD6z%U3E
zl)`5}0DzrIEb!zuhGFo1LGHL#`-vxI-ZC6hPS5Thgj|hyIeurrW1tcJ=&<Hwd`W!6
zd7eM5pV=D+Npu+DbE5}K%<5NH?5~{u8m=baAEj57T8t*hHJ$Ep#L!%(D{P|Dapmb-
z+OTpv&>yf6VVk%F&{y$uxd$;RDa=5?IGU?)|73nJC33LA=(6oau~*xE;ogy$6-1LS
z>QBlecWc8cZ!Jxk9z_zTWq@XIL6=CYNCbb4mTHo)rB8jzQx_5a+mI!!v6AcV^}?k4
zBoU;Df<aS!@0B6s%xTS}XBA^&8|*!vnWSA~Mbs!0bo`$GD5p`{&FCTeooa-LjO&X?
z;VFA-G=nsv!%|bPvfiRde983hYCyWX_iz<zlW26^jzW+G{)_m!5aYWA1fLuUkq6Lg
zr+!L&b@a@6`VA0>oG+#5?%3xOBT6yltss5mx3-`U2+L|ld5CrA4Bku;JM4fmzZTRm
z1mX4qmVU|)p<eLrp=Z&3B9-d>$Z85~A(}U2dojZp_bUV+#OikZ?#@s{d=rGeaXVKp
zJ5i1ByNhw7RF4Ltf?CNy*GDwCxcxa&JZTg8dfbD-zIWU5*W%cir$F4P-6R``;jBqt
zVq{B|{FWMwx+k0vba!9zDBRW-^Nlq&Q{@uNsS-gUAn*(`SOXoL<-;)b2Vcj*_(|*5
z=6?D99f|@1^b-}Yv7HjKJzJ-g%vVYkh^(XX0?X%U-093?|NdkbJssT-IuiZW#%<-q
z23HtwcluQ&tYD&4O|{W&XSp#V=?*6&&VnVM!m9wpW6eMa^r%_}Spvc$hAQoDJ18Qi
z7J@^y=GAW2uNc!%*6*n6#@ILZ{xke*LPI)`4Nx=rs_|SmfrH?VO%F3g#JR;d7+|9_
z`h*;7+Av00_dsWfPlp&Ry62yv(tLJ4u@8L@htqqt{s|Ah_eb2>e*f{~`aCU|kFU&v
zM+AHj-AlZSgbdnc>yt)!vw^iS6o?_~DvVd{F&qj^VY?v}<)7w>a*GZhKYqL`0t9B5
zAwB8~KpP9ZED}H)nD`LLWJ1e7?7JP(3_X|cxl0+fQJYr1wnmmr5IGeb6D*GZ0-vWA
zsQU~Zs4E%c`wxk*Gm;@{u&C%l$?bYx3rvIK5df$_13(4wYGh#V>3aSC0YTX#mVh{n
zzhRdd0q$VIh2?QRP)lNM3KtO>lNsn%Q=;}C(ES1XCke>Eyz_-YG<sS=B#(dqGU$xK
z^qn%&84kGCevysKyx(!&cDB~MyE~FRsrNAH>Tq;$wJVyqr|}48x)KuU)W`At0iHXn
z<-#R*!)oli9G?cK(hCe8c!K^!cim!Xd|BI>`p2?U?c=MHj4`py)-eH5HMZ6b$$}Tz
zAr0@!TD95I*jxKt-PMZJV~F%wU3J$}3nnX_)|j-)9bzs|N42M0ZJV~wk2DI@YYM+G
ze0jd3U6bQlL_AVF{dhp(p6Fl_JltlXlE<KRz+x;vv)X=g!Zm4NuG#ZlpXZs{;984a
zvtG|fR#=0u7}jC3zh=u*VzSBR8ISo^<IwGyhTi5-KqBLkd90uH5}V6mt+W|Oi_nWT
z9lvrPOc$yA;-Prh#v1Z&<{CaI7W+Ptx?5H@)}%SzOqd-f;(~nl@EbXN)qI82QBj7<
zHU4ndH_-mrzU_*>td)1Nc>r)g-Be9CPcqV0;~zDwF2BpMjEnPyd9@6iZ?AlPu0x_f
zzauvcmCy6Pxzbqhx}Z4QDk3^~=U7ZJ>;7!5=R^NqmjE=?cJ9Q@>2%3d=Y+t@>`}&`
z!T0bnt_trHJK2;NLrS?50k1ye^iZ{~)z!eSg-U{(5P>FNp~0gPlo-F#Yp&~W8;d<x
z7tX~}r+Uol{EA+O8+LvRmOe6O&GBrDK2<7y*JmV;HCj{mA2RfeDk=Ob86^MRynd=j
zsaAOE4S7VmWA9irVb{~&J&X`QomFoy&q5{ECK1G&d%QJ2`C)azdpGvg`3bO<{<ML6
z^{-klcD*N$ij(*j$DZ#tov>vi9y?g84{6xyG+(6C9L&I+155cF+DkYse%d}Y{>c}N
z2|jG%vtO7!_(f~n_k?akA~HBK5<l0yj64S(4DEgKG`nurW$#Lgj+J%ZHYT3gz1U~}
zj6tQ<$8&Nm5OtBR%B<f_SG`DGL95!pFEbGRik5q?#C>&m*w}PuCPO!RE!8t_xV~(i
zi0P#R+recsVDmhe3-Ux*Q_0=7rzFmgTC^1TB;P8lUQ`W!7`L9NFRgXFQZh3>NUT^f
zS<ZP}3e)5|@{1zlkXIBcN#bGt={oi6h1osVb|m9()@6OXb>qJ*zWfM<kQcPj<FEiz
zwrkkx>1|QRNTiB{a{Z+K7V%7s;9ca;^&UG<oD;k6SiEJupGnYc$D${kKcAF#KknC6
z+VP-87~flfIWN9%y|Q!GH6IPBDTOD!{oPv-hQ6*n$@%<Q*2u_64?nZ5bu8(eN(3Cf
z^6|?x2Q3AJTcDxBr72ft$^q)O#TdsRvN`Qwzw^vne9p!BrW^@ze*K_SH|KlJ{8}vA
zE>6?TFY;oUFMDk_Y%TU%3>hqEV}ilu`YC*3YPoHv&DLGbycV^BMQPjf7yhLeO~${(
zxgd^gW6ID}MG}7V3sJF?ZIgzdm(IQ!SO-tb&T>WTek^~@SoL<sd2y(*NHMsH@APUX
zc<AOMBF&`pt4!Tl-h*wfxPaqMbYjS5z1L^Q?KcMlO?wSH3$6>r#V(enhaQe8k|?0_
zOXQ2MZO$3$iO|%&%ZDY<(H;I6Kl&^p2n61MNdyrVwt@_`c_V`c7~cIJLMx{t83JuE
zYhIOkuKWsRdOYwB^JFS7V_I}h?fI%#hX1+YTj4Tg2BL22<=hmz_=pIW!KZFz&cj1L
z-(svZ6Q^{s>rS1i46f;64T$aOIP*WOTk8lwr|>I;5ov_Z)3)2*oLiqCl8)xceds}a
zm*H(!h)vGHWYEg90$bBZwwZ*Vlbc@qoS4gpKI=*UU}&rNX%aB0-D?_ps`=Iv_u9Bu
zzJBU@uHd;YKq{~mgOrwC6Qj3xXgQeD1<`_UmjQj@cu|rk+!#8ox82mjekpeZgauGq
z&lzWbo>kMBV(;Gbt<F$_84P>TX94Fd7Y&%ikPUnz(+I<wiPEE82?)NSh*~rF|NBaD
zSx};=ua{nQ*axxAA^A5VV3&pKtBbY6I3>o%(1$T_>aZ|$<5u_k-PGVkv^v}JpIs+8
zcJqR@0%(hR6Gu#E+wfmo0uSeyPMZuQzOdHe#%t*Lik#whYHGLXiFoeKdm<X&Shu`(
z+Y$0S-rbmm(vv#fh_urBoKHhXjt=Zv2M74}$iMUNe?c9XK0BW)yLtUyN-wynE1JZQ
zx}e}OVi8~#@kTON&Jf{PoY`tcA7jmeKr&RmF74~U3cUW%l{$P>`FyRLff7$sNE07a
z?v%*ol31c7rnMnpqIJ6@+}TI+5Wz6Ua43@|zM&_IH(eNdZWrfo_Kgu2fE>5U)F|pK
z{!=VJc`pdzoMPQrR&{iwFSh{$pb>9$PTKT<fe3X0so$*b1o9S|00lwpVZbl;s%Mi(
zl<P~tMCnDZf^@71*WDENTEz5AZ}jb<HjCyZM431vGYW-pY27|On%3Z2zMH1jya+OZ
zK3;|!d$BW<w>pk$9pARyg=RiHO$*##`F6@W0vmclmnts17s-1Wl1%Am5u`H-pLsnF
zZ19GJ=-DZ4wu4jb;{NSdMDD|(UtI!3<8ab`b8xH#<b{aFtt!O)t_lwMKqkbHxab%Y
z48)$t;h$t6-HiZdxIW1?AKZ0XC(TQ#p;9lsRHUT33A(|IQktp1>2hB@?Vqo+Z>!!L
zdTe3bX2<99!*^tk(a5Kd!*mTsw3sNh=Rw3=i~E!KFO(_h);Lr(RAI+ucxmh>g=afm
zskYmC;x}j*SN(oRhN_v_v?sm-cgMS>(OXHY{+IEh`9%t)NMmm{UNm>;#{(wZ(#ckn
zeaQlyhFITGpO#5$yTzrsPv6Yz>=^<hX(GwUTG$Tv1_OfMMPx0Vpy6PB^r;k&jWFVy
z$U#Z5CwFK%;`pgnX4<ow*KeL{GhGQpfb_#lZhEO7iOWlQXv?7OS+6M>mXJYS`gW&_
zuImDJixpCOyaVhnMc!8!Q^r`Aw)O}%pOGozXHHH)*B3_0m);(nEc*9mNx!4xvi`W}
zmr6Ak&Pg&3*Lpb^q*sNCfg!sqlIe1`EKMaRCs*0(nijs*(4&MuoGIlEZ*rP*{QmaZ
z_jErm;}O^Vg@9Yj6SLnm5drB1F@XE%=)N||KrAu9a$a4n&Wr`Ieyw_gw%j3R$rm#Z
zEhn}K+oY}!dIhT-T*~zut?@G>YbSDWYCACXt)Dy*5>nk7FR`{YYQ5h7PUU1=CMrSx
zaXug{VT7w6)vYa!;`9@=#$#9}YgT~4R({8GKJuU=luCdkDMR1GFFe)VF7LHzW=Q;*
z!L`sxkvrAk`=6OFy4KENo$T0@4oKf367+hW1jN(W0jO$5b!}LN64PRPvD`5`)fl^K
zRn28~fnc@m<~nXv(SDOuCx0__yZCix!`M+~s7&wb<3X?V3}V5y)2so%UMUoicAUv!
zHr^QyEN7{d_=BI<GGUwVwAh^2bNvSBuFy`^qnG%ZUCyRvIkLbJ)@3c$_-G!0o7VdI
z^p0k8^V0{jJm`zDnB{@cbWn|7B4{Gmb1r``^9{j2r2LgfP;wPgh?}1RaJsub7>EE)
z3^(3;_v`yNv8H_xd4)RfmoN)<POqZ=b&8>c%F1#HIHc81tO4iw#d93;9O>TL(q5O`
zSNOx(P@Hr_$#Ub(>qC-D^J@O*i>UH^3l1$253a@AebP8gHp)M>ox9KfNGxdExEVrc
z!WFx8C{yc9rrJ*C0kS`vd45apee=lhBfJ<L_*r$KAFq7@v~;k0RB5W;EuG*}W50Ex
z7y5C8CU=g$ByYIByCD5d=tOwphojiVT)+pk?7buIBe|++bjDO`TFH9H7XLUd{a}{m
zCH@j|kCxB_kBhX}G?DM;8z+Uw1C){-yJ~-7#kXTzhPpO}K%DJU3b@j(%3s+hpP%B~
zw0Acu{zLxdO)UKrAd=W41DzM?!rC;ck_&Q9o=}H5+-wzJnkBs~)*N<Sx&;UfJa+4i
z^5$lP@(CYVU!8t*Z#(unv*?fn)S28?dE)6o7arcjgCE*^>#cP^$nE>8M9*6U0XXLB
z+Oxla^3z|ts%MYn&`(I{*HUpUg^oA-hBB+=sGh?t#BJwXO}o|(Ha)c47{kHEY#fs6
zs?J>Y)vzDWwLcJbf!_Ur6sM<x*j2T9_3(`CmL+!o=PuADx8n$*=PBqW8FXx`?tAg!
zWxjHUXz$*Y@d|xdh>BetTy#qia2qN1TXcBXErYfi>&+lqs*mRBz6-8rq<MS^3DCa7
zSHvt~LrBZo&*rQ#)fiTx8LbJl(ZVBh!ecGrV{p<f{unQMmbgwJ>2{_AK-CaDa;6r$
z%M4eo-`y($5}md<SIFU^OMz}vEpSc*q({n-L0`SuF~CSy^JKwk)@cq##)D5!w6r!y
z3dcLB!J2`UQF~%eUjhf_FMR#ZK1{Ao%%Yz4SBdfuy3U^;jZ~@$Sv$5DT`voat@6mf
za8il&sXV0}?9cFDlJ<0%dN#N=fO3oTRP{Z+2?#A_OqOt!Hn<86?&$dn%;vW^7D5jk
zNU+I#68e&PW?fxN#5ibe3t^nrX8HQ9Hvs;!(8aLEJf4f-3K`gR8z-75L@etFp;N))
zsZhEFJV;vr9@;LtXt^;wA_E#6T;eIY+83(&7S6_A2(8Lb$ABec5kLsnoQasiJXVep
z*5Xx@wG+NF|DK;!&iXr^Amh<nN&Q-QvbShXd|cfLB*vCo5|BY}t_7c-&%*WabPQ6m
zBd=!iw|E5t!|3z4Pl}oGZO|F57c=~h8(dnNQ;vrB#z`S8`ujCH07z?d1)mwt4_XU*
z+i#Q&&DO#;HkXB?l~H`sVBWsCuKgLTT8}U=_VrRiMcSZ8d|t%x+Hfbd+3EHES2<^-
z3oT+U&r$_lqfU0fn)sQSp&?Xyqt<1EAN;P+>e&YD@rT>=sT%h5_A-A+>L!SUp}Usp
zDDhKql|Z@19KlEOntAGp)LD!fMamM8@^piVnuC8xCdEH`(;dgqgx3$je-UdJhb{s6
zc@^e@56bW;cbxXD&P#vDp5WT>MPPQX3YTImcV55`UW_+DZPd{z?WAx5EB*@dzp|P(
zS837a8N3<*qTe}QhjOTswZw^aV|U^(-YY7sBeJbzf31tahmK!B!Ga-n#YZ&N8iBJp
zQevA9Vja1@7ss+rR=$I3sa-F>8sUSs^gNe?8rr=?r6?Fw27_F+gE7G22e-i5r_Cxj
zo?U;Tk>#IE#eLRKX%v*++Z-pEN$6m?i5A*0^k%9UTyOx+N>1ed3?r4z`SI)rr`<D>
zhSFthu&DlduuH?X+@vclhx0Va^8n(?mW%X@wa<rr??Vgq%hH=qc2k1cR7%h=UHdbw
z_=1F|?=kC4?`Uf^pAt-t??{*EYCJL9oo><~OZBLnG|JX=J(cpJC=>xp&NC~eJ|WQ@
zG|yjwY$cT|7CixAkSG9yCMZ^je#<i%Nr=yynDr+U@pG##ILKd+CKn*jn+Alnr+_x8
zmq&U_-+zAIhAsS_!~Ey#S8D@8b1*SYa%5)IZEP^F?TpQ#lclXK*)Ojp6evm`miyB+
zCN-1QUueSKBtc}j-#s6eL}v1EVhRN}uAl9-(BY7Iko>|uIqi`ASel^Aq$IlUF{FzE
zo6aJ)lCWUKwpFN@q6Pntc`5c*`%8$J1JGen`@aiN1@$M-uD&ELy6${im<DYCHTY2Z
z*?<A{2;LWHhTlfrbLf6*@0B`R2UWVaU!g^ZZe4*^m8!|Eweux$%hB<zd)IICoCtk}
z2D)e8rdnBb6>U#ZWc(eM({{^wLS}L@k3lg;hLU2Xv5)i?&@Dc=&P#_i3OaW+QmvJD
z;lg$FhEOg}_7dJjX1?Q&_%UdL^EocVHWe1qxDL%oVS#2qb>+`8{I5YJT}!-bg)e0l
zd96Y={x;7i7oQLVP%%1k4c^4sove+}sZ^QaEV3DK+$t0J$R|WlF$b_CW<>O1j6KkB
z>dr>v-%YD{F}jI~32+kB(?KmMg>GBi-TinTkOH1dp#+)pHx8&c11kc+)#>nzzAP^I
zo05kLB{^RQd?ev7tk|<_7ss2QK7GIfaCnMljT})yjVk4mGgR!C;wq}D5j9|;{#2e<
zc2wKCLsKvd4L#3>2rB48{a#Jv?4`lvT&{w3x4e?`Y+vdLfT3ig)A{Pz+8Sp+9868g
z^qZCq`bwQ2!%OdFq73kSIY_pv-#7Dw&Y$RzG|hk4#0DQO2hJBg6V2#|A}BELY)tx>
zvVp_OcOU$IMuCrolq_IkYD&73Rsdl7kSk@Jn}M|$Kk5T-(HK#`>SK-Az%T*!Hl{k9
z`g!<B8O*ap_;Lt+axF7ltcl0qWYfK<FYO{1cHOAsRUv#8@6K2WB#s)!`6sWQBB&Io
zNEc{UWZino(>?wbUzCP}@ZNjJMY9_Y%HAi}`t6))nUj1XJ9Lw#g76v*vtG+Q9=HzW
zK!C(kbk1IMspj0ei1+PV(?4~fxhWUjDewii0ba3af1ilGWdAeMv}(bk7MPbHmuCKb
zt6ApK4JHCgDp=i~CJs1!>x?BFn7v_UK$!bNGIJzZnn}s-3E9?k*s8NM{*uh#??>-p
zhyd{}CN)(aKV~t+9|(a(uIL29rhrTzw^+8?5EcxGFdJ@Ko9Nis2I>}y%KATC*J1zi
zb@N^!h6FK<UDOZXTVl#)2yh-*Ah~JEth2yFtSk5%SmJ0Nwg=L#1{aJXt-~Ukv&P^i
zKoUoIa@a6(A)RlMQAhWiE7ejTw))VkI*q*QP1VmpLe#fu^xFzl-(%SM8N06IlFZ)o
zG{Nr|wZluzE}HCRn^7J2Oozm8^a#lL>|&YAw%A}3WhXQ8W`jNNiCG5@Ur`p_hH4qo
zfZyO_72W^oY}8++chodrw%0%L{q<y)S1CFeX(Q>)Z&{zv^4GO{meJ^KWFYMRmz;a~
zT&E7G40Q0~dxM3K&_G_bCktXPM@B~ODb4XROfwdaG`c=_9_aZ{)LB>u1Zf+%Y%s46
zKF4P&vkO;?R{cTNr44dh6D73XC)*!B>-#*mZ-bYz=$uyEgx4x5DL!D(ZE~yV2Wi!8
z32l1p2K&Lcsq~Wfvw%#iy5H3ipXG32q<Ps}87j)hB3>?a_Q`uE8t!|fhnKFQ3FJ`!
zp2rIPhRf@uE!3h~2L({ao)1Fmt@=kb`uvAqNqSdf+1}7Z`7%%lRwq==*2Qg&7xf;j
zF`KLx+YF-`lyw&+$Q7f4wv=BEn!gYxnDE8nC5$i4mRRUkAbUqV;%C!GyAC(Bef4sX
zNFs=C;CG<$CHyri2m=Gd6W}zxFUci1&uDoXG$58O8>rb}1{cJw3AvKm@oAy_7)uE$
zUM!c;uC{@>o};Ai5kXiq>z|cw`suzofz2tCuO+Zw=-lR!U*#-9*>ua|0S|H5U)5$g
zSsR(t#@){c`)X;)X|nO;7XQxQFi^3-XHsLDHHX5kmcKq<?Xe5S;@U=gXw6Nm?|h_o
zthIij9Jzr=9+X(I{f<s0`&$Qid}6EOA%yTNydVk?iH(XzeeV{ZYJ<#H903LIeSu96
zMYOh~@Z|<@*e_b>z26|!!)2ry(WLZrzw*CgotA6>M4ddv!nIynGEgno7aQ!6OHeP-
zMz--g5jp97zL^B%GPrJY8SG26(NQ1X#^n;4owV9!Bwbd!?E1Xft7^sIaT&WjS%^i&
zQT$~KU-ZA}o`$9}SWjMWr<nU^0}E;nG0ZJsS4_yn!)EVe>$7EVI0Ywh?_*3}Ss0h1
zKGB<8YK-~bXNZRzv(RGapi9;Z$h&X`u@$hBUd75a2F37U4T{$1q5G9e()&6f$kbQQ
z-|2uA)bEp$fHRoK0EKl^iUI^d_L~P1f0sZ$p3`86B0V_g-rytqC}Md^mkZs}cP#<v
z)@uwI$&A_GBdSD+H`K^iYYZ1ecL30!O&*+5V>oJifJwAIc%$s4=bt@Gzb;%NktsDr
zXy$d?Kw@$l7K+)7MFEDT)j{RX4%S3YDr{$YH=U-{faH#cosYpARD7x3w#h2qrz~io
zj|$c4O4c_M*1&`=j(6gYDF$$uKUt0D)|lkxY2`t^Bad%wS@t^4Z@cy7_3P^?wZFJ5
zbz*jXHCs{}NFiq7yA%t?5hra9!$!to@1y%GZfZI_j<%@!11HM#HF^@58P<9d;@oUs
zJx{69mJN-%#_6LI;ol!&-jw3ff|e`>%gBfkyD0@%Te2s9jeSKLd2OefPc2zDtoMLc
zMr2znqr<jMP>Fms6o(v~CYVl8-qRHwf#HRt&w3$Ws8K{*o;HBa8x$FWU)IJe(-Z%A
zrO~#Y%Y4vJi;@DK2;@?D<`nvl?3!va4q=nuFVll&l*uE<4UbbbBulpHbV4)9M7I%d
z0|!5N8kL+BkU)7D2_3a8$auG$Gz2Yyt<860=1<&IemfF~UcX(LW0QYi%;Bmb+FJJy
z3=9;3mWUu54hoH69x&KBrA?<+C*9w#al_g$SBfVr@q@^0)uj0Cq0MnIw%EtI1wR=t
z;He?L!SkW!vx0-I-sxK~gC(TDr6sQ&>N=uF)RBuPdiktc^I(o|!377sI{(17?wC(1
zj6%p=Zd6s#eO?#HCfMb-a8y62nXvp-xM@HkUe;!xk+PbKYu>~ge|<EmuTpm{JF$gW
zcCz4{FgMbs)b3;b4X<eO$MiS$?=890(@7)CeO%4Np(6f^tyi3TC3UOadGy`xi@tje
zX{h%E^={JK7wkgV)0w?kH0%6YgyDT~PQbxN^BkCEco^Ml0CFS;Z7^@-9b3blN1FIc
zJeLVIC8GKwUX6HXE_QiQoJYat#cKVNhFvmmLp<$9f6k))*a<|fXXS+MEVR5L;}!hs
z+AvdkY1Uv~hG(4(;EV~;c|BkQrmD=NbIeV;Z?iGS4@Tbam3WrP24fP<DUPO+L_(RS
zT1Em(foM)(D?eL!@a;dGhl<M*{P^+XJwW9H7!{{a3Qy=&5QAJ}L#^-)({3`43vsf0
z6UyGFHM#Ww@bPht)kOT4FOXr>ISYmJq8-*(wLd0oXV-w#!AIYV>o|aAN#1SPJXWa2
zMNba)2mA;?YKgO%Y1X>FgtHGXXt_oy@nBBpAlqUO42leS1839f(-sfSfg{KJ?o)<l
z_k7mmK70nU(YdyM#~Rv`tUv(Dn2uq4x@aJbH4ESm#qmOoxS&%HAdjdrRhIx|vSCt(
z{C|Gj8x=-?XQ6cqqP--(oMI3F89p}%RasG!t{tJu4%M*lpGX?u$De4~OifLPX(eBz
ziC{|-g}SjtuSR0H>*w)WGZ{aP<_?K|OtMQ~9QvCJ|MzLLcnqdRblBL~OCW^eE-1fd
zw&ek*N=W5@%6hh!yknp}<#q67KM2H2u<#E_!+$jrkBvy-C&I-QM=fbDlmCfk>|nY1
z^9+~KLC*eHPt1qpzePX)A#ZB{N$>mj?*ohtCJXeMIkh@;bGN3#qB+rxk6>YN=-r$o
z>iXAFjoi-b@_R<(6Xo*f+A|?$n2OMr!(P+g&-QH+3(OuYZy`gOE#PW*<bTM@{re<>
zPC^_WyuEGnHaa>_CWs52aRX-rU$QIgQgL8K$ogeal~{-crp#N{|BU$mC+@@L#H}F!
zJZ?A%n`-mV*uYdTL-&FNwX&k@;ADD7LGUv#GBtvjp4`b_iAP3czNM65ZUgj>n44E)
zd3)ko$K&Cb_7*mv0_v>k#|pR18x%n_-ajlyEI<q3RWQdlcttodE8=}D7aBzpTvIwL
zH?TrtVnJ`+2475J1~`pXqW_c-_?reGUV&j^W`-#O#`ZJEf4?Yn@GZr@H!LO_-jrnT
z3*842E5c6>?KXXuJX?ML#GG5c52TWThiCvovxK;x{f{(voEQ`=5~w@Z;yExL`Y?;x
z+z$~HTs?L63;)1C_**iSb&$v)j~Ey(&_JFjg(s@Tf>iFGpB&K~K8e8w=M%(4lYcM#
zw-Em(-7koMA@J~gpa#Fh$G7s#Z(5xb9Xrqbhz8?$(dMV?`FN*6xyeA_H?R1g;k+QZ
zwKRbF2tYSi{%Ny;S0g-@=43}@b*0>!28HT~jeK|B&G`L%<KKdX9z^@ZdA+aw79c-b
zw%Ks!-4;p+?R5KB3sMw7eJoc|mVY2c{4Hwjk3V@zxw+K>ESgc;&S{6e+cC_&g<WpX
zEi?$XWu!sP7hCmO1Y<>4JTF)l{(%MZ?{!>7YG`Q45&;7=6M#cPPN-bm_#;CfH|)1X
z`@4bzI=V$9z|oUzlC_YGiL1J4w~pEul^L)Y`H5ej`b%keI{Q<(#Ft;7=pG>6!ni?x
zXe}7MCoJ}TOF~S~qod*A=e-kT-O%7WHwPW^3edXZVis9hS%E3Q^ko@r+c%%pMm!K`
zG$1E`CCwS;VX!eja@GmQ^kK8PbD*!qA0bz-bQNn=J>uYqq3$F_UM2AuOm6`W?4-};
z`|4WZr@@;bj+>SS;Ba1GvDGv1t|`A3cSN^<hQ1~P0T}PJgi$^%>=_EEU(ph*O0UFt
zDqT)@x1@jwhi*67<h5Yn>wpLT4K@vjJAC=nDX0(I0KPN55*a&Si?u&F8_@oL+wotc
z0)A{T9`;N@!PFx68E`J-j5)*H>3JD|3_1)6Tb&H_z0-O?B!Oq403{)S@B_Us6IW{l
z!B0^zz#BL(hMK;)-MIzB_`m}TT3TAM@$mpP4d-XpoOxYQW6w^Y-Qyl9Cl=&zY4IC}
zt7^Bjhd^>orO52aNB|9&O!rO6tGeEWn+w&ghxR$Ej*i1354`_Lgu@#D74#s3UL-^<
zBjSFhNm}qbp*=G^Qo8k>PNR{NKZa!}h@?qRbZ_8;Z3lf=o3Yj}t?g%WVyZ=8*e67I
z!wq6Ll@faXE4uJ)A$^Ca=|t}^y>OVNm=KRt>-D;jv)1CmWREP4l7sG^a(V-7a&hf*
zguq#2kRruw&s&Bup1R?3vk@-KO8Z4of&DLDBLz|^K08JH8hZ7o&PhDprJk6!gMzB1
z_1m4x!f7hb+ZxbTTG)hbJSI_89L!tig;i+^)^BunfVpMyN)4baDbs?_Cte6iws^Uk
z^yFXw0@jdEK^rSXc{2uIFPnDFz{6>K&h$`2G`0!PTEFRLiuOc||C`Q9-)KsAjfOjh
zb(56o=fRI`38ZLb6*rS`If0}2Zy=E)D)lm+;{;~4qL&|m=uO&XacO(IwgWGmxPEvu
zo}QsQa?%~kysCV1y4<nq@(ijEu%ArnI5OR)W~H6J9+C5QCw|XcwN6OTbxKd2Fa6LE
zd7dAqh@(`@er301*vh`^e|-+KAGRKqwH==l5E0mv)@pg0!4Xp_L&a)L)v(xrnUPKX
zYiJ|S<lQjAS{N;E!oKlAdK%-y5Z&M0zxZRKAANoCz^j=O1f=6g6c`TMQd65xW<Gts
zNgK|QkOvXvpi0T!8%oDF{vIJ{B8h%P8y0r0O1MM4{82)x|6RTYgEZ=#lkp+@562*2
z{h9at%b($Ld5zDFKm`l*_dLFn1z+&5?{_~nJ~MN^QHmnht4||xu=WOkz2}@`X5hDX
zY#WT`-1b(K6*;INvFpQk@*d|X@Q3WXbHg=x-wO986I%paJ`X_M-@^rKxF(^1gZ^jM
zoN_V>xBU=xrv_~nHwsAFbA^iPrrM;xZ}ACp=D?nE35Eoar5+&m^DIUKF;$!I-E_Z@
zp`?+a^fX!Oc<9Y&DFK12ru=Z7)Z69n{YizlMlD$;@2$9TBi?Y7i0-$>!unrA+<(>n
zuPaFmK%(5-jyuSJ2gx#jV76WY7-p>jn%iAjrcUU?@a^LaR+jr7Y;DZUv(1NXY#`jw
zI3R2zJ0XM`oE(k}8Xm>TlYtyY4WtKR;6so{4M~5qRfOu)w6szHq4D|RkbH13^Tsg>
z&Li9-gwBIoo`!=^3a@=!I8k)mb3ymmMZZ~A=C)U?i@rD60IN-*P_4u!!d+iUJKfXj
zhkobY)LD@ae8>H%Ncd5u>nv{7M~V5BxX-#N#0Qg${-J8Ll5vgp8rRffSIv48*UgI8
z*B4X;FAK6>IA_Ly(0M-6;)=~RvcT2IwMf{{I(_tu)LkbH&0R7}vte5~Jh+N>K3Qj?
zVmFt7>G8Sgimsesl)nmn0nbwJ-x{fZac@|EFq8nYQR8b*h;!pKJy~gcp_onIxv0{h
zf&%dQlDS11GRKNiw%i3@MOLgVdirMy*l#9y8YV~4Egr7M^?AyWwGfoH9^7xUJq#p9
z)xSQH(=sGXxIU^|Tx;_`kv-Z{%W>-`8(EGpQyH(%J4<Wj-GyoNY9yyv(ip=u;OAK9
zhs7Gw_r_754x3TrK7)yDz~N~ebA!8L$8su0wgS@*BNyfwV=JHgH2U<HU}x7Si=xgI
zUfOY@apyLIc{@UGJ%xJ{VZ<1V^_E4BqB75Yc9Pet)JK1@{4k+Peyj~JMK7@V%cNiy
zES#9nVNcYpJ`IZ36slp*J`Jh3;cB^rsa1BK+E13XkuH8dS}(0`{jvX8cKu>C$7A%l
z*akdbddF3;XnfPj$7(@v9eY;noI>C9(syVt;Cen^y`(aSo}uS0&KB8;z(TFr&)L0*
zy@3NF=KeMuAlv#_jY)(1{+ag3!s!Km;X)L=-n5sJu3Hvkq|wwF?)|`{I?x%@sC4is
zA|j#RTr~r>o|n$DSbE;^>rzqurd~Ztc=;Kr*PbmJo>BAY%G8b9l{q1+62|}sodEE!
z6l_<|Pew^0mw-U5pFF)$w3({^nh#Y~BzsWHIw-8rlOQy)=kZTZtO5#x|ANUH5)|<E
z_yEARJpsW~y$Skk2|z?gCe^?Ffydg96R!v*A9!Skp~h-FURBAK$#%9HcbcDg2Oc?g
z9f$%_mrCS4UKoNid0uuyb%4U9Xmd`1FU!=&UC&~b+TstB${N{5m+P+Vb|0^#drau;
zsugRKFVTynn4wbJ35`5Gee={8+4glcy=`KP|I`D0+T)*Z_>yq4C!BoeYhZky4r42=
zT3w-Y>16?fGe1PF2gqC7yXvy<*{i7Dk3_vzrCVt~Y9cC{a85kj#?J0=4|R54gg#|R
zqvo4;h}2?`F!!rE@b+9kb6IqPl9w3&EYABCIQ;r-dkmW^!lBgOch`tebJyWhdnFJ1
z7_7Ifg_X*udP>Lk$9$cf0&UQ+EV+IOQoonJ^>{ITS@U&NL*LmT#t|%W(tYfOr<Bmu
z#h$;@#XN0l(V1_n^H9Iv$tx1S@}C5rXXAC36IK5F!xsFzw)|GKzJ9qDXdo0%)NN>)
z;Y{DOvx4)553B{1qi%8H70cpw!eTtiJJA|qwB`v8$xey7V@{~`vnP%{F7T^0UAA8+
zgvXIC`i)9uo2gZUoSpAbofH23zX1B8?vs!}>%#qHGEy(IY`DoLTIeZIdnv`IC$U_0
z=1afxB%HPK9ou4A?fR4+*}o=2-MUU&6uFw^*-zRuTe7^^FF83sfq!hBL<^#ySk%9o
zb^G3)VtQELU3#LCaME@rSn!JB>kQrRCm65Al@V<hfAsWZ$v~9ph@ZZsPNkM4Z*&>a
z|7`7`oc&bo%=d&U3&&>SWs^Ei!(QpD;^@}Nx`i|41)qz1i{`dDqYFqg*5WYCjhx8r
z^XI;4a{=hKpZpIiWLw20CP#->es%RGwtbplkK(a3F1jL_ecq-?GdgOX^3Ij~>T_ia
z$6-PDD1>~&^?+%@n(gpZ<{shIS_{u+%~-zP_$5(;tHPG~Rn{UYWMk?=DkS<yw{17?
z>5-M$gM*Y|W5ajD@Q&mGfu<TAui=LE@2)Vub22}Ft-9gVyzj%P=4nv^>kl^FRq^00
z*V#~uV37&=ok)k`iu7Z<Y1=tG>&9^l!f^xYxyQhq{VQze?Qv?E01j@g?X2Z-NJZ3W
zrmyv;ljFjX<w~h&ir^;uWr=rj8}+2@-qMjsDYw6X{lJrJ+2<Lw8U7V>=N7!^lcl;+
z084cZS~My0>!aQoCT$iegz%8GoNbJfa6|Yi$`Zk?ept$)KU(Z!dwZ$#dj`t~B{6-o
z<L2Q70>Mp@5j~KgrGazii$raPi)(-$1ejBkZu8zg*CQ%l+@rk?s;BiuE&0U-hJjvY
z8y3D3=_tnEl{ogwc$6|CgHE-dMu(U9&EirT1ciO$nPz}G9yR5O=(&+~EZkfzX0)mu
zX`hozkL{=$_U%XnT{V^Leu&VMzldmy1Mpa{aO&(L8;|I5Vx^fq1*~D>Ls~~Nkl^FI
zYAO=>UTi%^sVd~QJ0iWF1E->JwHGgYVlD6w;`CY-z}z{xxt!c_1R;aNAasVX@~Gmj
z-D*qUkTM$o&m0fCx!6rk$pr0pF2u4CFFdSWt7x2llvlK_k)*rVrcVAJV_z8-W!Hr(
zAc!C_qS82$A_CGK0+JGf(jna;DGVVXFe)k1-5}i!3P?!jNRCJ|z|cc;9(+IF?_8gb
z=gcp>oY>FaYp=Z5z4DUmA=LU7C&TOqJQQ`<AZ0Q{fxrW2)r>%<*Z{xoXpsrwJ^;#O
zz03PjvFSk|_fQur@nAC5*d~{t?vwmmIdO;yO3i5rJf|%1`Es~aKLxBfl2>A8D!)F_
z*~kli%Ya<6x8VV6H%bf6?+;yJ@7+I**QTVrLbSY&c#?`hxFGfrnH?`ZcU8)L#}i+C
zPtn04;DL{Fd4ohgE#Lf+Sn*i{>3@^gLd9t~WIAiAwBtbCYpD^N({1K>(cE?oX7D^n
zC;+g+O%<iPW^*-rhy@Wk4}JT_<A@$1;-@QnAzlaG@Z$Z#xga&V7V?Va;$>xP*D|Em
zvHLWRyW@|i2H=rW|1*i^NEc{$@!&ODyyI)%np-to*KG*pGNT18$sTOaGI{!jl|K|q
zqyX(B-*7<(#BJ6N%ssuQ>s>g44$91yA1Er5ZK(U#H+BS1Kc!r{LJmNia#^VfS3{~7
z6Y7B+PXBcL+N2d(DxBqbQ%$Tu-+K2<4u!4K=TP`yaUU$vFB1mei7#?|%hC4UsSHj@
zZ6yz3(`>zKsggH4{?=YSE`f*p%=KHVB;aeZEbn|Y%)FVo`oLUS$#c-nzFyy>sltA8
z$Q{p9`hOF87?&|GSLm@_WW#911IeF|l<<96DSqh^OKe@n_qtL9@pus2BGAj_A*@Nz
zMXKiznmAcnXn&J>&cMf|FtQJ}&?iUPf%I_*wy)xXYTBNp>rjTfY+G5tO!t$oR_`@G
zT%EMKXTkc~Frz&oByGatpc4w|F=!>CK8r1Wp$~DgfJUUqK{z!VCAcpQ>^Lb2-a6l5
zH#;&D^2fDR8GUhDneBUKHMve@X41ofc)Y9>IOUXZm~Rg!4B-PHiP|JTNQ|Kca38oW
z@3Ph1?}@vj%cm+CTgEibZ2KovcEp1@u*!7F#{xMWjKXy4#e_@6EiTgze$a?8;T6h>
zkFfJ1UW65YSov_S;e)lbtwo#0_Q8w|{CbVojk7wG?<EQRGd_<!BBk-1Sr38r;ViX?
zV)<`S*x}sop!hswF{iQBC)bKY5KoabBCcdR_Kp43JsaY!&Tntbkk}%NK=8w5UBDk^
zf16DK5pJQG7D>32)gP(^)1UsbMqujAzZrH$l+HV1-3u~L`XJMxxJ|G$zu&XW#_d@V
z7&%P*J^AygXFYpx?Wz7MVUmx1fxiXW_6Lr&4@%nkk`QApjEKt6KoG@sEBh-+G&C=&
zseq=0!<jRb213ud{)drM)9LMFc#K+zAj=Ud;Og&bO<Wmqe<;w}4kQ5mzX%49;_^Ys
zM4e0E5BSF-T$aJM4~AEEhvVh@H}nc0IikX4dS(bG4tN*Sj^~#%!nRq<n@g|U>I1rS
zPrgF0;80>GvP|&pHCFQpCfo1Ul>|nWs=u^9qjg^oaqA76$koVlWB^Ki;WA@KY5Fb}
z_iV*S<bovYP<>~~3E!~r&537gBW!(7V`jY|1}seEjS_1>C8njxt^~E8OgGmdO1A%i
z9XRocN#iv-R6WgED|Sj}B9;sF)GEenJlcH<NzZAn-6u})qi&DFomrl7pQ}DzVJtoR
zB>IS-oFT`a#V86XVF&mnxDjNok_)<7cw=6%#QgbzB#CG1?v#^^n3F{YxPDvbX)M^N
znB!znq}@%IX=!hQDBag@jJvC=iwA#7r!{CCa$`m1`GobIM7bcnp=MS=%NOnh;th<D
z&b^U2I?u+d4P({)D9&oQ!un^9)z3of35PS2=SA)T4s~UO@Cs7|p+FCrUBT>|Jx`J3
zwTEpb$5(1^y@%cD!I|Rd5zgka;V|DO`Yk2`f2U1dr{ps41LD^kez>H!%^p1jPk~$V
zLH+tqHG>pajk!M{OzaDsC^M$LnFZU1=a=+3%?12%sU^Lqj}#Z#-yk2nRfH&d(2x*b
zGo0V=er|h>+VI*F<J%f~s4Nk2?(cWivV#G0xm2uQuAZFu0cE|^9gNv;eua6{hW#29
zfbJFH--R6uj-9qE>I840ns*79=l8A8fvk^*PZeb)34lTzeQ-E>vUgCn06!|)E0qa+
zi6he#Mc8na3F<&tXbcZ(+^pKK8=T?WX9h5suvl+HnH6Ux%Hu_E<hrC@Ew;Kh%cLm3
zKW;S*L)B>SgHQMN3wGAwLBMrA5yqk@u^a%1#VGhbRN3}@5Ns#bO-r^G6UvBn&LQ-5
z)tBTNuXfoFEbC+VmVas=RFnh%LfAeaNx}B?qvmHPHR=tybGwz1B1L?<OSV61Hz;=&
zyD!4+Zk`7vM5pspcXgeP8?WtGvyM0+gqwECMWCBU$N7^}?np_qFuX!#j%{C|#QNDk
zG)@zPfpZxjAHRP4wlXm&wKX^w_ce*sWy+5oXYX_&#HB#QM}F8zvM2x{U@_7QAA3vY
zlByBF1udZ%FK}sf-#aob;a#;Jv_77{Z)a<8YwgtUQ40B&boc{}+Lb`-`T2GxkD{}|
z76#7aDECFjYVZ%F&l$(t`^66em5wBM?Ptt*wIS;T4<5e0MR@kIOSL?;yb)S5SxQSS
zb=lezW|(&o6C_JN^uuLsNQ^qIt8GjOJ3U$x(VD_!Ij-AB?Ss<~^Avjo8TJ>_W+o|%
zr|;wKTw9xIlu1tJ>@6;-brIE$)v-3M;9gCq@_PC_j2;sE{aL{@3$&yjLeOoJ6a+&6
z3qE>VGzmaIvMG29*e{}^iq0ypvfD6Gv5{kp_Hf%h8_BAhBLF0{qR)6!gszw3CN=?X
z0hsn1+(0CHbf+M-qqHyP_cr0XBA7=R>p<ewL+V4aj{b=TMIl(?9adPvW`Vme^+a_v
z8)*u{z4S<7{)%)kR}5e>5U{gk%KG~QTi<Rs_&on~oz<o=#P$5Nx?lH}RcG!i>ThP>
zf^1*hYN;$VYZ{%nM$Tox0|!1<$dT44S|BmhXS+u_B}4Nfa}Z*fQ`=dXHqD8rE-49d
z5Ee15v+hhI<oT$<gHMSl;S;2mfB5>mag#mPPCt14Hg%){CDg_0TWa!deQl0y9%|A8
z2NdxVr{cwlV#adye((Sau#@|H0*cV$h3Z`3w5IhC2^Pp#evcEXZ6YnX${ra2RHk<_
z0%8k~@a)N5EO)hcge*A@+ohAPCE*#<*by6gu>;W(8w&1a?X3)>+Exl`qJwtwQB(d~
z1NfCa703OjL<7VRxGcA1WWm}G+mb~f3o}=w6U@o2sN5jNxm?g17}>E;*b^*q>uc9&
z280UoMSno)q^z;|bF`cmzqW*lp%V1M4XP1@(cZNZ6*I4tV7e}OTixqwy#QTdPZFw0
z>%L|T05J{f5MH-_HHsr+d)L<Lnqp)k8T%2wxvi(3(Pi?LD}KR%e%Nn!6S=}#HPv(1
z2I823qdIIsUy1iYIZ0HlU^b2hGC~&LwLrRC*XV?2Zoycse`(AcZ<5X^Z!p2c!(*m#
zK%!Hdc-*=S)no~;${PQ)URmVj&Fv4B6~-E?wW6yfG_5-7s5HZHrf%;P6~G^wY=#`J
zgACo8x3}MAD&`Nb2Yp2yiv>56Q^c<L7_b_wuzW8N8bZc+_d6fitT+y0ZV0Y~t0?;I
zN^@!mZYncmGzIfysvGvS63`Yj>v{CN2qUaak=I17fIzoMSbj@wi(>$7rg*Q~83Rb5
z>cna0rl++0nh!Pf`bC{1fLl(Qko5e9is;E^t4pM(@_wL+?WWjvCta_^L|w*Y@Ex7i
z$v~T{0O)1Rp4)>{*tqB;0es@p29KhLYvADBh6!C8BHA?!-!mhx<wmT`#I4oDnWSbF
zAk8e|<O<wrh-CAbl^z76jXdB*(lCj12ti?5>Tuc(sgsj;gU5?+8US63W4$9mb$<WQ
zCe8xGIjN44V3O7Evh2R%dcX3+7M9|6gsceGzEfp0?C5sCV((^v-gHrorgJX0^}WZ$
zhHh@&_JyaUyU!Xcm?C)QqZ>Kk`ms%t$LiAd`8(S#u`ThCX@w=ZWv)DFK@rYv8m>#u
zMI>un52YSZ|4vvVZivmv#T7sU3V3F6T!IZmVwwb&9-R8Eq?Sj#Cf_vS15$lBy%&jX
zq|aulyNIChyR)~`wi9~@WSQreYR92Bd%XsSfT9U(oh4F!fX8)i*4MN#(cNoQqyEC0
z07IIfUM;j!rgIAgKkuYQg>s@uZJ<olm}Z@urA@=7S3vs@=rpMbAmYULp|VPEV}!2k
zZBci7?DRqKr68uu^Hq&~=Ro?s7SR;s*{UAZmKL`wJpFdxs&zZ5y%ym$2I24+X;iIR
z8?5vAwEI1`!>j-EwEwZZk;M8dmnkzT7U<nIu2k4bcU{PK>uSpUhwP9{vk)tc9D8=0
z;znB!J$P?*C}3Fb&8$D8YuP9g+O@KQwIH;E^_vj{O1X3w5e1Dw5Z&=vP|E!I*@;@;
z{(-)=ue-Ho*{tLhg{ZGLA6W}cxxiZ&Psfr~fdFy%+AS|qQ%FYRo84nCiBrL*8RCcs
z&9<BVi%<OacH@q-2T4{>u@^mTwNqy6?Iu^^><zs4SPxxCt#(d(8;dvs<+|&G#^B0<
zW{z*S$ba(>Y3~5-&Jq%SZC>SOl103nmUAIzG5^%p#xFTZM>doe(Y;XFf8ud*lAed7
zeA`A7_enG$kER4l!T^Zm4AG>hO$3_*4oL8RB;kwnNM26sxfd4+M03RL!qW%agG^uU
zeOjY3YM&uad7lV&yVfv1^|W8H{|OUykUl=clDP--&dtN!9n(d|39$Q42uwDP)6}zm
zp#3z5Ntxt$lYbxl13+0tP9kXxi;A(UkWG#D;>rQ+(O$NpDfa6ltg>XzFb6L20UQMa
z;<csJNlUstwRZRAk<wNzN4X`XMF`^d>2W&G{fg>WJW-k8mYIzC8KL7VQ$8X~K<elQ
zt7m~4R>okhGSV8$qrYLlz21xfTd(7cYI#XTt-=oq1Owf{OKz*aNX<Q~XCeAL)!4$4
z`%C8yO6!?Bht!@i*0(>(QzCdCI4kKtd|hPjRt(e#R)!JUbT{~0s`0(5D#TB+dv$u<
z1wRbcQcuPsc~XZ{m2wh*BxhI134YT#P%z<iZZkIfY_7M|^`h0wg?6pAz>;GldAj~6
zdZkX#t7@0U7&j-T7j;xE33<9=ZP>f#6VrMXaEJHQH#n?@G$VDW3F-@zCl5G?4w{-H
zaA|ju9qC_E6s+Xm>w3-#U`UVE{sA$ar3?fH0Bpq%I^>3UxAZoHT*`tjv$5L$%tMQ^
z1woZ^zZrSfN`;uFDC?~AFegsiF>mJVr)uibmXXAwHj?$(Yg+6`S#ZjbezlixY1;#+
zc$|e;<FE1gh~m;95$>6Zk-J7BvKP5}@3EGi2{Nmj#Z8EP(f1}JX1H!c`ea0*JuGE~
zlOsjXBzI%_k3I&tE&0@Fx~@$vR0{zSE<O!4pB%5<lu?nBr`7vJS1S@Zo|gAw!3OUT
zE?N)YRFYH!XQ@&gGN_oq&5aNRN=nDU;wImdS_}1{gsdY6nIxIomG{bwJJ{wlCh@%p
zzKqE;Fhd7kJ)~@K88TnqT~zEny1A4z*#~=PirNrq_wt@{V;@aZL=5*H=k>P_u{ZN#
zkt2>a>JhhgM72^R8z%rCLTo7WMXO4J?6hE4Q~TcY5Lkda&aTk@tF3F=cM`p;ch6Sy
zdFK(E(i32NMZ5l*n<guQ6w=F8Z=@fX-E^(ui#C{9z_f&A2UH5ZsI%6K3^h+N4SWO?
z6=$5QC2&veLSH^Fd0OC*SbM6$qW%?sxU2_7k)AZVdd+gAqzPy_Q1U)B^>5f3^E6Oq
zCJ?Ygpv2%W_K-ohYBV&Gc9Rn!N;-or1NGjgicQC7GR+8A!r7-}JI_%=Zhlv0EbN1b
zZh8JlDC{?B#o1$E;*(MLZ2Y=gTJ)Jb@D?w0faduGR%g85-re%C+25N3<imjKX<i-x
zx6WFMCPhX`1Nje@W1vKFk?m~qxMrsTiP%!mqi&aCss=KdI+ZBj#)qS}ViN;-&7F2H
zjYNQeEaa+f?uhYt&KHHI@E)z=xbg~+%R%_$&R+iPGk9@?Tz}@c8~LWb4@Ob5Jgf^4
zNBcKSj7obvxi~g9Jp(&s6!AcA?xGm!A>2S#vO*F@uya~><R5nH-K{7>Udur%YBrgi
z_fP30-jM+yqvb;cviVfW=Q}GOMaU_0ll#Q?LewN)v?soe{Vw^+%(|*T#vyZ6Z5n*S
zA39*YRA}fE?a!l6x=&tm1^aW~`VV{|`5dQ-%LSasBqGz9$=e6L%JK!QZsa1)&Sl7p
z)abUuluM&G-`?)A-D-nOyV5n>&(2L=+aFV|Z@fT|_scem!VV=^rrivC{HGO;-4T$}
z$*5@2j{9~<U9<ConF%$86lLp+TmrC-UFGa1n)M{+_GEC(-vKD%c{hGRKcK4asCTpJ
zKqk>C*e(A~kN({;_qY4fwbBI24}#iW6lD-}m4_Hqu=9Ci*qk0|zy_uHPNRzUX>0cO
zuk`f#jmi&zB@mBn#_OitaWj0&n>glGWSR{jO=s;EP%gZ^)u&BUrDoK)OC^u$dS=L0
z#|AzkE+<rg3&+Yzh(2c`tXt23B<use(UOP2K|h2j3-j@CrJ`P+$?M{8S*^bXxa8@R
zjwmDvlT7%9m<Z_1`jQa{^7QVcRx;L8$AIyADTv=UCIZ1Cgm>-zlLIcTsuLZj!MThe
zkI;I1xH^0i@$y>jvARJBVY7MbvTxd*h{=kH<<aeVjN8;S-K$-O2B>PdTSBX+rO0Ij
z`Kseq?GTVIKDJ61c|PNTk}R(dfn(13j|~hQfhTlmn}>low&zaZc6rjN7NO~rZ|33<
zuLir<?%g5!IDK-()z&dPy+_P_rejNo(kgprCy&x4(^fL!iqv>=Opt+vz0;DZ%B43h
zK0P5JKF(wX`Na)w$a+iGVHX$K5*XZ*9b7Qt#D7uRI;&mRdsl-H-PJhP4w@bAZ^q*<
z!XZlvrqR^aXrK9HPhFq7xDO#Okbdn#ML@Sp0q62e63N_c5HuKgC|F^=fKO1k-g0=H
zkC?H&cAg2hZ0skR;`=l)MKvTJ^kv9+72aHb1w}$l8}^43kBV;`m$@pPpUfRz><Y7%
ziAsbi{LIU&beUo_ABVdsz-eLPpvDPST;}5wO68_2kY{zR(s}oZOhCEiQ$RkZ_7HsW
zl~+GLEixe_B_Smx-RG!0DCVs=H@-19iX&MVFncTU@?_eEBqdE4mqhqn@EyA;#vNfk
z8_tt`g}sl@JU{zR)-l*7^I}>PXQArLp45En)_C{Ee!Oa$Dmhp63!WLsyt;k)y{lJ%
z7Y_ICWRq8pg_oavJJ-|Rn&z<wrn9>F`_OS~;f|vd8ZYOwW;JbDkDW!^ZJ2?NoIu7_
zy;;a=6Yb#V&|=gxf8Xi$aD^8yg2+QwpY;GtBO=4itQ5CS_m<%8sN&#5zK6(q*p8uC
zOiTPE>gMWc)w)pd=Dgbuq|m4O9_5|q{7Yn3&7Y$YTmXk%MHtB%mFDjp$qWkOlSXCb
z<qV>t$uuAa#Fzu`ub}I9s1DT;rl8+H{A=%PMCZh~MVC6=d#&V+D$B|or;*#e{mtFg
z?fHzikiqL7%LW`8|6;Lzi|8(4KDw96L)!yRe}c3DqQ0mzQX2MmP1AQ+yw7_1BXkSB
zEl+$x3p`3?B9h6jNdBJV{Z+&FmDCXz5(Myna`N(T+q51^eK97Afuqi>1Boi{(J;tR
zgP0K2=P90Cqm7%0G{sNj=y6&X{5lm_ZU3N|wg7UqM)38IRIL7Ng)GmyZ(9;}?=Hd5
z<t7)I9wCIkvHzaW`uAzuQeW*uH%Fl*K$QQ6#Qn!2qoeLPr*tt?7qBBY`z?mRI9F@v
z(SwnQq1ms-pqrHOE4v<1^HuK<6c}yZ0K@Uua(nb2GSdC@5fl+0@8MvP-L3PbJIj2G
z5enT(=wJ9P!29=PRc-*(*t7xyhtG)z%e~T_t<)od-o;%39P|&zaX*y-Tvk>_&&&)E
zSOp@vVtyB@UlIhs83Cr<@Nj^B$j0pz7W$nB_=|ych=}N&SY7Z+2hZ5D{e=$9i1;7W
z%ME~`!CxfkH$?BhZa+91AhZS;>qel^mC2qjf7u6NOn|rkeNvKQ2=vG7Qtqz@_;;iJ
zd$djB($awd-iwP{Z4GW!MEviM{jZ4nrUN`qEydDpd(`je6SH~fnarD)zbQ`GN}LM;
zy(j5nLZRq!b(b)M3SKSZ1NbnYYo$r6{EmjX#X&f!II$E}nOii;pAcXFu&t%O#{CCO
z4B)fx-f??9jGlxIEDd1yB+bkiA4&yJDYIdrf0FA=Kf@+W5nB1Fq}kWMuHNq-;BUjO
zpl<^j6L;P|<KiB^<IN}Fg<fLiV*xMgKY7M5=yg|neroh@CUge~t|FqM03LD4GbKk1
z^hfkT{GVizBNCLR$LP%9B?4^s^_N!@ucMc0+z(GN{GjhW%=y{TFTqF(%*CY!K&9#U
zBD>M=Yii~{QvYe-F~fShgDCoyw)p`Y0A%4WgGwE^YH`s2vV8n6fAs(PjX%Yck@31z
zTTAae1^T19Yl#V@-ZQ18<m#Cd|B#&jCGkM-O=Kk9zo(>GlcxK7<I%tBok0%F$EN|X
z$g8See<&qa$B~GSe$z{70SkajYqVhJNR57zK7cW(<Cy{8Z-5AR8T7<&13$;__j~!D
z6^K8^T^@K0@ISr301iWAYcg~%qhA1nEKo;Qp-aC!O{|3dyEOmjh<!Cle&S1SSi40b
z9{%q&|Mz35mvJ?DXo23*i%#MxA|>?G3w&cQIOTqxJBOQjEg1c|zts|d_skryZ9lh@
z1CCGldvnyUofChI_a9{oigb&4haRe)N_Ii>{}Vx(PG*l8^oIiKf5ZkHeUaT_U|;|e
zT&13owY+~>sU)zK7Q_z${W-7{`)f_VpHo|nxRO$+iMhEN9c?>cJpR%a0bt>Q246=<
zPD!qtlhofo{pCwbfa?J$`B}=ItiLFET}(l4HFfn{05=u_$3YkU!x-uP!WXC&z%7c<
zGkW``-|Fn`jq2%n3~*}%F1<v*#1FTAHCjB;w&REWfyV2X1V6cI5dyt%aSQ5lKM4^2
zQF_n&XOcR`pEhGq`Ls8YXqo4zsNQ(b`lw#&ZWg_c)^*mqkj|lWgE5=Do*rt+N0yRO
z@9wIO>p<o6*2c}fmkyPd_)&d5Jnh%GP~Lq=(+vT5d2{~?sskkeU-~KFxQrMCQuOrn
zvKAJ1>1h2{K0EyZh4Jff6Y&AfJiGOh4D^DnMBvIF7yNT$J~KYQLJPdeKp-2Ul;hu^
zz5iY%a6We5UE(L1Dy0QYG@<B4{t_kzeK?acn^w7FUZ%CwWnbtekL@Wu^eb2r2iqr4
zZSQ>zW4M1mc;xZYrv$Zsb=Pl)N9>IG;>C;W<m7T-+T~<nzTjU^{M$!92@ns6OF27p
z`$C<b_cEi`y10VA-@a*HB_d)X201GyQ=-3n->Gnc#sf9FA5{EKc<4pdPYKMy@dW7L
zq37oQ00KQk?baHie|MQCn3-A5SqgXon{~fxar3u_{-yVEFJ}QhD3}=ZAuKro{W8JU
z*xWpk9di-6xp$?dOjvnj(EBFfgUj4J!-)b;^uof4;!>L;-Wz29p85akRo{Y}10dj1
zcWN7lqNf=bSHTB5B~-bv_gFslqW3Suc`#i=pv%h^s$8Z795R2Ayc%p^cT7y^eWBmI
z32Gqdx02HUP|Xlwnm15jlOhfqs6c2R1>-U|G3eGUX|SILdZU1GnNvetMyjo?4VQ<O
z6Bd<$UXi`}<nvQ7Z{GX@#ht-LzeeItT?}eanlG-Elt~eb%wM7?42A!QQ7-87<i8^D
zo19<5)S@G%q-2SRh{!biN}(V6J2k~Gff9GXw*dQ5fIgoRI{ak-gvpy%*=E}>g@d7;
z*Yya|f88a_bUNDfj10Nnw)(%VFODVr!v}ic+FqvRjQQ&(zG6-Fg_e{&ke2!eKKTt=
z|KF=Fz6dnqK!I5eZ=abHGRdHK04`xvzrwj_ru*kA+L0~(fu{A>VSQi2u8@A+F=r^%
zHm>IQm$5j+n>S0aK)@>)y7|TM_makcbxohrEAh7R!%{x<`VTiz8qCI~1ZZjsdUf>I
z<&}8*e?-<QJ9w*<^e<m{KmsVfi~EA>BU|tn0rL&MY5}Gd6pR;_YCrgfKDfiUd~&s|
zy<Pt0OaA|lul%VYX^oxN0{(kmzx{P~8Q^<oxO3;Bgrp=nXqM=$%P$%I?X9?Aheb@F
zCkl`?;DsxdC~zC{hfDD5^Pg5OS4abjbeOr6<}bIuPg7it%N<Y^Z{He8wUHxA|KdR7
z9^4!lc?|TeMQm<5V1m4}G|{^XmoUxmr_#~pf?l-Sto`j$tlR_~*i19|;#-q{(JJC~
z*lQG^!NEb`oz)bSf4dTO|7uC+ccpj!A|9Cv|F@Q8<M>Ml<t1OP>wqk2YLfXvxm1mf
zf8CV-H4MN;^B2Afg+kxF0a-~UM!zNa?-ls%FEHJ|ni3lPz4R|}4sIqZu$SBy9&AO3
zCi*_LOPJ(0fB_mG0FW7=RR_YRfBVh<F8Dh)W@%~Zg#%%gJ<MN9@fR841gHK~)0aZ^
z{_=&Nn*Y(3pM_|RPzF9-Edj{xqdm&`1Q+<%P->w}$AzyKgf6u!?b$;WawGu9RJG5e
zvA>;UJf<Kma4iK7RJpt=EJ}Ahb~yxIZiZWo+QFIW>80+e2S>*Z8$`Tg`#4`8Zz_ga
z+~=VeN+V)bWie9XtLw4C;9X^Q6P*Bvr{Y<hLv(d@H?e7@!`zh^A1A)Iy3~R)BxTi>
znu+I=VXMvjh`bj)Oq}as>B919r&#NF>e~}X<;nV?Z|}{}Nr107=}$q?+zf^e+<08g
zV?Dd4i)?OA;<iySkdS2Q++UwGJqp$WNcgqQ6XJP_!mHu&3h|6GZRd}p6u60BblU8m
zIAvUwI#@DdMYDF|5=?DiW}&Dkp!QRQ-BmX%2DQh$%lq7OiyH;?;<+33B@%Ce0^CpD
zoN+Q477ZUA6_5{QcDeMGiIf8c_wfq%cQz9hTA@?|v}rf*$xhd4bO(?|m+`&uK0nz}
z);b-fC{GkK5Vf>Q(kQl^Ygbf1hB=-byvTDIjk;h%8XQsCcmB~Pcet7HXg^(dGB@o8
zv#O?dsg-tt?qSy2%xTQiQY#%@h^=H-0$*`?5;9mH9$hFFyR#w+a7ITR?G;6AFLWQ;
ztyUJmYHTN6ox&yy#1&t@j0L9KJ-R2Yv5VK|32;7_nIlD4j#S*teS|tA`Rr+Gw*s@3
z>O~@-h&B4S44lSzmFapPt(fN*br4u)`+m)B^h(-C*4Z~l7V1=eMb@7^u#3^AGv#*C
z5JkAx<%}e2&9(#t&ytRD4KF!&_wu<nGF^~FJ<D%;A2L>-**}kiIK8XiP;*?OzvF?d
zD{K<$2&Lu%JvyG=oCwE8bKKvBuUhy(fTBGQF_@cQTFP^OoYYZc(v=WJCsHqW?yW4?
zy+N+X`gGxacVe~@wNNKlD~?e2gn*dw;(d3sgL0(=NcNon`a<5BSJv~-eo8w`-5Rp>
z$AYn@1W)hBiYdp#2jwqX^2{ldY8T_{IK5Wsb4ZQ`?leZP_VK<G)xGN<L>R-~q`6YD
z5==8p!l(05J#THa2wx$_i`I(<!uh4vS+Dz6ujxoR-D3yInCVCyu!rc-<c%HIYJ_J9
z3tJ3xB$Fof_cXI-?}R2hHPlnTR4)cnKOHYUy~6a#vC7*+LNRW%Y&5Sz8DI<e;EJl^
zf&DmU%Glq3QBi(g%5-!=9AVGre%co=(0e(0O&V^#Khtuk?vS5ymEzmvGV=RFWd#^p
z()_|!q{*5SdyPiiVeEMM<4<22CDyb1Up@;ABU`X@T}<&z58L&~3^HCXc#dx73V#RY
zgu&X@OFwg|wgT8pI0jY_e-ENrhmJx1gG02Jx$}*d+hZ|ELCcDE5!!UMrJ&xs*l;B`
z6i1P@XW`=%UM;*Ecb~^sa-Gb$67eT2-wo{5sp9Y6h%>96rY(LPXAxhaR_{2f_Any9
z;0cL=Pm*w1OJi7H44YS4!HH+BlalT5k3oMNA_Wk5z-2#kCFh3-N4mlKWMp=Zm0bvU
z%PmY>Qquo6#fJg$w$)LC$@-jw>BH_YrKOi<2hVa<^u3SQ-Ij!nJA@H@#1SBfNKNQV
z%fYfrDt?Cnff!^kjt-;ZNeXv!W1QB)aSvN_L!GB}NcLuub91r?jZ(SUn<MYTFL+FM
zvyR<XCiG^`zqfLyyrbFi-A8qGf?7S5J2=tk3I`?ZHSvp>${`r~(&N)}_w~JT9IbcC
z>}Si3*L>MMkyypMl9kp53`sO=0O(^ODwZtFv%xveX$nIb6}d4@!`a>Bi)%ZwE3BdS
zOpRNw|2>03(y8;}j&h8giOK5&S1W{I;~8%uvO@LLW=sA~7UGO=!`;%ha9B=g6)|G_
z-C5iEQz|MWOg2xI!SwL0GSIu&5x2hEAO0Du2X-h}oEKnMTUZNBk$6JdJA#PVP;ERi
z-CoH_5eltKKU}ZwnwOgch|%p$Qlj)bY4*|(&aYbvt7q=JJ1#}w5Ug58nq(V%c{|vy
zqDD7btN{yV<Y3x5jC=wSc^p$TJ>Q5Da}Lc_s<hTK&8nTSI`KaDiqXpPy{9;vrDoN?
zc7&klb{T7a^zIfVq&y9wj8JFo-3bkOM|vDvcl3p{{p++_C9jV6=B!NmLn;VBoD(&b
z)jxqJ+Sb9;IpuCYo^LW+Z=Y}}V))ZFblV?_?Z-y^!aTozq5D}rfm69z^;Z^k?X=*>
zmBmF!&o{-?JNA8hvS|`sbXP-fi``kjy}azq9aA;L;8nY=)|DdGeBc@=_ARaPnvWTj
zoFSEHZdA)&la4e{FeY=w+pZ=}?yZt7fkcD33#au`{RZk3g;-eBNf0^~8L2FnJIo+Z
z*7_U+)B8*c5rfR}nRUpY=itPD0Y>z62O?o|MY^>nXMS#(kT99`UXzxCn8$cbwk1l;
zf^{a}Q`IsQcx^SAfX(5VOexZIF*~&EIIqxPB-dGz7>@1AZKP4c!irB{%}Mc&j%G!M
zPZoT7D{>fGcK8B;!$t9hk9aWG5NnWI!79JM;2EN-uRgcq2(G{`n=hmj>-JFQIk%<9
zDiy`0RT%23)7K+{B9g-4w8-PrK~oXCu;j+x^5F%cc(|Rk<+3n3h7O0O%Rhenptq2g
z;%?khXOe05_9{whHWxhI>8Hu_{_?EPE|RHnEpx7vQlsGD@x%<Ix$*AphU!nj^qcF~
z49X6$iaiLAZh969c4go=FAeq+lCtivP3GBF3o(_Lt&ZB?pY%EW!aZ#lq7rKqqB79s
z)n8}8f@qo^o^6$x-=?Sp3MU3$cTBsZqtg0=!!3u+;$5j-HoJx%Ws^+LsJx@=aKHX|
zsk&;~Q%x=Zz{PRU+Q%2#vs<pWZoQ34cmhFjRAv|q)2w8onvFY@)beNd_>2;J)xAq~
zTUuLGg}J<7yGi9a;~X!Biq9`Wo=o{t**0t(CG<e?lVGn}p|g^vzyt`#@r9h3MuvAY
z)n{`AFvY}`;eOGWD?+Y3-4SCdIsIZfiv`ALRqAa_3Mg**k)mYNWF4JczJ|4V{+YsK
zVarnm{V{lcaju7G5xZLdp-Oe~_C|fzN^DU>S$2c*&3B^1a_>0chNJi;OhR7o8w;9`
z3wNbrp61VTTPEQuex9EsZ?c@LR;`c)nF}S=rkmO3r0$l}rEt`qd0~O<8${K(d&3~B
zwl~w2WM!LfLn?x@HQoj{eH-uDkaD9qOBh_TRo;Qevs7B?Sq`zV9-Gu!Hsvc?lcRoU
zLL!IHj_{>SDh;$rW1c{cU;3PE1-13Zv9M?qy(ggL6YTG_&6&);35ABZ_vSC}`nk<S
z*-b;@T1f#Hh1Y(!=yuvlp^c9aaT<@1UG>|9Ni~n;rTvs@`D9@LHgJG0`O;SlM9;Kz
zbpCY2TWh(coB)-te?d|+qWQSpo@sryHE5x&EAqP0DZAT-u4>8ihiddSPBC_U{zqq%
z#S4D;Y!1;b(pY@65u^gP{bGFD8<r4_x8iNlig3uypfTzp66ogo$k^$T@E9!brr{OZ
z3zP38td}ygQmK)nFq{p8ctyao6lBN+`31bxJVNK#f#F)w<wNX+h#dl{OqhOH4i77h
zM@^7Gh5h%>C{HbN=w{`Ph?`Y6Ws?Eo*|K1ztp&RHw@g(W>msoF41&g@7AJ=ggB?`L
zaA$!&JnQyg%-ZZUHEzveYQ^M(GS8h}!P@nGHD=dn?~}BrO$Q^nSR(By^==BiEXA&b
zd>tfodk6!kJ}eMZAy{5&B+nXhQY!OE#_u434VZVqR<WuLP_%b3C)-}(Jy~DUUt%YY
z81>#jIP{xy6Q|{6a=S!PzZ$rtUOs6TB^^Q``v@VHIM)#d2~q9*D*pNwmi?G;EpF}1
z<kNgn>DiX9O1UZ2YO=jbbMj4_?m0UnbWtvU&d)%HhK7d97ngcgW$vq><L37}{<;9`
zhr9i(C$n0eGoG_z>&~}1uOwFh!cM(ie}1H3HBvBFK}2!zLHI<4)LhGak-mqA?#5bs
zvAP$VM^UhA;BmH@JQ9j4;?ruK5KG%F2rov?4Iv`t*^gbullM2Kt()TAa*oJ_=gH$Z
zoTA62gy7BErvVxi%!<!;P2f3-pQQOHc&uvjLQ;1&#M{1c^vl;nCaucj$|m|n!;tpU
z>t3i~XMG;)F$b$h2SxqB7TCW+^tx|3x+G2LSAX=4$dCzpBg(~y#x(^CUF2x5D2L!;
z-xf103#QpgG&ZQ)4M<N~fQ>Y2zrDqJ?+E*ZvfOwcFv#v+*ynqzQA$f2BB-jE1r|}B
zj=S0wB@Ol8ZEKg)<;@PO;odQetl9!}%+3{U9SWiks9{Y>V=Ib8&b+?R7wnDq`<pl4
z*Yd6>dLyR~FT%W~GxNs%z-v_8BloSJthzgis2;W8f2od^JO*5rO+(4Y_gJW@2dd%2
z*C|PnR7*ju2*uTVwhlQl7gn}m_Xo4RUJ5|Heln6BJYlV!T}0&KMtIme@vL2j(s|@@
zM;}pF`XhzJJwVb2BB#bz?G7DBt(=<TdDvoVYQ~jb$rk58`ehWUZ+MNlSiz!U1_`se
zlw7}ZBma|I`BZyrz`Gj=ny(TN5QKt2cm)}>g03E&SLrPhM6Qbq*{=^?cfCiWm-2u~
zeN|6Q!@PHQ+}xm3&vtVBo%*E==#=Mh$a@wIJ9p$MYT=Wwe_vhgSQG4|+Fn|ywV#nV
z%{OXQLw7+pYzBd)u99Xm&RI4l&y|(5yx+*%R29+Ile}Pq*w`IwS72|HveJD~%bZ?-
zK?<=NPp^GUmO`~QP_-dK6Lp9`Q>vlROQ9hP%mb3LHeLP@<=rReWyWcR)G^Q47<I{X
z-!W4k$a>Y*q4OobS$DxDyMR#YU`8eYZz0R{oe;hKOvCn@XS%v6c_JdGPYqTEPYodv
z=%!MCPsF!4F9#ACz=(}x@z?jxkCDwoc{{E8pP?hWJP$a`c4aMJ$n4z6H*e(C!MR42
zm_9wdshJ}42*LR+(w=F%mJF1(G}gDRUZ|WUGsH_E`watEZ*1hr&SJZQiBt_+yd`R*
zdA_KAvMah!XFdBybHrG8#!8|5hr1gEIyIYKD@O(|%yS0g$M=WLh7F5swHB5{Qy`)l
z`yST_biED+X_p*azssLq#OT1Z!Y-|tQD0n<!I2d%({Cl9J^{6a+OxWLb%Hl<`tC-J
zRHYH1$!_qIUPRK%m>|6T)`!tr2I0!?rtyao@Q}i!?dloFa^Z>moDcV&4K;qX_CDNJ
zHf_o5V%~>6!NMw>0L5=~0q)Laha9f5>ilOp$&q6#;}QL_gZP4P=hDB9t|_*W90zjS
zXu`F|$Q7e*kRUj0^KQn>0Kxa;YQd5@VW)=u;eaANK`j?HL7fcxui2W_=KVA*7Mp=D
z%4FVsqg;XQ1O2R(e#8uGj7uoMlMT;FrlA*1|CB7MRo5wJm}P6eT5a^jd}x2>c)eB5
z%9qMKtN*d|`rZR=H^cc{4o=&N$4j{snL|$=czK}S9}yHgO{|N*Msn>GB1*p}xn=2~
z^v%Rr37hO}9qSm5#W##*iCit%=>Tk!MjSjWhAonu%Ph|ATcbqSXod`*r4PJOHB}q~
zbq`(Y*w=|I)oY6;OeQ@&-47sS(9v$T67$&2T{(e8TnDo9sx=OGtRso7M_xg?N0wa9
z0h;eO+4u0eq7?3Ffo60ve{li0+~QUYJsoX8>Tf*3&9jXhJF1vipR0#i>u7h3K~4aO
z=6v|GlKRJSoQnoC4eo2LnTPpFTXk?6meEL@``ndk8&kEzQ~DaqJeJ@e-#`1S-+8ZM
z&ixv~G|k9$I@PhC<VKmbV2q5MIGXEF?gV<>>AQ{$vfkb-d<szU1>b*xbmLueLMDvW
z=T2IrTEL3L=G)$osHRC^Giz;QI_d3uZK9jhm#B=f-jT><9{M^c=!!k~ho|VJzL5V>
zHvj#nI2eB!3Qa8lfjWtzAn5EfFtJ?dqUxHe)cYZc1_$;Rd;$3CH=cj$5I1Crq9N$3
z0pNPvWhic8Kh^g17_}Tl+&~NHh@E3AbC2C!%cr<0-O9DrtOz~k2II2ht5@xm!Zcw(
zTuBV=#OQyg@E4#{$3=D>C~1mIg+d&4AE1epfE@9-?mtB)XdbB4c*$N)-HwroXSgd;
z-6}g%Eidll(<c4|IN@K)^1xRpUepi(0i=H|F69d0*8NLXRX_*$ISX*h$VHK?{5GQo
z`eLrQD~W6cCkF#ic7|QNdzyv_hCU4|-bV@z35n|LlvU+gIFae1MxUk+KLv^zKw5VV
zrCURb#*za$TgQffD^Xj@?<vvad%y{JfK2^UOdMWnHASCN4>!iX7*@~57Ag+-u5Y%H
z5p#}f%W?v)KQieV8Q=Us&q)XlAIH3N=MG@;p!404I@=5VtO0oQQB$=}ru&v<y<0yE
zinkJhg!QFT<fkWxsLfKF9q}4sbdTrzo#gJ*2Prq$<Hf#XUjHYv$^Y)z?J_?i2#WfJ
zwCIfrTBXCCrHBUg%lF(i!oNehYtd%leVrH`woTqsRdeoAiFim5>X1X6ha#>syd@29
zQCFc=Vf=+1uy6>0@;fZ&u1)&13Cj?O-(W6y!stijyKUrj8;zeJu5^7Mwe4X(e1cH+
z2D`fWTkX>^-v^fDm%}<pbm?fF>D!VUgL-#Z)GJ=yxEISuoXmhiTlolY#Xb}9)ZM==
zdj>u8yN-=zWb&FCu(nWKzyZ-FF@kOQGg6a0gi@Uu(8r(?%*&~-sDlT%6&K`5yS8}f
zfK0<y7|(SHd^Kx9M(T-{zfA9RB^emPjL(+C*Nmx<mY&~b25ya?k<{zZz=P9%tVQ=I
zwyY=gRuc2OF);{qMRUw2;?~k@XUD0vmD{Fo7Z09*fM^mQAOB?Jv8%6@wB+R<KG9R?
zVs~Oq%>7)b_+8yXUnl^m|3oBpa@ybQc(D9}`AI|Sjm{LNk{Q_zbdjq#IQ4QUmB<}H
zKBD~&cjWWl2RQCFT3!_K1UIoj@zHX_ToKXCGR?)h!f5mj@eNE@k8D6_-(;JA?NYO`
zDY#JD-ryfFz2isuPBGoHME9ARZFGgueEyaA5w@$=?QcP^U&~t58m+*YDecH_-@Z-7
zL+g6h)W1mr?F_WPgMNZ)xC9V)2?j*5CmZQ0S^lSLbK!uVfIydN9lu(4xuC6$<cfnY
z({igt{PfSj#GkGIVq{#e<GvPu?O_#yiwPQE>HVRNzJyb98S@Shh{atf_D7F6X#J|u
zSA~4n=!tQCaTR;H&HJc+Vn!m8^x2C3f>aa7l>&^8mDDC1`r>Xl0rtfb3bg6`MjnrE
zV$Z!tyIMaTFfk_R7jgm{h3J_^`@JT7zQC{N<^lT^983?WZ~X^FSJ1eG;^3N}Yxwd}
z<UjTecLNqzkM0r>ciLh45<^wg2&7&I1c0EOcI;&6O#|`N#hU@_2nPp;L<j)mh^a*j
z<M6e)d$Gf&A@ANr{sUlXbqiKN3!TF?x_CxlhY0}GAT89u#Eu&66GHGVOMq$r!RF+G
zB18;0ity0BIrisv^t1EwsskAix!xN+>|7|cs29MXVKV<?(Y#+gLZe78VLoL0M|$Qj
zpjn`Kq+@99X_Amn6xJ0&`KWtQ3>rn@R8G_5vl6A<gv!3we>8aCdw$BRTR~pjPw<7a
zS(w;fVUBVNL-R=)-Ck6VWk_&vxKa`gf3La#q;euRLdkYwig`3&gKKByaA#IVVLr}W
zI!<vkZ_XbjR9~pyC_UqDo~E@izGKL&mR(UEN)GaIUHZDz8Ii$hwd?f$Lo7Xz;GpB1
z9@*7Rir@L8RR_!}Ai)v;;ye(nYa_MwK#U?F8B~9=-3_qyo|{_0dnQ(vQmVT?`v+yp
zMzoA6fTFa5Ttdq?CXrb>)iS-?uQ0q8s&wof$CB*KHp4+>FSk_7wSY*@)UL(GJf?a^
z8{99FV#DXOXp(0Y68l_`;d}qah`N?gwHs2ucCSi(ksei9uT$rSjIU&xU;g7UTz++-
zMRqy<an3-XxGkkniqi(0@omYslI!E;8fPa?)t0d0J@%SZskgRlO$W5@M|n)D6)D|;
zOvzMW1JA9j8~2{d-twvd4=Z~Cc>otgQzVdVOR)AhDb)uiMp5_efuIg|Rg<>NV^#^Z
z24ums_$mVQe^996pYQ>Rl(3cpQWp4MK5}ijj2bdF4MUJV^mH<zJiV=fgyGqW#XHkL
zgKVEqFBX9mP$85jfoe7^C*6R(tRgTcfetv`7Ic>Vpdn*Z!-NU43mI7&E>rMA^w={1
z5UA`wLZHB#*qFfohKGaG($WBw&sPoCS;%b<Y+AdT*`oqsy}+=fX)KWCG*I=gFey_O
z@`bML+^@O*2S>&?k?umEPhZ04wjR*Z<{Q)pU#6{4Z`Cj;j_6IO>Re>iVTj=|q8<5~
zHd-NPT)S4Lpe*F~LnoicKU-_!5Mf{Dh7@Hs&wBl~h>W#*+O_-!yM9mYLL`&&*G#$L
zf(RTr^(S**(k(NctsrjJ<_WIqO6RIs@`ByuNpk&ADBSy4Z?Vs7QsB!e3T~{bb-I7d
zme1CvlYP3FU?2W9irukli$F@(^9h5R@()Uuq~X4#X8AKu_blmN3df9_mjw0hSW`3Z
zPP-w15>5X+EUCHs4C^=xNL5^?p<&c8&{O!R=kdl#A0oZZsGQ8mq?Gu90!Xz;hpfIE
zn;h6F*4qg=*+Yq`W_|slT0a&AOqbV#R6q5p%-#9QuF(}^;LT8fexepiBgAHyc9Wi#
zR=246OxuYyZ(})UFlE{g8{c%Y${=$jfFWzT(XHFS=ad!hxl>r6SFhw<wsEKDW5<)Z
zuM~@o-9SAgr5w68u@?kP2&YhET8N<*%1T^twX9Tl%o+}i<K)xhq22Y;EjLTLsBrUY
z?x{P|%V;5{Z3j}5P2DQzdlO&?iV8+xSmNyjULLE#^f;IY#Bl4qX_?`vbot9(9u0-{
z35|*TKWBo$lX#a^!2tTk4+PRW%uccdO9&aJczEPK)A*qr`L@%`Hoj#=KHvCYJVG+l
zVlaK<nVCKonPgCCIJ<fg?`Lc{f%ExbMoL7WdPk8GP+pE~hfV*ekArO^iWMUP7{l^t
zbVR@~Hm!HHAHg(aH$v>}V3?|DvNh=u;3@!}_|#Cc^X(l@uXgKn7mz1YBkGFK6jPFr
z+oqmrbY*DACdjxTbklyQ!g_4YY~|SGc2|;6wbL~MeQt}F{#s)aJ%;K7Mm@2lYE-R)
zjZ+SiBr9;_3uYCtX-*T4ctwe`Rlgol5e(jZKIaJGI`8kUEjc$k85bEsTs=HOR5Ge;
zKRsuf{~SuB17XN|iDYZ4c^^!(7YsDR_MtY-4(GzeA|Cn&<<yw#ky~M_N{5osQqy>L
z+9ar#t~M9G>V<+bOh;FFm_svMNp&538@TNXVD-7kV_<x@5Jm-%p|dJ1Ht91yA6%N)
z?yKq(X*`Wys=#1|82o9XIDoTB!Mse{m*b7o*SLf7GAnj8Rdt;)|L$O3(H(c0R`hfY
ze+6bAJ`Bna$SAHk;Y4(w_?LN~;w&{pjKSc;Im+)_0`LWF-@K6<s)mcJEq%5dVc&Au
z{X`^oV$$>!=DI%O<+8|<eF}vBoX@{=nK`Y8kFmo5&XJO)!`>(sDH_BM^aD^F))Gw+
zI}>cHEI&vKf(Sf>2GzNKxI$yGl-LJv+7Oq*M&Nr>KTC`3lX>(=8`apgk~_8!nWzE=
z5DXHc)FNlxfMUPE5{!ppli8rCV66<3&dOLBNc%(_Z&+KizZD_|QBzxn1b(v{%ku)d
z@#i~k`#2WKY1Cld-+x%qS&M@)#Ut&!D^+UrsL&jh;qJX(Rs7gp>!U`o8GG_REG3B=
zm=?H7v3#(UBGO){n)Q|uT;{%`zI5PXWx&AR_(2!ZW?5mj*ay*R51~Xl?;?cqVL2E#
zC(~`lhoWsAKktuVf{uFXM0cSA&0cFPMY(n%W?f8h9Xj$glxp$TXq;MubX$SuR^Bc`
ztZgm(_;EacpLN^7fMNevfHIf^aZ%W>u!%d$y?Wg6XB=a=-cKVQ4WJ^`$4CK`?g}Jo
zM*Ma5f+eIMOZ|$SW6*j=qlYYFj8)1XLvS4cmmC_wH*TQT2Y@-EDGO)&NxfC0ANB5K
zBvV_d-m_dPbam)Ys210!LX~OxtXC2g?6vkZOdp<_z~{k%uJr6j7QR|JKF;Sou|uoG
zu;ZZ!;%03?tF9V_XujP1eB7uMH`Y`a0n~@OC-MLTNS9?bdauqRJ4->M^V7pFR6aqu
zz9L~8eeq5A!-cLNZ&Ivp@x0>L_%e9?mf20^!+yKgK*gafYvpo%uNfaCD~qBEP5Bz3
zl!bq`4+V#3$<y+o>noWU>F)M@)q-10v8L1K({77`8MMw`L09SpKL-NGpq0UR6boYC
zKZJWa`8I4CZI=&&2g$6TDtIvYxVi%TUt^yzPUjaB5(N7_L!#2<u#8>7pZIXg+~A@J
z>c)O8cn6;L^mtkAPM?)k0aGFEa{R}xWL12rYZTnN(Vh)GHbXrWTU!>zcG(tnyg-cn
zR6kBo?Z@0w++H5GR5Hzj$H2HuyD>2?n^ZO8880M7W-Py9qLZze@!6jpo)B!n;RBgP
z(cq4k?o?;evwR75l}Cv6jwZ)`XegjAe0I+uG30i~3Og%PFaV4TiFrek6Q3Z5=(b%a
zwsV4=F5>&F4|p#nU1ruyeKo!`?FNrAml3gF<Z+2~wWw$EDgv@}5iO7K6sGGc)kcK)
zZ-4n%$@s8(qcI6Am7_!?n-jV|9b>yVP5l)MXP3w2%36pg7N{H^%XYKSgRE&-H9y1S
z)u>^iS|oz9dvn&mr{Qc696HviS?d^eQ;N*!(NasI%YM(nRkeanJwL6-u{(is0-5*#
z=s}UlW%L=(`g9^37_Zokm%sm7X~S9LNLRh^XyT*wR_RsVkTO;9&HJ$@kCT!L<MxT1
zIX>eNRNVLEt5ut66fJc3aoqqUxnOmf<kFBaV~<xi#a1|#l>3h@eaEFFH~yS>Zp)87
zp>O!QMIf$`5Tw8}owgZ^i<+)Zx!QV@FLZAVdPS&n?pSxtcp0gtOcbFkdN{(Zm>~H1
z>aIoW#<Wkj2+H*V252uX;epP!RtB^4hc}@(LtP}Ok8kSYvC*6t)`f!(`q?<Z0<YZ-
zg$^jGDF%=jj*>w`lA;!4CO1N7<G7d<M(;)SE)-WeBE%++<+yz2LKIDw!*lwVtNL8P
z=^LY!S?2v6CdceTJua(vaj6L+CgzK|rm3M0VY{0mp`pSxu+@U9=Du^2@u0q39Ec79
zUM3Hw$xOpxU+(LxB>Ep%to03DovzS2a|gKk<?z<R{W**Sg<J%uCXa-gkMqx!qrJk@
z9m<dSH-7G8+e!7Dn&RiI42q39Ap!pRgt3pdlUIUsuD)fBHO5xKt5aU@smHnn?3$c<
z8gjf`#B35s8Og5TD+nCdnsa+a>6!l+)Sq71sMo30=sr0_evK`idz{duU|Qg8wC{)t
zDs<LHrO4+jRMO%9(OouC^A*RFl9G`D0{gG1o@opbo8?RS&$srNm2#5i2`G4Z)(I$d
z>4?Nen7{D4woX*S1*v~*L=ZIv<Wzpz)U(~-&bTcfCEw@-6U{zL?gj)SY6yf242kX4
zZNXYcMg^Trl{fb}yMbHWDqaiJAo{Q6hwlZ)6(`(6<>J5?`wBwG23p3CkQZS?f<3E)
zl_Fq4gGchzx@{0Zod^H5g*@x}0nBnU^-LWva~>0x{dp-YR2FDKCpv7EAI^Hzz-K>0
z>$KFgZc}NpRd4BfBt&`2H`m`s4Lw*J{*s4dIE9SLR`fW^n}-Zo+k9J=cDmI_+L%+p
zsJNB+kSPhcRNAolVddrrd9m3|?-RZ6Rn7t0<FTO2hMjt)<+SS2uAEYoseS%AfeUg_
zr|EPbQr~rAm9`hh#i)=h?A|b;^~Wd<T#tWQ9!v{Fmo2TWSEWoA@MD02(^!DT;PwdV
zq@`C>F)YuZcT%mNhDgic5N^u;^%%)swkjL!3e?oYvNG<kjuu<{f%kFoibDzloPf%=
z2<r6~d+d*aruF@@pF2uhSRuRr;uhP9xU}eTqSmg+(kz{f$>DZ?!4cUz)9GqNQr(s4
z8dJO5cMkaq#oKJFXH2quRuPR`J_;9ZXkI|tyF6@K?#)t*Emf^DlRPy|-D(#xd%ZE{
zaxBo<kVq{SAyC1!SAUi1f|&RFaVA~9yjLgl>;Q*WySlcYd2t=t2%GzM3pP?n$KLQj
zKA|ByrP?;ebzRV-vNw_A%SY1p<!asT)5L!iyoYqecYQA){`rjTJhWxIUlf(WElIA6
zkJ%V2<MDt<S53bHkFr?%)a9+DrA+b0@T{+^`f84@KBC_oobE8&l3qy-%!QkCQQVjC
zzygsJevsoiSBNt~BF^+|Ty}|QI9s?wsD&gbMw;7u&QDQd+u!C+O%Y?arxS#Bo_*A{
zxf#O-MvQrxPjCWO(dD`aYK19?klL}&vfpANLxC-iw!ZLrRFe8Vq06-12eUHyc8@fi
z;+g`6*R894cshqpLg!z_*@M&dPZ{^kR?Zs#69Z>`)5q6=kFV;R&wpJ}mCoY7MDXWp
zM|Y9du#k=e%Cq^4c0k8h+4i)&GS~<?)98q>?GixRH!euKf5N+wX?_oYZ{A>0=l+s?
zv~V!vbv%EJ<csxDh`#UCBnS&ZHlNcB_8Fs`i?BfKA(YlPC%u&~?4fRZmb&?I+nYIh
zpR<#VZqA(*0;yms4ymI0zIxf}<L9NNP9`mF8jmCEpF1OGypleJgc4c|WtK(_eGGkC
z_Ez7(V)Xt%YVS~1x9Rs(^PZ+Sawxy!eD41t?Y*O#`nGp(1rZccKmkQS1Oe$vm5xd;
zq97fDN(n`JF9ETE^xlhfsiC(}EFhiGTYxAXLhlgDUGaO)J@<DHc;7Kz|6&XoA$#q;
z*P3%a&-_eaZ;Ib2^Kx)V*YkoIX6s`VEGkvMMBIJ$J;8od@oK`R68K^cei8AJo=3YS
zC2G9JMp6xRFzj@cu5KK!#aRnZqr`zy+es6a{4lV5V=&tMK24M~#v;JI+nrBEr>XZ*
zUp7I0CMb9C8o+*7RFpecL_un+UCWA2EILa*A;lE}x79I!s?2yGf$7O$Ax)XBsJ{eP
z!?L-~XB5S{$%E7`Bv=B%_1GtnuZa^>L23>)?7UxKrDl0Z*LDqS)75iD@-}6CG86~t
zG8uK?liMik(5!uyLHa_tqSv8gCPIzZabajYVAo~^lXQ#EwDRh1p)7?d{jYuIintEG
z5B+`Flli}%+~2V>Ia;bfM;0NOs2+E=OTHH|4j<6DzUpAml8ACI^@F?_EQ7w2d=Cjf
z>|F2-)r3Cj&V0_Y<Ao2lc-(pHN0A(RsLD>Cv~X6<?BJhRu;m*+N!~S1)rK1n!LZnK
z*&0h>&$m-g;B-iy@m^%dCG7qEV6Fl~@vfM?^Y=^ub>~h&8Xiu!acjosehPF|PfcY|
zt>sakOe2VZ*W`SRC<F~T;XygO;PA2e_4RDkQhEH62^<ZI9wPG}X6k9VGZYQx@+$Dj
zMnW`xzk*I)YEP$7>Uyq9E8=Kx&a(+C4lXtAZpU0QTgtsz1?tp((BB9^%T!M>;asU{
zq5%os-fy4eylap3mE3(U@5m2wU5Rr=ODs!Dnw)1C_pq-MJ$_^tYO-THHY?$IP?>$Z
z7>b1Sz9xJ&ic05SK`y_Rk(%3EJajyYWaU=eTIhEeu;}rf#iy<I6UI#4^o<ciF@`g%
z@L~=qZlY_k+<UL4*{XUJYAGlw&C4r}=T-}R=scefz|k+_eg=5TluEkKa*4GUpN|<Y
zRP~w$x%2pklMMsKwYXYR=}PD1n%3divjJZ)vo4%GoLt%M`qG0wys}T9bkYS|_LU<_
zFVaA<EL&)T<pWr9EW0MNF?CvAozLcZ1`RlbF?idvM=xmRtJhIgsA|K04ob|d8%-!;
zo>e<QPDG~6{XAQ>bU58G%g1<QCVzkz0P4Mv@|^5t!S2Eia|Ydf4|J~UW>K_B6xY=t
zmtOPOO=)#o^s{nptA7em5+j{h3~3E;5@2bEsa>REd)*^3A3eW41%G@14z-ZF!}BBY
zek)XqN865s44Y@1(PIj9^TQnqS=T0LREVElp}E)YU}TY&N!H`=NSIc{Nr~FP**|uW
zp&2Q0oX5IqNqvOf7>2S>x76V$Fgt&hJjR-Kt)4I8Vr<N*$6D3)e@aRi_#zuz(6c;_
zNZgnUI1+r|+Un4K+1<UB%i9+zVPNK$fN`Av;!9<4opTvluw<K5#p8Kkl*k`$P5<in
z2;Xjlle1lz<PJD8TKs}O9#=T72M>78b*BZtE>smYOAKd8o?D{Gvm>;p7RckK_U$qo
zt-LUR-HnP}8LfKf;IZn-i@bG0=?bWeZ~xpqFZ<2}Ar0z%n+rvLznIN@as(D6(2@;I
z>g==cXTxUrXTbJRjiH*c81OJ$PBUsDPPfmxY-c;IV0SQN%NzE4?8B{Qc>R&d05;P`
zr^>F3wK9*rjCZ#Hp(CH4Yp$?1(J1BrvVPkwKrNuktQRvC`!Y-T$T1nv1Lc4ZJgr3I
zcgV$5v$q#1IPQW$LUM!AQ*MVlqrKncebUOf&R<@H24#625L|Vro!K6wITnuO(0&Ao
z=kNFEFK9d3-Xf8j+a{sz3)i)-de|Dx%`I`T8{QtjQx57t(wd)wKFY=LqN=k*O|*|i
zk9O6bgrpX!8%~VKkfg6SMj9c<Ve2g{$vR~>#`(_Dx%;$VlA@9Dd{kiR5e_r$jyn(L
zMwAxRCV=S_T(K7V2yxw=2z@*<>b%9(U)kN4_s2)wSM*blz1ENt?n?S3B9+Dl_15%{
zPzGg5ho#3!wdbjYby&;I2P*Y0Qm~l@+6@`?n3-K<Pvp}|F>Ca@#`-#nzi=ScSeF;>
zHPaDz-$~eO_1D8H#1j6KHFHj1NOunQ+lgA<zxMQ>v;c$-cCqC$MPNv)ef!ww@~4^h
zig#oqnY1OsX0r8SW)CNAxr6Q}E;z*>RriX_7uUkeDtbec^ax)*@?#j(8LhUTrGrT4
zZ(ZljR0&fAY}TxJhrWm5%oRfM{6HxM<Ji7yZ&N9C1#W&=L|KQ-X>JS8e+gORu781d
z{?8jjhv`*>&_pN9+>PaIXj8`L6Q1}TmNULn0&KDK0Lc5q?XFn8B@~hCO$p*AUVJjQ
z8s~9W1DQZi2(-h<0D-O2cX%evQv1y5u7;&SZl;pkRA^J;nTT>0RHEB#lFPv}_QSs8
zb}kTz^||z<n~`6=X?;uJLw!LPeS^KBtei5tSh!e~h0^BYS|J6InIW8~-ar4*(mTQ{
zf*bpnvg&xoE$)O2{^U3%hy7E8NC4V18=D`lwr2%)XJil!L*Pxpb@%EYKEb|09x>32
zh$1{G2+CY`Q4BZZRDe^B^Glv|b~Km%ZC;ah1xJHJo!T<>JHlnJ+TBv?kM`RZnv?J5
zYQUx)T6b2CEBWfhs$xn88`F#Lc^+J2r%-u2e~-?>@w$b$m%CjSy+SVK*P}yhz8l$C
z;tOAWj}deoF(pStw;_ZtOZ%Qz(Cgv-cQv~cF0<FS_u}=?L)7=zef6GBJg>g%o_J)1
zKJury<nk@2WUUr49KhB6Tm{UBjr4vOrgo$hvzlsez1*i{Mu8f@H@6Jt(sz$Dyh7K9
z4tQXjY+9vW=-She&6*VNlw@JMaz$LvD6riHwOG74xucr@?zec7*b1_<VC`2y?8_DC
zarFvZyF_<tK1-GID%!B0rTZDlO6^YQ#`xUPe%(SD+Cfc?9j2~kFX!d>Ac{+u%et;g
zvhK(&ALcfz*$WwSHqeDfyj*rLp-$+1#^<`8Kt2CzW$|)X#@6yMYW+lKjieLVpU{Qd
z{7;|sh2f*N%k2DWb~?<5!a_pehaBdyRn=TxJ{FZ(UjFdvVS|2@!EjcS>RA2=?K;?B
zVz?{0YYHQ7oDEHSi`YLXCEAp5-<IRTY`7_Jq<zR9<G<ZgeV*3Ec75tXI9`sVH{MJF
z)NV{T=P~@gL7fNdlTbQB_nTwGFbHC7%q01%bK>}MfxcJF3n|t%Wm)g3&cr6+q*~d9
zdbb3iR_L(idETp!qhsgc8I@O_cBjMMH7i45me9SHS(q}D@4*_v*;iSf=pgg+SleHt
zH|Do1kdxT>0Z%7{m38tDX9NB6ij9gutE?>nK7y$84L}cLrC^JY$WL6JP1@9pvy%7s
z$Jlc~QY$0aH3!l!*jq!9sKLxOGkpWM@}l6Tli^Rp(m1))JR3BRGBPq5p`1vhb_aYP
zQ22gvGV5P_m7IckfcEyiq|YaEs%7L{{vW}J@g*&;<@fe&32SU4FgX>QM^DZ9DAO~@
zN{DlvX2Jz*0h~JdxEI$%8T0;Nby5H>DU}*Y-WU*4=tqNDneNY>p7T-q|MV%ozA-T|
zQ`BS#r=|6axXbtg0)rsWW+0nyPEJmo(%J0&`6})y5-+W+d;q##!@zPp+_`N3<HWQB
zw@nOd;g(F8;SoMrCa#nA^+CC<*{Q$%kOdb{avp|&e|n5>C8fG*e~g}Lc9ImJ#C@6d
zpP-!>bSP)X7Ox?Gp3Vn3mm*0|0GesZ-gDopI2H8}Qu{}$#R>RVK%TUd`?LS_o0<0K
zW>%S*XZ~>u5lkw!i=8f@8{lr=9VRAuJv|zrf??xqjZa;PZ)~`gfI0nfgBVIl71lM6
zp4#^<xqS_{5Fla<4yFQK>`3Q;+`nqv7yb|S$FBa&z$th8?73pFW*{cTHL_m-o|^jQ
z5pK61)2-J!KEkh_Zp(P{2G=P6=+UD)rF!>QD1=N~F5|kV&K&`fEuYY7-6%DJOI^xt
z_HxU^;7^LD^$U;^33!LIgd6Rk3G<H@^;E?Py<XgU?(JKDyr+5jmKYbXBSqltZJa}i
zv>l%6@|dFcW|UQF9*6m4yf~^+%`r-$ahPW1c3huo`Sy%);%iD;vGp+-s}?;Rn33o+
z&T*c4M~IBBo?SwUdrVc%Be`@QcnMVH1n7S}&j8}2Tf5n@e4OE#(4J45N;llKPj7#x
z#}F)*D!DN$x24a=+O1!sqGAE2PVZa3T|S%0@gM6ezYPQYnp><n22V2woU42zMxFZf
zn}=$#)HfQh3Tj{9prFe^lJA53hRU#?O>F~SNfXPZymhrdz@IvQs`CR+_80m`lku@P
zBj6b@{P8}e-QH~Zr!(Kh258zJuV^zeY-=$xIxt*+d42a(r(OujxkdW-kXC{LIp6Q#
z5tNLXn4ARk6%H35dvq;+?-zzQ=K5=W5C`|WTlzGoJ@DssX1^JD|G;JL3+t177A{EM
zo2gB_et{RSUZws6sxh@8V7MkJE3-J}+>mb8V@x79g-n)RpJ`Ek`siWIsaIO8B>C=2
zlS)EFnyku$vqZ{G&r@Bz-`u#6;-bU$Q1;JrX+ZzzY^g~@9loscSqpuWQ(qm)UmirJ
zFBc}H`Q23tHf;Af#Igo_iAE&fbLO7?<P}U4Z78eKdY>IH66~x25rq}MsZKM5obhfa
z?Fzk8W%of&oc*y%-9c4GNMsQUDL$!r#=pHo1hc-r?Jh4L{Dsv=l+N`zJ9ef$mht!R
z-{%-qSyKNSb^D)%;b8*}@NcVSq-1^%osK*@d#;BCV7ufxBE;FtPhSeq%}-irfve?)
z$IV|F9lCbvrGgIxGqiC><^`$rUjL5&e4+pPi9QieCvRkOO%7}p-o6fTMgKi$@jtO=
zf;ZS?zJLD?C=T8?;!oWH=-)^Rp99PnC8Yr1>7mtneY*J<@D{j8!7KUf*|PxO2lm3-
zCl*`()&B1V8tcKS*5|vL)gXLgO8C#^HHS$4^9X~#{@88t#2n;be&#F+m&2{Wj7J|X
zrke=oU;FPd3IFjuf4xE62RATqS{{|Bp9q*9`WtuV;G(H{=0}p7<i4x94GMqzs)c75
z8F-YMf==HA>3^x<2t(9-reA&kpF|L1;NqBcTKpT}!t>l0vfqS0>VNr*Hcp_!&b04K
z=;Bb(<3~<QBa!JOad7$LM9{UrXndIeJiBK&F|hX3GYpu&zkt6&_B=Q~{?xNZ^4I7^
zQr`y^;|Zs=Ie>E4XL5i``hR`Q|GqDQzV<4}8>fFQB9F6pWZuUCRgX`<C7tnSynQ!h
zke~klevD+T+tw67&}PUqxVqyd`~}N&hSId_vo~1lcal<PBn++ovK|`@Au%y`1F88L
zNNpjTLaZm4lK%C?p5?+(dxRNY&2}aR_!6x`JC;t3s_1PX=k992AVYuqKyPla@fFl=
z>+DTO8vys)Zg9NF>GpYWbHOVhWIrQ^!_N5HD<X&gYw!8jYkiIs+!qj>-@3&O0`zkX
zc*nN(KBqsO3GO)F7YK#H5-iUPF`m8z-Z=aS&J~JNzlauPJI4O90-m@X>kp-B;|Egv
zFE?NBET=|34iQ6EiHs3Bz5n4?&BcFv)MmF>ZR}2e<nW&U(?9^Wt24=*6{qi4lI5hn
z|JzpSpY=`pKU?$v{S&F=zc)*w&pxgB|M!3Yr`8Uf4F9lvys62Cr@d|df{i>ECkgz<
zQZh1Oajac*96RqMO^7_I%*)!{mPmvOkKdG9!Lmv#C%4-la5SB~k9*VOcr;H3eIJ0r
zr*^eNESQ%nKVUtCQ)(>eynux=L$%RQwZe+FYAY(9NhL}2;iisFE|Kpdy54}RHZRlk
zvS1=E%H^7IG#e@u7d_=Mk*o$-G=NaMFiu9sUa!X#yt%+we_Yo#|9UI3w{sA1JX%5?
z;-`ax08FzaK^o6uATP3^Vd}DtnDl%Pl@7PL6lEgky~~I#pIb)g@x#sz5cjC$Xx6uD
zJ0a7XcHUi)2z!!v%V~xA@%bwupc(2k^#Z($faXN@r%^RBZoc7DIM4d<Gak$RT(k4^
z9^HKO-SCyG>vBk|x?HVJJnuqZ1&Hj@?l1iH_QG!vOAZ%ehxrj@fK6b`Dtgsus$KWG
zsAMro9<*83A99t!x9JWG*Zrr-=_qH!uWg*R6mfWQwoF`HT)TK=y_v{}lpiwb7s3ZF
zlE^5<@+F0mnVmI$<!<UC4Nn95hqvVWXt~x8o%(#FYbhn*tYsJ1p5Q=0dob9*$eh=m
z2~~FMQ}SkG3s183v1~gpV@~rIKVb(XuzMK%*${n%6O&m1bKsLXi6xiP=&cG>rWNi!
z75Ayv)!vTDs<}@NuQA@{0%Z<|<-TqOV>RXVStK_aRu5r*lEC40xK%NjXzKSFRL7%I
zrTtvWN<yme=9lgwM@wcF(~PC*A4%sOi*(gz%DnHqf7;s(SWUZ+JUnWEJDfm;K2>)|
z*65oEacw|BftqfnQY^i(LiD!z;Hz5aQd36Va;q(KuRSkr1<>&CQZ`H+=YEXcx@k0-
z*|GlPii85dK`=3h>QM`P;Ra<}#WLO<FzG!++Fu1$<@t?(N)9gT)(qsZJ1>{x*UKE+
zC60I16rwoHE)rB!PCBt_<i)@gHn13Yeaq$z-rAA<&1I$!7b(K7<T;4l;y#oDvn$Lv
zsUq5PHKP&B=8hxRM1VOk7{{k!ojN?+-@=uwfonaS9iGS9VO_6$k&<K1v96DDpy2T5
zImg#mlri@68S2wLiaD+QnuDRBO+W-;wu%{kW~g-L^#b3Dd$z|~V^5{+<B}z1!LhrJ
z`7l^kz>pVsho|k$uRTn8^kKS%WxqLC;>f6n#_YCzE%MV<NZ3T9KQ@V{vG_=~Y%zR#
zy<gJ;cdkVO<1;^!la1|Bjz&J4Ghh7}n}_E@k{Zod^WD8!%i{f9xKWzAq`v<b4DY2Y
z#F3Z+3ywf)fmNQ~Lj!kM`D;|U^0@1cnA%E%xJf9(hv{+mWdVQnoado{$|1^#1}4JC
znKe8e;t6}Tpo_k$!OcmyvB53R`G64An+vMf6?k<_vD*fB#;K)?TsJ6(5zcUm`Ad<y
zR#ozG0#)PI-OezHXbx>QOx<B;rFuY6agr+|pg7$$YKzJrxPLXle!l(3701wG<2JW4
z<B#=&XHORT&v=)RcZnnZ-DV52KC8-9lcj5>=say>zuQ?_FZn%o#&+yB@;hoZ%%F>v
zR84MWz=te*{xUW5233vWh~x85?meYXM!ZGLr);v-F$z0u>~B_cF5M6wHS3)i!trnf
z$45D&Z(E85Io+%0w+`yPohOp%l$h*Qt|Sw1-LhvZ-AU}&ef|R<K3m*G7Sd3q6*#a}
z1L%t2FXuuY_G~W;bUGrS2d;BR!ur;ZdG!bNROwQm$W8WEfB&$1Hf?S)j!sT_d|n~C
zlQvQLAW>0J_^SJu=bG$F3yI)ZW=Ur)d~d=3TH?3~{@^W=_o8c4YRop%nEd$R!TWX%
z_p;RxQ5MK4?R<Rz5HNCG-m}g8wsXDO%Sh_|1;4&8wjWBoa2Otdj}d9h?!Xx|V@21d
zdDoSf65SkUp5p*WGuLQE#O~bkENvFj2kqjmVwNjms1?)c%3=1c5&kz@KP`AwN#<%S
z2%gcEzkM%UwW7OY0s4q3cFmb-g`JA7Ks~pFh98nyKG5}ozbpCA;q^a$ie>nG2*dSp
zzBQI=$mutbZxdNr|K2;%dx#aA@1H?@rcDQ+sNh~2iW{srq78>Ns$9R6*9ElnCX|<&
zlp1b<HgyPXH_k(KReh;PaXNgOy+=6U8X#+F!1qVx$s%>KYyoV=c)6ycNAx444Q0)o
zP81+2VxFfIci^Y#V`EO(eMor4O{dyveyVI=NtEsRU2DfD$Wj^N=b^w^-8rQ<Uo?0#
z+sttterS?7D3-`Ynv!M^$8XI_c$sE%gu9HOHmEXYuw#zW{cvrvX}X|%NlEhC7@0NP
z`FP>T{^~@+v)jW=q}{tCGR2-h&etE)>J9Gd#2)_4T}IvihM*I3$HLI10w1gk8)<!U
zi$(nElr)7$`75XpY2DH$lm-oDNE(d)))C~*N_#T2u5a6XQ(G?IP)p?9QuZN!qESne
z;*#{NW<3Ob)W!{HTxr;XW2?Xo<4S8VKxf&Z{xP90BYyRr;7f9xq_)+Ej)#GQ0+E_f
zB}ak&=L#Kh=y?tlZ-1@<bCvxxIVWT>X%m7YG3a@8OF!Abzv2|t=r7?EwRD5FC54g0
zBa1DPy=_8zrKQNQX==eDte1OlV5SSkCz;l(c8C>byx$plIFCmLqr<S<lh4FqN{;6?
z1~=7o%U{d?&P?3CUjiMDZ)I1@YUBN(LQt_tF>)5pT8txZ0b5U0xp`#X(K;^<@O6Xr
zGqNLjm_#|g88AtZ&4Ojlt!Q5&IPqr5Du6-RHBR?;P|60;gjR1+?~y>#9q&5RPrN?t
z6((Fd`J@F&(?crX>)Y*evBH)gqen*InhL=CS~JpV^iZwW)Q@^6ed|(bxV9Pxt?(v%
zbFp8Sl2ce6|4{{OKfA6c4g15Sq7;wpao#m4L2d81?*=rt)0#xB`(3q6fW~cVo+b!U
zDaZ)X$ttqS%C@U^TDs%9F-1Yrpp?MZI1Zem#wZOnXGse_Q_=~Pb-n$7*=&7~R+r@a
zC;QWT__V_A1X?4dX23kVo1hKfnU8-YD>4Obcaa9<Ee^D<^jF7*#&wG1xTPhD{SU|d
zj&P?szbpP<jDQ}MDC`vS@-bnos|Zm<<TmwPQ*>RTs~`>x#U9vK=4tV&FGmfTEB+YZ
zjMmpCt|Y_}CGEby_OQ@cQG(|zO@5<|`jT5`Ek=0&?iCo|<(i;YVf0B|<RQN3vV8A5
zv$%UAPX{tAoWno1jmyAa?iDv~r^=HUTgTI(`^K|@seBW5L(Kd=g=ytz4f|m-_1sp$
zT;nCcx5!@kyio#ie+;_#Q%gG2n__re-}Y56usw?h{pJx9V}pTX-o7Pk&QID;fgBlq
zlGM{nIM?Azv_!u{LbNz^^lqxSZWB4TX}Z#+mM+mlhDRMxm<3eHmdLUNx4`pvEgj1}
zOPtDv@03YOp;>N)%errsUU^9&ex$qrh*2Dv0H;+8TB1Z%4BtTK;%?<IgrFGHZ=H~8
zxQppeR;;p{&U@R0%JBSwX<u8Epq}e`<Ky1*rulG5rQfv6(dix|e{it4i)M~GqEDz{
zAYVdZ5@QVrEI%ujALHV)EoxsElc5*z^1jZ<8{0ZGuKT4e&`pTx64{RLIg&?a7r8i}
z7lfZb!`H9zGWWU@8GF7)QL1!4y{s8;>O)!8IjX~D*0O3Q@KCW#vM4zT*b}Cf76IG~
zD;|jQ)-Jyp7RhP?FTsL?H<8F^qhwi&Oox@VFSVwgC^Y(sjF`x1`wk!(#sb(11aoz!
zL7~=SLD*8*{E=*HCCo8Hgw$5xsPj|I$=%!D9Ay9C1#Qwz06@p!iCoMqL6z;HplY7h
zeRw&qwyE1>ezEN&Gc<an49??7mGJS{1RS7jfQ>ko>$>rCMd|lEFm)?Z)><zxS2}kw
zeANjVOycVgrF)#!CmdK-qA3C!>m8bfL>$+OejB^99lf{T55rzgtQinnbFprT=1$f`
zeS1eZ4Uld%BYess1MaI^U3iUgN3G61&o#jAYZJ$v^IV<_vG_b?VbdW3o5WtSI9tyz
zC_Q!w2acLYt(blKwB?fDA9{08i*`YCFxzqrm65qEHC$|5Ti*R4l%t*K=D%40$e{cD
zLW>mpdhTL9KOhdCxQV$GrZ$AB4rv>}Yg!+?Exm%vXtFhaK=|r)Jlp`ps=bEt?V$5u
zlEXDw^Kap^1}^eHYd4E)WA}iuqw^;k^Z8^E_>E*HpaL`W<kZq!<7X&kR1@JF3rFzw
zjwL1S0liMaXfr$XO0^0&b=@e6%Y(ypF2*rwEYK-yM(EH_ARG-8Tf(S@5b@|E4Zk?S
zabMe!QQCT-R-5R|hiqazcOpip7M$o`wX*jb?fO1j?x>Yf8)9GF6yGjBs@s~OsRBUA
zYjknc3wyIN2tnn+1F$t~o7HzxXQ$44cN*<4mT)T-&6jQ$^~#(1<+9LWIF;iPs9jUj
z6g_&ahEa&%=r}Ck80pL>+r@WuI@3RrJv;Av4c+2=EeP}gVAqt%98vj#ZGD<G@ATYi
zDrV~$#oXM2^K6bQ+y##62HQ^I#~BrXLS^b7q&w>A(OH_~R!EeBFG4L<)#<i7L-)t+
z{<=Hq(ta1E%U^4ge_F1c9k)PxZr3jAUL)&yHTdxhNBv&Vj6-J?ud^*u9|?tUceZbc
zZnU>!g%0kcH$>6CzF&!?loACVI|$uE0wN~5q}|yIRla1my{LVEyfvPC#{MSnIiORp
zWCg^Y&1f6_-Cv`OiJIYg4EgZ$q0-`W*DA!$x`;;VYlLJ&CtRS-aWI1e%(e~)a+J6L
zJe$t%^e<n)jJ_9VQHi4mF>zQ=#rS-GyOlf>{QPCYPXr7-BjdjXYW?_MI>bBC*4jzC
z@bB(OzPn_pQ~zR0Va|-}cuIu*>oQFi5AufCJgqO7+FV+t7q(I>Ou(@CR$e3IdquG8
z29=!dj{*CQOH!tLk^Ao3E#fDaQg#jK+1L~w1sE^lzmjPvUovPpRHj>3?VGmLxPh6|
zt!LZG;k)d4xTVSJ4rPMBV&8d7Ij)+Sr@8FItW4eZfU&z^Mc~zx?E1H_w;_!NfLrn5
zqQ12Vm`#I679KcE8Fzii9y7Qzc4u1Qi*7|!?3HhWkD*3$?EzC(;6h6!&=wh)Fx8dg
zD~46s(=wL>DcCjIGCSgpfww3qiz`L~rGz(L@WY?SdD+8RByqlHBam*{Fe?${KJxxE
z!7-nHmMNPMOU;R4&$A{(ty4>Qrq=XkB_~ac<E+89Oh?O?hfmqGo|6F}?u7&zGPW<?
zL?m)9R`B|5zar-P9e95Jz98C7*Fl>JxpcU*-)xT*x1`)Viqkh>ut@z~<GSINM7~m;
z)W&8Uaf7TafNHKz{!6`9Eg+=*s7Yc<!50bcxH%YGbuVwj!AbrHHm(%}J9!MQm<~Z;
zP)M@5#li%Js^<5B<_Ilv=RD&Ghnb(z1_c!Q+vbx$J0Q^deFee!k&KefTlb#I!1xCA
zv)Ue6j@5|EpQYcC|M|q^l9cGy=0-8F$swCa(JKi$0;VqYnp~7(-?&I$I!4fVVQ9op
zu5f)l#-rkf@YxAA$v=Ji^hLYx)9-u7x_2!{oK}1KGVC1WV>)H-rAkR%uy<<MLEnn_
z{gdOPmZ3Zo+VXIuUuKiJnWJ3sDDOfN!V%U28%b?coca)DIo4FI2DhS(<#A2bj(Ubi
z2Be`7yXjn)F=&Y_UD)p*A6=&XV#E!jHa$wBuT|HD6nXTO*)5d~wi4ox^VZ2VHg=||
z`8f5I%wm>3m)4Cv#HZD=b+gJ5fxxU3F0K+7Xg7!n8Y@$68^?SXC%h?O73R4@64IOX
zq>a1&hym0;!*}+#$jVB}X+`RzWMozw?JatLYW>XJ(JeM=;c;F5Fp#9qWBS6&b^TLQ
zP3yQzNkx0ieKlZkdKH(u6BB%-_$yD5YMxvs36(S^G9718u+71<6Fy-P?c88r1&_)f
zY56YgKL%rQHe(j+wz}l_39ceeXVFR7bDVyjgpQh9s5;4lfI)Qu4l6pjL?O9AG#C8Q
zQAX-Zk?=D~j*j$zYOcd~SNQz}*&ks%uAbAa&lwQ5z>MW)m0DoYijx4LrSL(aKhJza
z4Qn>O__EvB<T9P;-AVBz`Z`!gyog%sn5$5|l*|RGxsLjN4DFsnj}d$}+W=l5x;JGQ
zCgN;0T;rO1>85xO##JH0H$<I1D#p`^Ze&<&r!PE5ovp3f@n(BNdmSBmag>dKn9{*u
z(7A;!-{qG#^9=E>mA;5#==Tqe%R1S{D|Pqd6D2^CWUFT0LYb7Nr=f`w9AZs<p{A_`
z=T@I+KpO4&MM9v#$1VYUb?}tAw(Swen=YJ_>B#QPeqz-uD@)$5MMlHxE)VY~My8e6
z=XD6iRz+bH4^h?#<>mTg@v7VfuZNlGyP4AT6GLm0s&$XlF=V63`v?2AJ=(lk0cV28
zOmM4fJt%mJxc^JyYzG<HQ*WXSEU@lQt+6Ciz`ElSl<i3aXvKISUti&{L%-fVT&wPh
z&aUGgE$ik*iZbDkuVAc_L-EKYjy>cS#(KLj8P(%o#Qm+Dki4&UpTZ4}gRcvXH2d5i
zdcCq29q!Y4v1|Bj63Raj(Han2BIZAe4QCFD2C&cgCNr>3l|O>S;o=puCb4F*aNVL;
zg000&#OXNG4y$4`S2Q%)dfK(R%6jX!d!0ssR-K$x-8}P-(6jFQ>kAgvmBC`pd@h*}
z`79LutaX4?>?uwo@aX)N8zy6MOIci+j(}?n7iK3-`M|ohvk-%Sa;<qa{>>37YT8cT
z#l_`UyKmtp-v!5}C;CR9y;0-Y+vMsg6|9rx#I$GOlVW!=^L|%PbGrBAKe?yHqT5>J
zyoqWDSL#qK9Xg_PD~<43do64ouT<W8y4&2k^bc_w8tz-)m#uf24TB|&-LF(HMh5wm
zF>UFv7F85XZ|(sOm*PqVwz<!YHzBUFjbEa<Mu>MhGhU&(&0*Gym@>|luI3``<;<Vb
zie-ozD7oo!pijJ*$;}tJdR3|I33Ri|oUC<b6uw>Y)H`b|Jy|Q*W$eaiw{ewDh37+^
z8;TEIt&#xTe%F1w<Fr#uR?^Fe77SXrefzdImG9F>1ViPPhyZ@b+s;H0iKHAZ61D7C
zp!%B;{@#ZvsnB&}hLdMK?LKH>?{R_6`~Qj-cIMfj*Q&RxpjJ*IXSLp3G^UM9u2ZBi
zOIhg=*=Ju{(iMzba$Y&oSP-m4j#eDSiJH9yg5jVrp9Hic$?*IOQDT^vHr#O^vk^1&
zz&<t;*z;Tj1b5;EY7Iup%$TMFGkg*RlsiRD7Mmch=km&p+s3)XAYRhugE{j_mM{CY
zlUY=b7{t&EwAQb6N==!6d~`!fR;jupJSY(L!(5<msKSb|C3zp#^B(=~yqD?COI>T`
z7BOa$4fZ$Kki;GcXt0z_HE0TuPikB~yu5^J-9U;>c0QXZ*ma&w_By&xZV>!Q@W<B;
z#H+;cm=!_vB2T!K?$VapMx3eV)v*yrmu`#K4oXz*!4m$B&NuFMH1U`l9o!(LKBHUb
zk>OF~ls{*uc>CM8)Q7&AKb6wC1Ky+SKJ|$K&!oiB>Y(S)$@&i%ydliU@XJnWXl<Uj
zotTR2IyYLymrFT9&>Hf|mnd4)bv>p7hEM1O(=r~3KH|~G0=zC-+Te`O`*Vuhi^H@A
zm6$3(!!&VLE|JDt3hR+og&U8xfz_Dq0@W{2Fx@yJzJXM$(Ynu=;v94?xk=byWxhRD
zB2fHt3z+YEn*h#9pCU7*xS>2GmgbnWH9w!dqgrZ8#`tjCv3%C8e5<0?Q9^#N58I`8
z$0wL3D%o>idwsSI>Pg7A8&V3TWc<CQ-F+scbF|yukBXc5LtxGIeKCdBZKQ;-l~4Nt
zIVhDT#{L>v)>GjXG05K;6<tABJVCh*=*}{gC6*t9TJRms0=<Fk<)g*7j`4z?tb*e%
zX^8x?v_ZvB_5D|pPp&rnx`o@*LKJ!Te1aiBZ)L(0erNPEK-=!u*PZpTI+%$Sd7`>4
z*zc+k{gN8tnOEA9YTd_-op?n@BNtCrgCswa725rAXUy~{-7vXRNp=qJ`HR_3c*bv-
za%~a>sy?@_0^F}Yb76*YB0rop8m|URu)QNBSrraGWyfib!QI?;Ij@kV=1|6HKAsfr
zgUw(rbt75~v?Xl(lOylUq>UyKKr@|#ERL$1v<D>XexDcOb8Z_Q?xo#${UA|R=;WX@
zy%wOn^thtmfBZ=9E9dT600#fDect1c3BJLOPe`JCEnTAnk>Pb*C$B)4YzpN&MUUdc
z<)t<@_q=`ix@Q=O=zrZ^9dpJSZA5Vvw`m2<=PrpDp^px6069YejSGyS$}ytrUGKnj
z_od}?13|RUy#M15_&<NTAtMQu0z%nEAqJlI5F17!`p<a#$>Fn^u8gO=2K4q9flPT*
zLf|q~MrwveeEBa7n*jFD62b$L=fH<AU$=#x{D9y}qeeR3{#4uw!2AY&b&1Gs@-M$?
z;|*vn7l?@s%`z{EKN+PvdD(GKPAm?+I_29O@wiF(RO=mmND+a98FO@7V}Ngfn9?Zi
zUp`M0w^+b%$EP+!`)HZwR9lO80ISV>57VchAZF6g`#wI1)4ekE8@QzS!Go9^WU*d%
zUGYvn5OEI$Pt=<k+~AAb+KxY|DNjc?o$=1Q4Kyv_!n|<t;wu@cf$OSCcz^k-jGu)V
z^th;a8F)HFY*_xX@U&;yNy(_GTLXOac=JRroW4#s9=`#TUak`^|K-neu#?i#a<=<6
z7yoE`cXF_adrm{@a0ungmrcwvH)+oooaTH3MxKFde+oAMC6XspBYNssiZgigIK>Ze
z!0^cCMK0-`3h@EU$Vy5<!30iWVEvz2U4MT1(xk&Bm6R?CG4wbSRSKWJF4}6pfI>wM
zTtp8aJ_MH@_qbi{FPH9#2aNCJiDY2SK?CREM{oAOJj9L!e6qk7l_yds`WIu=Jo9Ho
z-YPvVAkBfdw>l7y>Mzs1{4dV+DB)(9kdp(Nk$=$r;L|7VNLF8%3m~$SO1~-bw~xdS
zn+6d@nY8XtwqHHnl@&6Br-4Inf!|cHhjE=gDOK_e(Odv-juRf)*?R+`45u%>8QbTU
z9Q}Xq!fLKue;Hi+hUlL+Qc~(ofMD?H4kgJraLoX&CU;v_DlXLi_UW%Ko+7=lunx$n
zW68+0esuQ!<<h~FWkw)pPx;EhEDHXIYV<!IKgq8b^lDt50X%y%8JQg8@sD7MR%i55
zINly{bAClsR4%+uID}53O&l{^0yQ2i7+Xhyz!rolhH+|IQ7{d<ODFFLJkgTRpGN@F
zRuS0asLQ9&OY^<Zss2H92yn<$sdPrKQ16)nanPW?01=Sb&Qj<wZ#Ump<v({_7X=HX
zZUqVj4uq>gc1kqxMzR{Wx}v0ZQZ%Bw@7lLrF0AD0XR8uqJ87z;U!f*Jv8VayknlBz
z&h1O~`*Vb-fj!C~T0zLs-fWF^k*i+ei?goVv01M%1?h!NH?3PDkZBW%ah$pW+EpG!
z5gghK5L$v82EV>~uVk1k?Wbb$_N-LI*J3VF51}g_^wL;^Zl!?&U2FIHNOsK#M2<#L
ze%dKxe0hT2aCJ=CRpA-RG=Q2$r0gxPk!Q!_=XaVLE=<y3#Ms$1^KbiHxwXb&w^Bcb
zRW|Fb&cF_t&Ek0dh@3&YoG4#k8|_-VY(tnGTW4}T{Yx@Ik)$4kri$5Md6}UY#SP6D
zqfN<j$#p9t<G;S)yWasKPSDnksz>;ahvPS2xchg+OE3U3Q}O9vG3rgHukXF62&B_g
zbEqN!jT&fRl0j(d>zJ3!q!`t%<($-xz~wYdsYYf^B@VHv`Ucj~xdqj&MS&U~$A=HI
zpY^)3GV0HmuBTtPu$>ZFVuB0}O00fRju}cxtQp>LY}%iC4!S>Ysm_$!1!a|*^{S4~
zA8OR>1GS+IDRIkBvw#4^jry4h(xLrH^M^<H(`ns?mQ8ZR&act0gCY&zUD8YO_N_Zy
zggSuMOu#5TPbYGUZ%k2gk_3R#y~%*%*=j8F-GTMDN0_}y7?*yrqyk!%4N?VtSjw&e
zaV_(KKC3xg+3{ir4`qPnvi7P5+<B^3K3vSdX4^1TA{wz$u&f>xhOb`-J@&*-r^{Tr
z#nwURdKa>jCQi+cFJ5@u?`m==?WW<*tk0Zhi3nQz`GnYy0`W}1a<`|Pi}xD2Z}X+J
z2C)<0(~wF~vV9vEabDX~=Dq42N~!C+->~a_;lV6lGE1&I2t0m-YM-}FwHRV4?av>4
zy1h7t88SL{M%-~;9u3-R$=9lOs1n6`<ho=<a=IhhlZ4d4<R%LE6N8bRTlelkswj;H
z4AP-x(4JWFV2QPWJapmx@dttbR3%>4thcL5(le9<T-!NuV|r8arl9iL)vH&px8y`V
z+~9ehuhIJ~-L=HWc(?F&&{nlxe||-DcyAW+L3y{|paF)9+i`hnXa*3ZB8#1c3E8N}
zQS>c)Y&6`j)KXk|#E*<pX@u;a7vEHT+Mlm0J5pi6Sj`bR7S#_K!SI>@HgZPAPnhUK
z(1v7n*>LSuW4a|uBUU_?*P9686&Z2j*%nfT8!z|I8R&hV@sSTp3X>lgv=Q<eO?@0a
zJy7Vm(ZOZbwd#rKS}QS+Y~_LJ1Q^!#E}p}@Pj7E89AVy38=NdIe?45RjVMpnUdw=K
zcraV6hVhmU2;JBVmz0vBqg_7HnCP8;Va{DKx{cxiFGB=V(Nvv9y&h}I?c3#VCj*Di
zt<<29<((Ba$mK*kfT_Y##y3@uhSrffkC0arX4$KziL%#~BK?pN)P~7q`v7uCCgbgX
zVz5qcjHf}*z{kgDV<Lq^Y{g0Jr>Bj|rhROCd_|xve~^Y)F;I_KemIpuB7CH5G1}XF
z{{=4)XL2nCnG~d&7a|qM95DmdA)q%70m>=V0yVM<V;&`Ql3cpwk0?3x?x2@YP%c_^
zF#f@8cwHzP%2A(=0`-ci)!&RWbt?wS@q7ZQ&t96W;i{S_Ywp>Cu8ahYe8?nfRCHjN
zF<-aLVQ_xYZ#LQer)?}tZpt_Yyupm@n)y*chib;D*;Cy0a=&j{g?#=+&+0T8Xy+Vg
z4*1Njn22j$nT@<K1QebJDf`)uwO!n`6>^<OzjpVj<o8R1pC=jv16F^l)<bB)^f48`
z<ff8$w>%G?nRLWqw5P_oRnrSaw@vMLik4rGRVxp86b<CI3%g9L$x1h=3wDU5d>X5;
z9OFVCufC&^aKa(X+*lzsF>5rA9mchGQ_WV1aZ|{RS!CPt7`k=v=VIy-sy;07r}OWT
zw*(nREkrn`AfKgOJq|*)h%^8#GEvI$0&NTY1~F|Vv_fu5okx3Fz$4K|Bz#_R?ej#>
zm+o5fS9jXvO?%yMfntr_+Jsk$pD0SuyiXEW)Iu`A50wF1Zp0B&+nV<d<iA|q2Yed3
zCs(AKmGI62SblUE8Iz(&P%kL7bFS16vOr+3X7`d-UuA8t%LEU4_)n`$63lf}jMBkJ
z+2;C+YBxP5>o*+E|75u;UY1iU-V{W~T88Nh1GU;u=d~Op#VVY~Jrzev>u5N>Xx4`s
z+AX#uE87rq(7C05SnF}}9}cwkN`hhPR(hVWM{$P5Td{#*_o4%iUuTd8FYeUS-60I5
zLRAlMS#M>_m+DryJ&YUmGVlv`%9`OlwEo7h_u|)!;re6ARAf5$9;)2TxXy;lw8mqn
zDf8P~0ZWk)Cr6N&x4hjesa+u77dH#r0?l&GrSrTQ*7ZBn@5z*GsTpCEho0E;!Zlno
z_J!7HPct-d{*9EO@<5rX34(>~Btq7I;VUy`0F4`pY;91H2oFt@iT@^q#%NbSVYAB?
zeO;F_)#09+H7n)iVqQmY`6?@l77v$2Fwfyg9sU(c63G!uoE@ew+Z~QYte|GRGnI`t
zWq-i@g-#4!=@p4Uf~qLl;oJ4h0vscI7S;%|&BV|bW!>5r_8*C4$Jfd2z%Jy?E^w#D
zSGasHir3Oi@4IJmPAk6d!2narqCjFT*^*x<zeQbXE+tY@YRrv<7N1OwS!MI0)Ps(%
zg|)u2zgwsME%C|f54Yn>%?4Wpv?grbYV=_b^{VWoWBF`r(x)10gW~Ix=W+HkAVk%q
zLVE~lkJn7QsnD!rU>XM+is)DtiRs!g8wki=&milfeqicr3C8153yXtNnmXTH)R2Jv
z0F7&r{otJ)k<VTdj4n1KM82C9OV!f;COog_=uyI)eJ`4>s)%8(E7=M^OU|AqMp7R;
zxwWXvJaR@WL)S(3`t0i(mnXA}o~h=K=r0>uK-VMWT+^W3n0w>19~~_MjKmrzBh^lf
zG9@)|Q;iFY805=A&!t|EK|TilaSQo@m@0rtj_Ve#DzaVgfD9n&F3@tF?xzc?D7cWj
z6+N7UD*Vl8-1X~<m_PX#x(HTMl+fV_S&|8$u{?S^p4&C~0vv@kCTH$!PE<a8w-2h8
zUTqIt9SoOEK$jX<ZMx#idH8R*17b3$czth5CF5xd2L6TEi;w{f9%KvVbJwera9Q<R
zmR0GY8o$aC5bl0+)V>im_vz@8R83E9F7T>}%74SdWNrzazd}tPEHOiqjs>E^d_Q)~
zXeU>In2NKUYkDj8DgCR%kAXdTdy_5INt&}izZnLXlPXhNR~+<haH1X@A$pk_O^^u-
z{Am-L^Sr9rt@?HgeK*i;F-`Eg9%bN~daWya^6X3PhoI>2^5si!3g2BYW-G&-AA3L|
z{AHim1J<%qrQg!FsPZ%T(@ySAR+1+~BTsL7xXj(a>o$DW#R>?jqNw2|C_t;vMppyl
zWyzuyx3+Ob1RIk-WoHTOeu9>)CXbUwvQvqu@bxz0jwD{Bxm{!OKKXHpibUxC76xK_
z3oOLk;R8;Ch%ORJcBiyFtX<@N0ig;0-dM(d^FBL|3%6F@-=Ta!z~CU1spGgD3IaKn
zB9>VbP6L-G``fM}5PXuHdHw_e+FtkN?AZc3@mCS|+l;<ohwNpS_*eoWseY6M!A?wd
ziv2)f1peWH^8UN%E>-C|SL!D>6dNMA?0uGEFv5F`vM{59hbyRGA7;Vq5g6K*%Ay!m
z=&QPHh)#Tnk8KNA5uH&_h{Y%S#Q8YmN*p(uUlqvS-P-4|#~mfV2!7dyJY}#AHd%8z
z1RJe!A)WigyvyJ!XV+|x!FQH&3NDX#c?O6P3reL|vn~TzUee#g)^<Cx|BC&_%~on9
zBxQp49za|bh!gP0<YTL@QBt#gyZul`bz5wvNBP27+X%NN^@aS$6a4eNJ1|~b$C`_2
zlJ89XsXD?JhfCVluCk<ie8>qpn`CP!BY%}qTlD6M8K<`PKRWcz>$7Ei;g?O1&*B^R
z$%3f3d^FLyxu%MD%&|=~FCr`1^&4!ls>G<<BlezcSZMC;fs&!oL8>GJ&!X@8NBu#G
zb_SD#qfK=pn1O;YQo}?JBxg2IH=>w_13|qR^uH@Qfhzv8Ai0=DkHHxE#Tu6x-_--@
z1KG5u*e520;$A=vxZ-nZlda#NPdEO&{<7teRNYuf6WjWJUj|&9Z(tXWQzs8V+|ZLY
zt6L0mIp^5fCoN%2MteOUW{4rk^@i=kEu}b{O3!y#ay^rUSZGohsK>`}!yRb^UJu<#
zL^vp}e%SGOOxT*n8OO4Hy?iShgzxkUK%YrhitVvm9u?vx{4}<M+W1K4Id}F3zg-M8
z6m%yCtLE=}O=8sdR=j75=K4|+N41wPGlpWde^{iMt}+zS2k8UJ^z&dPqF_?dt3!~-
z<<}X**edd6-R_1(?)vpOL(+Cu*F(S@;!<C(My-kSuazF5+$&Th_FQUULD4vEur!+s
zZk#YG`1A6~cS(+(nVEUjPHJv9pFeEfd>Jom38gR6Zh)~k1Yq132RZI~HJST7FjN%D
zPvJxVbY)%a`)^6|rjGds6>hax;kP(#6v7fCBpWdB+E+CXtT;h7;!xk$7rm0??VWy}
zLDc#QK0kF~5o!@~&b=Hf%A*5WS<8fmx*Hfcz_rWt90cC1WbVl&x!09(=+=F&XcbLb
zZP7C8TZN#i)30St#frxtQ~{~EV$v8m;#h0lYgsj2&l#1j;SzllPCDmHGIK+4t@69W
zXDOFZpu1dE5Y6!{G(26a=+#JV)x5J=OPFzL6<LA+`d4CkZvva}<8NlY>5It$x7Z2R
zXLrnt+lW%dtlEWzY$wt+t7g5&cHo9tTs#)rG)R->!#`(l<uK>1jFvu&LCaq*wVd$-
z3f-yFV=!$IHSypuI_nx^S~u9oo0u`>I6lZipW{&husJlvkT}E-y3(9jyASC<x0z^-
zv$GKp5R3<ahTS7w28AdmnqF`S&-ts4Emwilf22$VqI<Z7eY1mYz2$Xq+t`Yo3JxI_
zjm|S0{4E_T;#_Abf}Z}ICj)#JkcH7_e59d6Q3Kw-&?L+G>q^%Jw;9b|wGY^gc=Fk~
zj82FANK<c{%|IeLzn#ev&tH!?$3Wh?lJbp0`AHJHCKpB(k{m7`&tP3gA%T9=Z~Ajn
zD_gZH%rRz41spqk-FA(B6tCgvt!d4`<9nII1M?detDW}l>BEMppVAV`m2cLqUUYFO
z@2z2oGiWda^TO_wFUCS8y9$u8B_@hlREQDvmfhecxk)Vb&s-5)fOGH2dZ@(Nx<;5&
z?(XczEia#?PuEUPH9wr&^yvh`M4wha%daSt9^2Qbg0%Md`mauM2C$5Hhozojy~$d=
zJ+^X7(QqBi;>ASc--!7zk?PH$SJ8D_mzy&5CSEZFW<+ukii=|9?t*n{vqpOM@Q|h`
zUjGnX*|@O|!D6>P8C}<>*4Q@0zGx%rmh6PK0vkHRS(H~Tlcpxw!39xPE(~ljxn>{^
z{a@D#>9@`fpxQ*nXCt|gQ%G=XH>N8F3R!{zzOs!*gEtH@=6xL|e~Z$#L`~B~`~pdj
zkmZ7Yl{rb1_C>&!;?yly=p~FFcG3hf2@k(OYk4P|sMBIh1l%Rsac*n)U-c2qSjUjQ
zgxebKhkafZ26>R%!fAddXLXXKT>w6P)7Pf4L4HRQQb7w%BuOb@nCZYKms+A*$^&QD
zl_vuof1&RWyxSSen~nz)f~~oZCv>f8-Rm04S~q!9B&BMr9owf(L{TD3S;q8_1{dIv
zw4mO6xub(U8cd#_TGkU?1SGl6Rj`IF+{OmPvhN53q1A|>Ns5{FIA#jA2ZYp{4ew1p
z-Jxu@sV<bjC+mn8<M`o2Vp|;%x?%|L%f01g^2YJ|(TY=5xD}>Y!8r>4TD=i_;4*4j
zRd1W-GMz*KuN_xoNYhJ_UWNfE5J>0J6$h7>-Oz~<9<vGSQd)zi!#Rl@dZk0cN}C&F
z&TjG;jcp+)xmfJ^|4|tHx42`(b5=jD<sS+CMW-)lba-s?T|3Jb>v>$!gIN;iF;+0D
zVXmI>aOg8~uHr(ba$}duDcY!72J%tqs5bbpdK;+cQCmz07v(G7B~7XC88EP5F;;Ao
z{I{`6q196VS^PV~ZEA}{Xnm?Z9QPLTTIwBtxW;{C03krcW4cSCmz?EM0`60{?Qd`+
zHptmFp!DC(T<>A_0pd;o%Bs~=mki`^lA8V;`(W#<J8M8q%kXf;PPgaD{E!U@^M1Do
zRR)|taXN`_a+eO19CHjLFnt9~p~)(CiyNTGH@&R0g{#H!-D(Cdg?10Fr0K;ItK=c-
z1P*1NK|kIF@DI??F28=nJ-20ScGGYVr*Ai4FK=S7K{cxfC6MXJoaYsmxvqCMrOP|N
z7NT&0q>AX#7k%}&ybR>-wu{3rA0e~lJsh1rtT<(GFKHI&aH@!JC0ILqii}qq*Ir}Q
z+x6R5%!dlQya={rFha&3*bEWf5H$ivpL@OCv>%Us_2JHsv1SvNwDSz*US*G|(Z`=V
zXbre@>Yd8Y5fTawSV;e?&}DfOE%_b{U9t(Kj#p!FMOw_avt@aqla^$HcAwI@4h=V!
zaAHq>00_<k>7Yx9!GV;}<DQ&MP;qkL=L^P5CXeS_b2T_Z!JOH-0(XpMdr}MtKCnY0
z-AtzC*LfKh@u)|bQ=*G6boe%Z@%9BXA6tF|4-sl`ghzN-4VP+w!FF!a`g&j%ND*|T
z7Q^0>%>A1wYyZmiyKXQ9XD$Il9oEX=tzzgrM@qbPbxY89eSx)JWV+^x^H@`o2-pC~
z7-icC@d@1p)=-|WyoowKsjei+lnW_)SWjqA9!DI>ya+qxMJLC-=m-!|ZGx0M!_}W9
zjDO~d>%}NegO@XB<(@!4)lRhsc>6X))hKWXN<Q)&q++`RLodM^6;c0u-(q5=J@F<*
zeMpp9FLWPNc+68>uZAIv`)-gykx7y93S%?74+_4p;-+vnx#iD+An*n#43t{}2Ocl9
zBlHQkQ;}uv2iCn#^@8W};830)s!;R1o^|y|(5rm(*|t-bdFzRGwPw|S6b;|6`f>7J
z9W;=MC?k@*x(JV~9o@A~`Ne6AnyUeC8%+3(eo8j%ZBX6em@q*!@wa*IdcySpB{yj6
zf`(BW^Dz1A5S!`9^WZ7Wl)u`f`0o7H)tX(g9f2s&yoM^T>M>}A_5lP-I&<zodOu)M
zVddwh>ykDa!jY{x{T7Q)sKC~esjNHo%_kmJ-fz3-@V%+rQJ%Hk1ne>8II~t`Yrphh
zmEwX%(JKPO8wEq`$ATe!#NC%qQVYB<F?{C5b=l(ylBP^{{bOxBxN}AR`4m(Yp`nc0
zMv9{qqPX;}bfKCL_yrVzVZ5!Nm7^^H1hH!i{0q(BZh02M3ixxQ<fWu4E%nW*Ab|M3
z!kz*(cd^Eg1z6<CrIpdWGQJvkw&7vdZT#sX*(HN?ktCz%MpKdvj2(30TQ>zp#_KxS
zbZX7BjgVH!4x&XygP<>lgy{K~=N;QRf}>C6%3tfux^SYx!?cFVQ0(M_j&9_-$AgPM
zQt+p{DO+x>9J{?Z5qaR<e*3e;gkzN+xp~di_CFPNVd+Q2f0Ez^;Q`#FW|N?->bHo1
zPl;^Y&R(1?&}9@haH=J|sr(S=66sAh*Px0+0s<GWETTAptKKfBv#=%Ss{7h_ogp-q
z7n-zWFLuy{&tskr>oF1gy@U3Oj;?l!CjQy(hbcg4;98hjpMHLGjYI3}5O+)}RV7Fe
z!JW6_u4gW?RkKW%C%$^I@J>|wu77`9Ab-zy8mv=Jb2DfP;>*8~l~{g1O|}_dIetik
zWoG)OZ`W~J>!?#!f;jAFdHuh#Efd|W57c+vu!(hH++N~Uox64O$#_3^^1-Nd6E0$e
zaXNY1&D54fiA28P?YO-SeMZb+{(WqPrQ|88uN+8yzkU1W4O)5}<_ez|#I3q*4aBf)
z7wbUJ&T-F%7mp2oN%7zr7k^gn=;_w!dtJn;W^-u}T}=T;di?b73&hml!#@Y1IHtR^
z9X4Qg{tcIRU$MHbb~VRQ9=Sd+NQ$(!)>Lh~QZ6q4sNi5iMhxYB1d3`)U!`fc0oL7$
zQO48gjw;=R_EZ_1_mzW5d*tgILZtVt$B)x3u}^}6GbV+s7G)uOH~G%&TP1tS^z0yM
zki8ed78}JBQK(~Z(9|Fmi@s%vslovWmo59Gz|831+8hI6N{Pbd;eu{1glt>xZU&Q?
z>&keFmRn03L3}(T4>+6p%PkdM5t=>kq9B4zXHQHwVx=Tm#DUX-I(O=vO%Rbq-ok*z
zUH9$fvdgp*gr2K)qFYmwL0dY{N}OQ0iribvQoGg9XV)7hgPDi8fH&zMWhUY3nOQ+k
zvGHF?`(cdGC#;Se$~`GCT{u+U)Qk?+lItDAlH~H-syaJ8LEKSCz-oj8s6kPYxf<?U
zldktXhDdQPOk}FjQr2cHd8_VcLDkAtl6BJ!6C5$SnY;dgp-m$%qR~H^Ip*<;mI(sY
zOowbEF`xbij35;L@)V3hzHp@5wek>*N|}yQ6^s|UI*_-g3TiT4ZlX;p2+8-I=~Y|X
z>p`<~Wx`ITEC7)i+7&{&x0aP`bhsbL<2d5bo$)!LoO>|u-T-{#GS|NxYSRw?i?O#3
ziz@8iMioI3L>NR66zNhz1w=ZeQ@R8Mln!ZWks4{F8|m&&1Em?dL+KovA&2vfzVG>c
z=ldAH<HhC0AH$x#_fu=#>t6RAU@=iAj5G7r+wEvU%XE8GIb<W6IiBrJN2Fsx_JuqG
zuL4RGg#f6Vc=6MST-)*X^6u7CVR)MJH(SP$643^Uw^+<2X^V+h%-w`UDtup!R!E_v
z0BPrNFVXyfFjigdRB_K;tu+<;-JYGi%N$T`eYQH8*Sj1$kX8Pu%5n@iwl6xEeKK*D
zPGKq~=^Vz>fJOE0nrOQ}MjF9J3I{%&#f4vi96$PdIPhF6|8(}{Joyy~v^Ou~l(*{V
z&pJmDLzQL^ojAa;8yY+X95Iqy#qz2|o;S@mB15u6@+&K?2EKMJ=##s8OsiG~a0mWG
zB=b#_T<Az9WJKJHuqJ~(vIDef`%bX^ACz}PKCczUu(-M!c?^qgx=$VB^%ppQV<$(k
zWrrTd(2tM&=d2{OP+wh4cym<dd%dc!V-KK2JM5J~W90Hu+3waJo7KDvtNF!_Bx@uE
z=kJAg`j%U~pTHvsM@e~IGB_+<JTX`Zi=|iCS8fX=afnT??mNzs$Yl7^E9x4~`?aO8
z=~1&J<+Hm`iZrebE4)+l*&W~>0T@$H;*qkh$&h%{p+VtpyHr8nmk|I6blrm_XPex-
z(~V_VeH&m@aSvPA{ks55n*)QyVIw}_O}Zc%E55+5#J0(8(FYf@@!Bvk;%7KnS>d)J
zP}|#idhvozW(`6u(~T#udx4#g$=3qeElG8cKooH76H`O?^(IgAsIW@|(hMxDCrs{*
zqq*)44oe$6@*shkh5<->A(NGDVoIx_Op`rJI#c@gY!pK@4b}AZr&tuhWc2v_hwtU&
zb^=egWhp{aUd=yw$96<=j<|s*BI=Hen{=EgRG;)uj_m^+!cY_qH`!y+mzKpnYr{dA
zLT9y;N#dh2r3j4Q^`O9hdGAv#ZS;M;_AFs&+)qTUtm)?Ytt!iNX}I-Hm|={(urJ~S
z-~LA1imh(GI*W{=P{+1k&c%hME7+h@oU}8=U+QT+DMZh$R`;sgBbA_KAB&kP)+>`%
ztJ5O&H`zKSYo|MLopo)-RbrNv9!QOiJFPR@Eq2*i<h6g~l(I3<b^(g4$e%%H8pn-X
zl%?8HP43gt(QKn^KQfvrHxas?ePf*MV;tMNpkI$Eo^~=NK`_~LwSx3#bEvTG;a2$T
zsd!cd``a(BwsXN;^lN<eKjVPO7^3j#?s&yoY(^XoPyQ=2iwYp2pjg*<8b4(?L7#tM
zaR|;k8BqMbTdq#;O3Yx|EFNsuzcf{yxyLf?%*(O#1MtdY3MZ;24wQS^aGw|-*t3uL
zT6?3~twH7e_u<**pYq9fq^A4H?1iEwUS0Hn>hre#9t4<HJ=ML}^twUll;#x%1e~7a
zdTy(18O_tBs-UtIp7D4%W>BZj(aFN~)r?hp)WaCVM%D0Mw%q+6nN440JBD+%uap53
z`H3ufc2d5(){`}w0%Yt@zv{&`51g==4rFC6nd+XP2>e*MB<&fnEa*W@uNo)@n9dXh
zPbxR-e(Jup3M=ZNfbGEqm)=aD9zAh8l=z68)r*O8LDm{)fI{bNapI-U=;AQr<Vvn$
z(8(<7A<(|ocMHeD!Lv57VX~V$<+(_ED%<(Vs8NurWAU2veUrDZj)OGIO!^2lYfMUw
zqg?fhXYv;8P#p>JGf`@V8_hEyiZ9_Au&0TC<Tk!X`lMY${$VNIPZShqI#riB=`5i+
zu`OlMUfF^q7Zb0YuN-mJswUaot>@RvW;~Z_xXFZW;sI(9Ys}hC5cE%V07GX)@7(SF
z%BP&=+(k=b#;}>T;1b3wleVif9|Y<Lq9<cok*l4#Df5$|$`r>1QX3K{y`1Ox<N~yU
zXNM7q0(Rm%I(EUplW9`6E-CU$fUd$xpC%?CS47hQ6Yi^wJt^lB0VEHt3T_e89tR$R
zmKla4P>p>!b$TRwoQCZE{C#Im!7upn?i>)v{UqXB6hkc*&}La39iGT-m({^e=VXyI
z&amM6%f9HCVZqHZ+x_%tDW%M2zzCqrbt_#ly}e=YzH)oMR5%$~LlIN9-FY7X10nY2
zR=}T$`ISmJccR^Oj|MM|_TUCnV@hOlG3?ug6e1y`TfL+x{l-t->;#{=Z{Bx1w3+k$
zz0kTc__?yea^gWb|6Rm|DxCkx+*cS=1$%-+LPCJ>+kBbjxWm&c5O4~Ge@qFA)(+OQ
zFTb#={@)r-`(K)92_gs@3`&<1n+?WSsUN5^8`CPfivfLyxI_=re|`I9)>I}c0|SFu
zhWzBmc11zw^UCZ5HlA~?!SkgsLZHsWh8ud}+4Se`g>13@)b@?%NpJ2XLm(UR4**aI
z9w3x&QZ(6P)dmC7K9tFSVSMx_i3MMeA|tAwl0sx+3d5+LOT>FY$%gW!5iz_#8R!4{
z?FB-jCMG%H;mLWM!bfJ7-(00eQJvGpZ%`A2ztkDO5E}UN?g)Nigm^(C7(By`lg$mU
zQV-_nrBr8_4xC&`3~WUw9s-UguXz+5R;GazLiYKc=NAIaa-+hrnIxx4)(FA7DU(g6
z=-<{Q4Dh&K&|kk^ZDz&+9g}XZ`h}>G>AEh%d)8q8{*wF7?ZP_C-vdz+)j0@~FIw%1
zgCw@bffGDK?kt%_6#J(Q6q6$~%a;O+`a~(IYbz@LasQX`P>fc|D%2qw5E#d-u9pN<
z(tBUE94gSaH#p;77v0jixa;gsO6c_(7aT!Sl9Fu;LM>s!n^K@JVbTi<u)qN1Se3g!
z-_DkIJ3R5$g@^dxy@j#_3rslHCFp45$%G6R&ODblK^<R2k6$mP4;)ozq`RUWko}KG
z@OpjS#ElANu=?Qxn74p(%Pd2Nex%>O4}CB12o@>uq{F0kvv`JH8|u<!L2N)+#DI9b
z&%pi1SZopZX2zj7-v0jVG~W{ZX#Vk8$y`7yBl_Fk0c80C+K(=TZ~mg^zgR$q-3Iw>
z`3-`8(O@4c3fTctas-9&3R;^<Kp<wt)!;_e=QQF!vSIz}a(aN~{Ksr_OOWMa4%FWz
zGl~&kFb*I_6BFQ|@df!{YY+XSWQ3qtQ{LV{=kF$4<ArGV-;36ui1<&QC;?t$&CKQG
ze~_$IZUcGC=&db4v&qPNl7xQ53EuygREhoN>r(iI2+g0lC~5gWG<2oA@ksQa#8&wq
z7P`<G#@6INo;(XYc^f1={@dO^Y-Hb~$hNF8fuxYjJV?H$=!Ykl6-<dgqsTOrS^HnO
z_kv=}W%~b@gARE$*E5Iyorf9yhh!}-8vpU1JXTRK(OOzs!U}kVekQb{UpSO<e-DDc
zL}$r=^KCDo*4Q8Z{iQqR_aPTSO@H?q4w4cK)T-@*O8%P`OiThi#D83iZACA7M%jo3
zOig`BAuIeiFDcM}C-Z~9TQndor_FU5qCb4Yicl{R7ng=0yeR$45A;)~Ee(7S`~$Zr
z)*93LkJbPkER@kYEy`-WE(C)F{T4_Wh=Upx8bH!!`6o#m=Rc%jT1G}Fcyu1Zrz|Xd
zmoCvwNQnxoy!^*nV`fB6roR7dnq|KZcO?HY<Lg1E0(d<5_b+%COw9lMVc0(ApS}w^
zkii2oyvz5_TmN{wO&E0?e@vu(d<dYDGoOF0qW}Ka`~dnE4uKYM74iLJ-vqrcsBKf(
zkMyP$Ci)prK=Wz=HD1_3nQ>|W>W^TMh^L8VSC<EJA2ld&Hdi2R^I(NR@N_G}Icc$*
zBKm}kQ+D6n7VRZLFUJQ!+(mhL2MPH+q?fO2-l>~7`{mX6iAKT^VPm$zVRrf+$Se-5
zBNwc6GEO>ml-88?(8q0{A*%QF5NnK#$n)o5gI&x4uSibk_(FOVI0y*Z+Wszha8$;7
zgAjq!VdXBmyQNIW`O9*@9(xZWFT<WB=qXIhs<nPUd%V(2y2)*%4POw+xHeoE1AOG#
zSTd!hHpV&WjC&H{j!nGd9<A!U3tte|GT&_*pip%tx9@nLK*_w;ZV8w|Y`zA}^u>Lv
zhSHqD99=oU!0lUmQt#yX@Z^BvZ475kcJh2jRHwTe^3-`wGrA_!nnij1&abzK$GqqV
zKO<Af-o66mHGU8TWj97fYIj6B)U)Y6Q*db>P#*^R7OVqFcdZy{i<V&^)y!<@*k3sR
zBK-W#UaXDof(yaX5$%fLs}~=*siTWEn5J|+ROJ(&k#3&)Q@98nH_yOs1eq-KB<Ur1
z;pOYk2v~RG!UWC9I{@4}ADrAc*=o1c6=v%+{ae5YtpWBWuL?pCet_NL@E-V|QT5od
z+7%R;UxQ9gxFIa*o3C}4gI>`m02b8**4uBeDra}UrErC#r2UAF0UgPx)Vgd{fk6(~
z5zTN;yh~oH)oYqeBAg3|G%u<hXZFY+;Z0jwi55KPEYqJNLG^@jJFG^k6e;P*pSczq
zr#N?D8|-mTY?GirWlUM#ZqJH+3=E`^@Bz*1*V2MYGZcYJK^uI^mG-Gs-pJ^U^S31&
zT&wmIpgDDNW>4R#k#%KoA(Ny#GcKA<kCaWQuW(IfM;cLNbOI<wGEwz#$7@vfiy|Ye
zNhnem%Bu8<$(BFdV+MYfRbe^M!H3)*(OW25t(^QC40>22NAz5OSO{7iN|pyt`(KqU
zs)zG9QK0DvL>+@+!x%uEmynqFXTNMRJ2eOPV^6p&JK{r+(U#85T%Czw6!qS&;BWh0
z;>P{zg-&AW+yv{Vq5G3fXUCm2p@KFeuD}KewAITdpVn$FIm_jjvX&3d1y^@HPdeJ_
z?%A*%QdN&@{ZFs6hTI##6>vTbmzZjOe$^9@&4$0ZcU??2`7>WvKwlQ<kvU}U=J=w~
zvrKBJNdqf%3Ffig@~7xZ%aYrSDNSdC@#Sb2e-3}`QmlzI30&Oy-RqT{9p_8|XVx3j
zStNzlEKUD3vNbClG=FM-Fw=#@!s~jFIH_3l2_8QYEoYtyY;hNnfTq_KcZb(;og=jT
zP3IzKxk1nR3Ox14LirKeg$}0W?LT2GXa#eNF^UHw2!r|Bt>zqcWbGMqvsrO(0Lvp9
zFrPkNy(03R4d&5{Q-8@X+V$$=g8$a6n(a8lURAFY;Fu?H8s@3wseI*$?AEU8xPt%G
zjzXLFJV8(!&Um8NgPWhIfIdX-*ZOapUBptqtYUbI)P@#k<Iglum9DiD)9`|#AfS#(
zwVo*}Km%R)dM&;#v@l6Ln1aB3@xyKCGr(qf*Aoet;(JG9*(q&6D!`75+Y{NKQt+}n
z(Lw+AA6lGVy%z9xvbw!}A&vfTHd_b84mQ%$)31vj_CO`gfaVJeV}_6G7KgRZV(8YC
z6_fIClEyf2Na)F0M%t3(zWCg*nXB7cJ>!@F#O0`*#y}3$!Mk~YdUkns_5zoSnZtiW
z&xarr1GQgvnptTh(Pc{K9>-pxZ;6^QG1g^Q-%cD9&m-yaHT?~M&`2t1Y$@|Rzg!OA
zAF1n<N#d=Y(Bwr?Q9+^Tg<FgjkL^5EB~R&l5{bwaBA!l>>eHj5a8*!b16l}$R)_zH
z+PXm#84$z1(VnOLgl4u8AsE(Y__OvJ%<kz2)~UTo+`>1&eiaUyxm*0di?{uv`rcLN
zCcgCwIjN~sHt)&KOz-{_g$;*j>ZOVL$R@0Q`o=Z+>b}$RsHPDt&KSOCD;r4M73F%D
zGaQuMW8bjEgZ>tQdlvBBf9yo4Mf3kQGqyzaK%cqn<)Dgt{2n}Z!p7nNG?E=I)Mjf9
zO?f-A5@Jj_`?r}v&3<I97RG;4fl|e*vYKE8IjIBeUCw`yHH&)NAv5Ql+@;ASxjTYt
zWSn*C#LODBh2s@YF|9vDrT16QrxNNvkpE+v3W4yU<|Ql0K3<Fagebp`l+kr<%-#q?
zwROC1UVYF<7jN%ct4-49Mlf7ub#~Qs_|#^t_jK^R&&`m^l^}mpWkXtK4pHRs8e1;l
zcDs3QrE2P=i*tT-5Yv)d_{fkFrJ6qy+sadK(4Kbm2{4tM`2Th8MZLcb#m2+KTmPS8
zwxg4nTzEXEc}=K;#1%ZUx4nf@5kH?;burq_9Gmy0(LEW|Ff(lpNm2_p3H$Y($~!|F
zp}r8vHXOeIN~kQ8XB+pAS|s_%Hv$||%s0RuEe#q#EW182nh^(6SkvafclAE3(gl)8
z#`R|wES4E>>gIy2>!ijyr8;u~_q;p#t$GPsZ-Dng4{$MGQi|~N8<V}GfA9F9`sbH&
z-A+E(zD2rJhUdu{K9g2P$xEjx2P0mX-A2#AZe=&<{bv%S;Gs2^PYDMAU#zF?Vwb+d
zCQ`Pbxn*^Vy!4-6hJtCnfYjlQOda}2`qE{Jzw7WCI7I|tJr@@`|3)7fWq%PEY|)G|
z_NjlQpJD$E_#t8Gu;=JM7}oLU1pCu&8I`nx&g%t$PVb3OjldG3LLq$k|41qy;QoK&
z{agz<1p2@UGx1BNOpGW<{ZXCj*fo7iUg(n;$t$3%Uzm~_FSQmEeH7tE|G&1Irs4^}
z{t?5P;r_4frj?~D|H#UOP$26(6uUxk$@w2Q`P>Wigh&DeDGn0uxA+o0IO6r509^39
zA6|snP#y$|4TUUG{o}fZUZ0=)OAqC#f?&IpH|8H%W+$#mnOPD<F;hAU$XLFtd8>%z
zLxi55jbI&}oMP3!+y2CO^I{V5pMgRWw?(rgymU}~+8#wyKi`q0Q`8foTxQ(dF%#4N
z=xikj`W{cz<kBocd1)S2e*QZ4@^5jpP#cEAuhj-_;B~^M$x8WI@R;JsYspuOz|7#l
z`e*}T2am&d4u&cN#x89(#H%BjU;CGPr?UaN4bY3@R?XYrpH2-6dUr?kmKF+14MMGe
z(e?NT=lS@C+WvKc{#g+K<^1}jn!<Ay!+lG{i}O<WX8a^3MgQ!?PfoPAIeXpY#q3^O
z^W^30Nu=R|dhmA}PYk_4x>WOe$QXI5?QwQiz^#iF^mTBB)dKx=&ZvH$1v&gK$&fnX
zfVJDfscwvng8<2>NC=I%<U&W(6&lTbXBvi<zPaq~g;;En41^$45n8bJ*TYv>H1=^>
zX}-HsA<SVdT6Ut74kJ3CSMhMax;(9x3b5%vVC@`+u(kf<mg>K3dM2{RnD)PfjOZkA
zO>Ht{auGag&x55jGfIS{JZZ!s>5!0zMtayiLp%8?RWUh?Tec&zyPK?;6ZLH8YaXZ;
zMGz;g_RCUu9O?rltX@%yW>Q63qvshv)C0}YCg2&OU*d1u6qeR0G?_nfnl+PC(<#)d
zENJE!_!wb4KRL6sphfdlB6*Tq=?OCNAL}*`C-G#h;q>4{vpwRW|KyA1c$G#qGe-}A
z7ubo53Sm-*+~cK-FNl8=r?mS}YzFP?K@yZi8~48+;v#O}3}qcC#0Sd;B}FMnGrL6N
z2^H6Ua`HZNg3A{d?FO2W`yTm400^uS+8cUtG!_Z6WpPsja|_}-GVEvehfV{)3P-S6
zWDji{dzcp3se4&!G`<ejiRK~lQDil7R57?583a(^T%`Lf`pwRRs13&pTPN4#5VXKm
znyCWR_|&TRA3_97#BC3}0Psck2Z&ZW4NgTPPJ#*$PZ@<MzlFw{_T83Y&-8sV@)tWt
zCG-E=Z(A`!YS^MVV)phN?9`|GnW-0hQvUg~Q@XGy3>0IBxqH5t?dloYxkC91->ZP=
zFTC|Tlnu-MAD?7Heew^!_51&RO+qLXScQd!0V6Qvp;GTP^sg652;LSjCc8r=;nUo7
zdk_6t|2_q?OoVdwf0bI;8bExo`rqHw|Gc=ZK-4>XS!XY0FAfSwj9%EyZV#8yVnUSP
zaZb-*&VbdDZaY6J#eK9!VSBunvNHml@DK^S>hkR|n`TV*I+trpC8@6Cu|5Ee0g@xe
z?O=Lf4c-IB5&ir5E$9(KCFNfuGxF_RGxx*zPdsFY-$+N@2-mj$7`9f_ol>xSI`r%z
zCiVXUoo$Vfczd9IxF;cBeiqihUMf0cs{1_A85!2G(3z1F`jDIZ&sDPiQevqHZ0Phb
zdeBySQ2IEy2K#jzwmUI1XSUwHMQn_mn|17R#uBf60qX}!DdD5n^uctXT|w}SIa@v{
zTHA_=PF*L8#ger{70u0g$<n{w8)YlAAEI|cUh|x4S`5$8tN%pA;?~$)CtH$IKmhH%
z23{C*cjT`ZC&jk=t8A~gXWtn47dMTo?kp)B*BO9*t|$Tb<AkLuv;D*hx8J0QV9UuG
zF<^USe82h7z?BK~oYse+i{dH6FzxAE&Z7(VT?xKD=}O{_nN&Y7;)o*+zl{O;uLMO|
zlW6YI(bzmADVNm;=Z~YY?S%L4Mb3Bbd(@{eYnDw~=rz2197l$zJ((nBH|k9N`n`MZ
z<E>UnQ^TK_=#F**C`LI+!S;l$th@);olXu;OZ#f&%9)OG5lWHAU=C_%+yQgYot<!*
zk<JUcG2tZXAEMJeUEh5AiNpLL^+XzzdXfkY79w;B*J9FuHfuVmtYuJYK_(D$SQF4O
z{wseWT@|HgRd3(N*ef!}R{Qq%hnEfZeUr@~65+_xW64F5mQ5-6voX+ux!WJ}d<Ws3
zK?}GXAkZcyCj;}EtXP|d;P;QO7n9tuF;m~OwsY7a^Eljh{K-b7hv?$LS`@h^`iB?@
zX8!C%T)&Xd06!u0?WfOZ0A~!bSKY_OuQ!`02KH=ZqHaWysdi?KbD~}jgWzAWBBc%U
z*(n<(3`qPtmyPlL#gCwFsSYI8rY8mM524{C27a|OIf_@9R9ETk^v-wiL?_*prPxzi
zo*HrkeTHLAjtJM<orU@7tNVm<uM0mucU(WzQX~CX>4{t^Iki~@xkm*QDCx@#<wea`
zX?NBXn{O<Wn0Cc(+agb~nAG7nb5-;G?mgRTT;8v?8lz{BM^aZ$+Lo&nsR#r2jZU8K
zgWbv6=GTCZRpxO<&+V}u8~1|#Sx(JkO9s)^p?u5fKy*DH?}fhn*<C&cX~!<_s^`1a
zPwMiB9Nf8#YZyg2ao~^_6Oka}cSnYgJgoAr(|A=W4nTP56)J1gZ5P}0Zy)WmgLO?r
z`&VzI9rAm`+W)yR=#xRUYfb6GZJeE%(?b<${3QW}uWK5x&y|6<vjM#MXwlr(bIuQ*
z|L!Wac*q^*6xl;rj%=UJtaC=)cSuvGx8JLgqos5G)ic-1eqi5^m9anK=-o}=Fr_VS
z9G3%F3cP6O*N-XAyRoebg8Q+UcZCD-1@4d)<ImZf_NF%Ny=$xo%-9L{rpolo1ackj
zUD!g)gepx5y3G=y@cxQ+_a@bQ7oY54La*~~l^1B4Q)q0xHr<s~Mts(J^bJQuBlxF6
zoZ$wK$M6#j61wl+_tun^P%HPiNb?HBDC93Sg``6(#}hEl&hMK$gG@kqHVVFEw094}
zb1TifdSsGq(;xpXBM<|zuczZAPy|bv8&FrBli~jU{_RCN^$Vbb*AB7YGRKl(w{!qE
zoI2Wt2`=PjYq$5Mw@xmQVKO-yDsme{T240%=}ebCzw3Ow(h8XFD2bs*hEH3B%jJ!Q
ziI|i`LD$J<6GP#0Z&M`@=)DEsbpVv}O`tluF$F7r!{eGJ<aN3OB)x(J&*@@Gxg32W
zSzHsI>Z8joXmdNCXtGl?KY_jSu_mBqVyCW18GM<{1O|Wa%;x3G$pzFwQ&6nC>dw;*
zIFAnXkUPt8kL%~ZdoTZdA{o_aMGJZf`B&=JilV-HPe=4;TH7E>-Hyzh^GE98b5bcG
zyIRwxEzrla0dZ!-=9ivtQayVnX;1v&YF5(`5P&y5Nz?S)A5!l;UxbAva<eIL?EraR
zZ)!0dndYX(g{lcwwz-V<o@}`ky6=9$wkd*6Jt~L->_ShZZx#I2^CX_iAkAA-w4TUQ
z_?kkBfVSTaa{XjIP$4*aB}8GD(v0rN7{eWIYuEEoAoQ{RBJ2(MX~4Q@E30-b-rT_V
zd%v98-L+l6HC*WdaVKqmkFze+iHq_g1rkBgMmuZO-#@bhjw<Wt!BS-|Cjx`EUr41w
zt*CeWv<w8>N0AD^ivs%2omsC`dfIK*_EDNgBTs*|HJeicN*Ljrn9S>`Iy`ZL-<F2)
zvL*FB<D}eX1&@8{d-#F^lc<Ho;a8_XpFka-%8!7BZXQ^(?q;91+TB_P`-Ic6ceN{7
zgo{mAdB8HXn6K2J2XIvwFe8?nZgB1bpG|fz3MMV+73yrL9pK9!y%?bIx<m|(uWRe#
zN>IU=dF8X@+<skT*%_2lJ~1Td=+;e_Q+Tc$X9|hFd&W(Dx}79hfe)C?tTBVrZ6~R0
zvkrIp4&8Hg3-c@mrSL=ti`=XCJkM=QzE;yDId9EJz&b%4=e1hl%hF!{{I6#Dh_rIb
z^(x>lU29AiM8>J|AhLPD0^rZRV?@ex0@b`ai`{yRn~hw(1t-6}o0N9ptJ~vr_GiiB
z1aEvHvVE2d0a!m9mx7!Gur7}H3Ep9(h<D2zJfFa#`E=K(H*oc2a4E$kaea+p!3TBn
zBU=BI!=*^ydRA=T5Z!|heV4sqiA8l4Z=HeDOvSE2R_O|)>0^OAZ{jQ3vgAiLWt!{U
z`CqG(?x#Gn>F*-_>`Zg>-l1+5EOw)Z^YQw3{0!+R=|xkpGJP<p;*HaGWr|~$mUp?#
z=I_xB-lGHJJ5lN47#jeYY^$DuhvzCA$1knw$;5PV8p+K&P?VzyIK3YJDi-oF?tx~Q
z0e!!h(lJH>Q0Obutd?A*>2IhW<b=hSP#ZZwO2cs`cHLm$B=}vy{Amd2+TzYPBCf^x
zr;Fc&$VpmS8pDzzRP&p{e*7eqn`k~Bmwn}4D}O6iyO7lrh+)I6Cwn!JE1a7@&+l7K
z97NULh`K)x1h}_K-?iHUgR0u_S0~y|6lx_ubzZF#K(_{8U6?_7eIecgpn5x=I4FF6
zo8fnFzDrIHyoL4Y&xgRb?BO^~+SCW#drUj6BsDw~K?Xf+(|D45+AKq_x#Z%(`dD`l
z0m2?lj^0>b8$@&YBl+Z0F<tod^8@(Q(%599XD18S-S*5~=wd~0H|R(`FLx?>tVphS
zPcThHOIi4bx`vSR3jNbUwOp;dwqr&zrAo4l598ETDjC#jV!|gSs+UV~(hP1{$}E%y
zKsPH)G6{29Mj2l#LJS8!$PLWW+`)X@$UZ^JhWpTbY~$J?%%9f|)|FU`Xx;Bb@-L~V
z+%a+PGRrG2jxi3ne9Nq2Tz@Z{kesStS{O=T-|Kw|`#qW;`wR_Enbwy0>g;^XBW454
z096?aqieFzUK0+mjmxwJ+%lv3)~)(IP^`7^EY{4-?1%{z`qE-!bDk<xs6Y?h=B~zb
zn2IC_#BP7_dMQ0o>krGv6=&0H3Sf=YnRisXp_RRxU25pwuFT}Ju|65PzP`S^K1Lm&
za2Q!!nnlppyA@_1Vce!g`rN-xS?IlBFe!h)OC6oI_V$k{wHuuraml$QThI8jv1v>w
zFJYkld2zb?#$Z<1)p9Zx!U3dzYh`tAeXB4MbzYEr!1OT2yc^GrZ)&+xU5|rnipteE
z7ZM&3@%*`8s)mEVz*QNpd|zlWVw29=8b7b7N$RtHU}hlR+MLOFMf;BK4d&a_-)3}#
ze*eb(QKjZC^37P~-J*mQi6WLPHg+#*VD2L?S{j-t7X*CD%-RF_SXy@c=f*G*^&nG%
z#uU`STwM_XcP#9&-d-o5*4p;Ej45>K;-9()UU#`Xv(rB5jk}*gODJo_SwyhYbMKTQ
zCejT$ECg*%JLey_{8)FBpyvrB_&l=K{^JK01VVmvhj}WWnA+B^Nl`>Gh{9O^H@CEg
zbr8p^ri0Ci=K=z{ER$LfK)GMMHI$t8+BJXTlQF!9JpAU4*wy%VdQ*1rjdyKSRXJHS
z?tE<xB=+t91a&$b-Ag0JC}0wuUm*WHU&woCW7fR7n-CvwvRL3;rcp(pIB5Rp>ScmU
zXnvOCG2`R!D`p|>>)F_-smBSaT8yZ~H3%VJaa3U`yiqO(%T!g`m76z2F!LedNlBoq
z-`s<AUBdnBE8ptA8ygNTE>-lRB!`^{W`cqOEVXOX_ORdU%E^F$SkPNrdm`<q*}erL
z(j%&7;~%M-iY9$GDOgi8<~L@eKX}iiy-^I8=E=0`|B0j6T72RoEzS0JqGQw~p8rHn
zz{<jc_FT%#jZa>xH8SxOtJG6yRqf?VX^KKE2062@zksFBJmQ#00HGJ4s#mKdyxB<6
zjbPKM^I2>rXNKutIrt18KfC?Lh|KqvkvG9t##Apf3kxhbY>enEW5Tt<zLR%Mrg3hT
z5z!y{^^6IrCnqNfAo{_fA!o1d6P8I5t0dol7BxGkE;FKVi#k3b!MSu1lx(*5o0^Jy
zhv(&_1JdB9NKGH?s;@9>J~{kE5$|jGS$TJd?3Z5%sH*ACHED482ym5)>93EDK4Vfk
ze8@>pFTX`YVXcr?Zx;i!lZyw9+LSRbHznzTA$?S7n|6Ln|Bdd}Ju-fmjGcAwoT`JT
z<SNOH6&364zdNu+L~-xcTt+jpm%LaNQsF)B9fFE`&9<@Jh8X)cZeNXzMW7|5T0lOe
z@PO5c&*c4v01mN3>OglG+pi_A5W;GUNCbGc(X_fc9$mJyBKXajTVy<;0#J@D*)kQV
z2IQ6;(?pPINRTkz)N6>zVx*W!3G~{=mj3Ato7{p1X~j;pe(=yfQsQEdynHze9q*9d
zP(K=t7s0f9x3>)X5xL_|j7YZErTKh_gc=(7pkj$7eg;GLuCSurF@P2=#+#TMDprq>
zemPGjUOy9A6E+k#vz*m_wgIN4YfM1_vxunAVZPR91-U6X%`q2)N;1M*T>UxWY*NL{
zl`oEq8c%g~Xhc|FT)q07&X-O1fgEoY15@ASbjhTqHV#f@;jcF14RpSnOwT^aj1;LW
zN=rW&8XS}sv`EF>%D!FNnG-q?VXwG~Rc&>a2feJlQugVp^i=G-uS)!56NrpMOhcBy
ziVC75tJOhSVPP+#YNJe-`g`gscNh(%h?@0MO8hkR%^V&c=f?Is8MQ$PAGczLjo$9F
zU)@7UzZMtZO5wLl>*l#*fbW8KnO^cLl1lwG=zP3pJ?AM~ef#oKQwY(XUrOPmOmmVH
z>I{(VradoHyE8a4^3XKY<$>VjMD-4R8m_GQqa2a|&aNz7hIO-qQDdG~CH|?Vvuh+Y
z$J_`SF7@C~i@B}M;a3gR*OHG+P2Ne4+<xr6?|yPX<>aJ}6tJjV;r`~$T^~#0?z%R5
z+USZ{@%tpd+Lvxb$3GyXJE+}Y=X&ykds!IGP6>9<I{M4eX)E*ibbBSG?ev%K-CJjR
zyQ7hi^_mcWI?e~%$;s*X+NDe9=apDAjsLZLS)X!9R2>>=-4^q=|4wuT!$6-48ay>6
z;7CFr@E+p<PJjW!w;MrI+w3K!FNmTDh_J4Q!(9%X@K0P8dy-yb#KJrpV_g+eb_JGp
zT6K+!RZV{ek(!SbXd0T26z!j@73*5+Yo%CDR8<Dop6w&tJdau8ho)lLyzMRyY5{`D
zDD-M^-E-qiab|Sq_Cs8aa+5&w!5pg-hq1nRE=!dPyujLnAWht}=ysMh5<C36KaEI9
zNu!gKt)j3+E$(pnl>ZNs_rLw7;ptVoOFYh?hkRv+?DmjycSnq7D7sIWBjkb5+*sp!
zQ!Xa8A3lW@6B83A^)Q0!wd?-@sQ%}YUU&+>)*d&HDm2UL7T=nvGrT+Dd=j!&89Hmx
z04@UT@ATW-+cBvFb_q)G(7~8r{Mb_aAcCPO2Dcc_7i4Y`Ee1VQ&3nBuPCF4z-e0Ki
zU3M1>!e1>1@S1*nO-;?{$VfoXa<Mx?D|}nBa=qYXZAX@Tf+@REPbs$@$!MCGjD>GP
zwpyc>YQA!I6{nR3OpC+XB3G)rFg`&&*-{z6!>pC!q8V9PgiuD9|3|}%^KKLgf`F|A
zycm1AJXEm{34ijBVk0-M1xU9tjXJuzDnLP=ojNTsh2bXJipqPTn_j5r9FzqeBo&d7
zL>LfmIP0y8lLZttII{dp7Dx-A*k+=UyWTCo|52Z#{d3bg;HJ&8M4e)t|8dcD)J3s5
zsrv^8q`Fl?V1)i?S#v^^F@Nqr%v4lVON-14`qC+u^#6A07p1FRU9vKAa&!cW|NpMe
zL=c{sC`(B_LT>aAd-nxK)H8BW8;q9diw8q(-NK%6pqq7<Fg{{F1t@LNLmHazTGdwF
zP^c(Z+`rz+-v@<aV^Kd44ThSs6UVaFh?UnZ?03C=iEe>h#>8Ps6%qxNPUc*(MiJ}s
z&xJKc-DI5|9eH;+sgaIc7W=E5!xc8<`AV7nevWL<{!y4Pz{poGt{k%?u0^hQ4BOIp
ze)RxVmFVc`s+DY`<E0t8DvKj&^B2w0Lj{VQj_gP1ecQkI(U({pJxJj4%w2;O8Of0i
zP4~(dOD?4giTdV1O5gU`CN#f|8_Lt{ULDETq@`6uKm4i8Sc_~LMxZgJ;@H7lYl?@n
zW2cwSh565vFStWP9T_dP5;rIbQ%QqC(EBYj3VVe`OVz7r(PtWu$0mSvn4N8XoEv8!
zvDl++78q0XN~PuJX^Sl!&D8or&q^Tv+(IqCj??0Wd3w`$rTK`KxVZR_>!Jm=>C{F&
zy07cDT&$kSY-kNVUA^1Zj&^lhXko}i7gb;tbqRq{D{vm*QFEZ7!24VeUXHD;?T<T<
z&$z>Kr%uy^?sRv4-#$c>0b^5^P+|K}`t)QfdXFcxbnfLr9viek0~8B*jtP9f4aH~A
z4mmu{|7~lb8c_7j3H|)(5EbI2B4*Kr2P&_<zw7F?$`}t!y8i5fDmLPxnD6O|)LJHw
zI^E*wyOo8~#DjsKtJ&=jgqJ^}Ws`X+L0)X>FXRnXxgF(cToPG{B^y@P^jgid?b;d5
zm8N@bWTe&rfn0Wts&B_7E_}NZujZrahMp?_Vi5yJU@%{KDz7ePfh&_36a{m0Z(ECs
z?ukF31nw}>+NExlh4xs5;6OCD$`Q4{-Guh_Q@(hDVKx68)S?UGAByTUir>!PcyeH2
zb{Tp}jFMV%3q3RK5=JI<Sa`VpZ4Xh=+_o}h^skiQ5f=5Qh={`eSPJ?AowYpmhg9Ky
z(gnJW<C%=M1MvFA&C(Ocx9EA-VB-}dd_hUg!otE!@cRnB)h@smysm===TrXcqD0rD
zqtI`|LSIgy(7iqT{JoKi6;^nO6=q8vaF`YnJvrFeLQi`KHO&CpM{b92Wu&C22oz~K
z|FI-5d5K&Py7QR2UL2E#8fW2$G@3PoI?7&10t4xej*ha73|etfqW+*EG#DeQrkWat
zktbCML5(gZHIC^|vwvL}^YRd&yDMToQWLwNAp76=;oEgaPGuvbtV*k?cnHLo#*pP7
z!^T+fUWq;U9(TWzk`lHk5pnSTzi##|1{p*+82U}Klo<UPfKBvVh?82fTjj>Hr)cYZ
zfLnBmB@zsVZ7(1^-W2rjKYhD3r@IhKgJ1P@CHDx&eXGy-U<x6qsgzIbxN}`%vEIs=
z^>nem^q{X*Pow%u-T1J!10zhCX|I%ByvYC<d6)1zO|(1CShk8-S3fQ~>~T$BZ?$RG
zYQ32-@%h?j^<!O(rJz52%m4E~B5ffW>i+)z2lAA&0p`}b8rjMA6&p=!H;=yIkt06@
zBadCpM@yRaYxl?9Mp$6Jo1TZcjeD!Sj$Mk^CYoF~73Y=XkO*1jN9k&X@s3}bk^&pt
zZJsU<Y<eVcn^$d&I4JNQw^{ud`ypQ5ZKz;03J_2WZL7W>)}~)U!HW&tifBgYl{=P7
z0S`O-fReKEby3=HlVMjNXV-3&R$2D1=g{0NV{1Ac7H`_BOR_(ORCUTvj6E!FHdppY
zF&oiwS4`{d;N0|9OqmE|YkpH{He6AEGL>lVY}y5;5Lw>(t^c#6|7Qk`ZebEZCFSJ-
zXMcIv0x0w3ddipA!`(+yc8n5+s%~zK9}+3?T2xmCr#u@YX49RGnR>hNBRX;LNnhqd
ztOO<XHHnW3kEqjHq{h&Y+AL_nG<s|?`Y8VeC$;nw&ImL4pp!Qrx?>+tL^JD{$&qpG
zI9wv*vWi`zDX|@Tkig>*e}-&Lse0RIU_PEvYB^*2Fkh!$EqQ`gYYP#i=|S|JZH{3<
zt3V60wT?rMMT?`el9|WwK+tZzy4`bBK~SM&)ANq;P@Y;PuxFVp?k_Nnc*)7J_k}Td
zVAJ#TO}WvT;r`l4Wnq<tb$0@1Fudx;%$$TMW6hJ5>KV)FQ{SG_&l@#oPqQdx+!DB~
zz0P>_KdCw_)eYR782{!QxSnk@w}Hs@9DAy5t*>o;q!%1Cn_LX<duF^-T|fM$Q@zG@
zuubWcww9Ke?di&VZ1V0VpCI8vv8ku__pAHv?<Enbz-+~H$!tP!1J<0S-A%?>Ftxbi
z(IOLar6A!&<8`cre(mgcu9hcjhclCQ&pNd#&8)N?Ev)xfhove^i<~{5aq-IlOT^M7
zr}aqlTBEkP`p1G=V7F)Cq-!THmkQapXLX^s$A3NDue0koVYPyYGZf?cd{SU632PMJ
zYpJf?U7R?)-mDqCI%MfeqJhie((Uq;K_PB6d1AZDe&q@8cFp%frA%r4AvZyXBHQFy
z4^JL(bK}uzP5(Kye6?;tSAB-xH3`+GmU5GJ1T!D>bVq3Lk5*%ky9e{tM|dm;9{+B_
z0k%Q)$m0o$Q>JCjNV~MfP)^qn)neW5^O;X3<ck*`3@@TFK>k(4R>Vm|P560<i`rma
zp?S1dpKZMVO{cBp_{NtaM~x3@Ew||9N+s@l_C(kBY#ciFB3&nb`@<;&d1qF{ij*DN
zXkaxxQ!AzW{Ynw*v%4_K(T^0`rc*JYf+ro~0_R$%7J`NHFd0@p_A1$=_2>7UhesTs
z-7gVh<Q+>%b^$|D1ka#)T(S~ZAULybkB{q17!PWlmZsJZ4Q~d^t#yu4c$P|}+=F}5
z8z(v@@^9N4S=6o?=E(bL*}&A7K8uX!&EKC<Qq~&FBuS2XXp-R&MYc8oYYv%dxhY^m
zks#o1l*~yz*nU2_MY5qi(nm2v#*t&J{?ayNvm%srZEQ)`$=z;anWk>6WhU!TNY=g<
z<7#$_t!%QF?{b}<$9@uj%=V|0s1a<kA$(^SlW4uA0GV^xc%>!zgjkLOVL~Z9@Pk$>
zg=_2vL><b<zNWfK+bNp+y@}$aoFA#;H`96L%1Mjk-6GBA@Zu&URjb{*bN)uRFxo2H
z`+D}){%?%*%<XUMz;s>V1`7PV{etROHsPe&_d*gzHkDx=#(HjZ7#y|5#_-9bgD>A<
z^Up>~49}W+c$Z$2Fz4Jiy1hEq)FdHD;iI%QZ;P;?HRIZE=mhlV*sVmuLKxqLyPmYN
z5Zl@V0&vXmMegE=E(bdenPAH$or5J>uICZAJad2Kw3AI>V!S?5>a!TH-H>8|<=*1S
zYxPblOnO3x2LFxp6s_|@C&4m&fn#QU|JsA*83CX+aHUQwnC#raUL5gx6DP>+bj4&u
zQQ*5#EmuzER2AIPvJxCSrQb%_rxGTeCb^$E7W@n*)7o8>TUQ{t)R%LU^Y&iT_PC6#
zL;s2IbtKRbUR7d@y(K&7RmfF0BwU>JVfF#@eJyNJ6RinG>{JM@%YfTRQZ<5n<_G_b
zNp{0Qv3bAt60o2Bn55wLUVLrp{8z-Z(#*nCmP4LXpIsVp(c>nK%AQ7r<`atp!SmyN
zqIZ%~R&RiM#(w%$4(0pR)ApHyB+Z{rZt=8!_gEVq>%udau5`BI5awVU%5NQto>{)P
zVGWvl95;fU-nBL)H-E+FUl3=KJ@{J4Yu)@f(a(3r-)NanJDYAIAnM^%PDryMtmC>>
zg$T(=JH_}hXz}JB+5YrN>u^ff?#B^U2=v|NnS$E}ktIQLWu6rgRNQu1Gon$P)})yZ
z2(OyZ@Xt}D4&}YE^JL?g6>C)-kW9PJ^^%wu@r`eyxM@4N@uWHQ?7#`pI7SkSxV46q
zwQFARa1vb3mgnDQoZx3AAkvB1yfD^@^nHKaR#sM)0|_T_TsBelw@=Y74lc~9o*D8g
z4*8{R-PAt_DadLI;mKsEBYM7iXLDkWN6_;}K$PQL;hFmvs$5mv`oj<G1x?yTS#J~s
zV-{xohV3`Ci%Z4v?k<}r%aL!aeo<3qux5{WuyhnNy_bG1@+y5p+{{2yg3?c-L7Y5@
z&CC^rLvy8Ta60%TZ-w>UiG>`6riucRnXLgH5(hq#ERf?4M-}r#+^u;P63^30;bNa7
zn3ZK+2Uk*-DAKAZS4%>w*KzF)Ia65v;MP04Q#WJp-z+g+EPf4>m&J9lcF8cE82%Q)
zIVqS4Av^6IKyFDhIAq<;q+;OAl&)K9YBfkVn!N%6VMZJXGbTKylwW4s*zdjnAc|je
zwmK>umvQC?Qi6E+_#3VmzqPP)p7JTlB#D$eaP=wk&?NWEyCpihDWUa>bkg0KOWaKw
zM`dq1by8;?n^!KMI8@Q#^Y(g%4l^mfUHo9Du)k7P@zzTw#sQWpah8K8huF099@0eI
z)dWS|gY2dC(R6&N*kh^AxrF}5Q}5Q2rpq)3emV{<EdB5(uWPz?-(&n5ZH0~$DC)@`
z5-Gzq>-N&hnfY1h9JTsRJdT-K>n@EudT8n=TVmz9OnVgTozLG2so-~-VXD$|cSdG%
zt*3`J@4<duQhz7FGfUkXAbTO_?}Z=6cYplqiV6-TcDg4p;1D%UpuSYY)1EH3@@Y^i
ze~>B9F!f;i8r*VyWO_fzd$r}JS71rf2MAZa{R1-664-S8NytJ8b1@8G!X0k6{?OPH
z`)cAZrQh~r=IYARF2N6$$KN0tp28jrHVcVXeCJkd&34SN=aP0!zj;`HJUuVrGXG5I
z!$%X!*~K-s&ZtdY>s-C1>A{igfVU}jiyuAM`g+E9b$D_feW1B#;NGK7BiD3-WJu{3
zznpFou`+dqV!J$&Rf_Z8AiNGiC5R*JmCb9lb{`k}&=(Ga75TLhkf<mIUZo~_RkL_3
zfIL1}tIH;Lf6dh_zo$^c7Vo5Ru5FO64g8Uc4R78%ttmeHOh$;aMKqZ9H8P)-mrG*f
zY9_hTF;(R<cHr9^L)*(EC&wCFbob1gWbiVKwJguwc_$S8jjuf#1{!*OY-ChQqwxeh
zNONl>Y}(m6vT1ySzy72T-@{-E<>xZ)z=haX1`8b;6079Gj%7AG;m!IcVzu5xrG<q{
z7fwR5XW{R@*SL0B&_FyruTIZFKXyZ~zJ4YMNuf9uch0+(aj!G>KMBeIH_l9L0O4h-
zxaj?3XDsS8=k1}74aG9vMAKmk75Ng$cZ>v)d*(%46X|QK!LGN{HhP<absYP~`oyq2
zJP~K18^9r`oJPlZ^K#KZbq<UDI|dgTT^d0S3{momE5``QL*lyr-n}}*FhPro2!ZBZ
zY%gqw!<o^uPd@p6)%8(NCCJ;%z&M#Kxs3{&CKmJLsaCwp$zMoyJRoIg!6DNdYK+0B
z&v|wzP$VvvM!a(jPJP94@Jg2t$TZ(ZxJKy7iBmlz#DHwm(0!|7Ydj8FAq}qcee+R(
z^V3pY!twFV^+OenD_8kvC2(72vdyiQ=OjY!*(_gn{DssZ+!+35my$TxANr_IdhIUs
zMXKE8>NJj_r$<L4AGtAvw<iRTy09sH9()uM&1p<~Zz#w`Myq&ooItT2rw=>16k_%=
z=QeonXC^HX_l7FY2}V^eZvp}7E?B4n-jeaog?*r2wgkO0V{vhDz(A@~01yal8}f}r
zDqd7hTfl3?v=Il$r%g>F_9>0<J9qN0r1l_1S=Jv4;HjiJ%q^YGncZNF3bozyClcRY
zo99Z>qolUK*XktNy1BVy?s7cHwaw%=JAykvMG&rTTsMr%d6%P~TG80DBGzVf^Ei34
zKeKcF;fU1fnvYZ#*TfP`?@s3~MF<1~qNTo)IH>YWBmEU2r^C(sh-YNb7p1#lB22}`
zA}2U7-)XB6ZMYc#Z7;pYxV*h#sV+FbUp);Azt8NEbhtvI=h3-$FNX#>U2nBdbCbCC
zn1XAvf2Np>94|eb21hi9$t3HSX4*l|x%im5^(mV~NA_D!!rM;60yq!UlGOW_MO*QA
ztycKIs669|*LuK=oAR}Q76bC&Qt>MvEnS3Tt&CvS`THS}LVw^O)mOfu?&z7eQl^rq
zBQ`$d_oiuGoZfvcG&fvIjFfZM>C46FqO=q$qZ}A`sB4yG(rTt#r5`Dh_Uk>*=akNO
z?H-5QOD_}hpC3<_D}>y(x@jG{r1kh~kZ3v~VS!p&`3|lq-|3;<!9dM6R>&YWlm1OX
zdrxI!8(|hq>YaQ;f{g+SdnbjI)x6Z6@qO+Y8<61m-|v)9C*t?S5>ctp@&)%!X)wI*
zS>QCYu0@{5^qK4YR^?lHfQa0w4L3Ox-A#j;V~frYF;Vagr8`IyZm{!M|LhubbUi;g
zD+rTc1{?BLr342%&oQmbR9`q*-`R?*<QfqkZ4^lFPLUx3vy|#B?!|`#djr3@UJwH5
ztL9tx8NYUg?c}8z^VY3=hjX8`^B23YMvcp+YZWyWRZ}FDpEtSIs%TsjQ(xk}5Ib0)
zPi@K%3JMCi1?|PsbKEby@1_@{v=WQye3b4)Gk>lS8OUEyZE<9qz_H?#09ZK15d_n(
zLbKAZ(@;B(newhVzCtGLfjp@4XYdZ28hMD0Qp)FBPZbGh*M5xX;05$$Q8#yVr{sv~
zsCEi-lH;JJ7a4xueprt0I7wg6?+-lYfv!z;p(E2_I+2>K6Q-?}g#%UE$0DOt8^f9E
zQ?m-}nA9p0bE|8vC(aLs8@koBY3pvRIU&3Spb#K#<ISAM4(Rw%J`;X%I1dI36u&D(
zi&Kj5!l#_Vy5sp<9p8#o!)#WvMOZ$_Pgt0O+`{(RZ9UmjGxZsfjc>d1<%QMj1lq)B
zJAQYgwxjPRLF6ESV%Rq$VV}^a=eeo$s_~bxm;@G)eRrRGizog_rPGp*jxeIdG)dQE
zgZyOXTFRnk0Z(xs1C<6T`EN+T7?;&xFKg{q(BVKk=TwFbO-foWYIHt-@Wy$U1E35o
zry1nO+j7kti}?i~^D~7nWB|T;4gshfH+QW;5R~9Jn02U2B*vCri}q<>cQ5qX!h!m6
z<SEai^a(SaA;^ouYn90A854(>k7uYt>+bD0%kD8H6g8bTEYsg@L7ZYhsP3fRY8=oB
z4Y&oGSLx67ALtfD=WN-Z9>?GG!rmxu?zBr`43>RY&ZkAx046ucqs@f)b`BqT=Hc9E
z$*$2_4+vXxet`=dcknr>58w?6Yx4ps<+c^KS+QW1Mej?JgH0$6faj}Yz079j@L3)%
zGYcnotK*Rz(IAsvA_T&t`|c*khu_0@i%TY6N<XfAB=Sw6;6%CC!Mw8mn!q|vwnC@P
z6kFp?RpWV|aZ{0S+VOQwwx-{K#pWlUa72Cjt{h<ve5)1r*5&ah2pTi>x7;Wg2puW7
z$AZb7<^_H9Ni>A4JstL~;zRPrvcMjnufdW(c|*$CMsl`w>*;ceHh(k6g*netqRabl
zg6}*|n<dI8KE-8gHl+wT{x;*?fOBIF@4PjoBPdg+|L%#4ou1s$wyNmS$o1x0$n9&b
zI|nBqdI0Fhm^Z%Q9K-Xv<UZh7e49s&GEL6KOk>Kk=w)RG-1XP>eC_HGhiOCOi88~J
zdz~__)Z;c}W{-Ug^X`j>>N=gYi>6Dy=4?x<{{R7ux9WO$4U@j`T1oR3DF`w{9M}C9
z`V4wHyoz5QnqfH%6C>Qxt!Fzan|7aRrSiEnh4RP!PPtV$Q;gWJ#o*j*Jpb6Zb6k&{
zO!vaB%_XS(V6alCydM9s2eBr4?zTIn;kuR-YLQS_{dT3OPNPt3Y+p<ogmZXRIrLB^
zMbk*xG?y!%JpzjAi|ehhCeti|GXFTg_x=5HqEy9Hah448e#BZ)Q?HWpr@f)-BV6Kf
zOLzGGiZ4fc23RhJx{iICtlb(D>sN|SPL}irHhNs|?<jABJ<4<60<q!H==t;e&j;@d
zMMll~gj$;Imc|MjH@A23H>!%s-FgL(u6v>4er-+?T*n#aF;i!0sG&SKzAqkQ($f9`
zE6}ZEEn_b9Q6_Jo^@Exs2%lEW#p-ODI6wnGD(a1tl+<lw(UuRsfo`8o9qRI!HoCk{
zoDOP-fy40|Wu5Gd>G5QM95%n)zpny)HvUb!ceSEnr|f(;DR)&vO?Xy6j_v5%;A$$K
z^>f@~@sX7RL$ibddG4Rr9#w=W<?)@*CS=LWRhnd5?!{&v@$;m8p77GKtWK(~jxQSE
zwPzJX+Gn|+e}CqQBdur$a7p*<8lDh<m(H3?n*26pps=jpD0}`{o)dH<U0t12e{2*S
z6qYU?&bUlN6C9hPQy)EJtq=A^yCxS_qB}1Juw$*R+3$N%P4N!dy#t~9*^{%6SE={t
z>u_T7ncVy7ND}o|Tl5w_$gEx(xr_WPb_EhovOziHl7BOchd}yDrXrExIZr#*_a~=W
zI9K<Y&-^srXIEfAct(HuCzoyCqCc5iRY?04u_$px%wf&Kh$P9gPQj3_*rr)_%ZtxF
zrhS9II2g+@jYimBCp*zTGLyc#Y$hA|M%t9fBZfyDq#!6(z{u1j*8v}s`)CzwO}epV
z+QS`WZ~Ak?uc3!RqV_()@U`o$_ZO1`yVw0on@2$a%%=912RwhR|0TaB3i~h9O;(^O
zd&upV6l_3y(=A7gwNTYHW_s2ByzvpNO3!AB;<oap;44Y{XuRban&@v2nS0L$-Bo$d
z&tJZ9SPRid<474<_x`wtot^#RFcdqN)jp}mskY*=-BJ&XL{luUxc-<rMV!8F7IVbe
z`P^IKr%`VCOF8o5&tieN=E>6@_aAMAYxrj`<_;*QQ;8_E;53p_9FQ!=9Ax)^`0zwC
z$NKYJuHor7JB3|;wKJdk$-8rT6a-qQwfWEYF{(Y%h-CB=mW=_4VXQPsLHl;}%6NK6
zcH+Cpjnat_eH$+t>IwrJnA6sCg?jnJ8H3h-?JXR?9423tW!liI)D_GbBK=O4%bd&g
z;(Uyww}4(C{tGM^rvZJ%JN53+;_okjcHZNe^VbS|?9_=N`M9>e`S|^`Psz^+$;Hx+
z`qpj^#OS$ISx#3~(i^gjOHm}$!aI}eH|MW##53oD95b`$@EV0PeQWt`{uzL5pYjLb
zi!wrOlwtJ-2;CDLIhcQy@_6N;kdIP5-dh?Gqn>zjHAFhow_Tw4*)sWVif%YZ-%&0$
z4cuy|whKP=Opy4j+f360hxoyA=5XovMS&qTjh_q`Mje?fpd$=bS_6j5LaGw_elnqH
zTxaRzGg?JA#e;8*!fscn8NW$;x?Mdp)%LO4Vl`#Jj#+Ir!Z4JFR=tD1FryE@xZyyT
zc|m#fMN*2Z(^&US!Pn=b+MD{Cn(hx6ciV1#m$lZ+UtvL*-1KyAga_bz?u@B(Hw?zP
z#PV7PQ!`2rFk%GLKb!5nQjq(w;AFjo#1`|-9(^MYeXEm!L?E98Z{A#}PU7y6T`Gh{
z&y)9QE2m%D_r{ayC4AIKbfHQBx^@D%lZ@fLL=Ddn1rf4L(Swjgb&1mHI?qjS1zFR~
zG&wIOewppu2GH07%UQkBQcZA2ky6e#D6oHU+hfR~@oc}^qOWV@w9OjmFFGF$IT_GE
zzt!<9+4Veotp9+L{CPS>)15P&E=}?yGE?RDv*~Y=VasQDSTp$Jp4Pmly=UL`1NOKV
z5Q3I1yTw0}Z7d6Bs{bFtzB($(t$q7|pa?1;C5@n@gi0f&2$Iqr(hbs5gDA=f0uq9B
zNq2WQNcRvU9m6o>3@{AyJ)U#k-}n30i++E&Tx%9<KhLxGz4yN3y00r_N(aadN9=wg
zma(A^JNIr6BOH4{FW^}5K@s7;x^(Sq^ih4yejq_nPFhESbE9=?!`kTE%vjr_;W9Z!
zvzy!4IL^G%;p%E)?s<D<lO5R=_8AIjdoF!)jqH1e8hGq}0pFz{5vjcEnwwHGs#@2U
z98lRUqRaMEg-aUzANZwAlg}kK&c%jf$eKf7tH96l50ceDa}Nxv=UX_M=GPpYH*u-9
zH;1@>MnXXf=J5x;FdrJh+*B4ukZ^1)S6YV3)Ox)!RVn+YY^K&iJ?zPZfI^@~jPDod
zK5#;cQe~}=5fFH+ZwN3mjk<Jr621_yozER%k*O?+-#w$~RV8F}Ow8qblVKja`eb4H
zS8(X%ef}_*LbUZeba>wT5K~t$;$@m*9WcD$%v)kzbgzV~o)_PbUtM~*IAtlHhvd$f
z#eKjHakR{|*Bphl8=B0h1XAH&(ae$VaTu#jcgts>EScUIC}}dsqJL^&4d_Qo<Whzc
zLD#-=>KtU2PQl(fTv`E>dWiSv(WAnr;b8WU6p2iweMF5X2L{Nt++mEz;sR=2H*iN8
z(@sPNo*B8Jxp{6CC#ZmvT<jz>=_1EipPtOTacRN+E!97s<8qeO@&(IVsp_|j2Re?Q
zsUKUTYhVJXFHUI4-D_|SQ?OvRR42+j0GY`p;f})+R;kJ<lJ%1_PfdnmJ=-n)vLvA;
zD*yob8yfS7Y(t8`;T5iPErim!39YtMm>^_tC+<}HV3=RBj6x`#msXL9S-*p2&*b%P
zUNzvf2gzT~jxzJ}SKaI7OE!|SwgqYxg1|?&->e;bIUY?z4On!D%{S=9W>v%-40w(?
z`Zrz47}n<=N<!Q^Oe#e^gt%M-5kX=Pvf=?6=n`JemYK=KnS68KIm-=rAwUR}<<9SU
zX=AfgAHfYqiTS^4uQ4~+eE(D~&20smgmXzr@s}=-pZ=Mrn9r>M561&8u7Rkis5_);
zkG}8V|Gx>C|EF^Nt`$IaD6=sCU0=i_zkFu?$>XH0;%TzHlalH4E@!*ciT$T=tjm@*
zp#<a`rs_THWo7m>FHPqCf>{Al>V1Ul0^_}rEZq0+e*gv^D;N61z<&d>_AXa@`ggp%
z>$$RcdGQKiarA!xL%94?cXn5QtTo^Bmg~1@L8-JOJbq>Xkq{;&vqf5A{rh+0%zhi9
zWo>1pZ)XRz4u_l)yq>(wYX4oK;<o@h?JoqMLR@^)AKr5xc>2Gns}L_l-ERpJaPazN
znEnTF^=NdR>Gu!UWWospt1`W#A*I;NcFX(yAI5zB*N#GING<V)Tz-!V$hG;uiCL{m
z+Tr6rfLbVV31w7SG9G*v`2*sNLP;tw{?X&d)TC-{yJB&dZk&JYC;qyPjEs+uXkL83
zQqq-6YlweahN?6kz{h3}6ch27IeRhdkA9COVRys%8^{7YeEop#H;UcBWCSW30w4zf
zj455Vt$Z%w_9u{AD6ruFpo==eVAr}U&!22ATNdmjKYR>F#VZz?E^Jq8%w4TkhMlde
zJIuZe_)$~M4bz3wXob{HmmB%dhD-{Yo-xmfR;6ea8|FC>8~0{n1kKAPi?k*aCQH<M
zxpgnqvH7*_nIhlX$^60|&6AQo-r%m$X-ROBREl?&R5p60XvF3{a8;n_nX8eQ2ZDTV
z%HzP99o_@on5!cOS#xO@e@Y&E*ich$pt55_b%Wa6MEPWT+gW>X5ivfS?~q1+E{gK^
z@pDj&Evd$c3RK`&JCilU-dr1~U_3XyVv@Z2a$}OgS63lgKMQ0x{X}HSYS_eSV+RVU
zcN(vpi0HxjjY$QT-zEqIPfSdN2r(~X0Fl?ToPhF4`}x=Jo<LIQY0*Om36lc>F>N4m
ziLwByqCM+`iQ3pn&y9(dPHw-_@329}x$`bAOu3g2ysE9a4~uFU*!i-UdV1)fnN!~s
z;Jfi;b-)>UbNGB!E_w6DSyFu#eYM+wx@7#2(C6~!PL%^yay2NNQgunDYrl*EnsN?B
zfR4uW&{?OXLYAQ0S$?g=0ZDK<u`b4Jt&RkV)@(J|%cA<g5H?lQE2PBD`-$Qgi-<C@
z;<wLoj?S`&_T_oFheJ)2Lc^Zeq-yp&DqiT~)ZuL5f9ghASc-ARbfzLcEI?-P7skvt
zig``W&q{7$_K0ES9vWhKZm!{$w2;n`h-^sQ3byJoO1Z)aA}~LqGMqiAXNPKhGJ4Ie
zSRy}Jt3<zUVmMMtCXXx*jl+s*>J4vktCWloa#|SI7s%J!-OwCkOJmA>7xoF#gsmxp
zci5!L@c+0Z1;iO7B`f<;3%Gb%h7BF$Q0OtJVb&v`%?x-^reYVlW4`(8@e!A7A-_o;
z@ya3$6sHJ-IyfPNchZge>u9_Vs@@_X0nfPaS{m!z#@uv%5D5ODs5AREj`ak4?O43I
z%1(1&vDPEvWVUR}AQ<aV;(uI|s=cQvtx0o<zb@59{;yB*-AWV{=nS8eKlG!=&w6OL
z6C%N8XK&b_9ld+e&sr}Oul3hig;>M7zGE0y`9s??GxR7$$b~ubw*7Vpt(Rvemp-6j
zI9;Fca62c!VR4yas&6u7MAXOkL{VqXw4C-snfJh;LrJ)Dp-U5XNY3Mm1lA)wFShHM
zvoaFhcwSmP)tg+gEk##uPGquox*<t5Bct<|XqBzwT(k0f!=5Q`yE;2lC9fWbg~n=+
z+5At8I0unL)jv$i$HE9~Ulk=zBImZ>n1rXU$OY0hEACFn6lj-J2{rfazIyViVZ97@
zcIioss9nw=ZG8qL)Sqpg-|NRXO1_HU3)J?ir}`$hw-M&U>qeT%eBB!Qgt-tc`|~=G
zxJz-%P%;puz#$XEUYa558knEkHo38~++Ho!@&(Qir|w2eK}c9@?iSMj%bb@qcT%Wq
zt4xV_l9wsM=-j2f;s6ulUAGH#KM*(;;6lt7Fo(l>O*9wqgP&C4$J3IEfcWG3Ss!3<
z<+0a+;9{CW3{|CSSf6AB5h6^aJjpv_SebWYg+AvQ9MR@DHcUVAxuEX1UwJ*4b&MwH
z;r`^SaR>UkaZm3KS(b$l0v&%npd)dz&<@?8&#|vOd=L>JY>&c*G#nQbV63X4)q{n0
zU*|K++Yf0#Vs4bhr7ycNEB1>!O&(;hM$71v1uCDje75d{ivZPys9V?Hr4q`}MgGKI
zqi4dqdqk_w2ly)KvwD}%{Lb9N2RuDR#ezG5V2)z*^KTxRcZbCI7I-A?VTIhGXi%&X
z>L}u(+u9S_<<X51a(zmF7Wd?!3E>bC@W}IZ+go2l&Zw(SozE-jr#9SD&o;JM=4OSW
z*C9Q{9efaS!%g`1ZT8kQ<kqm;PPtr5L~+y#I)_KNJRauW!UEIry{NFAdYDywv&AZo
z4wh@Kjy_o%{vfgr(^ZHYL!9mln(vm=9bf0ay=pgoJx|bT1SC>D-f5;Y{EAm+S_=MY
zz_XGbVs%Zj-Fs&-J(A<j{`toEx#-#9PyD%A2A&sWH~8CSSd=H)_w#iMc2HhZY0j>b
zyECjsDK|aQxh7&cdDQ`116xyKhgAN9qt$L()hatlW<nC^Xj^C|Vv()qK!$9|u=0Tq
ze5sMh7m<P1c8pM5sEFERm=7>!YgnAj>Mf8B+8umO%mx}-E!-%as;6OfTX3mAKKqeF
zF~?bzBJOoOG&;T~oyNt8Z5sw;UkBk1It6Kb$~bo&b5xE`rWPivgu5s_Bb+Vw0lP3v
z_0=GUzJB6QIkozdicWMHIh>i;-OT30n%OmG4unAZsE_7iGouYvAwxs^b9F0~ML^DW
z7HeXgHC_+UHSjd)y38SUni20^nqJP9zi0qoy<1s?e8!aVBB=0^c*nsN@InAAw9aR#
zPO)9b*Ay(;;{?~j+}U%tikzx!!oW~#?y{A$0BYC+oty?)vfNA&@))P3MPZ#iAZ^MZ
zssyVQN}t>>Od!u!POm{`CQp<=%YzZU)3m$qjT0@1=E3+Le))Nab=7mmMJ2E|n%67|
z{_4EOOwK1<x{*_MYjypm-N~yE+(+9?T6`HHz61Kso^nL@HzuhO#M>9-<lqsI7M@|M
z<9u&K!X(!mH=AdrXVLa5psaP_Auh^@@3vjLTunF=bZhUu(c5gqmcfVdz0{Yr`i#W2
z35<54DWX5^YyEB9gODud3(+#k&7jO$NpB-xHH6U&+-%w#I=FCU!MREXC3Uz)(R3{#
z$JgB*%4;^P*AVMbsI`)SgqaXwXp#DIEcV8=rqeTrrw5x`Q(P=!>~7O~b2B(|mMtzV
zuE#W945{8kVM^Zn*$ZZKHj>^|H7$u-S42$f`~*VSeN2|c8V9yfq(gbNsBGb8Q7bhi
zastg#-cje;Vl+MKNu7D^jRwn^VdUBLEKAr?Bj-uALl;dz%dubX!W+YDVx}e7?N*u8
z>AeO;7nZPudbP*Fb)y9PfuS>Pg!@^-I6)^&LANxLFyzZex|anwuUKy1k?^a{`u<%L
zSmrN6Y;)!am52Da5?d`^WzHJ>P2=yWoU9vU)#oih=Q#_f%Xlr$9(VFr_$o(C^S7cK
zzSo9tc$N*l%92v!B(GXQDwQWjK-&YRQ{Np7Y*2tzK`7JAiz9U1X%P2Lt$36f`W#AJ
z;o2xp566q}bdr_B4+<k9l(7-Ve||N!#i)2fr;TY8OyHRFbA%7Y8t}q7i>VWP^J2=Y
z+wL^C+1H>6G8=d&>@VS;Q!oAHnx+Dl%jwPX-jV-RYt!o`(G^zB^(#-N72_+k_w^HU
zCs?B@z9px=CY?h$O7>Y0C9sNKOJ5!eLb7(F`Z|hZ`viHibZnk2NFY4W+OQSbQM&5G
z0FFwP29!OmkVjy^5EO9XOwi^CrLw!QG2gI8kdB6GW?HsB2YTV)6EPmg+k=xVvF<Tj
z4*#jT-DdU=Uqo9acWb;Jl<G{iMC>VT`GmMShpZSFM!y4fDA;>$i<_VgGG47P38}M^
zE9jJ+Jw~9rBeKT`8Rr*gY3lz<)IX}p-&l1Kddktf9%fQ@Cm@7I>IHewh-qkjs#y|e
z;$=ai!%tim+0VJc0?ftUu7&=5p49>N5)zKerU;G7j?!S*yrke*9V0SbXzbXkUerde
z?v{SmOLZdpY-K}wg2^0kc=^ZywgGE^b~<<h__o55ZfhzDYX;KE-#+1z(%dYyM-gL?
za&QP|PvSJp6DC$ZnO;Qs_v%p!k&wb4-0T^*=IiAmacQ7kbJ<jx&C6@|R6DdzR^0s3
z0u7_|-o{9t+aW|>PHuv$@fEdao5dxNfgwPdh<t4^uL3k}Ux5h3#V5SeSz}Ym?nBJK
zy|jvBayl7oSla||e!lB-i%OEeyZQAoFL{vnR`-Hg!_<p}j_Ir`QHS!$(M5BPsoudA
zhN9VAhWgp<{ImVK@aHvHcdsNHjj-qn#IQ={Bs!+(TtpV3rH7Gde+<}$h9PwMTW?_+
z^z{jR+G}fG;&oeQ|1LJ%25sHu%IH4cxGDbmLi?+oBcsl6`geUbTmo<WyY4)}M;AY+
z@`nmiWaN{1(U)Z)X87=@fVR7T8zdge$^;3edCfNl1~fDX*I0Ju1n33C**&M9ORZO<
zn9SE4s!FsmKI!3EXrpqPQb_O66kyr~D?a?bwgmTX^1nbj`r5`i<9nE~0+o8<<Lh2w
z$hm@O(a(IkHHz4Dvl)ej@Bc0X8_=}HSAv}BKnPvD{IwMOEsM!+<U3PH&hVx~0mc)f
zV@WrAF&p$w#`qE_p9z84@CuQPNo}^>6!wM9QQsG2&R|EW;D7nrt_VM+^{lAocJ*Af
zZys}{-+6~;H|onbCT^{;l{uk~Xb}2I2KZm`rs65I8&`~>^9|17S{W=%)h~)+axuA?
z7lSFjtbSH*4vkLBAw8fy4<*eb^r)iei%NxJ?=|2S8`f0YRd(?YHD~?~><M3EY$T(%
zYdn{1z|cjJTb<p<ZTDQhnqBMes@bYn87-6T*@=p^hj@>PXu-X_1d*?5eq7e4koyYP
z-stp77(lYFTm(2PBc>&{W>JR0UM~7Ga_H}(f*I&y?_IN;0?9q+G^meyk8TPQIKIMV
zJ%qc3vclBQa!(Gqa>*ViX;jL}R5EneTtN*AoH5ghC0SRJJ%QBeB}vH~J!yAo|J%?b
zH{U?ClQZn{Nz?U7?G~KS6VnR9(@n<#ef90rAnDbYxp&pnS(rmy5sQps1I7N28s6;H
z@TihtV||4OUptQarZEMH4ot=<JWw;(R%iPF!BGg)oSvK@P(HLQGW(G(?%$=-%qstl
zXY=uV0pQIFP;Bui5e=K^T}ZThQ?4zNPYcl%u(P@jAcP8!%mL#Ncil%;E8d$-Os(5}
z`6f0qZ;kM*NVbM|8`X}-Oz@Ok>+A7<2l9a-9BDvygO%jr5lfs7c5SEe?9^ju1H~RB
zlrgE7tJ2Y^zd<W|irW=ef6LXQzTkt(4;!{dlhWOn@&E>s7OFr@fvxsC`lbNY9P7#-
z-~@1H%q{cy9z#Pb+y|-^zlw~{>%2_erKC|zhH`)kQA)*TQ$NC&{WXITTS9$*&bbQ<
z*YbGa^XUjI!w}3hu7ArRZY+<FJIM?9(2&Ch!VSG|_G6-LHNvbAi596&#)`NZH7~#P
zNx#<`(n&J#F5YatRMM99J2)DEV(~kYPrJ7dFAJ5I@naG=fYtz@&&~+glYRm&#YTHS
zy%z5#EVD7NDse@e!&w53qs3qDZW5g@p0>XkIA7&ewAY_AZuUl%+J(Oq8te3|<wW1S
z5HsRTzcQV5n^Pq?&ojw{Eju>2W+W5m?QlT6`7ghh68*G&v}O&Xgksb0V1isXR^71T
zH^Gn<3-8`?q&+cW6^(dZxEJ4>mbPL$$7jbR%KX$eBIaWA+k(L?;Jw@k?%k)h<BO4F
zT8>V|mJKjs+ERx%ygaJ(CoAkf$h=f#q2lL!&h0}SbD<dc`FnSj68<QWU7wRU{*$MP
zBF=U6+pdSfq+|)HCatUvRG262lkutv4=F@+$`0Er4^I5=`DABoB(S&Y{5t<O4G+*a
z?JWivru|o6>Tz_(*ga6wD09i056O1o`r*tr+D!PEw}q6n1aw?;Om|U1->j$z^H<n~
zut8de99tF1;9&-2IksFsL`p9sSa0p-1=5@UG?K=Ikb+g;{%lQ2oslHc{szDi#oy&?
zUBDW{TC%1k52KsJtg=gZ_w=yEpoP7UO;ec7a2}B4{#=*~e$KGVhn&fbDx8pU(|rHc
z=}&oUpK$*gUw?4S!dH2|zEV>PcpPKXbleHe9FXf5T_spZ7jeWsjFl6Y9{!4VSW1Rn
zqF7Ua@faSJ$zse_g7$x1vU8-o2C#(subYY0n|OwS(L*o`qw4;JHadUp4AiTWTuJyY
z5Ov$rh`&lToQ_?QW&I`$#h-8X3>3m=Ljqg|(>^11OM@49iK_`7c|;ce>$v)-ljkR1
zql5+x-G!cmoDw7I3@s7M=fxo~13I!c$|KraEYT|4QD)PO;}X+NBcI22F_3N`v*cTg
zKK+S5+m?4gD5K={q2FUi1EnJWra0krZ!Q`hS(Bq{yft+&|K(D~p2V29vND>vG^F*u
zynYhgg8in5qD0-6$JHt)**-7cXE=sKs=nIF1SKr;>p0?8jW^WKpUSQMNG=&dxLpgd
zht|E40a9lUn$RZmw(w>5Z`;EE+%+~0WV>{ZWLV=>`x_QOWY=O;a%%T0tc>1efWLnP
zz#QJmy}z?>>pfLV^u)VWN6-|)>}a({4Zb73WTMe#SM}JC{(Zsn_MID;k*sB(`(hM2
z-aspN?dUD^;=!julg6<aCpr9&D;g{x-Ub%m^&!6Sq;CqYCB11!ML*v?B+0%I5OFc;
zKkcu&zpKGa-%gmq0nYYZaiQNCNj884)_|5n?>c|gA5LlT+1PYCI4@>~aw3Za_psGf
z#dG|FWlj?<EogfB%4dhJr~c#{URuA*oxri2w$5#*zJ0Bucy_j0DKD<$Al6iJ4rYRd
zUy;MY#%F12rEDuPCul!0^ARCXEG`A1ZZ2>-rkm#o6d0|((gv|GpSKa60MXK4Oq7>o
zqbXhhc}`9xJJtoAto*vo^oJLYF3JUbN54{3)kQFa4$(=!;HAgKR}AvPCTJ$}oOtJJ
z4Z_3Q>{DCx=Ij5%1#mXHh&7EhDaNg{t~)<f@c$n3ynpFpzc%2!e9mxh`2|%cL6I<h
zHl(^X5WLxYwTU|5+_*1xSM=Vopxcynz-jo_Yo}3_*B)tJ%`Tb_rxeAqtry7&bt>zY
zf_szl7ezazM&4JM-EXngzfvFwafsF)M$T5pYk5qcb(Og7gzjTMjvr;}%R-x8I*69=
zdVB0pq86Xa5&R0Ek3~GV>~~V?03QzUW7ZYv=hB}e0@pu~GM*K`o6mo#HlF1*#vVk<
zBR-SKqa2Z-e#)K|0cp=F@Jmy||1wuS^P{{NI>=ckEs5|G8h3glC?-7Gk)<a(m1V%0
z`}_)r56GvE{0X6tO#oCW0Y>D)t6$yk^*UfI0HG^YQW(J4)g;ul&t2TtKWXm}XD@NI
zN;CR;k~9$r2__5mFf^bP^;aD5=!A=5YCmZ<*f+yrY`}4z;{JUN3^WT{ve@icqN{qh
zWMdN1ixDyZIgMOlBs!p<yge0$y+=aI+kRQIwv-Fr|Fqt5Fcs-HP4W0`ilIHn8u_@E
za?~$wcsZAG2`E=`dnPyL)T`leKB7%ntkoIa7?}_$bbqp4d9$dNKD+Ct%x0|*5WO0(
z*=^5g2Um+muZXp!da=mu>gq7Efaan_+0dfY2_}ny;I7^IVRz?{0&N+;ad6D|d@hB@
zOk59`AUPsMU~>DUKWveJ`>b$tRz2*mETYhsYlNJe+;6hp5Gqf9XL@GiBP(ZIQ&8og
zIX+xJ8}{mro6+lMhjUeDC3|H_-St8+3e7h?9#&jT>Z;>lnk>8!pgBZB-<P?0Q9%zY
z5rS^u3@>R6G0%W66IsBFL7vt++y~qjH8hCAEjixVyV}vuY1gR0s-^abL|IG3JZ7*S
zq%+sJ7BKwGL7Kq?07~L?I9yWv31lV$$`AVb`dx%FFXTC5Bu-pn5#Mh)Ph1oC*i9*O
z&QGp;nSf}$b(opD-Kn`h^FT*c7{XED$SYD=lvg3q{NdL4;Vq?_P-0uMmYJt&3zRqQ
zAqL{8&)fj!VsWcVXNP;c^eKBIEw?s(?3UX{+P<`;6DUS-IJQp3Im=dLJ`1LnpA00e
z74CpXJck1W2gBZey8}DXUb1k^;g>R+2VbwUVaiB5963v$DS5{fC(2f3Gx(|Tpszqf
z6JA_VU3R6~e!V4FQh_S#)@)q!H>dG=n+P8#cLg9z?O9EmchEL7D?y<H<ggj*FowsS
zx-GEHI&##at(;FNsC9r0{((1pZF2<5TvvQkv?e;)11bcht{yeCWvPjdhUtG2#HYX7
zvY*JIrOSUO&4XVdt3h#`Y%w3(MWG|vh2J}IbZ!*ja1ASdemc<P5pYspvx{<@yCv+K
zSjr9^=HMZD)EgFboyEVspEIG5c`09-6xx4)Dw9BEvp0|0KM4O6(!s@^JF2;a{d_|6
zfacSEdwj7BM={hBl%yN2Nv^1<WXXm=A(?CryMXR`Rl_>L=Z_u-XZJ`V<8B=Ox7!Hx
z0yC$XO#+3>*n|YTuifW-rbQoL)LwW`%ePDcs3LgCNWCq}=nyq8-XLtJcB{0kus|pn
zo6<1hb*tK`I=%$1I^(9((=02y$^AM@+-`F$-{FBW{i>KTCQx$0KxMu?d{*40o?-HH
z?%Lv_cK^4qqMP1s<-~jJQs0lH*JdY93(Y#tlsu)AvteTg<m*ZN<;ykHp$^Ty+Fze4
z%}u-7CiIu*O?AcSh59EGg{`vxsAw)bm-zc8#vjTaGPXOm*BKmF4dlQl@rV!zk<Ppu
zGPlmFw-x@iVqL}*nI+Y^)KFQu$a7!EB>~q*Vd+@D<p8rlu`xe;^^*E<n#Hdasfx<b
zEt!+n_j3URz<)t7{_%5h!6l$l8|4Hn6U^@V=FJ_aV(^}+)4gYY<Fva9RGHakQ}j{W
z-6iF1FAKWg$vWL=e$`-zbI;?1VJ@KZrDLTcS{B*cHRrrH-Ep0{G@XF`%U%)Dy`4($
zXRx2L2=XjtueJf5mNVZbT<Yf{46w^;i4L{6AwoB31%LR3fdL|1iwLml&o<0B7z~hh
zSkG0@+PVwQ4=nvy#(%2(*Pu>)ZnRN-%HVwOUrmwNYA)k>-%ehMg@`dq|6SL~l3|1C
z{T`msEynC0DBCdi!l^-_ip65#lPTL{|1;{a<yu(R^)mOT({z(V)1mC4hs$>e90+k0
zN<3hDshHf4&v$**5@j{qCF`3eJ@UqEE~}?f82nqDb^OI5<3s#TRwl`Hc)IyQs<!?F
zw>AO0x+VreI?@Db3FZ&~h`?5g8MWSpESI?S4ARb+$L;8TKR+48?9*SeN`IH~)863H
zoTNzwm5@p^WxN5?o@w_Jmn_#f*8`yauJ8tj$xa^e!lEiSkxij><i(60ve!VvmEuH8
zIrQ+BgJaK5q{U=`_To3*$lvnj0B8?OL!hC(zZiIgS!QGKb5UFT`|EY@IuyQ^Kcr0I
z*)-F7{buTX4OGQ?oKNP*PVjl{vY7yWlcN3`@Bp-01O4Gwr|2#fT>tw^0}0vEr0@XO
zW8QJ&-DUgrpO}c<ALnmc3=0{VEe$ukOOEM(=MAXQ|IL6Aoseg?2r8!e-E{sHI7X)1
z;8|p8VL<|B7dJy*l0p7AT_x2;`FAxco|KdV{qX1ZAKua%=-j{a&<w9DUoj>24^o$J
z|5vG)fZ^KjKZk@}4;Zrd#}DAc`^x_aocJOI2!~{6KVp6-_xtI_!BfzF3+!y4KMn;Z
z>+S93la=XA=lc_B#C;Y3p5yBJ2!LXIjBdItx%ZzL)RYPY11(*+q-x}U;I9CXB7d6=
zq|z4fQ!RvNi7u%P{->*72EVv|o6~;2_F*8Hoe=u_MUhIgzynmy%m)*N*hthKCH;SZ
zG61Y*C&hQS%xW+J5bj|A19!)-*DW+^n7YRN3xJdI$8neOcAL>o_Os>pS(uj%zx`e_
z>94?Ja#cH40GtpNMIcj{b3gGCXZ=6BPAUmtby)C4G)-kZC&DFl5mdVDApLg{T73v@
zWIEHN-+!hdg<bDk|IZ-*nb7~WeqVH7wZ6rf%GctOmASWW%JYY1AlCsJV6NVxv-yXt
zDzw-0Pvh3KilgSAm2EeA>;9f%=P%qY3e_^ZNie`8>4HCd>$h7N2k(HQ7SW6bTsN-H
zr+?Z+vB04K08(__9fB_T+<#z2f8l;09RY&@=BN-Ys;i+MmnCEV{Vi<|U^Z~UVo(MJ
z+C>1JMoO5#pX`qh7XTra1v7$X5`>&pm@@cY6<&&@`}ftJlL4=>x@rMrpv=u3|MXd(
zTYt6z3b^D~IYIPsQ+An7UpXBoa)$rF(1VAoFvxGwOA?~B;Z@R{*w}i6h_elaN6acZ
zBHvL|Tb$a>>EZ%9+uGHh%3OMOnf+6ZPWKB;DxxL}WBt1ZbmF;<O{?9tC<^qOva9SM
zt)4q0Pb6=}{sEJ7FYp?}n^pjLCO=57m3TJ%$k+Qw$rp_daG3I&)@X^Wvhv`ZO>r!k
z;mP}2Bwdto(_goA-eGiGzuFOfPtjS;nWe#1h3a=U@aoxZUD)FGG#HT6fbI4tec*zR
zqAn__nv?48F62B-RTLM3ER7W9>rzn#5flM?TDt`#UQjV>1rQo27Z^9yYvn~X`2jfa
zYO^jvgL?OPZvDoY^<k4&1F_shi4c=eyBUV$u_EsdNSU|aWl8gYL38Z5C}IY)!Ni(Z
zGMxh^gO!0LSkutBBAyWF)r#E|$NZVH<b3@i58F6^*406Ip+(eVn|zCoid)~J0vm6R
ztqrgnFg(k))S`jlh~-e(N?umb{C9%_NS~u^-&6tT(R{OO%x6u)-kJ3H={+Z_^ab6r
z()<oHtx@__?wO2sMbl)>?px}Kf*9vSF|QP8gsdFhf=9tIgpKyMXNu+n02g(3MC+iO
zAXowf>Gmnq&Y9hqhS9}SB2=MOaug@}&^bBQPB~GKW7Ixg9L<QvMC5@|$0@a|GJ#lJ
z1~okN+l?b=1l(ntzSCExGAv!YZpb)rN`nD?q}g@H@zA7?d8HB6V*<)&jv+;cbz=mw
z<l28AsUZi~qAui$v<kk5P=PnGW8}UUq13c+4U(~kS_Q^~qLp)gO&Sj=@X|GvSJ;#e
z+6cz@DZY2P{&q86XD4|$g3qk4T`AScWinhYq1WPA`7)4DBehyXE8v2@#>T{s<?eDI
zWql-R%Y|s$aEf)<&f8@Do|5uD<r0AYNY?*6K8#Va?H5x@h9|dU4}DF=E%=<H>$H9n
zk$#=)*D%aJn-FtO*kp-GiEzU!+RI;MrW1dc`lu9UPy~SE)*l$!_RNcSQ}P-#sVzc$
z1h{4$uj$n2PySHIWR;O-uP_`0O9KBa3x0??jE*J<=(c3c?Dx>dA7}VuF%kO}827LF
zT7@o|vOrx&12*qXtSGOdP-`qdc)pP;;<?nN1DVJRSeseX(lIt;OLaF4_om(Mta$d=
zZ|_CbGxx>&v*h1Jc7w(pA(bsfo^S{f!WFMw<FpX<L?#`1Jk)@g%T-G~^KjmBX`-dq
ztWcdRyM6gh5fj#$))t|67+b`tVwbIa|GowwjdgCYX?gf<^-2GCDC^vO-C-fWI{(5O
zH(p=h)m<6*BJz?wA&Wl8jd`6!?!g^Kp59)xm`NeiN66EDMe3<?%g~vlkLPR4iY3*~
z&D7>T#*5yttlQ#~92ys;WG^MSs)s>dN0k^Pj3$w%fcO0_ty#z8^7Ey|0K}y0^^Y;#
zRTmi44M~~}7Agz1<k;&x0txzPWFlHk)d;mXfZQ$LkUe}5`;ioV*;PFwj2DxTr=_mY
zMIdu7VjWNKzws?>W$2#pK(+^`9^zR(`o4klWZ4Al={;e5N&8O)R1clzc`tmUR|mP9
zp7&*~0^Kw~(`cdW@eXXVErv$H87h}3I+N<>2fly5>hq8>0uf5dUG0yO{DF{jMibM_
zK&uz5><y~@;wOu>$}^>=&=!ZY(zZY<Y=*0(zD)vaR*7Of`(a-E-mk)MDBGRV(GFm$
zXJYU@r}o8!)ezx(&ZIBwG`bDnV^U-1*1oI=#ZDaPi}3AKA0OkAWm>)v%7IicDsvHU
z(Df7=6y%G$w#5npp;QAheqSVZO~~b_S_|IFov$0s8phq^p${sEJuByE!I~-<@%zg=
zij@yg-uG;@VOmbEF)9CelV)`Wm9JIc@Z(#V;Lk<0vh!*Iz557gDn}=R4pxNdELmZL
zP+O-UyxclTgLNYk>q`(k1D5EqTQZv&Rt+0c92J~8#hN_RwH)}&F=qMGa4$&4htNh#
zDxqa*7ADVmQ!#r)$XJ2$H{rf!%&xEG(`9p=7MUWI1<|STtSrb}SXA1jS5#^G^&37v
zAKH&T$}_`bzEy`YNUVDGyl(M5NstZH?lDkP#udXZxqOgFZ4TC{`B=rNr$?DP1Y3Q&
zw2eRT1370O+^EfUaQ+UL)HL{TgSV6=LSi=df!?xp)4sm;r)-<E(+v}Np&QQuy7{7>
z3qE5Wej|7>S7LyfL~W5NQGw|x3zHA3ZrrWfetODh(e*v?)76avcjczDqnb}-0fz+(
zJ_E<uq_;1_9pc~#-U~!CyqVXp&i@N&%+a8PcoSnZi;<&Dot-UlCrq8~S;gCKcOmP_
zTyp|w%?iM=g#g?|dSGsafUk@JXS1=~23A_zY;(8Z31540fD+|M8(=WDsqM1R;3uz3
z@~mY1G(xgUT26;392lHi&PCfeb@ClJIOIKBanL?J3SV8DyRhqth%=!f>mT228U0Sm
zpbJw&zH^S%2T)o8I~(gHP&pP*(}4;;;%eA!Hx2fvh~?Iw0rWI2Q~f0%AbQC*<cz;g
z!%@_Z8pTp$h>wJ6!`^AfOzO_za7*PcJ}U2G6}eE#!6L^wcd_%*_eCJgJV!aenBlg5
z4hsp4sCrn;RJ&N{JXRYCuU+x<Y`sA1H~Bp0<;N_CmejkQ4$wCMy>L@`OZ<-OKlEZF
zPa9KX!({h9yR{`hGzaam=xc7)Yvec@j_xlMJwtnz!EgKPRag}jOzu~42p=5|uQ(1u
z1g5f;?ZrkGo;e!KNOeMYQ^HSouc1%lOyD&DQxCs7y=Wzh#qKtRM8NqcYk$Y9$>X2c
z=%V?KN83LT!9TGDpN&sdxC5*}wUKwfk{QW1A7)5{-HZ~l4u{3Lrq2{+zsKfE^kweW
z?A0o6eD_2p``@8nx_>D(BEX7Rs8`X=;CEtcznFnbUI01|2$=0aT<AIN!pMR~<QW?+
zDa6cR`BRPFj}?{Wd1_!_hBw<2l8)<zvx4S&^kRM`$kFFr7sh~Kwt;htwYW137V&jc
zdCvqy?YvOZ(q&cWrZf?=yIw5jyTR^6Cl1PRRM&`xpGMBo4@0qgnaKfdYajs%I|fmQ
zAjAXWxxCjE>%rPdhu7yg-;S=tN;ES(`$mNo`ME1rsJJ2S`Xl@*GlTyLNbGQj$UO5!
z23P)6cdIX8cm|Z*gWB%cQL`DfMBl6PON3t{%7vglLO#7SD6W#)85NP!lNtA;P}%1B
zsfJX4<ZRsNY#CzvMCWxDkh~K`IyRkkRfl3TR!l&%A4J{}Kyu#E*`asGyUtKBiWa?a
zrrx}qq*pqIDdHil(;=rnRNpR5JRUmS`gR-tF8PS}&L?ZLt%S;gL&LP??_?1k!%oRF
zDG2(Lx0c~=+H!1ZkUQqruTYkKy_^PAiu(GmsE@&Kbqk=h+e)woRjIA4$C5e@brd?2
zJoRmOJ#06{kyl>j813Z474Xc)?IPJen(bwoEm6UY8rq#RQX}Ll?(Io1n8CtgDpc@i
zN*idZ>B<?z*cZ-VaNd`bIwvr_NSCPHwgsQ3Jt3N>-I1(|q)X>0-TR>tF$0jZAuB%K
z8mue><TVbd9vrb;<JWjz@obNcBkyb8iXk^-wmAH}&MD}feub4XMsf|=vQ%Gi-ng6+
zAvgtoYhMqI$$Sh7y#+69LJQfBt<tqcqz_9Zm<LG{klRRdZWftAMJ2=T>6X3<v<-T0
zlYm_&>L~Q7vNP2VOf|*UUo_&9COR*6r{;K8FL=)R*iW7k*jDjl_j?$?VWOjz3GaB>
zl3hK+rJ|5oG#utV;h~O<RRP#09XGt#%G7HNeiJG53F#%xA7EJXZOuf{;}X8PTOub?
z4MiJaWwv1u;km30^(K<4YuBLWVu*7Sn)1Hr0Mtf~CB%9PY;A;dnvn27UBfO*Xz@)?
zOt|gLNROLC0aItIH1V0Ym_sTC0FH-os%a3i;{VKmPmB*A+a}x+KVnLSaMXYP4G~dX
zE9O~B<#+AAL{J!b<(i+fh7~tAAc8{hbo0BfXMq#<wpMvj&Gx3KnElsNk9(p&qp}nM
zQ7{vSp(ur^BE{Xx7oVy*Y>a^fdPs(m>#P8BP{{n8$E25LTb;);f?TiKp^o0GeXH!&
zPC-figo^ORH{FM8vlZB~l%})p>ZaA@!<`?GRr*})MrlZe3<Ij@-Hw(-V(poMW>xnb
z$C~Oy=Uu0wadiP|dzi08G$_#_C+REz6rezsH6a#eq>wdIo)R#-%kVlibq7*au`t=<
zrE76lmBecPO^1NzDrs={gNgWJreIuhyHB#QL5^hpA2AyM;ijiT;$*>wa+xTDkLPZ^
zy{bb@r&9ym0YzNT)pM7@e}_ZE=bivQ(=PqUa8^dY3QqRV9~IAn=e`8Hdd~M;W6tmt
z?U88mo#7Ef+z}g^VeFYz7D9!HbM50q0v*1PEo+OMX>}=uK%iD$a0cgXXlziVJ`Te&
zFn$Nqr@iH+xtXrdW;a}?c7xFP`CK!aad-TgIKM?2uWpfLK9NfTt#mr_!nb7Y4h5+Z
z5^(rFhwLewUlxF|zXURa>Hv4aeUEWs8TY1RdxJ^`t;i;XNX7dq2i*>yH>=iM4&uSD
zzeEu}wFy8m7<JgyQB59eyMN`>YQNim?Do~y+)xDD1@W%IE|Qz1Msq4LnE?!2$fL&{
zX2}yi<0e~C?*>LT9y#t^i8vYW<pQUL?`1}abVZnr*nFy4d~>&FZs++;ncQgfY2@&_
z53LDXS@Xu>w!QN#+{?mij7$8>7~b>5caKmD*e|rUrSb4)G>?QXMQpHCVD_*G+Pz`#
zom+dx%*N&@bjDK09W_okW9U0*S!Rjve;qx{OL7+)XG~{xla{}?tN~EeomJ~eqHDOu
z=)WiHP&dX+@3&b7(no{#Pfg3zxXQlH#|1Nh=2LupbRD$)n3nqsoWNNXG#B$^5^1Cc
z-V1RyrP3bafaXoA`PWTwh<!=jJbqPpb%exOXK}-lcFQ8E9G#iCQ$KQ`%=9j6J2;rf
z2w92awUA;?gwNq~yo(4qsq7V~H;r3B?!#oSkeja9m%vOJ1J2`(Jl5`e9?186n7uq_
zrpkjmn-`x_rY+Br2x2megSEIncbcZ8J{u*fDW``_R9qjYqT;xt79~xPeDsCPPWL{l
z?oj3a_>zeQ_=%wE-Aw_f+2Z@|#y~s&R!*wL@%Dv|lpg)`c=pShlIAnP*sJn6$E`nc
zL>65oSAHD&i_&Kq(ZruR?7*=nia-V42e~EZ5XyZ~;HEYq6*P2QuE+zH3`#YI9-eN)
zoZ({w#m8vT%`{Bm%Mym`5z#hQz;QThU-EfRKz4argD_(OH4hzDnIL6s0lACr0OV1f
zWj%DZ(<WY)?iDj$9+fTo>tdj@CNJYp6!RA&9!DlE#hE6>2g(x{9$Rho^sY({YWyT+
zua}tT5N~%PAN0`sem9yH-xsl2*)2W<#lRYMXfa*aD7npwH+E0RhW9dA$u;}#AcK-O
z?B3@hUx0AfTPkob4Bw1?&DK=>WcO^f%2qm);pvhcJ~t!CM%B2%RN~U$%aS>bl=K+`
z{kCy!(O+Hpp#UL~lyn=|liQw3^p4t?G=ca{iiad>BPCMF?VNmc%8B1&#2escCD6)4
zW8axBs^r8CrwJT7b(*dSes(*ijGn>iS<+y}B$)1f7YQ1ia-F#MW@zmM=B6zm!P#))
zbG;1zdUKFeAZ3?Vshp1F*^Gvt4=Y6h=&Ua|BlG~nfJ_DGg+4RCsLbqP2<ZOhaJFn_
zQGG;<QYNStg|`t~McApqKL8R9Eh-t38zyg_7p4I4tMuicoI^#PZKu`-(@kP*kojTX
zAqpB|9MZ7xPub05grjOKqsjAIW3S*VW2O`}^ez+fg67>yiu~nwM<rT-kig`ve<V?P
zu5Q&>c$ZL-+h~{0DgR3al*}cqFaTR`BmUKf38kVau2wL3IooRNCZ_^l2LC$}(cqA8
z3G&m)IvONTJ?<`xeYPG-vJ7VQHZx9K6EVRF8&|<NHvkRl2l+*+>Klja1_%h?tE`Cz
zgq^9juBBZ;4Lr<XDg36B#`J(VH9s%CeK3m@AZ(KD0UhL}BllQdo{fXAGCLuBYnsls
z6G0a}j7^RL_EURMGR)S(hRUy44wC^yRSPJIQihr%`AYfb!xTTW7vV?Rrk1BLi6Bao
z2$mnb{njta$W36tr@M#MYgaYCBhja%zkV<o$7n}+X%AVT>#v+6(4F6{u3_+tJbbD~
z*TeK3X%<D$2$^dEm-a&WJ75iu*GQ+*q%kwZfNW-$=gxl4T-1HV^Tv}Hr3C6h6ysbe
ziOG-{>VX(y{;|1ztR_>&_aQkp<VI@1tdSR#it7uV*sO=ikR-xE=h`xVTu8pF!)P}^
z35CI*G*v|(9HQI|HFlP#{Oe%5(#Uh7l9N1u=EY)45pa>vD>}TdeR{8;&XytjT(Y6>
z>}M_G>SNS$?yFE!v^W}%fA~esLv)Jo>7KM%5AY{NSzoptr1S`HfHpZ4Rf>VFP~vaZ
z=+D0kJuV;Qy`z@!>)83=t6iZY|Fy_5(H&5XSn@HFlXra5v$m1?#5+XUK({L#lB4ly
zM^K;TS6th#^;6iblgJa%dhNU{CgVk(bp}1cZDX+FeLXz}yR&fZ4f!Nx>pt0SrX%L`
ztntpP1ZD_|wvR@nTwTQku{lhHf`z(UMp06lJM>+PT^}`{e@ETIdHM!5&$nU`Z6w(D
z)KdtH_P4OM-u<z7I=FMTDDH+Rn-lYR@~pV2+Fli&uT_yfQFv-15u%FE{B)85Azx@v
zV+_KYe>_Ld-8g--o#Ux+-x>`hcX)&rW){4;B5A;P&UX}}BI6y0SAY+Q4DvzOZLBto
z6rixH1trZ@1x<nAVF~n@iure1e#uVYDp+r@k3^7dPjd0&K66t`3Rt3WBKa|^_TKU)
z?UdIdC0bx6FFt827RYOJlCgchaU#-{N4qEGa9PqsiU|)lq3|qgX+=34+_}j}`p|Bh
znfjouUA=;W;`7M+TQKjmN*hDvb)E%g@sC4a!VKILF?x$vlDuCPCb_*%;?FgK-Y}Iv
zaN?|3!^iSeUiXb#(~Pc&SdhF2pV44?dU)R^xRjM}>fq-URDV3Z3fJE3kjA<k9q8K=
z>^vEMH9neEGmrq&s9M=$(jYK;)T5Cj--2c=*V>+b`K1P$w4)sXTnt`EZ9lCU$dogT
zG)GO1An}NK;zi(B{*ZOTy0d(q=k(0E9+)%9dyIa3lT(h<)nPW)EwSd|BI+sL`Fk;X
zp5`P0@07Kh06N{#&PB($sz?T_BbBtL<=axC4ws!Z>_mZgSxH9I)I<nmlu}!y>xtt@
zZ<_;Zd<^c+SMMI34BqB^fr#czV5?eL`|_T6Ldz0Z;gy#_wIy;!Uw*9GyDyaxmC~C6
zkgcJbP?Av>#81osVQQ~I3P9}I62(`u2#WJV!-<iY)xxr<*w}5SL!NU}NQnp?q)M!^
zm0VSyEhZ2=RxKx|b&iBFmYc4~il7VIua{LdEd~uD8ozR1zkclQ(HRatS&M`2h-``A
z5wiPVbWM+K452F%xEG~5r;0>et#XKV*gtl5%0_*CnBD5Xypvg?q0E=_k(zXT`^$Tx
zu#YEaiHKFCF=}R;8|BPnuJj1eu-k0Xd~#sl;Pmrtv!GnCzs3*Ac)gO|$L~#IRw5*2
zQ~aJte$)K%j68pFqqzA1$fU@Z%sH3K4-#p;!oT#YL#s;3$vnZ1-H}&O4!a;F-G=Nh
zrCM~I!SCKhUS&CY>uY~6sHQ9;$w+=%^Hby%{pv4(bgHiq{BSKSQLwL2&&|R=yf+W%
zyPMs(2C$Rm{4A+0Z}^djs=>_9IW<Yw8-mK_J_2N&@=ncJ5&qEn$+m+^Z?h)Zuy@9Q
zZg6a|4)S#lr0<)sLV|$fG6T!s^SaSr;L}?;>*hFT?03Oo3vEtAtq&TkMhz5u%HjJR
zPWIfUrL~92ZG#CgF7?~nDZAcKFK0#(RFcZ>@#qIYN3`#z&~dqZb@ENX42x+c%szjn
z6IgU=-Wel$9vvknI3$spU`Xzjm_)A6f4!ceBd@{|rd@XuRbV*hV*aro=h_ah=+mY7
zp}0D<lDDH-x^3r9xA^%!gIo@^{b+_>q_53laB2>gll#YnQW%ZEgYxj=q{r4N7^lqx
zT8&3nrY1$nFU?dVKeUE+bSt>JioDP+`ZnCuAl3cS;PxXOwma$9=4r<to(fjF6$pzo
zSr$$_K3vN|d-p@VQk#xJ7m`F4llhb77K#)isFN#Ckq_Gdh0%`YQ>1Sl9N7Thu-ho}
ztOrVu<IU45JG9RA9mx`a{4->%qNl1l+N%die=tze(wFGm1Y6f;-~NPFy~?aG$AGBY
zt~2!M`!IG<`YbC}epS2&k6kt_{^wOo6-l^-x6La_SXuzH07<$dYW>X!3b>NO>AZfZ
zWn88CMlI-92?X>iLUmn2Buj~NORpX$<PKO;$*a3&6dIN(WG6;akr@xUqEN~0eTfCj
zQK7?ei(d1<J>|W8&wKYY9f_f~PGY{oxC3+I8ft%kg)!P|@w9a@mF6>hzWWwLd3^|@
zn4kC-BBRk`!q=WRoi|QB)?#wO9-a~2BYOGdetnCKSl<A@;ACWBrYu@y-MD$?ZF2hY
z-0gOLPw(6CuRAWp5}SYJ0c731k}Th@Y-=n(w)#=2MHZEysNaE&dUCBIAWgIlplrG$
zG(R(NQ_#I>S-oy;J!Ln&#$lGZ2|d5z<Rx_S0O*eECmI&tQn6fhxMj)oG(r!8e3Rql
z3fV;G*FEe0?9=!8;soI%;|lP}49C~^q70K!K0`eTKZBxYAOOMWF~IR`lkHt!r8?3s
z^6}7Tn}e<Y3hTy;tPl!#e*9zW0j+66=Qx3r{r=VK__9;0>+2z&=fkNjty80hqzR8R
zYM;wJ2WH4fFkVe|q25T#;ubjirTCoFv^knqBwc=9Aig0yHbJ;8pfsZvo_X1Y4k%ZU
zj!-*&j1a8w;&(EXz$Fb4u<7^fyRg!;o$q&tD$aHFT~{`TYb-711tBdn*8vI~_=Hhq
zUb(x(e%cq1I}~(fts_FBtmphEh65+3A%1`3LESopc77PUhnXf?_37=KwUU!i8Uhuy
z9*Nh#56{?iJ$-KF-iD7ax|{son~WanhN5=`ZB!&H@4}p0hQBy1I9DSO2(Ox?$-MUs
zMY$iwD&?ZpUt(4ti%pKSV0k!SzY&k)syAegGn}s*sS^$)fZm(Jzx8U-@QsU({Y17h
z7q!HZ9&``{6~nm=&&B?1;&5s*0bz`Mjv6PMc{$T-HPqx-o?zSg(4PGT)ERYjexWMK
zF_91TKp1!gZla3B)|;&bw05-2nYoumd*w^$*Zk*roBZ)rtgTZ4G~@@AH?3@#6c3#>
zb5+|G+#PEYWe&kM-bYIpt|8YoPbeKVPz<M;_a;sTrz;5QI%=9*P>Z9C3(AkScUhU1
zxM{wOii&!S(>EO;L=c{A1nIDpJN&9D!b`dctJq7c;OrWKRKa17H6CZhq)K%rgo&-5
zvt<utCnZ}Fnv4;bP&2X+C+Vr>YkrQLm>|z<5#w-?kI<RNXn*rQrFw9pQ@tKSSBk}n
zQq6IYwIt735IvF;L+F&~nQvT_)IdRFY0~dHySgYg`0f@MBp_{$_Mib&32u5^6lR<=
z96sCAB{~^Hh%d<_5~3r3w`v(L&r{4o322zi=hcQB?$3Gce8I<_+sjfp#D-9;e3$OH
zT5hsX-_4sX96ZbA0R?UNQ}ez4B3^x!ZWnONp-H4FSNPdF-v(cuohPa1`S$i(1#iiv
zkcS;E99r-T4z|90`U#-`-Md%Hv961<^RUsavau?E5Sx!;bZvdNgn}XbUaofOvAT|m
z_yg|c9UDH}r3Y!53=I5j1j*U*q2UfTqmA*E_S3Sz7;mNrlTmT!N8`MYtaqP?DLmEL
zc2~j-=F-VN)n&f;UkHx>KpF^wBHv0Fio354L?x-KL}~fLSwJD#)m9<dR%PpXyCKND
zt&Hr<{S;^0I04=u3IC>!Cu+??*%q9R=o!X98`6;^(hj-ss_TXCMc9;;7CMwRR(S(G
z_<GVV>zeor*H`0bm+8uV0q&-ArNPy%oyShqN{MCN4V)RVz6=^_kbBytZQyL>aTKJN
zfd2aaw8`P&dlFi+ti!${mi|xO%p{+1X})~3l6|qsejRgbC^=Cwq`><y8`)5t$*97Q
zC6JO?p3EBj@9CC0B^}AzHldM_9_zPfddlljiN|teh?E^7U}Fnn2q2XvuuQvbcK-g2
z{MoCS+)rbrrYi>`%<V2Av9<|Ee%ljy++nmrQDZ8T-!&fEy8Z-Ik@Q%z&0TjXjW4zG
zUqFC&6eDz`9kP}$)LmUqZ^^KKV=V=(!|}^q?43$Mrdlt_bWLVhRq{1|IBPfgpg&!3
zIWgNO<5~gtAu^T07IrHVP67MYIk9Ex(ae7tT=Q=rAk#TMKgmN^2TB&^B*iML6;JB@
zeKX*|i?86!Ft+dPd69F)-0`-3&eHz=zB(X)od=*CH1lrr0_m=(8NxEFL!Mb%r?>FA
zngPIZEAPW&0wko_MMOk~iUm22%N)n<r+aF7(G&gmB>x9FgU6L7!h9en^PP{mJ+#`!
zBV6g!=|dxSfK#v8DbY(q<^h{#M5K9QrviF{P(4RMsSMJ%*m+lQL+h&`S}1nnsz7KJ
z?;m7-_6UKf?_~2+)VCK*?J)IMr*Q#-{lfvyU*bar``&#ODR=GgoNaW>VK=@PV|C2=
z;_!^(US0Kz_cRpWwJ9P`YR`Xm3O**9jHQ1VRq<HcjH^pg9RqQ-IXsJetzUTwO~5}0
z4klbYfICHg6%2km@SN<oD@+1@5_p$|^@Z7O7G`Ed|L7msdYGmDHmh2f+ak=&KlMjt
zF1_mi21_ujyy^wV-4_86hNNCgzzOi%$&X}81CVq_te?T)pwQ>Ee|S&+z;qUq*iM-!
zEjfrsX47v+B#;SeEmfmtC6NvXgKKs9Z~qQz^H<=D+r0w=(UInC@|oRX@d+GJJamq~
zS14k-jR#-`?z41T$eYW`$h5Czg#F<qQh=8ryZ?~m11V{w*Otx0-%r63cbdlIo3tWo
zQ5xgG%cHU~JpMH9+s6VL>gtaI!MzQBm3MysaeI`#FSUzAn12oV^^Zg5wyFYSDiCTs
ze!jVuIs5yE2bH`H2jHNr!1Kp}>GI<x<Gw5e{MP_o@jr$ou*>%W0#VGU+hf1Ss^GP2
zFiGlpWZ#QoVSd6(Qgm50|KBmk@IOWjG3j}HH<5w-K{-*Fa1#s$%!O6YL)e%O@_US&
z6hFZY+OK!}IDmcf(Y{aQw`VF7i8ih%vso>mX2g0wx=^&R_(s@e+53OrlMwIV;K1Uj
zwr`C6AwY{xZun9K=l4rhN_I!oHRB#z4hfi`f$Q1(-vW+Ez_@{?nf$*@o4qzB3HJ|1
zb^n)9F(&tc!F%-&Dt~+U{uQ`MIzmdy!C|X3NG={1^Y{-R_2ifRTgu8<yil+c4FvDi
z-mCmQFgI}X_8mdaXEbcAx541zf&SUwPpvBQ{}A@oVNq`D+gnsZqy&o=q)S>rLL9n7
zKw6|zx)})tK|xw_=%G8L4Uq0;fRS!Sa%jHA-sc?8@weIEA9}sxg)j52wcckv&%N&Z
zelX%`jha5Pa`O_m<#wD}_F`NdTGHgjE)%7HSBQ~(PsU9{(_Y91znFU{7Kdvd8btJh
z>(5YR;=^hF@0kBL-=>fL11w)q4e(TfiPl7jmES`mJtHHUngbrni>3|)Ss+EG@x?yV
zTwQGB4?0b#b}M7ms(z|rJIbz8xgI5r1L0B1rtTs(x}Rx#)k2w8(z3Zl+N=3^doqTl
z)V;QKctY!K9tp>LVoSN&6SDml!+)R%H<O%?XhekC9inOHBiE;)b*GaK?q{)2OO5K6
zbHa*M8$I5U5AbN<E9FpE<dN7deS2d=li;EeuEBPLuKsx!wvc1|g|1|Twiw@}%%syL
z--7b>YyQ-yCvTwT%K9fR?w|DFDdTDb?_8Fgl=I2${0J4_hK0p~ZcehhmO~k`(QY~F
zIT20Y7wnMLj&N&agI=X=SGYm~f5+i2*?k6vma(U|Y;swpsuW`}opWnewf=fV{@nV1
z`zz%kc*p#Vha}f_QL!D|b{rqN1cX9nZ}T~aS=?Z`T^<_ATnpFB)wC0pd2p7iS)`xO
zXFFalqfw~Mme(oDCSZD)l{hNspnbGsL=o72aU9Ejg-HWK*!_jFBIsDO*$pc58El1D
zDM}rS>+NM7?(Vf2-<YH%3P#h5PAE#!sdv(JhuOO+uByNlZDgz`THpC(tLCm&IIn6v
zt2534rFJ)^l$6wY{iR9~nRMY6)(-pJ8_pqT6wyYcqJNpFzNIUs$29-#C=2w2^Jb>A
z(N)B0`5=jmboT9j$7g_GcU<<vz_YWNY<8|LQv3DJKKb<vmtoCS$#-oL-`~p2b4x+W
zuiRtS$Y<<|&${hNnq_EblT>IiWw3415=tTdfJTdV<!_lo=Lz=Q{Cr!seWXI^%J+E=
z!p+gBgROS{4w^momsu}zwQ|zdkaf>;;6~%b0g6LBp52eg-WkSc30st0sPPcH%0m$l
z8YC^tr^d~uQ)wM5N$-?-S|&i_(m1jUD3|X^EBJjtB~f-3Ji6W2G^j~_%M1Y(>$v4<
zb3cHiSCX5{XgFWMWmhnV1x^vOphK67<j^hGYS^E#dS<MD-UGR`j-d^lp3y{i21SAN
zwmq>L+V%xlDFL7<R2ED4>^&KuY)8zI-0N$cD(<0V{I(G}F!@O6X&Wq*RX{)`RP<CU
zVc)wYRQF&VkkgjZ=~aRGtAp#Qiu>0@lD`SBpGAo7@L3x9ga&Qh2-2#z4@^93avDo4
zbA<g7c=*KfdrRwOGmQx5n-Y7Hib28^uCLqfmVBOj*V=Y-ta1L5YNN|C@LciH-(xB2
z*ja8oEUZMG_cy-$M}am4s}yD56#MOG_8j@0t(`GndK%P!v_8$#hz=8RdlJKDz<yiT
z?e!#J@0{1uV;H+>(_KeYUaV*|bTnBuY-2>aYPIm)n*rvR_@XDrAv+t6Fzd0>%+H6L
zF9KyiKdAYyA+_x@&2kb&M>=-KaYsdxz8-Ym>ApxTtVi^SD!bTk_*N{7t|GOgf$eQ$
z^aR4kpUivrKh1{5a0?}Bti8A*coswdLx!pT73TJv>vt^(oR%|h%jP}7XFho>=N549
ziBvo2Dwk<LE9tPUAS~-f;_^4S!5(Xhw+5}GnXIa;<-uJdA~rRyp&T`YNL>A52l*lC
z_UWMxa6Dx2d=Z>=Hi=G=PZDIymZb6?B&vLJ{KKE%dajQQ%gNR%sy}_P;I)hBVq$1N
zdP>NoebufbJxqAs7P`2uxkkLR5&XcQ7huMh(lRX~opL}I)YMz(b$(@$<0ax+5zdlu
zd3WA)<s@nSR9fwB5p+MsV{E*K>Y%IJ6$<(>q8qWgE)|}^VImU-iURWxw712roxuIp
zbfuEOhk0sP)s4u>W|4_;=heA)_(|(NdbRq@RTG0{S}mgk2Q5vIMeL78_g<%zqN^Z9
zW%{U6W)D#S5s7JUAa%cok?Cu6{cx1K_Y;BQUYo)r8;m{NC6;x{0O#OsW-ut-fXI<5
z57i(!_to^6TWs-TeK8ElFY^;$9&?)F_q?GK6cPIU?M=Zrq~2&PiM(G@cRx@6lc1C!
zK|E!Nrf90iyX#9@ZIuS_KXO&+%F~JbUXK}VNpybX9MC9=9hC1Udt)0<YDY~YEc}!?
zL4{D;!F40befzYsqX9}uI;wPzGa`rXd7jP4(Hc+eABUntI0Ov}Yb*2O;^8sge!?OR
zrAaZ%Uqgz@zr?92Ebh=|MG8i=!=T*}c}4YK_zr+oHsjXYV*{T91rJ?lLV=?h3^A96
z+Y^$ZHt|BI@pM6`x_(5sGC9<;8V#*q52CFf$=f(hUUn&f`+mfkl^msRrX(PTyncxd
zx#D>GIPu!kJ!&y(BLXpN_L$GpQpv`vv2%?=q_6I9IwaPebRRwT&cf`fajgx01yR;k
z|1F99d9(MlDEvj4e51C*!5yN_iQ2RFeTxupioJs)(x)@VT0NId+Qx1A%_i1TL>vE&
z^yXE;GT@n*^~kC0hi9;>rItgM&q_0M6Ft2;K6nT46K;MvQp-?WAKxh9bpRcguWgf{
zM7g}0wEFO!;A>son?k4+E7+Z(9*-BYrr{Kv@oFX~hj^-0wiIv~qHR)nYH=k=DaDU+
z%5y<)g9M(5;&sLE<UTs-#C2KqCzx1uwM>s*NJbXfPJUQu#SRpM6fdFz!-gJT18L%o
zV9UoiQ9Oj3ad%IC{&?bV9NG3Zecp|G=CPDmxfMbZG&DCI>53Cla;o8@xVKq-moqi9
zrtSS;BWlvY?=Icr-_yL5PZ&?66r-Y|%D0GumiBv<N{znl&5*t>Zy*jZ@B0*ge2m6i
z=H!7|zBUw@3om1lNn++K<seo+vWkuT<nbi5m8qq2SF>Pr_3~AkI;@VauIQ3kE_pGd
zceUgEFQ;u8=f#Vr&LRP?VR!-a<6fIk<|FO>bxLc{mPMPg=9atTD`R=`3MIHOE_lpm
z$<U=jqkSrnIPV*zOItpd0ap7MMxQ@F-s9m#E1dbDN2wtx+rx%U=h$?$<5}rYyN7m(
zn2ib9|3+*vw`=BSBSD;T5fSl}C%!?;+x)WVd(f!m=%1MPz_FYWz-p=%Fo&{Cac*Xy
zWp2`mi0I>wbqEmoS$@dbIiiBfX0*I{_HQo$Ma9sjVcCevu2rmBozETsjZXA`bTGKh
zC2+)hv=^UO+ln{h>d1G~BZ=3u@Yr@?a5xm*EEgkNf3hN5>tZukuBH?d&x=b>sShZb
z?_eJ+!ZxRlsKzW}ce>_d_2wuw;ko9+`EQeE*Txp#jP82a)Ky>hIkc$p+MMTiLF@__
zakmAy2D?a}0<UHlk37-^M+D{g_(r6mWX%<3!4+|sa*}{!W#@y%lx=r@>t3-?{<gPa
zA`8+v>Lo@glejiV8?{vP33iRKCLJ*y3@{(tDys%O2H(Qu1n$6-8?(Fup1}o<3vuwa
zQ?~fp7SHtx{(0o<5M$BVvE5)f1+MMaTi?P&JJ6!X_w7qc_)7Mt1F7io$QF>aq>#gJ
z6G8)BPD+PLA*4<ZXL+hZJzv6JgAE?>q9>kL2RPr;0`yYa!67ZtG;2ZiXl8-yj-YjU
zeV}upvrXi!dLKNOo~o&u-FpuGZ(GK8yWLmHbv=p>SemPQcJ6?Ij)`C0`9>hx0pm7n
z^MjsN&^kH=SC)0JP$zVmM@P&BF?JsaE#|EcxpeZ3{7`b_5JXRNN>M$BMTLfhIOg7R
z8#<a^Eov-V-Kj11Iq^7XuN$F8f?k}RQD&O$Objq(Lzr+qQ`bq#;wHilI@+fgB7b9f
z7i13UZ}2)#qV7vkj_D7&C`lBxIc@6=TW!U*l|_6U9G%lOzh^T}u4??C1DqYmH18fA
z=UD`v(pz_pF=J8os)h=#ygYI`OcoLC-2+OR)~bc0f)VMW=&34@n{~J^CYv<oeOU<l
zXwqPIs8h7ATkiIDP$`??P^d3wcKI=#HTq<7yuqfH{N?9UzDspe+#si6cOorn+^p>C
zxUp1Q+4rbR)N;qI76qP_X&rHPo6xl(Z~8EyeB#|&N2f<~rCwvB;8zvs09@&8==exs
zP#)?TDzuS}(O6OAPyYzIJH)@%Kq@wvCXk+ZWf$Ci>j?SSjxa4D&NN4=DsTOCN>tD!
zGA7MI{5q9@hGhJ5V)-LZbD#>&zXJWOMD@D~vZA#6bg}-%L$sp$_n(OB-pQA1U5%#4
zPJJ)1{aH(3@yA08!wA)^kD;Y68P85@m1Byum^vJCJH}cnv1KBI0bBdk<G|3xT37+?
zEuOaGs<qK@7LEoU-9$w)6rb4`e@_7YTti)lbN2#`0hRaMC4@a`Hm!T-=vyx1CF$BT
zt0F}nckGQA=$W26FoarQpn^){3$68vBb=I7hOFj%v8bX^4QC~->*GYbGuujIpQXcZ
z25aSP`-eTCkUI@_X|+-{Wow|wR(vI1HR-lZu{9euVAGG#uR^j4+qL%4r6TI+9B0gB
z6cl34CXZeT4Mn@wl3w>YR2g`SXs;dD8xHLiLTxaxbP8*#_gP3#Qt?n{cdMA45i4z|
zQ$MaKn{uz;PwVc7yZWR#EIt}K^ha;`b14dYv$c6=9bK(~I@R7%_)&;_pBB83@3z*5
zmAM)%ytXiNKaaipVD*c$WiB`gw=Qy3u~A9zy?od{y^gp!zIMX?jzYL;g1;Vj6zM&(
z?(pSc@z!_`GPr+&z=L2H`h$pUblcTSLGnyAlACV$%0MtPkQb&tdhnw!jc?33{z08w
ztlTyE+4&>kenlUK&x@Ya^=OYtpGag6x&Y-}bl|j6S6jrYUpELIkaDY^8#v_pU#8ES
zYVfW-m?WQe`B*FDdCRtT7jxO+pgEcM>g`?EJcF~q<0%f(HS(R&KY%=kwRkqU!Akp?
zzu023YtCem6xu2S;jCHH@^WtkGBLfMFjr5I?6LKH`{Y!9${Y2h>SXFQ!mhSN><?Y2
z)$Z}}%@YbX%eiFCJ2kpvlZq|s>V)E#X=x?jJHoB{XI=SygXK7?KObjlxQZ&miwANh
zoZ_?I&PtKoEq=*T_McOOf0g^6Z7(G`7)U{)LdehSuLw|ou|<X$j8g~j9Ui`5mR)VS
z)?Y5;F*<io%f{~y=$Wv=ExUKo+lrPHHxM)6^zn%^&)24RZF}1-VPv*KO-bLE2GHjR
zk|OqN`2*b?cuPyIK>$}5$jd}|yS53K!7Pwg@b{72Kd=Ti(+`Ns6Ac&oUD|my4enu4
zj&d1Fl~!#(6>8qGa9?M%e39%jS!tu=8>*~#wwDlzOZRxVyUD6{QY)ok{8`c4x?LF)
zxXpMW&TQaq55HlHBGf7tm11<5=;@#cPGMVig}L8LhTfrJr!@nY<<~CtRkNM0+W7DR
zC85-+ICxTputy;d4$j_j;@%K{`gMGPIch{sA(rshcM(B(cg$cxRa8c&=J3P0{7u!q
zd~^(G&!G*J96fsTcWg&L^-;8?kg2Ig7*BkB{&=yZSFt~_Kp;&(De;eROde2(n~KUU
zio5!;Pi^nuL85j<1_;Igfkh}6=CvY#pgc)moXQ<~oTl{j{HU~0Q-?uJ4ZtS$-3G9x
zVZ%U2;a&gT(;_2Di)CpFJNM}W2HdN(b;zsrnu)07$f(nqkRI29`W9x(Y96$IB}hk$
zT<UlBJ-T*rewuW|-d^HqJjkMSFd6B%#ykD`c3>@SmQ#9i4=4f|^G5QSKGbHZwQy$u
zZR@8a&qgVaA|YSD;R5^^&_Cd9Xs5ld6Wqre6;amHex~3+P#XAJ)U-3ost7DUHsOX_
z6z;%N=iZ{=itAG-f4zji<)r77>JQ!W`Wz-EKE~y>yrYSiC(fn;y*H;O*Bw+Ebp#{Q
zKqvLR94LyDOP_BbH4bS4zj9b8;OvJ330Sp@K#TNl4}T87b)r`UijsS<a9aJBQn?nB
z&%a3_4q@xvlPQbK?~L<Q(%&rEmD}~@L{GUdUKYAxG81t8<CB_{KVi>xpT35nJ_~Ih
zzI5*LB@_&`S>v>B3b$ApY@0xuS~6Vw-xTN%j4wcfo^<bh$CJ{PkmO^Dg`!c?cQVqe
z0W{dDcq_=%2%h}AFW|W6NAJ=It$u%-v6>-8j&cvVcTNu*mKY8~Jl7(w(9|i>uMSjn
zs|y~E6)CvOQIhSH+q`k{v!F3T4OH1R>?S|j`8n%S>(X7nt>KcYxF$RwggqF(w(d1V
z(3g|sq#eJ%-@eD~+@3B%f46dg=&5?kV*P^5ei&S_Y?oKrL8>TWQiY1N)6Jq)8l7XZ
zJ^?+gX0V<#Ji8J}`xRloz(F|eH3eu)k?CQAUmJ#&)izf7Kg$zs`<IQmR4z;7Ch<vx
zh?qdXy|1eEePx#Hp&rVqrXWDaV3u%x23<9))pIrz((MZ4F#x#A4)iBc)#ZaMvf2(n
zCEHk|9L(dF64&^C$D;p!L9dUmpp={=3<Tui0v(RUBxp6lB0rs*z3#^&^aSt2-qlb~
zT_GDMdkms(8BE7h*Gb1l`GmdKlM+Qee{AdZD=M*#+Y395GRFOMi198$W}>IuL2tje
zRjA!Cl<Q+ScFp_(<p$?Ou%{N|`pJX+vDk?|mGSCR&{2_OU!j-Dp|E-n6LC#A3>5w8
zVutdKd9enYNOLAL<EQ~^iX8iI3a+0<)`m3oUBXZ&losB2gpYd9^vPZgpato|6#01^
z)K8<HjDI;ktu4ALJpWNduNPFxwx1uvR}YZF^^-`lldj?Lr`^tjJ*>=x;V12@TTPKY
zE2ap(6UD5!W&iRevn5oYw>Q=(`p|5r_4c}x!p60-A17=hNdHR&Q;Uke@R6549XZ}A
zre-u(l?nB_c5N7*ULg*8x$*{K7lHClp`E7WK|l73+mj8^hqq8st%XMP=6p>iOFTm|
zEhg^pj*=6RYKc}k`iQNYa0fpoR`cv=gD2a-wFbhuNTUY0%(@>{e|?wI%e9+cbq$c@
zZ9QMe(x=np-}pV{z`!wweg%M9Y?$#7!_=9-b$c7$oXT7!yl~tA_<6Ak2c9r}S#W%b
zPm)U=K#5xJj?N60xs;;Ba+tu}bTHw)8*e4p<)mn3BD~RBdGA2WZt-bx8+_N|lyU@V
zDtb1oQy9zA>BOk*bh=;GT|Mf8y+S-Y7Ww`5(w&OvPAU}fV%5aNz=FWb%4Mr;45INb
z+x;O*w^!5?h0O|u3PN24@1IzA>AVDN1Sb_mUNt)5QqSD`wO_Ye5Hh;z@D#XZYBON^
zY}9PK45;|n`u6m8Z{e~Zquwr$7;yLXe1Cs!@BlE(00-tkX?Vqnr(61ZK}Hgyr}07O
zaAS*nv?CyB;I8G_mCqKIEf<f#+d@{ZaFqM^1RDy@oH&QZ?1|u#1i76yKj(Tb?z7l{
zB4O)h%Gayv?jlHC-2?3%7YkgoCi;)G{PiT}{eHS^9Zlf^=9_&BC7Y7SrgAFE&r#7=
zU(Qo>soV<Hcvi9`%-;$cG6~%C3UQ5!R?LZs8XYZgSY3Cm_N_3(B8W&2eKaw-z*@Jv
z=gIXm^*Hneg-YrrNwz6`^LizNuH+w>bBW%&qMakojbjwc>6a)N%ohhY(YXhFJ80Pu
zQqkvGo_Wgmvc#P0ksk3#IWwmKJ7Cyy*TiYBI(8hX0JRys>;ptoF1b8<dnc3q;S`gd
z0_J^&9liJbaZg<3{E1?ntG`p++?qZrLa5xU32Q{f+d9e?118FmGMZx*c^`RX*ltCf
z2}<?uoUxGt(~M#FMT3RYted=(s^G`Wn!atCLSTxQme@!$++Kcu(VuPqO+1|}an|!P
zNjJ!m&nDir{yeF7soW0!?F8Xf(fMg3AS2*AK*)X2RS{-_ZoxWl44@y%f!1t+bxb$k
z5W?tBIKB|eUdTG0G<aIv>$HD+<coo~f^4E0A0<(mOZ0uh>2>vfeCzc)eKYG(0}MYa
z%JQ?*238V14y!9?6@*Yu-L`f(PpN0712_2JmMCpej_Zlcc6L{OlYuYyTF55OBw;K7
z0xS^}r=b4JyBU}3uek^}Hv{czl!S#AQ;HM=V?=yK=7+AM=xg)SX#|s^Me(9SN&6IC
z;kxcm34}7E6>BpF_zqn11$TKYs_8jKxO~<gSd4M)*U@F-K%)L!O}*jNf+kTe*o{Zs
zEUH62=8SfqjqI+_@DR?ub78a`r&}a-D@sSzui-)VLp|*G2o{_T0N0f0(v+gsdWPtH
zxuZ3=GilQFlWi%y{Yo8woI}JX7Q0xU2QuRWs%q9Z?XY$Z7GbpLiJ=Zx%_E<Q{p$&^
z$4C-};(efc>d0s-8hdeNyvMT#w0v(k-Xg0`@2TIr6E9Y07G||pilP#hN=j?F+cgiU
z@u-%2^!ww5dVRDDPKWdgB$O}w=mIM()<YlRm{5O3u%iT`=KtJ^>lovyGPBbz`MFM=
ze75Zm7Z5Cnu6npg$S7T~Thuu1A~d9`Qhl$kWt$ykG3Xx&tja@s#fX2m?e-PJ7!P|e
zafRkaWCWe*SgA>E`4f4~711P`ukJ-fpa{lu$}dK0^os>xlJMN=t5X?D@h3{f7iVM#
z=SEc@U74fF?3U;?4ThRE_FUMlXclXnSNDZmC(mk;F8h{dXqHF@lI+{LVvv+$yh+aq
zBbf4Vj#k|P77vGCcVH1kUwY@G>C<4vKBwJ{Wn-uDG?99{P0fnlLqMV~e=i|ikw>+3
zUt$=(T=8P0%6h6!LQya?QqTKs+s)pi(Br+uxX_7nm2cq)b-2C(RAQ0GH7l}jt_#TL
z>l$-k4|}4bXB4~UCadnF;~K>RPBE#RJ98=vD0&`E%1=k0Wq783Pq-PM{@5|qe2mN&
z8|C_AAjb}iyzR%}P^A~Ti@{dUj#^xb!D41>CZ^t5)cg;VY8jt=cmC7lv#`3Y6*Akx
zH;Y|^3R2|uA8m5cwW@=Wd!B++c39<#WtliRA<R@hJ8yT^`Fm}*_*c@hPZIk`8yaaF
zoU2fy_gW}jYxLI1f__f*#2YqP3^*YtC(-c<Qc_{&o0w;bp47c|ex4s_Zi(Lv!rnPB
zIY=N`^L}77_wX*KL;lVFKMFA&>gj+4R)9VS&E*L7^tYUv-Dh7#wI#Wt%iiYkKC4g+
zT+~TKk|!<5z&+D`KQSbf7CUN`3`<~re<LzYlu)HVCyu1};g_I#qJUn$2fUHYBzhuT
zII&3w?e!GBVZx{Hgs|NEJa5(SA&Nwqeh!`_3l1GS-(T&kPb!+Kp79oaCKO)rqNVC`
z$@bOQTD92yjagKEcT1sT8kSC7Qr>Bn$d*guK?l(^!UeT>8$QrOCfyf0UDneDv+VG!
z6K3;-FO93|O>V4vvDs3mm4nGTlG+Y5_rYfKO_m>7pHg}3NlTcjmT19ct)M9E;^fm(
z=3}eUe5Bs6!2c5C)fb=J!Gc+3?CR)m8r<t$0E)JNoA-Mn5+05nur3aP>ii1oWTOW*
zp7rn&#-f&QgOnnLchX^-*;b<`RdHVMwm`RYzt=-S8X9GL$>#^>I@vX*xUEBk%ZLT6
zVbzr+RAYZ|?s_$14!>`vt7o>H_Ty3W#@aT6I_PkEqHt|b<c_eZUt2xb_(~K#;q(<&
zFGu11VsI?cxZQC5&cjyrBV6$%$*wcUc8i07Iq$P|c%{hi837^o{Rd8S5N-(<*&Qqz
z*@S$-kA_WC*Tk2u)*<ib*+NQJXi)Q<FAQStJ=unH$3J|Y!DE*!>d}(GpV~@sl7GCl
zO^^Z7;EmzZ>yU>O(zY-Bw0Z@`q^|eC(inqQZghjy9i{dqF+>gSS(TRw{v=j;da)_|
zHQHiL6V=eM9J}&OPub7wNjEG&XiPlnHR#vn_*p#t!uqR;-XdPZYZ^kL;G^feE4&UJ
zHm)^l*W3|>9pju-c3GeMC%Coi&VPl%w?JVA8*M71)hkB~qxee^0BBq#k?;3lXkGqu
zu{S(^hTJ|r4TQ}t=p2p?P5qHMfUofNxF1*PXrr<PJxv~j-7I`(&AYhhGSSozKeWd!
z=Pz~6z*dK@>34dr!Jl*j6|i^h+~wEF>e8C^JZ<)%V!Ttr54NmU&@P;@fS5&kfPQ&{
z_<OVEv3_=)N0;`&5$d4S?L~f~tLo|pFL8TE$Wj#Kw(j7NNI?N!Z;r2%AU@kvQ}rQ<
z>-%`#wL{^PzNT_cPEOkjFtEA~V?$ifQw$-x7Dv<IkA|`)#E`zZi7zoP@gZ)+oUSWw
zZ*)CvMp6{PIb6KNLhjEhM+*$1%=(_=t2Dz!NNRXeIBZ{s_|>Yq*l94DbmP5PfFso{
zUgtQwgdGb@?_BK;(6o~=npvZ~BNb3zW_&))4-3uLqM+qA{R|7db{&0ERQI~#`NBPR
z_qfwjnOg^Q1|ZOoa<|Jwu(-K8*ZBMO+L({rU``Kdp)0JlG(n<YT*P8|2<;DUj*R^g
z(x}U-NbG#rOdHw`+v)`T>UtQG*WF^U$zW4NSk$_;%wZ|D!20Q;PaiV%T!Uff+PDfF
zjaapcmDy|NWIf+eP8NmRj?8nc1{>~iEHf4;PxybC!b-gcxgx|H$vqi?xy_qRl}!S-
zO_?qJP1=;=g$>~BpM7!jFCb0XIU&ZaSh#ZDCLz}(mmUZ1K2p}^DWrFdwGF3yV%GY-
zpgQxE6?Lim(F2WcfrpBugGC(Uckkevd}+kB`NQy;BCo*F=*g4*3;=7?QM59UL*G5x
zbUQ6)8oy(=Wkhi=h4!kfYC9KUYEts}LC$<0hloRDHR%6%ygs|$gkO~tSKie<F!bfo
z{5pypT|VVWb<@={tAEPu6oY8W5xvg3Cro7*_;U&y;s%QV1W!#w2F1j<Kt4{TxBo3L
zFK!C54x)2&){(PHYla8q-Y+EU@AF!c;43%q&9k{%E1yOl19<@2Vn5;`7UGg#zgUy-
z*(wLj>#$n5QEa45C^{BZe-2p79G)f$zfs)GQma2;(N<cua&Ni9cEbgW&9C0zm;w#-
z8LcBoFEf7VU%~{P>|9svZ11~4y>FuS_?bqJs6qHKjC{(WS0m5!*ahKYlM#6L>8<P!
z`GOzt5x-%a!8iUQ%Jhly4(uF|WgLCDD{+^^Gs*6OI6*OZT|AEe`xt?98yfiJ;3Q0x
zj)6hS$cjz|v9NnS+*fGMG5wu}vLd0zBLG^GP;~u>Li)h&P1Y<jj19t<kC4!?vYgLW
zwzh?J2Me_hz?-7u)KvSHH_f;Xm=I1M@vOR^GcOT|VrnM&y4CG26BWE|DUp#k>bsD$
zrTm0_t9uD^rE(ms<w_}`W%UO;C45aXpYu8*%f8EMYv;1xVupS^QgOsCw{p!MEY!>E
z-4kPxB@SX-_rAqQI6Z2Kkcu~+FTfYb?zJ#qgvJ(5PUO6i?SI?=-$v8ZHT)ZDsd%F4
z244}_jUt{84?L>f1$!)G*U1CBDP&qYX1T7Xf@XEYVukHd9WFY)kB}-sh3GuE;TbzE
zxiuUm%odeF$4YNzJwdCCS)`q;ckMs~pMH!HL(=LzN5eqCs~Z@+8sFU^wDN_YkaM=@
znM2n`6WTXxX1w@$I!KBIDw_qbbtN=Scs4GPSactF_Nc^G)FZu){PiXqk;1lI3oWoa
z*2HgCG3{<x>)4}VJ||QW1R@_Tk?X5s5Q~k+HZP0OkBfbSW<!Ow0r)sQ$@SWRt4u%K
z46~83CBg6{GTG33I{r)1@(aH?SORr*<C*Cd=zYuI+~}gPF0D6`iU>XdWRi4I!qnU4
zv)@G9f_D*59Bk^pU<?14BE^}uS)(=6j1YWkH1{foEyH7XWlG`5%Y8OWfy-)`{27ea
zVWq_8$=(4_jZ|7sGJorOv@`C$LXs5oL@3=$4oz9rTGV**TvOCiP(q0_DZN2L$h<sV
zGQ@5%r;w#XEWpkT`HAxh9WU>*g!x-Z$+?SoRR~>znto(9rYjcgDr%t5EYUvry4M5f
z%3Zq(F$yz9vx6z=>v=XmU2IpgW8g54!AH&dKTk&-mpn`es{9|mm|+we3PqD+u%U8j
z_0f1v$(hwX7*}Z;4p($M&z2Xh0yoS2sj6_gcI(yZY(|_xR#5`Z{3Ac^H7YJHCVST@
zD?@~kb`2F(6nLrYcSLPJ*_5$cf!ZaF2mNht9Wg&T+f%&W$8Z93KkUO8C|-WU(ReJm
zvE*1(kPZb)#9I_(Xxn!A?Cs0&Bvw-DorS2rv*M}YRoep>SFBpaoJ=(<3!EL{(wi=4
zOcvBe@8j5&F4JlAJp4I>tJL<G{>!H-^NkQt!!HzW0i$P3)XADnV_D?s!VW;gU3Vm4
zQ&mCqajwB=pFU@a`GH=f$q6~z_;3zY{c@<+&#8gKB<S#j-BX1re72RN_B^{*;Jsvp
zT!nd4fCVm`y^gmh0>pV=WgZqb)}O1%?CtG6_QfTn1QQVgqHg<J`$YX|5@q7fPOlfd
z_uUVR`oGF|4Q8u+qgh>Q7jRr?yQ%3?g+P9cxLaI^^e_I66qquBb52KmPfXkax(-yk
z-frEukP~+aPXh9}mv-_kbBNyVf|<FUm=c%n4JT2h*GC&=RZ~4@X1@8_71}Y@IW&uu
zP_b5#?_@zs9?hAypXvBr1G}Oh0B(I%`oKYNs9CbD5OQ{wMJR7#gbJEyEA%1hrXZKN
zKOP?GU~KjFX=&1HRQ*|a*%-b1Ueebb*2_fW#VYA7A@qN^1dHfR40kpcCb>d8KQd8y
zALk@!X^t!>t_|gBI_6^St~i-nnBYk+Whc-tFQ>JcR$N(mh&%Y$&Xo@;D@awlQA82O
zKjjp-lsKndK2QLvHXF0?&~+hsgij=}O3?&9W0qC1#_g1LEoSy`(|!WBuJeEt9$VGn
zw12`s{&?{eH9oH@<RK-LRPk-Rt;JAj>iE3k5U%9^kb>G388q&S?n2wXsU~O%O<=Sd
zDI8F6=oX;JMAf^Fn=FR8LhWu?nRyl$W!6*G4V)%=^=~@NylsgK9WhOFJW~P?o_zeV
zwr|!xfceQe>W@j$x&%BFC$YL-4NG=gK=5Y0SO+|5P{1CbZf#)~tiUZFbD7IT9@kOk
zSl-ZYyOR?c<DyDunV;?6+Hx=xPIsOaAu7%#Gvv^TzW!b(#U9?qFKYTw9j7Z1x9S-f
z%-(bG*d)3-y%`=bv=`zwl0#V}xyXc-m~`BlG)B?cIk;0y4=t~Stnr<s!}>Nmx#d5@
z)9^?v2%p#_ouHl1vrfZe^cNtMobqA?j%KAJ*|tf7{Ux)@g-K;Ue|&D4OL7${ZcI2=
zZ7sFtf@AWC75ZMGzQN7g?_RDruNX^`#)q^1A2HnC{ge{}z;TWP%}F1ZS~hEaVwMsV
z74cSLe_kv6Z%zs7hd=%Y=2{rx<Otp{5zhE#Hr>6P>I`1iM=c&Qh&epS+VY+8dz0t}
zAqjXUwtBgv$|5ULt@@;rY<{cbboJO_CDs|757aw(WZ`g_2`DgcJr!C==1jku7*Hai
zu~pWeu=qL0p_5Z;e0KQ=1T9Y?!c<rhMd-QE3zODKPlXPUR`lIAWB^-EbI`PLRTdN|
zmt%L%L9gD~LY_;FWVUtn%6}+U3CwTQ+QvQ(BdD}PYfy`$zL~+uR1NP(Y#&T%b`7Pa
zU-5F}2w(<xe;R-Ee4%s9!5_z3AZc`}QmBJex0k7-9IOYYNm1O>=wwrMUt%{9G;Z2q
zm`zeHdCpBX^7sZ(2sw0_zYd(t$*gN}j^Q2s<grUiCdLA8xyv&Wu#kwY&eQXKHViL{
zUZMZmQ`|j}7~V}{Z{;Td5ZAY(ONToAOMO`LF^DaHy(2*&=VR*nGj)dpjjr~?A|(}f
zUMF=3*o93Z?{<xL$;Uob|Bt5ZfJ|U>hnqusI74&&2?jC4K7ocC;v3iR2LR(|yp|Kj
z7K5Mc0r4d@_PB%z+QEWk4I9maTGT!iNVUlKX0CfSKyTte3HVnCm(OhDy3Yh*%5L3<
z{XERd)Z&*3#vhN?JyYw$Uwol}6=P=xZ|oWFmh$dD0J42nbqUyEBTy1MxE;B?u3Wyx
z@Vwl`N8xBLN!%I3`M#%+!DWT#(~mL>7Wcn+s$KJbQ`kF~KUO4Pk`&l*bLZ`RUSVBb
zZ@EIlE=K*xqr1f142W<B?H<pDDSQs3?#*tmW#93Qcb}A3WA$5=FxG5B_}><X2AoU(
zrn+37tuD1<;l-PC8Qb+$x>O(2RPRLK`ZX}r9eG~nJe35rp=7%1o;tLW3N21~(&}(Q
zY<T+jxIO|Zk|nW`?S|EEM8>zf@V0O%n6(m<^2TM9fM=|~0JNYesl$WHa^nU(eM%ry
zq+)7*OK#3@yN8KqGJF`gVlZ_DVJ~jWI*OiW^^_j__O9c6iyu7*ti(!Hn}gFDCA8nv
z?Y#4jK<3QWt*EO<(l=`VX!9{kz<gobkYkpLO0T+n_yubt8u02C)>MCh;`+|k%m5!s
z#`l`1TbbjcVq0r#%!od8fP!gmEv?acoXC4b?_{ktz`tt=-bZWT#CO|m$m-Ganfq}y
zLI!WjRFV{hc8wiFh2^Kx+Phc8i#!^=j3n31TPnCElGS8TlR9?Q`rQIY@{MZOmd&Xs
zh!)<t^n35NogwV%AKzGEkcO9SZI6M4?srfaGjFF_jP}KZ!JyAS(j{zJzDaoUjdM`*
z#AaBmLa};2sx9)njJ9R)_OSQKS{cWDckR&_S}?6m=$eG)3dw72DY$J-x~7j0ovT^d
zk1O|_CW-wq+i@7kS0_9F&%*S%S{`QD^if_$k)45-M%}0@i^8Gd?#&V=Gq}OWms85z
zB9fF3%Occs7_%Z-Bvx*3x1suz5!bj)zGH0j{2bQhtY*gl5HNnQ?Gn59>BthARO>bU
zwYhZY{@Czx2q~{MBd^sPTS!a8!?2qy8tq(>QSN3NiV0EG&%a@sI>~#rifF^L$BKQ@
zmzVMuyE`aL{R4l99e&I74H~i<9))MGu2;e0ELpzTnVDjXl#T|D>Y&H=D1@wSZz&Wv
z07+fti+*I?&t_XEPS;+B{MZCf6;V-Mx@zUAP$SC1rXe{;QS%2+;GP|vjabgB!zD>o
z&ASsdyi&K0YnA!zrdTU1hokOCvWh4#dc9RDzao_To_=Y{&<AZfoc$c35rMpRqM%i3
z9JlsBfbRw|*=^6Ja6Y|r(DWwRZ7UyFvQZ|?7e+>Yf-Fh7GTy5RKm0Ktd@YDtpu9d*
zy;Pr%l)<|(RH)a1dd~YPT}{xU@71>xZ&YQGkLv@nf2sX63l_=V;g@s#Ugi)gUphJK
z23+v?hPQKD+%)1!$L~>^t)Ded`<sJUrQj{HBYOujOgiyRL%e$`GnNdGE7A%OPo)&C
zV3grLJbxLK`))D+kL0iS5!3p3MF}mwbJBwH;WFI7Iz@5SD#!M;N)pPwPD*=^73+62
zC-~kE0I7E9P>a7$GYQTLHoX>p(xvtu1eAb<*S&BW*N+UP=<iYT&7bUY{te1!6882H
z|6AYpjy`L+?#Ag2EiA|DE5D(4QFZ|M;JVKwkO|EAU$VQy?8{8X-|==Mf;{U_KL+;;
zmiU=JNV6E&spsPoml8kT9XURxZhE7&?B%c;RF?MTU)*wKWwFaQ20DYVD0WlM3SdI~
z&~kG?wOv2U>g^+7h=*RGzE-pOo8NQF{yEY9;~6wgOXM<9`%N}bDBM<1j3b-@QcOi`
z;Zqtv!gjIW`Fa0g$}_$J8XQK=w%m}?x97sX2_6-b+3)XVlZ>_CM%tx+@zEnVDb!S4
z@mGJVV1IoCyS#5u)L{9R5Y5+1{a1#2>Q2I}+sBskgR?ai485NxJj_w$Y#iHNS!Xyb
z`t&y6+42owA|s$483jU+%I5Hof@!vxq!)<^0>b}dx~mFw5lwqi3|o)i`zET*SmaeU
z0pxUb=L%U0g5YT4`0q9A@6WXayjIc`D?<w6t8O{Ee`yJNCacvd?U3v`RST{3#IHs{
z-8VNk_vvVbG3bR3e|W(7(+OwR-zN3HJ}Q&@61^zRus@fz)tTdJ&bLMZMZwX4=6Q8i
zpFm?I08$xp#C?r%xW)%in*|Ro?9$_x2owdE+lJq_z_TK;GGM;YRG9k5&2!<H$}D|?
z@z8r5h}-kJj)6tH53sW-YVO-MF;`it+S~Djj5{imBC4!ntF%Yi`Q`pnfmA5|r2>ij
zf)~xQfW=U`7@zWO@6K3FnP1b>cd<>F&KWk_htECPc`j!AmtJv+YuGU}AhiQ-=EOlk
z`EpWL7pe{jgRc8BV1`A!dH*q<iL3Bd!QWb${JFfS{jNA!W|<j~%ayKR*O>C$yhv{V
z>^XrvHI9pmK}PjlH@J}2r+l$uheiUpSjflo$f&BSwgRcq?e{Lf)zSYoafC7$pxr(2
z^^l~diC`!FXE~k|1fro414RE|5CU)||4}`7iGnCRK3<lZrk|aB{U1br6IXejRfGmn
zOF=#vFpUTPcG~yrqgVitb<!{~y#*3Sj}vpg-?Oe?>XYXzDYP{7iiy&pLB;jr7tiY-
zzSy@xV}vNsR{+Qh_nk8ie%<5utAHdB1$xD<0DbR9e=qev488$12ZvH=Sy>wq(Lrnk
z_r>BH>PJ_(xVY}~@<!*xecj&bW&Veo>HrNEP|U4aNv~eK@UZ1BCB-wbu!Im1J$H9D
z|2s9szlKwV8jKL|4+fgTYlU?1-&tG#HRxJ6z!Ff7i<=wJX@;Jra{fLpzg7|?9Ef~?
zmg^1?k;F)p+J*5{jGFZdk5p5JOr*31#Vt*L$zQkl{ff{8gEXkMyE~?-2?AzltYY5j
zS492&iqY{>7g2b0baPM;SK|$y|HSYAGXcJgBrh?50FMbsV85<*F#XQ&|1}!QSr}Jn
z+M{3uQWxHh`tT|k9H2SvgC+?)xp)TKAz%h&WMt&K)aehs7%yJDD(qmR7#vgwoi2Qm
z1cd)TcU)dx2Hy|@Blw3Gto_erCLj<e28l8-QzW=J$Z!#T<gox^<90~$Ki?2&E$<5n
z>D(YD29lEbk@$hXQJ(y3ehgu_=PL+A4q4f2zCqrFJy;h9BV~NBG_LptIlN32khu8K
z_bOf~c11-;(^*(pybBr~+4rKnctHEufiP1c`O!1r*nk6p95pW-|Gsp7Es@cYb3q(A
z(UEpi&&AJ_LXKk|ik)S8ZOg9+==Su_e5%z8$XOOC^$l`0g7F-Be&+7=1Q%>gPVAPt
zDTJzrg+-o_X+{&{=dvIix928dnr)@dh`C3OK6qA|_(g99NH2O;-=G^W9nO1@OPvkM
zhiEKHBRi|<YQ$dH3POyGAnaaSxBC>m*x*%DN|ej}X^<9{jwF3Al)>HY<rxfxY)UGY
z0ZejsrN-SbW3Q4y+q|c|idiDP4Px~(4F|ih_gkHav(ZT-mZsJZlvuKvpRPTokVI@w
z7v)(``bXq-BrRrPRZvA=I9gxjz&-;S#z;b`jrL}``sc@xvKeRJQqu4D+#h^+IE6Ac
zn_~BT=dYIAF`7WY)VJAg3AbC!k4%v2X5HC@$ECEV(`Wa4w_cAEf%;Dt`uZ19iipn`
zDO|}4n2!`4Zq=JLtM!DM`cVwY_tJjkGTbuQS_osY9-2FuF=?L+#4IDbxW&d-X|c$s
zW+o;wf37;Q5sAx0;HY%FBa>@?{i<rF>Q(od_LEHSGHqWM+*%ug#=|P$K~Rk-3<<Mk
zwAjrH3VqlMZDbo|<PZDEgy<wu;CGe|XHl|V8)j?6@C}N{E+M#J#S!X(m?bSM8+<AT
z+342e@@z8|D*fV#gCZA|(y$q|)uf2mSF>G@nwhkYC6LLPE*zL$GQWf;57DmPYZkRG
zevFt*Q+e99G*r{e^zla&#jZ+xIAQl=9LU2Pbr-!j^J?cCe&R!wc8O4IXzZu$l;zUi
zxv<_Dd6l`MjYVi-v~z;%XqO<bS|sMv^-@>wyg^czDBp#Q-d!vH_2L#Apf~Z<Qn+@q
zjU<~3bSKM*m+|u6y63zuVtW<#`Vlw9VBNgVT+izSo6z8zAr{$$9nv(|P5Hi_{=Mrb
zFH`fiU{p?hl?L`+w6#a!Y?g8-+R<}85(&mr{cJ9J-vp!Qf6_>LSx+XLT^5A0Puyow
z_(O_Vo61#;!a}#|rO~P(29edfFh#7)MGd$|V!55R+@4ZCJ&;FtMrZ!LO9(bK;VA}a
z!3NTnTPL6|rCu;N=IQpBGkaEPn;<-RAjR{+lf&F7wtm$!DVkX{E)<F<?iPZHCpqO-
z>?Pn>Fu~~(;~J^AVdRHV-!02hep+OrGgsMHHqo=I(M$cAd!#&S!PMzVio<Gl+}7@z
zvrpcmmonS}d3t`2jIwM!Y|w)W9&1%78y!PfPGeDwPuw=-GE;+u|1JNT$`3%@G@;;m
z4N`Zw?%=*t(Kvb7{WY_NCxQ*(5<&a*()2}HUXU_KnNmUU3#a{x<h=&)I;mR^)A7AT
zw|Dq<jaTgQCIdzq5U~2nO!9%!(AvX5_tp6~)6g1Jh<2|<+IOTw5QT*Dpo`w^V6mp4
zu-k19xYKBq`+hWM2x-^i<N%qF{;Aj7uBvI2+mM3ls)B&fx@pAIBQ+!8i&pX!hP%6a
zL{gHThy!H5mLwH;=`RlEk}||nBBXuz+h8H2Z&L<nC=jKUUe=O#Sf53TeicUxd7O=J
zO*msMrQvBfanU|VJiZw{!`#|smeqPmX2^IUt!wM6=UELcvD0LLj?UOg@FDj%`SkJ$
z`L>;%gtJeyEUGtVx;9m9cKIxLA#l$vej0JOvtW<>^LY}yhZFsr5-UU5_hF|clBEsW
zE7lQKN-|MoJ*_=u(;VPf#Hujy@JHBH3@!=;eQT;|P0q6r{*ch9pSLiG^zr`QTS)8=
z-_{$TS=9%y=K`P3j!HN=(G=6iV}-5^T9T<%M7PV@DkseCMT7jIWgPo>+5w4^ARSx$
z{^7n4vi8zdl#{feL<A;g;+8Co@9LJc`OE3tMW`!ZM-xK(D*4USn?*dkyjA`&k@$ry
zO1jmJdM>B?xR40}pGv%k=JlW<M_U4#oSF2FefuYikog1GvkJT2<3{%#X-<wA4siB3
ze#3oZ@@n^nL(7<j!-4(50khLQsH$YZKCt0}LBxLbBAXSlCLD8Wu#-Ke&%>uDw9m)k
zxjsc<-dp>;(*0{=M_FSv|My7Ebq)qf^$~AmkJG0{Gr_5fCF$TCg7T^kv{_fAD^wp?
z`keV~Eb6fPtZ2FhJVD|nw7Un6pbJ!gcmp7wg7UD9BF;YYZnS+{A095b=C*)21-x#z
zv9iDQe(m1vpr6T(L$W1X%dhs*E?u|V^r82~F1p@vK?W%{hrKi?4_e0`(9(z;9meXp
z(^~}4hdzKBFLr~XuH!x(-+zSS-ElY5GgFh}+k{lb6H1KN`2-gGV3W5@b}Z@GNS`_)
zMbX_DchAOd98Hl0eL9XaFzN1Rv#l3q({&erQC*>SsxEiB5_6xhWI*?bcH>|ec`row
zOf~GXgg*l~O(*@>_s9E~N(IaIpQ{ASPUI-Y>lj3@-L!mvWySw<1$hT518F6t*gF_R
zsUV>S2iyZ#$Bb5d>)3~qg6ARQrA*nYT{)m$u6|ydxO{h=@aJV0JFoq%1&22>o$DNg
zeZXXJB4A2FfhaTZ?uV1ux`S`mJRulFwa?uz%A#rH#jr$;O-&cDXh0K&O1VJkCD{`*
zDae{n(P{#p4e4|EZC%H2&X54tK`{{Q9bVtvB+S0Qu37zAIwbA<*;CV><D=gNeHxYT
zaQX<oQZ{*ns@@HGb{wd0(5n976Q2{abm4$T2!cO!U#$UFJ2iZdkVrbg=Azki!~Lr`
zGamAY6A#Z9RHvocNO~wGa_n4D?-|dN%^c}j#qPvVfQ(=nntg#gugR!xj}8Vzcc&3G
z%KgVXW##6o77Fa^I!-&1NtQS1zDKTnF`zd3Y|K4A-E!QA?~zD=675vjC_q(NBbgW`
z&-|Clm9?=UT9|)pT6JDY5HX}&rl41d2Q;MD_vAGwa>bf%bC1Xtah6RatTf=pOE1!r
zenLS{J^gp?2!3lA3FtZDuwaIhm%?i6vtNTV@#KHK^}-qS(aCO}EEdDXxkp6*Qd^lL
zt&&4J^$Rk6*v`O;JvND+NZ=fqJZrsGVdIDTG<qj87LrjU^P|8yQJnf~_>T*tKI<hs
z2(W0C1I`z;G&}vT2ZFF|dIZ8wSmlPT2PAZ~;X@yus9LtxfgK7&{7ItAq~!Z^zI&=&
z??SQFWl8_i#B=^^!3Z2qk@6ppp1aN6+z-R$uSRI|<T3+Wp44V!5H=p4d2-NG`m+Ev
zCu6CQ??ZF2n>x7j->C_w88`n8=KVgmkeF9ley#28Mi9tDQ2gpxERWkbG=tDFKyy%A
zPg$GxI&qx&r#bdyRfaG2Bzkphb#7RN+quuKFZ?dCtq??&ICoSKyiqkOQce>Oj+OX7
z&Io5?YVa(jIhPX#{ah)&sAD1|^c8WCw2aJiNPvDNe&BFqAiLED`kDu^jwjr3t4g1s
zyy*&YxBHG6`Xg9Y;q-W0LMzVma#Y7G>2UT+gtK;fj;XOfIF<&znb{&n8g%rt2Tpr;
z;vM8#NcxP2zmV8br)Bq1`Db;;uGwwD4K1~5OY6Mt5Ey|;6>eqMxz!#lm#Z{nzCc{5
z&Uq3{K{suEblg+n&@y_K6?=G``c1<Brea)~Q`z;-Q#n)i@wNO?0S?OQy4PMpu1V*K
zb|C}d^j7h&I`V(7AW;C$!LHF2a@mNGppR`P<yKHlTCwl{WLwvynXgQ5R&0V$M8tp%
z+J-$y(wP}6=|OEarWK8~Fu#J!WG{Kg^`MKb$RKaUOii<*R*8sI94G|vE~+aoUHPi|
zS3x=tXhg+z%skgFE(;lndc`1?mdv0{Vs&yN<^|~jc*y5;pmyEaaRSY3oS&LszxW4L
zXg-98-}|%SU)r391L^N8?-vjd5d9e-1pvj;&<yzg>z{wWBBc9QuEO^A?ORaSM_9F6
z{Qfh)W`U3oqt<2p1^}ocBE+d_tP8K<T@+{u#i)b-s!17ZQWF1<*5}t3pQZt2rU@uG
zw6#fTX@FN%FaE`YpC%y&H;sSfUJC450F)LJ((e8b-<JKansnNM*Bt8~#*`75ssYIH
z8V4)<AN-e|;XV}j3;M~)=fH&hgQpYExu?^gNJO8Ty#T|-Pt&gY-?bKnkc({hp6*yB
zo2G-~cKcS%&x;MNRM-h`Yd&Vy42|5EwO1`MvQ~!`{0Snp135y+Fh%L}7mDfz#)`io
z`oGW^>bk3z!$GmRPnqAi(#rJ;QV?<4&p?=B1!$ZGzvc2K=v6Xr-n7}tNqZ~a{9WVa
z$o~;2{@TjLvah;qbVgES!L-em$KuPr347Jo3_+yiAZl%Yf`sK;ydW2Su3hgEQXfkC
zDqFwc#+N|znmmEq7Yq%6cX=2~EVf<vsY?u!a#gtXBF`~INOe2WGzE@InWPE#V5aJo
z$<T{|Uux~EfTU!riep^{zs*KV`xo$1>op&wRcVx7A9Uqj+HPLE`$Z5|ILi+_NuGQI
zS_h@3fvtD%t^+YG8<iTjz}p;W!7OdwS>fxf7ZsJD#-hYn<)0h1h)<*Qt-z#dR|v&6
z<AHqj8EVBLqC_%iUz8D1|Da6~pw%dxvL2B<%*Or`lg#sa7xeOmIydRp#n1(|i&nAN
zD9*!lnzVcN01%c|+R&Kj__r5;QrKxu9G~qJeS*U9=6FS}wAcKn;@TW@!i#S82S%t^
zcct#LDxW;{JPjF3^}MzG&`%?JwJtKIrltp=GpcskGq6AdEaGT3L^A(<!1OCf{B<Q(
zP5d&;EI1^OdUr)5WNCXu3<6N~ov@&nTTdW|UfM+7Ref$3%>N(0DOb}{4RjpO!T6k)
zr7IH?x(6$Hb|#>kQmNbKjj<A1O<+($#H097<J}wFTcL&JI2T1>LlidTNn<4@4M3LZ
zI5{^PiHNor&u9rm52J9zSZ{GVtNC!^HlA*+PlZoNNxgrATN#$Uf9Jw4_JA<xjgQTr
zc<C-O=v+eE)>X9^4vw72X7u<7`?7ZLsRHw*yT_fg&p+#L(L=snWjPotW4LIv#WHZt
zzuup_b{iGZ<}d=)7Q%tge-AsnOvw2IyB>RZdo;^i{3LVGnm0o)9b+AQMU5W;ZWmgK
z5e{MW^%m(d5^gpT_p}cxWsQk71=xSflzhKps@}v7;8AZDM~7eW_qVHQMnXJaZ0D}d
zP7+s0(>_jIL^$UdXpGR16PW1H4lK96Zf>M2{Pv%IeN^EfRPYVT$jCU(i90=ZjG5>=
zg7Oij3eW)0bM@{=v+5ROrLW1oetseHR!N`tlh~0++5Gjtf4h2&3z2KA1S?uWp^E?l
zJdE3a61|vv&yVCKJZQ@;2#QMv8ngyHQU-Ds$&RbIQaTs==Mj4NnlFzGi$Od*Jbb9d
zBUP;wgQ%eK>`wyU$25n;&UJu}!zUC?ME`I|KuyTz8+0BD6cyR;1oav=bteg#v_+V3
zS?!U>J<qcCFzS7B>ETzXTDflV&)BTjzdg*akEw(~F+S@uk@Rm9XusYing;ZH^dXqu
z0p(B8W1MO8e$jWSsV++KsEd{Ud^cus$HvAYK7RZtN@Elr7i{tUooMEi&r#gmAl5lr
z?4h*z{MT>%{pu4&A86(7O8}5PIywm>)1Kt|Rp5)xDUj<b;}y-!W!-9+^Q`Pm*WE8c
z*yx(Sjr~8NdmEP@1?S>^{wX7l(xXn8%zs6rl|#dLO=Au33U2mj?I^+y73`;_OoYp1
zO-&;4SY4e2m&PdFzu%KVY+TfA=6ZrL@eS#?IIrzT#_)-_YIJ=9Z}*tzzwkj5njf#l
z0>mvsvAGFL02g(Q2<3f0T`DZxdR8n?gDs;)hCw>v8-6q^?L+(ix04-LD$8wWqVZYS
zs0uGS?4|y}dWqxF$gnRyI8V4iMFr#L9RSkV%(GXkCT804sYwO?v<|mk%vX(xKFq@k
zen!UOq{W#aZ+}rRxO5xWZMwQrv5UuJ$NX(bNCytY+}NlkG>OZi-&jUo_JD)>`OXb+
zR@V45NARKm@QUne9hi$x{z<grfJ{h1n$!y={h(FtkZC<t`ZQOgfEo1i%OyK%D=fP$
z*lBy6<@dS#PyUm9`)9i&2u;tGx=1L`8<&$<=@{sgn@_JO?#c#68#BnqZM~L1@~Cld
z3#6*i1Y&rNh*;Ob3T9OuimOT{e~(rhHeRj!sjD-K8&6Af=lVucd>bhdXi?vYBr6oy
zjMg-W4QTrC49Ot^qXwany|1R{;6!QLLxI4OMj@Vuz0c}4+9-2!cxG6tgG0Ygy%K1l
z&e<gX1ffWn+{+6vN;j>~xW3ryloUin*jE4pf4^Saa6tBG+6(?di3{cJ&_g`G3_sO0
z6mFjpv-p3My>(nwTh}(Mh=3v~NJ&VCba!`&NN+$Tq>=7ML8QA|kQSs{M7q1XyODn9
z_Poz~&dq(``My8Ywf*hA)|z9EIr17~l-anAy>CuF1BDZ=!MLnOEyeWwqyO8z@y|gT
z@7$H&0|BK@1<^#^kUt&_C?~3M00Y`*`JVo3PAEAQ(f%1~ipy6Igrsh9qEzDA6i{zy
zUH|~;+HPBcf7?TUU%B`H*;_QUG_e3;aS_RyQ4H&m^`B%UB#MC?)d2@A8Ki#29SLOu
zd}kY0`!ABFuq43XxXrgZ&2qtRQM6GXk?>kT!yRJKk1oPuo<H(F;*(a;%&YT)BEi1;
z>GWo~3wcymTU#U;DXDgOYMj4oo~WybC)peTfz6EX6GrAukH8>9Ei@iBi`o4tzvs1U
z-Wh9C<aBKI>GM9$zQZrcZUPFa{tVfT%JsIQMH=0X=-nkgnk$iu)58V-etE`Yr95>}
zvvSwu3W7^vtI%^M<I?ksW1f@#uiHnP+#*)epxc*)C1hCVi_~J<?63X2C=rc)&0=5f
zNV*I0+SsGKQSo(llW=f)rRoVOeDJnC=BsQ%R#ptoq{g~Z3TpJs+>EN>*-Xbw@{iY@
z3N^*fG|!T*7cKr@#eO6|bBbpcrIa(=0{Z4Z^Lg55c|{kxoO`m5)dmIkbp|X~m{;?0
zbocg+9taT$>46*@=#rF(hDNr_*1Iv?OfcMEJ)rh3kuHeG*}SpcmCYfWXRj`^L&yA)
zliFAre-oYEe5aQ#m{!?$+M{eaU1R5GwmnhN&u5lrpyd&z?WjJ6ZxvobGn@m*K;UwY
z!wfH&fA7k4!gAlH=!d<5*?mM}vYa8^eiWYH(V){JT_0J83kvW1vUn>w`m^61F?F~$
zwf$3FRp?ZNo<sA!&54Yj<jng|*vnXh8BJEC`-&ESpalT}l4#iza<fvV34Z8J8Gw;4
zHSAZ1t2_4}C{XEs{{3Ay!K!V8;r+<rdk+X}G+t{U@`iZ*yF_^XFy3j3OrI##c2j+?
z>Dv$Zr~W-ejY#a1&&Eqlqx5A_LU-pw+eF5|QM-VtgClN1QxGzb34J8OV%Vn&Qrw&7
z9qVQ5Im%gY191@wwv2_f!{zYDeYTmzA4B@K+aPznK>!VO;Y8Byis#>~|HwB}RvVH8
ziXhA{VJgo3jIA`wau}IX0MeIf8an|xe(P+6+q{k(^bQ=F&?<jlSk3C}U2%EHJ{?ow
zNVskfP*+y>4U}_L$yAW4d-Ht~-yigf$C_ST1l4U+u3e(=W19so^w=2phCGHJQ(jm9
z<x(?^(C57Si{*@kl`mZhakNm!N7Z!LtC?V2;bZk)wHh4>iSU-&jDpq0I}!t(`!SVC
zJ%bZidj5&!PCa>j<rXAXafJU)yBE%PtqvM^Q6eN5h<Olt+w3oom(~k>;W*mf?gHLQ
zit`bAW+@UrfR{mf4^27Y;MtL)Jda6rp>bSQUqAE0;*WyX=t9nZ!e32nQQ^IW5;8LW
zHhz!X&UhV`Cs8^~T{tfHKFg0QQm$f%5jsZ`fksJznp!Fi_t4arifHl+y^wh2xC9BD
zXXvVs)%ku!yRM#KY4s}g`mE6NT&07<m`2%}ZPWN`;EG@=$?6Elav2{)>tlOF#h)7R
zJ`Q`?vDuZt)zb5fK6-s9=$>hgO~PEQQSz+WyjO?%$J$d*>#d0&W8sJE>@Bio6J*kn
z&smQ}AEpMAG%UUS*VE^Lj@8qPI6Q4%#rfs*GSHv0o5<S}DhxLzBqSIz&QL%R>D#9(
zFZ)1=62nw<#&QBg5H2T>E21}DJ~KM5o9B?9oA862m331LR_vJ#X~Rgk0_cz4<>j&t
zadDaNv|FeNN!!qz^+3R<-tU*MYgwSuZs8)K{{V*rMi?4Jl_;NTvh_StUU4CJi*<8M
zb-7P`$soo9Vcj9$x1_*3VM$~gLo=*ct`*mf4e=6;Lfd}CY(>A~C|Rsj@SXoN9Bzj5
z<(HUsoqG3n5ieGUDDzA=FqYb}XX0Xo<XE~uD|3k&L^H79@&1(?!prMDU`g7z5mK<V
z9*P8$q<T+Hk>UH=pBKU}9`wrvs#cLnUxx6xz(+T;P?ZAEcW-*@F)qrMO~qoy`odm2
zJ>&5H<w&_jSp3vFjFX)`QNvV4P{i5RRg&|`AiI9n>a<*I)C)&#58vUBNbF+oNMo1X
z_ALBZ%mx_d@PB50s+>QHOW!8Lidk$c%0r_m4NBmWRjO;xXOq@+>WpC8S);K`5WMB}
z{pv4aN#aqxUp%4*4Rb3TUP6&jQfrf%V7sW20>XfJexh3Q*-`r$Xm-^hVKUM1lr!Z%
z|2c!?M`WjV9*XdDkKPK4`-yIwhh?oBqgEaBXAea{2t9T`D^KmavT~j}7}?p?9g*%Z
zrV^GecDPotRZ<|}9r&b2;T{)ef7Nz%<od);z+{zeyL*lqgWchli^qh`GVPM1VF~N`
z)GxK^Qq#Cx)rzr>&O(z>%NP?<vLtSE4~I`Q@DOTt2tUK{B7(@m-0OS)=Hhw0d`v0F
z&_E@K@M{O0%<&XO=KEfP8Tv2%?`cYLq3-shXk)6AtqYbuDQe?8JV0b}Z6MvRHqUT*
zVj)Ggo*Klz8}EGH`ff=-U7(Rm=QO1|VAaR^VQSrFtZ~AVT^lzTG%yG+D_6CUY3}gh
zm;)rLYp-qQUFT1-(IL+*l@Zs@FO2(9YQW&bfU4LEbhBmNAOR6Aw9<cdBq%jJQo&we
zc)!30d%=P!0Akl5DehPWiVTQ(diVXeGh!=98}_NrcP_Bd@$ofZ@3V{+lP3(3fztGS
z_6g_p$s#~&=jC;Tk8Gyuant9+XgHM{@<a`|j3L`_A2vAFT7E8W&I)&;lMN0DnW@aA
z0Efk4u622_znd>eRV>W6%xJKo%M|bn@ni0Pe@8`+22V6OL?KFlEYK|k88k_7<`Wa4
zZ1SK3qc&w2#GdmQ`a^ma1K!X}pB*)il-2Go2{KtNJ-2ewCc(9?B*xF`Nte_)v2QTg
zk5|!h(L_fVUUGcnfK@E;+t+VLppj08I{mR6&t&z-O9Z%i(J)E7tqH-oxwl_jYaA;z
zw44ond3pPXwOyz|xeoKO27j)Au;8b!X9qPe!F+G((;nBBoNkRw%v1FeDa`LR>R(C6
z)K@wma{j)Af55Z>X3U^xCiV$e+VT#`q`UM8%62&8aHTGEe7D?FgV-!CT3*<wj4s;z
z+8eI#0;XcCjsFd?UP^qA>L0$#Nlp#by}ZD{aFnTgeGasM1W;5`nJ~Y~vjKTdCwMqH
z)g+WP{R8Q9zalfPPJHoETNu&dZVOf+=7+egE~bR?IOeM5e-mhg-$scV@+tMRZ!a#^
z?7K*3?$DX-$NccJsTGmF)@W;(%Ktz$U6lJOexHs}oONXvkgA}rD`efQyptzy7$>uh
z1ZDc2f39zvUCa&|&e>z%^0P#rg>~~<=7O`yvLxxnwursSv~T!iy+aN8+9QRauteB3
zhIRaT=uU5ySYn{pKBjgxfUWjzgMt7LUuT|;zu`OoxJsUYZSX>yjd=eORcL)NLO_HP
zgQ+%{pdGYlXCL>-)o?&L(AY|n#f_sE_ku$`)wC^1z)Jzk13ko^q43(vH?H~Pa|<TA
zxPEik@N1_Ji8HV4f($S8$9k(r{iT*TN$5N9-|+t#Jhi?BzsU;(e?q=wrfHwvN)CNA
z$+Hd5tGo?K`Ka&RtES7MlqN<Q^Hum1^fkX<O-Z-F6Oy+X|NIztM(FTci*voBCXJy1
zu>g$Ut4-QX1Er$HjVEt6g~@uA&))uma27VlEEOyH5Kf7SRWm=I8`V*yX#3t>V?sb<
zVnj~6Gw)ANMosPZjbiS@=%>F8_kUi&KTrPQTQ-ejxYV1cnG<QfJtdou!%>e$@+`N>
z0q8*O8F?wGw*cgqMYd}sTb4FlS*&di%0AXNdttd2L-?W-4^}bGls|wT7d<%zJQSLN
zo4QfM5g$H3X_sxnkON6aw&Tn|NrqI(&JLT+fy;aOVHNvNqQ_DA-bckdb;T@I9tsm~
zOuz3>c)MuVb201T%UO3tb+4de^to$$=Wr`<5Z)#j)vobcs}m!Us!9VvX811Ne5erg
zkKAi*41Sdz?$r2mC~tgWL9v^WKE)&Mc-l!3#)D%$bZLESvMQh#r)<2nXuIlIu43l=
zd#4WI9|${5QxmP&r9TLfP^p`nYIMf3S|-#O9pbKzZ&PzOi=_*Q*ca{ewr)#1*C(yx
zn*2W}^glGHz^^AeFNqqqkC};6)2F)nGhAq5MMl*F`A#J`YmKoa$0Nuele-$peMm<s
z$Rq6mYGuX7T0JQcKQKfpf~Gy5)2*e7gs-@Jd-(V*v?MEUJf=X~jaPGvZHf7NBqAM0
zbFLR0EQ`SI&<>g{>QCy&1R(g?9h~2s^cEkzM!Xq$GhOX_2DBHhByvCmq3iEazI>Vx
z7_?cGvB6pI`Jgbk!*!_oA6u^Fp1YUEw>>(JYhhy75wdjelK=8tgD>ec0@Uqj4#--)
z831$9=-iS`OXy#9L<EVEwFjq|$G%%VP<xj&DILg>ny0I$-?lOB8Z~PkRD33ZDEbf@
zycC6c3j4UR6vCN5vK7)QA<nxe`hgGj@9_V-yPezsTIRl28;(-)SuHy-uh}HnAKwe{
z1;HWHz!&yQqfs3{@82h8G3c33-(u3=_$?8|cx-67&`jvUF!v&*F&zWvTxx;J>p-`T
zU#=2oS>sdQPf+*=@gkS!!{luKKrs9T6zvrOTilBGWuWg)2&R6@m21auv+Tyk#%PVT
zFa69ezZG8Ehd8g}dSjpWF<bhhrMFZ)HPG1CDxe&XV>f3!Ju!1ykW9BKE?|u*rwg$Z
zSz*nuJ{5C{rCY}(5wCvcNO!|rfLA6SMUMHJV{IVO)WmEkCKCSjdmv?x0(`9T58RVv
z_8#-<^;hDjNLQd$ct`cSHy*x{gqbZZ$Ks2)jL8&+!KuImYQ>B?{+{W=L?5}_tkSgN
z@9o{Y7su#F?7V8x_khWuCy&Wt@70;cMTi)S0l|ZdA-CTca*p^e60Y5vWig5}0mxrs
zqb`ruyVH#ZvuDc~hgq>xJm8F9d2RW#AcYJmg~@lvbJ9$+ve=1S(VQ;El~PsDT$UbY
zCb@+i@UG5AjV)J_6Augc9c?l<z0wGya0}UfihtK)s^VR1#qu$0(Er$Ddl4FSu3pu@
z`%q72n`4fg$oj0+PvmrO$U)g_)k{NT3e5vDUv>jKfj^H)qY@j%w~|aQ8f&&JMsn=M
z=Rf@V=YqTy!Je_%r^R-amL}OaQf&XIrU2Y0Ih8aj`Jtc?DE2t$^S<O{rH!9W?UH3r
zH3opEFCECtK1loQ_{`KxZasYy#C*&=GV{P3fLvpJu?)3*!+tMN=xuaAvfC-S+_WTA
zZn;M8&G;Do7_xC|TN@bKb;X!DnXOWmkHgT5_Vkw;Qvg*$B)zs_X$h#LCe5cqCeZs=
zBVy;PdlU?shk(0)x8hVLIC64XaaijLAQ(np*+c&C0X0guyY%;oJ%12+`0lw$FAjiM
z%;-^LpW9`GiOzzQLKKJ_=+H6iASk?gr68a3^oD@iH*FX#F#3d)R00Bd>fw9gh!x%-
z2}>+>H$wWRgbf|W4nW%jJ>G&go6Jt+fdFp<r*u<ZvrPdSoa!vZd-#ErjV%(Ocz<iP
z*{lNvL1nc}$M9H+e{ZLzBCznr9M202SP<|7;Or;(XtT#>4@6$Ym(kJwYsd+ju6yt0
z4(yDzT<Cb5@>zUw{C}l4RDV;4L%#{IiZ5S=Ha0f{nJZM|Wcd6BI=Q>g{|QcI#fSwF
zKx@NciJx8trg{E{0RN{R#FT<A93Sn?vhVNHv(ZsCF<qgw$4w~E9AECnb1PmN8V$Ma
z(O-l38y}FZY~Wuw{QEWo+}PU(_KOvzOTG-5`oyRTxtE!@j9vOd4UGdwK%<XLtcqE+
z8s!`}t>_NSFAS&?5SL3r4C4W?0&kD_f89tfR7$10P$L{4<fTG?U$}zSEvII)b2qLZ
z0Yec=0MjBkVrM?W|8F<92Hj5-(!8I7TPxpsYwbU`wt4$D^{<`#ZGN}wA2!+FdD}l%
z$p=st0zE!(q17L&HS*>ERk8T@GS0{V0io3=-a;vUAtY}vn(#wILdXK}hQgzxS1#79
z<*qfL|HpHapTjaSf7hM-i2pL{WigA<i|^0P)QpaS*B>lEG;@&^Q@S}q%Wb<6;%Jj2
zU6LIkg%pl>b1l;QWPl!c*Rn)w2%LY+EY0t09$NX3Zjc%L(1I3{m`H`kwi&)QNG(0d
zHQ0uk5O?#PUPRYN=2elJs#Jm;tuRP~Q{{e53tAnJ0fBu?9TD#%Z`PzI{mh)FE|QD?
zu4wOgJfwXs+n$af8#iEE^C8d|0nTeGDOS?S=$(3{$z<tg1+;v(@xD7Z@Nj(<%#eXE
zS4oa!z*>anWY5NiiKL87E|@5}No)K{Bw<V`06BMV4LN=9?~S;2HHAJBQ`-Dn=)&x~
zf)+MX3R16tclUA*HVJX@4;&n|BG-9jO-xTT@_RR!3V;)yf=siw!9a4xt89!-cXfPK
zOcrqwOH0dNpg=_Ka0{zlcjfm7bWBV#h2CCt&5BT6y!+PN?|#`ce*F9`0Dc?(;@8Zv
zNB2EGl#}hdSG+TI@aM<wR|I><cid2R{`D_`tV`b4Jh|On9pNVPpASwQtoBD~7uLe&
z{ZX`!>2ZA#J_v!Kx*8T@BC3;-r$3Dxm<$tjaqhxj=nzwrk0D4kVi$<f8_R2a&Nm8g
zP#<aXI`%po58lu5geQo+lN994x99Nsf^FxdW%+IryfeX$!|Mk-4)xFvL+1C~2><W3
zGl43MGr`6M4@07?v3vU?0bSg?2s)qG66N^^mS1pQjbubduWOeCK$*cD80J=2`O{?P
zu9YHu2^Hj-`vKZ8#Bm~Q(yT>>=Y19~7oyCrh$k-d`yZ#_`B1PwwJbk_(!%GQw|@HG
zzyJ06ink|6QL$pH*nXEiU!S+(s4)lAcjxQ^JWj+O<r38KJ711-o#_40SNmoeXEG5<
zr=~XhW^AV~_hz2{b_LVhtI(Hht7kY^U0Q6eBrnIAUAPQ`8j0+IAnmDg11CZS0wtyg
zDD=tN0bw1{$j>*aIlzDJ21E_Z`$`*GG4_Q2ZnFQ8_yVg40F;P|fa*($ua$oj%8ke!
z*!KXH!GKMQs!%u$SA65}sXHEhXi%9^4rDjlm!IuQHw)#jBQOBnwBY-7#Qd)MEf||s
z1YH0bqQnRt8BqnMBr>DQjT%%SdF~;=34R9l?%4$_G4<BCd*sdA@WK&{`0^AGSv|4T
zyP4$FxzIwI@Nm-I-Ccj*uiv&|aQ`&}^cOj)9sq<c$X!PMMF8E7e>a-`2;Q&X{sJvw
zmYx~jqUpZS{{by!9VArTyICJ%%GI}_p*@0&iOp&_<U<m>rbqt%nEVJ96dDns5}_)<
z4NcrKEA1g!a%*;2XlUd1@nhewFL>p3Zr)2u5`fSI!6O(ny@gKG8{{xx->(c{$!|gH
z8KFSmhy9Bz82=XN`}2PuMVKI#9{&5cJ=k+vZo8W+jq1<9J%ymPe><+){X#eIWE+Ht
zhDKT_1r=0pK@#z9K0Gf3VbRgiNl_6PSQYQDn#bM{E&!)YAO;j%0tC69R9ELMtHy@;
zW2=E+EVY<jztk<Ss0FH2V4+b>YA44n-+vlq|DjXd%kKXLatRUeE~|<ex(VEbK=i^D
z)Y|Nv0B8|q9o<aVf86CiZf~zBU?l>uc44_=ag)+HH?M|L8|<~W(6dhg0eT`LC${(P
zZZ7?+cLGQ3uY%O6b#?VyFn1@2svZb+)7`$ld)vrH*C9rKzo~l}G*6tvZ-{jBSqOX#
zSO-H)gd<<$>n-4?DbyaQ9@a4;HwUQef7n8QAC^B?^=g2G2(X~eF@BJC;O41?cg>-)
z6#Egn?~a&V-@}`CIi4&yIGE^<A^yMK5xOHJ4S1T8G&k?a`$&O5M&Dms;{Cny<Jiq2
zf5z1Vm@vI)Xs&fh0^Vm;VNY)PE)S>|6(nkKxDX1s<?%KDl#uUT%x|=%06CwM0}N;Y
z0k8Vp+#G@kN3QwT8=wKux5~!?mhXb^dl&ZGZW#|9l^Y$~T5%zK%OQN9=l*|Pi!fuS
z5Wkz%!pv(>WAq1(z)>Fb758Q~%g5-^9R!xg9MrWdFM`ivx%s=uSbunp1a)@DHP!Lv
zQ&=ts1b{y-s}yihEA!JDZuzD#5hJ6*-26O%6$NgkM&9yGad6K+VrpxZ+302+?`{lR
zR8&NY@emYOvGR(E-Yo9l#|Q`sdBVcn&Cs`0t5eXtnbjfBl06VCMaolizLMTdoh@`w
zx&NmwdN$uIt@M9c${+b?DIcYvc=K~7o&_f)K!MJ%#1p-m12@mxy?YF5fPkgMNZjC}
zDIRdknoHf6d?n=M$kj@|SA810S>n#f{X;%_b5{kc-@<DUXhC*(cq3@uV~fUmi;}B>
zQT{8u+E6no(Rs^jW`L6YcSndNH@kZE%rJm34ZaB7))cpZy8nnhpgF*d@m#YMwwpJ_
zUKqgS{{(>8E5np;ktWbG4zPJ(O2OI_qZ?6;?(Xb=)Gr-fpn&)Pc1Mqe1zk%KjvVQ)
zx9Ec@R8XN2`ht?Qu&~e{2<NC<g)<41bGV2>EL(bDc)Gi*i^+CHZr%r^L8X*!BP$Xk
zB4{&@H|FAF6(8Tsf2i+20CoYTBYyd*p*NGRTpEDfrKF@nft>@+lFG1x#?AMPr%(RQ
z@VDr!tNQxv)+2?6W*g`WGHdVFkptvb_?g8U-Nq~HL_a^-GQuyp*@nL3VTlDMtb;22
ztx19VH;et9#Q!Hyk1L~|+<YKjTml2_FCXJ7KN;?3YS>E)C<>C2k$sxp2Gt>X`CnLX
z{w@cU>G+a@1iYCmz0_}EI(#6_8I1-gpNV_horXu=@=Z#pYX!#0z7z3IbNtYD%Qx@-
zsX_&E%|4mg@Rotca*zLFJdr?zOq)lCHw79|1?p*Fz#trS1X!TPXz-=DZ>IYDP|!jG
zD2H@{6uO(KV=wX-Ux8$m_-UB_Elc5mDm$p#&}zXe{Na}8RtVVImXeZ#$;s~>_+Pr*
z%%)FifXD|iZeN7vBUH>=MA{dqZ3ucU=nm3t@@EJ9ZR1_La!<R@f{OM(LD;}8D(ag%
zptvL62Z514xCh9H-7B0M{foQJ|6_0>G#@{~ytx5Qy&f?9AVY6nVcmSMvIl@L4@rn8
zhKvVp`C1gP5231tHB9>S^Yy;1|Jb7$YN()uxeJ4qzs5>^BgWO;T^be;<`EpQKGN&H
zlHV*0^3ngFPyWB&5ww74MVk$+O^v;oy~?Hj@}z<ro0^!28<cp(Z*g<qdq6p7#TQuj
z0KIVkLKO2B?UnGC)T}hS&Gg~W{#$ASEB}8Lg#QS9PYl`&Jh^!zml45x0)0}Kben9=
z$NVE77sj^I=58huhss|b`7tl6;=XE~m4?tQ)~P_f1x&=-x1<<Sp#or_XoE$~?T68w
zJcoea%>Pd?n{Hb=`{wwG`#fxFS{kX1iQgapJa8SK`erxG9UitRofMIin5QR%<ys%u
ze|klk4?rA}gepb%FLBw=<#YNE{=MeC&D{4GC<Gun`xFwxTOt^8kAXS;m?9lC05HTC
zcDY#;?RW}UTNi^F>H<Xd12S4GFUGDt@E;%D!(gd@HA+y10})JN^U&s25zNKfUp@f*
zM*A<qhVVC^COLH9PoE;gUljdih`wxoaZ_~@AX)XZVA?DlMc}ihF&o~$`KDdyzJ7k8
znTgIqsi`!;7**30Hochy@9V&siagkI`P3V10E4!*EvNpEMPHYn-(gwQY^sj%zc?Po
zLY-LF+niW>1YPOw#7wF0`kmmVQ@C&2vM%%%(5=~3ea;!=l;Q^&Z@aHKLVBQVh(JA%
z0eF+Qdb5E7ufl!d0B9Q+imRALp4XQ1_eXbe*wg@t#*xBjyU+l~jzm)5qg(V63923}
z@yh^#Kf$lrXss0Dn-8zONImF&54BYZRuyA!%<#Fpr$M7>(EKBU_~FBdTiEL!H1c&`
z&IrO(0@{7Bx4b6>)BptsLCVDBISKL8VeVH5H%lxOg#VGO_go|&-@-BB&_m-dDG3Hy
zeAP-}x^3w|y5dH~68{N!{%=Gj4W@nElqvOx0`P|qZ%n2F8|N{g0Em?(u1MkDLePEK
z)YMenjp$zBcU0%6h~506<=X!f@@&1BltjF~b`A!QgWTt%F(Gt@YB8Z^=j|*RFJBAZ
z@o2dJ*5CY8IWRC}t*H(-f*NnV_e0W5Z(2^jZA&-aP|E}@p5Cvn%_3HpAl+S@x!$P^
zHL_=@rp~qlSrE~;#si^4Hh2=vAK@kY*I1?J`U0!OzC>d`_z()>g#ge2*?#ft`rful
z2;4)B>$hu1CPDZC*cqPuML&YrKn|p&0hW~I4x{TRaZI7vpvMmj(6LP-s;P5fqWnoB
zqC_x>Cp-Ifk%0+$9k-jeh~#9e^!|QqkU%RUOYTcqBfM$bqrJVu*u}le)H>{wnMJt_
zQ$4z560*}W1CmLUy@-<<>Gh8w?GVbvCJM5eAc24wvwl4WI`hhd*2%V=T!$1EU^~JC
z1zdD=MJB10q?hLwod-X)W3@-SJqfp>E$4-q!YpU#0adK{8!>Q!l9Eq=e9z!EM7aLC
zqK{vbiuA@)eyI0&Xm6qG9q4UuKAQwD^%FFb`-b8{qfvU;*y1Y{@s^Y<{P`b_8xc>k
z!oJS%-3SJ9zL<vNy!`~Yo}k#`ZO-tXOcz4ugWdXqX-538{%PxhZopu&{r%0>haz3R
zK;!H}a{xTMUFm4oc?d)B_2d={x+2z(Ps9k};qK($%pfI>lA8IDg8iX$PSOmzVS<?@
zOj&`)s@irfA^B#d<T;5P&mx|p<!^~nU)Qw)jIh{93Xh)q5x?++(Za?|Nqe>x$65oc
zR1Vt9VTjI*+D<}vsfoF`)PZSAg!)=UM1d>*zYbuzraSDQ*|y-?w(?zi(tL8k5{+q>
zf$>ckGkJ(66}gyD3Mq)ATm(p5TsNO6v+LJ1x%E`^#S}g(f-+z!iDY#dGDGz|u?L!Y
z&UE_?Nz9Agop^1_OB0wL51;pxY6(|VnZgf01gVPomx|bEvttD5bN@vn#n+=<rlE#B
zsL(@Ggz3u|+SN4pRkM_xcD8Er5};M9-`PFTj%a`8USA8lrj$ipV9jHp{p+a{4>`H|
zOQBZuKVC&)jmWR-CzDdp;|q6b<jmk70*MpV>L<)$*g-~fYLkf7V43iT>0h;+!Ssp|
zSv6W@R+guX0-goPfX`0B+1EoUFP;M{`PW=30}L7U%#lE&`!;#hS9mPpJ07Ws{u_?!
zy@=eoy5VRNlK6P&e|!?3L!`m$Qabq+h$)9Zq`?wRmH@`SU!w>(!oEZ^O9CQ5%lZ?t
zN9qouoknP0Cz1V20D7UQiV&+10T<F-en!MI0(b4;iHr2+ykGr^k9*&n)_8TjVikbw
zLH1=X9fImXj0iGsOqlo41c-v%<L;pmk22BOJR%|9JD`gDug58ar@X6*{8#}6+aPj%
zq9&es0R=XI@+P1sPA^l{um2?cE5JseFD|@Az>o$Yo5FHRP;B@HW(!%wmywuQ6wIQr
zq0G7dBYQP)`zWWVQcg{9(eLDY`fLVrmmQusHC5zgGw}bmsy@eFclTd30Ln>Whqpg_
z@d&yl^{JqN-vau3D<a}CUlISm$Uh)c;TZ8>AY2}5VDP5lOMizv0~eT+B4lXq)1kyr
z0R1)x5&rUo0-fy?sICiEDOIqj2VRz(uzujDso1I*qIWzXFk0X@P}Tka>tPSGNr?Z7
zN$*XHe)%t!eFGLn_NZ+UmGUDLZt_|Iq^>L<lyiddRm=f|>>r<kr-lFb(w>7A{Y;SV
ze@YK7b~Q!rqrK0CE)7(4GFb>^|K&dwZZlAS{M)Sgb0zQqzym1-W#~Q#Fy2QH!FcQs
zPUvey=mP^lQ2bBueljihy45`ceNTcdNbHh5xCq=PruKE$xj*sL*EcXQl98$vK!47*
zQr}+R^6+m^K7m`bM8FURBxU?Y3Btq`u;6zfFx&JcL&DjahlJSjkov#sChT7U9uen`
z)UOZ%7c`Zhq=;uEpv)ptq}TBK6{wXYK~)&A8@@+)L8f7wA^x1eRQJm4Wm$HyiE{tB
zoy@nySAL)TR7-j6x}wVz_)Z;T)INMH$!?jyK&I(ldvE@qTkgSx@m`vUn3qJj_Tqv)
z=6IXG$nvM7T7_%Ps{&=ESXKi{+Ss#&be*wQ!9%?8l=$yvCA_AYGM6XfYQ>fx&Z}$#
z2J#dX=i=CyA!E|*s!89erA<u$q1f)zP``GTb{>>x)>{NK-G{zhwGHXD%SMgWF1@6f
ziTbVRD3SJa{PhQSDj*fS|FmLdoNj66-^tU}*TY)Ptz@NcCvicJp!4BcM@d^)rCAsZ
z!iq8dszoMNYhP^~GA4Z8DmX?ge}=j{Kke4$ljKH@S7t_wQLVB}XSqt1`FXz<M%ADM
z<@XGPgkxW*k5Y2{JNI0P8OJgV=VeP8F#%0mS01-*%bF}+XDVxsQrL)Cz-LQ!O$TxA
zJ9n7GB}D{Z#YFZB42BNobU3YH32R{gz+$gP0WxlNys?*ky!d@#hvT8m=+1Gq(E8|a
z-_pL#R-Z4Hov|Mx=aY~Ba0?S(W^*78?JkG{9<Uo(z@QB&X;&>t7!Ic<mZ)tNfQFhi
zh+qGcWnY-V$f1awSH7=339k7nKvA|$sgmfLu_7Gk_ibaMM0(3v$JgLn^0&nhn*7kA
zOMy3{4|$Fz39WQT${Ck-xte}<vu~GY))y_>yuOI+v|R7`akL3PZ5>A=)`IH$ttwZj
zU<2}9nXhU|zjY)=nbZf)r!@3&q6;K@AYUnc4`VL_dajfML0uBI0|0ynM?~md8WXG^
z>!UpRt^}~uVL?XEm#t0owcpq|Mm`@8Cf9kF8@||-Q^I2YLiQyXQ)n7_Mgv;QZNpIi
zr!N&A=N@(sEw0Qw3QybNSyZR!q<pAc-nhiYSc%?p{$y&}-6rR=h}_BIRyy{tcG`w+
z62?yB?KJ&vNhAe9-4D<WxC^+?cvfv26^h=pKXIU26;>;G<2CAxPiq;&sIKb<I<K9j
zDHmITQ{LIS{v~6|I@2V+tlmuj+>rOnFSU0Pc}ucn+{}t>^q1mG<e4pF+RGz)$Q3&f
z&eM+`M{G2h^7Wk_zEX^g=nu&x|0MPY%FOJE=CTv-;@C@Fnqy(_;#KH0ZtwMb*0^C9
zg4qe^a;hNrmV)*5Ki%;cd@ypLfnB&v0j?suYP)b0QZU=DpmD$JVDFtEf9G*zFi6EW
zr;DSVZ)-6^L6M@Jg5TMkZ8w;sj%V!3sH$SR>qK@cnqg=H8TW)Z5!b%PC6|K+=+iW%
z>LT#Z^5U;PLp-*&M!t*94E(99mxfj+WJjeXsdqnZC)vv>%Ot(o${x(kIyl`iU1uo3
zd;wjS%aSiJm@e(C6=2XDhb9)s7qW+4OXwMNXF~c?^e$Ip`k0Fr+NX!x59-)k+5)O{
zm$zgd5WEsbHr0~mD$S-hoiiFArZiYABh%0=-Q7NRD{J#Zs_GCKb<}E(JnTHIUdALt
zO&NZAtkVVg?0EU6>Cn+Gpwo%!dQ}gEd}cwQQCv*RSCW5;$9kWgQzEhEs0qfVBtCNZ
zOL9@uF|1y%-{RhWbzNujuSopyFBX%I=<gsJkGac`2;yl9>I)E;+LNTQ;)VyZ5>JnK
zL{rmJJ2$KO_0LayLMXW?3QbC=l|;qO7Brs}s8b;ZoY6CC4P$d+tqo?=!m}IGX`=A=
zJ)I3Hb5<zjKXop86aLtjV|T^Ya#L-2EK@e-B+UPO<FVD5ua`#4#YO(NAWS{ICT+1e
z|I^Fw`X#g98u>)URaB*?foCsc?HYE^a6M4dF!e{!;`&gGoMVAL65b~`#Xw^x?^pS+
zS}SW}qR--{T_a4n?P6Oy^6oX4azb#i)AX%5zX($_%k_&8HLMl-omI|N5iV3+@#@`+
zkBWUQQ-N`Ek_3tqdmj&3cCDbKt9zXe>38Mq2CN`iEq~UsYt9}lGM*>T>Mi~>fY>Bm
z6A9lg*!+~NX~O1+GZx!vv!E_!T%l=uFJ$-;s!Kre`Pm?QQEz!EU4+pqETq^4O|~v=
zBD||a`qN6CMWgSoToK`Q%b#A>q<r67TFR>$FP;3O=0XPwspj@^PMnnsv=Z|A84Py>
zuk>&g*kRC4rUOA;Q-?;OX8u#I_F93tWMp&$$j_;v2yHBLMsc|fMo+Z+w3Fj(p%nDI
z9lwLlr%)c{n2aULIJ`aJi8*R^G*+n{UY84qy5zN#&w*CH!71cBxRfS@S4n*_aJVY9
zJy}cI*1ukC^S;_$0|pIgZ6GA2Y@%Yig3vlPQ>BTt{ao+r$p{5)0Bp0};VOlV(E_Q*
zh2ABPgQ2yjrj|I~%2%)I&u|=OID4T9GFAI;OczTLoyLFJW@dg4ghZdVcOTVO)8LkK
zT>XA*bzf*N@>6l1V8oB6gC~`**kOo%n$<~XD`gSW3>Ab?@HuyP;alu};$1j5n<UXp
zt#={eyD0DBTK`0{?Ie-?D%(VRUSJ%TfTxfiw=|WLdTVV`zPP};_fAjGzzfw+=Q${l
zF>PdaPZ>D~kQ;?6ZKZM!_t0wiu+3yzi|y8q=LW>Qkf-@C{d2G8w_)Us?MG7di`KJk
z)?@XQyM8NV@Smq^);8yKOQ)6kjE*1q?K<1Pt;-=b)$ForF5j9=Z~u8b=EH2a9XV<q
z7%cjjV)Se;KRS(<Zas_!HMH!}xF{B|BZV|L$;s3_7knuleXv+jcPB>fGhJrJquoCx
zavKYqw4Br(n(MUO->KQJUgU~?H$MR;#7-fqFOF65(h8qeAAAQpnP}{m9+2<D8jN*H
zXhul=92Im%l&i38d0yyAf_n$YVxO_E4Lb$uqyN)FnsL2L0Z+U~p3V33H@WNfV<)M>
zHYY-7tS|5^Df_%XeMUVz8@hVoCxSE`0&q|zx;ui`wH>wkjyBljsVKWWUC*vk?52z8
zbAI^S<{`6|*=>%Jpafx?!NG07+|P|4D*S%HpQmzHoMd~*Fe{(%yxL`lROgk*nXpFt
zw*f}m8dibbF;f8EAI!F`NX-Rh{=1hhDB~m;$i;c052y`lN_e@rGAwEwK^+Q@{pcM-
zyf;z>so3GRH~@i1yK%n0Jz6T;lrY_$Z!k|X)>eozMLUScT6~PDN9J;d%sg9yNlCf!
z6iMvh>Dz^AMlms69FIN=EG;97Haf~<@4)xbj`LH!*prF&s<C#htsZe9rP3KwJQAgs
zitm$$v*mO4yCT61nW3?T!#hxe@#`xpF{t-PNC>bzskQJ&n7$+BE<x32C;XwfY<UV(
z5OlRB6$(1%EpfH)oXaS9HFkB6om0~Y=Wvyx%r7DI=6J&+-%Nuv^CVI1LL6C-FJ}+u
zet*z^X_6zbKB6vG>u1k75<Mj8^}vhbd0Pa-+0XHD>CYLQ(>s)uz!(?SylkUyBBYC1
z(ql!~J+%>UMf2bqGPS>!?|feY)#-*!>?Q@Sv#XGXQ`FP*`6|5DuPCgU>#a85+yffv
z`J+Bf%a;Wm84L>sGG}aYmOEJKaD9njT3jaVT#e0znVn81<a7vifCR0U?M|0pY&oYf
zh1Q)4HMt!JI8+X8cM2X$EJnw#dNnyS%QiXhN7xwlzV?$#8R)^DEwsFFl)N-D$~O#3
ztUTp<fZNZC`R>HN$u4x~SGaGcfy-9i!9yol!A7C`8v}O&1K;;3U=3l&8|`$|<8?3t
z@c3pgNhLV5Tq^<3fDQl#;9{SmT-Z<(Lb#?=pWac!3Df!fuB~i0&k;w(!9st>sUa`B
z*|-s$b1qB}GPZ$S)tB)@qrtY}cghueu4JeRQ@k_&XYzOl?ztD6$B>9#_@m3j$uB>i
z(UP@EY*ZEKb#ZUEPo!g1jr;(86)wX9*}Kg3$Q!g6E_Jx;yq~OHo<FvHQI*!Y_g%|L
z`bpr~2&6#0AV2=`DZ})3$2JLHc->>MI6Z6ijQuA6(3LCC1~=DWN;lVUb_daL%%1P!
ziCJ;kL-VfaqNc^2gK2t?s0vUbPsOTKk!64pfMDvdHWK_N*CFbH=M7JMAn0;P?Zl65
zjp4x>T3<O;(lj7(Z%-zm*yi2GM+wEM`g9Yza3p5jIUf#IBe|~{7PN=kbXu+Q+FNq&
z1u<ChtpqOO^`##pI{DbyGFeJiJ1@?rTA8YShGXn<S`v41{Ibu@9#+-ejiZD{g_^QR
zk9YprWVFK0`xlK0;WJ0mC;#b`+}%dt0B%_u*Vs%Jiul;{7E08x&)jA}2s{^zK<3ng
zBx1_y_@x)o-|a&>)QVqJ659Af?2a5}eMGH9Cm2S4+wQovlkv($S_N`XP4vYh2UQ=J
z+DH(vi%F~Y!>r29SADQ-{-&}aGCG@vJ7hjeT!!p2%4b)<`mQZYtk!dfjD}k}5$DhY
z-`@aOo;U+l=Jp{j`R{NQji=eq51rHKV!@bIyW@&i2Pu~x&qXDbU6M^F6C=roYY%cY
zJDtw7=)_A}E|T}GNS1$5h-t&cu|=_Y*fSq{*)*Ke#v!f$7|M85yUNzQ^x+$gVJ@mK
z!tmGf^{RkwKXXF+jz`!cFMT(MMBi3fN9s4*q8dwmsa{;l^bZ?kc4NKl4E^2jD3w`d
z-mRoNoYBcNJJ-JHB96R4pGRNOGBLFS8jQ?ER&D6;`qWZ#88vA68^(}pTI89qTgt7V
z^JTwT9<$jiWYh~QDXv;{G<4XC8Ok^@>bRoUo<94A@9)c-|J~Z<JO!dRLRkwn{$pX@
zg1C#N2u9{OsD(S@D##0&shECXVcCZk@bGzdYc>s@BKxAIEw*Hi{K>T4(bk!NR!kRT
zhC$!rPs8?wfbPhV=B9~p$=JaHeRB<(qz;HFdBcz?K9a>ej^O@_DS^h3GcL(1m3OUU
zv`*p%JT7Wr*x8Qfy6L3Xb<DQi0}fu)l-L}0GgSPTWDjr8CrDC|i5j031D_i0_I6Em
z!Vx^?5D^)UynYH=^@;|b*@Ywg#cbv-rr~`!+^(&@P8oGmO^4MrrM-G?bM?3i7)<T1
zSgLKASObE7FmfJZC0uKcv;L#{N1y@<ukvfW4ZII|&ZeZsuEula-*`E5x;5>>8d=Rk
z&D|{QfXc7{dma`-cQ4VUFFzK}I-emUi~1}5CaAsz1xhq8*~ahH#zENFv+vmTt_JAW
zo#a2iT=*`ek@Lgr=cyKHL_l}7gmh`hvI_qSF<JbO$Z+hAdeoD5$Dv1Mi~eRz==YW%
zvJ`JwrNk7ERbFO%_`JBkZvLH(jORtlVFIUpv_tOH4>9+hyk}_q%X@I#j&6KEax+~N
zl>KO-F}C6mR81>rlt)YiqhuNET<lqjen|}pvF&DSQ6}rdI<0i?-q~gwm;FF%H6xj<
zVxxY#lXsJHC#OM3OF2qrJr%Tz4RoBstc0?$G>ZBKtSGDDG9+e(?=WfljO{_EfSz=-
zK}bIbuk~(9U(SV~XyudZK!*vknU4bAWR<r2<T00L=6mhc6-A8*cSO|v_U>q8;;DZ(
zOyf-GKJARtyWG=TvdLRFO#EQn#Wg$@KCr4SZ7>$KRLaTQkAFOZ(qc14mJlj|h3~=e
zJ7auPhtTCRM&{Jwqr(QU%zfb)iD^$!FMlo6^v714k;dn%<k+UCo*a?6a4L~IUzyfk
zR0?|$a*2kJ7YvEsdw7+vsgr-qk>L^|{s?TM0=ns7`ZyO-cnOQ~$O{%q>u7$hIsei|
zY?S<mpwBM`sbVESB8FFQCz_7yjSlzgos><t$7;I<*x$p?d*5IcB)y2sN=z`E5X<8@
z?xz%5>goktYO$d!PL<0T5Z~mpZ_4Vk=%GD2(oPFq3_9jxDzkCSunJg>>1fF-6wlP`
zTaB{L0v?)ykm>r!2K!XViH>E4Ece$7#=gq#`}!5t{7iP+jG=G&-)!@}J2-opCwR{(
zE@BQEwNhw}HhZq?yc9-~ihV%<npVY~3DT#X5V~p<i4qX<va2Bb!qahybglKU3@2Qw
zm&%4_(6d_#nY6HfQOx&j5(E3V&+%Nn=I3+Ev0m8)x2WPSjq0Aw9RZOkPp--Ez+eMN
zrqPtJ$+ZBny+A!^Qup3Ww(tBbRCMpBwp$zh{;`~1t{!l~$fkv_WW|I=%-xb`f$vH?
zjUhHWJa`D539LTBxS>=v@>oTahBkItCd=7rq*w+kX+*edduWpG*ksP<L*U#u#3i*>
z?hD1lpGQkFBt-j`l*_ZpTPCj;5;*dN-}T0052Y&dPFh$HT4A&(5(X4!y7%4r^{kd7
zM>VBD6l|1;#xnhxN}}{R<s1t{{YRh=0r_MghZI*S-*au32O<k3RAKlas2Zi_^<aJJ
z{25K{mBJI*bC%)GSX%=M3Z667d>5!c&7b5(CCz_jl=LZWAC9;bPw=zkML|h{-JUVM
zq}Py7^mrIuT~lJ@>JANk7+cg)VY`df^i{`d@&>*r<N=|QLZc#Oq&QT~Cd3*-i~x*f
z@4zr64wPuCQkcuP2O}n)NtSN6G1#&GiIa?S(=SBh&@7UX%vuXd=NUz8Se3|tXv0RP
z>$k^hKFh9@E9wr%SWkR=ins#$&&o>MBdmzGSx2r_B)rdb*SH5V4_v&Vd<erc-gI2(
zGo!}l#h+Iw-J8W~HD>Oa$*$x|k0r)a`GHj(jHGSX(VQkjusR7-97rQ^hHHjfI$zT|
z?4uh@!5PDPDrHa>%(fOGQWv0Dz}4>fYrezJ+KonoaC~*W7sH`bN$Oh2j%{&dF`0h+
ziFa`fE2*Tt&Wv<&h_p*o%@5s|GON_6eq~d>39mKFDkJFAD}E#~h)q*WlSELBb}T6>
znq>CDF`6%>i_SW7?EI_`MN)Ufz$t{}jrCxqO$Tut7JUT0d7U_uZH8Lrg5w};f2C?O
z^tGcC>n?-h6(qUthcAVUfJtaFwffsFpR_=O2=&6w;_?cailZmJPFQvi<RdjFtf-Pm
zpb}9=ra0X@l<ZF(q{4I$a9URmKgz37lhk#bq=}Yg@>_ZC2EgjjwJ32f_^G({Y96JY
zkUBmcRaI{uiu_H^n(ms{W;rL^zZrrK0$;}3NwjX~Rf9Y#VUor#SLdDs-_6GO)f1%f
z^BU(kmzd8%pCh=t4Bwc4zwY-SL9+|R6nlZl_Va;NU(7ny^_f=j;P}nqsfu&S<F>3-
z@eD^NC}h_LqfVP7JZHrM?{}6YL;Dg$)m;*AJ2U;@$tOYiIK?H=<YFu{dSKHPF6+~H
zve<j664#tZIID<cW9a0~sQzXf3q6l1L`w&coh`$)%fSG9wR}sX<W0>ZN1d-OzY}Yt
zT6<~LN5{?Gc(iI`dE2M9oK-bWcDMOAH|G{oD5Z!})5o(tKGa=ZG<PKJ`Y`V44Sqzj
zowOn23Gy*}?EB(Fkv0f^=ACSHYUrMeMvb!bZuOr18s6mSeTp(4ATr=Mp>BOjKE10M
zpn#Ouu^OJuZbZpn^E>-_!uba^(w9VUchg&$_7{gc<_GcEL%%;3^X1g*Z&6sP74sn^
z=hbqUs{C+rI+-Tl?zhU^VRHrg6}InN?yWCSW4uWV<d@4Hpi^gHX;|H0f;vbHQ^kMs
zSt1rwt-rv?s9J3*FNzKPLx#h`{FiA){-mx|kdLlKBh`6w9}Z?WH#=v9?Rks*ITI^+
zck*gzcu;qB4H9Ke$=(Hu<8$tgl4ueKYK`dox2e{d1~~+@0Zh1Y^uD+(5SZHqt@(#s
zShyq{r5iG3+b0v4ri;JXkTy+~ucbF8=w}858vPE}7edg?$Lq_qMl=GAdiy{Nvs4EH
z0{oM}8Vzxgl@{M>l#T7`@&aoPmaFil*t9o8o(@YVpyYeJzi(kIDzT*CYG81<)p-8p
z2K>UkZXR)#ZK2=5p}~MUHcR=y`HiSLJwW7l7Fe&NRX32)IY@B{Ks)9!SoZ8mz!7Uu
z=e=C+BeTUZ7R@xq9jGcOspuX~1p@GUp85}mCIbv4*wr&3EM^rS#%vO)??HH=MmH>_
z!wuD!<Ne+zmxAzvD={m4%O4e%zulz~s|}RJKBmXJ*1A+r(hf_vTXlz<wkx+}s%V*S
zZ=a5Mp^qP`I*qIMK1HH=cdlzD_E2PlQH(Tz+iiP!0P1}ZCb}w=(rUj+?4Rw5Tb$9#
zREuKPcEh_&?7-t4f|yTz3A1*Zn}sxwQu0F69S5L?tBJ&)#Jb<<6DlJjAuCY`t94|D
zcEx11^&vIm-miJh&chwuexI`d^EVUr*0tl^>cwhiu1<k9{5+_PC&MLss(Vu>41_Fu
z^6@bgSKf&u)7UnJ_1G>c(mTnqOlyJh{K24c*z93nB{Fu=@%UrhbcD%Ch1j72eJ!u+
z?aj8Z-W!2L3A6Ai|GqcUM3xO+#bzp>EwRB_y&KK8%h4xiKIY}Saa*S|m*OH}Z;bYI
zE=p@lNO{7Y<ZLGE+M`2PGgP#SGHLz5@M6n?bkcTttE)aG&Wy!pd+QA+OO=<{d@EX6
zN;MyA@@UkRy9*<+^6S*z;<1*pZ4T?L54EW@`66o1lP~di@++vm)#p{nOmmz`VBa(r
ziS06M&S!C0s43fg{YmNfs>iUjbAOFuj_MhrBNB>;L5##l(De-o+mONVPz?VBmCQwM
zEvA4gc6vVG0VfL2;f!$^QYc)>di3HR9C5C|tJ=>TCgRSW@u%Fm>Z19`9=^nin5yr`
zCQ;hPw5<|PRw=#vryXRehjVcXtH}!!cN?va3JD7M=mW+G^aCY&LLLnDIjxBp54sLg
z#gIe#>OjV;c;`5XSBJc9=ukg_yDgj0ZAi(A)7-@KRhHuT7>hP*R%xORZDx?YrggFK
zlwNzEo9-?}*cUSfA{!W2LxY7RUnagZwIgk4{CZ>KIS#+sb1)jS{{pB~lgXGjGBw4T
zQ}NXUiF}d;(<yqqI7~Yd`^sr`8qW%3AiDV~Ss1kQTieeMjg;BS4x86xs}|PY)U{=7
zI*C&N-`BdhaW$y>o0Wt?{mh5EKJA4*1MCGUg2B2Z4@z0rgzP?24AFr=$l_k$+zxv-
z9pPl}kKa0U%XskWAFp+MtFM8PLlXIF@Y|ZdGViYE=gQ;Y(~@I8g#K#O$F)gxVXo&|
zpQELX-2@0K=BTY|zKQg!zm^xP+?751#B^~y-LZF?mMq{+{>#<SI#shvy_dAj4&wZ&
z#IR0ZUk|6B0x6^<jxFZQv+1WB{%DHB(_B5LF*yf=#`jhJuKjK+d3I8Z(NfAGz6GmI
z>}dsVCl1{9sr{mp<Hwetm_2cZip=))aoAk_6UK#(jrktAxNFxKDdmjtX<w-psU{K}
z)@p9ewikr|gxNhR%?E8u-hnv!BUz-;;p)Zn&tIg+e{Py~e%g&>bQxl|(vLeU#^0XU
zcgK$&D|r_LIXqXib?E$LVOI8dWB%x_4{(CstNMfs+dK)p646JR#CtVB6)`sL8a7~z
zR%{$*SY3A&!_^thX85&6UWG0iJ5*{gN3vF=|EE?Y$U+sh>u*hwFvHjBL*{9mw9~=t
z#TSot+>TqqY&ng|N;R-nPgm{@Wn9FX`q!RX*B{z4t)J$pOGNqj*PEykeB#w8YaNK&
zDsF$3r=rp&=PaKJ&gZ3}c5nnSVmUWz$lp*fzp;6s&QlZ9JUkl(@i($Ulubs+u<E`Y
zYvAGfuZ(0T!p04-c%dpTFFfLYRObpbz_A;XRS8c-(QzDhrMwqhVbg(h9d;Vkk*@A4
zomKC85SthqOIF;zxcD0|vwk)|#I5DnihU{G<eaBWk-6g7vxZRr=<aoG0igh?5br>Y
z^5eWWCo+c~t~Kf<dOwF~(ZU4z-^sLNfIqsl>?jVBY-W>2rhah9>ewK6VY?lP<96`|
z{%$S|=xbvg-gHR6>GIn=g5IE#f;Zm*M+={MjM}J{V0`I4Gy4bfDr7>X6!-#;!$+Jo
z{e=~6SjCLLu<tVUVLw2xeL7hb!SYp6MHyESyOY)Oxrn+oOLIcgfXo@L&6|WOZeGoN
zXS!prR`SF3xHPm}_n=7L;8G)^`NT4<c2-B>ds3$JUQNZ)8Zs0#I2BXt1Az&8^@cUp
zgIbB_JG>|BNnegi;cTG6^Q)@4HOLQ|D))QJAnu*~xUJ$LE@?E+4*A)$8l{A>TGgz<
z>a2~?Qq9uy{Q}<5A6!$r`QxPar>#R7D;V;I>qFz?xE!GG%__HTTan@PQkAQqhwt<G
zW0#2!QA<_Yg8jU!Nc({UJuViLRg#_hvH`loR|~jGDb0ZuySRonKR7GfEbqXWA&UU8
zt3{R$Hkv~GCA}GuP$r+_LFmwlB`r@Riwb$Smc~pT>(_6+*l2|=Dj(IzK?gZIa#`(X
z!hBsgY6>$S{O=VY^9XU3cHq#aEP{Bf#CRAL7Vni}J{pev0k@1JZfmjHb&G%&y2oux
z7i^cc#pYGtf~?ul6@2JJ2!eeGhvA2y390W`bPRS_Ks|VoP{@Z;@n0Dv<xh9G?RPn)
zTYm8rXD~oFxnR4heIi@WGjpJYj*nSWkb1P6Rd@azBp*hm=nTlVU%jm1BBY2)uv8cP
zwZD0_vfu5mK*7AX+09Kh=uvEQlzM;9c~1OfE5y!+9L{a0@A9O>Ezwx!XGD=5F5P;y
zV9lB2nJ{t*8~&jbQG>#yf?339g>8Zi-hn{vYe7Lwqse6<&b`>X70BWb;k>bW6cCV*
z4XJWmPk&8lf)Vm4U5=ZyY8+<U%Tix(2Nx&8gGieYHZY5ypO|Eyn~?sT8t$9h(CXWY
zTqmWjTuHJztJD|e-2y<Q>Fsv_!!=z`!N<ZoY~UrayxQV5@^LU-G3T`J*gk2+*IS~!
zh5icj0*lX4upJ*Wm!?~DN|_FyN0IG3%H;GC5e0O7XX~`X!M|Xb`|P$b{7YjGzyEC7
zMoZd>^rI4y^XV5To*+}KXuY}}hD2NBisyuw&*AImfh>g`LUo6NAJ-<ky6?lr6ZpO;
z>>Mv^6(L#Oe@Y_wJtCI_^3v-r@3>v?_eyKlOMce9iM7}b``^v;mM-&J1t}-k`Mm28
ztF|P0*Or(ms=l(#yt74FKNl$<Im^Y>cj`Wf&YI<KD^?Ib?ocJ?HmJkrIc5GF+Zui)
z6szkrabPa89b(r@I_lz-_;x7+d%shKX(`UoHiVn5QUrLg9aB@oey7f-{r-?NX@X6+
z5`))7&YZ!eW}}6ZChZH~UI*EjCb+J7noTbLCJE}o^8VIlFtg@DqKa|Jw`$ebYH2n+
zpGO?%NCx1lTa?3X!1@G<q1HNW7ZSYXMOe{&<rcehi@s7f{wzGg7N?d8t*d5jF^1Q^
z36L@B^nMnb>UCu`u0`n>EGbsIGM??{hIacl${~<~^{aD@+UiXLC+&7C|Ct|o>?7m%
z^Gtp_C9b?uoK+N1(<?#tIRd#sIR?um+)sXL$dLL;4+KUrk#qzPU(lK2X%D8d8EB<C
zv=L4nkw#i8iDU>O4}}F~7H0%%rF^n1;ve7y=WquZmZBD-sz-w3{}W7L52;7;@ZF*7
zSq&L7nV?(`FpObY=}FhBah6Q|*}kkf4BJIBbX8a5<Pe%uxqZjgtb66dd!on(LKm@j
zcNwVbi+))6YIadqy?SzT@8xdOxXH_iHo{=b2=;ubZ1i_;#9_wKnPZ1^qLg0h&2f;w
zHbKNgm6v=y_gV)Pov4y~`9R4yL;PcG41rDe>gA(B)=6HMZQf<8e33!tL+-jOM8YPQ
zPJYZX1}Tk40edu>{D)@c?^j<wJ<i|BitGDrXWE83RbkI~ewt7wyha#Onm_i~%|aXE
zqy4+aW>!dIzx<>L@8?zmA@9+frC40wI-Iiq)2EfkL$$x*nuf*_=U6h9Y8;i25GpEW
za>y;I>`Ngc*O~@R2xFNJW$Cuqu0*9P#!|Tw(<l>NWlNSK>$NAkwvp|3-0Eh0KJ%Nu
z<})+z`9AOSJn!>;|CokD&4=c<H<i>3vLD|wmFlRv1*KpZQSu<{0rg>16(`|hcEw@^
zv8zzEgnY1tG2N6;u9a_|>(}z^pP0%%qbI*`GJjUsYtZwm#-Urj^XGfmx=0AEsFHcf
zza!vq%d?E4+HI9P|7xz%LJSw(-IV#DtuqT6yD?ZCKp=*$TK(@ERYJTipr%Se|J=TV
zfV>J?y)LZ`&vQ-)QdEnwva!Jx+Eh0gIh9^Ik^H^jd*u})BA~X@O#(U_6H4fo67dEI
z`3BVA!x1xjb2JHl^j-|k@nKxN!dZ1%89gIlMo@>mngsU=xU#Vo+f?~Tthu>Tg5#Cx
z_`{+<k)a1sukzs_1A~zR*jx~RPv~{8!(f}X#gl=nnTd+f(BxBsW6bb~6GuZtf;;-`
zrq^f2k_2$jPJ3dxyz0Ne9&0v4^;AwE_@4Qmx11#ocQIke)pI3y>gv@b)~ZVqSX_=C
zp`Vb^Izls*w@tU9KR~Q1lV`Vm<Ln1{uPlhb)seT7Y%C53ZFK;TP|FgrD0L#%4-i)k
zsW3$CqwbEwKbZbjWuQnv@CrqjK|BD!f@dkD&@%0%8pRuj_WVgP0}5g%r;c+<6kixh
zfQEb3*>8BTV3Nx1E>Zj)VhsuYkUU6nS9?=k9oan_r`tZ_`&5>Zv@z9qZ?N!}!28qe
zw+YYo8Mq{D{Q>towY&6)K!Id*4ava??K-AdD|!_bKoJ}mpk0%<Nw>?p)V+3bvK$Xz
z@6zLkK8*O!T@c(HkPgf5n;Vm$@8+a{5MPXf8|TrO%R#|etE4>_#b+;ptCG&0LfBm)
zy7eQMgbTJpykP1>ZO9z<-P<K#Pod=0?J(vf1}CV3GSglsiSsZ+0Up<?1PQ3p$Hnxm
zw5P0!H5)`1$4?7Fxe>w)MdUd>NoR3J_wff#9YcwIXiIM->c$?e2jJ6;Al{=6IT)?A
zU={>TB8h2f!Y{8KU3k(O+bBF(Ju$$dCz&|I@8vS2HwKNR7aS<rv!XfG(oljUMehtD
z|2XOkgI<|~p=fWcPj8H@toDc`SG#Px6)-f|BIk%sSgXd3blA<}<GQr@ws4CSPTvEs
zPM}tq!AJ!+p#XCdYCHL^n4<=RdIc>5;W_qTn%%D!sfy5nJZrzaof#6wzAv7Kr%5Y4
zzRWogt1;!MscE}?c`?%B0PJB_<AcThEd!e=>boi{(`@MLqwj~Dd)nF&tH1-y2ZId7
zD7-;XUneR1$O^W9OuO!nX~9+~E)7;^tnx->6w<_*T9!*=ufI{&=8TV$9v1UuYtkhD
zKb}|n5q4F`g6+Uvx>*oNP&J_*Iv(M@f9}2<qtC_8!{2}F_8l_o$YgRl`~6^={W_>h
zIjQOxG<nI;9Gvc0EOW7IEnXf?O97yU`<=lycAeGl#{Yft+y@?)ZWWQ?-9eB$jk!?I
zyi}w^(H+*p@1x4_c(p&13+hSN{mW;-va$_Lt{4M3vHNM(;_%%eWTN9nFgX2D9(nSh
zkB?L2S7x0FqbCJN3w7W4PSB1J?5U~hk4}x&NdJ>cl$mKhstX!3CtaGzsuYYCzs!>h
zN7*TBg!}ePv?rQ&m1kX}KRn2)4f*nksLvYmOcs)PqT3oJwbDn&_~&*lxc7COm{Ljp
zD2z2w9-D3Tk4Wiey4B1Kzblp~FR;8-dx5{gm~fcNbZwVh$ng)n>2x$a*G!SI5v+Dm
z7jp*cqr`zMen>NW<0lE9&a#W|jo+2=EerA`woE$DwFS@2-4ob@1Mmezzvh@zwsX!W
zYV4V%6JG3Ad1l(U*p*b`O^p5QCyDa*lO>O20;MLt+1X?Yp-jE+FPZ0UR0>BH#sf$9
z$B)44eqUi^tM%;0*@PD*o9yg@%hfU1-0ZT??>)P2ZYaqe)->?@$6IIm+E}<fL+8Qk
zVj*gl1pAJymw-J(Y4l^XNyXXHLVSQY7=~mq@2}>-UUnV#M|9$Ek-Msu<y83^fs1d<
z#J`+Bx__hg7m3TyaKMvim>VsBFN_K=_%t;Fzqq<&imaE2rOnLD9K%7mqepr^aVCL-
z5??8KCVZ@K?WpHHSxEtElvvB7i)YxZKSxA0ixw$8C)iU-4WgRz*JSg>c^2Fjsbjsi
z?zTRz!!oA3AKzS`hXrd>2mQ63?U8ePGoJ^8X$upK;eEw%E9cSHn%FZ$FV(Kt#fQ08
zcl+y|CQ{E(+;3lWsMX*r25It8BxK=_KJWnDLf|F2Hf^wCGj!AZ#%j1^KOSx)#}OR2
z-0EL}T?A`pVDv&Ux!gi5k#z`ZtjXHhT_;f6lKHFVm1ZmrFl<$u@7*wMY`6vH1H&(!
z?Pi<2&-pr|u2LZb(S!%VX^N7x<@wkBYS*94eh#E{l2_bYgnV-zlUk%`2Q!a4X>pR!
zQ+0@-nfdHOYivH<<S(~2=?xx3l0My^1f;CI#p-;p7Pz|=??UXDa<jJprObDM$^U%6
z6=~gX1XL!&5IZ~=k{^(gS@QX5;N%y(l^ls~j>kk@-ef0~(A`v>&~t|_IfA9<W}Q%>
zCb9Dpip*VJ<g%a0(trjLV$PHil@-?>BsbSx#1!gRvBP;+>S##W<XQZaT=tOoAc)Oq
z(aj7fkLkLVq9eKS19_Om1H67TLhGSBIqOFd9Ftz6rd*LC-v{179a}}nsCWGXX%RH;
z=U6nBM*=TTY|(l>6@=3DGGT3zi(66PyzJL`=yPd9lTo;@9muV4lRR)fou7VBiNw0B
z!q^GGk1eramOX1>{`|$Z;<*)@&@%U<E7;dl+m)3g(D>#ju|i|e^<&xB%dYRTc#OUv
zWTS?-?n((mWR*9pyhHyh%Mlq^3yzPEr&9)dEuHovUIV_`jLNbmBcGJay;B{<LuXZ1
zgvT-pHmSrfZC76lNw9AGK%{6G5@$JK%8k}eDXJOh)6FhGlW-^+M`CH(wR7VL+awzw
zy}>xuBhsx<DmuZ^vswdyStH3_Os7R{<B>bu8ec`N%U)Wk(kZ=-<Td*ti>2m@#-U~0
zaOPBw^=*@^2&c;j!wHVnr*#Zh+<rfKGADRe`=YVb*Vo6Z1icmhP(bo~5N%l7a9$jA
zcb?SZ*7a?%pX*ZNqt~|T^SJ~^ubL(!FKKQi4kH)^Z}gfL;su>~U~8~Gk7n4BQe9k_
z_FkTw7-)iSi-zVJm@-0z0pw!n0H8KG&9jQj5%~%j1v0zRTSvrAlf=pl)n0Me{gfqt
zyXszb(S@!w;Yc?>{Wv68A9g$TF{CB=SIKJb1LTQOu%}D}UUmk2rrKuMPo>}9*+jhF
z@p@V+rtd?|kSTZhwjIk7>#DmG7kM!Ya`XePVxs&@Ht6w@B1$4Th5Jt#pe3=4sdH|#
zh7@_z2AH)k!%{XKa&#(-<tBQAqUzqgqR;#W4F9M+nGj9xw;#@=Ct7&bURQ*$U_(G)
z;>z9ihkNjLooCyUvurN^t71mmtt<~4I^;<4IP;URAHV(fNyFy&bF|To*8D~0?&*7&
z4<YFKx@=2caPp~3V}ma_QEAyUEhhzUv1Ci{O|iD>jnWDT<>CeROmTFR&sEs(R#=hW
zOy0+(kf5rMd8A%&kkvK%k^oI1h9vkw=)hzYLV_1BFumbIn>0wubPFfSpC{AA4Xw+&
zMz?RbgzxVD8fRRT6EUz>Bn&xKyx}O9(a1dP;F5{5QlBXB(mjt^9}}p4LmX6ye_|qD
z?^P5y$_Hf*_o>=)aiVG|5jD7LjmlbZo*xMY>PNu>Z+lPnu+|!`9cp6qk4Nam>8zhJ
z&qh}SYd=wL{m6+RwrY_Fp9OB$kSehD^LEdCyu}oitwY|?*__qRm^IMYo*>JOjIAU>
z@461Hhhko>MR|hI+q+*;1%CSlP~&^;A@q|ojtq7<f%#|!7T|{_UDzQRxl{PYhl!r6
P(AO{e#&GTdhp_(v8FUM~

diff --git a/docs/management/connectors/images/index-params-test.png b/docs/management/connectors/images/index-params-test.png
index ba31214eac41d5fbc101aa8d81010aa57928d1bf..706fcc47258f51c1b73f107ab6c82968bcddefc2 100644
GIT binary patch
literal 153671
zcmeFZXIPV6(>AIIq99@eZa|74B3)5>7m*H95`@r{CV>Fbd$WVm3B5=sG$AC^P(*rD
zItfjBkCcEA0^h~`KJQQA+rRccj{W?AgM%wq)>^Y>&6+vqocZ`vOPPj>iR#RmGc>9y
zk9E(Sp|m-3hQjH>dEh^uk@|;c&YZQkRaAVcs;J2R)Y;M6*52yOnY)p0k=^QKIyaib
zUtfv6;`b}Z94=URa98dFJ=97mC@%=b+}g;2Y8AgKU{r;03sCyO@$!0*ofwSQNT~+O
zN3Osp<;Xvf;p2rroUiSaiW3W*9(;3G!cV^HMZ%J$aW@QB;OF>ss^P+&Uqjo7581ja
z<_7~4e>^RPX8hGA+@gH)FsZP@F_XKwX|0N*^(2{}X7>=1cF~=EZ*9+pkx96{yx49q
zdp}w+k~u0A<{y>p=+eL5o^w5L`nJ!eiSg>R^OF40PVDuXPaW3pL|R3HZto;0#h9C)
zXIy>Gz|{Vp>+w~E2$7cLnN3c4u8=GBzAEft_jd2W^B;T8w`O#&{%Lg?+R^x-Gj-t(
zCS)XtBDR7$C;3q`FYk~0G(r;cxo3hmj}H8I!@xf0>6eSZD><1(gF&5F?m3PBl-_Fi
zO8s(-s(Zj*wJzet_n_TZVP2O%)tz}Qf^hIUprEfajeWT8H4KPf-0GRCwWj77Uf}Nw
zXU@L2Jwp!sbr$$x0)Eb%AxkIw-~UkBq@VlWzbTxKANoLPpl8m=pHY3RpznEhb=)gi
zbB?WH18=@s!)V<i*clNaVx^5<EfZ4Wxed|5dMK4WzRQ)rs?PQ1!mW_P>{~15_s~B^
zNIfq5<2ae!R2O_og4E1}RNBIB^}0mwR`P;$FHxdG&VSM?^}4gV`lCl@&XQk|Kk=7}
zPLL}PR`N4v;2E+D>?i(OBqO)+x^l|*$)5?*zrrq_MAbG%cIx2l;++pp9P-}@Wd)yU
z9MzYfr$1$Wz=s<RQ%@aKo}G^TLQf8vaK*`zIevPfXY<m@LOFh#&o1vIN*7T@ahe2y
z&%td@+>U>zq(X5v7?~f~C2*Ro*$EWY?mimTZg>F(L1T^0?m-mda~<hCcNGopEx8Ts
zn(t}bD*xl+_to)SN^tbGbkJ~KdLeXXsA#tTO0s6%ErHWk9>_+ek@^s<7F(-GTZ~}0
zdqGwn7GyZsk{9WC+vg3rO|+)UxzqM+Dx6Hh*)lGR{AJ2HB!XrT?0mg(be76l<}_LU
zDUyG2uAGN19wbk0L)y9j#p2YVsLwhAZ!pG#X4u77LPxV`PCFdG?apeS#l~Fj;!Tc#
z7;V~dNxnbzl>AYVr+7}>X1VRNOXA8_kBw1f3;PLK$2ool1kIhTHu0rCcZdNW@3t=7
zXlQe_=jth1$eu@$e6Ae&m4_uBw977Da6{#^bw=cn-vr*6;;DKubiPyS|4I!KuU)u!
zu{3;mV<dHH=3FpR_I$R)snT&gi-Hbqupps>h1j8IbNOX4YUDP0YH;_{*3^I}Pd<l?
z=Kf4aQ2l&HpwY12=jP&-({?=TO`xH<sB+k9hHU=TbT09vYe==E(}Xc)Kn4yngmCL|
z%BwpK<#dakHVS!mU~WSp><14EFoa$7Jo9M=C0MHg2fQ%F!+89H-v7l5YV4&!hPWv`
zUU_D~N~4p0e?C>K$V26a9m3lu`~p<-qdeMXRV|b#Os+@kJ5^{;DtI%4cnzWeJyY$P
z6Ld3_Sb6m5{He<fmDfFogdT+Pz4R-cjg3V%ZtCB^eCn3lodx&o6SjYxsvH;S0UOpR
z9R2CsY4STTVt;M68`iUjX;|vdo$HOqIIH6<rK&Y-+v9}NCU+AqbDVrfI7tC^dg3yH
zy=vhP?VXMqPG#mN54IC-3BNQCP-NvkO+(nPWfXbVQatXsU{8W2*^m7}_A-|^8F=NJ
z)WEfIr2VAkYs}1cSZmTgA<KC5rQ+xT1+`T}LoSUMI=a+iB6^1wg-Y2xbqf>E@Y(47
zzCTiCRZuJQBC8kwgIH=ROWV_vBxVLKGPS@CAM9<_klQc_?6;H`cNmv1+65!wk~dB^
z!dW0d%(iax(Gu%=xzhp=arf0q+tIhw43@oV_j9atBCqOxHCN~t7QTAn;n`GzeA4~>
z(7!61{PKlAZcgZZ8G@ev^R3<jy>gPdL#^+gl+{A<c#dM>v(jMOI;t+TL;pm1;mgQx
zWzR8t9VY$MZI2tmDLjWrp3aL*f7iPT9rkfptysln^PscZGCZSYRxXS|9n9ii>(%RW
zKdHwZZs@;tCJ%lTXd`nsCsN_>>yEg6w%%02jybZ#pfYDW#28ZldavdKy3cK}!%BFc
zRJyrR0wH_>7a19zr)6SCe0uZO1^?&4lc2y0Jxnz>Z`wTH+f=P_hebV%Umir<S&}p}
z)6aXVz_@jI*Gx>^=M+sM&j$Py+`}TM+ft{HOhD3l59~BU$c~}_ToJS<?*x8%u%OI!
z)Oobd@BK|_&!<|+;yl@Eu`wZZyefN}b6GE%siN*%wA?1V>`rtma~T%ww@Z>6(FmdA
zL&T8|wygKuI_XK`qC0uEezA-J`{f$(;_XjOOB`5=(ma?pqkPJ2deh3*a|zDdi}y(`
zt0VVG<5gF$Ue!&P_s<8TLI#Tc(k$DfxY{eKy|!}f54@u7acGnJ_e{ICFyFoM!9FPJ
zRb#M@ZoaNkzLz$QYFtmvux!ni0}hRPtn_4=gmIoj@I!Vm$4BU<r0X-S6iF_nQ2I#c
zxehf~SH^rDOyX=?WYgNn&Kgl2?pHrnuJxH|(2W!F>)mI$&gDTn;3?<+v%!DxwaCI4
zK@%ecsNe-YuE_sIosdcOZ9eb;JMnN|J?7W1CgsPYPafZh`1Y1s6_{}Lt4zw<9_z**
zZHKapp)RC%pUW&-wVHhAx|5WB?og@d>u2p~3`Ft9;@zdp@;3^(Z{Kd~U;}qfV2F=p
zYL+GHJU23|uRRYyFTeB?FsY8|6fY94OO$~0BumWbCW|?mE{)~Ce)Hzd2k+wfo+KeT
zyIz#HY+tT+NpEAQ(4}Ggit~NO6ZFEI_sY{oLtM=Z7(N}9k`&f;yWc%URp+TyzIne*
zzfD`^tLxk8xieE}+aPS!7X6}OEWY@*-W}~9!P+`upjt^&)V^}Ue*44z>VP9Zg;X|K
z4I$juSD8De*jG7(<Oj;N7GoR|Y4kTYm7I2liXfZa6_f3*-Io3HX336r-V+!IgO~eA
ze-yViYriv6gHGdMx-((l@3L*sW9|GrwD<n6_ciJj#VLd{r8WEOwV(!l3L6G~<J%>e
z9r#jm0IB;0W=}=n!)_y`#dgEjL6ZJdua}^`+h8r?44TUFve&-ho<%P!B$DLQ+`+cm
z$~ob$7?Vx)+bc=`%1*y+zY+yaY<})Qj+;88czXTed&<;hNq7Oe{s0R1-5Fh&wyhg@
zP>ALTnEp7?M=VXf#>BKd662p7)mu%a#dn?H>t&G<{Cjy6Iy$WozQY!9@bUXg7YF#d
z<5RPqR2jbU>fM-`SFhgjF4uEu@2n^~4W)m(_;>rWPEiX%FVxYfkyNHO=lF!pr>=M{
z%?%p|yY`Ih7x1l!yeusF?J7tOccE)r#^HIEc4yC&09WMdgStOz(1AkE&bX58km*3Q
zaFti6=;l7NqtB)7Q6~Mf3LrC+++uAl-GZ<*rhDIKk_*n@6xXC6=glxnP1SC4s{NFZ
zg!9%ZC2WTW>PF`Ht0iP1%SLo>97ggIe5DC`B_)QHi_B{h4!4mDT`qN)xhhzlsSin@
zWI?@X-G61xBg+;EzIGisTm~~^$ct^KVG@nxVbdgFACs;Id(RId@tXIB5xu3#;cBf~
z<Hlr2Fri)fgeYT|>@3Q8$ZM`(tBUyLd_ca@t^GgONwe=k1sK*ss<FIuQ%}$M;bC&M
z=E}<JeO2lnouHu9mM`|+vip@?e-89)pVp^ZxuM=}G=)pUXW8S8P$QM9)Cu=V*L4ca
zuP6EM+rF+9^VY}^)N35`v76v@TN%<CaNF3(o%=cAcipW!97{iPT`rlU>D}d5J}E{Y
zNgV}_l|?hfPHp{7<wfDNoj+{GCT;q2y8B4Kl%u81peQHeWs}*O=1^VV!8|J6`h9HD
z`nxssDy~_5wpY%=a^B#<_FDQlSd`}>#LrRpGye&0%x~SmSfuGAibp7~ErvV1_w1Pa
z56@9vLm>v-Q{(~)ic%<P853t43TH;DcNeqkZTj!`y5D4DODk+BEMlR%;D7Luo8Zxp
z-K-^P*_#gyt%nL>5cTQ<?(5yV%2@hJRl|=G4hQ5qy$K*)yq%`j@kgG)_#6rTrUh9O
zq=MvV;q$GcgS^-t6Ymd3`Kh|9m|ignz(K9o|7}L1A8_O-<+&fQ7&(H@5C7}6C2w@&
zLS8KLV?w$B1l>L~iS8UK!p-&`IVu?Cxboy1SLwb;R4uKBsz3KoxLv@^AY`f$@)FPM
zre)KU9LZqn+bki~ovNL7__lBmJxKsDiTP*v-aGVDbb)4Xezi&4<^7R6VSpg>UXS7p
z*r{T$TyBjX2W=T9P{9SCeSIqFvA&2D9T$0M-9;(*4pHZ={OTz8d{vFU5Fay(fP~9@
zgh@?+hus7OB2#BOW7NM(!DptuHC4)aRFZx`55@0kUaWUn=uw}n)Akyqb4(Q=K%U~i
ztPgHIFTrMA`}_I5ko8Ia2ZfE0ab+H+b<4yMIV5tgLWz0+5iXEl4aATYDLMNdaSk78
zV`{gjotCy9JI2)s68+!e0%NPwHCNz$rA>;u2z?$2@74IiKC~Q|k48_JhEe({;3cF_
zP7j+^sH~t_G#qouG;sbn`@7T^FWyh~@p0amR`S}IGZ+UuKCLg7ma&Y85rBXl#;fxw
zJ3#4!yiOJJ)Zb|QtiRs6SB!peIMF0!tNi)qt?oq8$gwJyC51LF^|<!_UTM40itJ8!
zD70c;MudOm8J%S(TyuZN%Qz#0gUh7abrU(%Q#k5Ugjm^=a$i?-b}CigE!HhEqN~a%
zVg>c~$Ct8IVus-Y5RFc`6w&cDDa{&>6^>ro05EMA;=KM--=49(eV^EFa08;&v5ut0
zy8g4<Np23|JD%<Dm-ZuolS}Q!@PggYs>EhX5+}dVp82=;eWeyY<G8rqYT;6EdXUWk
z-fH^$D_xWtU3;=b^tzbWW~(qE+7|8y!hZqR2N05PbAjq=qIOyZJk*28_U2YcU7Y2q
zwHSEy@9}89qWSyI*@D^AgOP*y{1WY$H4`LyE33z}f)!&mTjQvb(8m>xeT*=(q5FEU
zUc==;%m~)%rDeN=Ug6}RQlS(0ajmH6$!dQ^J<cu~^0Fq^-K9cvbfv0juF7ey1LVNx
zwmzUR!MKrQ+4g&KX0meQoKd={5tAs?nsN4UZrF^b5pag<-F?#X*)*eaG?{TLd7!kE
za(UBr<Ervq^iJu56q_%JQ1S6{4+50^z}lBL^6J%{d92(3m`TiAKESb9rhmzNvd&LS
zVj{(Vi{MMzdsR4IY{Cq<Pu6GkK=>cOIQK<65`?YF&2lJ>7M@W?fX?`}O$EFrqC*E<
zGJ-$x24br<eIV#xKJ#6pf{ljSTO#`y55iulNEX@hGVQGpIsvGJ8C0XRRC%rUEs0U9
z1zD^y-<{;R@~*Rjs!K3l4zgaE`39rWO)My>y$gg$ae(nh0rSqAd{O`wNJfsQ7MQP(
z+|S&W6Lx|`K03+x-HphZl<+z5OhyZ=sb_$HoOjlRq#rKM%Or7yFo=;`v$SF}ydLN@
zc9^Sep^ChVqNpC`v%@XShrk9f2AP-X1aO(p&i4@n6wid=Hw!?H_^<o^sMJwZG#@Ih
zRgHdP^rQTX1^kz15dF61YK?~SXQt;Dy0A?4S>w4TI8n4-9DYs8y=vC0!*eft!GsLC
zoH*Sa(!NrHS>4$j8F{9-hhCG~PA|H(b;Qj(B|VkzZ>{8Qib8<0?BcX?=A=B<L~Ccj
z-NPILi?G<`fnuu*U6Mn3TiIYENVZ=9$qE#c<%^oDqS`mg4mw9<CPSjVdGATvFZMea
zwDcs^H-N`i@Zq_>D&|9W0=$2ZDyK}3^%dG&2pcS9g0C6-4d=V0&8ff$UA%c`im>M;
zBKm(dy&re4cbsfp<FoGO-B~7lFm#unAFq6+cpS@(?#gOQ-x)<h9IeI|gNWIA^jRWA
z@!|{PBqAG}&wj9*ZT;tX8EtCEpr8BEVGVADg&NNrkUM6Qp8-g(QYqB>olEO=w-USI
zVhL+6>Ggr1lJS#SuQ)4))5N{{p4PpZxzkiN^KrSt@XB~8;A*38YSXk5ciFzC`6QNb
zr<I$w7c$uv!7e)NXynyCu<60#XF^|VCVj&BNL7sHX!0%a6RWV(BjY|+gN`$RuI=on
zULJst0T=a-{%7Zt6i9cf-p>S6+rU-;8!giuDmF=*EzaNVM~EWy^J8X39Twi^YNx&O
zA->xcbAp&^;d%^Uq2AJhJur;?-R&E93m_F?xaTqaUhnOnIkJqQOnj%mU&MV`@+dOe
zO`OLG<7-NC)_!ag2io;=_N)`K)#F4v(F=5f`fdL9?&;{C1kro}H<!5%TSF5VMIo45
z>U^01pB=^eP316evpfFc&Es<p`0D|@6aGat#5}dsiH!m<TMZ=0zCM!n@&MbXXI!XY
zG41s+aI^Q}IV{^hc^<!vvXM5uYO*j^j4G%AypzM^b^_|!pdK`Jp~qo-e$J_=0QM8B
zvNmP^d3mr<%2MZ=PI{nv`_hB;*U0D3Q_tOR4rQPTnOe>Nb42DW_|)i0)=sgBS=M##
zPkiz$IQ;^i!5X=7E)>UriM(`=;_u<oH8P4#snqJ53vJIax+B?T??1J*9ZlHUfkbS=
zZaTcq2^(gSav$3mm>a>dmvp{0dXn69lgp#73#*-9TPeQM5YQM*Au}QRt!c~Y5%qx&
zb211|;JWp9<RlPJ9?T(L<F>M68Tu#V^LN*b&GA^v#)Hw1Ro~0j8O0h6>CR}x^=z#V
zUcDL#U!&A*w54qv{r%f1?GpDyw;#tt7f0PMk0=DrO|N4;93U9Ghp4FBbe9*zt8u{v
zDD5;^7(Pr&+i{_D;u#fN<%9OLNk4W|x9<K2>q}zO;?icl6&ARge}|_d=qbo}#UZ5B
z{r#Jx6H<0k9;xDxs$AdJ6^os9w_?_N3xLfnTV0uC5PSxgpf|2|{kiebJp93%chze|
zxue@Jahug8Gw7fr2J1HS@s?OVgIe21f@XF0hP@_4I0J>bLf-p5wTXyBT=8hig51$T
zbS>`BA1GnsS;6djLaB+%UKw#g=;6c6BHqap;=70rva@u_nyN{UYuz7k)kJ2Yx8^$S
zyi&0AqPK1-lv%dFFjS_yDSLATE&Y^g%jX$m!Gz56dP@F8SpWD?DF6}AfgTWPZ<ZG_
z{K{O56L6g3rqIzD;zJMC*sToZr_824QC7y4xQUsq&o@rU^RiY#n%CF;%F%+}-t`WL
zWOarz4mE5iO>hb$FHd2UV(=Z?1Ax-}kN_ecgAC()LHD*O)uoP8FQG5{ruMnzk$xhl
z#fu%a<`6pm)~w))fYnh8Lsk`v=g*%z)cE|Ky2Z0*T|9_r(o7OfLSJPud18<E5SY5-
zi6EPX7A)0z6}_H^cA9wL^}5sKVB|l>FiksEHffQjGHjwLq2I0F)okc*Iqj?(wnuY^
zTOpTIP(C{cwnqNFG9o~<J6ZI^jUoPMhPJo9pG2gM-|2@luKyByQP6r4TKnf;D-CWc
zF|NwEC2j}mHK~JgK8?;b?_@CRab-?6DPK&IXQ@`NA4EJuP51HsmLP30_T}j)#;w>h
zGK)IItjl<hYSB!lNV!GqKEY%z(0vLKj*&>~GW)9HEoVIuhA8M5&wfNfUCnnnvFxr`
zn3Tu*=BPL|1Me)lC;>UIQeUV2Y-n$`zt?j5eY9q0YdEvO8Ww$DKwZr`lH;v_kY2#!
zQUHs{fBH+XQxeJ#Rwao#&$c}WX~_QFRl1P%RlfR$gB&QaM7K(}46xgxQR5$Pi$2YG
z{OV$7T<_*`iFFU0Q@N``09;@#m%JT0hsp<CDJi;506~Y*C@Vd=V#8d@ibCG5RGD6c
zidxLw=R$mXIpsIpu0Ku^g;g74ya!DuH{|C6fB-zq@ZHR{=Fl3Gal5>mQ{05*!P1+J
z$yHlQMf>h?*1ZYbYf`T8R`1<Nn|HF@j&&lBS_1Cr<OCePJ=nAPMA8LZ8LJNcQt#bD
zs%;^s>l#Af!g!MG#7$4{A$<MOq=y{@CDPrEbeWn`Ff84qEKtu@B)Y?`PJ%S$JE+N(
zozQAr`Faa=x9wy`3QP3?Gu!RDKIY}e2STMlU&sxYn2EWH06ueH+1%@Q(hJd|FsU}P
zfHg780$JDfKE)k2r+OO1uMEp%%eE>1FX)+}f%eMJ<qm`2*5;sAt2=8_m)sm|g;)+f
zmvhVh)NsA?ZH+F&qFci9qtQ`AyeyKwk68nzRdsN;rE>TTiq+EUNJ_Dg?8_{DT4#zX
z=|>8ED+rGGC7aaPXm0HUUD(JU<RvffczYlUh6_Rjq0Ng~?QER@4BfdURLk$PyY|3%
z81S@@Z)~b~_tgQ->6sZ8Bx<jQU-3On+%bXyOhA`QT{3mKwcTqdlY?`v&d090+_v+n
z!pf@|?h&oE$<{EI=wg#`$8+NdD;FQX%O~7XKvHl_xl^}ZF2}=lxA<8<b+YidNy!9W
z+|nr^mrwUlpW<<+L0(iAbN-rvndhNl6G}7jAzVAxu%t!5F<X+r)NzgmANS}jRY#S}
zg5`KMVcM21?bn@lX&!K49**9q+@6nSc{ny03$FvLCOfodBr6L*>pmFyLFrt<77jzT
zsPcfkB7KCuj=s5jdsMb}MDMac)M^u>brv~PWV9S4Utl*t)#6U;7DLHqkEk!$nQiwp
zto<W3I)CFI_c~Kl5?ptohee=*%it{0$c?EjR7g6P^3~RSH)p*a-ekOdiNVjUFg7}|
zgpx`0;SIjw$jk|`S&7s<pYh4B`8)3~cV`1Qy+kJI*Y`Lqd}^I+Ngz=yI$6S`;-c0%
zass8!ZCL+2(_;5hEA%E5w@~f2qB7r=Fqe*g0S5G*;W4=WBQJ=T8T*U;gw%zu0Xusz
zl1C|n44L_)E+6yyzK_~ChZ5G!bUfF=*|FOv%XA!@fnIZq8-sZ*uS=T6%(bULCjCcE
z<UI$MMRp*VLu_Z1l!qX(s)F*^sV}vdjD{DDmB^<^IR@p0i!HTt6IF6F7->L*H40{4
zdlX)4go;ahVcfh|R(Sqdd3H2tU>fu7?RY)gV5$GTn*~Mg3$|NdZMTGSnsjhfv;l`)
z{lWzr$UR=8@(;%WvDZxZRdC!=K;iFvG#9EO-!ZLKv*6CIp~2bdx7eEWagymE^f_Te
z^fTL0T^?xX_6c5Kr5~9;>1e?5&<k~YXR9g1Q3<BE%9Af?))UWbrB>shy1Zl*z)ySe
zVr0dH?>JkH^`hPycEV8(1HjfzsE-o)x_b_c(u?`ujb9iVz-n-rJ_h}p%04pF?$k#8
zq5Q%t1I1hjOgVgjzG0>nBLrj$w%UIjJIJm-!83{36XAp?ron;)Ixb0V6sYtCMdwP?
zR$;;9R$e5hueC6c`Ejm5t0kWV`&Sq=l)Of&egOb0K(rDG4_|$f-dSwg2j}rFX3Fxm
z<!tIFAg;gUvzGA!G?`o5*^ePRcLj^KJ+|;0`rX`fLiO9hb>2fsE$*u$OPV5`lCRIp
zazUvVXS3QqTu9hiQr;gbwO-2uRqN$w3{+T%^6iRh!xp5MnrQo0JD#8hcjC-^=LyK?
zb4IGv@SeoIx0byQbxfw+!`x{aKMfKfs9&1?Gf!v;Mey-K&2=OzE9)IIp+r6<6dkr*
zRhxk4CZS>{PuwIDnF2#HDiWNptICQeeV{MA$ypHatT14pv_sFTF>yfZ-a^-5-wK@v
z%%~!!V$xe+P<(TNHm*GyL(P7agE{w5Lba$(A3slWn*MWJB$I5256mC=_3OQg;Q|5s
zT)+L&OE)9RJs4=2M$BZBL`75~;x%i}0_nj06LhuC&3(5^9)oe50fe~)R+d3u&7;-m
z+m!2R0Dvu<xcMb-q0?lu8EGmiX$1G({X90AURMJ#g!>)*e7`w{?DbqNusV0rH4&&y
z5iBacqL+QfZWXYV9W4a8j;~)7`Cpd<actaAJcjSO>^}uX>^--<HfPZ{t+a~9;_?CD
z#j+J`CVjs3(Iek2PjuhJ<Q}mYCOo|+mgUORi+ff9n60i<!dvv<`b(W4X~!t40Uo?2
z^Kg5=;(2f5vrKTIG_YfYsToY70PLEh-?406V~)xg8^+(Fq3*PixS`z}Wh8)DWe|wx
z1e}Vm_N}GqW|OURahh`N@w>{Z#l{jWq5R>nAYz(W;b28Qc<Yy7zO!4JNP$6HG-=<H
zWp%q5Sv*m5u(z#kxlutaP+{l3T0^y1N9=)Ywyv-B71~~J<p?_=r!*x>{bsDM54L`;
zLR%pSh#uR2X130%*cax_7*{!~x+e6&6>v9JLu~uS94BIc+iQs=<uhMs*%6~kb)!uP
zNE@n^%CbuN8&6Mby-X9Y^4%*l#yEq%m8Y8@{&wQYrf@_89xZnGyQOKpzsU=W@Q#ny
zxo7`uh*!PZdY7dgXUf6JS-wGc1@*ZkH#Y8LmD$%JO%;_0PURPFt(DigQS#0o>Y82k
z^<#jXQ3%!iK1ZcJF-5#5P8ihtxN?Wbq*@>FcnWMx67p=+W$IhYZTKEOeC=@U3#_py
zRR~2VcJTy*e4rONRT$7ijX90<6vTf0cXwT>!n<!yC)}d{!OzX8uOt&tch^n`r2Yfb
z-T~NAnorwK8~rS~uYkPM&~Qfi=~R;V3s;gw6mC(Uu<HL=!EY46d@>8|V?DvK{GWWP
zIR`K}`P-8a^8ewZGz<gl@e@!xE$PV~82Aww{Q8Zu{|fW3IhX$m^S_$;cM#$K&&Qlm
zW3z4ZK@bpTb%ez7aow>_OP2Q1b)N6yi3F%CC8jJqriJkUA3{YoNmdaJ!wD7{p(1)x
zB-H?q{lNal;dlywNOYF>%Ekp8szwx>NUF}X(Ejmwzr=E)DU@%x2war94FqgPQ=E_)
z+^Q4aS%!~WIonC1yu2);enaREK)&cBbD+sqAbCfL*nvao4}^R=hbCw9bI-SbX;L<p
z+?{7GQR`LqZhPGg=>%}=)w#?kVG)8UQrKPzCn2Z9gGt?DUoORL;CfeSkMj6uQ(QH*
zq44v2t8RR5)L<K@Td3;isJ*Dc^9+AS!2tNKLY@63xCfvkKuo>XG^<>fqC)3-Olp+;
z=z%=FQs@nMZ*Bn7m7t32+*)c2f-)MdS?3M2H^%`HGAf#b=K%J^r>Vl=A5l~eleJ!3
zlh@ZKe}BDq9LkZ5S?mwz7@Ddi4NILt^3t4wEW0zGXzu4)k%ng4m!HpsTy3wOFko;T
z4S3=pd0?pSS*)SU&!1G1n9FiPaBx94D3G?tw8mZYo!n7WSF%WJ0go=<(<ECyO>XUd
zc{8PzL8XfPzKYO#<fSfzV5|VMz?UyyoC99(Z#E$YcTCatqu>0KhiHw^P#g9|AS>uK
zLom4Hg<7vMD6{Ic{_4>82KJdoCHWt6@30ATaYs-|UhU6A!BdD{fk^oVN}JX&V#5l+
z)%y)~gYB|nEDtJw_7%gJA?QgzN9=5M#un)(XZDbv$Xqg-u7s)!@es(=SoMr~mDy;2
zs&jLRZuxxRz<)UQh2OBOt-`E#I4u)UTooL;h~Tle?~=B}e6rF_T_oR@vJrDURKk|K
z_*Fok)%o_-cnDP$_<9{@-0HG7DA|1PZsck+TdNeo$M#pAw5Q6{+?q7g!g?(71CUjj
zNABZ|=`x2k+8vk6($qKjjlVr@x1THgLdMN=$LV0qYESA{qB=3Of;D<ceTQjNc{l%#
z(l_Ht8k5^*;P$Bdm@n&V;`zU4Uo^oCCG4iAP6}}O$;rIuRw=K`x-x<Rh}*Jb_Tx2H
zR%@XGoy=<2mq!uh&~dF7JL|}W0=n|hx<hca+nRl^i}c7oPSg->Uv*Q~_nB6zG?&-b
zd?bJ+r~*lfEUh)8s9Uf3CPx8WVXX3ESa(}P5Q*zO{h5hu%&z+}b;qg`+#Y{FGltIq
zY-9_$!XRMu{b|5=sm#YkQ=dNWm6Ra9eT?Rw1Fd1IdFcdnAA9eteqpQM8@f>CPkQHH
zc$jaBK|Hj>e)o5f0*G+&U5PT<{zoK_JtCgkc_C%)v6qN#p9=HL)je0ND+ENU>AjBO
z;>ZZ}KbSK>T9&*{+4L(jV^j2V+dPclFv11kw(!OJI!35{k0h%HNv&)F`od7YK!d_R
z3UKJqvDx^d_+ACbPOZX>0e2W+H5ngUsP~syB7yui)LMy4vij3u6@DV|+O=yhN&;qD
zXc!3-|6l}s=8tFrmIP+}ccZmtmJtf^VyNUY3u}}!7X8zD$z6uQ+V5gkZQEFal3#NF
zym7IYRfh8is_))v^#^WG>L#ypm*yTt{@F6Pt>Lq4_go+kSFW3-F9>g4n_EsPE$~Q-
z=_YD-{_MYa&Et-Ovvv2~w@pYDSA8v86IA-GE53>~=Cji>&U?!N^&&VLQPNeRk}h0!
znyjZsjD9_5Nzn(#6Hd2$gW#2~d^R)FS}L(nk+pNBEUP0sp|kzqp2Y0QqY+NphfwRg
z(EjRdjX&mvxA4==p?ydL$0h_wkzy?ipbQH848`eII^9zI*^^R}rHX{VtEG`6-F2+p
zL$mrmym4@3IX3ch^J&cy+CY%SFYXs9*LqkV@l2r(QmZ25Y|66liC3PBjWfGvEIJcf
zGF$aah-uTF`xxH=prku~`#Tj@OOt$Xp;F4bJ~I22zV*J@m|A<+@<QX%W36yn_t|wY
znN7KRbUvorp1vndfRuXkZtKjnz2-~&xm0$9HgAz3QY+Pe-cYd$GkrumAmuU1ObDCp
zWh-8|efzdbd!L7-fr~@{A(kO~*8=ms(5zo}PlZVY`m%D~U5?>h5BbmbPidFi^Ae<J
zIE@ax&s8*zhQ>Lzab6FA$CGSmh9y#C_+kxOb_)5g-f5gn+f9YX*{nxYUXQyebpNK!
z0C-V$IKNg}Kl5v9S~`W5-6d0Ko`ri~y@`ZZZP2S`w4u!A34S*F+QlsDfm<b}q)hc;
zN?ShtA~GbR%;;i%us<|Adu^sRyVR&^bmb@a*m-LZ<b8Q;4vUmqEO2um^eSw-MmFF<
zhHk$a6tqLBZszJIiue>;nS;l-0Gf^E_YWR=%R3G@KcDX^oee7hVJ}O);=Mp8jOOSo
z6g7b8mxtKek1-8{*F*8<zJk8LoTadpzH2$sqF&JeJ9>E-@6)T2R58?%Pi=5%e9Zq(
zt+cFrCh(+s3PJzLkF>Q`W{G>%L`eQS?Gv~QRp~B_Oxdsg%oMcnPya;{^y*=Rg65M)
z&9HK4PzquKWj9<7N<Oz;^gg9T5AWlq#Ve1?cM<c07%vF7ZUOu{@zg|Csq@O6F@jvn
zm?~@4xq@))i_xSkw1xj(?63?NWKqSk6lYcuKLLhWNxP0X#R-eJqq56gbRqiT{sGCU
zMQCxfgv7Ak0=lfwP{uK-V42wI@?}42C>m>2d6Wy;ZYao9Lfd0Se__=O32X6!Ce^&!
z+DF~@)m!`+EW{1C_cpB~iFP-lINmx}$9#@Qsyo<1*b5faP<UTj90l;L*bvA`Bp7z{
zJ6FCo8ls9yT|z=aoO{#;_R8=E|De}F3~_=WUGzbj&QK9aVW)W&-l7E=M|g~ArR?Xo
z5?ukFgugM$7)P~7y(WX~Hd!v|1Am;*y~-}&N9-mWEr#_LPEfAI4^(v+q%o#xyYQDu
zA3C(_#tB4$oSc6KOE~|TGTpP<@&?#n#dCywopkgERyl`q{zLaKzF$7C6mNQT07$9{
zxU24<Z)<<V#-C92eRXu{T7xNRh6z)X@W2KwC9zv?(EEPP%B05CSx{7FH*Vouxr;5o
zOFLS8w6^IF&JmYhS?E>srHje6<Y2q!+@=#!_k1i2OEf={_HRtB;Jh>8UwHXj6S5=3
zfVnN6HP&+Dx1?~b9fjha*P01>dB5w+lI2X>ll|7G3R1R!XMib$6lL@@C!gqHRm;DV
zcN2H(_{Usl<^nCP`jFFnui2tADW?7U@$HbB#-&bAB9+JT4&Nh}w&_jf)~02=z0{Y`
zS`E6lJ?=3PwY}7@&Lc1aS*i1}!lBpphuXr#^dYx#>vQpG$ursN^&VBeo3j@IHV;Tf
zj#pS$_V8udKxHocdz$Q;u2}X14o(is(Z1%W2R4_Ria1dIutTquWEmeVVsb1s)+aFO
zp@U^fv;aiZ_D6bZSAx`JYA(1JvD=OC+O(o-S@;$wn?E}AO|$eJF7|Gsx~YRtZWi^P
zm=wnSUX~%FVFfX3RnB$7bhl<QOg*73Ag%PrkL`VUGx`zAZ{sKOqVB`h$=HDuD1Btx
znBi?m&UO^1dfrYuJB70~8nkd?^@B>8e8YL0l-FKrQyKIPosmud%&LFt0tmg#2m^p9
z6f=bW$6W);H})Qjid;$yc-||^%D@fq0J#DVoqSSf6pkIIhC&O|m7yZbu|F5X44r>{
zqe!E)IXdXCd|QA`tpX6cOS|2GYqY)i6Ewm0U?L)oi5ufBGkp!Hh3Ssr$-Ke;?CDY7
z*4Dxi9ES5~y9y)Dah8^PJNYb?%^}(%9L6f2i|;n8-jijhbE;y2iI;ej7B=1XoSJ3h
zipK`fa_$;LZR7H^3COMb!jV5_5e7w{U>hC0JP_d${Xz5-L9@FR`huwts#y+pJLQ?b
z#`nMjUykEriKNSE4YMtn>9{Q*?n77xH9?<cLvl21^(;~QgAyqr;T4y90Al)RRdwEO
zM~>?;*SZrrvbZRmQ-R5Re6jx^rib6O%bWTcs(UN=ZK&ny$i=dwhM<`B5L;s7ALIDT
z56=jfnABT6+dx#`^q7wF-6pVxW8~b{%P?9i2nw1;Lr5bVvFF47h%S$SJn?0dRF+}3
z3WWZo3~``*89AA#c#>Rze_RkAi@^z}LkkX)&?#TB`=YmRKOQ&&yq<@HRHJX+90iM^
ztD!5#NJ}(q9mttmfI+>~-B+N7@F)si@s;F(5Pjs0#EqS89T>qLet1X>mj1b*YFM+*
zjhxo+q;6T@82s()oB760)r`(h74qCp9hKQ+h3((%NY96q(~TO~j|xuu&?ZMO$WCz7
z%RGJbu7cNQQgSq#<0OuCU|<~CS>|L+?i07TTL?OMkr6uL5@Xl<><JTWtrByS+aLlQ
zsYJby=ulJuo=(gLSgnGi&!6uZZ#sCqbAEc(nji><NV+b5UHkDHCIVLEdLONqtM$=n
z6cIdz&I)b}+bx^pp7UAe?$<bnBrFfXnXqHZaXg&$4x_vPk2N`F9#hw1PqgPNkoOX-
zWvxvEbw!R6JWTTK;~(Z-`Bj?hg=9Rs`$g?z?dG^T!D?{*dfEK0UYW%aql8<>0WH6E
z$%v39Y7iM4I=A7;#(UxoxK3`I$+8Y5>KMMI^7!Z-fS7TwSbj#aa{lt7Beq`$|M^vW
zi3w3wMw@~$1qVU8r_^-}d1bExWdbJHk9VIoaP_hYhuje4KhE#tI{@lvd(dmjY|qjc
zJJNKP00H(3X>67K;lMv*A##33?rT^9k8#k1sb6?M5w=F5Dh@;}Z-4R9S(*}O)S9Hc
zJk}1!pK^0)1rw@NE*8W%=#g0DJw3sSS47Nux;9l(UZ_^P_3$%3hP^73<u&;M9zHDR
zHqGIm<Rj9ih?VbU(l-DVQ|u?^*`nAZ1TPN%>E;5C{c2wvkm`%`*S;JP4^#<}_Uj=D
z2=m#%AnnfW-g>9}$uA_uom#j6TRB_7ITV%aW=#IO+PO}H4j?+e<VE|i)-3s4<vXg1
zjjUHQ?*u*Aq&@SJCARQ2B7@Lj59Kg;ic$KY$#K3+edEo?=w`H$YZBUI`^T5ws)74B
zqtWar)s~H!SMSE?yOS8nki*3$(Ol|q#$`{JvesKq*EIb=-2bFeJGQPn5}5Rbi=#--
z^$HKX4uZcV0mdc*jxUT&Y=Wz24jXhTW)62&TKNzpnF0TAh;w*p4^g{3l`ZVpe-)!q
z)CEJJj-D(~z1taRU!oquu@!8_KeJ%dXFUo2zT!lGVI&p_WtXY;7$kF5w`yw9eD}%^
zVDRg(#U@t}+zS8bANe1<-acTU!o_m6^5Tw*+wY0R`_6xUKhHPbb66vO@D;ZW`C^;`
zSldCaUNhkV(cT`5{kdTQXM<*hZneIu1Ohg`+714mU0&T|yWye!*blh6W<8Vd$1fX;
zl`bfS+@MEE4#VqAY9AX_IPieVy`JKz>Sd-)nnKJWG7F9(E%6xQ>gclJ5<uvD^Y(3f
zU~X#6!Cupv6_^q*Z_hptPHy4ALj2IA=dA;7v)X+%UbZ}D;&C^_j+Eyer8y|W4~h%`
z2n6xHooh*dWl~P??)8KwE6}PG(!G7oPAuDbL)!UZ)hYqKFVs3un9;?$h4Ey_i++^a
zm~{UYuqwsrCpXIBg|vwY(o|RVhbal2Cep<z`~B@DD<CN8D;rdVH!2h~%mCS-_9+Ez
zM(F``3$kwCSki6jd0W~8kGi~YL+`E62FH+*wUU3NLA5K7U$RAu|5P7aYkGF>8N2>F
zpJ%(pwiwBB(C1msA)oJct&A*t6HT(!taKpva8Ze^S}8R+EzDstP-=Bcyg*Pt$Q0l?
z<_mmgtu&K!-_-^#vh|jgUMs6iXO-O?E~}QlBeHdal8K0q)Q4YJ-Ro)%vp}%{M;8<+
zv{yhvcjX*pp(Q27Y!WWHq_I7Ai<a%a;{AYt?_WAP={jK-dJwe)$dRA2TT0np_A82D
zWXGG6lBPhJ)Wpy;8ZKU5HE`jx3<{MMCgu70RZJu&z_U1;F~Pl@3>_}!O7oQ-mB4NL
zj{LaQw{_KmeYkuY)^k((W#A>ImxrvTgD4-np$H%`+zk@~n0JEsx-B?Pa;Eh&9H<py
zTFz3BD_6Fk3gjlxRlRFT)*9%r)wcc7kh?wDZ%uGtz2~3}1GmB%KJ~tZ*$3^&RN6Ay
z>g47D?ChXXp?70^Ul<RGMd7QuIvuecD}w|js<{}6rj-xa&5`>wP_U8yk0Jgwao-{S
zB<YiaT=^(^iLD2f(p4^iVUdk2sf!l`_}rzdCb?m2b2vwOm1BCsN?!0CEbq@zWZl<G
zf53fU3xxb^!`Y#;+O5o%7evmx>l?modD_aG(`s1eS+TDLoSb-J>#jvlUg+D6A2#nQ
zwmWVAw--Pgmd#*UVQHRL^g7}4@ItEJlim2e!Am9knZ|JcT~ywN)E$%&n8E>vg3ZJi
zvAs|HG+r8&@R_$4U{mqO%i+qqJ3I`cjw#Ob*ng6vnF=g;0f4V7O-gV1rGm$T>mR2=
z7dUCG(Cl#2ctncvJLQtbq0=|fu}e#evqfPZ?TfO5S&v+00g|#51pR4Kzs7m9o7yeg
zJeB`l*|AIg<S22|IXp!7o-p8>yJrNK(TeeLQNJI8U)%d!F9gbc_Dpn7pL%}+)IvB^
z*5V#X{B@$=c<%xLzDC{RzMxfXRxik{ojQP)l)bfticQ+1o{e)_W6AvTCG}iJPm^50
zp`(QVL1nV6%M<6he=*@GZR#iIq1C>7A(lPK?b$>#e-ZU}GQ`?j0i^1|jNl||Rn&E6
zW<Cj#=-<EZ^@G~1hq<`4VYa@1+OAf)6B3W9r<UD`B0SwHj~)fzl=0RmHm$jH75gAk
zti+>$yW4@@zW43uKj*mc_%|!g2gbq4`^1ph4kiSp#o$i!M9y(6zp-`EdGo;P;_w6=
zghM(h@66W<9t9k|#EyNiagDzohqKktq}0k9YC!St4r5R`*Oi#Y(Q=Wu>&i7yLU@^Z
zBZq|3RQl@pZd{)HLU;jOJztk=jlmS-4Z_L{wEqq>0C`T8$Y6(xCMc^`X`KH~?EFtY
zQjn~exK^!yi!*}4`6WKY1Sm0Ty25Jz^NA7K^C_=>rTU8(I~^61{@llS<8nE4G`XQr
z;m!4vjs>usDDH-i(b+wU?}IX|{`&sUP}r3^AjT9ltW}wOG_n$!_u;QqEB|@mK+#tv
zkbUni`7saR7_2KOJx>20l)KXf8J3jion(Q497^CWSz$6^f_KW!VRS#qcca;$%w@sh
zxC+fr8mQj1#WBalEiS&y*Ut}T{Z4c7;>ACu!e>rd)PW|DI<D_l;Uz2pHFSVq;dYUR
zMl)N=nfa6#`_MqeXSvMLC)U$aw7RN+9z8kN9#$y)T_^tij-YZNJuC|AmCHP-gzI=-
zLHgH#J{xL3#?GHM`2VA6PTBJ+xSY1|D=Ii3J>0)@@WA^N5nWN?I&Nk`-VHkexB6Em
z>@XnLu8G^~T|9x|@IRl7J#OIfUtyjg(f_xF*%qO;`%Cl!`;}QT(0kaW&8zzkp7mjc
zOEoPoPjb1)o&eQ(XCHuEZ=9ynWQKuL_Uyo^KlPXdUS$_&zNe?8e5zVSP&{&PzKNl0
zJC~0Cd%E^N@tHjPg|E({SFAtE{=Jaoe~h$z!!avIw;??E?1{16zeD;9Hgp)urLk9^
zN)Ktg1sDqP`AD79zBDlHn8dPmG2>J&$CaDFseWz2%6Mugn?F?m>EplCJn^#ouQdOw
zn<pfM|9gb~YmiQ`AOAJ)|KGob7=tbT`N*tv&}>)c*=j5CPa3-oY6cls-08LE@~aQD
zr%VL%*r6{)aYCN7XZtPaq^*7d7&M^|OCq$tm0O&c=KI%mi1;T6=sTv?MG<5)Odmn=
z_o-c#@>GbDT#mRB8P)8pG86Kg9D0uMJpDv`A5gNf^FirAtD$jc-FZh@9^z$Vm8%m`
z%`PfLCW<VRx!*Tz)1I8_9f^|zlxres{eiIm=yQoz9JfH$yc`?_m!L+Enc&^gyt^}Z
zPIH>BJUiy3k9+?Kt|bu^Bs^!QVF@3vDIq(5P=>0Cz*hb*L}GsZLgLgafw^LK(D8Cx
z*=KHhi<+WIO*{ICI0${*k8P|vRQ2C!e7siaPpV!Wuh0%-3y*GVyTAh~%d%{XxTOPo
z%J_HhGT{0Jplb8WgE*_HPyc+B@oq2i4ZYEEC$k0)pWYKDg6bD90XBWAmn?vUGD}^R
zd+NT9h2gD77hfhwFP-Bt+`R0=O8Iv=kS8AVkOph4%u=chicK&}aXVia``bfV@DY@F
zs;$mLt_nRdhp`BhT|m?%8Ws&ur@2H$!Iy7}-#*5hf%40bAt5n9si-<otd;ePMBvh9
zooG)ob}3e7kEbX$uHvO(d&vt_6gn|lf1GZ%YTo3El5n{bCoKH;VBrFJP#{f@X_deF
z#Gj!6^!=TOqtK)ohD3&F0Q->!(R|nhGA6=~hh%%JNJeL%n0E!>D43}46a0*!cK_BO
zG#E|+NpqDI(X|xh+CnIOPb?HvFw!gW_ttjo5#(f>6#h`=8UOyBwvX2@p0&W}`!K9K
zQVO<F(#Bo<0}HbO>dzEYS>d;ds1^Tf1Y3Yq0@Sf=?IW<aMPgcns-1oXukJl)(Z8kU
zBWD8?ziM{2J!Tgn4`Y!NR1Rl-fB^xeja)W8H*>6bw}94Ka4Q7+p?)pSnd<MF{@W%f
z&{zWJ*pgP}wZItQj#|aZ&~0|Saj@d=Bvr}7#P*l%9NQKi)NQMZA+0+9t;kq5iOTwZ
zu@YkPtX$>!=vRNuX{IbuGT9sP_g+PP^0bMu4IQs>i}ZL>YipDvOv@(AA%ZWkGd%3C
z2I<y5yWi<d_4kcAo(|5!<J<B`AWav7^49{3&EwCv04iS>P(?Oq6J#iIs2(S%nyWQF
z*U<PnsO8r%3FErNR=>`cqK+doC^mjY{q!+$CKxD~5iaWAiex3X*0gGS{5J&R!i}In
z?2xBsmqbF{s!IBZ(T?8dUp;NBx^j{gRxAO0o{ro9=oE<frA%w5!FSeb+QJLs)OS`#
z{l=vMe!Tn{s#+lPf6XMP9LQ0d9q!xJkG)d9=(YF--It$9sCjwLDc<$32albGid@6V
zeRm_kvJ#!LQ3MH+Q-@v>@~7j}+aKeZ%PiX?1rCwQO=XiGHm~?kcsOdVrR3@WjoJ8c
z9;<x@ZPhh@JdKlmH<xULo#X>N2Jb4K33|v8A!s5A1Nl*sqMy9$y7$+8@B1L%KyH(E
zd?HP&7$5dK&u!9pZLORWE^zd!XYB{dBC-OG6j+JRN*rKbgxI)kItSjbFVukp*>6z)
z`KE-?0Iy-eL+1fvUy+^7anm{w-R55h`=9N;@bb9lm>||&ZF)KwFOvwE<Or)8E%oTl
zL*|GB|2?$|1rTAofUZRGJS~vSG-k{F@#E<dHaq$utWPDe;w9(%%MeF(8JD4(OGlPw
zO|;PebOlpPl~j!r#JJ*z41rqHFL6aiq)dRVsBzqO3#fkP2U>n*OlTV#P%}ZYnZ+F1
zuqe5uH8v@C<FK0&91A@uae!&D;|rix`<bDX_46E!66V|kiKVGV#WJ9>?BCvDtWc#5
zAg6X)T3UnlNgP1bTQBko2Re4CJ$m$r-;uD@n*=0`jvNG7n0*GyQmKNq|F;ntkJ+J?
zV(REeqvqNd&9p{x7KA#4EYOigm5Pq{wvJBZzrDpExoFF-_@ArJX$vp_-#a)YvUvx@
zBrV5z=X`5wa;xu%<!hJO9f-(lQwiVIQc?L~@G=R+U--EMR6xJOfr?!pp5%u&y{ENH
z<J?CU&GP^ZJpDYUxEMZWSV@vDWu3Q!G(o$n@ZdRWb-YG9j72IZ++Z$$0Vy9urd#+-
z$JR689EnzF3?&lK_(;NETC1eYpY)^?0WcKAq|=teC0KpRb4dx#V%i9~HPqT?jApJ@
zb7x4bTpK_IM3s_=%m%~sg2vARQjbWVCxw9OX;YD<V#mWjm%K#o^8U4mBnu(mCLoZ#
z%yQienPdd?)<7!tq+k-;_|9c|>sx{iALeCbA;a3ohk{%eM?gc4UoV%}{`uy#gv+fk
z@cZ;}l#hUSv^O*;sv~WNF1_0{F!fW+@fYrnu#rj-_6labyGmG`DSJM12ZAOMQ3hsx
zuVr^W9kChLdg{ogZN&N_VA+Mik*R$c5jz#2E04<SeS$PdB*t;FPVtWBp$d@B`yS!w
zrkmmU%4<HMvG1TUCrZ}OI}VBuXXMVDWLt>BYqt1sD*u}mDM0LA)J~Dqqz_oADgi3@
zqFKjlUIuOZAD23Iibfly2hRhX*}ik0kO15~=z$w_xNi-iUxzF6_w}vSudS)Jty&wE
za+&{h$!EvQu-d-LRtAzobs#6_8xP?2gYY?|qnVr-m__gGVQ)@A@ew`1u(AYor<wt!
zWbbHLI6gCplrKoImOJ#zw&Syp^VB}ShsUM!iEDd)HKcIin|QouVeo$1%cJq9XWboj
zlZFJcZF=7~k8fpSUk!@|c)zP<eDL=c5DwuD0mR;kRH9Gq%9sH6YtefJ=L0l+;)<Cv
z<?f(DdQ8kkHE_X|3!LMa^=czVY_n$IZ)I5QDq&?9<AC2st-PR%M?q%+bKO^N$maz#
z_o@YW#_sx46+Ypno51a|%x7AJMb8z~dpuQ`v+jl*g=2_k!ZVDR#Sf$2ydl4KO^yA{
zL=9P=QWn+SybpPKo@<{o0;xFqC~hd7J=^?9M?QihB=GKwvyEgQ9xlD1zp`|mjC?&g
zh|wJ>m9%Q@fmA(Q@EJ;xfXyFRPm@?DWfroe?iFCyu^33I7yA9!cvWb!q#JgzCwFq$
zv^C7fK;K+I24Dp~;EfP_)n{otiYUqw^Guvj$a^(8xMb=zTgpAYOl(c_hhMIk<a+)7
zQk;66H002jg3qyjX8j@1K8>GEJ0U0BtXq@--dym>w9XQ99DNcHwsf%zao=II8pJx}
ze_>;we|&bfU2lR3Z9vp{2OX;PX6R#%2Z`MSjv=PI=K395VxrHXPj;98``Qpyo4@*3
zvR5xGPOa{R##wC&uUI+xaYS8A@&COht7Ab^UakVUGXl~@N^i}!&mck+4RPq92R5KN
zKWrarNpovH;FoJlA&4kq=N}8fmJh#92fG>1X&+8;3aAj};?7#qjd;0DnRkxX74M66
z3|wnV!7p(@>&?vW&|L^vURoDc!_kgJXIZmU;D6}U9UW3?CrXv;1dS5eJlkeQ;}A`|
z+yQs}h?wag9!89D<vjZs@A}1|nlJE0|6k4itdy@|`1Uk>w=$b{tYD&x_v<qBZhqLH
z#_v|v0NtqQb9N%<X8c(1Z+;%ANM7F>eo`x_E!RIjH(3d?Ng!P|9B0`3t5AZtuKZ{m
z&9A?0y<&)LDR4R%@j8}A*3Njj8q^lo<Ka=pi|%rCwy@Z<UgGG~F0Fh4hv_l+RvZuq
z4B-n$P~unFjaeisW!9&#L4NE{$2wTDq_1|;VZQJ7#>4l%9uE$&Km)knTCXY+AOvm=
zU!ifNm5JLymT0uFOs8VavSMt$e6E=Fw7;YU{Gbf`D#6ZR*x-SqN%yr1XaW3nYW);-
z!L;iFaRsA8q^I?CbE?L7A~N=+7LPg#z|9F!a);xpre0~F--g}kZemtDQnTwMUADjZ
z@a!(+WRl`FmZYCuI_+-?&QCw1WtFz%d1cbQe2tzSYUlupkn(UiZhAS_8ZBE?Y?XAR
zJ9+4=PyM4>En5v9(ejx|&G=_VF`~V4<N9NYDqU_77e|1uo{wbd8DvGL;Oo=}Sdqnj
zi(;*S<H~IU+NiW|dRN~kVu4<#ahu&=fmYXsB?gTmZ5-p=`grv_HFHsgW%~*Z0$BfC
zXuwmqRbI?S3#2#%V<c+XX2)nmHEf3eoR~0HM07D_CUzMjty;rUOjm?BS&AS>xwZEt
z*KCR>lFBDo+}KL&@ZnhEuo+J#KB9g-dgZUsuca~j?HQ9lIqx}hdpjrmY<&BxLQQKX
zbd4nkKZ@AZ?))G2{xhoSwfh={6+skK6a_@OQlu+LuZn^K(j;K0Dv&@R^denEMJdvW
zbdjFWBqT@)peVgaFQF-f9zqQ@aDLq7dEarKEq*%Vl=0u69AhWss_R;1&bj(H!MI-^
zyq8cXr26ZJKZM<_<XT?uQ>virNDu<G7$Y|FESVm|vuKQ3;{*$d^u9U(Ekg(cGcVrE
zrpgaP_*o4V)2Y^M^e=dRHITYiYAn8B<Jgy$dG<;#dckd|lw{Vy?LWD3p*w?87$a_}
zj7z0!!AW{nS4%+(%vG=gfd`cG-r_)lJT8qS*r_t0CcbZ8RjVNHi7kY2qHr$;iqQ<5
zGcED0BF408AvlOv+K%;XRM4v404=Yq>|=3xUvhzGI;rW^J5p{DG93lZh3R$+#S1Hl
z>I%EH#LXpu3~#`9dKt2HQimBCT?v+8p`Tk0<(#D>&mP!dZmk0@-CfG%y3yWh@S_Th
zx#@-W#kNFAi3fPgfxfmUOzXOeezNT!Yx?}Rc5pX~c7JI+GJCJq=ergW?Yh?fF#CS=
zV|`zpNN?YiJnjOJ4~fEX7dIdz`az}fi~-8uQsey<V%gAWs(j0b@<jxv4kbVyK6}+|
zR&RiW-eKdCa{U6R%36@_71DhSD9ISRh`Qylbt+NPHwW~&)i1DCP0Z=dA62}9UN8a}
z=*5_b8iu#S%I^jT6<5DnfwCXFe}H2Rg%SqDzk)rwvWGuZNxLiA_bg5O`NfoU`qYjC
zNc`Qc`8m>lHj8iTBVA>&jEs&Gc>0>hwnK?Yf(mX8w<J&585({~c}+h93ql&{Ku3_^
zv_{>Os1LKYneX;+@T$DJJTz-1!$C31y@CYX0C~M2btZ>Y1pxR$(MrvJ1>lG$3WQ{W
zALqX;%*Q8f7_ivR(4J#=t}rI03`u6`*Prwht*@`oK4|slGhr(pM)ZJ_WJvUd@1b9Z
z%&R=-B(J0rgLnFqGZ)YFVlqEnwV8VR)S&qGMQHh_84g)zJxzosNrM_tjbz*?aOhD=
zRcOwPR3f+zP2zkR70-3-Oycx?hdUD2Du^YE??K1*+=vwe1>pL&$jC@Umr02c<%24*
zd{HEO%xUmBDclJPH%vsiLg8iv;&@=4O%x^oS1Iw3eu+&bRL?)3o49TVW0=zr!6UPi
z`^H0Eods+f6s9^T`YeAoJTz3E;7QWn<rM#Ea(8K-muN^`K`mE=N@Gg@U~hpMG)N-T
z+|29=b#(f|&_f^hz<!AvzDs7MZOKkJf!WLOhJu?4y_b_$3aN^NY0uu!;iy4~nL`k{
zON7pi+UEUNsioeNKH!ZtI`BHdFL9;WP}Fui#@u|8_xknw&#a2ud!<(+NZ;?0NcRfJ
zy=9t_iX(kIH|$L}-!*b!lAk)5O8a6xmOHU&=*hVr<pj9tK@6^{yxB5vUreQF%P9R_
zKGl!%(cup8MZr9pZ|2#7``eA6&uZYX>2`L2M_^!WomDOE_g2jxA3j>;g-@&WSd83M
z7u~hrIC0DatyHOE#qt5ep*oJ(c`Qa#0J($$w<RVr2UIi>2q9+z`owP78yX$A15FEw
z?se}t{Qy_B`Glm5(tH2;;SxL_B?;~1wTvmO(%Ci>k>y4BZMbp>rgT!Wb^Tr3U~Mdq
z#I)|0P#DW<z8IPKUukVL>C@8GEEQTct)VMgpB-x_Y)He$99XT5(2$-arhyxMXAJOR
z`PurZd{V+U0{5>|9w7}MKta5GeD`|WrfBGEE@57kf+_))9VohS8}L+19qgG-NnOda
zc?qcJT&+r>zSbB1>ySA=DLr4cTL`#fG<37+uFMgjI{#fVQNkr=jV~brvNY^L^r`LY
z{Z-|+?Ya}w4x58O=k$I*g$_9qwpVdroKHlnulK~hSONi1D2Uea8WjXIjwi}Gp28nM
zrDEmK-9V%xDqcv|Dzd;O*;EKU^5{2R6t9By33&r>eo=g`Skt1{^$m*i`#<H7&p)R+
z&YD8;Y^^m}o-ggheEas2NQKVr%)Wo%tzhGT2vx4dqUrN)9+XkCZlV0(`DW0Kz35!3
zdoK6FOqTR3bWI&)(2q{Q#rsQc%xJN)ZF){EUzq&)%aj;v@_7|wW5ywr740&3Z(O|x
zV34$sITWlL$sDB*cY(;tn30jZu#3Lpu}3LP2*PM`D2&?6X?5F9!qhjqGBqSGrAQTJ
z)btf-6R`e`I--}W)X1c9ao;jRa4O9kINsaG4C}y(c-V>%UnrlMCT>pu<XK=Hl(GLx
zo}JwjYfS5Jdy0tgH_O{kE9fp{Mi;>s#(nHfTPF%owM=;B@JUslkZ|AMe*__Mmrzql
z$X0ECJb>DWJwAv$lU|{=3Rx8y#+=Tjx+;sZ==uF)QZyJ1z(*4I`Hc%6E4TaJ?}cns
zXckdL6b<K>s)d|0G13njml=EBN+@{T+Mq0^cl(*K;5Gh(JvT#O>lTo{2pgFCN_b*=
z^DZfH7R_DIclMId<0j<&&Paf_0bYu@V~LY_Ck7!WT-X1`R-R_(|Anr<ktIxPttRvb
zctFm1SucqQ7pDHEVC}2&XQ4FeG*#7;P~CLgEK7bEi+J<bi_P7WvG7uXU*VQTiT(H9
zr`1FmG1bPixLp|3le{dcKtn^5>rD^i&n-51_Gz+UWKuw<Y5CVRo9Tj~no5T^J4(J}
zhd0ByeOrSoR(7DzA_u!9_$uHaB{Ki)=MRILtZw*D!bs1IeL105?#qj(^zWL<Vx5ze
zn1mcS;*3=c^#%YAg)W*4#3MPL;XcY8|Hu56ggG~NFnXU(FKvK~B`yySYX_df%1ji0
z##{8v4}zSHh`0*hPENr`m1Q8e+-+Dz|7**DY?_;{LxE+(Ld9To^5H|A3s-7BbB;VN
zT%_n|*E8lCX{x(4j)%Vt?m1@*ok~K8`(oL*KNYjIUer}ij@E(>VfUXq0c;HP`UBxQ
zyP+G$=(>H<J5v=9)8=U^fnzqQW#n<sp$~t2fR9rfoZb?5ji3Kkq!UT=b5Y-Tb1tk@
z^@{JLdW7}wtmcGzc1cJ|xc|(<R#zyErRa{y4o<NS9G$kgrrRposwj9J02sGI038_@
z@Dj4bR)3d!HBUdYhv`FmvP`jAp!vgmqeA39W#f1DC$qiiJ8EhhN;ZWFVvZwu8CYn+
z0!71oG*<w919Xf?Kv;V86@qifw-1d(ZvohRw>PTB-}1AW58mO@1T8SpP-c(M?xf=j
zN^ei3=l~OCsCwKnbU7JCc}~wHavczOl13iUx<K^}4RB9<f0r#JYO`{B9P>JV->P<{
zL0#;Gx7$oR0-Ek^AOu2waO_GP4)|pBfacCf>O1>BL^RjJGjNY7AS=^M(!GI%%qs9a
zP50Z5_jmz{ATCuYXzt=2`+`GZ2_?}12lch+^40`F(Lnf!wb|IxZr^e7g|E6*+Fa>*
zV6?^oWnfi^NjMJCkxELyJHmwl8QXFcVvGPGUZMH<u6B&gSjAuv+rGj1Jyc6nj_5Ex
zyu7Rk5XVQgnLIX>b1}80l`BLs@)M(7$Jjrf#PiEJhqtJ6Y9bLGbjwr9s-V?>vuTP!
zxzulFr~0R{^4^4!3lp`}m0C*2bMV2;$w|Pl+w~-~uSz6cV1X)GIoH35h>3~0Y9|_z
zl;%5#^NqB@0E%8s2>O`^w?$PKL^zh$+U_wqm(q0ru(k5>U^E~m=h^US1_SRg8B1O-
z>VamZjTVje!$lR&exwS-$?##kehTIDwH!RI(m7N*1>N)62<TdM^4dUhalD*P;Mo57
z(S6P!fwYz@32D|6CnqR+ugc;|lQ2s4KN!?C<AvtRI1>N(w4Qn{bUy0qP}In6pPy|#
zw`~ZXutk7o@&$)$omd?9SjYw~c<!7rM6tRzH_s4)8B}6q)N2W@wwt2^LpBuxuYram
zjF?MH8Q<@QOba=6q*S<)aQy?LdF?m+JtocrHHsL(P!9{3sJ!p00j#+2!=#ZsfPr-H
z1?Exidw^z$87FiK2fBPI54Zl3^cuMX??YybSgc0$Xoa(`y_c>kPqn$BMHECS0`f}U
zKX|4?LrV2qdCKj5!@ht2E=$A<N%HV~Mc&`vtS!<3`UZV9f=fe<boYInOv-GhW9CP_
z1X?t>YDi@r)1s!Lzz1%dnd#>e3nUJ8DM3^E0j6*}R}^>ww!I|I9Kg5fzBE<l1cG3`
zm%~2p@c%JS$35{d=*5{1^=bO(DL26}c4)$!R)kVi_r`#wfS3K(A9CrP=xR}>Gu3NF
zzEef-y)+9=2IeHi0m;BD@!(4DR%UOF<eSMxb<6ysO+zKO{afvyo1DLNDNFPn{=pcl
z!k8UP@wqEPfDCCD;);&>FTgCj9-KHpS8s-3>M|~*V9ax5JyaSa)9<I+q(y35rJJAv
z)b5zo3JBR+RP}F6dpIyS+Ksl5dzYRUV-?pXc<OC_)*U|#dW~~*8Y0rUx%?ITc*dJ-
zyGA_D|I9;-kpP~HTp{x1FyOj)nLw;fhFA$f%fxw3-1gX|9!M05^2)f#bzkj8_PC!g
zkh?gPY-hxKX^GnGO~rPa806z(;R|d`sRUM=S_(M?$Q+r_FKJu>v+g+dl~%NpVf{`w
zMPE4V6<&!Cw5ZTbzu=Ifu<Mwpu7?M+9l>LD=9`fJHi^t;Xnl57jWF9~&1J#kTxDd%
zP<G3`Np*XB2BZT`A09&u2OIe-KA`N>OguolWAxF1g@9^rzZu@t3E|kOEGl&VVzKCU
zl`g&B{tlib;Y&7a1^A}RCpO2S7PT+2;z*FeS8b*;$HMl<?LgArf;jlu>QL6dd0iLs
zSgL2OPa6b%AWE1Q!T=eaBpG|5m6es4ICrClnzbCTdAloa?fp3kAVDSBNq#cCu4}U~
zFV&sfxd!Mq@|~tT7vo`4;?;-jlW^;Iz#}~yVGV^S+(V)eKE<#fB4e5zKsouAZhfGe
zs$IR#358u>ePK-dj!v~o)5x=Ec&n-n$OTc%moR5KkS-`M7s`%G_G_{iAOm@NsKO1Q
z{b4IjixCB$0fZ|s4!Hq&E^0XS;c+#3N}^Hs*yr4IpOMl46B;1fzdCWk+-zTT6rYXC
z<9gJar*Gct``NCCpQv%N$IO#*7*L}~c8jhrF8vY4W*vHH9O>1k6Nri5qPJN<z(!nR
zWfdghHjCW9P{h(lhE1JnmfWY2<zhyF9GiC$R7T%-%p`kdxU^_KcB~g^L;v}#kkNG~
zjueo;C#g$|ROyf?5hLUDiolsThpRC$s))jd6rxz0TWb%#E;=?%7;o4lMuZ#hY{ohz
z_(LnQ761m%)M*w;{)hmF+Vp_=)A$~DF1&n>V^)KgMq@`3*g`O$=1gpCEP78FjkQ{z
z@$Jc|hx@1o43&=$jlCTGJRCL%Q+ZYuI{eOuKXs{6(gPb{k#R>ZcUwJYNB`Bz<O?8q
z0KG1Y+F9J~rZ0WIVt@!_;L>&B2$x!V=#Q!`WU-uuC;zzlXE=|=g;T4V;ucF;dWIA2
zoExj>MXTt0KOfdf#|Eg%#&mGL8)YL5-N^$!MNlt&trDMW`5z5|P-)O38<N?N%Xn{|
zhK@C_^2$}%A{5}@7P0&ha9wlG1B^?ic}3DM`GCdCRn_4shmm(hhnnSvSzJCU>!r6T
z*0CMvZzW|BSR(^FP0+s<l50ntmm5ro@ZWvdnwTvVRYa9C_h7z)pN}s)7iq&mkbU~?
zajUBrJ^#ZiPMcOIz3`9zm`OW!TsWxiOvlNIMSWpar<umasTEIz#R93{6HeGAC4?qX
z<|48nZDgOCT$xHubR?j6-x|VIjVL;XM0FURciFEV@<c--b|%Z7KuvC|XBH95lU^@8
z@bOSRaHp-4cGznD#aL)s9yg$Yn~owmzA+K=0z&>JX~_ka?gUZtEj>TC9)5@lc%v?z
z^f3DB=h7$p?C*q4ZmF4_u$U8o50_yVugS^|7CxEFX*U(w)pQCPezd71nwQj-74YhJ
z7^PU!$Fl5?_|PWK!}zF>*~`YVWAXOl*!32cb6&+k>GmkTmn{AmRZj0Mp2*^Ym)C0x
z_P&ZsLf}pY?aZl^q1@FitH?n}?(P@;`khkeuQLXPFs58MptLF$%m3a@SQVeUx%P>S
zUFZGLz|1UFFRt`}$hshsUpGH6ytdB!7}~}S>=;vc>wSZu-z+<3;2k+7N}j!L>S_=+
z#5Q8xkYQGSKfnoTlrPd+1LjSm#`ZZ3Mye!<=qe?WIX};ns(}Pbk4^1L@xwVJ!YCW?
ziUh_*O+|p*<$V-VtpbML!}EO#cy&bg$2#M~spCH12{_#v`}s*^ah>0glkMZETU`yD
zvw}iG25-)>UJrB{;?A_>;*mlcYpo@K^m3t*jyr9pOx&V#x0iX_!?H5(*xKfuxv~|y
zw?65$qg*xz_Q6o#MC&fZnoY-Iq7Jle*a8a_v<L%zDq5S4or4es_VL~+^+YMRO2q>+
zuhVp^d!2gi%lMLg8Sm*i0gj@l$<e}y4XIw&@4|r=8RDj+Kza@j(TN0cdkse2E?tW3
z+mV%YJ;1W)?NS|l`E9B{R%9?!MT+4IW6^A7ZZ`+5`GEKL`U8_;;L&j2z*?D`H*c=a
z2|OaSzFwQE@m0w6UVvFX#^|nuGPP!Tpw>Ir1AyOMf00X<RH?}#X5kE4G)f$<-)iKl
z=?QKER3)^~g~&{*4&=jZO{SiL^k}*ozYqym%d&fas-Z8Zs}{AItd0}91G5`*9pXKb
zBXetm5U}Z<1Vf9P6DQH-F0Grby?ncEZkC+4^1!MMDtgTb#4>n%rh^ZlWPD=pR;Fd(
zjH71}3r!kgHT_a@sbA%_#HCm3eG!&Gy^c&A7uPt))wOg`Vy0bj9p=>Wdu4@@g+%~{
zEi_>qij7P0vmo313-B(+N)D&xH#awbN{AN)BB)E^oFt$!j0c3WAG~MZ*5K+~v1;TK
z5z($qOG=#UaBV$I^_|#dxc~cCJy7SZ9o|yAOA`<9M)`l-iVZ(`)%@IV*e`&@&-*kT
zQZ94btA{fb@Y3EI7Ci0}AJFYo+Cjdr9cPm|hnZOjIzhWp`zttvk&l=6@$OXr!JA3U
z%u)o`BeO5gw|Bkjc_<X^9q|WOSJm(P`Q6l~ptv4x2@TbB0*=j3@rxHPiUO)e(a(vb
z8~pOa#)urtKQj#24~fePM8sWIg~0Oqv%B)wB!ki7?qUL)Bj*<uc)C^oY_I?A8C$<R
zWUyb<O-10}P@+%sCVDj&)AmLW-XCx0Zmo`XvHA0F|2vo{8G9=c3lCL)t(nibEwL@O
z=jAPBM1|g8o7ViZ@BOc={gx^BlVCL6C;jZbeR5OTf)t7~)^1?>+h4xMJ>eVl;#`NP
zlf|7+R;33LwXksATkke0J=1i5`(~6K)p3rLvuB(6BFlxM?PT{WORi*I5k3l!|F21w
z7OSe#LYa0)J)ULTcD;4jr4GGxdZ6(GoVKa%&mq;nu|KLTr?w^>qNFp*ys8X_$SxZd
zn6kW^F@O6Sw=X@lpR>`542oTpspT%DN+6>lt3my5;)+3w;!%7r(epRYEEwv1Tcw63
z3ou?`=B+1*rNbNQRsZ&@br{uz(;W%I>|$z5DDH~VuZ(rDGuJo^cx~tjE)@6cf4ueo
z!8rvvT#K@KiPo&X7k}A1@8LU<$l`{dWmj8Sq1&|0$Nuu`&T8CRG|;{;l~TfD5k=y&
z4d+jwV7MzZ>o=+U&0S>vwz(7bK_V<EAnsy&UrYl_>w-O7@usDS*qw$E<E{ltH_zX0
z0(FgQ!kLcgW)9wTB~x=4DB`r=FO=7FbAoMR4=(4`YwO^LZs>4%nb1F_8~?*~m^d|6
zS&&^<!Lhk?cXay;Vb^-No3bRe?nc}-WkJlC#6_8Xx1or168^Frr`Ur;I8vl8BOK-V
zPe2_IVJu>-;NvSCpW0(M$WQp}z<djB%V$r?I{u~0aFE0GC{f@@R5&PZr7OyKpi*Q5
zl({({?a%75ZaOpNBZ-n)e>+yksY@R^8!5G9ts$)Ek!lhPjlrwqiD8MW?rT6K=<667
zdmtsme<1_xsx_|dGWqE*du8nv<iM07#c8zqqjhyI>F&1mkK=M4t1qL8J){p*8QmMx
z&*%KqE}ZU3kUSz3{r7qwqry@RNyyqO)PZX`qVFxdZ%N<~fTMA)>;*JWQ3+u&rZDCh
z--QOBY+d=kQqL9zqlm%i2CGL}oIq0em0vC4OTmzjnNIqugF4*W&@taqPCW_qE;@%P
zlTX(%K}<S)Tm4TD;eVlj_Cf3yQyxAnk-GT+%b^o<qA_+u_xC$%IlsMX_MRG$(0LC2
z&s`aeEEoA#hI2o7TIAclGVE7AO4#_{f4R;)h@CCP<0Qsz_jc7Hj45;|)$QfcXA}6p
z&xPues?%D!&i$!|^S`F!tOjrb*&ZAI?am*kR%8OY3FosD|8k&#VaoutwaTD-puasT
zs&$V5&fNbD^XPT@pVj=Iv-w{u^S_^z|5sh16uD0{|J4HcALDeSA^o3Q|3A0>|0B2l
zUpKv)zr=s{oHumw`Sx6HI$@R2YO#QLf7BHSQe`}KIxG2?1(n7`2v<N1gG$ox^*5g~
zGx@}d@_?=@w}Bdf=IV6&LK$b`sVt3&t#=n)-PZacePGF4tyng;<e3`z4;w@5+dB(<
zKAVJ=`1qh=@@8N5>>q(GhfdK?pi%YeRaqw4xDVIIMS;d-;Q6-0B)h+liU3eX)G`0=
z&3{@OKubQ*(djP^aO+9V^4WmR)c_JnHPIXjUh^BR2w@;+XGWirQ*}{Bh*R--QxQ4m
zVKRj=WfaJ0Z@=eK2^d-8ls(c*^#eH1{VYhig3c9^PTV0>)9#T<OkQ3SyYx;S`x0Ab
zV-o-^%N;ihqM{k0>k!*p72baK%h(66K$@Lcn{WWcTBm*;c*IBMY6D`vS6Tp!)=7RL
zuh&O8j@Ehr)BNOdH_bJ$WX=QU`)|!;18<WTM}-3qa1V2IcE7XlJJlZW6rZ`wYc=lO
z(>8f5Xr1m1oBaJZX97SkUk;vBz(J0b0x1vxh};WGXzhy0H)q-IzhzDV<>%k(s!e~s
zr$09~=?$)O#04mOjrqa*CsVt#nj?0+=L7R>tU;py4B^4^=U?KkTbQBnvh7OtovB(0
z>BdEI{-<{dwOI#QNa>zZlRl(D)_sS0ttO{hirBl5$k}b6YS1+g`iyd0p18ejMU3A)
zOHUsQwC0&59IDy^UH6(_hp}v|B_~UFk?hx|MN8)qeFnVJKub)=>#ymUBz6^CerN6N
zEI5^JkZQ9H^9_azI!}5MAU{yF0EZwpJ-|ZHcay&fK-m#?7VKL*09^UqyLac2uB%gm
z+bg;08+&^2idj=fJ3c`{!B0z2jI@^Aty{p^E#mc97~`&RB}m{=+}_WAKXvOb5Ypq1
zj*ezzXXicauC<V(JXmdm%7d0UjR&A@0i@(A!Ps(P2F3-*=<Pug<xBjfb9K_Y(;i&N
z2b79~tIRVE1@egtV|p5)%%YzLO8wLNP{#2R*;=hYb1wH29>q2-aS4?&BNOZ9H^kiZ
zeRJ6Mhp(fI4}`YYG@8$P!0dPVjBkbZ?2TdJRRsVZb2{ldP=iL8V2TDv*F5Sijf$f)
zH4ggFYts=?)9sE})TgvCA7%B*UvGvPjmz>}T8`>rHgybe^yMaac42RURgXDMdLMr>
z!cju}rq>u%$iyOmAtlT~eVR(0Y9$v~X#p+eKB)GXZ|A6b!sw<9P?H-iJ67`fZZRAP
z^+W;X-17Ch%xD$sS$jyyW8&*%00nEfpxeF-%Gdk)vfGE^wDY;LQG+W`Q^n|DYX?Qs
zU8QR|RO*3B%sqFQ@Qqa5iwb8`xvl>G3fwrSLE_h_SC&oKwCDD`^~&$;?zL@YoyIPp
zHI?;ud$sn7a%8Oq{Ym8wcNvd7+IO{-X?wfzj7)aQrslG)_|N@}mrbN<N)GEKPG!F=
z^J98_$x6_oef`E=@={4kYUT44MsNGJ$DnrY!@B=i<4bS!#*-5Lyq80xzGPSVoSlvN
zmJlxOm=7N=XI2utV7t0G{thRh@bsD40ga}%L^NUabS(Rhfh3kR|2$W1zj~WK%c=JG
zxy`LTw^5GyoR0gNn%xa!qa%oZtQk(>QLf)dn!#d8bf3fOe({-Goh;%zcVMuuUf0fE
zQS3eAjv}j2zKmS|GhzrZfv#_l*}t8Rq9vl9A`@R7g6kFoI%d|^S<}=TfRjGeoLeae
z(6r=*W{0afwIDxRY;$Y+w7-XN`G4anf%NKs9Rncp+3iM(Fl%q(ZgvfY0|3>n9WOqY
zaN*jx^QktZgj51FjVO4KL-!GxSRSdgQbv%4wC!o9^-z_=-sGaQcKl}pBju?fpiw53
zJ?oRnshADWSPQ7O=~|?com`I8aQN>c1|=AHso7sp0HBBU8Aqn!IMNVFf_PlW+QiC-
z^2X-Hp>)%+H$F~>%D~ZdF<v#B$KlLmd2}T0Qmt-syV;N;R}M`}MAkg3WE3dP<Xa*o
z@hnHppV>@Ja)4xnTL+pvbRQ07K!&jcR=nD%7C}4Mu2_9oAl;^%{zSekYMK)c)@^45
zX$@Yn+a+^!&n@kSKk_Hf+Si9PWxbmuU`_Ff+xRjc7`CW9Ht8mEshFhYUq-M?9`*p>
z-|u$35A*!WxO4;ntN1_=imG%N!mxgWv3q$fJxdtqPxua!RO>5f3GlbPu{I<A_<H8J
zA6`+{|6@b`(#&gR+}-xe*oQ*1xd~e!Kuyf}E|I|@nKN+lf|4$wYPbiZh49_*0SX<G
z$uh9V;|``kV@oB=_VYx)P6~trbIa)fVHtB+f?-g0h8Mt2+gp)~!Ez^P8&-#4ZwivO
zk&yJ^8~_WRoC}+qEHY8WODnCd15_?wk|xQbb8aXf%7gC*Nj|AH-Nz+nr^P2dEKE!F
zc_Wk$h3`%t!z^wtKMgjFPBT2_yS*uVR}`;knA`>DwHXF#m<@tQaeJeJsUP>t(keMv
zp2a-(t2Q6d*q1|!qfz9?sdDyMaQ{BmQzBplb1Z9^gs}(~-W@<{3aRFk^+0xA16u1&
zlU!N|Kf9&1{2l$<Dpvfz_qHvYVs#ZEh8r#Abg%YHo+Yxj8GgOb<RICNw^Fy?UGVJH
zRVb?kIaXF=>+>GA<BfzjW+W)3N&3E-YL3+qH`W?M9<w5`?99&qSOX9}J2`G-m=m4f
zBU)$*Yo)G*E{QAH%)3|dxr3asW)-E=5>@jiLeKLIfWDLL2}wGmwerTdjWz^LJ+XNc
z06T$UsMq&YV4-N2LvoG|<)@jliP9sfnr1G)EMxFKg<*&DO9N*qmZ&IavAS``U)Qt`
z3lymg3f19mDKHg_YlR1H!HLDI>JjW>FbGPs9BYpv4WJ;B3R?3xihF|y+IIQl@zudh
zhU6IlxgN_bif<Zw<?oZ`!@#va9zQe*uy$hKdyVnH<ZR*%^~mdUlAc-*8Mvgs`@Q$!
z+YdUzYmifak%*R?*57sfSfQpyl-I4OR3uG{l6NsR-L>iFxaWXs`@%LSWURQ>B3W)1
z(3bzO&EVl*cc$%1B2e7SCG{Z5Fp#A3BLjo*tHplfzNAse6C;o3A<~lr(nB2<pxgTR
zp&URu?G~yC116J!;?{x|OS+t!dbqB==q!wvNqZDPA-TXd{k?Ll7O8yTj&^Y40H70N
zm78T+fq7N`q6HC=>|;3&RJLsrP{C&d;bjV&>silUuL3``k@0d6MlOwJB%7a3K&}Bj
zHrR%CyztUwi*|$dH`u~zn}u;~?x*1^om&1VuR^sDGK2%qIxh66{i<|K(#l>NdSJ{&
z%Ga2t_1|Rdf6j<TNz#0fOO{NpGS={)c;Ww~MDN!fpMyXcngu8;yE2PAs?;0BgNn?W
z^FEPSkyLTNe*G$K;MemV^^j_pZwR7W^z>gI?ygj?DX&2p<v$w$0SIO9q6S8e)Nw^)
z+SkSJhoslKv$aZn+KVCmv|Irq^OHi9Ok(<i$n$}crzff)Fn(l`hrL+4?@-YoQ~;)p
z?aTqx_|FZ5zJ2=>@nj6M+j8bNAanbuH+(oehgmd9&i(1G<7LU$pzO13MKrJaluKwH
zi3SxwHphUn=AmQ5v13-duUn;v9~$+fG1g_g$bh#&K{EpsZ@3Shs`A^Y_8~v-7mGYf
zWvvNJ)t1r@?!*gZf_9O^{8r*W0d!9C(7k6??N;~`nMD9Z*IYn1wbV35I?ymqKP9`S
z?~Dol#Zw>0{ctRG5&9A%<Dv+j<ei@$f&N%lng8X>r)eA?ubD4Hn>NF_m%$u?S~0@L
zV!28jWr+_8Akqq2eJF*K2_W1nR4bE${iH~zXQWMLHSqE`WNa5g7N&u=qlz>CD>3>H
z!Ix{=3#+ngGpsj$pE-4i0piEW3@v6<Fu#x>YZsbq3@<*C3S0ez9dWt;mLiOJa<LAS
z8YcuYD7I1%zO_<9X}i1j%#Iy^V9WK&`fa^cODmRm_Uzdrq@298k<yFHz_zx6`XSyY
zT|?i!$FlW|;ZEx~ZIWus6SuLXpv1Y!V4z!L*szyTb{}e>iO`B5CcHM<4q-URtYMEK
zIyhozNgv8Byz;D)qcxJ}QsvLGDNA@Hv~ByP)p)@H7Cn1Q(?87VzY$na3eOWR!B$o)
zNSp<utd|)0%^40y8HHX?r~U<4e@RuhJiKDCQl|HFt0`ulWvv>(1VEOtfWGYNk8j26
zrNH&Rdf+>I8=WS<^}zIf|0z0+yHoK1Eb?b-Urdv_Ngjp^P{te``z)k4)7h)X)`PJ0
zFSL}9mA#*2t2LLS1Dm!fV_q*yqDiW(shWWaKGTgwV-NdvZqqZ*n*)4*&0b|B)^0OR
zX&}M0pRTBO%moa?@6^a*&%Qurr<Vi$DB^`cx5Pbw-n-z^b+)w;avd3`1O#z_Rz4#p
z4g)uk{1hA<d`~noMcyC1r~oDty&za3!&!@Yyd`tMO=Bl}qlqIoKm1thm6;D3sh@)^
zsy|#kbm(82n3nGs(z4^R_TrMzc4>tg3p^WEZ5Q9R26Xrsq`~-X_~<)18R{MHA99<%
zl528)ak#*M>AYmOrs#{^?UC(<{Jf9LKr5b>P_BS(6+uCkb_qP614wTPx2X~b^fNz<
zET#%?l7NWj;A#IxV-Qi+B5+dl5E(UUqmm}^5IInA?T1!Eta?OpDBVe)Yp?OtX9F=q
zwK7WnA+M&SQH5sPVOi&X_J8))nP(kTW|LB=^dceJ$nzg7WBu)jLR%BO8x~(C8+3m{
z9Z_2OE8*-?!%G@8*mAuZKRNs()|;zmDWftHk?FELg(l^(u1rYHA1zYW>&aH(SM|{t
z%K+~e-T^Zl9M)uLdeRI`npDs^{b7dvk8~~W7pfhMPo^C@e8xB<v1YG@#PG<(*OLtq
zHxajt;``dZ-9BL%&0?{bTMp7<vouDf0o`ox9G3A7fA-ynZ4ZWU`qatB>v(y@>8hj(
z;)|A`__c~L31j-7%tD6u69Uj}VkHo^^NxD8Y1+vFqL%^e%_;r#HcbvvwRw(iIuC47
zXw=<JYi?(PVo+v#0bIVMTg93Hv@mBOOaQj{9Vc#H0SG`vuU9|nb;UWo=ZuFOW)5yH
z<Q?0Lc$oA6sN*NDuF(3FP;}thJvo8THXU+wQpJSwfEI#uRbaIE`Wzn+#6bf0<@L~(
zeIoE{my01gMdpXt*8FP#5&afvbcm9dT^<6&Atx+23RqCbc7S#Q*{`vY1xbWz0FWj5
zwg~c5y5jTaq4q5=fkZ&mfe;|B`T5z8DS+M*50ESK2G|s>zl?NOX77t7pFKi*;#d$n
zPhHy(`^pD@h5Jm@rYjT~18f`SW17nkvCYwI0G{wk%KU8*({(i9&ettL(aO=!TwEYH
zAik7vYjCf6LWmsJ#(S@^4AMZjyuYAEJWUnQ=DXx_O`^#_@(h-CULH1X9LUe4z3-4f
zku_X?-2UkyZk?E?Uyt*&-yG>_E)utDfVi%DSNTB&0H?$rfs=WfUa(^m;V@hV?(`x%
z^uxYtNzt3oxJ9f3-bt&QQWa}%0Oj1-v+)f4x@EqBy|TT#R@8f-7rjDCtIKMhq|jC0
zwZd{jW@PR#jb)XWull^b$|*g&!|=Fca0P-8ulcFP(1r|8Q>sivH-S{Ww(RX_o7>;Z
z9%cF*t^tV&yrSm8*}F7y_J+m$n_d;h)14IUX*(`_9c*4<j=b0-@f(w2fV6(sd#@Y7
z`GIc)z8@6Ra4<ALYt6JJ@(|%Ki`5e=_W?KGR+61Iakm#)`tc*TXr97DPQQ;~`k({H
z0c?cdPV=RFy^QL_bcIa}!M9zTi#;zf)@V`>;k)-)!+I{JI7@r3o6}NBmUpm-XwE^3
zi@x^e-7u+Fn%G4Sekh#JT9V$GC<uU(u_zd|6e!0>8rebQC=#`T8yXE5N~+V=439Uh
zwwC*d!(-{fJCo$hm#WIqslh%BeG10qj^^k}v{%N!nv(Ta$yc3m(~W)H!B|!IX0|ef
ztNu;ot;oJJwo<13_k}(dLME>~pea4*rK&lqMhQIP6=L>+(6d86Wyx5sGT{QFj1Qx7
z0<0JHeEpGx@B<}J?K@?Bkzq_>TAMNDF!9b{T83tCIB5__OaLjJ=Seb|<R&He>-x{E
z=);m8u%3Dlp*H$xb$cyFMaUrZlHfBIGcs8TsY0p`iM-!E#4E_iX5TTUP4du5krh0E
zp`Thk`;-lc8t5dmc1{DhJd@PR?F#+5R<1r5?W~brPMu@8B=5LO+Ds)nnfWyug+5LI
zX`fFJVNk|(^-}EKc4jwBUG6B%zyvptiF@;EqTuYwkbm~>{#&31)N(+_6QsyO0;zun
zR{!_I9YC5<-iznRROG*o>@pG%AS`z6W<6?<|N5&FW<Vv^jm7oPG3<ZuKrtPlllVWw
zJR+<C_VWMU)l_|J?3;;p;Bmf5Fu-1>4gT-e{qF_9L!ZT2Y<Xs9!vFwH137@EhzQZe
zU<<Sbf*Oh*lbk%Nk?!G_o1#>$4dX6de|$sD|L34TaD+X_!<qkf)?d6hRK^|U&piJ3
zgINO{;mvm2qvFVa|J;|uma%Y&D@XVb|Jk%9K<d-u|FU5^o&vn|=H}Sk5!>5Gq8PY+
zfveP>))}wQ6E#N#G$KZ5aQOnt(=hSLM%|Y6-CrmF>tFv95F@CK`Bd{F+r-W(Yg(W^
z#l`H$pFa&fy>7u;ze*6Eia)N_Uel4PB^`Ox8xQ2`01GjcvNOf%^@gU`04HpGAf{5h
z2a1X5Xu)UFLceq_{tR-xNrk?7vrEG6_hUi*tI7&zB5oeJ#;k{u%RI_gW^M(=#a$X&
z9$?;fAzT^4De&Z;RWYA5FSC6IF4iR-3N4*Icf=IAbAf$opL04ksf&0)*Ak!{7`;c{
zO?O@S{lgv8oFCu6w^Jpz4&<0+{x-=<RXrWrCwoAlhg)vDdarbcp{mZI!Zo|6=T>9i
zP!+UTZW{1grf(jhNd`EdIxK+msS|kOa;+(qzW#RBgUp@oj{)#^;cWuqwekkzPW^>C
zrQQTdptcfu<0>F}9vS!RNMpWq8aRiYVZ(BU+=_~k)ysR27`eC*YBZOnkGvMD>NG$;
zEAwSp=LIUD3UKvCa)&@FK)EPpWoAz3U^YBLQ61RuH-{U(lETVI6>ve;W4_EgHIzx{
zL*r3yH*js<o=+i&0(PYMG>{hQSVURi*xIa)+C0EG0JX4lfEGD|y1#gw+bKMtak0>G
z)Z{O#e2nTU5BK5mV!d!#CLqRdlep<Rm7WQa@wc281>#o8qXg3qEz*-|5fU(9YrQ7}
z9ZH@-LjcXgOy1oV@zuiak1XKBC(v5uI60*~pfm0Q&xCQ%o3jfKC_WzT_BtuIz+?WK
z{%a{G{@Hx~$G8Rw0~XEu;(1kWH7bDZA9vGAy(ML+C)@hnZy(F_jxB9z$B~qb0K4%2
z*r0zjk=8OmrDKTrPJ)wK;sLjE&4=}+(faBgQf;y1Uyk_sC!OFiVD`(OR5376+n7=D
zcAw((;d=bp_`jI=*GfIt=e~ON+aerrga5iWz!YiEtJbwrUAXYeVkvs*h`)X;XpyHb
z4Lvj|CqZ}AC=SPX${CpV@%<NHaCOY5=zi;7-?%7bSn@F~9yrwoz<(@mM{eEJ<De*Z
z1=o}BU$9WWIqTC!kFzcoYe9$$oZclb1P_0<LI71W9^bQ3T}Rq2PP!Y!PBqyio)<6N
zf&k`6GR?Su`M1BUV$<AVYJZ2VZtKEwscIPWL%y2FDPs!)=^Zim!V)xHT}u(gcf9^_
zxBoL3)&7fsz1&D+^$J&2rGNG6RTB^c@m{@ZR@?cj7$=7Ft!4kY+17rfCD}g@!0Q-n
zih@+nUA%6JEo)1;c~9Q6+C2T9Dbl@}oxjfcNXJei=zODyE3lbC;q;fp%<k{3FGa7s
zpFMum@oC~eOu_Lp#5_H6QGuDOJ^}3b*~OXq(Ie+@_(^F%hCKNpCvW|qPwl_YbWj~L
zAXq-w8B%qmwL6@W1JKP~I$81lo4>jcL5E!hO41p;LV(uC+DWpvdqa+Hv@nr&=$usN
zMI3dh|Ft~Nc>(9-n)H>wt-vv=|2_&w9hraq+zSoh<S9MNyl~`Warn{yM-6l9&cw*)
z%otaIKwn8#=VGlqegzs@_qs=b@XWyAO%X9dS;GCqt$%{dHj$}#h5}xlIe%#9V(YTC
zu7*kP3m+EaPugViN=q2VbXdkXm9zJdKH9`nF<!VbSo?0MgcQCg=h<Pfm_yga$no{S
z{j#blW32V=FX68r)d{Ow8GaQJSF4;dErO~m2o0;-8>JhkbNPNfFO3U79lM~VKHSI9
z8@nbD*;>oiKUZ#CrvIp!iCqL5$=mX-Rz}M?O_9;GJX)hXK#uR8r+A96f^rIXvxzen
zQv1{ZN#StZAVesSR6aQ=l)gLjmVLakt2CrZf{E91g)xC3SE#CluSW&Ov<}x=*MEAJ
zRp)_8VcesvSPv=Lhu%#P5{OTm6Lfi)q)<2`)WhbVGKSXbSj1n;*k0B8YT~ipnmULD
zb#N+Q|8+0)f%}h^BF7+!f3UPc4q|mcTfu3D55K%EC%(UXRC+MMBj?Pm?>f^Vy7J>0
zMmJ@u6)~{OlG!N2=ghzT=}_pQc4mJw9zm9(*L=x53t%dAl!~W%g1BD!dTk%yc3U{D
zwfQm<l+a*uUP3qr%_7$PO(jxOjCkN!TNCx_^;FC9jhtf5I6^HYb5nBaD_wUb?0ByK
zm5r;JuC1j3m<@T7hyu5%XG)wz_G)umE>aH8Vw>0~4UZbPoX;3HO3p^{dRfP@@7rYW
zNx?p*4Ftq{)OGbe-uGLR8Y-WVM7R9NlALz&VW{rX@F|Y(@(Bqv6=i#aa~OK~L%`>L
z_JPt<Fy}1LY;QYKx?#{Kg4Z&?o3&;%&J9W^XQ`Z{Ock3va@=|Hrbk&EwqYob^UB>%
zGg?qmZ5i{3?5Q+L9GkTw8L!!FhDY)t&F<OB`=<rubM&ahsf~*!46-F_Q3e`K%+vh-
zX|36Th+mpk(fZ9S$8n~(ROv~#A&h--&$;BWUOh*6j~Sp;keU#ih^Bt&YVLX2*;%h4
zIOtqzOtfRr&GDt!*DCz;8(v&W!r~ag#3k$)^77OaM-!5CuZVjWJn_~0o6<A+YDhNg
z2T^B#^L&|kxajP{7{jsZt`H3w-D|YRF}xe0VjSyxg~JLit)IB~WJl0m^%-loB#HuE
zUNH9tm<0s<zAfi973JXLmUqeSdFGTTbGmw~{g1KP`dOkYvi3rJx-iRu!jrA#e=uoN
zhKD$ejb=&5a%wV3h1V&<-%>2!!(OzTL1q6c9!rX0@l|RM^uyd}c`y|1&3>?Pg>~rz
zi!Fcgn1#u{o#z-ZqsP^{o=b9Y1cFIdhvL;$O{^D)X}1dGe5K$mzWRn{ca6E)v#|H;
zVAQEjBZk3^=1Xg7Fb2*!&nHGwfU%f<xb=&BKL-*M*fQg3EMGmZF+>jNPuKUJ`-TY&
z%wsKP>DZqspD3U@8!0L@u)!r_?_-hZUG2N1oj-<)O!Y7k7@JiyzvgApNN91>ke|->
zP>K7euBX=GL3NRrti_$wV`*p%Rmqul=(akC=9nLZF&!d6?|Cd2xc{<X+atBj^2=kc
zAwbrWP(@JDYGr;{I&r^(5KcGP5g$=`#Tnh+ilBMvywdgblQK46&-$$y_`{I2%mRnX
zSlNdZZOyI#MV{`$?7+>nYWKO8<S3a)D{g6tk(=UAJTR0vkinq@z+${RpLlQkP!W=t
zz1Hly9%;GmxSDWX^w;Y!v$^hwK%Yzo8L^poB+vF$4l)Nt{As!IPRF8-s|EovFMckr
zUL`>MUNSaHk%n%Yl0es2UD}DNT<!v?y!*nM0wPNEHulwC#4LKvUy6~joEPc%CqKdU
z0}wN?lj~TEc7ZSz9%t29wD=XAr+3`DX4h)EZBWtsTh`pev%Frmj)|1*JGiyJ+Co0r
z1!Xs^t;<Gj<AT*qNV5gDxh<Ur(g6vheR}h)>+5=(X9J<k+564dR6hG^whjn*cg9h%
zHk2p=wqpOP|2`<MtjL)>tB=;aTMcd1_RVBi<Ck3yRZUb_V%}&jxO9n`|EY<d?Dn9(
z{{dKc>6)6q**5Owt0_$4Lq}?d(;YsmvbMqh`?G8<eCT1%yGUHNJhk{>5bBA~0ZB^U
zu!q2C&n^rkbk6u^cNQu6tbf?&n6fUG!%MS6Rf1YwH)@;g)xspGJ`a@gdN~jKo=sEq
z)z?Ya>T>BlV`SxfC%zoADY(5^OAov{B2vHCH0NG=FP>*emltO-5Yw`~FZM3Ny=K#;
zdt1v@dqIs4q|vwGA@90Vz4v*ujMuVSL@I11R$|znZF02_(}&sbDzcBKn`$qV8zv>f
zK*j{rmzL?^gJ#R&T<f44?JDVa<r8TZkPIMZ)&OFX`iQd7w+}%{Mho@?%Ycf<koKf&
zUwOW+Hr1OGrjsd>rU$Ei*`si1^Odh)sMZ&YDyta{mV@0+k!5#FgUFqq%blD`pDY#b
zCet`{IQOpVl14>yJxNimEaIAX9a6p<7V=lPTJHL4%6aK@q$}r_pA8FTX8P`y&_Qv#
zyDRg}=5#-qhoPNovLMuWt(THEf_v1lIFvu`W%yc?k@3Q>K6}{(k?mLHT5p!3Jq13G
zieXDB-HgHBA+b(zTWq7W(<K5ssOZyFnD|m@4Jaci1NjmyB$#Z*vvg2f%}P{jkCKjA
z@p_gFja&H#o5UT3rXD#E2g$XDbY0~>*!LYVd>iJr&z0C0_~QNBQwT|D5%m=@voF`5
zJ{{P%su?;?J7mHwA#&Hz?!2(zaR2u%<6yK)S4MZKMZv2ObNZHwJF`-5Ar8X<e9LS1
zYE4Sl($NyuOJZ^^Bg#K7b6gbCvM8__=u6G)w^KRuGa;pqsz^AbA1y4YV__M?trZ|w
zkWR+sri{4YND1ub=!LlTbc|X@3YK9cZ(MX_=$6h-na~`Xo0u{l*|a52zFhCQRg-C_
zKZnnWQ>#ITd)2CNrw3G7mSaSVEw8D+4DMzbaRe8>ctuV7AU1RWg1{C(y03Yu<yu6`
zbU9JFeG*6%HNB0_Z1)l0<l-F{w_HR7&fHDN=eFVU)5Z@-c2oxhA*I%<n@XA5s@FLO
z_dnjI`1Zz5J>Y_p`I<I2$B>pqhK;*f>YXfvVwX(9giP4fw|rq?zRQ~iPHnyhSpim)
zhGdZx;pB17jPwCN?=NwcL{D^^?3V&!RplaiddJQ>-_>=kO&q{q1fpzGWol(~JUdeW
z`ObZ$R5rOTI;Qv)6dl7M?;f*Ke}bc(J1_Q`T`deqPKH#Y57-mNE$6NY?3+N1b0BpV
z1A%$w7Ct&JUydAfsm%u{5wBsNUK9Pub@erDK&nclf0g;&b&ET6y=4cRSa8rkh2uf&
zhsBsiMcB#t{JPjkr6@>GRu&raMA|T!@7@#Xhouf+p1aAc3R`3ePphzZO``QnWu0hL
z)cn+Zf0oZuS>HQ}&0V#8n3-IJ@a3gj<Eh$K(>V(8Zd0!~X6m$q;5A?4<JM9|DxPTx
z`H{x)H@MoyFdo_@B?Z*xNE^J=ryj#)JJ=6iL#+AX<r`dDg>D|&{YS)apOlw!+-71p
zl2UpgtUHtA3fpB92AJG*bX9<Rw$LZ#G+wF9F733FP^G#0X@W}f^ZQ1dJ`E$g{nhCx
zTJNxi+>T05$DU4%wp7nBq@@}jgor#)_+lBbKq(+};{;@!qPVy!wdTX0<HhP03HT;w
zF9Ga<D5^?j{`_TQ4%AR_Ejd75ZQx7FC!!SbYa19JR@tNBFscp=Pp}4Tug~?*Z5I9&
z?k~TrV^ArS_RZJF#dx<J2NE+ksL(Ke2OR7sz(~sxH?5v&lC#s>A3oC-ZdT6%M>r`t
zvV6c%az42l6CcB;ZN;|1$xMoKD5V{dUZvB}so?Z;E$DVL>RQF>uMJ6^Kk$pthW(=U
zDf22h%JDuYX)ZK<TYu4&YaCA3MYb`7@Y-?DJ2hK!`UYi$SV}5T>(K%<j&17S2um_1
z-?9_gUZY*wooLZ$Pq<}ZEw>3BLt<HplTAn_B%2abQDEj>P!T`RuM4jG-(BP~MV;6$
zc)=4&^u@VrFvpfFc_{654%V+*3<`JY8NoRPyd1LJ3Q(Q+?_3FXttZmsJx*B07}3|n
zPbiYLGJLJr`+PQH>2r%kbqjY!_Bu{cD(8rS^?6?bG*Ek7;ns78cl`;m`%dGWawY5b
za(g{qbHtVc7Vzg7yIA+B5)E_+t}Db_?VodP&LAKmQ%pt0dg;El;#Dm~;SFCq{7#EO
z0^}s^DQne_Ca?D-KHKxvE}l&e!rw|pD#2+3u|0}h&jY>fOmQE*EsRVXHs5q_Pep$=
zrV5ix;ED=iYplQ=poS8|f`JG3p1;GRnvy5wFVRkcsZXSxdP?4&nb#XuEH>rW9ENEz
zsmQs+*1I-B__#Qz?OU%!a&6`~;IV2igM+gHc|PUJ7*dr|sZX|d^f#GXHzG&nmeslD
zeIf)pW2pL&Rc>?Ig;mgBesVRx7$}^p##K5=+9|M(bM22xN-pKOq!w`Ol(Iiw&F0)1
zS^F_#u#{G2{L<M=Z>8PI#kSOKXE!FReg2`Y{OW?HzN8<hrI7dw|9mw!MrNsnLHZNM
z->uJ~$K%?`mi^-C>|6!3P6peR=C3vYqFEzg_ebVLfy~Ygr?>xP5sp(A(NXgNk$)O}
z9wA(yTBUFCqfJ<HmR<(cv>dRkce%BbGqybubYT7)sD?`IWO$OF*gY=K_|<Jd2k_0k
zzAx1Vy7*!cpVXRrUq`IEew`l*7Z6GDwb_1x(QvHwB%_`CBKohV={h0_RZ70*PhZ(;
zl^GS9fC0^~k2JREv4c1i-?L4>o5p0(Ep0A{bDHzJe6zm3D2^7uZSS(fD4!@bd}1`Z
znFb!%FV7_l*SFUd+~mh(xG^R3<uUkG4T{iZ1yi(`6U!g{`jy*OSCE(=k?FIkJZ<O0
zKsSKHlF0olnS3sU&~<641@BA-wB$dhWxoj3wSg^Ys1+~W?|MmpaV(ubS0}a0_ibck
ztY`VHwGx>mo{8(ruDKG7`M|IZhMzAFuja@YwTL(FS52&w?c<sRYAr_59-Ccg6OLWV
z<5cNYtLdf8nKqPEo_?LH<;cg6W)P)w-2%&#R_0S}Ma1dSau_RKUTxg{j9BGt2b=%p
z(HS7{YVoXYlx=4mM~Iu<KrFUjWD|IL^XBm4<3=vISFZ>c2q-fA;c&SOccUl&(@1a2
zA5L~qPCVz7L2Z<?<h@Ix{8GCNh_m&(3#4HuarYkRbc1x|16b{jNu|%4I@es~`G1ts
zbB#OnU^l+77L-$q+51xbWo;4`#{>095<)`hin~*4j8k6&RmuHIUAp9p*BM!p2q!Tf
zfid2lu`GOVce3KigVc9=kPF4D=EH5^Yw;8n-_7HkHqi&i_managADK7IfV-~puR-^
z@w!ha^oMIGp?6K(^YiA|5A>(Bw?N;G7V!DG`=_a?UR|P^!)=n&y%GLiGF1;eWvT?H
z6gtt1)oUFJk|d}MTe}mKzt`E@8ZMV!c=4y$QxwkU_oO(t?Qd&h2DlSztA>w0V?i!A
z^wwsvEfjC7ANH24tbU!-;(BYKw{EBv)mo_pzI}4uCI+25x(BaX{T}7ULRARA?*mEf
z4!M=5sgyO<PHAL@f55XW=)a)4^zj(Yb=Bi^djG$Fo;h>8HTUY7Gc03#H1bSaK-*PW
z=j9TE#=br#uMwXUib||?bC)6nXkV#5O>}I?uaGe_A8>H&<3t%3$V|%otU91+_C3=Q
z`u^&4D#Q4zuK9SpBaXRZArKVV-aPo}tlQ2U%42@D9p8zeY$Y$aOXBhA3-OcvMgU8B
z#Hqi3ZaH+bx30iJ;mL^gnIw-l_eOy)g~?mn{Qr;fe+@V2qQwhIsO}cxgN&_xkYynL
zMZ2lz_4by;Qm+wDC8`tf0}UI~$Yi4aM*-?;#T0%0u{?K=Io1nr&$^IG@q-gZ3+_X2
zBZSY8Jsz2gAiGB*P3pAEsmruln3qQ05X&u#%P<Q;2lW#hRTHyFH&Vex)3Pq`?sS^{
z#jiic?iY;(z{+b}>Tmir7tXstSxq~&i3Q^5j(6i364!;HWi70ASZz=u>wWJ{sq6=G
z3OjKFV<DC!H^M4Q?y)g@G`0N0@&i*lap%R?q2ntOYy5D&WuS<$<w7LE+{#D&M8DOa
z%x`Sd`zS+`lETq7d>!&hs(fSk#+wk|t1`OiG8gNQY#m(V2MOWv&+G4a9G_gL8Z~Ig
zo%E&hWcTSd{4Q2=oHe~Vcf`DTpZAq^(zCAA;ls7P6rYOo@6}2|hHrX<bcb(FUS!L~
zj&%>dElG6io!n1YdH+rg+%0A^=y8u``PAojQtzkK!2C;@`yP=$g23LNMThlhzn=L&
zpQHcm(R+GluvHDy^(Q%XU)Ay-SHLhPzRfB{bw4w@=5I<~nuP~_R5e%qToOE#=52G<
zlVkeBeJ2csVSu3O&^huHX*Zh+4&gX=pY*-t{HO#$A-45r*W(2?)Agcf{RTlFT`u-&
zg?c(XT1&8Y=z7CP@ea9{*SA2Y-AOJG7BgBHyf*oJlAdT$Aq7snK3G%H<7hJP?t9(K
z<THzoPvblU&AGdx5PQwmuGEk0v+}+WW_sMJ0p+bFfwiswKiGS#sJMcyZ8x|>2q8f5
z2<`;ega9G9y95G_ySoGlu8n(e3pDNocXw#q-MWEBPG`&c&fXv6T>lsU9b?cJYt^cn
zHQ#qWvnuvMBk`&Ap<rNu&c-XirUw8U^Pp5!*`I=g8K>3CoA2I)zvj~sG6_QT`becS
zq%xha>O*J_+Q0a!SPNBXaJP&aa@z=4-8{_tpsO|ETi`wLfh21=S}PJnvErxw7#A9(
zm$tVU^Rd2-GzfPbIc0002I`Y;;z$W|D6TZNF_V;?tMR<rr?lP6Q)i4?@z%DPZ9SZ?
z_xNoM{BAX)SkhP}P6~89B%vr*8@<1xt>z~7UdwK%eI;<xB3ouuA+tm{TO>;>bU|ls
zUo~Z9B@t-_&4sSdVvT;<1An%%3m%OiG@kRGEz=M<QL%)zr7GxuzvG)&>sHGMX)uU!
zH*QQ4*Np)dQ!tX8A-S#&C*lka@fHgKi)PNTaTWjl0ct8dHowr+S}&IiVqzXXYE_?P
z_C7t!A^59RJrFzN6541{DJc>?j{~u4iWO~zV^(ebSzp;yF4#y)qpBpWq)aCN{1iP<
zvE3RmtN^d)7|Hl6jL~QCqpmWe9Lavz)E_NNxuW*$%K;XcUYtsJ%RCqA6)stsT9gPl
zDe8(o2m#zQ8X0tO=3AOM=KukR8J%4gJ8q?LrD8@WDF%uwqftu?9SSKaMOm3`&9%yN
zj->bJ&86u1O}?;fvH@YIdDqo_Ca)VJ>zi1foe?8+EuLm0cI}tS4#ArqPHKUsnJ!h|
z`A+oc8#X7#ANBhG><D@B@$^WN;jA;?GXUbTpH*Fr&Dwljys+FECFqyTS<pE=tjc`A
zLxLtt)uz2s0}ln*?M4d3{slv#XOY7LdPS)ZZp=aYO~|;Ba&%x27RrH7K-%zvX7Lw!
zF)(G@Yn37yp<fh4R*T`aCY_q|F%F}FF7ehiL384XZ!M0Xg)e6N@3m%`Q=)#nfBe+0
z!7i;Lqsc0e6yB^qlf`lWd*aw{t73i1MOY2Sme7B_&iT?>vm%XQp%tTuQQe?a<3&9v
z{%mW<w3O{m#*}XQ{*c_=r=er(*l>P5DbPoG@Gdw?bhpSsq27#KYyaT4TmM!_%b^x>
zIB68HQR};R4d(l%x{|B10p7XQrV#i-`qSZaKMcLzCLOk1&vOAshOuawe#0u2`;T4c
z-w}O`2!%N9D69grcd7sxw}AYkg9C^^e`3Pkv&KEbeMvE>V?Oe`hBd2SkzH#@VuuDk
zZ@k%6rrUs6TU+55*6%e~t^1je)Rn&`=WC?kh4J_t9~9e*LtAA2rouq`%=yb4e$O+H
zawTA#c9?n_UrxsCs1A?Fz_y>}{KK&k*Y!u_Sb?u7C{EWO1urM(&{+dk4}X|a>bR*P
zKU`QuD#<o7pLEH!F?(#2c2ndYDT|4DwPBC&@1itorKT*b05yBz?^_yq$q>=Jg=^WY
z28y@s_Ir0&4^wLaiH`kJR$v)0{ynb3AkXJJg}1`t^p!r&<F`5V+qBxb^cOZb)Ws`c
zG%#6Vuv68fkQ`g8A`Ra-tegS>nb-KddwYr412W_vW@kxX^88G$*3GMqdW;B~h)lGz
z_Q{0rLOA}Qs(U*Zk&w3Yssz!h57PI$Rsq)OOG5nB9|{Xy#wLF8<jxN~Yh_*-BYgpS
zdQrYqK(=H{@Qr=RTZxj^#iT)lc^U5uinFH4j>~1Sv3{hyH$oms&(>y8^UyVjCe3J}
zK~PVBozLuF1i6B#GdjnxPmesNlLX?~P$H3FJAXKP`{5IE>`H^%OW@E1Gk(dDNm!B;
z>>g~0Me*LyqzPg^3{NP(%>@ZII?27GXtpG7_Hyh1XtJE_{h9w(f748Tt{@euhU!~A
zn+hX)@xot<fVOaYCr#LXhl>8+X91A5wzlru`3%(G?)5BtL-HD+-&9HE<jgN{)tapz
zFy68sY}imCMcnpx&r*&P>4g@tw&7HS&~3#BfXZ2|bkSNKYK(P-QX3^8><2BQZ0o?h
zQ|zb@=AVEOjYkwi-j5FTXsD#=Hu}$nVb}pVeQsFTk+S5xyI$;_Q#TM}D;nYFf?bvi
zBqyGsA#OWjsD@W@E4yb&HS3H{QMySt?q-0Kf!VJ3bZ<)XEvs<}Nvl+4Jz8Mj3=IH3
z9FX(B(yzY@ftMYbY~eFMyLBGSB_^#nc`MJ#%(2;SOw{A}v$wUi8POJRj13TKQrRvr
z$i<mr-FWjVtYQmAh<0pZfySg_Cbzhp<ZWlm>Yn+VPYYt5F>S_?z?s~v9Q+48mJm$a
z14qG~=6W>yHZAFig<zV_mC4qQu&M=`Uq9z-zZr@we6ho8N!HTRijIk)_wR}%=64J^
zUrODmtUckjqZG;HQcWhL53s-RnaAXNI~DsqjGJk%!fQFd7;|cK`_KF!DL5v@*Am7r
z<g}!u9$b8A6b*_NLc^Ir{yvOtV%|Hapck5A)VoSTVx}gl?vXy6(apnL9BCZtVHzY~
z?P}Ac`2bRjOAK%#8deQ@$!2YzILMd!x`}y#ZMyuuG0*ZH>$~?y>MU-1-39Dc3-myp
zk;bRya+b7TcsO=fPmi<as2X7!ABkLc^&x9k?F2yJA3rxxN8n3!x~A$RF?Bxr9oJ)Q
zNk`MC>*lCbrd_}kE&^{0^ew>3$L31=XrU^`UEe1))Epia1^Ou6viKuyoR}NHQsr~2
zhB3Bnv+N7clbBw|GcWuu>~v1h^}JinT%9eicEL>-6kMgu94i}HzC)s>Yyox=;d&Z2
zLPe10EqqjhDfu1+xoo6*URh~O=))Rua3a1)PaZBak4C^R-0~u%Q2w8s{NK?Lo~d6d
zBcK9cdsw~S{{Ej=5v8@!i!6mHse_fs2XeJq0eZOg4$=1vc#)Q{A@8}VSKnMs*0Dir
zHWSHxkq^(2l65P!C|{Xcn13F*U9r7xnN3g}cps6w?cDMK^uRoygL4ll9e#u?QWlm?
zA8Iz+t|7X5cxW!ZtjK+Gs_q&gw$zOnQwFTs{zFG(*`W8mPrCp7dwK~C3FNim1af`}
zHr!h{!xPHY0W0YTmpwM427_mrGOevs;lXmLRiokr^H9UN4*hf`7h8cPPUz|i+D%b=
z{0e6dJ~C6^&=PnomrBzx&`*1>9_t$ew3zarev&A}H1jD+eXhvlf2M7=h!~&4@&GNl
z!Edf|T@-44@C0*>m|6w2tH0S5G-t_UxOR873%$pNhgZLBB7NMGLesEb0DLwdPj#Wl
z3!gprzB}_F<}`Wd@9%DxY(`*Yg#ToYD+>L)TKDw`Xh){|iyBaQIQfN_R$a5mK4||=
z+ZAPB^V&xSYnCUEJ5LVR?P4ZBJ&^wvVp;ka-@kvS;^waH?KwQ`Lh*XfP3V5e+#C5{
zGVT8}CH~(({rs5PR}V$KuiQ?aS`z;?pG2cD*mxI>rVc}%OmqM9*Tj8@*dw@`>Y31|
z_wE1Gke5l%0zg6%!~gf8|M6}9&mC!Etm@hvZV{sAqci!n`4Urvgc=@v6}h5y$XcYY
z$21gY%D7XC8OC(97t6R^*`J*LzLmZpJACPXOwab$2qe8Xc0L#j3kz&qGep_K<%L$3
z-8N{_3ELxNB<S+9t@r6kze>%&17}=ZVW9Q<wUd5*a&pA0H3Hf{Fy%q*gk-<{Qki;p
z7&YAT$g96QrJf?({9~lR3(q>o)M|Dcii%&*Q?`T|t$6zZZ~4<6y5&zJLu(5o_KhU%
zR?89<f1kP3U*8&m7i3@QuEZrUD&d7uIXVaHqRR7Pun4!3XYBlJWmGtwH92gCI&TRP
z`&_-~((@!C)6rpiZ95=&vIaMfPf1<`|ImI2{2SLB_0)g}>#@H+Z#8yI0y;bTF`NQ#
z=;ZmH(Ym<&kW03<OKtwomGZBJeCdMl5ZKbz=1=Amg%uwkPfg2%*Weati|?~bCP+uD
z7_)YIb+va^`Mb0Ay~6TXc!99IGV0Z;ai=Y~o{EgXZ=^sykI{IXr|H`##})6)<{B0>
z54;2ybW+EA^r4W8gHu8IOI<&LwfmxJp+*y~$kIFXzfJ^f(k6brT3$pHd?NDpa*B_4
z>t?n_b=VuoiOjR&PF}2pS2X(p7?vFT3K?KL=DOkJqmJ0LAhC%pA<4sY^exkU<a(Xp
z`{Simuu)3ooicJ{=G>ZF#%>d$ELRFig>1qW?`h8kowVE^sVEUV-jqj_Y?Ct-l;q;b
zd`3U;xHRRbLvf$F-F#{BHjXb$lg*D-ivIT~+B`-p4pDT*@Y^aY1TQF`a&p+Bk%`mD
zzf^Fa)Mz7aZ4qAIwXINZ{iYe4X|3Fwl>6hhlZJwa2Za>43O++2BVPzVUg#h1C=5q=
zxr^gRuysFg@@8yv)nIv4bD;O6*l&KWq`bHAzy_ZaN0-^%?M0?eKB@_=2#o&^AOlx}
zk0OlU#2B-hAS9zs)a~)e`wqeQl?%ABhL;8$HSREKr4HKY#DEI^_+eq)p8sAwyOj;E
zpH;~3<D^`my6fj&A}9Nv?B&stxF$*38n@7=!e?4NJYHthS1_Lp1tA(6Z@I1~&vroq
z$WKJ-jSu9=gn$7}$MuSL%;3gVU!35fe0R<E-sS6!>E6!z(!^l1srybWBLzqI+>bX{
zA^>V3&_Gr=+P!vGTdT-oNs}wd=x3KRb`}dCUD(D<59)W%+g2sG@c%i^6PoOOgeY}X
zVdkTgQjJE478}1_7??=q3EYxyueF&3_rA4m#t~y}n8-@)q-0X}cS8*n+)YFr(bG%1
z9E-cYIb2CN1BA?P1Caq+;uP5d><=Bizwh;><GCX}@A-O`oD*Z~E;At=8UT4#=~M%+
zr@p1_C-lqvFC7>iL#ex?i1v?TE+RTbs3u}!0d`w?L~j@v5Sf{o=MvNWM};3zhlhvz
z`ujUGNo&`t=O=G3m>mw)Fn322uACf{w8mL4g!N2}FNEwhf3%Tqiix1WcsnmW?e4XP
zpiT()P(vRtpW>c%2TdAfST?_hTgmj$aQyoNpc+mx_uzVa>0yECj&n`ZnDTA!$+M{F
zkI{Jdo3CG%`t*5<5ZOW?AKUBu>7*C(hOli)>4Hl#+r(W6naXGL*O^HXr2Rp?K5E7W
zYR5b!QYo4G>Xa-o6;4~6PsBhZ>Gr#b0#qQ@2@tVZ^xHS~^K;C2BXxE4B{$fM&ytc1
zAfxp3bauNtQys7AH#HCCLa-@8P9*8o>y@m8)R~dkgbpvO^8++aK#kGX#ZTHSsM_Z?
zA0LXx%2-aMX~#QM-BR=swVkcPVb>tdy6+ZN*1&}z57VR+KoDXJ^C}@p9&R>`I#f>`
ztEsO~C~g^%>!U}*V=0%E53m#h&55h1;F3Li{nVElJ3--fs9kCM(Tw1MMaGv>=FILk
zp;6yNI>Hc7+Z+B>;lLEB!5o1TNg@lUQM9yz`*{hYf0**@psxB9S8j2uIC~tYMh)Zl
z!78}lp{O*8EU!)*9&!3fCVK6m2PGlG)Z8qf1cda-OXeg&b8#+IX*@`#Dzen#L`7pd
zL|3w8Y-}mWE(T1@&{NjJ>T$)KzTefduidBG??PVIwf4sy8^d1gkAeIT*QO+{9}?`4
z>Kv_KgfsL|e1hGedIdaW_vBW+9t?*8()d~=LETlFG?$Q8&{tA+vk;!3KvRfTd__0#
z67y`tuKky(O|Ir(J}RKBfEk>5y8-XO?Y>}b4h_G=4yO>pluiWWQc?~A%J%Eb%=AVu
zr)aF&CEH{?%1d^DDX(inbAz2=2HdK9zz1h;P{j5=!-wf<1}_ifz(P*v)Na?Wc!%Of
zZhUD%LTjWvWElaS)9eE>%Bm<S2M1iUsKF^qi?y<)y9)YhIa79Lmq8!dwCQW^MR2zA
z=tPpjfjtt}-L&n}s7*(ANGmGzOt1IX=vvvfUOoS{q>`#JpTo38RUBpf$3lVF)6l3p
zeEivkwT7q0)XU9m8W`Qa^x*1yAml1ML;-lsHSc@vSHZ}lBG;c+o8Cp#Fo1g~nLbxA
zZPP{UN{JUaU<W*uR@uM7p)~toF|V>%d+K<8s*-9g{NSyOH8j*mvWJt`{nhHG)&BX+
z_OIHF#gDtAvC|KwDO$j#G;Yn{ry?DEqq}&hnpioB-6#;{L4L6w9GYC2NXPtHJShX`
zJv7PbC5&J|$ZYGp=NvC;$)%Qb_x@6ek_Rx9{yOv(KJujqMH<e9OLsDD@So1%=0MEj
zJ3*ZOBEryi7pVMacSUlFM}DL&;~-f3En2<dkq`mSFBVT0#bz`FT72}SyRLrJoockv
z3ZbAHZ7$A^6PO1XOOip`dzm_b%6f;YSz-AEazKqyw6>cbuK>17I-ylv((v@jyWIME
z1d0qfjk?2kg7y4J2QGy4!V7kNJABHYep`MFM|Vy2_WI5Si*TC1wl>NbuQ|W%&qcC5
z;S+n#>|b-cXKE(I;$>H%^ubK!86;0NOR73gcCrWU4fPNK<IH~R9rft4Blx)vr`PY=
zlnw_MA*-{8Dax^d(Z{d|QXWQez6Q6D2=dVGFxJTm!#dC1>OEUqJBia@^yZXnfRVrg
zbbpjc&btN$M#q$KudqL_GMBe&E1`k3(Xa#gfxZzf5Jioq<{We%R460GO<ZR4$8_jn
z7b~Eui<VLi8YFbzCQ^bRdjD12!`TpaG|MQ?9#-Bp_t+%=SS@>z2aAiooDwq?0V%Nn
z1P)VD+3t!D4qyFRZoGV@^6n&XiS;`C@!`k)pnf-dC6BqZS9*sKZp)ok_+2lv?LM6=
zi?_?pUF$0}uqVmYo8Jq<D6;%0Z@av^{ET`@(~A2CyBouH7>r}E9)fb1NvA~fnaIxT
z23N@iu=`nszu7L=qh<VwM!~`vs79;3bR1g|(e!rc3f<f-)Qz313iAr;c?&5%5I4|<
zuE_i4_AnR=SDpd6dKRA2Gpoq>2DT7nH)=Oh2mw0!X|Sgwa8nP&!NwR@S4V^dO8=JL
zzLVBHG}rqIm#bck&*Hov3uh3Up<2Ln8rF0}yLf(fMcIRZ=q9BR?F52dHi6D<E^lQW
zlYHcm{nQ`L+z-zs#lf@Xmkgesopi=(X2Cd47oT;lu*%&Ysgyov&8cYB<)U{d$htyP
zkaH*P^H1K}yrci9mmAlM<@`Qzt@!e*XN#kt|CPzwep_S{UOb6ztCJ1=X0Dg}PH-+S
zz%pxm2%zn{uzp`80$xbbx)+OAH*HlhP%teB7^9!0ro5$JzXVZJ&b;FrR7xGfDK$T^
z$h=w{13FzT<wGU-YPSV`HD84GOE<sCl?9drl0UE=2rE>B2&XM9llYp~g?=@|Qu<#R
z`>KG|HI?4v3*NsV(_NOC0f~RJvgURcbmTdIyw2?3{+l~S<h@V2Je{N&J@MIiPo`P(
zXOmA;qsl{od&L#S<PHXMM$k%kfTY-jmy6sE??@O|QSI%avAgyZ?OW<wy-)SnM*%Eq
zrPeHK+%v5lY>%WRfPy4fJcB>#!wooUN|~oVpFtKTypE!v?*^_LM*jMB;Pe<?M}f$t
z^2rW!iuoO*n<9biX%71hgG@AhQ>!fP@-=`i`@dV8)K?nCj8XmO13{=8Ia1lt9UZcU
zYNrAg90{6*$-TvA4?Q|}7mf#z>kqSPs3t95I<{c?Y+kSWHpA;=bWa;T3NqQR^u6Un
z3^I}9%rT6M-e1F&M_Lo4M%r5>k>};fx1&t(b-{GU8wn?z)B$ZchW&f6R+(PdY^1_|
z$}M28yE5ce#R}(}>y*q24D$ik{#^Ag#z7U4n+R*?OEvsM-9nz+h6*?H6PuY*lIvp_
zWleCB!z~ln$_ht~A%?cqdBo326K41F!SN%$148Q?4=vIpr?V@`>*R|y3J&x#S=qv2
zp`iA&Mv_0TaEj3wh>n)5pC^%fcOHfC8kM7i`LcQKh+_5Km6AKO>Wzgs+F-9M!&vGL
z3cnl70KSmrywVHL>ZcWB=}5hrbm6_N*@ilfES#`AjuWC2^DP*Vp)B%{BAfJrVZ?t-
zGI0Se@+$cS>tg~HxvsNnTPf+#M=ZeOsbnyxAFa^Y8$r~-jn&19EXPsYt=D`3*S`Sz
zfpK91khX_reu2jCD|$ahQ*tA_DKdoNb|~cFoNJJ^1jWR}Gl;ejlw*N~wMstSO@umR
znK=EFf6*@b(!kc4s&&74#~Oo-*OhpWL~@)8GC4@#vneA#s<IdsLH-8uCFhip3Eh~k
z-}srgMk{Z&BqZqQSYzwTo@BMR^^1C{`)263BoPS^+ApSX9Oqssc5wai)&1A>gadoq
zqwwFjiG*sT`w~69vncw@?6}?wUcTbm9M3(B#4sTg4C-3oXf^AXY0LHUAoYUM(+AmH
zd>7A5jY``OBb1ckifelH=UeZ#ZUe}Nh7xGyDM)?A<HX|KXG6ErGWm`<9X>rDp&%@b
z*B9m_vk5b(keN45@%=pn6_@8@NzRuQfVU9AQ0%*7dlVI8(6O<{(slul1FO3I+{5QX
z_PYqVJsO^9H8&0Bs|>CK*d>7ApiC!R8fFhArujqjGh+7*|5ueeM;Ww<MY@@H6ZY6C
z+{!|b7lYVnkrZK9iJ2Ag<PWP>mEk9W<gARPdS+e{$D;y9H@#yk9vY~I+Fg1j^CDg)
zA9P~tC+T=o+dd*|M-|xNg>D6nPBZh6Q5~<vCxW|fOISY1s^wRGw{x0dca_8&*UJ%>
zWN!Y9T(CpmE5_RL6=y_3*B0ZG{LCE`zBA&|3f=fB6|_?6x6J5ebi~Oi!RVH1@x?}(
zM1{C{2s|eooiL97kZY5qaS=scJ@wUnF%TwG50eY~-e4+-zWoh2@xFWLrLkPNOZ;fS
zO+$lO2X>68f-;rS8DJssxX?DcyLq-@3=McZT!|KO#Hnmc;$Co~4-If6O9Z;nBS<IP
z;7g;~NY$O#*FV0JraeG2F>d2ve&K;&F&XozvxVOHMl5XobZpDc)&9)3rM(n_X^@0I
zGtlB=91B&{m@X73N_22`REWyyI@Gi}f9dhkLRsc_d9$LmmZ#vAxct%Fro)#nY&}tw
zi#AB0;c3-5*g2=Ufz#L!=VyZ{@yAz9L+Sv)x7oMQ;;T;p4W58G-NSyqhYZPESpzk&
zZHK=0REuWkNRrL-q-p=_uC7qc(nPvoxRR!m0_O@DC+@^$cq~(~l^ne@1UD=&6@wy+
z-K<RdP{P=@y6fU4yUYOQVbg#HvJ0w~^U!LseZKqfT+s2(f`dYm`+)dR+BD4x+wzb(
zpMX~C;TAohVc_1?IF>U^`SAjO;qrDGvNG?`7auo084UKsze$}ff%5}T8WtKfSum_v
z<Jn4X6x34Rx+uJ*<>j%Zr8g9fEsGqSpwn#uM%%&IZrd5y#-VTEdW4Jis$W>}A4z0W
znDRoVb}lY-3Rxt6W)~4}A0vi@bSt6_Vg@l3Qer~Ng`_%>Pyyd@C*&Y5Pp|viZ`h5H
zeB-5YV{O>Np(`~1G<eqXNn6X&Lv}#3yjIR@d~yalM|!0CtAN^WUWtp2v3HfnU9bn7
zmpp7bk`!5{8!!c3c{zv+D4Bjc+C*GQ#G(|%+#lZbsL1Q#rfDx#F<bUks5FxL`j?q$
z@rQeHtVjIZ=&SU6b1OOAtkk|DJ)4s7l527+2DhM~lI~lOYE9t78HTSXnLM+TQz0Y6
zXE7=E6w-r)2~@jMS>}kIOp*nM8R5lAhjY$~Z-Wu)4AL@`?y&d2ysx<hbAwi=wldr2
zCqaYM9=N!{X^Lr=QvqK|1&&(@?J<tW_CWkgoppl}nto5^&e#fYGaqdiYjm+zZ}rY$
z)ZepjYHTb-_b2T12x>7-2jm-hK1l9UYtB{PI?*UHqAkLp=k^8@`+Sd5I(2`Ma$x4L
zfME~}J4-qr6R}~))GWpDOyUQOa`03pR&dwU?)jH4aNIBfI$N8l;mCIhx~wyL>ps+&
zVI@;gHlnQpSQA15Qk8TXv>Ch?mG{0StQ;+|=5|sysvwXifiEN^TA7aPJgBzN#Wb^M
z-JOfN7c}7_!Hj-i0U`ut+srLdi7Q!5tt)A)6+GE3=6TyVd`U#VX*rQ==(8|nqn6Du
zeL19|9a-e14Y`c(*dcj*z$Pt!NS&~PXO;F*R?ORI$q9KG-9*Z<8RJaG%z#hOAY~7p
zCo3O*4>aw@5wJzZo-+tN0uPTm919?+Td_~)FYgk9DJth;DHPErWw$?jPR9fi9MjS*
zNc96JhJ+TUo<h~*ew!%!eKeTqp2oMQ)V}%c!XG1eWMwP`v+n31_Po{U%lly*>sRdL
zBSJLY8=ly7RH*y-BgSxM)hyaiH~A~{usvV9oX|@1fpbie(yL`DMbtuB)hV;NtQPp{
z(DRxC-@to{YLyNUe2e`vU};co`zZNvPxH4ICp>)$<o9$F!3ShwNfIr`?(g^Gas;b4
z7oeILC-~aMv7642kWZOB?W~GQBBt@dd9Oiw13%I4--&Z_-b5$72U@(OXRUbF8H7`l
zg`$?%{*!ujYb`v~ei&Smn1Sy%_k4MxgM9g$rR}T}f8$KX7LS)Bx>F7FS0enijQWc-
zQ<<o%fB@@1%&%H%C^hFB^U|z@G6?!7XSkQmMj78=DrdN3a8M=Q&SU<~Enj3UL;u7j
zL3%t)xP(j>WQ?O!8*Gk_X@S`W8z+Ul(LXL#GYzk~c#@`rh8djLE*4FWT*jhHqB7l0
zrmUdtoJydIA}!N58zdA~In~fGC6W8*H$D%=*q>34Bv;%-P}2o<kyo5D<<DE}cgu*5
zxHX#GLZOm5b3~fn7$5Wd4S}xLW&lk`%6~yrTd(Wd4bsjRV5ecECW@q`GEXuDS#VhZ
zJVC~Er2Z{nC!&N~z)&NXDTEY&mZ}Hgpc~W28JP)tADK)yHi;-V5@|{(eNy`&RWGNG
zwue&(ncd;y1847Bq-EQO>(z|inQgDWdm{&XF6bIHq*T{wkhq?APu$oFoV$lA|5AR^
zWfqo)D<?<XdQI84l7&(F>SO`4VYV<X*o3>3@2w*Q((wb0qVsY4v0R09skTVcAH?GB
zQNpdNn!>4)I(tSg`~pr(FdjAHQG~<YW=pW7JXccN9$rn!-k^FrBhx3L<D&2u!7YkG
zdkn+m&DK63s>zm<xWHqq{MXl46&}P%(}t)2s(1Zo2}Xk&zFf*gH{K&jXZ<cDUUWHB
zr07S(b#cA8K@s0?2>IP%o<Rby?u#m9SqCL9F;1%tFj}ywT7s(BW5DLxl;wjT0R*?^
zuVqePh1_Fd$u0A$<|piHU>YRQIhdh)q8B1V8(JU~VL9%+`lH{R^F54Uy19WwU8M5T
z>JB~69S)3rm|gHO^B84YW}0ry@r)BIW1PCz<Iv1b4Qw@}RJQv1Xo)hma5m~FpJdu=
zxCcu6$P5q~e3!^_OvkpUpk-+``D(f@5pZU$Yrys8q{X^_HPppYwFE7kq+&Zc`^g&M
zZynzb&B0;U?q>uc<gfF<XOG@6f|{BXV}$8XF;aYKL3ekb^7`iINe~bk^C+$k*yRyC
zFn@$47cW%rvkt=)J(x1pL#tYXKY$7@2d$DtY&@T*rEzh}NK3yyosv(cL8>NI8nm0)
z5U@S)Q5qi$<Ma|}gc{hWU#ToqGN{xp5~-t_Q0k;-v#c>O)>SWf_t@)0m|p1XXf|FV
zq&2O+VbX^1GB7$JSP@oaei!_NTJ*N8f1F9a;#E@e8S%^VnNr3N<V>oJb5tAn*;pec
zWj7;*;tkkV=V9{135!)!p4(>o!lfMbZo2_42K#8OymqwSnrx&$M+F&7pf2|)F}Wh%
z!7Hp81%e!EkF!8A?s;I^$FgO4wGlREfh0>6R_N%8?dAocc?0(D0{{FVh?`cLyx8MQ
zNJ`y1We+ChvSSiUT~c!-weMf02Y)*qIB&(o=4cLgg_^ixJmGu3+$BKNnW>j=#wPo$
z|0*Ob;^UVu&qG7Mj?n=by>$+!osXM2+28S#$;u9Y5q2d$n6Xi_`POmAIV}k1{-pf6
zC((?cejIs&32j?h<wb-A*jM7_-<Y`zR8|$-XQeaCr5Jj^&K`vnyjo@8o?g<6O5tv{
zb`R+MxUCRH^c8`}2-w4pDMK%zTnA*LjPQaJeoyp1RaZ!Ii{#h+O6D@MMW|U%182ia
z?MX&kE&sL!N&P--tTP4wA^V@ZG?iUvD6B`_#-PsU@BC}|jIXY(wW*6sumQusP|a$)
zb$;#q)<gI$s``cp+{3Z82M^Z-XJ?(ZSJR1$=MaxlX0+a8ANApnKAh_m#0}V+M=nqW
z2tM;t6~#|^k?;`EPHtr>c6XD@o5v{qDIp1g*K!ZrS9Bt-W2=tct)H)WFPc~t>y1*~
znNIAk*AG@#b8gQ4btc^I0-}s|TIv{`ltkP~jir8u@IQWX#f=oT^2QA%aG^d}WR1U=
z7x4`2YuI`7ed1-!FodL`)Nw)?ueiIPRWP!T5705qD#{F!q;cHG-n=`{ow%Iw(F^z%
zme_95_Z-d$Q=dRH6|24CKGsESrHrx#{IRB(>jd3LlaVz(>IE||n2P*niG&``hZ*Au
zWl!<nS8KZN7fCkO`xnsvXMFi*VRMDhz_#|Jm77eH65sX(r@6JJJy(YNvC{`0p4`?}
z1bv^98zgHObtD;n)TD{Lh5nEc=4D9x6t8~Qpur)&>~m*0y9GDpUlQ&GmO6K+-(QHl
z13L0IaZ4ea#3@}?JhRRqj}!$E)hHZurs}B#vwDxJ4s3$U;78|w7OKc>u=ZBT#2Okn
z>*rl0Q19CCi{g?_o}Kxy5s>K!8m)#>8M!Yc=-`F4I2WM%Xcx5ZYpUzp*p?);RG$=e
zP?ZXeVR6@Rx%fzYFTq*Z-B(L%X=Y!~bfLa^FWb)GG0X#hun(r&By@AvP2Mpdg-@bZ
zqVFf`P>pZV_$=CHMO4n=vO8e#Y_*gr8a5Q!d}U4Md4aOkyi}(yER#3xBC=#=pr$vu
zVA=f6!$`GeIRKPv-Gmjm$j#^hs-2pp-ddgwx9-?;Wz)$h{5tE&O{}_a;#VfLWvkWg
z(_|W#n;XY%G43E82M*t%czEM4j%55K13iWZubdsBvAzhNgCW`{uhUYtpur16Q8=V^
zKMlgyTHRY)!S$ziH%YwTWKQsaZ+B-AN90o8`)$ec^6j5*gQp}PiTwcH!l9HrM8rBT
zh&O{gM#4TCdxa%Ur{t$`PPckLqT)E(8x*HM3UFdNNTRLd<Hry8mnkA8Etp7zh@O)J
zBn>}RN7a7u0>3etc%@yPSc3E_9LN7*Q}SLjT#g+1McS38>~d!sK7#AjZH%i9lRi_T
z>5TluMLCLC7t@A07kUdL=!JUN{2<3(-BAuSWj|4XGSiCb-~ei4-n@Jkf3)~E-FrdC
z6T1AmW{*=Yvuqot-7_suq+-LwSYv)&?)P!uDZ<c9$00U1>{z6etQ0+^Tkq1P9_89-
z<wBnBqqtRO###*VEwlum>x8T{y#!-~f8WdRlQ!P^pd^q+85AC@>&=BKoB4BdHbZg`
ztSiCk+_^nOz^Paf{CJA5>%6nR5gc6vQmD2HP~x%u^U^g~($PKrA&K8UUYf`vE+B41
zS9_b{rT=`UXCRVIOZbw$&%`Un(c|oI#LmMnuDfx1w@E7$1_olCOPt8A7M;hv6vcg*
zZoOWItDk6D1=L=~TX6${rl~=x3DPfk$ZW(|9!qVCxGi^NtkRDMsaV{5oR5LSPXa+r
z=)BcGzb67=-*Wql;8*-EWJg8f&6=Q1IXHxUTeTBiZcgT5gsL$yGZXpDI)64bMPFKS
zgej-Ye{L&-jGWgcRIWH)FyBKcQ2(@VJrwMTUlqRa$cw~=`WKYo0IRBB$UOl0w6vo9
zLnW>~8mJiB%O=m#F4ie>4NTQ_E4)lO?t~(cSafv($8HTfmO)84OH&g;g;XxskfWAN
zH))~a7D<c!elMzv^K*PcLIiz%UEj%+TK9{T^Qo7X&9`ri(X%JzJLy?l&CYB&T6KPI
zs%NN`lRCj#LYgia!WMT&P~g;gAtRH&`e)vyJEW#b6=*r3%~;Bv&WHH;_UTzXc#(2-
z^VnK3)m~&a6#MM`i*ca-AscT<%aR924Hs7qg8&wDO^xl@MX<|v6?tcyxkMa6pO#go
zDI#+<MU7KHjs{SRNR<0<=u%Nu4|hiQgE}7xn>B}=*N)L7;gQB|2U_N803O%9p4(Pl
z{nj?=A^Ze@|4krall==fgUsOwge76dB`t{|V=A=U!{3+^KZGsg4B#f+?2ib+kLF|#
z#;ZDdD42;<k<*F5N07bwt-fzyUpm})LFloUlCot1!eufoq!k<{moqSUwwc>T`}nPs
z8X!6F47k)*)A|eDo+j_TR5IUf=yqsnW}Dby&Y*{5P_|?rRi9)9?HTG7W|#uSOr-e8
z&}EeTZ^*f|J}q?Wiv0ELk+bE5D36eIS4P`HyX73o1v4((R_W6#Ssb9Ye{kb&V3sD8
zk{V}zE41}X3aB@7`;=`92dCiJP=OvUZqPp@Eu23~OUgEX!1ivq24QD#D7Kp;;6Eev
z?kxM_zW*`rXWMZTQXEhS<%F8uglCTsKkzRlc|56=;EwL0@BaF2;vL8ZP?;j+t|qvK
z+!el9g#@cS$j;j@!)ZF_=dzKL7@-=`d?dwfgElJZvY3%^x%lxVE>z2@sc~~#%^Vt$
zkrV!uildpU_TrX!N)EVd`CbHjXr<l%quoWc0MQ=9L<HZG3)<0cS&$}Zmfs%jFe16>
z-$q}<7z<sG8hn)nFB)@J%&3sM?A)Ic!eR&Fua1bWx6(9Ct=N_-G?e2WmD*bo_Y9Md
zWO;Ogf+h^}a_t5)f_(mb3FBX`JhXl%Y#(JG5!Zy4-}=znEv=&c7h<ckzLyqq7!`5}
zVSeujLo0!6)u&R}`!BxA5x3)E-Pub2a%l``5!gMP*YBgKzYnO8-RwKWpGg03QK=SB
z=ktKAPPvGPEfmYgv{^H!9GI`|ZvRsjX`}Z+%drb_Gq}(ccXWS5_tR=Gm8#2NFDd_F
zbA^x)yPs{ndKA=H`i4fNW8c3L?^Q<n`gM2d{7>>J!zab)t_UKo)tjr#wFQ@7e<3&W
z@JKu!UJ5$2;a5zw{0cIznf!h(z_v27C3rMx{Iva)@Ap6NyQ_{!LP8P}5ph(>E+Am{
zQU9lGAce<Z<=dx<)c=)t7*Jus%LdW<USNTza?*cubpIN?F(WvK0U_oRc$&2R&tIcf
z!Lc=@o9UgFCqwOjJ)96t`>JJ>BIy4<^gqJH|EVLriu|&Wm03bsH~q?GW+8OpPDfOb
zQ?Xsi?>6>LH5ZSzd-BKo#vH_~vSB!4^Hjj|MWhY#z4&QI+Klyg2DGqJZSaa5v*P>6
z+jLH8=>NE_&#A2>Y=a9oRF~~OQP;+W69IN9&FMa-vXkeAYRw{dLN}Ew)C#QWyh-|D
zQ~p|c&^<eEbci!MU+nN6AzhL6r#mY7aI(XqshcB%WY?$~1H)>(9K<CVz1dmJ5)Mv<
z^aKob8xdsLv{LMf{~+RioA+5UGxMI`&whceT73vvg|`}Hc12&X{4OlZFaG+=^O7YJ
zUVnhMY1rNpiF61sEaY$x73t`!gj9*a1WNZgKTv>U6#p`DV0_b3Ix#7woQVc`N2ccB
zt|YQPh=BEH<J)h@^2vURb;~Gi-_B?boK)siH2qdyWgyVH;QbgCpoGV70_z7qa#bEp
z79R@CTC2~g*WE99o&D{-q`ibNT`U#%gXNN07F>ATn6aMH5YJE!8Qa??7H1R7@Sgdp
zodu5$4Kcl^+F4!o%@)h0&P+zl5Oosc%(xYlZ8$??B@MdhL0L;e2MV_^=+cL^&f^e#
zem<<XSLVbw=TX?)xgAhW=|}SBy7zmF=r`53t+Gr#w)j*+%pEJYL6_xsj?%(2M|4VG
zDcTq)08t#|Kiuw0uvOxD)~owFTp{bcc@J+HmB%NRf*40a+pQelTxlIO&F5OEZS)O9
zt-{$3kjT9RiRnTCB^6vq;k)mXrJdg$sNr~@NXx&KMpmsUYN*vp<vM79_g$shwBV{1
z1y9{ZY#IBK`-4yfYN_}7(Wbl?070w`<QTI|W^g@(^_R4aZd!BMg4)fM^4U5bJtPu+
zjf?wz0bWc{{M)jZYjc~}kIyx0)@rHPY{bdU1P&)TDf_g#%T9BU!eB|qsEi0Y$3i?8
z(mkJr--Kg8sB=H`I21E`3~xKhyP;=o{@KAPN1*T9r`{{#(5<fKga2nLN%P6QlFp#j
z_dee?Sp;?FmuTCoYp-RR<_AcytI>_*fP;~da$74UE|?oJ61Qhik)Myl)P{5!Y+>9V
zOn-g4!?aZQ21UC|W(NEvk_Ie!f7UX+ZF-kUHRD~GX8<$dVk71KhPi!j!@2(8ohQyJ
z|393bzlcj1N$>`<c|ZazQgk1{7=7I*G<Scx{6+glDhl^7ykf?1Kb5k`i$>U<Xj4Yb
zAucUO;4!g`*ltj1D|TVY@?G0~XhS0DEazDuJDMczhC9=fd+W<xe1ws-BYYEQ`y9-d
zM2YLYHEo%Nb-l3tAm6B_v)+=ZU^`8oMz+SwwLo?{{+98qI~4pcGNYv&bO-WiTsUPK
zRi8NH*oB7(qB1BaOFAoxroC?7v?(Q?^nY|~AVpJcUOt3@t9tJn;DFwnzknWR!AbaI
zsX~dY`=Mt2^>tD2_IE8((&)22*jLrj(=XwzibIhf@CCUGm>u>%5Al<G8*b-#Gt5;X
z1h3Rs&;0flXh~jqybUWH?pF$8+bT+2U0w1x8O%3d-pN=(sx46N`$ZqpbSv@8=gy{Y
zwOGecV?>XON2=+Xu|gc2*_QprjkU_>`nA!68?BBfvxm*#gN|TxM57aAiYda{(I4gM
zXy;6{+tQXYe?K#afO5$CdtF3-p^X4CW`lgWGjQ8zhG=?g4DKB~bP~gVu>Pyv4>z!f
za|Ukn?rHTGr*cpe8H;g{MqBKNp!&QoDesbl>pxN?iS%5acS0x<Gk>m@Rs`F%&ww|6
zH+oglf@I)Ku7oVF2MJnCI71C%wBPi)u6BY_MIo{44{USw+=I@l@5>Jr)RQLjTx^Vz
z8;3_m)xRu<E8ptkRY%RzfgABvC8K=St7{<pronK{_d!jSZt!)lZf(7K&kOhS5AS&y
z1y~nu62&_-k9@`C`BX7R7_1KG18plmgEaT9N0UnrHn;M0Ci0;v^<=D^CCqA1Cknrd
z;Hd%k)^{T$DT6^^df&(h`IovOkE2hbCpK$iBe7PKjF+H`p?Q{|-bwD~Nt|z<osW|i
z)u<9oO=Tu5J2wx_er~Vj=`mHy>}{)DEu|!zK(#DGADJN}Dp_`y`24r$blQ#2+-dYT
zI@hSoBjIUi$e&+mnY+`Zr^GMwA^NFKGQ--jXXvvnln3@sCzIt1V~@*549^eNi!kP#
zr*TK0&RFL3;D+d8YE?G^m4c>bU`6Y_VuP}a3s2>3-dl5v1Jw5Pi&p{!rk!VnafO>D
zI9>aptLxvv86XZhr|N17vp^@hQu9yWeHnvLJ>b&MR?QM%R5{(S(4%%JtQL4!g&O|)
z@F%=PZp*zPyeYI9&qLQ4%^7qr#MNf~{U+OA>)p;wmN@dOx7|XrB<on}fOJ`J<F_f=
zA8fl-8|SNV44Lf7j+CS8ump9&p{!Q=qZ1pUjV3D7F3s}alQJ2Z<_}cCFa*05Sl3(r
zF&v|}&1**D3aVZ<d&|*LfuJhwu7^aM)*Bo6eE=x%li_>FUG50%?8L6Ls(sW(D5hzw
zsHFah@NNG^_~L?t;Wp=F&TLR_pw)-?gskm3c9or-KSJ%483AwC2=Ot{3Nq4%|Mo1M
zi=io~>paU$`gThG+5%Gb=bS<-HFb>+IN^kauC%uwhNb9zot5OLg#&GWhWsv^TSKi*
zYDmVayh8neXL`E$X5kMaZ)0O|FUQ9ETG7yJZo29Yzcis`1x4^T>2h%E@5>fN_2}TL
z02p=R;}toO>R6<{6C%LBc39*gvd;=yQuI>ZV!5?a*#nw$tIqzGxgcQ})M@78oTw22
zR1I}>iwm<q-MoM451*zjz9THKw)O(XwvQGiCjC7nEN$re-WP8JK=+TvM-cMs5HFD(
zIUK@|lI@SKw%kK2gn$e(OuV}CfM5<+=vMig=Bo|G4@u~lL19AbCwwmG`8_18Xp2W3
zbrw|W$ZC%^#;+qyRO<wg!by&U)mg$$KKypoKn7NLb4fKgFI<ZXwwV$i!x(TDA&J>}
znnWL>2`QTFiMJzXP=2tu(u^0%Ybv~lxVBv12ubW%^YXlY<W=Pn8!q%uK!JKC`*j5v
zlk442T)ky`JJNhlxpMm!E%P48EX;$QDqw8sJC6Vs=S1Dm_=z4H_N;;X-pZMHz(R}d
z-JGuW_nC{Cvc<D*pEkAq?al4AD<0rRjd~`}!NRc`W;(Yna!?vR6J&EL|CDp*4<`qv
z-v*6&*pT<kqtcIn0G2)*XQZ#<%N`R;++Vwu`q03x2*y%P;f=AdnVuC}(wv<P3&)We
zlq>PTxr?D(x`o<~!o3jCXm@=RWl#r`ajsT7Wg_!uWn;e0sxgOFjexf+-ao@1J+lrI
ziuHxyOdI>{w!l=5Zq$-ZmA>Y;<(wOHAuF1@QU|sh_Qkf*DxXIbkIZ`g#fb5X)Ax06
z*HYd~Y~^Eqec|$LR!n+ap*S^$`QRohJp`_vlN*0^a-g9t@3cO|{vp>h*#DtNItD|G
zE-Jn?9-+`P99?{GN<hial994nDrw8MX|a1~KED&_-8A%ckZ{z8pEqz!S`~;u6I~Aw
zQJUn4Z=w(|L6(U6s^AYo3iqqC_#`?)=Vh6_cG&q$o=A`$LeE9J{OH6#bHag*zN?>@
zsvaf)770<WpfsC(cEpPI^=ubVB;oh@NCQGy-hRXSZapBim#Q`(E9(Kfthq`;=N96<
zxw&sLZMGOYD(3G98oV6z5LjWz-Qxb@;^|Gi7%PM3R(HawYhAqf9`q+7^n_nvp>Qb8
zKjn32@`JJQc2s8?M4*I#-<Tf`g^Q<ob8mL0OwpKl7WWUVTBasRmC9}-11`ABJ4ZZh
zX7vm&by8C!TB4T2@~f1(blnri-Lwf`TCRlaLRb8N?wzyBi{2xwA~}|idNN-3UamiV
z?bM4DhlFMI9vC=;y;i=fR-DqsZMEnYKDte&SCVNrp?XlZjeaNCg1w-o1irh6#y)rq
z#d3G$H<&veCH|T6m*c=Se05n!inEf-BJ7RYaV5vHL;qj;@n5^I0GxuekksM!TF2<i
z3lq_<(Q04^z_Va!B4)ue>sXg5Mnn#(V#=hJhcvo05o%(vA@}jap}8Qf$)tHes*6vo
zKTed~_+x6zaE}fh5Pt@5Xh5^74qgdX&{sbkEb75pAs4UFFmEWYMZxn*_Zzh)n>Joa
z?sWv&<i2TP`zqKhl&0{;<WD})6umU}0Z*0vp6ds*M6Pn{t_dg}eF2=GJDm}c*jHCQ
zk9mM-9=n|t1;lU+jb^pk)NbY0&$*fz2Yhu$J9nDK8<KlX=-Zb55>ccw?Tj*b@N7BX
zGdH=*J#mp)z-+?RHFQg<X0Vc#ch(h{yUbr_*9mv_%)^B3&dkBFGG!Wn)KWc-)~hw+
z{vJdC=lik~bpx`AbWum6pHFRWQEv>6+Fl+c4Ah|M`QQfR5C4Eh6USLO75vU_o}yx7
z1oZdld6#Ku@jWLbDdMFw`J_%Rt8UUp(*{A5^FFR&X^H~@YWy_eoz&<Vf`sKcE!zvP
zRRF)}2Vwg>9BUoDV>-F8iSC)j3Q4c*9{U;ElC>#sO(V)-Y`J@G%NRTg5qzT)ucfS_
zs!gFjy^DyCngBEowlc~j9AX|4u}5!|<~PAvckRO8y+N3&MJb~>BMajqaNC#>=m$|Z
zc|U7HIVoc7toL}Yk(p=(aVq`tlvPDH=JL1uy{Q66at00M0d|FFDl9C05F0icoR|op
zBzqq`MTz3QP?E~-F?hqSA!rrtPD<N*YnYdm$NxCLTv%o%5jW?-rOHGq=ox(kNCUG1
z&!^!BNcZ$pyYBzda3WiKgU-(>{A@?KP8(w+AE5Rv(G?Cs9+4NTamTnB^?#8eS-6TF
zx&_%GwK%rrFLh6hVK~<V2*gxFH)Fex5}Cms)e||Zhb1C=h#VJP7Pp12Ry9&uLzLtp
zq=~d8+Y1g5Z(IzFp1P7YQHfi8<dBxnxjAnRm-Chv;KgrED}l{lMdsk8@H98=oLPzX
zLiTh$t!jrRcVR>D4Y9+b?tZ1q<@0du+h<y@_ov$p&N7yrF-DGkwltl3EDu#5pL4!>
zlqV1N_(JC|q7!(fu3Lx<z~X*jfym2BwD*mhr;l*tp6CS4g|Qx$hT4w^(IJnOeJMYr
z*Y>$%SfLi{I-iD@Hk{|P5(t~$<a7zQ1%cdkn+2z4+tW-Y)x2`lurdU33YxEJ$d*6o
z-<?Lui*6=g{JzQWE|d`|ojKrmYtj-VmyW;}po!YbI5D|O#8Wyrc*)oYjpuIHW&(RK
z8%F8Vy0A!>+H?s%<xK6`AV%I>wUe=;xJy%Q*}jGx%BnR+MUeZ)$-iFF7W>vlo7L`A
z5VVm!xDnqQNDvTlJT^R!Fey$Yp9%?`udbDQ&n5dsu1q1t$<C<@evuq&?;-twO-hCK
zS7`9B7oZ@!;pQ(OM34#Bj66dg(R8-TAwFYV?zNT2BcE8fgfRC6DM+RnEJ1jruzGY9
zXt&XOx!7K+L&JU1R1pI=I71`hjwPamqfnf7W>rHYriZ?_MDjO=L9}5(G31xJmnFno
zNWF6H@kA?16mNk`=8k%=eq^$%GgrufENk=JztJY=4`6OS+{P(&GP4oqmOmCKTG8U+
zz1wBBNNxL;u1Kzo5+I*xp=K~MRde6K1VdY9T8ya!!yAKYpqqzV5kFF~6ES8o4i5Po
zdn~UmGbB$G5v$Gpl9NAzMpeuQyle?F-O=qK+ywtUwiW>kFaCWNz(1>!kA!2gQu}St
z_88^%W5kGvi0f++efoReP`bhOLDnjd%tHeMjPS7YAWu`}vLy0U-5KAz0n{m;8iwvb
z!ia@QQ_Gq7A{6dEc=}pc7XA{%UqafYmqDX;N=~qyHzT0+E1kCB6^Suoz>@9c;e!C@
z<ZjRq6R%P!D4C!8IY+xS10R113y*4|@oPVvS$!7ZysRo9a^Tt4Cas?T5@0gz9e|C7
zMY|Z)c#F$Bx7X-U7thhHL2}oiFBo2r<jN`kMSLYLZdyF;X_j;QB?wZ@5vC^eTQOfL
zTtC%cJ|l9QzjCM4vsxP7?>8O$nlo`a-FBsOp9|^zTR`qWdx4CeBKxU4vDxj+6~u>2
zx1;{U`OppBLZxhSHzQ!#x_%$AJ~)W_c)%x#9GTK%QAvg3i;~IF_Wc9rW+$8<?pb~$
zM(mYkJC1+<v_ACGYHw~cgzRaruF@I!_)V`=s6tJ2>J3=#?(Yv*=sk#S5$!Xl3AN8p
zr-6tn@dt>NLMSn5xmY7KdGQ-*@V3c$C%vC`qJ{V3-r)4n&zAa+pW&Dry!nZqdkP}0
zV6jLMGD`SHAup3g_yN(MMs9|6|HH}~lc9lojT)(uMxmQMb*e-pZXQC*<&dF@HqkZU
z)wZ4?$eqyeQQc}l6D9=b(!N{U&U6D-@4ZWgM^$f{o8}xe%1o^#kR54-PkB=q7^o5x
zfl|kV+Nr5l)>!aPu#RvS;qJz^%o5a?Em&Q4&eS2dM$A*ho<i0Mx~=9$>xGu>J1-R~
zPEIWCx+5hC9#>mBlMHtbc;72F#jV(^NP+%{APPT0G^|+<+ClAkstknVXHrA8mk>L@
zs0u8&#@Z_c%g8&x%uG$$>-K$1)R}-kXYxf)GUh#$7gv5hFhSj~WXFy&8;@ozVwxV*
zK{kubyu|i5dVB$j`S8xy_ou2}hlQF}-#r^%_%OH3!?!@BX8W1Ew6bEW+0vfULY351
z<1^J^)s**x%&oT1bjCFDwQ1(MS61>}mKNrG+m7!OUneD;#6>I1iMQ{vn?RM{A~vLU
zS=t>P>hUS-uyh>p@lO2z4#T$PiW@U;tT4mrJW<JX%+?Ok`iKXGa+Iv`u{NYyi3u<(
z+;}Lbtg0b_@YavWn=feUZNk@v)Fy&s9pV6x1j?u5vtn7+$CSXw^2y=T3E<-X{E9Y|
z@tdW;$Ve*jl<{Qiaic|JsbD+9-}AXn>I;i^0G~?IGkue#@GOJ@ST5F`ki`o1W7}Dz
z$KZ|wmyU7O9q@RWhxq4j1Inx)kF`_(7sW=dn;)NeEc^MKG3CLyV^<)NdVL7AwoO^6
zr=HSGnQBw7B2??t)7`6X#bF3`Ll?Mbx~k6&2PMi&7NB}IXh&OTp7gx9fQ)k!9nFo3
z6#C7t_D{0i^zW?g6B!(DeQgOC)K><$<F%~whwIsECwjcqo<d-JI_thHeD+uj{(sne
z&#<Q2u1)wxMN|ZANCy?L(2Mk@pdcW<6PnUXXrYD@0Tl%SK>_I?odg1e7P_FcKtc^A
zRDl2q0V$z{GP&P*XXbsLx##<S&vDG(>}2oc+S%(`>s;qL&;03in93DnV`B>`54ot6
zkLU1Lj*+(Yip$;g@lRiVZbGI`!Dd&zy+T8prFa50GF5C?Dl07>oG;0HmDe~f){-0W
z*Gw>G#%)#8=z7xubrSUZ<&u<jJyj|)<iylYomTE-IXi#I5gu(NfTZ&KYd*99vJ~ZQ
z-pfO9_iInKm{ej{gXu>Xv-=KyF_|?bJstmB^UK~zh~>`}dNa{7^r$df`RxE+qXx%(
zF!`-x0)X?|J9E=K?;UU<!+#)HTLFlDQ&R=1>eW9*i~rRuEE2t970|0XIws>MU*q*F
zyCyC!J<W$DTZKoY;x(J47e*Jppn1iGb}6Z=kUxF@n^j{&e!Iu3cVW)9@o|5K8874Z
zlE2Sqs$bpqH$m-6#ti_yZ$X6=6ea^p9YxI^)Z)qrPEvC`5}m4kG_6^^jwP-x?@}{7
z@7L^c6F88MYp@;ZD^$6#&pyW;-??x?SI}-0`b;s4%jmwvq?3=AvLviS`c{#u7v9u9
z@-A2_bmc(B)|#wuuixZ=*JYe6x?ODxxIF#Ku)fF;@a16I+j~9nO?H0jhGao&%?0kL
z$0+p-b~9T6khf37)zH2$yJa<WJR_&dkjsbiZU}}WYc=-?x?g0r>baa?>b<(Id__{F
z1QZ~BL(E4jp*fywnlbjDv2hPRyJNH098&#G552!%dYLJ9aimyxV|QV#l)mGol4Fu#
z;QF`32Uln|JJILje}6G=%JGQ31m5U-oL$}`U&TrcTsx;cAY7M|CLGlvJ~Z1m)AweJ
zbf)>-q{U}m3<{%JY5n|R$96I{a~s{(Fla50gdtE{g;^Xw%^8>XbJ$82PCZ%WpREL+
zjk~^vyQw9f$c;@@o5{FO{ehjtTRt0HeaB+kNy~D~^|vrfL17^dE~!wz&aL=@lqZd9
zR<a+Xk9Ss7^#hJBE!C(1y{U6%fYyd5UboBZ43`uA_>^`^_O1a3>dp)!%*-#S7UvZ0
z-rYyd>@0P<RFoP}Mx6*(cB&Q{wX3$MX_%nE;B6dfGQ=fwD&R+5x!de;{}4}G=Ozor
zh?@<1=DxOUI+kGJR|uYIHOqN!)T9K?C=>8GnDZ+0@9%wVVpbYq61bIa@x^V&Z&M>-
zUf(@^6)QFH`=se_rdt(gWy7=f*Z<)*Jf<>nQGw^EsYitJ9We<k3x&z-Aup2Da^754
z@~TfBcgby<ULLB%upmzCkD=j+!()P!=C27{#cV|Wm|IJN4BkFW3kepI49wwTFcSxu
zW!N<MvEEi{(~wh4H;JRg@c%B8TVQ3|c(*-u|2Wy;-CV%!rxz0)Evxu>n6f3G_2P&*
z6ED0999;GmTejxtDjjTYEx|?&#ktvF$q4t<{wwvt`*nYs|5J@jqONT(c_FF##9U0A
z)gZ!iLS&Ei^p#QTKsQh~3Q*_KNf?_GG@*};*_v`kZFO;orh{DPpo_U7XO;@GbcYO=
zC5`5P8hzeDC1{b(!<Ayw*X=LeLIgSrOdYaN5oN7j_cK=^Nyb()Dn)-Y!M4`q>q_6K
z8o_6%Zs1;t`@yddRDN2Af`DbY<VLpR0V$H)M?J)Fuoy#s4MNiS6Zi4Cy$-+DKL5f5
zL3Gf#^e|23Xhw$B=VX9D-s?F?V2|Y#|6*1|y>e6$LF+;sTf%Meka|m5O{jRi2&u;X
zKPhkiNwz_pi6At=PtFby)Fsr+TFTRsA7oO*XTOv5>qDd6_0YxNchB#w<+MWk%S`B;
zUUenyn``LczQ@H+ZIm>_V4T{U;3rBgjys!wlVSgHE`ms9SJk59%>KsPDygE<EWdt#
zXW4uBR8P*`pGsa+C!r1!6(5Y`aW1kIP|0g{n|C|sp+$B0Ilk-PbhL&<Y5oU=O-!Jj
zA;Fe8p_?l7&~?ul+InV`0=7|+6#2okk3o3ZneOfXp%riV?Kogq?W^b&no+89H3%$+
z<Ck@($6Ov#ZrFxhI$kjwSeIdQu$>io<LND_<flL9S-KaaHNbKnToRHIuy`kBeXIz3
ze^FG}1>=7N8&{{~x=@Jkh0H%>o}IiIR#NzCq|s(``EXEAcY~YoN%JHZTBjS_M?;-u
zNZA`)MGCpHPyv-gem+*JwTvp=;#ae?xEZE7=!IKE`kl&6q{gnO!Ory^v__=)(ZsCl
zY9xIkl5lg>!BJozvMRjz26CJ{-Z5Y+LuokqW|{FzqMu}FZ{lD4!vYW_k8HB<qYh9|
zhBLlaQHygH8oV<u?q_u;)@g<^G}PO8w&XeD-uc6zzQ4(l_Z9FTZ%0HcUoIuq$(EhD
zTQws5{`@+O5>*<-;N(L_;8whWcf`!sNsR>b7Ax1L^JqFX)u_ned6x<w5l+rZcWmCR
zlA^T9_r}@d3K1H#zoRMle-{iz5PVTbCaS8_KAZeLe@}AyJzmg<2o)U-dcmQgncw&+
z+hpGPMJW9}qOBy~%X&<qP^vcF*=OU(&HdXMClg<tI5S7v=uS@MQ5lWnfR$&zf1uv~
zz;$~c4{!X3h?%1G8(dYivdaCJtkG}&f{;ybXG5~nH@&D_X<PrEIA$)0+|zQ0d-j9x
zKc-b2rOL|6y&`CP#afirud)aRvwh_PAJ)o($fBQv)7Z6Q4Q!1|mTJ#>q=j^fDlRJp
zUql~lCVWubeBE$Bu+anJPVFDOrp~Fn9`4lZ93@YIr<_UOYP(aEQ7wStmM!Ir1B#tX
zh19AeANp5gYyyvJ5!w*Wlqp6#yKtRQRr*P8AA2fqG*0a`f3gs4ja)~B#mG{u`i~FX
zYbOjubK$q^P>;V7mCY1Y%K=H|Z480eKX0xX+uFhdO55H=S@!(14CtF*f3rs{LdPzH
zpZdC0{K$%nuRoDUyU4XW6opS&G}<{@J&=XXG6y*y;`;vbY@C!88*1WJ@Bw?>(!N;C
zj1|ykr;B-$ZPigPV`SieQzDiyk6-^#a!2Mu5c@^85MPgA=C~e_at(WTj>s14>m2Kh
zEDt*W0s-v>@rvKm##}Zg9On1ODG$;BGX${X>qq#SNcp!PPh5C^2`$gQtgZF$=~onp
ztf9F?KSDxIW!P62ZAw=`HZaaQCQb@{^S_U6>pFf+R$Ig@mp+;ZB0tyK_Z1yCvUv>h
zG7wL0xv!#k!A^UAeeE(&)p})AEL5ug)fabm!9IQAlzIOf_J24PFG&ne0yH;<EWf12
znpVB6`cll&eD5AJFQ|*xb|mK0<K>Lo;Z>bN;YtH*`B3@tIEIpb#dFRwfkDsJ)0n3{
z=kQgv?v?vnl&`-Jh^MY&)x&?YjMt^+9s*y6xYI^H$R2IwXyV?SO8$WJY|~!jy?d9N
zC+r~Jnqt5B4{6yh?1{Si#n<-sAuuE72WYnBiIfv^b+-+7z%wc=WjBANN6Aj(qmm6p
z>&jL@MCk6jTlkeLhn4=mkHw=VuwgxW4t61ZgRQR~Isb@bm+IiIpUemLv3-68!r!A5
zdnNw`JjF6x%8={+E`Gqo!MHyt)>9ZkUk}p=)4V<%rP}DJ_7bvp10lbhFUn`u_Sc0N
z4ciygHsBu?CikRJos-3zFyyGyIJJTD0}><?uKY8Q2QlulH<uh0BMYkdW$#{A_GH#e
zMQ|KRdr^?GZ#n%!M)ZX?N+0k|Ijrn&O^ko|#ro}F>ZDb9{bKTe92}&hRkY^XLUn$5
z)mwc{<haX}CzOAH$ME<!$JcpS^S!OakcI7G-wO#Wl6eZ2flXl}ujSSjWTs;Zin)!^
z$NqC%-)hz$QPtjEZNGHiS~bkoTwe%1Krk6phcp?=P-S=ie5_jMD3L-=z5s7rUZ$t3
zPHccyupp{K_F}n&Utio=$vIP@N=WlOPgC|jzRPT=dFQg!+qZ+NW=~4*O@yd41xfFs
zD}v1RFyL8>&C2YcZ0oZaW`&qHel%;>+#YJac(?oZjDmJ@a+b+(khv`0dupSCY8{zP
z+gJEPyR*L2x@mEubXc%hF3<c=CPnY*KdVf8E5twh+e^(Q@0<ZwB;QnYD&wl5CH%>=
z*P?9T&3tt_0qq#a1qQR8BQs95$`BmX=0T2#lCBbNLJ2aUb-2)B#P43p+kgjhtVh4O
zeSq(Olyuq!y{K;7_LzAU((~Y3a~yG*0@C}s&c7442+sCt<;w}l(*r*Kg{E4Wr}V=-
z@=KxcM%Bi^eaxD2dPkD<KbQ$N{gs9YU?BXb7uuiz?F~J7oqIPzP(|Z5pQq=-lPiDn
z%^l@cJ4c@_!*9rJKb$=JflI0fzk609=kVy#fxxxIOabuhw8-Lp&AxZ3!Aj#5!Py@+
zl;Yf`SAE=iHf|P<yE><5q?5zi--K_gFgw^(JEUboS{GyK2f#F$SO0edJeT})B*xNV
zbqXF-kM)=$`M$I)gE(C>Ha11dR=#;-J^wB(-lK+CWbI|E!}Y&^{D1n|StdRKgB$rC
zP^7tx>>F8r?)qNjS(KH=Kl*L{54Y@JPt>kWHL<Z#t>XCqb$%OUrM@$6Xz~A@^Z#p6
z|L<MT_Dx>zlIE8&h&?I75;Gms3yW~i{Hb|6>SL{NZu#Azp@H#e31jj)CP|H%InFIA
z>fh|0j`i;JoHf2opuQZ@$*XU|zkTRMSsu(&^ELMU`cvcm3j>Sf&?b>?*@dq(RX1*T
z1iofWP%ghWcyytf@hhrB_>j<n>n)8^(0p?gG?4}n5Dd6ghM}4?N!%$K^Am7hzVb-8
zC;3CR=8d$k9#(<);dh1>Rzh49hOdlU*6gFH=N0NuQ;-v*y#b1DWWIdgM^N}4GONF^
zt!HW_`)h{|v5>M=-1C8sdmqWbNd1a+4=NXGQyqy42)=5wnBAt+`)l&2<~a(;RlIwl
z9ZG#o(HD00c!zXj=E2yCG~@V6F@~js=HHwY2kt-duA3~8GXPwhs22q=a?0v^nW?Hq
z7CK`#$Q#{^K<)V_uJ06&_nh*L0&OQWbUB7K1D3w_@NRmDWBGOIlV5#I1VTr4FVb9K
z7pe?$ZzUg!-IcPGe^1+MMxf`0hgOZafco<DIi>?ZJPm{#CXOGNSxAHG#hIWcpQGjd
z>ATCc!4iLpn)sF@wL@DAI)G~un|<^J)ddssb!9ci=Tz0omyZORS`SrCry<3)fag9R
zO^PG`I(I6pZ*Vec*bo*glog&|FcSdh%K=5`J!JkB-;bk4+2vvs9yO6VmpD=LRJqni
zR#_#i@vne?b5e8(phkoNUG!xDq8+yh5yI8Ug}d6AsYFIbF7<YAl)JOk)%rxd35a&v
z6%)&~j`N589kOcPP`abg-+{@$T6oKDlFo7LVFs8XP2E@exwj?|!@y&{v2Xi1`QS_T
zl44MVXLrkP(KEh1w`7>r<8zlDx3pI(Y$k`BSqZDyf=a(SY$QsZ1--Zt&;4Lwrui&#
zd5H=C0=vz>jmjxvXKDC-id&utR58m5iD<R;z8M~V6z&`UKjY?q-y~dgBd|x%HvHq?
zR+r4r1qaibW?ebwfB9J*obA(xb$yVvHL&I#Ffgq0xk$KAxz+ZtWhtzTt<qCCEVI@Q
zKEyPWD#b<zKskc4%3s{MH%i{QD^}uvdQ-STEr@~KURlXbBmfc-1hZb-roM^t6}A=a
z`pa$&20Z5wN9{l!h)b5!AW-sHL=3tzY^8W|f3bGs*NRXq)_n4G(gP|=yB2?4z|vl&
z0iW_9H`<B^yl-1hk2_kxna<#}ravSm`5xAGZ9H!Z>}|Eh2ZxlP!ga`pYr_xe|LvbD
zY}ihgi4fktfqZzuGQK_He0=UF^e3+1r9n$kA;sx^+h^lbtQ?kcZ<KafnF&4LD&esu
zHsfycqZe2j{p?#g9}3A>mKlS#FV>-hzQATJsLrs=>?acd^ZTxbl7Ed|uzI}Ue9jH*
zmcJ@wA!&p??!N>q%wc(&C>8C=#JGR5!tcIzkLdb=C#=R~zc8uRrL{I>x+fpj*k)YT
zryYj``$M#Ss~y{GA)d9?n7IZlL3=ouMa$SX#}vmR(!6}xkK6aHzriHEv7N~P7t#GA
zkAICv@X7PVN?2iRA!@=t6sVd`*cn;53HmpqwkHUxV=OShS9ijawydnI;QRNEhT{tB
zn@f=(J+E@>g+`_?Z`fRh1~M$Fqdf%kPsBibVg@5Z=YXp7pJm^#);jm5^RRJE$=JQ<
zpED@TI#Mu9&HZzUC{Wg?6$h>aX4O_@YYlB=VYx|*O_u()0(5~MwE;{dR`;>ezuj5`
zXp|ECT|As0nb^J_+`&i}_`UEB*JUP6FBsj_IXPS#>7`DP{>z3kA4oN>r8HH7hOrOz
z^}X90*C)QYKy_(pjOIUolk>V~;B*Iz)QUXck|SuqMAICumv~&alIs_LDJ8<Xv(Vk|
zL$CmR7C{ZEF<kF_b8EETlRtf)&6*ll5Ln%4HXO=lA_~pLzlv|W7t>ef@FOL(SI+$I
zqbwZijpxFR+rQ;#rRz(q7|V9j3Y(`b=F$N7@;udQ)yw`e4twg(1=GTaq$D>nmJzRr
z9o^uuXnNN=n;8}FG4nY$z;L`ZO@O`**5UKzbw?z>RV_TWg`vete|^1s_SknanRrQl
z4cIsu$lYzzdSX#lA*gMgBXZf`uHknf$ZY0=<>Y%B{2G=g)GH+Z0?_k`NSLed#rP?Q
z)Mld1^z;T?>Ic$(Rfj=J{bDX9Ej2K9?JSd;`;OS_R=)P6z+O+9>5C}6R^@wMJJe!d
zQaloDRlJGA!|pB0*O(Z3lob37{5<i;E`btaX#sml#`Ng=tBf?h@BNDmDx!QgGtLY5
z6o?D9YZ?RT#BGgs6Mj<(4E>#htMM)FXP~oF&fwphdfG=Rewx}G59?<F@}H^8M-|rc
zO!@&LdEK0PFTNkMGMi&V(Q~B{z-_sVTm;<A;$F<XZWopaQkcr==OYQzg?ON0rDOiv
zpFg#X4XbN5IXAZyYs*JLv-k=#wMG^eO}{ys8?z<@_7>fP{YRPnNJ<=Db&L}!Z&#r0
zY7@V1i?o_5-6j0J0}k;TOqE_&R7_4fvG6UC*SAT}a3}ee6qr*tZwr*uuW)Wq7Nx1R
z;<y~J)Ltiiqv+hSLFox!Nqk<JU~FvR`Wt)p4{zq}N(IF#D5fSG2hEI(2{lu-^?C5(
z?~O{<qP^&fq13;Yud|P6dU;kG`sC{OjkUNJpSts~z|k3xC}!oKuQ9JCaEZM*M+TL`
zcBpQvk-)VZLoLNWcX`Z-E#jj6W_ml+KXHIULs-+T(qO}={O|nDA>ZEyu32s(%cV!7
zF+W<GmhHN9A5FH|c8pOAKqc^t=!OgKsYe3T+@mkTT48A(4eUa&V+*6f$~XBd!zf3L
zwRNd1B@h6Nq9dTK&2On>)`j^nWmy)^ST+h`VZ9-6cZjR}M9I|8c2vLPFayhh(eraV
zyQoBe6w5C!3yp2ns6F`<+<dWC;$i=xoKZz~*88tTN5>vLNIB{T{9j9k++bS8GpFKU
zcm(3^pumOg?d@{nr;nv8EYGpo#>bj>3<ubPI}EnmJWUeg$9_y!aH%=;l?1KnbL~Pg
zYIMwA!R`o;7jU^YpBgtJe5I(z;E{p9^v)r{Bl!1Oou=!@nBS8z+|uMF@yim61$^$8
zOmI#^G!+P*voUiiH}6l1-s)b+g}AtC|E8VT%iw&^m2@L;@3KZ<>2>D@PptZ6>xe&O
zhm+-OL>y9pgw2f@<}Z&4QgCL-(X%G+oaR51(kB$J)EltK&i%|Bp$7$H$Bxa6#<NoH
zQMG6EBNzKBf2OOIR~U{5544S&Qw9#yc;v!L@>^ISeV+r{a6ll!ESnMpRdlw^BSZ*X
zQasBu@O0;>KiEimdAR=o_ep(Ma+mb`W$HyQd1!rT{e6vaBQ=eT=eFIF5Y9Uq_s7=Z
zv&DC_op49i8A?Zod+eCEvqhV|CJ%PMY9|nWZygR(R=0cmPPV66aE1D`jx*XG#rjC%
zC%&}LmK0|gW2VafiAb7~mtNe8YJK1{%TF&=kg0rSc0l0sdY>IYhQrwVX7(nlFs<(}
zV;bBqC|5+e*M^GWZt5k)<SsDd`faCBWk0hYt_aT3bL$GDC)^V=`)}|7ueJv}c)9o6
z0~0M8Nnb)xj;Yoz(qZOvH!(>4m_3IV#+$}O#jqmXFTTvi^qYkKhY0B-eOEJ$CnM2L
z%~K|HvEgCIPbVpzW>R|z#!qwZ*3Su6MY-o-pYYTK{z#}k`q-xV@k-`oEaQy_wz4Ki
z*1_d9^svL1jwg-JZqEeO`t<y1Q@(p$^U*eOZX-pN*{?d)n>m+DdhzZ@F8S%!sS*fi
zs(_uidxgv4bnjEIR2@V1X)a%uPe2?Q{0<#z1I3rk9PPo_artzNiP!g4oGvU*%Mk2v
zqL6gAa&8sk`L&69{7UF)QQY>(G8)8lcz_u8Kd$QX0jPlWuu5lvP=*l4<*2|(7V5rr
z#VJR2Wrdx{fp|?GNkCPIDodxoXkB;HJljN>f{twBPrK;}$||c#uBF!Trz<ac?c7LK
z)~+SREnL95)8!TZos~@zG_DbSye>n!t*N+WoPbFUZqE*$Lv^KQ%Vb{$WgS+)A@dCN
zS}O}0=}@<3;+?aj)HD7jWl9@6u0}hingIGy7(eeHr^G23V{8|+rc@8u(aLCAQ|3He
zm8|{^A9;?MDTCnSgHO(bKymw|988MT*+GVJnJCXhtf%v83zK%oYSrGDKlc1Nx6_x{
z;5WFg0Me*Rd>JZF&GXDfTxN7TTvkQJU5+36Z>37OGc|E-+hLgBE!VgMZ)X#VU1Jpn
zpHBAod&uQV&^7Y?)V8vEz+AGeELlz7%@ib?-g)8Jb!tNUnDpG){#1u{sQFP_*_%Nf
zII!fpu~fnUM(|69t;K`!EUb0~>&P!FU<*;GIYe1Eb@R5f1#z93YyNnBC9K*Hl-Io7
zeX6cr5!Tew`fBB=+<vKvVL`RyOswb1JH2`+tRuj8a%k3hvZ3B+yqfWr?IA(lJ=<(Q
z3}xa?Iz0oXEZ=18vDGCkS08>0C#3EY8u2CV6(aSgf%%~UE8eLdw!E_YjgoH^oLpec
z-~3%+?}QrYoXCz!J40A@Gqcj^jqpH3sML&<%LuF94xhI1AO#~@F3IBFObn4QQeu&>
zJjAHTp7-11az+n)9&ej+v|TpD7^F1>o;pWOhuc(VD%?XmX4nj#$etlhlCrEV?K6<C
zC)2Hve%cYCK{)*c%t1Jr_CxF$Ib&&AzB*}Ov41~RW$u+}Tp(p|3ID$6&nS>=Fxjz@
z!^CUsZQ90e7{hoQ$(fS6d3CzUL-s0t3q}#H4h<7+sqT{ZGUF`sJMsNk-#xi6d0v`E
zfP&6Qs`qITLhfLsBFpeq@-O7ireYm?K1COfmpXrgW^EGGf(GaXK!<T=Sws)1Fr^F|
zO8vTR)iZVFBjYT#2)4QY#1m~6EHxFu`xX5@c1`Uo2vkn}@N68Tf?H!Z8B6=1?b-B$
z|Bs887=$FiY_6mcAGEv1PE*-%owpFPJl=;V9Ll85g*3g)B)4i;R#X=}OPK*d#~k1w
zk?L~@Y~LL6wbLCUs*<|u)vc-Yo()!J)-eH-f9A{_26H??7IUn6h`h|&w%%jtshtQm
zXxt(P%H0as9)~C1tsf|<vWCAn`(w@AAKJ4h-C}5a*1=Kn`8v~?QKO!GYgag3pmR?`
zYUbJ&a#X=RHBMAXFqmMep|V#4k^lm<gE_FhqB7RP%d}E$ocWYoNEbm+ez0YCR-ruj
z!_59TNvL(%axH`$H|#}_+Q=YUV{=qmozPQfJniEcc+u%GtUhX;nzR1b(&0}NHGMvr
z@uFcFw7jsrLtn0)b+Tr*J+v-b?r42kf9>sJcU+33uF`BtlZOLM1o(o008_89fVqoP
z6X9xyd(rN-tmmoFNKMhR8eAXM_MO_DF_6gB{-zD(5yJRh?$4GNd8*4bt$EM*_GaV&
zt?5O=Y|C@s%`;$fS}NIJZnib|{Ex<6!_K=o63vKD1g=Nmhq&Ul=|@dt-l)drl4>4|
z(mgc)>R~^BX_D>w)iSG{4tA)X=-lV~cYjo*JraLafl}`zBy=0&0MzOf?<c*=P|V*O
zl<b&MEOhD>To-D=6_j-{Vk7rRxK7<^y`^|BiCKUWG}ro?w>@;6E@PS6&ptVcwUj=O
zk>@=e0#UvdOV7eNaVEOl)039_6V5ot87GZgBKz3hgz^wp+WNA|c#y2NdC+G?@24^B
z5{-tZdmFcho|;?l)~bZR;+ae_63}aI`_;oYwy#TfM`7~)J`h%{JWdkm0jAKDok6mP
zt&>K@#wk}&%Mki~OU!I!vfTD^?uqYkt}cF~tBE^&lKYzyFq8#p=g|DKYylwyrR<K5
zE0lklelVwJHi;O*4h}e}F+u7EuJi}!W6)WISf<4zzpq!waS_28+sluVU9GH)T@^ur
zj}pv^u>Dv{v3!D(SP1rKg+!^BhE#!nZfLatU{}(_*7XYJ2tD+fbo2hFWU3y4Cl`3V
z;Ie5;tx3$7H`M9!CUyn}KB<tj8@Mr6oMTZ=wq~+#^ynHewKH|TwujtJxFPBN`Rg)E
z50+^zB?~bp8E;GOnYp3hQu(YbFP_A|7!9{RhbT3Ir;6N6FzL*C&(V1!gDqT6Ky9yn
z<?Jr+MupM~Cnxni#hr7SvS8S=J*~uJVGf6rwo_M!TZEm8;Jr<Wquv!#>YeUzF%5=Z
z!ogJ$)PQ(o1DGzX8U4~<l%z0zeB*7&ot+pulP*v4bcTG0I0+N@!eP_lQD4tzVXrok
z5Xf=YrJv;ukVek^t$L~V)ugj-SAk0{#=d64l99d8v0BEA@Em_|3oNR?adnUG<WM@_
z^EA=#XmZ$bS{(m9QMhqMp}Vcgug;6Q(V64?3a$SvoY<zn-TJ~$j&bLMEMBxYX+ZGI
z=qXwoiZ*HO34e2TJaWREY5wHS1fJ8I>2{R#9P(0MlRxBJ1N9~g2)1N=U0P4&vPIWr
zw~%;R`7cv#<W`)Tkxg3_=YQ_Cdk~UkUN9v)a<DV=(~WYLa@ay9`+BUy>-(}#eiyT=
zQ7^K|C@97u1J2xS+qj=BoFn8&SOM-c&Gn@hbBm)3bLL1nkb5n<3M0$xyB&Sq+?D4L
z@|`Ah`t}zY5(Sti##EfyK+2^)pC~bL2%9?UL3i-HFeFiy{PHXFt-kEdwj>>djTqzP
z!8RgEEFiMGAGj~gOW8wYAAau-<3@DMBvgsgX{eWeT8meoiy8IC-1?W?nhF6CZpb#b
z^_CF(J=AiOFE35Km#P>pjq-dBr$Th^sy$EcBNtO#Z-jn>7_0_>Zv&9+Fxrq$xk(%9
zR#qXw`+8C3xy}jS^m!|T&eqGf$3)}vfODsgIf_9=lDuY^w!`KtchZ+rKwuQDhWv`g
zC>vNlSAjffqW+iHuSTn(w8rfB6e%35@*VZlFjrgm)!(NAtf9u6E^-S)j$O5czZTLz
zotLPt2Yp)>aq}D%K|d#huG!H#Q~WQ>;GLv!a8j5~*HgiRvS|JAeQchauAv4Vphs42
z(0IFR`1C1P0d`qDdF=pQ^Eeg1+ngs_(msvUJ9WDtLB3WCmbF&$*jl$mI2w>Y*EXJ{
zxv|>q&zEJ>jVrTwdc2kVFs)6Crtr(Iq=4kMURgHm{mjPdw}Hl5C_YGgn?8<Fa2OMr
zs6Ez}Oyo*?!6snte$hFj1N0@`7JK~riH6jLO~|PJDE<izIDR}Dqm|;qOnq9A@vp4f
z02u&YS;~mIbINEH@8XiD)NZAPIzJr>FkaLfERgS?+IZF|q(2FFW&~aAAvXp?xlXWT
zvkGlVeCe3KRAo(LeU@WxI@4hiVF587%*w6^80hrC2tob~8_R{;!SXMYozvO14la@3
zeW1)vIFy6nkKYxCWa!j}?hfTU?saeWc}f-dV6v6?q@{~W(><{PyPu1l>?(J9s(u6U
z(35+TETWaS6+*;oO1ZgBnDWcCyMJ^#_K%2Kq-BG-b-B#1uCek0$`DTj`wxwWjqUn`
zqWe$|B!pgi?DuH?4WH>=tnagg>|xhGVux!nptyO{t`#25?O>L1w#V$g^?id%ztZxc
z2#0*5qh2P6>@OD?&<`sqxuT=*?+-gmu<rwjuRKN|U!N<ed^&&cUNgFSX0KO6UEies
zdX}_t7bbM3@1DopBQz^E_)tyK_!`NG_gXD*k1omg2R}Fvx(e&$J=+UR3+bKgQkJjG
z5_8H-<Z7Z6Z#ou(b^V7r=i`kh>o@jgAKo*(H;NJh&)Op1`fuX>sYAQ$6y>G8rnq2d
z`-=s=drYU!43`xT@M~Syy5#k9PO<J?nT5|O0Zo||j}-m?jB?&rD6>uHJe<FY4I2lc
zi%J(hMRneD?2OgpSV12<hR4l&>{S<H{mHEdT5FK8$L@0Xft87Cjru1PsgRHMF1sg!
zW-sbLekl*z4egRgn5K%6GvmU4TQJ{Z5>FwA_V=z>^F0-K;>xJd0-5Y!|1lXBi`V|~
zUaCu6{<GZPvP^lf6Im;ai*&QmQpLF|-V<`Gz^g72esq|2&=rlfLUN5xBZtBa3)RNC
zs|iCPpLk_T?q<%k{hY@ZR81WAh*wiGL_dM?N$-^DoXMD1#|HNNi$qMEvoZwbMBbU|
z9w{}C{?`QL&6^TiZKG>X+BqUZ0p8Mle9z)@Bn(8_c0=VzON#{nnU!k@aLM9k_`zhx
z{Yg3+?fIFUtV!^Qp5EX27-O05%15*vR-iuEZUr{!MT_zC9_Rihg&U;#CE2C05`K)q
z#6L+#&YW_W;U_|E9DhuOuXuSd8nAu8X>zS!XpN%X@AjnylfKzpA!zbv=xYCzUhYcM
z*knPY2hQh749Y$H)pz%r^!)vMD}NdjTIwx!2b&Y1pR^FudH6p%rV+C#Hj(GEAl88i
z{x)83`}Q7de{bA$dQ|QWe*Dh4s&7I{+gtw$wa)b#*>~73kzHJVv<gRr58No5@)kX^
zXgVo)28}!DvD>#^n%yy6nvFGF@)95_JP%uFZ&?++yE<Pba)dfBkHgutnrGPy-{)6v
zxZpIvAa4$pOmY|0S+D@$bgGm^bO&l>{k)+J{oE6^Mk%EpFA+bXFd18IDpFp3)Eiyi
z`CB8Qico7(2l-P}>pJf*1BkG2FD%<NNvm<{1(2Z@QnUM~+X!aGkssC}cGzhHIx~t@
zKpgTRZnU|qmN_fYm8n0S!bW4sEGDI`S-0|PeSpLeJhz7?VqfuY1W#P)w-g*>BEE5z
z0mQP+HOBM3_8g>Xx-Rg<{dSgP1_Cd0NTyji;R-m*7ol+k&86&lV)}tOg9DAtxs0z&
zl@zP$4P>H6q-CgU_O4GrO8d=`Oi3}*!n5SUbXc~*NzBIP(L4Sy566$7iJe?RZrNnf
zRz++1=w=zQTzV?d@8VDL-hAaHw!@{iPvh5_R2*rYNI*Xhm0rt!z{;f#OF?7)MJT5H
z*Qj8H|K<L4j-#?q^NoFbdS{p^MQU>e)()#RGy!M%Hm)Mm{D*8`mk5-HJq)#fK-QS<
zF>o@$s+<+9XQ_-^?$zB;3HV-1gfmT-R?o-)P{#iiRQkI^UP&(-jsV)KQQNtSS26?9
zt^}4@R{^Ly{H3xJ%x`u6>RV0)S6Jx57R&a|@vp8bTL>lpWqMG}+xPO-CyLTNS{KS_
z{eBz0dWx*N#d#z5y=&Z_%S~?fJ9<`=dRoSJB-9-Prcm$0(6)`IuV6c<b9-Ta))*7Y
zP(u9t3bqApyVtnM^1VXMIR`ADWS@m0XA>3@lt|-){uz6+aCa*=ja~z_U9do}0BWl~
zE<R7YzVuENMGSNF?U4W_aAD%YVd$wcul<CwGofK2Ye`7T0R#}$S&%CUdCOj5eYFz?
zyMbIPto1!v+K>=<q_t~>YUC?{xn?~D0NCK!M48rEM-ObLVXBE~FTX&pdz+U=;j@q7
zW2W(>&GgG<IdL<=g<XSv$tDCk&15a9XAKs+(;a(B*~_7IXf|fAxg|p;*v1!BAK_im
zpWV@lHaJdvMRIbtZ^v}6Y;V<P3Yip&4YnD9g%iXlcV;+wLxvO|lHw_ZeqE_OBVOBE
z9zIub<<S<TC25C>NmG6EZ=VjwiG~KI_kLWj$QgMDs84Uwgd;>M2^+~jM=(hYqDuBK
zk(Y2KHHDwTVoqKfOgouvPK8xv=2V6H?y*xLT*6LKcuDhgpQR_yoQbOaYvbFwiy&-x
zsJ=_ckSW*`^F0ek%CI7AX>bdd8Woo!1Dx5}I(OiwQMF2I&DzFJ_*?EsVbk<JNqJ;K
zq9g2lTQJnD=l7b7W=?E{n1s#%(f|jg<Vm`?3ue9Nas>`|o|>AbX#du9Zn%o!QV1$Z
zWCN01pcevG?^t)etii4Zn`rO&7RX8(_0jKq;`4ORFEa*T`oLYOBsi0x(%af(;#GWB
zU7CNZM9zI+IC$bZcaC05OMaiPbTnGI;X!9%4t{HIzfxr8nKP6a98$ZJq;TqR)reEY
zDe_ap=5<O%EjHw(oMv^(@jWVzqp~QuT&#_`bprb8`|(P84l#7k9r%XfzgCabVltd}
z{s<S=wkFN>yge|YvXW84<3;+GuS#Q9-#t0v?oG$Tm@z|RW7s)X6F2kTu;He_@01E5
zUVSyYka$VT<BBhmtG4zUwXY+un1Tf|0u-Wj<wGj#zMpq-`V54eN7&$?c`*Zqg}f*o
zD+$T02)tmn1<8bntB$pf4Bd;`P?pn70Y17#C2Lst1uXMA7k`Td9<@ADBunmmX8(P(
zG0sH;8vxKRW6iJ}o=PEaQEzFumSvND%A#8<%C8#iu;hs6#Yz=Jxoynbb~8K9kABA8
zG@d8_d@3%5PxJTEqv|0S;O$PexBwfsL;dH*!-9*`_pw5~<YQPG1=%L^cM>ENdkdQP
zY2eknT8;I}M2X$HwxE7AbO7p&x}Vw(%SK5Y!gkzoGnNqV97%x6z0wWLyQy>abair)
z+q~e>)4(>y+_gM&|3AgvUlyHv8n1~8(g=vTrKpYBYKf(CP;4rx#*<^6t7thNj~1O2
zmL<(!Kca5j;@<F?3pcZI?pJ}XOi9IZrw3922q_ladWcbQ9sSj>yg5O-R9rIoRjt=-
zAT|>U-WYGl@6wC}Ki}0V8<UW)g^RaAv!hK?cV%p(Y`{UUlsLVL4eSeJ)8}L#7a5fU
zR~h6v{D^d379g>4Bm$=%a>w>e=yAak{A@seJ(^yxmf&v^(|id{Sd8=VCrdgqeuU)!
zbHa7U&X}&|Y~_AkSpn>8oN-R7;0TSnb$9<2csNLSvm>*9I^qnDX@7P7l5v|XhqA}#
zu{|59W^q~?uM68AX?cmBY*n+I@cl_Ij#epMT05cuxaYO??r1N#Vk*UWJ67-$ahsfe
zMcdff?U8(CQ15|=2mr%_8-pHtSu?u5qt{uJv!K;G+gW)k(JqV#S*eKH#>=pMKflJ(
z)?kXAjGW(afXJ1m9+Q)lZ$R-R>KcZdJ3l$2d;$6%@d`Q|Q8M`Jdq8!5De01Xk;P`c
z&MKRr%l(8;J3S?Ki;i`~wV6`{wzspgH#@!x?yjX5(llz40%)VTp@L`S^)6NNyR*4M
zEH1lKB$;cI^9AiqeEhnmHiJ>MJRE=79a*Op{3@^Zk?hnCiye&1t@NvtqXj_K-a0y}
zR@&H1)t>8zC|B+nXsoWluz5UjW`ihYa*GE>zQ$$#Qhrl4mDGZ6ZZB?cLj5Rr$$O-<
zn4qY2zf}&<s2eaKJ7BqsfQ8}3ha$AH3;+$nEv9+lM({)fy_SbV=cCOjtA7<_Kky%$
zbLtr{e))9_b879_f$dMh(k&g=Y57T)WUEaG9ic9Q8K+9VwsxVcHrK3kv{|zJXFgMV
zMS};gqu|}9oQm^fcR8F}JZPQBG~#OUpWj~o(jsrVX>4NZHhrE;ar`-Mbw2oI`py~C
zCx+vQe@*)4_s=<?k4||1dSZ0NukJ)uS_ZR4UsB|eQ#V!gM(LXy6ZhdT?rnTtQWY+d
ztr4DEgAO*<*5(932%nxSMSExqEZmK6uL{<YJk<}poq?PynXP4d2R#qQ^v^nNxHY$J
z{|b<rbNSSL=wTh;u}rT+lB)zXH1BnvcIl6ROrH2}G;&%XOWV^ogHUy<hl?QSaxF*n
zhwQ}(Be}cfUshAOV~!}~;O)gJtI3-3_A7m74WVr?Q;+~8cj}VSQ?n4{MlIRUYAGnZ
zDUkjPKu`Cpc<+$Nh-mgceC`?DC#7WF#Jfp%<8!{iA|*7p#Y5^!m6WXW+bXnW!Og3w
zjIBbDRc>CQ5EX%(+(vT@@5ew}Uax_MmfcFmQO_}erd2#N&Z8E%d1}_k1Iql#$YtZs
z0baF1eBJPxV1Z5r`lDB@)3dBs6w3<bC~+fepMC{o<4+%p;sb-2su;#$QNS?x;TJQr
z>z3VO{f>voYCKOxXGcXC-awNzzv#mU?LTEF*hV9x5OuO{A}^2Oj}e89MA&jHKWIp`
z*HV_64V%-^B2tAuUq&cjQ&OoaP7(vdR>yzLu(@5DeV$Ys)athQKybBmrDwppR<%oc
zzYH~vl5amm#X)M)*Zntsxs}Yux@E46h}Y8H8_269drvStlAmxD)llB(IadeYF-~BU
zofvUT^_MRJGRjrJLA#Rh7k*kisbK`b#MW}LX_v<eZ+r^x>E7G7&lFT_2@2Vyf7^FX
zd7pS=AsbRkz_;z$N|dGI9EiB(;AB;pkrLgfZQ!JgI2T7s*vJRe(x9oppzu`M^Ka$n
zOu+?qQWDvEg?g!s)mF4fzsX#Dl9DAYOfmVYlu9xB+gKqYA>vWDLG-?!5~LLU=JCqB
zk`_ZC2mG8HgYcB^6pX<%rI7Ij@ud#Xdj^8-?UrGx#lHlu%2{sv=#X6Zq@)$i(WX0O
zLaK;%-R+*1O|Qh}X^GA~9@~x2sTHfv8yj2Jbn0;99bRH;s~%59Pg1e+l-qPp=1Jl9
zk7^<0x{LF?I)=wRoF-4rJhvHia_4e|y{Ea}0}}I`jVaLEW3m8`=CaVxpBveVMvaUh
zkNvInpA}rq*fKjL@M+*J@S-XqT$xe>_rSYfp9W3~#(E*K=E=yQS6M$M8M77#)PAvM
zn?s(AN^TbVKk?`PZdP4e=1r0Q$R*KlS!eclfB9+U(R=+mo^dO3kHbovmjJ4-fOuff
z5$NWKTyJfHEfo1bv2@mB2Z7NICe*^&x?j$SBk+4lu-}&u(?CgC0n5fxQLfcg5jpqp
zFJpSje6$=`);emSFyB-x1#kTRBZ*GoBM<XTv#Ep&LV3*8w#z8_ZLC#93Y@F+*fd8{
zqkLpvCzZQ6TUd>%gGj!;IoEMB1b|WX!P~4|+mtVR9wxlz{2b!ip2;g8FgOT~epLb2
z0fk_Pe>s_4ob@ZlL|BA*<0FGjIXX9jKexjQpVIzo^S9l)U5fu#m>}xX9lJ{xE?nsA
zc#eu2mzg`Ug7$Ukp!1e){3c{0pjh>Z`M`7X*W4L*%Faj6l?Pt1n7OMpRwo`Pnv{Q9
z{Q|A8)-;8BQ-MY*&t=zlxAqpEPKB=2-C`b8n&$tRa@b(zC;&D(@=K@;2sv%K3f(C6
zt*ntBUU$v6+&?hGIhwuajg=5me9@XIt|}kMD7A-1izHK=yvmnfjE`L>Wz9KGWo!ob
zSda5sq799LW)HCHX$RwlUG8J(^iDOxofY@-B8#lqni08|Fr;rEFDh=49P+#{rfVwZ
zlub79S>{WH!qnP;HPi7|Qf3>zb!nr*9rkvnbiwq-MSehjso6u&_772t8&0Q>@C{Y>
zNYPzMoa1W5HK`hJ2RBH5c9UD0@h!RPtgwZ(f=FqnUgOSIti|Ygm%o?8C=JDF+vTgG
z&SY`)tBUuz^TpH9nPriTe2=FC<vhn2$BeL7lx`l&SSl?6cC=7(;l1oik?=s@F5%XX
zL<8(+1YMx#7b^5H9&F`U#cOVc)8#m&#Plus)m)#I)GP{>)%ZTbxqqKZ9=6!&kgVk*
zR4YH6KHOLR*!R*?xUf_aV)Asv3$2I_S_YP#zW>N@*OVbc;b;?M;ZB8h>j_Sd8}FQ1
zyNUZ$CL`XhyXi<mbzid^n!DuZ9=72nSl(E%RBr7q+-*Fk=KkEju(_QK!i9wdCGBWm
zRcJl<8HT8`vM}A($0wd-LB>78>-Tb`X1<B$a7}98wj94{PdTnM#Tv;OTevz16KDMJ
zz~~Fk(qT%`)&IuyX=kFngg#o(DMq!@^YQtm?2))=vUD;=esRB*0#JaYi<2!O@G90^
zNbgvdZQnQP=5bLmf5Slc;%=2$0Sa(uFr6d&G@v+{EDsATKu!gzys~@nk-9lcs=!}5
zq08AukNq|BLaW-@J~w(AGNnp0cB_g4#MW{C*-_|?m6l;?mG$vhiDhD~+(r{C3KQ0*
zeP5;Wnaz=FeK$!3*!Lv?;&=R#z?E%~mTBOoJGTN~^`br(ZG76w*2}D~N9}pX1dVQH
zK5gM~LuNO|pDEQ#y({Jh1DK-AZ6zTSK!?W0eb+$G(prJ86b8?V^<2C>wwvdnP-^|{
z5XM`MxN}fzd(Iprek+SNlWjC(3}Kave^AH5^{s`H?>B^Lvk-ueY60Z@UpyF^9BEvi
zHCoz|Kb3^Qed6jmt;%#3)`snFia0nrqJZ@S)X8HdjST|}04**0O~B3UB8zmw=fMH_
z1a#$2?L<^C-LTA9ND!5_Z9##B>}e(|nM?N69G0J1rbShCCRFZ?Cm$Ht^Hrzv5^KCi
zz?#$+T&haoJJkQs0w96!dgWW5?YU!*mUcwy2+{dBCi0?~U4(n5dFhPR;WGTozXi)@
zOqGt_aQ08Q3TGsj4I5gVw)-98VT*iJ?kcDj6|xsoSiQx+Qi;$|JpQ^$`5wJ26<s`Y
zgmteDJhe()R1|*3ci#evfTTH(g_SQ=0C-h&Tb{HklUavoFzipYY&mvcpB4S_fa4!w
z_x0O`=Zt7HPa;-KV}Lu{fvdldW!@nHcE(?QLKpUgs~3r){bM4V%faZj;u(Y`Y3Jug
z#(osa2b|Yj`6Q*p!v(=v_D}|j4S|oK>j;2TO7)Ug0A<pct+{PXQqM0b9X=tnRu(ta
z`lRwXt!G=Ngx0VM7&G01-ltBy!bq>O7GaI`$-cPI22vAtcfXEnPwj7b<9|^r|1d?g
z(;06iRAA>&FwSw?*Ij|W4B?}5s<?^#zE085DRm6{cx-O_9g8*}#86L?qhMhT%*xS|
zRx71%-n`PgH1r^GhsF9qjyG(VMC@mDnN9;>hqO~g#6?zn5_tjGceUG4wh5_e)-Dq|
zc%QNKYPZ{qaS3L%GGn&)84|I}d3trddMK_*RdCG!1*4Ow>*ivCSncl=$x>a8Hi>_N
z?-Qo2mPhnlQgvc6?Fm6iEN}7@0e;MEbt?3}%fH#*8Mm*M{8pYwr=c(N__4kS$L1mZ
zMX1Sr!fPqB5)oH{7omPyH3s{;-5bY-7FEdhiJI4-)+MN28rpvbcC;JE{{B#H4AXo5
zwG|_&BGNa*SKEQYt)ZT>@nu81@W^9$ryG4JtZ{n!i!rUf<GQhRn#~<&ZmN>l1BRNZ
z$>M51cp6fj(c}TvCR~+C&hdl&rP=sbPj8f?t8&4ttA_#;^1<fLLqvDMh${zQ2yb2&
zvHJ!B1FGI$pzGN<mPo6AWIJnU@$LL*D9oVlDsF0OJK#i1%8QW1z_?Q7TJ_pVL)1|1
z5?nX%I7}+o{K4AHWFk#D+<uW!!<5*o@$+NAXyGHpMHBCUx+`Ca)iO=bT8&m>jMeDP
z9?re%J7Zwp%_+riNww&4bD7z@kkn{Muod-v?YYGdj1h+BR;B0u1aJ50u~B<7=v-2c
z?y4*KX^xDvkh#-I$+=EKrU_x?cV}UIP9jOJaJxL6vbPZ^je1{R0ZGtf=Ohll=e~%1
za<UE4A&19~f{p>EiML8&yIgX=ws*(bwo9*|r%;7An>0%r$DLfS=po9B!Xf0baYwY-
z+zU<3j~+91)*YRljuVwXbi&e|T)p<|K}+-T<z2`mG*Vwxp)p)H2y`7V8#-{QmG%Oy
zHeq>uH26a{3Y2g~Hn|ijrVZLhW%IP92Hd^-9kIZ;K6RI9@_wampUVO)Un#qUri^_q
zL}OY52vKrE;sz4<P^U}{%z{NTq)ptx%Yqu`3{NZ$2W?^Vp2M`MnwXoqKFFe|ra;a2
z=?KHrZ%;e<!gpCyN%#&M|14ULakkix#W~RT@8e`-#)2>wh$(Sn#MJi$dQ(uRY1xVz
z6Ma+QtX1z^wdQM&v=5CD-)LN`S5}bk-(@@d5h-3;P3?AMkeO@$V#e0Ycs0IMgFj?V
z)X>E89$mo3=buIxU%9}KzE<8R%v}L3cS&_2g~W!-UCKY)RtaKM&5NBAv#x5!U4Mns
zTbB(inrf2+2y+13*(R4gD6bJe+^l%{5(9JA^-MBRVzRVajC`%*N8MF`9#FVtMcTe+
zw(s{n`%CjZ;pa{CTk4Cg$0Yw`-SV8Z^Uy{Hm0d8w1g7Vm%aDhfr?wiwjilq-LIT2-
z0WtgXtwN)l3F90%GLOyz+f*sSgYpNMufuhW0kr8xl6Q(vf1@pSpdM$(_7>2{^rP_A
zBtP`?8wwNtE<mNWEoCXcDiKQfk!~L&_t$yG1w$J@eOlT7=rJb>pM~{KRGh7<kZz|s
z3zme1_%nF1;r!1)5CH!T);sS2GTL1-ActR3k}zkT&4M@*BiK5+A*k0xO^k(P2(c|$
zpRu+LznARD>?TW*=rudBJXz{YIz&kRfl{*ku!l$b(A5=d+YlRnC$BEE95xkqf!D%E
z&OkW(m9RxYNk@SH#gO>)44E|;J)c-j%h>zkKIt)tl1jBm7(Da-k@HllVd;8(^C8dT
zXGZJBk4o1_+6wEj|5Exsu76T-1S$Q-ItSSt9wc7XZ{scaFnXHd;zw<PJfHveQ3Hh~
zDL5>b)pi~6;L$86zM`6%O3M?P_A_RPPfxPW$u}JRHaWjEWrk%-gFL4bTpAM%04w6X
zQumTagEXF?TRXST+dGbIDJ{jp1KFS~<!EN=InEzFL!Ec#Yl15ap^Ul%k^{r1cpFs&
z?%&@GYr_Ri>ZJr*C9v=G&B7}-i=vXN8|7s!0JeU&m%bQLkQd6x!4+Y^DDl8jWxY+C
z>k=f^aiQBvZ#S%%uUR$T?{26d+E4@ewERoeGK2tWyqM@Z)9E-m&uU>sLfSdTuco$q
zGJHxvL^nBwOx2%dle>ZlMD9WUmm7*I&$ENPVu#{@0+&M1&NyvNeKySuU%#CW@?hE@
z^Q}6PXm^w1+n#oe7iBx9mf)+Y#lEvuGj9EKP>4ErqpXQjbL)_7L0!)E6N=x-)zxZK
z$L>aqV91HM($aW2okP?W0pd2Q%xck5DCkhbUa3Vf4%5U8&CO`JRr0c~PQQ#wW`W3z
zo|h(UIXiCcay+MN^ZVmUUStYV-0XRfo%$jBqg36m1a?8!`hNWgl*T8Zf=amAE~>>Z
zD>Uh9!;#(wlnJ%nPV`D?QIU<zl_&aA`FF@n4JN5+O8<@(b}d**LwWnFP|HdH@0(H?
z&!9E7)UbY9rQ_YigyT-D$Fu%VLMD|0SwX1;=B>r}<Rwt%WIQ;FTUBPK2IM$i%)?4U
zEEHJu?a=o6z<38NV9*;@KpikZp(o>odPo8<N^JLTC^(e(m1IYawa(hW4I^HJJo0+K
zzTE{T5aWzHX?XHBdaK#$SyOY6b`|M!eia6RXT0J4;z_=zzc!%!TR)9V^dT)CVa_R4
zK%4?RHauA11m32ztKYkKV@Ocbuvqtt4t(ITsdMQ<2N_!N9Z}KQwC^|RxVjtSI5aT+
z5j{T!n(zdZ=0tEU7OW-V;e9*4qp5c}ZJkO;&N>($MXi%&f*hDAn7mwww%)asRZbBA
z6nVcnQho4mMcH2wjTb^GTHe;eRSYyL*BX8g?<^0;qLWKXKCrhi&=c=CXM!WAkBgyv
zmGZIQyL4esav38EbV<u!aPNDm9q)puJ}o~{wIlzpOvO;riTm085eB!Qr4=~WLu+HP
zftF|Lw5YLSzCL%zy68fll*%coEe1y9cu7-dYk6^ON9RFS>A?|0R6znxtRG*yc4&*5
z!SjsaI!3K(MWL@gY$C;;%l|j_-ZQGnX8QwG1Pc}{2ns?hFCtx}cPxlfRhkeW3PPlV
z^b!yeQK^c6bd+8~Cv>79L~4*0LLi|>2oNBU03qbYbI$8|^;rI&?p=2+zs-}(nrHT&
zU4DDd?0H)HHm&Lpywg7M>AG@_>+SG;o%n!3K3@vQ@$ByR7`*6=T}sy!ZO>8rK2rDW
z%Q)cKNF;ipbObV1;!6Fvls++H#NEE(@2+p0Mt&RenRd?#rdw3un-mzNn&=QU?@?V~
z)L?yckCtHxG2KYIrPqFCZY+5Uih0tO){qj=3f*5QR}r^KVVu~FZ}T>rUfQ6E$1Kq%
z0o3c4E_I4=exBc`hA_74tLJ4=plO0b4de5nHmiI)T_da!CWus@ku!0OFY=w03u!Wg
zL9LxH=qnv5)920(C!T%}lY8MV^v3q{6jf~D%m%nw_@c+)Y>f7p4Gi~+7#(q(*fTtN
z{fJpCu=mnau9kjbD_h>dC$G9^rQNoDOdPXoVtmf(aUAXymQy>X*ij08r<?Yn*Q#xf
z_}9Y6PZj1mj9vQHDkEIX;N3HJb4Ox&jCSe<bRQd#Iae?ZcB}P(ArG=4ll$)|;Msgt
zqZpMHyTEF@T3WjNF0WK8#pE>XP=rb|*$!RWHKS<!*?kAyFI&rR%E6{+8dV;*!iJ4a
z0`a8Ve;yrNtOb-i!DcTzrijYR7JS*&F1<U@ezhK^vJ>YO@)yXX0@1nQ!#K~6tdnA!
zby<$LHei{P*J!+{4s2gI%A+r(srs-N-SJ8ahTc*x5bC{!3wh#`fa=y}Nr|N0iEuMA
zZb^AA-Hk-$sMBrk+4~NGyTdEnUkB8SGSZ)m<!CQQbrss%4D$>96XY!;GqKA=-wrNO
zOoLwBb^ebTl!jMT>1S`}yP^tVv({?JX8DCF`f=L%kV@%F_Y;byEe&%YqXq~==;2Pt
zN-b}x?*~X^+ef&H*iBl`Tw+*_qs$CjTzf_(Saa?mYTr1Qf>F`AP8UDpYbu<glq%Sc
z;eoj6DWKhKn{}nfTSf)gKhtHSs4s=6<0vLrR}s1#1IxIOc`F${>W=Pi;S^jM%zEX+
z^8ER8J_!jRi^Yz=lpD$(=Z&pyzNtIk`(n&_L=qnb+3F_Z(j&dqj<zhqeNy_AU3dz-
zZ`IdxBr8?<<1Pva6}@aQYYg9(T#4X~pt%LWa>pKq_N`vYIrUVp&#ye?(T9{Svo}mt
z-1_e-atdy(Y-TI<N7YxbY*XUFy&^pCUv;|KB+MCWs8Rg<Fn?a!9lv{>+e%Y}C=D{w
z>u$4_5ufdu&qL&MwkyaC=+WEnMsk(PU+$FP&O42$m#>VwznZjhYsIe^NQwLCFSW}-
zUFwRbg?)}&@qU0Q2<X#=UMa9RQ-#xml)MS`5#_q&k#qNjMF080R+o7`L$i<t%qIzs
z<JvQ$Tbm(Q`!V*GN(7}qHigN_$+i?F-!G+pv!Pd3cjf!tuQB%24xoz&?QkCr@8z3f
zi`($qYVLJ<2_ZE|MD%XgQ>rTvQ$xP-zJt=S%o$!>Q1Ux4c<l0N;&9;;2a)KHDfM9w
zUy9+KW+9rT5}D^D^t2C{h@KKJIgG7HY}0r5KlG-MWWd3xIabJXD>Guh<~3*Ldk%rE
zH4zT84n7T-ON{EH{;2kijiwq8gC=u?4}>eZ(>U*meGj@S<<X?MOy5%;?)hBh9F5Yl
zjBEP|C(`zv?yKK-t4WP|YlV~Jz{1EGE87(G!5Cw%*zV?If<qYTl|`JIFNLd#el;hR
z4TN+`Qm0+cbVf+8ni^cYXCXGR`Q^xIU2cTEW3p8t{#;?v=Z4Q7f_<O2zp*`6SX}kk
zWJh1hkbD*Y<pvczvt{%F(@5Vjcir0lYR3?+p5YEH-TLL7jAJV0@)YoyZzQt&7IRN;
zFQ1%THChy*clt_Mave+Z$4XoVENw6T*1@%U7PqVd-p1FD-i;mZc1`1rpTvj(=TUFV
zG*?YwBAK7J_G#MR4tS*hB!}0eijSQ~^+aF2HMx#jftCmxsia}s!&m#n;~jY}hZ|j{
zz6~O5XztqRk9rF)?~cM>-*pST_4-urSr5+nw4lZft5~9pYzPx^{O+2ws|wZEQfb~n
z3dYOLeP*M7NVD<vlAtW%b90v%IJE29s#K!L-SK-uvbBUnF~0*{JM-mkK=ywg8d+VP
z9lH<Iu))chujHRn0}Fa+&7-0&CvF~7LfN}%r0%TDFS|VwGUVWFxnHsPQ_Ae+s`>=D
z0i4Uk&D!}2+bZ!k%~o|!_)G@Vo34GHPKoEbhWL%!V~;fn6P%K(>0xv6RA|4xK7g1a
zH^Rwd?{pt6g?A-%^YSNK_tzKZ+*vO~Dwlc?m75QJt}wiD@!Mcs^_}*^(E{$>q5n1t
zlELrpF^-abq$;xU7z3$1kCHEg2ViUjZhq$pM)k$|km<TNq(KonT|Cb<-%&+lWSJD#
z7B~pZdOLkn!@)dPGOshcEo!lyNfO5&u{<ysL-)F})6_Lc_xQ_ah~&SxK|VSwrujaO
zogd8wdPt9>zZCbJt-i{|m=%s$@cHw5OVHj7MhUK5v69&a$OWnib8KM)wNIl!<y_%L
zpdQ(zsT<z$_j2wmw#21M>7<89E_gTQDkqoLodiiYtOL;SVe#=tDVAuZ(K)@Kxv=ky
z9VZhrm^Lomd;LqkB5<0c8=cv3U==fr`W%VJ#2MMT`BJ-fJQ%PP$}mFio++4q-8l%d
z?KCLx>?WN8WtZ9sz*FBv0qGXZ*6t_4cm$EFNYDTF^x=+N!t6>^WqQhHWe0rv^e0kR
zq5q~bdc9fw!dA1)tbCZm?vu{18T7H`oyv3#8>p<?dTH-V+5ZgS8zwI4I+nG1wR=F(
zy=@A0f^0v}M;X3rg(7&{M*5JCro!u%I^*@ikerYapDoNGisC(wK+k`sTfQV-Y>%Fl
z1q$uw{!bPr4Z5e!#UWvs++}TC(k1R!a-hf2lW>m#pEpU3%5Qhfy~63LBJavAWXf2P
z6r4U{iTG=3E-z4l#-zM-Y6jzAyh`+HQOBz}H4@)jmi-d;=4Xhz*FsgPIxZK;ne^6D
zYPRN9Ld?}0u1HVNz-NDAXwj?fM&?GA5WS+^x*9LZ+%+1UQp`R?SFx82psbvF`m~(E
z%4UyQi}uS`d&Q_D)8gdyM!D}Kan$qZea~w#xK&n@?pD;7OA(}Oaz{*KX;yFEmbQUv
zG*q}xE;e=qaI2fi%x~;G(Rqp?v#RX}Z`b0}{5I`i1=qx0J=!sK_{h=IkebJ>kNrPA
z*i?NY;dtEhS^k%*Z^5Vv`;xh2dOEwKshCyp`r#LY!2P?DPMbw4>AdyHF7J2j75j#<
zY0Y~wva>ZGJa|xMW_06@YFTnVU+U8ibgZ9emGpml$_g{>sC^RZfAe3gPXL`<czW|K
z=zosAZr*%&utEjvzVV$ze!KJirE0WO^h;fNtK6w?jN<?H+r5^)t%-{|VU~^jr$7JS
zj{aiK2p&(F#P@o1zjAa}|4ZE~)ApJT3Z}ok_o4jw_6uN42Q=f%?vvd~OqMM=9&#g(
z)^XLsW&it{e@vokZ<HKCwDH34C^+eSjQL}d(!LzYXW#1S_oJ(7a;{Nv0LPiQ!Rf-t
z4z#qV=FGw0jb46*QRySHROqbzkEwm(@c%q^Pc!fCf>i@GLjIA({BJ(<AFVV#Rz^kf
zGtXeVOWz6a_m6?n{ET(%9JwX`_y=$NW)>nhACB5<)(M#&`QNF1({XpX9D^i>h1i}`
z-^l6r?`C9U?>}Q$I^ek3Sb|Bis=xmm`;nT<j1p**kqX!M|3m*bFX=pUuun02On7&>
zNMLE{g?MVO*oA<x!>vfMVtG&cNTr6BR(XZi_aWLh319}p^cYS>;JpHqIjgW4Oatp3
z0ApNE>E+E_``uZO@7LqxCFj`eZQB9N{$>?dw<zQgQT2?Bzpf*BM>6!Z!meC>QfqIy
z{ri`F$Be(<y}El2Tc&GGqbS)GZKvr?HIk4~IXTztcz$%7%|FMqJ;Jc2iTenLoR6%{
zg*ri{(j!g?a?-}^?c!N~vqY<VnENVsU=FFO{>9I)J5Y$Zf8%kmdlaclj)&vBX@39c
zclf010KcdQ*(gxTjwjG~gl>5@?8WHl$uC<$bLd3Az`*$o&s$>8BCNeE10c$uWqvi6
z(eQ2Wjh$W%B8V)~*-jPvPM<k5`CdKcLa7ZjChx6;ZBgAO(@b;^rXfN8SHmzw;|ase
zkWQW)4Sq-FIX+-cY*4AaddJX7SWqw)5AJ%I*=}S^z4bk+_)a9>u`_6UHOdnx&+InZ
zZ!Yf<#wZ+8xLD(<9R)E)FVEm{jA{>9NxK5EGxog=jZaeYga2;#?>Y3XcB*hP#zX?P
z)ew_a)zpG3EF*bGCKqO8+7{o~90uUfyFXz4N$x$>t_3BLSWhf6w1D=nvix6&e;Q*`
zZuta*R8<3mm<m*%CNggH4l08b6?I2$by8qJnIP>5oBf}Yo&PWpU+C^;sGj$MgNqkW
zo;;~4@BVzr>%+UP+<}d`xf5S%`F~B7h^liee%p32=0}fC#Fxqk!OF`!CJvoqB&35X
zYZzY}@){0_`2_`x_1Y5pa{7U&q(r%R^6c56Aq5GE_B@PGW@e_vfq>x>%U6&izu_#y
zC{G>#a_X9~6ws0BF5vzC`IrhqGO5Gk`qN6Mw-LXwXzz_vwlmiqlC|yIZC7d4Zqz;i
zRVc7B6A%!HiByTVgmO#&)tRUF8<A1nD|@!*0~4cSg#BqGQ8-<Ff1FyV(J`tLsmN$*
zP2dP$h3?CHR`|B0B6!@RM>|?zRaH6{EY{NGF_z!P6W>@j2J0Tu_Z&=Gh5PD6a-Va?
zqO;pl>Wxb+5u)kAMR3~9m3H%?O17BXxD+Rl+OKY2`XY>%Pj1`Ad~i|c<hgU#9P9k^
zlKjT+eRB8RvwL^c`=E_>h=k({$B~*rnVah0>BD!A?+!YLpATe2=I*SY)8>}+&VF=>
zMri8jq)g&DuOT8n9p=WAbWIFC{lD;?>tuJKnZit;K#P~usPlneb9wRd_9s&0rbL~%
z@5*GqRW*jlrmZt{LmDmz{?~0^-%0#8k1FgZWeFiN$)abz=lplmS0#P9p2Od@>vwc9
z`JZEmG@FyW*>|_leDmHfdKEa$c~Ta$InDS;@UPX3dGiLtLjkaEHNOXBVhl&V-YNHM
zsbbK!_J(0{RqAHkzT4~nZm}7U381u*Qw9n2auHIPoiro8S6trbDB8YNdgG??l$cp&
z>aR5XA&B*FRJy8kE-L9}c=)9<r3Xp7e@n74gJcyPWaD@G%k=l%Mu&dm8g{RhF-Q(*
zpsxH*Q<xJNVWxfAP1n=ES(k&0UkbFh{3tUDzk9i4;<oo_>-6a>zv9*xnHxoZ3H#O;
zdOevFRMUzVA2RHy<V8)%?@k_mE3V}ZU$7Q+t4D$PK<ztjx-amouAG`^?WV19@n~F=
zzp~D^{l7yp<%WT213qJ>GEAL(&Wm?m%#9?@kY)}a9{=m~>0$hY31&MVUuFxR6E;b-
z66aDm?2U&$m_D9e4s&#_{}ny&?s9$!lA8Qu4Iey`O7y5TwK1`kiL(kY&dDiQjw|%(
zN3!gVYx4#8&-OQvle^?d?8j9cUqK8Kp<u>&iB%L%_;@Yl7-VxXs4~M2^;jAMl7I4@
zV*dA0)sFL;u5KJ7-(^j>dgJ7d4O@Hmg!vZ}SGLX`98&IcsyV@lGG3@5Naw==NV3vv
z2cBOeL&mjt`|O6VIth>1$_JJQLZ;fD?wxfg&dbxVu3u^>0o}L}wU7HkG1hXZ=RnZT
zOyd#bD(4qkwF`p3LtYPeGn@_+^X#Fg5fLv>1rgZFw`!JU@-tm5)vsT>R$MX17Sr8*
z@R`x^@_5^)mP&NtU;E*A1`qFsn<?GCl=hwp<hL5+K38%CVd5T;_c$a3I07vwDE}P_
zc<mYs-WGWF&|sZa{yl4JZioE_O~=*M)FiLhLZL6-rM(;QXf+l4m56uSGY-N^b4&5t
zwlk$7*RiwMJ$h#ub12l;XM|TsN@~L|46Ld)LwcpOZwEcpWvcZg#z29d#}F%XXtNr3
z!g%kJgAKkR7gDfrFSi;j@GEiK#-zg-NN2C@Zpmw-?M2D1ohe>P0pLzvmk+z!ozbO7
zzucJh%K==wmiL|PJ{LGVtY}Qb_@wVwLfQ|#^AEQzssJcje7KRn7pbJ8$02HZPvqB-
zVAJejhjBmv)8~M6=7tUHLif$3Xh!AImdW*NPvfWyw9rqqw{I<~=gG$(v@wpKrbjBz
z6#ccr{VS_j%!vC;*!2%CYLAY-KfP{MV)+@HmUdFkcEuUTbwAxV)oYx+nvzmmfSs8e
z4^Nc-K~>K;E-2vW?qyU&uM;zu&|;JB-h#7d!&Eff9>$(to=zmT!MA8H)m%P29lK!h
z;rwp|dbEh?O7!MxS1<AEo>wt3?ZW_06NeKDE@1`~d>eUQ0s79~&lK!En~TWwB>oj}
z_6_k@i|~-|U2zKs%TeY!&M)U{7@^p)UHbqDXAd13!vcn%P)tiKGW%<}oszEJ8R$v-
zZinDoGxzjh(v*PeJN3Z4Ji&NUC)>bHgl_!(ep-F0+suQ|JEQNm|5hUY1rPl=ZrAw5
zyn6MD3&D4m9L2bm%g-?#%3ExS*U7g_mTxw37yK1P+rD7zod*|<M?>XsKtz(;rnq79
z^L$m+ZO_&VPYeGd%6tgldr)bK!vAoK`d6{X$ko>NcA1E046DHi5h3yoP@<`!i8aAO
z0hlcKYr+0E83)%K7yRsqM<Ntj^7LGG-y`Cj^erspHSU}Qh$(XZiiC$|CqFi*G92eD
z#~P_T*PS?u08$o4_|?>!pQt_{V*Q0LqJD|WkW3jcZ;!ho4CHZcu~SCnwtA9tBm3_{
zjCZG0r-gNy829OEq}A1#PIo4XNr1f2_tn{K{Dxhkx%$uU`h{KD#^mrNTLG-gU)d9A
z&Avte0b+;&YoBB-Z{ObKJw3z!m!xF*@uG)%zgU57Owh}WF$h(<rhH5yh9^smbZ4;8
ze682AI$iQ4x0z4rz|eX_(I4EJ`d?*RQ(_t7xiv+pdl>7s@Gm#0!?-|oXS|?bzUhhE
z|Lymq)_ow;%*@Qoq@-c{WLDOF_hGITlSkfkza$<&{oE7&$0s^mWz0OWI>wFpS9ayg
zTTMzC=;WW7!XHiLU%%a#U<mVn(rn)<+jp4aWcN!32!~D9HdXwRy$q>SO=R38hp~3#
z<N0*}z<|uL!VG-NhvO;S|2vX~!Wbk;y9&+h{<UT>?JmE^@ERiP3(kzh_isqD{*rr(
z2VPhIpOE7_+?>YuC0uCr46*y}yy5>aHc*;T008S8){y_DDf==r5e6pyKPN*OcyQXV
z=g{vE?EO~8dIFb6#)f`NQs-_4NfMPWBYwlBhpL(!jP?8@qJKp67plj|*Z;pLqKovo
zkzGmp{q?&RRalvNLN$)wxFURx%;9T+x<99sz<DHGJoYbTJ--ruu3CW>4!yavpV*~f
zw=IZfC8tiNv9qwN^?4%Sb#yIsNxu$8FZp7@@d|jX?{pF|eifp;J}(!yZ95b5?t>>)
zAO5SMU;5A)_7bd)`|nR*|NCzvhim(oeZN*_;D3Mmdw_rZa-)^05v`HJ13B}b!T<5!
ze}74{Wqw>{AQ7|k(!Xc$!%h!X`S$Jx3we92gnv8VZ+i#k9Xi-$*s0I8`x~OZ?X;aK
zM)+hBbQ1kZ=AV>*--$Wzs;VqdO3&uxKiKm>op%3W*jGvU!?3TC@<+n{R;@oO`PE?k
zv0+~={2!zL)dBwTl3$_2A6W4fU;Kd;e_+K|H1W0Ze}xrkkp8d_s%>Yx{jbME(C4MD
zd^Nn^H*!=14+-rrdS`AB5SQWHuY$OG?fWiY)sxXsW!cSu;dc(Z1%CBvKWGHbax!2z
z{RH=^U&8RCCmAsO;q`8ozp=s(d*^`|Fr4OU|M)8xe$>!^$cS5*&R*pFDmFiA<oGk<
zmQ`fQp~L?q>U#=qY-hwRtgo5Pe$`1eZG+`;+5evzrb=b~93-lr_O2=y(4t%DEsZL3
z51~X59cz0|&rC%YL8M!B*U!h^M~N27TF}&%<EJ*G5TH~J&fyDZQIjd$VgLnbKRl_^
zE>u;GRm-2AzBZPc(zWV9>W>S*ECVonL9;K=t5lQ{Fn_)1U$41y)mR<|DhqHU&e6>V
znr>eFv7Cu;EW)KLU(bcQG_A0yJmUv>$;b?5Du~n+wH~p|YI*#uY)E+dm9Z<UBX`(m
zj5XrsejeSxF?Y7`_Wf4%M|}`agjRE(+%=dyX6+|gxmZucq+6<yOLBE+n@{i-8!M3-
z<^%P5A%p&I@RxY~pNK(V>~7(jJ}6)P0}+Nua@-o7ssy+2$-tBBrlNV&cY`^5%Ah04
zmgM0zI3YEZuB;@W+}1czlWA1c<$}xwa^?}`R@;Lo+?-bcDPgs|DN*^p{+qsyXcKwt
zR|Ee|<J}`x#;E#TkT0Trql8JFzSZhASKV5&Fx%do7gXC%01p*by?M!IT{(2;&Z#tq
z&nBxs(gMbyX?zUfjlEwj&F^dnJM7RkjC_ml;jt()h<z5RvM!wB<?5rj)UxuqKl5^!
zNdq{HYdHNT6pW|`=vq^>;^p`aZ^Jb072oO#W9s$NDU-T7ov;H9#7s}i&2sdoGlVAj
zCZFauT5a=7&GL58OJ8l;byP;_Y}$gjUv**i#HI=n43xo<#_OPo7%{Y{$FY%3e3Sp;
zQnm}2W3w(sDN$ymwyWE`L<i>X=-P%)RaZ<<N+f4if+t(x_LPW{wug?LH7Y9PJ?JWV
zPtywn9Z5#V`_9Cg+qRkjlBfAQ^#p@_JR>S3(rc#3V1C4$T<Y|&hp>;d<H)+U&_Tcn
z2|n{=Ng;53S26a}8=4{kSz1!3=whw-Dmj%pgO|gH8_jZ~&jfJ`uZv4c1>^><?8EIL
zRVHXd?Bk@8hIxJ5ZT-l`_efYN>cR?CiejT>V;>0@hjxeHTN(f|Dq9{4v}v@bG{h+Z
z*rJsZLqKFulq24>3nxn)Gd(?6J0IVQCN^g8_ixEJRuBtIeW8FW0%zY2Xx_lZJtIP1
zt@`?e#Y;+Tco2@|gGsdmQ7Nl6CW`PTs(ZM>E)QgqH6j3%a@eLp+PK;&tizvwnG{v1
z3wMgNa>&MED$3-vaMk0thNp|?JTK4=M0TdolNNkQBW#w{_O;{plro%}-dMZ%x<~d>
zwqBsJrW?e1Ro4DO;oZw{@hiBnfpY?{wZ~??cR~B#PKO4e-H2QyBP1;65a*E}Te`rV
zjMU8jcR7x?NBPmu%jJx>!5X7@OZ2IH<HaQ20?(xZ?tRZC$Yy8c-EY4gsAeC9P<s&L
zFN8k|ifUSojf=sn9bF7sC-ypV>ka0?)*iXht8peW(md5#Z+w=i0EDh+z-fyA9gcC@
zYuvRbf8PZ#p`M6hUFzCEXu6P;EM4)QINRH0O=$Lg0M{i;xuC`nt6hYm5>tB+`vZ>D
zc0ji3a(5{2^Xt(nAB~Qh$03;}H6w4UY^<K+xdn12yslayl3+6;!;<vT$;$)J%}_kI
zb9fVjTh>bgtkN&?HKC)6{Lf;MVK2>GWPyrs0Qe2o1r90ic9g${!nuued=gKj)+4u^
z>JnKzo2|lMK*lR^rYbcac|6Cm?MyBN%xnlPcuOom?9Fp(TCM|IPT^J9_3*nEX8Z(a
ze7(kG2A=udNx0O#IfyqqRDJZ7K!N5Il3r^QW>T}H!g~#sS-hNsQ#r(@C?__l<Gx<1
z#nEH#-FLNmQ~^YJCq!%k5&b179&w!^A98)e+ftwFma$Wxh5|%7sKz*xB4<&a&H0i&
zE@Y7T$4+(V5p?28ebpL<(EQGx8|x>Kg4+S(<_&<j`I-7s3G2Ns7d^_`7O_kCf=B^V
zT8kVTd)E{jd8>_eX~N8?6COS;?TLACe}QdxSM9=j<ND_NEe!M+f>@`q<xpnMO~pD@
zS;MOqqbkxZlj(+%`D15AH3D9Dzq}>$+M%_+knd|q^KGN^P)>4^6#f9};A^q--feTT
z%c#g#D^;YirKLm#bExM6KS~KG_F9`WvzU?tQaW+uY*(JAZo_yaB~s*g$25`N70iY(
zL&Brsij=UA6^6;216dwLkVR-?b@`A4pu=OPRR2Wf#K*?!mILOkhLN$X*1bvs&RbLa
z#U#CaO+>sFS=cz3YHBzeVxW17lZ_z{gaCw;+GVT^_de_13V!pYdz%|%)GQWugV?*7
za$aRv)bU(r|Cn*N*L`V_J3~)KB*e7CNshUI)0J*p&s8LN04c#A7=P%~ePDv*T>*ZA
zJ#8KOvxR9XMhZk6yRhfX;0i7y<LG;YwFAelvKg%3^$9E`j)FJT!4rBs&q3mDUB^LJ
zc-rIg0bcp%i2@&R($v;CZeHHFL^%5^yyg-(lh}L_uX4<$!Xx(q5O%ss_H`$SG@jo(
zo+Fg{v`NfI7Gyw>8i_VM7AHtiR+7_TDVrHm!EKmiRNFgV7wRK0ss#{~8?Z)dBB#nr
zVDreZG;l)xy}ezIZS?nW=ijR}%kV&i=UzDbKsM#q(Y4Z0Ccl+Bp78~c{Sl0#VwE%f
zDBX*%(&9Ym1yf$Y2<S-E*5o^>i4=*-@LgS4<%kjA)lDlt5S`Rm>oU-fobJlJgMWKQ
z<|(2JcPgdke)ihB45}46t;HYN)i}Os*fK*Cp!OA*EAsEv0sBkJ7$5{>6ytog>6>#8
zr8Ekcg-y@XPeL;`4LPo5IbVob5pKuP??ihoH}Xt8Np(DQd6#EoUF#;0Rm^5;@)X=B
z=b&|#FWq@FtJ*h!PSbuXdqr7zZ{BlF)+A&DEDLTEW53)$TM<LNs6`d{)op@`KB%KP
zdZz?!gp(C2BZVR`vNG!Y5Qy9R^-dRw)3mw8%&CbQfD^9_IN!u`*loR0oj#8p8XI}k
z1$y&-?j*~cx}QT#6+I5qd>PNUnG%;htw3sgZBu>p?aW4bGf@IQBtYS5#nD%J)F)?o
z+ZQx3_hk&aw(y$4M{8}Y7Nk^$gn8w_)FfY9p&0h8tn*3$R!?Ms&bbZVRF8=|gKV3`
zF_L4!o_Sr-n(3yw+7*(W?X+|S1doIt&P_#G7t&%AQ7HDE*&->LF>azz!!48m5Z`cQ
zeJj(B7~p5IK;4)(GkO*P#>K6eX$skrro<w{kbnUn?NeSGN(u_Vl0<*xEeySk)D~>l
zL$nxbtIK`aK*6nbo(U#GHX1TuJ!=bXE%A?L^;3LYG?F$@T<KXuB9!%(M`-hUc{NL9
zwumRFT>Zxgu3v-!>lfA?RzD@jI;bZYZqE|APIWUA)ES0Un4}t?c!f=YwzS6q<`e|U
zL(a|%-qAKxOp%kc<N>se`R5pT)|wPlv?ER^VnmiwfGN*>;L~C6V>m~l<gE{vtJyaQ
zrz&x;6c=>?k0xH~58YBaTWNA0x}ar+6>RZeZ|8<+3!Nef$x!cMGR>pHA@g&_Wj2}9
zPv@#r12(WN!HcDimy7C27afDadBhh=wWLkqJ3RG%k;C;f-o?4l&AfJYNsij1yY8>g
zhelH#pvj03hl)$54(d+SPE>PE)Ie@WQQ(Sh^TTD%y(i{j*t9`W%xO8$tpHt&uYOoZ
zikW=5Q=IHrzSKpRSxpmxB(c5n0qfLWyCI(q46x{!0JAo7Q0ac}o06X51bj&YS*Iz#
zFcf3cwN&BR@S;|@lN6)w_<FBjuct^gptkAhaG6#wi@-5R!8yqhtK{v~X_CpBftIY9
zVs-N|m(l|Ic=MYdrX=^ym|h2726=R}xM-1S+V5R$ed8H)=VpK#7b=^Jhg~-Cxh2G-
z5ut3io^Iqj6(nLT<RJVH9PVL6@$J@x15eL1lv+5}&aIeH9m&Vnm#sg|V*SjvR>SNU
z;1_JGhX<x?d`Ht^z+A&^sVxKg-n0?6@fZ|7xQe@|UrYxF4sSH<o{6u4%ey6CYsuYI
z+Pl(Adc^5&Bm7z$QjPBuLnw3iZ;rixyO4_f@m^5i>|sX4i1HI%{$yW2R9c~22FxZ0
z_dCyg_%Ktp7Z38YG`|+zn6X3p_^liy;6zfe!~U3TM8{seUcr`|K?D^sw>Wp(l**01
zO=N3j3{%HSShs#*!+eDaa5bgesB^Y`b9H~cvdR{%G52yMkGWHY1M7azHp88<g2*ta
zvDF$>_=KiTb0(sPXFO{D31?o4cmCO@?U72sH3~&aY0lbPqp#-BSvFD@8|Z@1@wMxu
zy`&oKbBOIo!&IIWX34Q^>!As7clJ{D(f8{YNa+dA(kf3_;^BV27%SviDA2>S$QsM9
zMa@~5Vev_Qw6r<<c^(BgX5%;;YledE$xS_OM5@1rN`A=_wf^7|*>8F?wrK`k5@N3`
z86ZeWctn#bi`t6n#IqpRqivdJxQ&a~moXB{2I5Qg3AoHlRvzbVGnH32s`@{3<@2EO
zXvyevwaOrCE8u}RL4orlHTOkHs1p@t+QrnlL@C^-&GnihBs)tR)e24$7!?&2n8S)v
zd8age%opDZYqOMvmWnBd{@6`49Am0D@>Z<nb$F>3lg-pUDjy+3#29m?^k~4$dVa2-
zd;k*FN(|5+T=w+hD2C++09U#Uv02gt$NifN9g(iUk6Gj%k{W8QOQq*-&{XnURavuF
zhJz`kxP+zox$5NH$)L*e=Pq}O5)8tsqr*2zb3mz6rX~WwybObkOpT>HL<}{q!TR1!
zNR2Xdw?DW=J-DPuF#`-eFG-h6E`2BjwHNlh?s`*3i*Q2{r&LCAZ|^~~Vrs1J;>B>-
z2TBT4Y<r8E;-K*%$YttY&Mwix_q}R?<Ef4isUBTRzRsI2$6;D=*MNKJTd75T8=|Q&
zdIBF_Y=r8;QMa}FV$af=U9V+F6@}H+eAw|aqP`ZD8gf8$U~@zpDO%Aq#lAaRCF&!c
z_m!<@v+%V-1<Fj#7W%{_5t4g+Y)(%t;Fa^F8l!4C$HZL^+=UUWH?$I}Khyy`TwuND
zn}G0d=BM2ZOrW#CKeZ?QRqV_}>{zSnR>j#9`k!c27FGmhxQ#GkcWF28)(y646(iW%
zWR1{DUgebYP((GKmBpvF4lJoM1?n3>=~|_x79Njt2uKuz)FLr3X}U7q#8kzxt&YI2
zRkUZzr*98>nPRYECpRq?USdWL2z^`E-$=w1%*B_wYmOK+*z}WTjYo|cpMMzzmW)Ia
z!$O^W1bEwFnL5bQ&N%icv4~Q)<d~6W$TiFBe6&MqJ_lSar=Xs;4U}-kO<!>VXWh0S
zcJ*gTU!q}5%0^w#fZ)3Lm*jvny)~H+nfuqbnDJ|HyI1he)ZC-C>LN8JA$F*<pX;qA
zV4RK+>lqTD_!c}NCd)2t?ug28#WXr=-R?Q4*Hw`aiyK}tsgHS-J-l{lbD`LsU_LZT
zeGybM)mY~CJ`pW(&&Z_Ey5D*$tNc=xzOnoI!qVg>*ez>R3R+kI#3lefW^EYYcX>C3
zDqG%yjVwHRb!)o`%+9ex^pK$FHLCWAUc|cHtVEl4gO?Sl0aJL)y^^JnYFtlX&av4}
zw2@H;5lY#s%)N1mF85&&7nkdpwUn)FFslKf0A_C=?Qp&BDojHjqK@r=Nn`OVzI*YU
z{qOsBHXu?vXo{4ik-o@s122;p>}_K?DlZ;R$%a@aAG@_8Jba6?zcuAh{kgWYXEs`1
z)D|W9TDx9OrEIQIEPRp;*7lp_r~EB8-#KPUBUM?9sQ^mkm1<ms=5%9{XW7vVr|{H6
z5~X*}E2WoLWq>_nhis*kQY&x|%q)5)*(}EU(Bif?W*lCGVg!|SkPCHlL@|6`Pi#T^
z%FGvp{yZclg}u@WBPQd?GH;8<Pq#-q=|mQV<-wQ94V+n%V!5mGKG%xYNSg_WQt-GV
ztnETYSGLTTSo%ig^s<sGqS-QlJe9lTPY&y@L8?NO_C5#ryJIE1WsYJ0m4t9xxKUQW
z7^JHkv9hnXJlUav5jdA+xNrH%fkF|*CrL(K4U*YVsj@qgpdP_FDGkL5*?@*V0*;p(
zU{iSOIx;@_Rj2NTd8+3K>4jn6fzQTeEUW27{T=IZ12X`)vRkr=Hpeb<g--c$Vjuk$
zJRNBrXw^_4U0}3T{2o<NN~B4VkXg_Upe_1N(_U{2XAY)p@J*qwg86OZ&dt4&4Rba(
zDJ^(|ig#Q>E23dU1ZtpwLn}r=QPI=?p-ENF=Q}Hl-jpn7%0>v{XmY&g8cH33s6h-L
zrY2ETO=<6d!6cib6S_sY>je{JQ;{wK)_4Bo>}<;c^;C{Rr@52x1SzxVl*=3A7zsPG
ztu;a~tB{>t@<(iexQe~@>Wp!QP4hjM>kej&P%k)d{GoH_QM+N$s`;2kshN}2JdpJX
zmzLDjR+?683Nlf{NBVw4#+^kRDRq0&tn$WW*;+Hsye-xIuObFs+1p#q_q_3QcA08j
zb*3(PZenwwUIr&2-O?AI-`7Pqr)k-*GzB2uz`Z4(?-*cDN%iP23yze>M^#MtqFFor
z<d%l;%OTaMaR<L%TlDzLX>!f3*#J~%kxl0WZdg3akYvL`jx58)`5o^M>-OnemI~;0
zUeFe6nVYM<ZK~XXCAziLm#iWeo}Vf5I=zg;xpijPuP!hSA|9HFlxF`)y7-0&Q$?Jp
zVS7$k`e~K}!*17x*B94JaSPrn^J}S*D&Y=gBBpWXc@R@7u4Jh%G}9<Ki@Tv@iq*x)
zLzk6Hmp0M6)b=4B{T$_A4dd-H1Z;`=nu7(!!s0nX>?<r5WNEIw6Gz75<EEh&rgyJJ
z4*I4~ow4$$b&?WxtRsXEyGkH85TPzTy!o69HlOd@$BCBslaq$jr*|cXq)_h6m8?gZ
zE^Z7dl#QbTyi48yUGL5qRUSJmLj&6{BwX$aI8Pq7zrTRxN9aVthh>VClZU~HN9~{y
zN}EDW6AOsxaN33f_Ngbhqt&58fsn2{KCRCGA#uWba!4z1yoR)6v0TF=M!4I5soz^j
zA`(7XQuQDcD{gxqS;bEXFbS?Z*Z!yr*SJzLpn<p7oB?gpnr|1X<7F2$FWW*-i>@9=
zKpgsIm!9*xW|L{_kfmfZ^=W%tXG-!W5q!28zK}}UwQc5jNjp&{ulvJs<8ARET0O<c
z@aZ91P0Mq%#<X1-BLUaa>xmz*Z}!-VFXx8#@rxz|P+}_UId=Gp@Yq?oN_w>IT0;2Z
z?9b1M`P~uX-CQ3)S<H6Gp;?#w8At~0qDQVxG)&5VnG#$}lHZZAxpJ{y0TGcX3ZT~!
zp~D^@6_WjRPmuZz9^}`8I$<)pa7rs*Ou5>F)Iw4UIPuZUh)%5xg&N;wMoRCr=nu?H
zMJIOsOk>lajGYWjo0h>v6;v1OqS6c@eS+>!*LRc@$Z6Y^oO@cSsniug4ld5}`Zyz(
z#u?xlBs)2`>p?$iWXUHZwPs3)d;fEXX(yQ^L-CXZ=(*0gXo}ex&W<b!Vy^hX@W$d}
z(=`&R78f=$0638zYPdc{6!6!^l%~*E8AX(33+=)B0KfD6g_}n6{lSR^BPv_e4<E)c
ztOykhWcBq+mi!q%pPe(Ae1@z}_3zVU@5ULhQZj<dwOy75>7<X3uc<WiIiNN}3!DVJ
zy5a!D5|a~AETQW!9}!lf+c*epVdCiLAN&Sm;aL^tocFdkU}E((ZckUj#{Fbd8(Z`T
zKqa2h7jcDz17SAk%`E6sy+I#GvPs_N=Z8|I?>w=BQ{|7O0Yh1f%b(|sx<+0;T8^gh
z90jQm;MEj<D_pC#;R3f!EuLNW0MD=zXK^;MH&V>EZU8Y^Nh&m`-i<AgEC7djPt;ef
z!Y3Z6xT`EzsyiN}O-I%)RM!x7N9^?LDDU~Ji4c?Zt#nPhNO7}N>K1REVFs>5|7-*0
z=Bd}(#8h6Yd9-V6q27-+a=vUuW$qmusOkadFm0et0Y4d<%CjpW%c~mtTtfKlaJ3kp
zpz#pn8!?Uf;}>kFlwDR!xYe_T@7d=RL_=BYCtrtKd|+Kobw~39-^2|m+0j1*Kje4V
zo&;*HB3YwZQEwe?_mUhVads7r>d9UPogUEOw!^z-(A9BP@B3=<QT|wa);OKPfN<H9
zK%OKqo>*ZGjj}fOo@CE%lM+;%(Z}GM>x3S=ngIH|VaEpC`VGAq-#Zup>3j0RkUk(H
z@UU(=Kqfp~eI?gjFr4yyLOLRlR?9J~w=KocEu|Wl5L{EUt1}r_<C-`mU=Zg7&m^Jr
zeb+rmMU1F)W<4g(&yIF2(9^~Ht{(~3s^mtxTP>%JgVyjtHFQWNy0F6vAe|1Fd{^8N
zvbj=^Cm(2lcSy)%t*6dTZ@2F!I6in|M!{viByqBFd9z|h3IgZ>aG5Tu5IFKMsCDI|
zI+89o+A?$HcoU#&+W7{0vZkgz6#OHi{XskFrI3Bilnn8dRF<L{-?$co$_y3us)fg$
zwlx2&qm}F4nyJ-IpSRqd>;|Yyz1A{>np>Rp=N+xxI<{_KIrS5iH^qLR;%(T5z5{e5
ztcyFLX18pGr0N~OQ0_V#nCcL01)2-E>Ju@QhSfx|mL~LmT(RfFV$g>9xx&2;xt}pm
zJ*Yu?r;X*^qU#VZ8Q&Jdt$9pyl(Lz|lf3<qt6Y@FGi4Jrv}?LL2RmCEtZY82qBrSf
zO1qpK#=O#!BY_Q=r5O!e$&&7Mbq7N>ua_AqNM{4~x^})zfv-R`FOKvW->K26^akRk
zE9q#cxSa2n%>&(w6YtEE?Hm+FhCLE$7NV<D!N|(wcxqV8hC6T)hhMQD8PVO+Eld<R
zrc8bKsd{2%4rNm|eTCA+W1%WdK78Cu@3K&muB8^dvbW4&-mI+pT5Pf=Gi;sP`W_r$
z6YS!z=Frd}S2W}O4p}cRb=3-}UX%dUalC$9#ofbkFBvL*>@_v$dF(L3<R=cX`!!=v
z^qRUX@bOsGwm`90s+Y&?foj*@FMNUrTu9-OkW$|AatsZ5@dzDFIS~`wV~B(uL+<|;
z*!+zoyVD-h`>QW<@qf|AG$?Dvjn(BQlwJM^%IU{%&$$&i#KsKmxyZ%w!)@KKTFp`U
zFs3Zjcc-5+qo1H^8iafvEov6qwwhr_PBIGq38X!E4*n3_#S!l_ZGY&=<sVPsKbsnD
zf_H!ur4MYwem2y<`(-k=b2H8QezGO_9~#mM7`tnK#`+=^fB5xBCce*E{E>-2GVw<y
ze(XV2|M-rtjQL|H{@95>cH*l#eB1bAC%*FI{|h@YuZ+|%2HNik*N$JkzBv(}yEOd@
zEv}@Hvh{x0ONAQ0{yu5#ysx&^jOctiFfQ}0I(bNl<~D!uGSwp@dEoOANSWnNgO-0s
z8X||*8XuRftCC^a*&p(qy24n(GcXmQ$CS%~_O;faiw>F%Ha|U0^MyByESxzT&g2aQ
z?in}0o8KH_X`QdNx_EcQ0=YjnbOdFdWiW&~_a77UcLeus=-q$nM#b2i15!71uOme0
ztZqvEHS0VOJagjnd|aehQIFjVzZABgh3o%XpEQR(`ew4!4?u~Dl|*cq45HISSfZpc
zs&FZYC#1y(J%C{S<qVjYnGB9}b<tKxYv@j=4^TFpu1JTH21od(2QK5HO>diCqA%MX
z{bgj=u*hU^s4F6weAAB@S@dCT4?w@~v8YOpW>P)<>9K)qJ+)O$@Yg`|M~&MnOb*IP
z+Q?WMy5Dj<S}s+@r{3DnA|x~RY3f|P#hh%OlSE-*fo6)=a<13n`w)}9T#xzKr-3^*
z5K*Vv@%}!m%loh#+hb?OjX)3)M=E8W4+yl1c~R0I3w))R{qpA_XWA<BP^Eb<6tj$Q
zRf*KwGMB>~laU-^=c3~Ph!2;!JD&oGl9FEz*1gdbD%@H^q(1FM%DTSU=+D%Q8*~m@
zomiWI1M;CYZI>#hrl<FY9Vgiaxq6Onr|tnK>dt8VlyRzP=AnDCi7;{H@#k?C%adrU
zp!@Sr99vU@sgv9i6OBPeTbCSMH{b69d`R{jNv6t85_UDaApFG&vK%%r(yr4TUNcih
z8s@TT0q|q8&Uac}1?~3Mt@N~uyABi##h`2XVsD=w;HtM?sKB-g7LML*j<&o1RinRY
zbf5h)6>4ZegoECD`>n+DHa#IOWD(1Ww>u2Gj395!i`Hm>@fw0t7@>&fT2MXB1<EO@
zbSoBkJ>p)eq=}WjxBh<VT>w$QTgS>FFj_}hWTBq8H55a_(Kg<aCh|ce)sxk>(8-%n
z2|Lqo-uzV=x(%6!x_E0zYGO6Meu~R;<*;#JQ7W5~gh<b^h8#X<hSG8^;=>%;0o?DJ
z+1bAf;CI``%r=^~{&^x2a}N&8?^QI>G_3vc;Hqg?)3k%jD0R!`rrw0A1Z?G}bjc^R
zAfKXevj12uZG+qCgE3subBw!(=@+^ZDE(KrHB8Fie>}vc5dexnsyJP)+3zM5KE`iU
zf0#4Cx8gQLHEw5N-sbGe=HU1RhoKcO0@P(`r5E|(RjyvBZa?FrTApz&T?)k4z6;>`
zXu%(;!hf<QyY=6wChh@8!hN(l*4N7N;vYq-Y)I<V&xBV^FZN?5Uk{kuxt;LUnr9qw
zh|*PF|7&X*l{lWwpTcg#J@KTio`U61a@eh|^mBSt`}dSTb0$0K)^kUnHNd$_gBbQ}
zcw@M4&~a7SV6}O+`_1LKdK9m?^XS7t-_#vkCorL64f@1k10xW3Z&rUmmNS(+KQS6~
z;AvN~0;-lDwA81ki=fdVC+V;O0;|xzP#zer&~PNbsDYyrOD3AQugh@T7yB1fF37J}
zF1-t4Yaa2$9hqne58ZPF8=(x@_+Xn4J$&YB*wfVkApg!4BB;vaA{(#I=NDdcO9<D>
zNPx<l_trgmlcD~ri6;2ULBF!wkkx+Mekn@lnMg%0#@$jzckPvY$xjUojrp!doH%4x
zRAIP}M?RxkyT4X6m{f`L2iI*3*}Z6aWoQ^cMuR^U;U0*4Ev6k)_Vco@?KC<Kv6gEa
zu6CWM<OJQiZ#y?w5<F3}OJ>;FvW~h?8$9bz+i2#kB^r9+2H(3Pl>l_e==<T<XSH4*
zjOK?QsrRL{HIR0s2hjaXX0kwSw6Tk|9`jswS?^t2Kabg)_jpP|a4nI5RBFKio*_iq
z#h}vEz-r=fLOLqU!00&ojzVZ#`uhX2KRJ@myu0sk&YCm1%zp1^sH1njVRrsZXOR;C
zfGHT@kG);IFZ-=PLwRdU3C#oZL8LPFfNHAuG}?y-pM2Rq9wS~fkgt36%+&&RphLA<
zt84CZD}QQ)gulOGD@kF#>T<oahZb3GzZpIKi2v)oU_C&j(!!e8Qs&0R<$2Fx<Fx__
z9TmO<ig)0*yU&YCtuR)v1&vPv-7hN%s-Z3P)_R6Ep(VG{BiH>EV;nA<RSw6nd|F?I
zBLY+o(8+gSFfC8VvNxLhH^;naB)1sq;xQNpl-aniI?r(-sH7sOLbb>h?>{t}G~lop
zxC_wL0T9*qoaxE@<SfmSC4<|HteRWKA&%%O8&nnby^jYc9}(Ke%@M-u<9xzxbgN|Y
zrDkkRf%!<1oa;D|z6LgR`{cy6sq{2w#?|&tzKBd@6C2&ozV6eL)ge3WNFPAfqo28i
z`?u~qJ6m+SgVU70rm%!vkqfQngi@BAz{nnL%YuQ@7Or%z6GMZ-?-G@KJ%aF@lxGad
zP=Vo=^7(?$H4ud{b(QcP2R41m9(}B#h(=HZ+^{bA5sjT??o<*9w0WVShQKRs)%L0;
zTcZI^SfGE1t3;m?tzKES_T5}{l0k3)9gd*PJukOPb9zn{7?+I$amp7ONF(Wq`>aV2
z2rXP@oL_}zJXedmh;E~|uFviS^{#R|m8zXst)Jl9V@<%NJX%qr42gMySfhUGx6>Z5
z2+AiVOHfEvlVq2ee50%sGap3NHA`qqPlX-oYKWBUbiq}mSYfnYmR7ivA8C;TvKg>Y
zE#|*U2nD(!$E(&DcTPQb0{Gu63+nAdl-H2Udjme*^AxL}doH_}b{W{`;gXKvr8LPB
z;_&Q7BIF77f`z(v)HtYexJDIn9RqNx9no1Le|WYZOK(YZYH_TcKYD~;+jcP_OJ{g3
z4&Kt5orLYP>iWr<`0Y%gH`CrWp@jg9TN(1LNhD>+P|}y_zl3!;6s*kj)|T{!&JPny
z=VKDfc$`KKqy)TIdts<*_@H|03H*vl#c<DqkyV+N^vF)%vyQpGy%Mf;A~^e%eE-`T
zQWyN(LhGXijdM19v*L)YG&Lb(%~b^@{<V*1A{oaZ25(I<Y<iemXJc%+iCl2`PXX4A
zc&4K~UDyqM66_{aYbbU#j|-7tcmm5HPinU~!)tc>bAW@w^+%t%BI}Epd<{}WlU-Wk
z`M49rEv-+)JFH{$jjbj>4&I@yo>szDlq`2T@f_;S)^(bDsrF!@O^D7;vBm&p3^&L#
zM-uJpZid|-_pWABS-uY|-Kbnm(75Zbm;XQy6T<tzd2?|WqGbT+U|bYF{@ktz+5vqN
zO8xx$CtBcllV!+g_8pE<h|&@Plmuc6B@2LaFl=cFws=9j3XEV>BaP2f@E;~D!5_3E
zb)SJj{zd)qJ-7M6mga?+ThJ}z(D5BD;oJb6!ba6qqtu8K)yr=`w_OToxwvZqK!8^2
z_-%edh>y)zP7IT{*g$}Qy0QMuaQEp!%LY!w35fo}OGN3>yjp*UqL*>m=NEJN0lDsl
zW*a@Cs%X#DdW(s0nXp2$nwIvWy2G62D~VU}!YpB_0bAZ=g<DjTD15x_YUQNT;zQcF
zI{yj4NUdl4>V=9IhT~f+AEGt<%}px&NI3fOT>v-L(5wBqdWd860lQ#dGKN07v#H;;
zOId<E<VtC*a7Vn_Sd2arU?>Zsoa}63!KWTcbZW2}(;uo?Tbl@ApOGuh)EFXfJZ*v>
z<&k$gm*hV^1Kx|sJmA<c({dX;UtycPfl#5x`0jLswyit$NVgFi6!>C|vz%V_ruTt!
ze|!p);j>N7-Y6NHgCe!<(APK?XO$|s4kDanGO!~-zV2b~>tmmpsf!(n8&MJWcO@mR
z77BPaJD^{)4dsBU6CGm6=KfY%!*tv(+X@=im)MMP(hcJ@_Y&_JsMd~wP)2HVH94s3
zx84sf)DmNrF1z7hzOk5f9=fnL5sANoh!9~L+PnR3@?x3jm9d%{ev`$m7DCap{W7L-
z#uqU#esbhtOUj^Y5shmk!Fzeq^DPKI#Y&laG(ad6t1I$#9xhQwlrYYOCX?{D=oGA7
z<n6n`cS{J4zSH@3_2!V(3Xua~y&WPYHgiJ?3sw1s0nc$6F>udee@)SCB87l%c);dZ
zTl+*>5Sz&H?yPr|1}dHVi_02=wWO%kl1<VHj6?P<$sWU}Jg_z)YgCmjgZumeQI{rM
zCJ>w(1B1s%lt~cqfx{MW(NEyuLsb%spmb8b>!HVGA;b%k4NI9@+P0Z?8>^oW(kTdW
zZS&gmoEhSkG0xJ#TE4{IQiJejX&QAkRHSmSt}1UlLU(f}Qe&rO(~|??(Yo^D5!9`v
z{bX-HjtFSgIP3lt&@jKhTO*qtOWFEXM)zt)v_ID_Ubp)Vd04_=iKSg|nXVE|D+pPv
zjX4Hb9XT^w@uKLq(}=qToko790&>@G$Xnc)b4B7WjURooU#L%{EvN-HsZ2?d*gFOu
zQO<lw3hUJk-!GkKd=u!`iQ6JmOvdb&1c$~6JxdG+c@(KkH4Wpc@EOr_nHKAMnjRs4
z0k}HM$G8lU%dFM|T5-A(yZ@)qGq73o#tURp^6C<JsfQq8ax^;tp2?uZRfVRgL&YbS
zv_6ZR^!Ilm46gl^-yX-Kz8W55G?x;95iGLl$OV8NKiIJ0SErJXQY*Jt3k-sZJs8&P
zXpBRxc6zVmda@^%61+-x0gh|f?{PP@Q^s!5R9;*FC<ip<^;;YpudImh#CnIE#e0`^
zHs}*l#$}4&TUVDbY95<2*{LmzKxkwX?@-@wxIaacf9HO#WBY^Kitb_5IpZ$w*u?>d
zde)5`sQvH>;ipomL5A8Jc$nlSX$+nA={LCAvWzZE^j)3hdky8!{+ajJPf=CNvh=Kz
zl~Q(?idz2YunUzC9wh30%3Of;aS@y_@3qo@+=b?Obt>gzqNuWcd!Wm(9h8$RTO21d
zO&ff04`~9)hsl8H%bYJ@-O$OGuqX4M(#Os>fRVf}U@&c=rx=s#mYOuD9O04=hs7;2
z$Clb&8*$fU7}6$NqwVU&{9UJw@mGAhY%Mdzn*`8hdYtO<$`GG)KyAxscW$Lr9cjtJ
zXGi$^YdoR$gz+qmp|gr`1FsFNL-AIPxX(%gdKSOmg0?zvv_qQZv*J&{f6l?c=lj4Q
zFKUw^-q;1*6^wi>X{iIfBONf_S!vz;fua(zT}fd&FP7LV5Rlhzp6X?Hwf{+(0K4Ku
zn4U$*e5IWf{DIUkJfIi3HIIb?gSMMiZ+zmKmjv4@`AD9?4$SNMbU9mQzKJR=@m<Ex
z7WQ<aD#-)|?Z=IKC9(wcvRn95{ci2n?=|cR@uQ_xjZ*^d4;1%+aqbkQVDL~@u}568
zXV?xhPKI+(I{y&op}%9I?{k%*YH6n{rBdX49rG<WN$~<pcVMj2w9T==Crz2-+D|x}
zW1IA>{d;CDK_>uFOc}cXRoU9iWv$>=zBtnpTA`B??Mkrg(Y8g*BKVV8))%M8&*^2C
zFFYTiV13~O#r~V=6P9J#+*oY&K(jkGqnJEvR~X9Ui52l*?oFL~gp-f+()@8+hk3XD
zQ&qLXBs2EyQvfG!KtR}1xXxwj0nICPUXo#F)?UUp74tt4+Fc&p468pu)4EHDQ0Oz?
z?u&!a!=LSEb{A0f*;?ncsJGv1m|4Rt@AkR-`3}J?(o@6D*Yet8=r-i#E)^MRdP%Z^
zXGFVLt*k!@gKK8M@zf&6B|8&{f@MpGEWHk7jVY<LTcSDsjDO4~Mro&;&^AX)eO6X>
zsDC)Dw*LRH_ugSmW?SFzSg@gB1C*+x6s1Y;#bFQ?5tJr|CJ2#EXc0m{WE7<;y@Mbi
zT?h#!6qOQbL8Jr-5Fpfq5L#%Vyf@C7Iq&nF3FqJU`ab{h%7yoR@4eSrd$qmRZ#U^g
z)ZwcTZ;|F#tX=HWg(DtZ!KzFZJd7KHOqoIEaXUFiW(!GCx(X`0CXR_EOm%CyYiyFl
z<3Ilh58HOAxnA};c;A5yxjypQF_+r@>=UUjqz2$7+oY=ZhFEcQn`9UY{So9Yj_kfq
z8_?ZHDZ%)Pui&9+6*QDThEh&AwNp7&>w}Xqgb*#ZIbm}pAjhg_!jL3;f;XdFisfgf
ztCGoZm&s%%zIzFCgN~HilAf>TFM3ls<%G@8>BEG-e`%KFHTcrU;URA^?32H%ZO1w>
zyyE>0y9%>>&<DTY#Yx$3^N&c%q_72y0$loq(-ivFC*`=ax<<vk3*xRm0@F{8AmPhh
zGEZ#Hjai7!^PQI-aP^W@30xr`=8LB%0O3IO=A!VzCbM`GqC=H~Rc-TTwd7<^cH%2Q
zsfW3uZt-*cZvp<7feO$R|Dkk|@y6JqYO7Uw7&Yb?V!;H3AOSTZx%0I$tn90O9A1uU
z+Y39g0}Z)3sh!hO5^?4}Gl!`Di_JM)%Bw(t?Dp9(kVC%He*b|($De$poE1Vfen)^K
zZlG1XW<g=8;<)CrM6cy(8S7m`la>atAB5xTh$zrD?_r(_|4hEO`^^}pOg|_G1e+=(
zrP2nv*-?d>3a+2NLnd|#5(|U#*Z-iJ(Qb?6eUlEW5sfQz^TIpTa+hz>!z1g@(R(W@
zHWJC4$K#AlA&pN-GvM39NhpV{mGZjt`9=5r^YQK-=nMDp7Jo?Ekh+68C)q)cy_Wt(
z=<O!?O?*(}D@U%`mn}%#(8=8(e0jR_lF!O)!q)Puxgqov&<Oc?qhzt=5@(g?JCfSw
zNc{~e!J%X560OcaVQP?h?D<lMnCDevU^`PW_XtX|symyAFBLw^)2Up>)ZrS0Q&62z
z#av!~@$2O~lO_n&uc;hLmsS-WdJAsm+wLr5gfkp)MMzaJt;aZIH~by;b$1+u5w?)n
z3BsKuSrz}jSzNYq;?NuBe{LIi_DjH_UD2fUBH_N9_lO-FPOiT*L#+C3lp0SE%q|Ux
zn?$v3FA`iD19io#u8D-z6vpvwk5n82LTQw~F5P<;MHcHU1eN<}@TmH}@bPS9L(idr
z;C9p-$ZRG7W|l$(woJHGhoWFn-KcnD9CDo~jcVF8c@*RgIj`nlmE;_!znNOxPrDsM
zto8Rb^_pocnJuNI5jS@8FD00*kKIm{RU!Vc&fi`j02daJ8}yF5F1Op)>nBnPw0yMm
zIc&Dt*}lh7VOG?dl@HLJ-Sh}ri-!j~1lO%`&$W8-sQ%cfBPLwC(Jp5vW85=$k=1|G
zog1=Nemj*<^6~nsL%g??tQzJcS4Bd#nhzN=tn3jz{X}`6{XP8&bcJzwmQ_o1L@Ulx
z>LF<;$9j`8-P!q0D1M8ga%L=1iPIlzCza^j$!|C7R1?Zw=_ZXLT`N3YJ^sCw2m}zu
zE+2#ot`(S@K{TsY-)Ph&<deQ<X*)MQT3EMN;8pavnW@q59alWDpA>N5a8nQ;*4cv%
zoOvQ<X1ta@$8+KZB6nLm$%##^8C88Z005`08GFHD(SmyCCtb8zpT;?RouCRI6SmlP
z3!F-Fw_2NLBLa=OV%~On7SNh7>sFEJwB7LS<BlpawJY%pt~=<Z(bXKi^>C%RmN~rK
z_f@Z^wuFTTE7cPqmn~?Z@I!qq7NuFP7u)ZhLb|RFyxgw1z*N2)C!mIXT6cp8w~k7<
zBFMy#&I4`Y+wm}bmr`|DxVYMFC~uJdVnL`sone+aU2{L%dF;we@5QFFC+C=<kcd?6
zMjcFec-8=}Aijn)+6<Xd<7jv14}qmMnV*=bu#Rwc?RmsW0Bi{#or2a~CYPHQj{4a}
z>10&Cb2w(7k6dm+tvZREyF(N+Pw-y6B{+#XU~bBLCA97$sAhBiQbg?RZ;AP5{Fb{S
zr#SOAvCvu`JDZs=(b=fqQ|0aMn|jial@aHZpIR2W$`+c}j%>PH)g54Q{>Z#jHPL%h
ztzC2mU4xlJ_f+}DnR(e?OV;7oo{MaCQ$sr2kLer>)s6uc+>@%v$P}d8>}Okl)>S*i
zA@;`Z=yjaP@tSqIgXUBQxMp~{J6e9K2?zRqr@zQ7+FBfxqb)7{<lCpU-bXw7V|R3V
zyr(Q4EZJ_~^BI0}jFaO%kS;pJ>;`HaM$BX<NuymlR98(A#ZF<&OV@3W@wMK&Vbfta
zBn}Egf3#UnbdW~B#_+;2hLO7gBKJyrVoVWD?8&3X^EqkUc1TA^zhjs9L~56*Y56q_
zom#H@zK5LE^2I0GUZ017n|9%wZ$Qg&Fh?h;6RTa`!Gti2&3jZq&YFR=7>2kFIa8WB
z`||ZE!LplkN?Or=Mz(%8?LfW8=D98@C~v1*uc8OIN;gO3=lZM{b&MOyuhq67&NN5&
zLrZN^9kNrUMl}LVi~ieP)TE)Qmx@u7+ll!*XMq60X*$vtmlKmAj7-h^3k!gtR^&|x
z(L#v6o@z_bFQ)9MY#)XIXB<8GE_RLUQz<-X|H75L{_Y#cQ2tx_%$Hu2F@tuaGkIEc
znoQpv1!Ydh!J`a$b}Jy!ptM<=V~8oAX0fK1ojdF`TlRQxvmTiNo8o7VQ(YSfT^pSc
zXB!p|4;*dnHa9Gn-_R@Sn2k~?URvYh#XWJ)NrTwdENP2XJ~pLIsg0*Lnou9V4mP|I
z9$L3Ou`%6=fW1aImD~5*#JvUrrVQH?Bh9mwMKOB4AZSVjaRp=*6(;vEeeONwZP#E9
zTld6OE%@py+u}Q-G|YZGhlyQd`QFv@`t6PSfL8IEieay&Mkh~Fw}cpax%{nBjo6c0
zbq*Y6Pt8S;21F%Rkpj%~m5v`MB7dK7{9ixRf7g78uy~lO^?trgrj<Xan75`h2GMAf
z$%e*QgPpslb?F(Dh!CnMX5l_h+$$YKiLw5A(>sd}6%Euoi6K8sio~NYfB59UmZy2A
zQs}J}^2~xb;5eXWDfibG=HTtI<u!V{T$5X?C}=U!*9O4ZUJSB<QSjxufli)Oqtp)k
zlll{52|2uBmsnhU+1$`xF-!T?ZIW=}fW!7#e|oED2~`y)^Tfb+>{UH$h!$V1+O7|H
z)7=6a`DMFRoNl%`!)h#D^(#6T%##CdR9$T&LI!dLH8%pEW#8TyHuq|FA=bjE!A|8{
zxAo&N-?hb4=&EW9eHxIqPJ+|&ssP~u3CIy}v+1fV+~lSWQOAu&Cp%=8ABsi195B{p
z<WozFe4AS;koNUiNLinxS_BJP#1Gr^tYLI}U;8o7JK|6HZ@RW^jU$X^a4#K}!$Vkv
zwhF!)t$&j3o(7DT^=x0c)#lpKPBgR_I51OR89<*1vm8Zl^n=qHm8jKR#HNUdnXYUt
zOgNAGyXBG3fr)J6qQ0!`1uyy$U`z#sXuUYzEMd2(1cYvs4E>zD5|*Eyodfa}@2^2$
z^Rt^(BvU*7IO>8C>|f0@E>5ka>hJh%WdJ*>op&66MzHDqtte}^6)AdV|3b5%J7Qru
zNv>$$7Fh*^>Oav@cWo=jdt-S<Lc+n{YQ^M?;N4(@xZ0f=w3=hzx0`VDzWZVkFDOBD
z29Cxjj_c`G_5Etf@>j&x$Xtc8hnYFC&aPiH7G`n^qrf|s#cbA8PcDmn1NIj<1^zEt
z{Eq}+y5VkaBn1cvXFW*7LdCV)4x1KgW`ePl-nFG)g$p}2G#K$`*Sl3;I><g`p3zR$
z9nCA7n1A!xjG3Chbs@~~8i;~$^ktNh0j6Q`I3V~0xC>CbZV}>bgN~Ix#o}!bPDKC5
z4F5g+CypOEV5+l>yw6JBwv%7iIaa*K2*&~)+_uL^2WzkG=4HitYR!C?gah;aB)^~Q
zdcZJO{$sp6<K1j?L+zAe>y0`;ZDY!Dk#f_i!E^au&ko)A_l*8?vg&u!$Ljm}OPR7T
zlxy$pbI5chmN4lX3?1#=SS^6W4jlBzF1RR^f`JweP*3~socf$edn5DGn1SOwS)KY^
zSiw0SB~cR@sZs+B|5%wyka7Fd<A40;%>MnCfF`DaJM!o;$rR!^+&I|F@FSBeXZ`uZ
zMcl&6l<u`zd4^%`50>{FDNAsbeeF_nyIB4y`m+<STG*qdQz$9tr89QF?8S$N7rteG
z>6b3LRL*^tD`Kwe`9-7NEOG=Xg-gSRcH3pI<I$5(oC0JyumW$S5MU$=_qQyhQ_Jx7
zvu$lmB|TgShUR3{$@*hH>5ELji8nsC{xpOFHHttQQ4H6=EWs)!zor7&9o(yMO8&^Z
zN~arUS`7Bv584@otD`#*_Z5chOmy#eh*vw9ZjPcBMA48_7BxGvfn(E!hqaU{XMc@d
zh3rLzt6J$gK?v_Ad}<o|4zwpep56>z&kKI)lvWt2Li-d$Y|SrAVXI}^mvd&X&*bT)
zUj>LM-chr4of|%(y?b`WCZVI^BgV$TTY9@7Q3Y(YXC=uq^`1Wvc30JsmrP98KQ&ZL
z4)1`ewe_=kEh@kG-?9~mGQY)o^2i&#(<k-RPicr>XUfuExO(B$v$Ku)mKu81uP#`<
z>({LK)%>mA!GrIQ9sKR+8}<D&C%?mLz^vG7QEhjy$yah_p=ur8STP3*5{I4~PqXM9
zkg}eMl<_`4Bxcq+79YV9s=vZ{HbppiF{aiV(zRFdOu&5(p<Gv#&qt#o6TUisH?PgP
zG%2gjFFiduAR5}38Z19!9Y~xW+R(zZxi!f$@;?6DyWQ+U&8{e~!!GNq_=VL4ck8k7
z7f9XmuYN&yj-a=ChluI-;KaTmI`XT^(B50=`&prNU{-yR{1JQ!Wfypp<<(MsZTv*c
zqw%2w&O@z4jY~d_@o#Ia(wty7Y$~%t^26W^&$xE^{q3W={g?g|N6iyzM9h;ABDQT7
zCbWbaOPjWYx~r2mwNZu8j_}T6u;%gE9*IL>)j&xM{=_u*B}qOmMvmp5`akjNn*mpp
z>W4Ui_5ydGAg4n;3SN6z20$;FG8Hr@<tO{>C5J~&K6wr_yc~TH%rMgX@%ja000gke
zjl?j!_v5Mbqd=#JfaR6jd+FHSiT#17Y{_K+h4QcI1_%JXhDpz|_L3@qWNvIHv6EMG
zc>fFa0MtaM{jnK)lj5tPy8KUq{oq~VPlElG{`)Cme`({NTk>x$^HYcYt>XV5R{DCq
zf0PEFe&tEN#4cu`Pctd8H7jWLjdTb63lawaHjq(W0QYF~_3^lxzj1lWk&$&!-vA&T
zXSkM<eX3=nK4DF&uMV44D?Tn!IF%QDKVV!<yuh@kh=dSY;^WE&b8mPEM{EyW%?ON^
z&GKif()pWE|Ko=pV7Ib8$CJKM8-;tDlBi;G8mObT!Ka_xys+MJ!d+^o`O$D>Pl<Qh
z-Oid)4Gql{K}Od8_MJ~kU~NZrP?ZvbqcHf2I}<{bLh?Hpc^;`RRaf}<Mis;BKW+v+
zbCu;GChLoHh=9(xfWMdkUPz(fHSlO&eA;?pKO>($;5&d-9J_sPs=J<F7}p3|G8#89
z=HGuXQQ(@&5=h%`m%#u0ZhF~n$EZrJ!m9J!X(?OxCjGbSXPEMaHOO+f-(?yZIPmHV
zM~{F*T-qLPy~f!J%!@vBPUtZT>is3);r?b9XPw1gA2Rfw^hyDjB$8)fPzhzZP8t->
zzx7NVyPtV0=T$PrfKk}d2v|SSm-p<6VAGFn1^u!DIPQR}`|4EukNme~(VW*wZB@Gt
z?11Sfm*Vzj8Aj010|o%TO!i=7XP*zXMkG97F`8d+q}<p|BTs|TAmM<g#u60xyQRvZ
z{RbC+9Vw6F@Csw#w*|<aIf+G`N51@LKKx4-Zz2EzXwNLBG8ppD$I23bf!jaqfr!1E
zOGpGbYsU+RGZfU_nWVP^TgmB0;YCIQ@?*sBz+E#sOVebfzxC}u{csWhoH{A{6MOok
zZ)^d_HBrlgz(BPAjH{nW0Z%2}b9nXdF#A7843Gw{)9F&)*Z}TV{m=jX>n}hdFo2N}
z`j8P9|9tno3E*l@cH*FW(qZ5ZAS1TjoWC;K`@1B)&<;qrbVP0K-hqiN@RV$3@5#UB
z`HxGmV;9nPpQ5Fx%kI~XEe^K`g{h{d$qQc<ZY92{d5Jj%W9i7wliW*Kb}uH9IqP+#
zTl~#Igl?FBK549lEuR>R7HEhP?*IT56|cTzoi*{#QckTQE;LIl6ndXfy*|}aIz3b<
ziQ?@O_Tm{9SB!-|`B=cb$2g*b0PhvFp;zw(JZ^F<g;U$$*4Ry(1@fH-N;agywGB_!
zhCYc)#0Iz)yFrIw`-77mHS#L?;JoPv>=r7J;yy@7tx1gW9{j!l-A7GsAG+HfedIF2
zCQ3AcpFT=C+!%o!R8vJ^V6B{l^^pd7N(-8}eua8At0^zWVGJ#&%-vC~nj@4(&|u7s
z;9H;C`mH!cJ070gZ>AK3IUf`jT!Z2}CpS#<ZA+*T5<}0tJs0K8N&!ns*+r3Gl%6>M
zUHGo5D<%<Rg0zKK*SMM}%X!~b-uWJyxMaLZ>RcODINUG^NB1Nn_DJ`A+tq}zG>`JL
zM?-m0CZ<b`Tf}nKYHq0N+HK`{Zyed0NC@qU=tJ7Sbh@aw{Iwe7WiY8AH^?&N)cRBi
zvAp2v?~^zA{f{f|FAy@EUX1mMs5rnIZ++;Ugio*O&U}YwOKmpSR=|?f47gy?I`PcH
zr>_9c<HbxX^<pejeo05T#@KL9PSZG!P~_7TCrRz(LDK=8#~RvOoYi(Dn<0jeOGX;S
zHJCs7kcNGpB}~+1t$PSRCrB;VFfj7?plBXzBDoGtut~!eTUdDdl0GXn1{*pM8|4UL
z9NE=8QP~|4?UJe>mTBI@bJaE;WYc@@d`b*uE8zZFz_yKjAn7MDU%oiIs#Xpi-0pi{
zaY-s<rSY{CQ8;1s8*d5qtNgEsLC8C2{Ba7<kyE>v_6D_Kf>BYt5^M7X_ZTmGrmdF)
zi%qPP=6&ku<{6V`lX7X8860J~y4|LdS8lCZW#&uS2(lVRYv<|Oe3^aqcy2C*RX13i
zZ|SoSc)j;5iZLgJ+yYiKw>Npy)UO}quEfbghP)4BSS}rI`fH<U%BgZkfklNrOcnUW
z$0Q^aI3dka6YiNR#TO1apWbf~V`AlP*VM*16Dni~sKeaw0>25JbcdY9it#lS;w*9H
z6|ahtjcpJ%tk_~zeR8Pm%+ksonoPADZQ$u#PrppuhD&duZJmr)wr#A`9Ig(Q4EvG_
zX^dlewWNwLcI>5Y$wocfZDHu-)Ikd})I;eP4vILKo~$3ac>CT+J)SkVvtBm;n9a_5
z!+3?%(smDjtMTrZX@NnfY+|`<7v?y~ZI6fG4bP0=MZ@r_rk!L}0maz5^4SIU1WPZB
z=tcv_HrTYFr8-Tve>mPGUMdvC*3{0(90YU&X$O6&ZpB2_fXD1kr<=k#d*zCnMaW9q
zF$t%f&SCF*JD6|I`==Gn_(+1h=AQFQI81&?bZ@?^i7A!0j1wg%JIn-TN>K@gEVlX7
zp{!EnCSTY5imA7_yu0nb;CnQF0%O^W1dMj<;2V<OBjy5^E{t~UF~5!Va!w}%n2Lp9
zbD$A(DZ-qhxWSM>NhvTHe`v+q-;S82ZQNtrpuo_QsNVvXq-}N1GeeIl(k9eD&IG&m
z86#+{GA4HE5Jz`r`0yjw<kj4vj72r=6XlcjwAuS6REn@-S^jEu6yv$x-<|8gE0XT#
zBgz|#ZELiOqb07NOY^{-O18fzS5Q}+HheW+E(a4={p;Fe@_U<l{GVn_o*y==5K)Y+
zS!L-<jM_tq9DJw=*uJX;&WW}Gk5RLR{@w!S$?@KGj<#H=3EPEr4QTM_0T@a_JHk1p
zgxtGDE~77Mp<dIsWpYV_%QH(v3-OLuHBwSfxbVG&`Th!%nz0w1L)&E-Q;7$Vc^;O-
z2NMNd>DEzW;fF0=#|Rr~VOkc~9^0a3-@=@_s*_NzluXr9C*@`8l@j}j#5|>)xnT~g
zj#CFR3pD78qMjd+gY$!p!X(pt)p%)lKUxt3q?aED2RcW(b*yFY_1Wx(Bk?N!CZ-<5
zdI0rb+<*z86v}<hIJwf|GZUh@Yjyg&1PguIONPhfnu|#&%+|ggLc`j^s|=}4`U(9=
zaxX4L1?}6D_;jpsM#g6Luhhjq=xAv%KsgU$4EHCUU85Wj$0(>(DP`YD0m*;>$hwtR
z+TjGLL(8P<=Bo9p^RHD<;n;*XC?7O!n8Vu67Ue>5`etk9z!EhP;Sa(6@u0-Vsi(4h
zQY_qM5GbEoS{X}}+>52093KlHMAf3xPxM9rquHPXRpCQ`#q+K%m8iVLyrzeT7NxXs
z73d3bC>lmL=ByG_{g!YGh7r*skYtf&-?3UePI+uw$>r3JkNxfT1+}!NDv`RtwoBxH
z>mW9;N4mW4{j&r_(&hWl)Xf5R)klXE;-)xYW%DdiS{-*62s=n<GNkWA#u3|mnEN*|
z(C;0?)Q-6tsimU9%8+6I^4YKNYOJZO&W2{yljsdIWOEyyS$E@RyEkJqvTuJFbG!n+
zA|n4_UhGx#1d~PRVgZwc;F5E{MMTm`W)6}3$n(HPN$Jmi@u}yX2D*TESA^t8Kc$T2
zlq;L)s{%D@1D}<8xcwos*pi-4sSv!Hd9aPPac?rgzRwmydY73|T0N(Bkuo4N==FU#
z8x<VRBWu{;$ymZWkClPa`h!<yKx>~Z5~UGX9%!GfUJ9{{`%ZlAWl^*CyfowCZ4YIc
z?LtMHAg4+b-|cTHR!;>g?zEz=oxzHkqONXuQO~AGX>;KpYFT!_StZc$ilP<5jCA=M
z@qI_NYsZlw>HRr;l2s&=v_GB6u@RLZ46vc}r8@}sSqCm5LLrMKd${rAfT!Qyu2XpS
zs0YP>cZ#nP6zo%w&rmf1G3>>UGjZyu8~Jm$_VU$#35W)qb$!{9s=d$5`~atR9fG^c
zXq`XY^DBTp%y#_b`M)j){hxa=U=z^AOT;2WhFse9%kKm0)#-mm7Ta^cb>QC4NsQTE
zbU1kAJrF`9mF~lt?K$A$C4j&YXd^~e@y9%F0%4%6&4D6DjhlZ`dRz+_kPlkOATIrL
zMQ<blW!rMd6uRetUn774)#e^Dx+LL;09>#E+}h|96?1zJ$OjDQH;CNxWJ0|K;PVx(
zdB-ZeSkiATz-i9dehQvWL(1oIG5C7GegK1;{hQ_4mdxmwb%aoK$vpSWX(2MeKin(w
z?oBxVpo8D*s2__%o$AP_OKI6MdHnhPkpOm%56gU)9u9V&U_cS|i$`yc9<!4^Hf~bo
zHLG_)cTD2Qd+l^k7QwvghN;UxzjeV0piNoWQ}!*2kx8uP6;0r{$1Y&b4<@PuB#8cD
zX1fu3IzR*_8SWPg*LYe7G>tFbdvyF|&do6O)w?$L=28&3=UsUInIQolz;y^+3Uf)b
zw2@Sv%pn2oD?nO6`^e=w<i!L+GQ%vCkQ2Zgy9gI-jkawE%ZyoqJDlz4$*<;?PbSNa
zY<nG7EN?TS{;xn5jeX`5ve9~#WXir(Wn8AIKXBpA!+?D%S2Mtq<+coac5Yj!|EjlP
zJy^iY^7Riyim+k>h$<H0Nlx+<jyZbr1OGQwMC<}PTv4;Ug$0Qn_~#V^?7eLQ1atR!
zhuBG=)jLn6t<>YDdvC=OetYj6<rXkrZa_;q-Il#6etnf8hrXi#4ux;&3<oI`=-P;w
zA;n?~OwVW=7ljx);2INU$Za3mI}MN?M=nb}ZfzOR(hOQjFqx)EN!he!Xiwr9dhzdd
zfsI%z;bIgKrI)L%IjK@Ml<3I?EN<8LU?7-xKP?w_pQvPE9J~TT^M)1Rmufe1Pt~eU
z0>mhn%Z+Ex`jrcOfPngbaA0u1#-9=z(7mgq<;E57Fq-%7lGIgqm9!pC;GdWFuT|&n
zDrx7ho{W0wemoZ7yQ`$%73uur?){5?_kk3I&d?k3wLJ%1KM5#l4YMQ$yY0^vy}t{v
zs_G){(Vhb?UIdhMP?hXn96Wh51<;wE8b$Sc4mhp>49M!~#9&|jxuQ3U0G~-OO@sCv
z@at|4nU6HUD3|(U9v3_TKK~S~pMv#6z<&zX55@LVWBt%GKQ-2$D)Of(+!cqPrtnV{
z`P0Yx5eWbEv3AAbYmhpcmLSS^VhYh-scnQwIWruV>mG;MY}?+<a<F<diFi7b_aJut
zE(&Ybk^zbfo_@PN7vozMi;0CRHTK<uXSmoB7zPS|`n=gk-U}obvOK1G`#Il9t&(^9
z6JM>?rd<As2Y|1pzx_R$VHC6*6}SaNvVvV;la#e3eHYC5l@O54hagrmyB7R|zc1-P
z60&7$Xs`P4Ujn|L6zX?fNsXIql!4Z<xlf9?M7`y_mhPSm`#M>&^VQtxd+LopLxMjY
z)c=TMgv0_OnZapr2Z-qkE?2^HAhJ5N!3g9L#>|SB^y(0SJ2H$1|Fp<R_2xei4!uPY
zE?b1?3i^UV54@GUdJ(n~p{=Sa(xUX({Jz7UpSVEV&wmPAtKg!UyoASDZG>hq$)qQ-
z&YU(*{pfU@tZ$;%G4W{6H9Ua@WUzvxpsjx7h$t&so~KiBoMy-b8->V)apVc2bjyW&
ze_=S@ztGW0j8N-*A7qa!f*<FVzJ}_vTFTQcHXr_szx;`tnXtZ!9&48)<dv`NHgCW;
zmUCAV8K?92?ROH?D;u3{ks%Y&{=&&Np>i^hn<X(8d}tek*m8nF=krRxtrK#M<+X4-
zL~4$9oLC7aNcEh>7Ky2(e&te<r+5q(`#A(PU}4~WGmU+X;^G_($M_ZuJKWtP$|y@w
zH^IyFxQX(&o=fvy5|#jC7h}<O!UQ|hNwW%Kj!1Y~a<y4rtb%!!huz@Lr$EEBj#Rh%
z$^OF%k7S*McS>x$>5U;A7~$etBbONfSD*oC1tHf=US=R6yMdzfe$DgP?GdUAJJ9E#
zA`N7qLxeFk=W%|vXp(;JM(w(B-D{8w-F<K+hk%*x%)H;T`rEAI={CQ`SD7SunW!uu
zXN1azUJWjJkC^AHPWsc{zAfFIBDkxMGVM$CpbzL5WNQ31@krJ8p4ztGQ)yY^n8k@k
zDY8PCHPU0IRN4!a#yHX{ysBp~I;&AE`pSZ!QfPR6U~KXhAFr>?b&#~-8>easo7=#l
zRMFM1;3d7iBEN^)=}%&1{Oo#5*9KfH!f0erNCsstX?c{(|EZ|o!V4ZN%yqMYqEU9|
zE8hN&6sO_p^@Uzg*Vy`$V8bAkPzbln+_KnQd?~*<UvCwcqUGYz&ahQ%H@3|Z(vu#Y
zHQtfGVpM2qENT7Gt#P1YxmbTJR?17HMHOxtmqM%-$DIJ@E0y}tNEKV+{$U~F>t2^z
z&&idk04<7N`d_*x?@>}Bq!5sC1WbK8mlCgnULFom@NOBapf^H^BRurzZayP#Z*Ok*
z<s9qzk?WAQk~F)IE@uR5zmFhKh_@xGC;^x%+wrnaK9f?Swr%m}V`6x$zrMLB0rVO6
zDM%fFrbW#0u(7dm8MSY$#Tc81O$k=(c~Z|y*%}~Ys=4H5FaYXWer*sdK@mWpiFiV&
zU10kh<s&z|obQ95Bh>kG(`GJ_YmDHF*g686eon0k{J|8A8sRH{BZAj($`o~2S9!re
zd8<vzurWtBt<w_ucyb8|;6<g7`S4SjB}4#cK*5-9IaKAjFs{E7-W+97ESU@-Ok8$~
zj*Bx4>w0rB(E8h_00~7YBYXt+J#-%Yhx70sdU03kuO2+6nrs$lvVUy=;u14!X$mDQ
z%ew}tcGjBBcrIMx8y03!So?Gix>`f?a{f)=$WZqRH7D&gmve<e<j2x&N^@eDS(V4@
zsJqIl*p0D-PM}vkaVcrQdv-x^46H`iRGuHvps~ZfHr+k3E;5b}l3{ZukhQ*g&f|em
z=j-GAcY-`gJ*x6+=?5}E<<3amp8h&w_>RN3LUNXwI}4Z(wz*KTsAY_^%YPSmBCSrB
zI!t?s$Tunst{YlktymdIYjlVbkaI<^Vy;~INR5Y&g-YEmK32u`VMLnYUQZuC$eFfn
z{L4@cC86B<^QIxw{N=)>BT`b-?>ZX~^6($-DarI9<)o-NI=1n><%J#9@vDhxo6@S@
z4fnzhB0L=g0;W6s{NS_xpDva>N`F{B4%2Fl6%9F~>h8wvxx8@V5Q5eNvu=r&rzbA~
zAUK$&O(tfNaAczU>qc|F?FTVh^`B>(xNn_Itq=@v4h1o+Qd7ThVm}iPw&)>3wW!YJ
zVRJ<NiJf@%TNc_7@&M8ybLe69)8-pET!G0M3wfgULZEQb;PgXT!ASl$tUGIO7c37*
zJ&J-|emCEo<14nk{_Rr#VCk^rt#j-B9jODBpG;k{PAe(^E&K9guQD$!U;%J5ivMe>
z?`o-Oem>(We4(oW&so6!TWhnCsWPCgI7$EEyqg;jgYoYV#Z|(K%K?)z`~i=%i9P51
z^gJ;vSnlcAvJ}?-ntb(yZh5111kTL9{4<w~+eH(v^)c<*p_{M2*Ld{X82`TLJTU2u
zBe?2czF5dGD||tZv`dn0%FK7OIcU9F0Xi)SJ(`=LmZ}1~E8v07{Ospgvi@xv*n%nK
zX4n%%f&`lGjBdhaYW3uzN3WN*Ehr?|xXTSjCRD0z&2-2qn@v@?q^Ux>b0R`RYJIMA
zLuWfZi=3X$V?fS2L$m#l6^Q7jp_+@DDMY98^SnE>{wSg_M=A%MqLhtAo?zWx&e<87
zkG5vK#hQ;sv)M-o)FG53S4&Whs4g!R;@2VBkWLMBV>&NeXDu8ZU*l>Mnud~ZQrU4<
zmUv{Iuhx{*72Ck&Zror57Y5Z7qMld|l+8e}l~Y=$-^iAQohuo-5myVdBWe%&ttt^h
zqjWd!=zK^L(cR3<FA697t+a;C#UwvnF2Puj2^TkfJ$1>xs3Sot=ks~wt#?$j4T}84
z_!);5K_!dLF^;iIFe+%uloA*u*?Ni3cRm2A%Qn94ZJ{by>pRzP*s<ba+e;OUC{TNP
z_sh&wlbT@;D`fzguaG*w$t**sQ8oz{JKShL%Q(fj$o_9R{-XtoQ+ceB5TB`(%94It
zc)spB<8*Iyvij$j2xwj3=EQx(`9kLK0mbm48o~|D!?f9R%~Ky!HkvG?5D)9<LASVK
z>}JkDYp%&*Ii=obx!|v^!f41_3&mP|`R-IEX7+}*1jN`xoM4mF4h)v!K;z+t4oZ05
z?TDAi?96)Uf~K*S;8J1Txm~&XIcppK7H0vN$<S7@x(qCm6o_}(ama3?kIv32gmrvX
zU5U@k%kTAN#k;kxZBN8CX<E>4v{#Z+E`N2z!i@8&T}A|%iw=b!k+mp?mL7M=WPu4S
z8BXm!?A7m`X(?MNx$;qiIA0RfM3}2~$gFxjS~k=50>RbH7#K1-a+eUSweod6DgMym
z>2nh4O9J@y1}r>N7q=+C8Yk{j>gay#GF&XyRW{)i3@}^GmFNS9kH3=O!{^-H+V~Ak
z+P^EFvd3)mi}?vTDI1j)6S4STO`M_ilwQz|+!?GNa?-=wgy_HGzeY^UizOE3&ZniE
z30IQ^X6@lIGr(WvHNy$mm9UnU@9{I$k1XUoP0h`RE#HDMY8>L#^H#HEUEy3Ym1BqF
zFhI*~%mVrT1P;I&d@^g!HS~$G$yYzcES-9PBG;NKV#3obSyx!egWefY{5-qZLmq2^
z5rQGQwLAb$N5q!bkVx(N!lQflR)+5v@tq&O<U=cZwZ3G89I)nx`@t6Srg4QCJp)3~
zTox-e)ZhCLU7X3}YHKLmDrhcfZ9-ih!GqIk$S1&4wRC3@(+VK~D8$?|<a*#CS+D$x
zwMZ8XfStw{#N%~ywu&rP(mp?G*fCHGr}sfHJe-9|u^}3VSe?uA5A$s-<Uv>F$_cd+
zKHYaEJf`2=v>o%J4vV6w+uI_OH(bVkWo%v=4ju!bY-~vxMqt&sz%7S?2T@0@G25=b
zBBt|x^FAGC+^xoz`62ZFO#2r2qQ(|+64GTK4zix=m*c>ER$8$O197ye6mO>SH3S@<
ztLt34lcs8&>E0t4zPVh|$uEU3Eh#Kn#RG_~<pRl+D3jmhybn7qiVeI(1@WyLUrr-A
ztqysGrAQ%cp#(T?ZF-omxou-s@`=-pzpwy|;8$V@=*O{Q!`-nWPG&XLo|0aC8zat!
zFJZF_@76}<(16;!qK;$acm_nCd1CQOB~f-~>rELlwHRh&QeeSnn5HElT5zV#sC>P5
zIZML7Kao^_PAUW1?&m-$(<Fe%{c@g!@tO?W&SKREYD&?qA)J7Y^D_IbwSm5zk``*U
zRQaTvWZ+V=J2p=NYdb~IRXek550bq$IIJ61GKtY0shs|G4yKb-!6mKeFHWDHZ7=le
z-)*UyYOYWL9E}A)`Mu7JP`K#TH*)~;`2|NK0PvbdQ#s4nBR`8)zm83Y6Dc-@bBdFZ
zIi>cQ)%EmsT5yj8BCjj?H>t_uCwFPj3zOQCeK$*jGTf&&2n%T6^+hB2iuck~Pvy?2
zHEY=GGabSC#g!=Rx+Cix9kcb;SG5|Kx)9}16uiAfw*es^xA0RJ;9E2~Qrk5w%Kg>@
zI$&N3H!feK%89R6C6x7#U14Z(&lY~7H(T%Xd_=+*a&_C_d$v^j#H+k~)23%~LlA|D
z?v+>Ek7ZJmNb09iyzuTElJ6mwbKfkHmqTGQS#ey|!|ybL4izICUToM__)UCS8cWPC
z4t;#Xr3jxHp~4H`dnP>iX!)q9Txh^2MbR@j$$3+AH;`&4)wkDe=p+M}o4F}321S$^
zo)HFQoEG|;fRG|ITd4N~)~wI>W}Lh?H9*44fROmv6evy|e7Xvf!4x8;R3hLmx6@E~
zucQi+mRf=S1mCLKNx`(mb;T)rKHn*HT;t9bt>dkTaP_Fsy?gg)cl$3l6uM~Jepmq_
zu3Bxt1;!O`ClsbBF20f<9|;@-z+NK!2X`z7-KlUxZ9%YS*Us77vDUTQFS&?cn6a%@
z0|Q7hrzqOPj@-fPvb?XfI{skU6ns5de!Ie&I0u_+m*2j$>l&H#`qlNNx$J1~I_Fl@
zHoC79!+<H^KAX^2SFgs!UJKQy_4|fw=;n~EE0<)I%{;50HV(+I$B8!rHQM+AeDEDm
zV-*EJ$}0hUkQ<ABy&I@qO-h`r6=YEvAK4JY7}cWyTu0yBVTU-=O~Mb~9#&W>7?l;P
zw(z<>UlqVHdM!5`e_FgwSwa9%z{>R5wL^4$^bpylqVm@0Y?}!p1Kjble)9d6)j%Zl
zTdLdQYs0k1uSvTg>gFxWqc1{7qjXh~&8tTR;agjL&Zn^KUFk3*M(#>_^L}b^KYl!~
z(D)H$pqKSJ0>06c0Ir<rOpvfP!nZv(MN}=EkLg#1*0#X6$Q&{Q%UN;ey!pn(MdfWk
z;6YYNOHN*E$v<K4(9CROV^iW}YcwyYw!Uz4|ESWo8%TMJiW$o&HvjfSsyUPZ=%@1R
zJHTV@esHBT0@ZqinLKxwI|--V9ftBhKWFl}n4p7R!e$cxAV!2yE&S}1*FM!iIx6ZK
zZwaP;n?55LP_&1q*s`BV!5w976ZD|JN$O@?p(&TJl$3Q86I8fm*uty4S_3T)u6qYr
zOg%vS;E)=zYh_3T4HNI{lM^PZ3JD6ZZvk|0?BQ*#8qZ;0hliUBu^{pZ5{ta$PFvdm
zj9duqF*L^PZvU6Rb&RK!#`!KONq8@kI{^&o>7IOW4^&b~#)M`4n+8iuGTG3RO4wXk
zm4MC-KB#_rOT?t~@={HO{T1T)+Sr{7X!2pN+@<5qXpcIN-UP!|35)HmDs2UvScQ;#
zn(B_XzZ0&=EPvPrulLnweZsgwP*qhn@&aNdwrx;_T3y_&8WXqmGF8btetfG6u<fFT
zw%V~GVVWWAHr#PWCISds|5bd_r5S&UXadc5-G&gBt4|2swH6d@8T!&>dvSmH9+kzK
z0nd+v(Vn6XORg(DIF81k9s27;iDBCZ<!i(D>aFu@sqN2Z`zuA9m7Os1i}a4(XuGhK
z_teH(IG}F0j)S9W%{FSNm{SP}xqx$#-_;YyqMVL}Py#P^Z>>OUIS3n*jh!XdniOqA
zx?1H*RmIGtg^Ne+MuQ(cJa;$@LY%X^cA<KM<UpKE@;eV8Tz$A=Q6uH?^$lsrr|$3x
zZiA^!0I-b9oex%xtt16r-c%m@nn~13SX~L{E-|}2>Q;JiUQTS==yI!Cd1GwbX=g|6
zRN?{jZ1ugj4Lh*7Ez8WM9>K_YdK(ZssunEOG_ogYNzdONa02eP&nY;-Xs<j|&pmo}
zT)N$SNS1{#!0Gorx)HL>MkLapu{h}(Z)$i6E!OiuV`7MCnf?*Di?i{K$6o-j;thkq
z@>{XL06Hp3wkoyFP3JfKOVs6MrL{LD3#;g+Msji8DgErbVfY<4EmPM~&E2@p@x#NO
zQ2cnxhaOPrV~7TRi&gnt8hw*vtOx=%7S*rzq6|Fs9utNvwb#7{ki>G{*(a<{u;7KH
z@5X8Ys~s+eeF_L_dedGW{tk3JLIdMh+Wx$Myb?9&7ShBk&H_Y>kg;27VIj3EVY@-A
zLyG_c9<j0fRtCd0cloo^>GwP2PRy?fx6oFN!Fj7#^NpHTVtF0C{$-;>csbq~od{=K
z^9YpAKk+4*ruq!#fV}Ut=;OI$Ve2XS#Fri61qwBIpfR788{!ZS@)4YYU2&XBgE|9P
zera5@Eir0Uis5Q=eIIxd1zyxG(25&tR);K*kDcK$7D>_yca^q6XlC~FgXb;e3$e%p
zQmtZgsG-#e`lWSg8zo9vhm*nPnKXH2=j|RBSw#yWK_A*||Md6PW_MM<SCEOIr?^<0
zzV$5Ck*@<NBgO9wo4Y&Jr&yT#TVGDgc1%+kt;jxW9Lu04=HvxEk00vAWwkd&0lof4
z4AS~S3Fph1bOLQTlc*RtQ0_o}nNv8ls+eNe7<f_R5N0L^Ufap;=S$NC*!~9+XYSr}
zW6E6xvI)U70M?CUp!-|%<%7<-q6spvSqUvC5A^sJde_p0VZrWJ#VTsiIwiJo{V*yk
z7#;!GjFRkGt<~+DJ?Iw>cctB@c2(r#Cgh&_@Wpv7YH_wRe1c-VW}9NK3g(k9`z)dA
z**2nxGfzPlU?JLk$LDCnO3ol4;aNf8=qT8!$?WNf6oJqO9Jo5(-nB)UF9f#cg-mRw
z9P}g9ZGQJ5r!BnDCju9E05(iVA>kmRd}t#`NW56BY=>G5&$?2ce-$=;@i3;ZBuJ*x
zT#QYua*b?=03&jh9(`e!X^dR$F<<RU`~CEHS*Vil>^sN|w613m|A8Tb&`F`EyXpvf
zt`BKADgch<H?Q%6>u~Y$4qqzT-2B?-m$Vw|s3R6_Tow@$K@eaWcn8&~^h~%Kap!6I
zWQB}Z<hKd~)b2$E#&vFfnM0Mci^8Ou)PwoZA#bhY+}F~F$zdt80M?x8au0Lf^L`c{
zMd=62&zI`BIsAzZZ=*YGw1@NQI3;KN6T8WQ)!VlF)iyi)8?an$!-ZzqD}It)D^+Rc
zW^{x6xm9wx$>!!1&bFs%ZK0#*im^$*gmd-i)Z0+QBGBS0gre)m&Bj)!1X9IK=|?aW
zv~Q97na*SVE}x0?DsYrHa1i^nap&s>(f>}qdlDQ)IbWyXNq@RXhc#rzQBFm`S2Y%1
zr_g(^xDTo2U|QH5fX;*Fz~FF-HTB^>i1x6O#p=eOf6DhKYYEkO&!*7xG*$Cb?uE>q
z4e;h7hgujMGpp~CFd!IpVf8!JSGY-S>383m0;x<mT?a5jqs#il^#xtS_HG^9&(8Mb
zq@&5YiVJ^Ktftms4AnLsEzfQFJtgQ36_yWQom*>lf{ZdvHKOpxi_0IBhAz1HyX$YR
z<?+eNGnZFc0hm^KP|!H6Lq+xMnN&J7+4}}jDg}?k_aWS;u!de8s$0MJ+!=R#KKJ(0
zjRqhcp_B?+$(5&TTZBGl-^1>|ITYYUmI7V$S}q{eaO&QP$K^%H+LpJE9o9M#u|nZ=
z5lE1rBh~77SJh}<M5ZKf&xm_9#DR{dR9lVEB@U5S=exiSvkLB3bAwQ+i?$}ah?M|N
z@!7ybETO3?gtYa+Zz{5$ehXub60nuzHn3M)vW!x!D2TmT$)3JElag>z>B37O`8$Bb
zH}JIyaGI1@Y2HcQ^l3{|Q`?}CIRX!}1{axupr|zg-rUJW0MmI40DydL*Oi0W^j^xe
z#)Jcap>^kWF%B=nXeT25??(Eyx17T!$_Otd@HAHr*T4*!`s-ghC3HDXljwBDxs|hs
z-IRjA&jw{}w6M6m%BjvT24W*{a;Q|-#-pV=1hs;4?5T=hoC{uSDvYuo2+cx@BU`p#
zXu0rUW_ybb=P20>o#5T@cicGLvcA7R#Hg`PJIzi%Wn2Z3DcO1~4*G<nqqgb-klV*)
zQwW|5MV-Y-P#4sds;0fpxXRwDf3BT{sILb1Sv|o$bsvb7&3N@7CE*IaO?wGnP&06X
zAI{d+%U;4*H2`(0Wd}(`M35yM?|`1H(<u8?)jdKC?JqG7#F;X#a0Jde)7O}eDJE}y
zuhqx|7k{^yl$#;i!C1w%>jYHxe((BjI#jr2pfUIGai{rF?TO#MW8N1tY<2!o+IQPH
zJ-xpFkF5`8^u}lVQnbAeZmd!bdN7fc^zc0j-T|Y-uQxyHNN@Y&`x5I=#^WIJb0B_r
zAMsyC1Er4uqxrYJN-b&s=*%y7`c_(GEyFhMABhbi`0fEp)T4^!E)dY{!on~0D;p0U
zvl`B6F1gitilIxitHn4ugc4o7$nA=a&~UuKK+LDppKkGqsX@?vc`i1@Oyb@J^Zb{9
zvmwV{YYAV?A&Z|iLU`3?>Q(U%u@%#Y?;qYvex$FbfB4e>-U1wU{xpm-m~+%jq#%QD
zFc)gbcZ{5?e1c)ZW|t*}qIw>qj{Ds-C(Q~24}01<C9&7-qz9xB^N1*?1$x!RJ>PyI
zt`|M(2pl@Db#XvL%}`XswJ$r~UjU@rCMOF{HlEhoBUzQ2nRC|}B~*65eineDq9qi%
z^5)p-Mk=rC^2W2*Rf2uGuA(3_XIQvTPt5_BS~c6?ADFxEwJVQlrGKdJw{L=(Cvp%r
z>)$^>_?XdhpRb9vwnf$~H&Cp0-Zo0rmtPoBKDfu40#2V50-(sw$8mtg!rcA0Zi~d%
z<z0B0tJM*_)(qBaT1i-K8`z5*fUHW6I!Z>j8Wo0EsL2XDdq1@mF)I}i&%|drm~bz3
z20&WO12fz;@6~>n6L;p^tB3%|`SY`3jaYkkkD*s}vEhU*_ZuP)E2=g;^8HpxW~T(<
zj;`D_pq=S>6Kvmqsc0D3&wn1<J2xV_<EON(3RE>DSASfYVehBDIr^xaPzB?b&U4{L
z!|K>8bCUil>ix%s>Lu>y=L2R1Dji?A6vf^UcxDO{RooWQ7~+<64_^rL_I>hu@j0nd
z<5`4L#|M#e4+yekkG?N}8Jz4lb>z_(KMNz`8XeqY8$;KH^HmWX1)&N{#*Ni&&{Eo5
zzr+Tu;8j44V$(<)Sa0$vdS8n5?~~ShRv$c5*JrxVg_UKy%@BV3&w^uVtxt*7?Vb92
z_NwgLZvqtbBmTJmUoHV}2l`NCwRHFHFgf!03Q)a#`nJTL3gw72&^?0ZR`J|x`vA2j
zSwPLPwov0ga_jHY&u`p7{j&RV_g(@A9E`>SrO6`i&i)s|x&zhaKMA(GO@0#Wr-c1Y
zfxmzJ+>(Erke@p2Z&Lg}tn_V6V)aEd_q($f-oEGJ8N)CrS5HSWZ9t2kPy~X<wr#QO
zjn}+y?rFn<&D7;VvzMmV_q1U`#{lDW?|4)Y;}a`@is^j-s7|Bm^VBrP^8=6`Gk_+e
z|Nl;GyRL@*EHdK(*ELfgwzZ?$EXR(Vj!urctSR|C{oJ+mXF`XbKM&3j`gPKk>3U5t
z?vHgVqm!Bk?^!mVZ@wpa<mQbva(<SNk1f~>49x~Zo64~Pb2EBoTLvA=soPa~C)I!1
zckti;jF~+fajeE&n9%wkfByFafBg!mIC(*yi=*fFi>LnQ7yf$S@2_4MW;%jxf}ObU
z_kWG^A5ZNL_lkMna|Gm`&e_v{zsz73Kd1SVnhZn(kgT7w`TylDlyP|;6Dw-pp4W4)
zCCu?36^Z%<y^(@XOujcR<TFhQ2<Gz%ZdnF*R+3}#?oYH_3@Ni(ccV?Lb+m0LdoO*c
zg%Wt&Kqd>H(bQZWF1bXfInHb96YX)v?P*HJI*HdhMbH$ilELTSUbHFiTzr$lbT>sY
zt0|N_mu1^i&oKX<hMAXl&aA0v3w!o2G){qNOwuitO?u^2_kuOXkfP{mki<e!QMFq6
z>emtx)f3X8>Ts-!mgry*F<dUsq@Aju-|TY>x<V~p<e!jQGO?jefYWl>T4Tv>muD82
zrEEs)W-ono$FR_P`$|aN&H8y7nD9KG!o>a@*XV=)sVBc$0Xo#gbRV}W@)JQ&HxIZ(
zAc3t>JNl-SJRL7yCy#GoF`fx(=EthYd1m`GOKiQ_s)rEUs(#fBj{j8P`vB>d6{WSB
zs$y^*!33<<b3brv@O>qeiyV`XMQwFUg0OMkm*j5N>bf20=O(FA#&=cPQ$P1>1hM4O
z$h`?}?BeF8Y`uh<*;p&Xrr+~$vqnLkViCS|ju-CNS_FLVcO^*<*aU0(A#B@RS(eCU
z7Msrziz=v9+e+hs5l0`RyD#sh-bz)_7Jc|peL`FhFh<c%nQv1Lg8kRM^P2OVw>I*8
zq$T-T|I?IQxPB0O=grcH^y!=F_A-P^)$2=BS>CqpkzjhEMd{Pm1n_E5kKz#r{jD2e
zvm*KjOH)31Y^lTMRSvY*IpOa=FY7OQ^N9V)Qnn7ZvMp6cxUI$tZBoz@f0M?E=WOxQ
z((bNuB->vctR%Dbv!<TD`0SVcM=t!Yf8PAEzbskj+3h=J`fui5=Nsf_$BLR{^pYUd
z6)K@P(xd!EfE_he<t|5~*U%THCBuA_)2vqAOr$1rN(YkM?KPQj{a;!w%N|#lue!CU
z?YTHkxC%{Ge)GS_`g7=Khk+4kzr=`K;`o3|PmOAJ<9UA~Hdf3$*}lZ1`RRRV2)Br6
zyc)p-s9re%PCfrGy4^hWmF8c0q|Hs@A3r<t?iW$8N&`Q+jk&vkUlc@;JuhNj_CUsQ
zP~Om%nPctYm)-(>Ezx8-T^?1B2TrDS*JDJXwS*Ndph`Q0Lrk(&tia$F|Ah9?Y22La
z`1~oPZ~y%vH)!s|8vB@*EDT))=4aBAVIyo<@H+%;@^yw3liyb13qm>GJG`Tqemh3B
zW0tTP$&QsT4^R>ZRT*rpw0a;aU=c|%p=jajb_&q*XUbjQeo>47Na*F%B?7aoUGyFr
zK-w?9=WELw@FWYJr;8f6#c4d`z&U;U<kD5QqnbO3y=$~I*=C4GIU8ak_>8BLVc}ID
z-E4X`$3g<b!>*pMSgNVQBW**~>q2$?*W5OrBHgFN41ZIC&VJ|b6Sy8%xx}Gn=cEE%
zag>1>l@63xqe)&{w7gqOlcerkeNrHlpdZA_XEY&fpeOnec|4Jj9mci%wCGHGl~<hS
zH_rzH{c|~deg+P>f_qHNYzAhua~L#j?W1;9(J~Ebvm~HT;4ppqu9<GJvk`}|ke51B
zyMAM;M6+;n3kqIhCBSsqt~~7ab?#pK)v)l!Gzas0*zm+gm09)Ew~8Nko)smz8)jWK
zH0YXa?@j<`Z;6HbLbLBCWJJ{b23&4^MLWN8i6&#5Y1A$qF>_Yh()RP9w|#igfrXM8
z3{^0<JxMkx!lotGu#iUMjvwbtic;2Y$I)A51a6^3ElM)%zZc}*?&#($Ft2%7UO-3(
z4NV#IV->W_2CA|Yi|?33rEQ5LY|7|CO6@H^Vck-F3b%`yh-&NI1@=AJVONc+<F|F<
ztx2#juVPSfE#W~{>7(}(UvJj5EDYK>`aqW6SjP!=B<Es8bt>bQtC7$uoUtwGzMmk+
zG`;Jg6XG^OKb%{^-j8_IuqY$3{K-4Fad}WMw~^u+?mBpOd6BJ!Oh_=wT~YFwPv01+
zf!J0q{|*@nlgl2s!Ct+CMNgJr(+cM%Wt*$C%Z^qtwO@PwqVrm0X{$C!o8~eS+nz+D
z+MY7J8__?Mrvu{OH&u532Gz+Nr}5Ax#&Zs4ZabGd=Mzi)xY;i4KWDlGjo565G@S>3
zh|Id3+q5B9e!C}chE1@5W>sxJL7n8K(SzA0sX<FE(f4RvGRMj1B(Y1nYMbe@({&48
zl)>C!a^0DhX~Oai9j^RHer+aEjS=scOCUB1?9sR9B`5zwsc$dr2X7IXe)$@^|MaW%
zy1^ar^FnuzXN9X2`284n?9762$k{6yiWZ%X2f;R({Mzg}$FM~YYQOZ?IR}3Ge9QZZ
zDsY+D9rf=1>m7H}WOc&2SW6Ed=R8}Ae{5Gm|Gw0be?{%C7nOAI#l)j^C+MIvZxh`q
zT}{NK>?VA@A8fl|69>H?p(1VI)E{}e!Oex<pR=RCsyhEHFDAe_0l4ASQPAb+MiyK0
z775YOQ(U)c#nNA4cV_in&o-RieIRg7rzd7PgNfPWg8OqHVvli;lz8n2thh1OMQwdV
zwT>l4@#S%>pTxElKdWUHh#YzlJhU$70(tH8bl%dP()WC}%O=iaar_FclTJ-qk9B$&
zbR1h`f^3p-Nay252O^?q^^X*$+}MOaJVcT|ps7`@<KUgB3xx+=Yqv?-GLNVAwtlJn
z!z^abqh&m;+l}V~R1m~hdgpoJyXT0moV$h{$_wvd#!@>p4vP=33B7u&tmiY1ofV0<
zuMv53ctV5b$<LZKWH(t{m#D6%&(jx6wS2T?#w^#&%(9Y*qJM>qr@a?wPs}=oy{)$u
z5D<9Z%=+|`IBD}FLQh>?<OuYm^a7sR9sl-HVBz=A4Z3X#9<__N!EoD_>DlCfgn~TW
zO%;ulv0k-pR}$*}#BKZN?O|<oO!g=BTfh!^Qgd5j&?cG#bajT~=5zj|*cNKs`y?OQ
zZ8`a*&Z=kv0!&+#oQH{yS}M%ZsnwY`wx@bNT2wVB2<Ie9L!Pe}wbY0|a5XY#hxo4!
zlsUwa&}cYbcB=g2JHMIwY}cXLmCpDZ^*5id9-z~-X<PymTssSbq|aI}^O%=IOg`VY
zo!i|8AKj|rDyiNHl{r=9N}n(iiGK7<w_KHy12i!z*|8||P#9-Iozl2V>CMQ^uz8BH
z#k$Q!LfsC0vxM|5H;UwrOSx$A>&6_pxF=scVg+yfviAS9_nlEqZrj>Y6cGg*a8LwP
z5Fr$$OIH*LT_VNMrS}>lMG)M83J8QIC4fqY&}#w&RC<$8LJL9Z0fL4SI``e<yZfFo
zWS`@Af8H@peq<!$Epx58=6u#{Yps~|%~ZF7B@8jIxPA_rAa2Kub(xsw=ygkAr{2TT
z{-img1ZQQ0V|*Zj@6NVgqj9*xk1F8>$9VRU34wg0IWOrb%7%!_0u;0XU10{jdHe>P
zy<O4?&up?15a{#e!i{zwmaEy4#gW+gK%P64P<HPwtXA(PIT?Pqn`mxfz?Fs{5Z18~
zbRcE~70jpmLBUNR)cV%-=oGKSX?30|bRm;%$8^WH=zJ{mUV;Hz;1X}C(a#X3ZZTjZ
zAC+wjFr_kBS)ih_wh|2GivGvuy9*M)o~q$H+e{a4rGhQo7U)<Cka9jFgmP=yfQ9S5
zbUV0tq+Lkf@lzKg{hnCM&phPzYo9Ux@a4{qY<;^&VraSI4@*zK(7b||I7GBuE#HP{
z*Nk~`xlM@eZGPYC3-1!xbfZ!ve)`|NOWR60CTD~g&JPZLa>v%j&`H4ej^)<JXwq<W
z5JT6s1u+L0pG~4NMoW)-)1&}j<iMV~*#EI@@ItYZCR=A+JN0WILyNaA_P}v|b0u)M
zGhFmQdQ$Wj2=5LUCp|xxTdmA@qoE(yN(DXw@NVOs!n$!O->!CkYwVq2T2s+GjXrvu
z-e`_mS8TFhRomv%lvuPpP-Tv;fV*LvicI=&PfY^Fc{`pjCnTwcnhsX<%4$f;65{??
zzPudBt8lqCZbkA_gY!3ebLqn~qLkxygz+y=6)&lJn#Z%J%y9AIGwCl7u;$;_C*pKK
zb!>DH+f|p>k6ETCpW_+3-<VGk70xRs_?xN*9?~I|fG_@AAlP*(&7DN8^8pEF0wLL>
zI}hZk4TA^!SE(0LXJ%`tz&VD2r)9NPYdQ-7xcyZ6w{TmTw%=w>JIbD^z3-RPQV_2T
zRg)MZ%#BrAd#Fb+ZVQ=i%=IFT;aF%_rG47Q`02H?{e=B|?>Yxao&mhvjJA12&PT%3
zQ#~EA$vsk{sz?n%FvKGiIjN24)n<n7`h7QqD-ECU8gB>P=d0)hZ2|nt&)kiNW>J3M
z9#jObw?C47XQDEz(P^j1a8TngtqR*_HOx!(+jK`WCWeRU$Zx)bVttUl$My-*=7mnh
z7!h}TOvZSn+bX?o*6s|bxKVJZnsRLL#$qSl=OxJW+yUT^AdkJQ{7?_6F{_+SBHzrO
zjqqj{V(H+%LW%L)Bpx!4hE^zq8A1e9#+k1S_MlnQgg+*=A%+KWrwq}-@s;-(?u9F*
zoaaeo%kW%5)5SX^%+4A6B@dmC@mt%#_XK2McEV0~j@8ek@u?{q)x1R&W3E<%8=0<$
zoe}5Gc3LX*mhL7m>CsX?hsiI~SGWxcW5z3;R=sHiP0wSumc8cu`GOxgM8Ri=49AxT
z($wK7iVoCCLs=g;iw^b2bctwGWq3;~*v@FQsvD@o2Nc{I^jYNzIKvP@$`qmc1gAL3
zMsoS}xxj6;C3P@m>HusycZ&V7_ppZHG<AK&Nl}S9199vg!D}&fM8@}b2we~_E5_SD
z3-eF$TmhG6A2#{#LEm*9^xu4FOOl)@x3k4W4$jgNw2EA!Cc*H5KuBMDFMR3C>kD&m
zSPEI)#OzJ-=2~CDHeb>o`dMMJTlW6;F=c}U;a$F$P3$k`dXOJQ9DMW5Co6PnRFgts
z>l$iL5<b{ex{MpZ@GlP3$*|2yJ_7OWS5dhR*==bU#d;`5#ee?s^@bWgb%k~!D}sw_
zGmkkX=k(R9_+0PU!&<W&_|p0jK81VU%M+tNyV@hSx>mn5?UMERyjjj7ct>{oYgxRR
z$R2ZROC^op;i3tl6tSp!cbkD}9R(Y*$L1=AwJWL6j*HvU%rj<JWgtQYZkaypmXJif
zXY7-6#Fu&T!gxxP$}o4XU7J?YM0km9@kNrHu*sCu21JWNmTzdN*(BAv$SBp?S!O(;
zpz>xso9KH4eZT9fe-h*7n2U7)lu>@9QkB7P0t`K<-@|Fx##V-1`q@1YNOS8+KeT2l
zPGlDl|4(2vQ?o8Oq#GCNtgSGN(!!lzaV2DzYAp>HRaIDO*-Xf!2BvV<!`?(nI}WtS
z=GhKBC4`o^JOa(*b&P9YrsG^ZYc9LqLj7UG%_yR?w`q*=@6N?Js&nBmT?_hGU2E$w
zi*sWqY-eSLybB?WpGGPz_x<FS7T3)P2^Dg;Kn!uiU_9xkkIPuC<wvCC0ARm-T2wS{
z9gk0<ov;#T8x~IG8g4cnm)${0w+i~&bFWlB`*x3igx4nVMa`M+&a$jR^=<8Tsv&~D
zVfKB!77muZa>ArF$(zB}=JNJL(3J88quSZc@ib*LK}k+W98wbNXZuB^IO_dQOKj7z
z_cP}l?tE`Bi!&9iH}T(x1rmkpSO~?K`))oREd_l@c%FKKV0e!i1fJ^}=e@hC9kfu^
z>r!%l(_e0_hUm?+oK-PeX4Qr~R=i%oLtHCT?-xUOz-C)mF274yi%ma4=KR`sr)q-+
z+Y&oDem<Y;gp$M;#_m(^Ofo!`I0De{lTS8dUH1h=O{{NpXo%ygD$jJQbDg(nILNt-
zH0V7~e*igrKBHZ-R2<{tw-Y+AFT5|74)oe{v3SpNAJ|B?o|jE9d&4-vlpOlLv)A*8
zU#=z(#3NoC<}!MziW%gt?07U5rmAv`!-gX{=H&U_rSQ9PiJMm>mSDcOFtN!pgAzr(
z=9Y%nj=Lj6i<7mHqE!D{C&LaEg+-DMf<AbH1wCH}<uN6!K=t$7EitLY$6TD_<R{Y3
zMyoZw`|nlSx<XDwcN!K=(RWC>F;7;N%W+c!^z;xM(~v|kD7i=W1xY)IOmLz#E7#N{
zu;>OM6$zu2s|xVl<Hakd7`4%KBaooY<9;hrWhr5lweMTFP6?xeX>>1d(+mu;`dYq{
zIgwOr1|2~UVTB<4xr1>gL{qfSnQBa(Eru|~^g|s)w$CNz?4ozbv8}Zk1e4%7tzu;_
zz<Wu%*7FtbR7%#!1_7n{9|Avz-NjC8pBS~jQSs-Ls(KPy<#2)W;FVg}xz&vn@!Zwp
zsma)b#5ek8Jh5e&HUTS7`QGG0xgGCL2KXX(W9##HOxMOLb!)P!78A!^#VgLQL$S6|
zrbPy5GiUpWLF)In6?aeDeXtoE9=bMc8sIzHaf8tW1IeOR-_K{*M%LZ@0^?Busp*_R
z%(RG6BivlO*5`~XooA_^q6lUOKK7YGaW0-L7#;=b5f7W}Bs%I3Rv-W5PNM2&3$m(s
zX`&&jJNN$$e6Y=&_>o`;Z?W>ijXz%d_ohAJWK;vmE*5B`zr=amh+q>f=Dlf!c~ex<
z=3TY8N14^+0T1`!r+dw^>9P?M(<?*nux&@GmrkFs{@8xMn^{PU)D;E4FN}J{!vyl^
z<4oPVRh9(5-P=PFL3%Wh%`=y!vY>YCX^`@Gq?V*YjWu}fh4*TDL;i4fjWSp17+dK;
zP;!njW^!R!3<3{wimRl+auYy7a7A?6PcOFgbOEEh7!IO78k=ye)Eh2@a<oFK$7?Q%
z-DYb$!}?0pBrDHri;m&IbFLvpps-|LH{ZVOX|JHe1J}6j@!=est^{!+2qQ8yI0RJ>
z>1l?7bH@1Tm=ZB&nKB;VS7V6p<8lK~ht<xL%ba(i2OTmEo{BifABki_LcM+eeR#9*
zbSK(aN=~k&S<{xJuMN`ci~JfdbY+Jsi1Ym7-(XPk$h5;K1)&<vnQu!<dL!#ivJcU$
z9^Z>J!qm8AtwycEYB~^!iz0R_T`FEW@Nc4`qbA<y>^kQPWvbMp18+m(n)WJxmyOAK
zk!HWxsSRTxln~$6%^;O!Vol%b<BuM08h`l3U@In2kM?8M!#n-<e8;0U=b}>gS`Anx
zqz314HoZ($ovST>ybRhVCoSQ3{7wp()!%R54Y77MpNTm}3EpQ2X}oowR3j)yU{bkO
zMtj6~Kd%i$@;>Q1JVomEj8&z1+^|U-Ws{Y`JS!`Sm`;HOplq_`R2+`;S~-c}On<67
zU0b~L>|oFLMD{D@DK&R-R6NMAH>OZUp?;#muBM`I+Ajd(j-bDleY_OIq>3?z+Q=*w
z1&#KI$)ikb(l68>Y_|ynHjfJU2`Q#du&mpRl98BhLB_z@_E?|NDqzu@dao8vai7Pe
z+X~sMYxiX)rn>8^1w%wuddO_jWVyVrUh6~VY65nhdd+CZD?_vitBdXaTBDO;k(v#y
zwi&P;*pV1|bCPYuNwa(bzPn;MdvV0n`_P}EpqYAFVz-lS$78kL=>V)S<fKci<Sc=d
zG&0|#r=DEOyghkSd_(X-WSCuTZptuK_|ojFdB21tx=T8#Io4@zU@t^mk5V$WRF97U
zEql#jH@r_9TExU(XFT6GprE1VZUBw!k{Li`Nq+EtB+|wA3MA}|A>Gd91539dW~g<}
zb!$BV2K(%1u5Z81-Jn&?^RH=8yk1wscTeFWi0mKCKLXQ5SBjRR;j8HusaY7Iq(WBT
zsn+-8NB-W?TvE?>`oq-^LgTW+Uj=~KbH*eF-SmCX>^XuGOh@AEJeJ45&kMjl8PM=2
zCMxR_cG_}UBJ|LLW|?$gL{`L<=PYPs$d(kSi+;L&sw(I(kl$!z>O;g{b<{8ehnJN2
z;?~a#$)mypyJ{9yuyG&TAP39ZIq$Qu`L|cJ@xeIsu+Ie-7T#bHaOj(h<q`L^;}8_N
zrMH}l%iZE}`}A))DX`F#SlkuGw7Mk)l+}on5XyxXe?@-5>A28R!DCdx<g;C2g%j?^
zSS>y`UrVd4uMY>~{G9K>mn^YoE-a`>$bW1;7v=fIt3ka<w{>|LP9@}rWQsBGj9U>O
zH@Gg7=^u+f6`771Zz@<38zq=}pkxIIY0~!bIGdt%9uKu3J0J3dL+kM*E6Ikf?~$Ci
zIF|+q^^&H|oyeKV#FHEDIj*K@20Pe^#-yOPSL9NLa~_$(CE|iqM$+{^32Ope4Kuc_
zR{1rF6}-isIqSTKx4f5emn`r5cq2tp6aS?{+%6wDg;$29{4&YH$pTbMl5~{e(qI!d
zARn`IF$5XgeZ1LyQD}h)+9<PQlkhO<PFlPfXwaR~z97YJK6dZ<#`e5z%_90iQsj`-
zv?1|XMiR;68*SXmd9k#zIjOqV@}3N=vW3B7V4{dah04xSW{FeFvM!fsXH2|OM@O|y
z>M$u~sn|;~S2E5pI*wz-y5x4U;^yE5OPio-r?e-Smyrqb7GITN{zS}R0V@{7;U?>A
zP!27|JWq(1_sY4n(?qA<nEN{I!z@Ssqsq>2HVx$Q8YSF-rdQD7mG@CxEcyrFq$%uD
zQdpwMlMgxC+Z~JPL0?KO9Y-!)kB?kUjvX|D8w;7XYa}&{drz*-_ef(jH1vSgReGqg
z#!0@J+TDY7*h=b<>7`U!(qX+sdD}^;D!d&q*Daf{e4Bt!F~zSfw5xahpCl#k`jyIm
zev+6~VwFl>z#ERTGcT9x4txq_3Wu_K`vL=VLYRl?NK%{UDv-s#VO@1&7(CQZ_^DpV
z?J!H}>Qj>A=kKD6i}V*ny`Bl)m>BKoBy^TI!px_n+_7qk>;m8Y&u&qPLAm2FPu{jS
z-b5ym`mY?RYvHR{LxTUNZd}k_zcq+uy^w(;uEyx~_qlJ_O4V%$T-+$rqB*9;2qT-V
zVKvI*)>z-`Lw4oMmh>tmXG^<{%{Z?Pbtl{Hpydy|+|(ncEZU&?##MZNo#su3(f&TG
zj8OhEv769(d-WG!hGc7JJL(1^S!@P4FkOE@6xNO{M8hCB^+#yVBw~y{kkeTiuTGw}
zzOnjjgnukOSz+Ej>H75zlIxjTH}fB>I|2%c<!2`BHaW%1iFbBpX}00uE)D%YWB<bF
z)+k8Ep<8{&y;izDd-v*MF44`G)YjyE_FnT$TmC+YH5_!<C)u1-zotoTIiF>m`Lf2}
zC)fM4sDjSpd;`hrEzup-{Zi_MU;Arozz0trv5<-FYODE9Ce#%Rvs9@qa!=@~?So0i
zY8QzlR$NfuC~r^@{Vt}tINCY|Ne+!oW7xg+OBUvZascC3lt;i2Ua7p2>|sL;*gw;j
zsT!mFp~!jUX7=t=#!q{D13I?;97NF!2H^wVHK?DaQtFMsT@+wIBp6_Uz<Vow_`$)h
zb-_j%^eg(gdQHjsJOtTn<sW4(V^u7dE;@ZJ4Te;fC?0-FW=V_nV08f@=Y*kKQ8Y#-
z(X7q`Bw|oaMc}~kH3;<iws0hcVeuXWssV;pd%x!T_|v}NI;T?L1V`NMp-v$q_nBAH
z1Qm@gm&>OSw*{mzPz8qcxi_<2L+kmFp+JSV?z{qz*{8^C0g#}S^OUom&$V`3Lw2mX
z*sy?)<-lRLQ=y}z4;&LtHRk7@*$o<<MW)SSmkg@j>*a}sjVV@iH53>M=wtzdn%lI0
zP52@22DH-tQLao^lCaktL3|015~uN}mUnlD7iiRJ2kiwS7~h<jOEreG`ah?prUAQ8
z33<+aM&|35eLy5R@;+bNFr3TgO)g>oN?Q}_Y6)^6#S1u+(?)F@13#;hmMaFhR3@Ak
zeg>Ic&eq?vpBU#oEXoVFpM+#T3~nMmUh=Uxq>=nK?za3;zs_%&c8688$U3Yf<|W{{
z$%*HbLt<WV)F}zSlhf&NQ&oi+OfZQ<RjZE_qXd7sz$26T3^t1COE`9nbq;+0?&B19
zJKpI|br3h$C$biYmel=r?LkO-A?ET!%=3mYjwKN>`_`*$2K7_4e6z8<&Dy?d{}5`}
zXf@jC%u5<-YTO@O(@|h`j(aEMM80I_J{Tb?+ZHbp{W80?Csi&&X@B8*mGvVMPY8XF
zncp{GJIt`ln9Q0OM6)KWa*<F&lp^?#^@$-Rt-^Nt7H*Rtr1vDrmQ;2aL%#$02RYIV
z*gVsO)(iJZ?4#B2157D+`?(dh*sM-)Y*cQ$%3=O;25b;(u1Dcfyw#zy`;aR@S7Gf-
z94V}@#Di8jcsz6`O*EtA@=U_jkPlj^+r?%0)=1_{Hxre2;y!ahM6v4#(m+L$Z+|n_
z8uG9)n+qLOidY@lidHI*K;~D*Ow<OxT&oLcq4d^w{{c}Q)uxPM?4q}+_~1zR^DBiw
z!UobSc}W20d0(#t7ZIXW5t#ZO^ZBqRPy*tRueA5=ePEXu<!S>uo~^(W`8MF&@r{`u
zZJH%?!P{=Y8o7!*&nm&*fLd{!Y_-Qgj;+_C@TVL{8c~s<{3Hr(>;%h-Tk2`1m>~f+
zRR^S%1la`<WH6{wxtd>sr8s_Vnge}Qy%PkNv>#OCn_Yv2XC%5v49|8at5i87DK&q1
z6ZXkLhlN>iL=&%QSjWCYUZV~SufRt?e#1SZsjt75z1SFI&_R5>id{=b40rP$aY2=N
zglW){+8W`o(R<3R2?+*@1Kx$)sW`vVfV;DuKH_%Jj|MJwieuswi_QLX(S>*S8Qz7z
zqr}|u9TpnWWVjo#Fl<cu8ZbF=hcw@zbSIoVm|Y>xy_Ea`&Fa)63mg38yOySsG+@=2
zC}7;Wy__D)W-rF|y)>LlDk5Bo@(R7Vv!t)(B8a3f89?>%wmWd|5GM+AUA0WwkfDO+
z??V_Zy53cm6I>Mh3PemXq(tL8gJBy>-A0*#a?iHj+bkJ4YI~O73Go&XMBThB;S6jc
zkU8##c6!7p(baWqGeBNQy}igL%_i0Cvci~&AufCAfmZ7MDyO#Ao|OE;jnB@EXboyH
ze4UJPt>3<(U}obB+Z(xEr5XKb`|}s@+Xqq5D$Sa2)z05Evr~ag|3`0vER?~}Cb@o)
zXB&(lKj8KasJ*1Pe$J~%&W~7N%sQD@U{F%*Ip6!ypvb5gBaz_<MRslKDfNgn-nZ34
zSL%Z{HrNGF=<HPd$A{6$Wd%$m5t;1Jb<Hbj6?ja&+M{x70Zd_X7$Aqb#ZhL`6ZV_=
zDC2IHAQD)dn;ca3XF}w&LdJS^L?vhJVBwyKxzF}2X}qLStcCME-7b(?mB4@BTp8~+
z8mC<8TZSt%poOy98saSyE7jwt+p7pr?CD4O>a0~x^V)obvpOj<%~#_+G{oaBkwhZ1
zAD&1RG(@EczAzA0OFF39P~a(q6h+=c+5vJYwQ7X_Q!c&i`V3em{WBUx&GUN&p5VNX
zi(>0MSxWQmR*jdPyK@xQ6~G6oG4F*NclNxzGSC!K;krUr)>wmo5)}RH_2TVjwuJ(x
zk~3p;uS~feFD*9cnoao5{p63ol0jYQ|6G7~sR@<k>^fp&9HV*Qo*2O+LO*l2Tu#Oq
z6vfbmdtmyxm3=W$PrSRX<1?JYX{d{L+L{@UvSgU>2*1-E&&?0oW*6EZd!=$Ml|W1N
zZyOKmF;qC0sxyyOn_?uQg$cw>Zkex@r(%^q1E%e1^z+@fS9<=D5e%{ksF&N_fUr!$
zGb%_CKLxCW$Bwhe@5Nl&9Sce;j$NVH>!dCuHc9epdiR=hDPp*lHNKW=?QS}Dx5xG?
zdXH?g3LA8<UOLc?))D}7VoZi4mjgbH>b72)1bj4y4PoIWph$+*Tbj{v(hFO15aN3A
zsbwxmwouyac~8;48C*jMjIOV0ezI+1&d|Qgg2Rt6383m$j8e))ZYhWb)DqvdvWn#8
zz3j#>@~nm14*bjr_%LH`fe^7!L8{2uOrTy?NF@lGj`fBqMA<Z`e&^U^3@x+doqbhl
z#@D3ud`u#D)_ls%v#l37^mDo`zTw7anJad2?xb=cZK@fg(P)V4Y20H<l!YyRAT2H_
ziRVMl5F<Ftv6w=$)Qkx_g6K>;wYSjqVCD8_Wb3D!sPg-MZWX?5Xs!>wIxBuXk|c~<
zqZEGLOGm*4n5_JWF$@Wj=A28sD7)~5Ng*<Jo{LWu-T_xLd%={LLh|=dDmFZB%sO1I
zMh<QB?qik$LXYF+qu8bW(o;>UN5Zc^qR(d<PX|4QwXJpxpI*o*(@PjcSrP0EYs?hp
zKUTWSEeWj>Rc;zKruliScjZ*Yd%5Ey<<AD0FaVd>K0ZP6K3mbI=!!S+q8evtP%EEC
z8ye^vT**Tk8+A+C)Th{ON3`UEhE?mkpGpMKn+0<Is{aofzPkfPyd3b&M+Eh?om8|O
z!Df8A)2L1b#-3H@Ia?l4?z}Vg^}RY*iiSl?j(*_>VoTYx^@d$n7^H-&cPnA@nOMR!
zd;s+zqn{wDZfbMGG_Zx$@#|D`;I61?xs1L6YP?$iCHJKdS$y!)!E!C94N|I=z6H<y
z>I4c){oz3-J~!><;0nmC-W9rhqDwAKj6Bjv7}XEiN(Pq!W{fd!dh(qb-QD|oZ`DZp
zXfCe(47?_RArUoxM*1e>X;lQSP{Sd1{{xw=+9jO%E(@f3VtY<{qgrmYeO*B?_W)IH
z)!BL15f5JcB=h41ITKac)F%Q=ON&USEUHw85{PsaN`36xf1ljb95^uZKx})(EwF=c
z@wQ*JB4C1(e&%NAU6I{xJp<>~^s`-%vv`3vggXg|&f7>m@Dz>TNg@h@J+X_PvkA88
zhetf-W5K$#b_>O|+M&=6N>EPI=6>5jGCx;KMPiv8UyRqn)LnwGldFD~QGaG|$xSXX
zl_&dk@Dfs>i*$v~w5?VGJ;x_4N?e&!8*`O0oK8qUKmg1-V9IC5drV{+n3NQK*Pmq_
z_qH(PdSk1PD0a*qiiornGG(x<;hh|>an+}&2otO`p8L#kE9Syo#SAh`YQ%~Qa7Y98
zn?}lDre=FC2t_du%Z|&=50Jjcm(T8yFGv8*Yjl>pS@f)>8+yMfj-OwA9?f;9Ks`Z(
z)iZ#k>-&e`G(UGh=A{4bm5OnYl{r3mYRWV?yc6FbpSU5|)>D*=>F$5m=X~cH%CN4w
z#%(;OcUY8k5l4hM`2GWRQQMU3PQd+@kut57(W-~$ec%G`WU+I{5g+t7m*aH|E+;z)
zeeyRp@U>k}7i@TNnoFkrBD^W{Zh`)|l&x7S&17j{LnHf~UJDGq=4sxoy|{30o6E&;
zm%3sI@VRUD;IR==BkS^-eNOiz)9fWh$YJ&U^Sp28d}G*u4Ofmn%6z8xcG;-tUDE3*
z=kAV*LmI|j+e6tmm4B=rP+fAFM#96-h?_2`rtt4xk6EDYi+uLUI}Rk=LfqZ@DD*s^
zryq4kiT>;lZJx*O!<g%cqw!Flm}|=JQY}}}B`IF8t1pzR*^TO+h61TvVD<SR6-I+x
zVbY;F*M2W}2n0bVxZ;X9f=7jl7?`8}rq1k7hv!Sh3o4yQYX!5-L!k5x2r(4ztS`LB
zg!Z7MTqYLMhBl;$7l%ZgkdeuEd7A07A}B87)hQK@U-K+OkXLeF{)@NroCN{#`ZC0v
z%t`C_O~83vJ@4Yk*GvF4E`W_!lOJ?nf1!Lb7%2x&mJ}nqY@}4(b8dNh)Z+Rptbt<#
z%=Bs&r*mp2gVX9f^Vv|)0w9o)cQ5o*p=y+<-jL&<+AFVV-m|Ylm4Wp3AU>`!y5+sh
z31E1p@|Dx&ef3|eMs?q|enxlx*AW8{Q`z}=uS_<?nWdw@9P_6-mHVF);QpH%|Jhk(
zPR5Hmo#!5AZxrX*`6Wr-x&Ev3_|JR)`eg)g#2`fA-@f<Hdx5IC<|iy39hZ)TKYxXS
zQd)XD6g}i$^X<PMXi@=4bA3lh{+6}{5S@TB{!JF|uTK1To!^UafHY9q=k$Bpr_QET
zo!9&uBjuMzSpd?0uQY~_Okuxr_5~}Cj1%9xBkuYyO*}@+1(4o2n^g3B+8|~3Vf9-N
z{t~xe`TRdC6XY-Q$ShqIdGh<wHh3{rlwk4ZNSl7`-LsnjX%&-l)!))C0;B@eeDSwJ
z@dK!KEefx-{#OeB&q~ez2;{#U=sz#~M<D+#d+7gf2&7#at|RdOLlJqVqJU!M1`j^N
zUvTN@-zFVE!?+o^|2=#Dyy`{|VA`~L@vmC{PaXUVPcs1RR$^8>a^VPoOr8Wltu?{q
z_n@W(fPNrn!2f{Pzie*(IRMq7Ky|-I)Ib3B_hq(zMdTxmJo)T80Be^GJ%10WdjN}e
zJbwI5q24bI|Dg(SUAlPY_n5lH2(V~+ite|w9Wdn0Puxs8Sbq<yK%8)?t(oDdF#Lks
zO_u?#Pu3zpzbDQQuqgT^%kO1F8sPeW1oPjj#{WVve;hi$>8vT?elK?n_<$d1-!Hyr
G5%OR41zu<X

literal 70194
zcmeEuhdW$f*R}|vL`XppC3*>>htX2>7Bxl}MlaEOO-J++WsoQn%n(K|qeXP0jozXg
zqnGI4@jTD_{K)$keBbrCuHiUm*R}WAYu)!+Yd$_#lP4vnA;!VMAyrg(rip`d6$yNp
z2?>BZo?h|~aB!|j+dO^xT=D5s#^)|hmNxbf92|~lb5qk>3J*A1&CE<qTf4Y9iCsK3
zKYR$+G!6V&|FgckzQMGsKIyZe;q+bd>8sj}IGGv^<#yM@84rtjTOT0xw4`FW>2Ij|
zDwB-<W=GU(N8(m!YKFxI?=Uc`De-b}0j;Xw6vuZc6U(epG8$wNE^#pW5`2K(Fe|)L
z6wA1J)l~TY<8GNf3PuA)F=l@J)&N`!49oqGFy^8!dm%XQ<%2@<qd#7`0*kq!q{*!$
zQ{o!%7@}e6Blj_c`QaN)3W@EQUAH^o*Tci_-j$gl)i^mIcyy1t`4Rcc<!$P_D%nBd
z41`73MG4+PWdcbYWj^Hk<8Argy?dkN4htn~BVGNUPuY*Uh6x)NCcEqF#j$5+Ju}y@
zuO?r=9$0vGcIJC@b{3e(|M1}y?#c-P&LOc8(m|F%6p*McL{HIDRTYN|xF*E8^4<mq
z54gGld}x3VAo!SfIM;x`w}8*H4BY>DdKH;*^}pB5=LH{YJylc${%V=KKp>8;)=q9-
zvxV(IQ)nA)JvTj76>)PX2VOG^r<V|3FNas>Rd6J{#DPl(h?^OsmxH~dtGJgW)4xiH
z1J~!b`Is30Rm9Csl1WeXIpb3&7YL&W??c{)Oj5**jEoX47M9|g&*c779r#a@$=c2B
zl{g=tr>7^cry#GBixnTgn3x#fLjgVk0Un?PkE^$%o0%7nqbu{j8~LAho<UsAU2I;t
z**G~ep0{iE(#hRTl8NcOqyPT=dz=t2n}2$8bp6k?fC=)QKjGu&eaQFUwt=b==Xb@Q
z+jv3j!Ov_Q0Pz5QNIiNeDDkiI|Le&=Jzl7(_fJhRA<>I9FFg6Xrj9Gb<*Abc(50Ky
zKP&T}$`>F0r=kSk`OGg!;@@Ka*Ihu)Qp6H`|6MaFVlFMP7Y>dLj^eY&+Fn;yC$4!>
zG*i}Z-oC}SGwHid>2n+Zaq|;C;=KscEW!^GdBZreS%gen89{HEG_ypPYj683k^87K
zI(5G@T2po8QmhC*^PB3LfF?nqCp_!^X&@w0>I)kY(G@&$8JvH91+%b3Js{eRFJKD7
z!6jt;=a(rFdFK|{m48Z}Uoo};ciAcp<lf)B*vJ(;Ldyfuf9n40Drye68#~UE*>tg4
z;1M43nD%mQas?OQuHsrkui53%T?ql7l3p0pdBZGXS3*WuJUf;iUK(!@PQ!yUf=hF|
zf)|sD(_kM{4RO1Bc^*Ng34vGt8kVA3kf})9gn)SXWkJY1?5Mk38z-2BUFKoRoFg@z
z+yzly!CT`EmQyuoOW+w}s^#G67ccl|iq?7UaCuI_&#3;CczW9Gn^{F(K@b${=eQf*
zZh+?#jQusBkG#)wR5%Y7FnmmSB_53V5d9Y6gEz@@$qgcZ%^cVBNxiVw;5Oz1944dN
zL1?KH{O0l`rYUeeWb&aOA4Clb<WT41{<RGl70=f-cTCpm(z*s$zo@5=AG`@Zc~-^|
zM@-&1S$lS)Lg3PT7~2Rd2#TwQwJgG(j8Hv$Xs5jK>2lw%<nbD>6??FMCAJ3RwCnz+
zy)4b?2tpy-(RQCm`#(eL!_Z#S^0BkS);a0GQlwtjaJ1>w%f*5I9(Fxy8|M-az1)o{
z33=z}EkEYV+mMC&e7CsfFL7L!SrCs5Fw`Hvk2YqSioU7pT$&S3@E^*Juyuml)wPJR
zvbJR{tCw!0#SmrXch{-EB7C>z6i14f>vQ*~U+*ig4CKx?z9rcj5d6eyx~RsfTT{{b
z$0{^_UEAXCk!#?^_&ppu39Pjk3G8_JW_Md%TB+72QqI8h^!ROGnUODSGJH9(<79t|
zUC^?#7#Ga*D`+o0&{AQ0K^5V%*kcma4^s!V%=M)Aj94<y;N75?;1G3uqtD(Nb>BZc
z0IpCm`Agv9G+7d4V#q9SlPL9QWy%Sc_v;iGwv8}|9Qz(Dq&NY`LduYGj!IIhzsN1Q
z43~HswI;sWov(iA!boHf!NqpQYjKI_J15UfclDMX^!82QEAI;p%M3?0z}*2qRj8rZ
z3j4WksDW;wJ{t)oPqe;pzVc*^_iW$wmcQQJ@f?|uYsk^M&jjC!Nd1~je1C>h&rc<t
zz3GW?k$&{(85&{4enfUJst=;1m>a{&j0oIY1&>sF*4=4MRNq@Ci*sA<SLO-~1ee-=
z8j+s%7!N$-p~9*!_pzEwJjr)}8&)b6Lpp3#?IPM*3+R!ygSKr+f-r5kp7F72U?V$r
zf1%3&y4oJkt+X}QHs2b}Ts*KN__{LUXpNg)%*DcUW$9<|)!<uqy?(VT$G4lbCkFl+
zoh);xwjZw0*qZOMIs~ir<*3@t`yRTU9J-HuH_KeTP8j8~@Sb2-HQ~Xbd&^fOA>lA<
zOJw>h5F{hXrN(Vppg&zGA>H81NUzOwM?&HE;(Q&%?@iQrh4a${9+Lb_im*F855!#O
zz85?$%*+!j@Y;N-OMCqI!nqO*VvpizScO*CeCs)$_%*Y&J2cfgubc=CC6nBV8bBDd
zjCfAyRl1bc>}=($p@;dUmA^FNXM2ZPK_z@=KZ#D2iM%I0Qlk;^`q>?^foRZ5N2Rx=
z2cEF9tEakg56R{P+&ieHcwR~Q=G{A`b*U2xdM(rw?}HL`zH(Duzq-ZFBu?yDAPcRk
z%u2G<8d_)4mmNNpd^Wq34*BsRS~uRX(xvS)f9CwiVwxugMzH$yy&rd^#MXB^E#2wi
zwI;P<i{)FQQ`)&&ieU>~^Zlq=CcM(3qPu@~8IuGcd1GRWT~PKzPQ!}t55N*roGA}C
zJ*ma*-)z?)jWST{CEi;4W!8>XZSmYM#@DR&*Csl>Pd(t`9`=0LuyXemWbnmPz*CN~
zHv~-QK6rDqRnEj*+=tdgrS9w$wsW+DB<$ibuF=yi1k>G@{vuEnFg}6z(OgobFib^K
z_e?SA;pvN9>kw^_`&yss&j>oJ^(y~DBcyJ!ke!*X{wb*M=8yeJJMOXa^;aM@&w)(6
zUZ$--=DSRBP%&RQW3L&Cav5E2sF<sqvF|JoxXR*-a7eCqBCk<Q0^8C=jSX_GiuGh>
zdNDmPdV8^_qx>~N6@H0x(JQ<0rf!p1wvP7<9y`x(m3>G|Smtn#{rO1(-D~xw>8y3S
zh$-o!T8R3F`;oG9v?1>VO8z1@creAO7E`p`m#w5!?XhkEX^EioG(hMH0(;C>PA06i
z6O4RGQDf1aI)bO{0BMWKM!T6D%{ieC-eoDq>MJF3L9Ar|(4U?tl*@?ZCmD}dXfWH|
zdDR>muj@~GN^t#;T)@#Tm0jS{_w@<f5s8J$i3FZxaDQ;%*$LU=XG_ZxujSuwV|a~z
zaMlC*DYJs+xGJY%igfpGr>*o(CUcRP>%uFNcfx@?OD0)%iE6r9PN<Ut14e^fO<B7+
z4>WwFn{d%2P&Ed4XIsadYR%|w8-!V<c`Ff9a4nTB=`IUoBTyJ22UWYyQk!W<b~=iH
zkq5WtXJ?r+0}n^2`O)I|TZ@UrywZ1vTZV(-#-0sN-b$#cmSMIoX`qknQPvG`nDU{|
zujk+r>)h25<d6y}&s?q&d^<-qWnuF(<Mx^!=(ACs*=qwRn<`C*=j*znE%79qES>xz
zH(a{%P<oFYZ!JkV*y#!~-^2E(p}LnqDwe%kJr)W{+wX#;`48@x9jOVJH9oWRooRfF
z208AI4CHD}6sk|TrwH5WZ6pZWQBqrm7^%{{L4c8LjXNeh+|M(DI#b2Ed~|h99A>MS
zHp(2vN<v$*)J(`$o#X^gp2<rXU2TS1-U0W|cO)WmQ65(dxUUBeuU+*n7!3P5lxfq}
zca~}@Qbwtc4t%mRTNUD#9ZG@lHB0yX*$Lju**!V={-yhl%gN^Nw^Sw`?WF}UQ(bPq
zgLx`68G+9P%SDa1aU=NIQQ`Jd4z-<3ey(#rT3}hdN6UIP%zpN#s-vo~?Qs3bkVb8?
zux&daJ!s9F;R+9IvY=8f7PFL1*SZn_i(p7@j!|05i7yFw_3HZ=zpyR(6)qUD^W%0T
zr~$rKsE-x<Jm@)VOJ1P(!Xn_$%zG$~mOR*9<AHkc7zv-$`keIkj#l4tCa>DBz{X>}
z44V_5eFowk>H%OsA=?|zisawUzPyRzQ9lwFz$DWLR3sn`^3hMb%N*Yn+EJ~zmiClK
z{81?}>K47ExTu4lkyv7vn-3Ap#nLB2=*pK}$n@;N4BZZC`=bag`hHTV+-Sa)dgP$%
zA~EgeK;x$rk?O%*{nFww6iQv>%j=P@l=2EFGKWaTC>BMq)Fo=-*%ec2IS3ijE)Dgq
zW2iU_7<#D{SUZNQbv^UnA4x%bMl-!lHAN#B$GcDF+r`BWQ*+h2N?{Mi@a@o*>HYLZ
zWgSL!?)nu4pZ&Hh8SN9Be>4`*j+FDVLDUD);^Mb3G#Qw(1s(&`xa||n3ja)hrn~L?
zo|g<4&7c~Y^K)*<&d7SQpGK!Ix5b&rQY%M+I#Z)WC|9c*diuLr*|9KD%yTW(!28K+
z){gozdi5;{)x@48_D{;tYy}&%50f17y0CIBd1$91y@_|gN^UmhrHdi)?YSy8BYZL0
z&^rZS$FciEPg!^=9Y1*u_o7xJX~p~C%U{89Tz)QH{Z(lNeBj~=@LOrBql-rrdENOD
z<&$h_ABkRJ9U0T_NprbZm*|sUT5S2od1asudfndxX%lOZKf)_~L<Chz;FzJbU*>8r
zP=sMtFczx=NO@6Cvz(eL0&C@jihZpq4NNkZHhj7&g=4HBpBF>qyT5W@T~bH7-4#=9
zZB)q3Mk($>r_)zo;*#Co{Q-%3r|<%-=D+>^`h<tSa5Q@NPN$svjrNPsV7i-#MH#L&
z){qx~sRj$%OxvpSc}$dbAe4%ZGaoBiF!<8gh#^A@?22{EYQ@?sM<uM5#U%$zjkU*S
zu6}`5d&uh;`T6_L2Ol}AlAxEXIuZ-NNAy~mAAR0$U3sZ{m;`bvu;@sTY~-g2cNqTO
zD=t^)uv#%S-VH7~e(iYlu}G^M!d0B6el#Z@GCovu3e$|I(cCXO?5lxrV~m@d8~aNE
z!{Sv(f!-z>6JBCEUN{TgG6_tXw#Uf*sd9X~deN>58X{sDZG~gvr493QRws}>!W|9<
z9kVez)SX|OnF1-gTW>ZYG#allc-8wfhogtGNN&d0u0KZJ)s*V>tp3S557?8~?>|2!
zCsQPobgbVFq=4FDIBPdv+ASuj@;LRCyj{Y$xXGIN`oI^Y^%pf3y?ZuV1_HOJd*5b6
zFi6j!J^fWx4?yIdE69?r6w%v9!jG$5ibkb$3)AjN`3-|N4}Lu^I&_GPdskQRS?}AY
zQF<|#XQB|m28PQVEW^^`=+7{0q_n~hGsl|fI_M>Rk{GU?7OhkjNFXvB^%E~48AW+U
z4LM7!#*3pd_f7WfVtFff19`~oRt=n<)`+<Frmc=*x)d~=Zadb%os=Fcqx<^TaE?CN
zU`bAU6@9r?PnrUiS)Wf;s0*JU>5#CEDVC<y*2FEe2)grG%HL<C8ojT%9br(tp8Tb7
z^1#2bP(vzz1uY}7zH_!hl4}+60<^rVk|Z!lWFc%aHFkIa^T%>I7yo*lE|Skxo%3`-
z=jrwW-}mBBn(B|Uf$r6OG(X;vS(HYgS?^y!B{F?C6*f$DVHEOv-UsuGP|g;bA1kK-
z;Q179Tx`K#hsTiE?B_P%(#a>SSh_Me-o3w8?U1Df+jI2ZyYupBjCW_V*4>fr{;|XA
z-P?weSV{?eyw&1--{XMU-4~GQ`a<~7>=NM@XmRojJYk_=jC4Pn@}I@0Cce9ngG0>e
z&4}Lm{ewk=4nXs|`L;M{pP;v8E$>Q6`++=6cE^V1rIwT$q{HvAt=F9uj8i$zTOjh8
z%LT1eVwq$ouC`X_`Sl^fyaP9`Y4*(v%h3#DFmHvHtIY#X+~JVi9FJoE(g(%+9kvtS
z3Pv2moGxk^1-~ol&tq?$l}x(J`Tx{~EiZH=4*BrzdicVE2T=Y;ogh<W1%7;QX+Ft)
zn~fBHExEQNW_h<kgv-%qK<y|lbS9a*sl0sA=h;QDI>}7kmyOK9uSPMk7o&!UC}_jX
zTOtg478lxLTaps!Q2zcDQ8^p^jZH)5m(NavAX9YpI$7=03pO@zxNb1MvP*-%e^Pw$
zpg1qGAqUV9PBq*+e}iTv09tZ*b3FU2o&R5)@&69V)PV+bxnC5t<_+3eU=k3TCDt08
zCZ|{0;yATxJQwHMVg)Q$3k7_;B@_WHDEH|e?}XIy{joBK*dp_QnDI*2mLoBz@`m}2
z7p?EHAjJ;Ku56>~eW&uuXJV)2?k%iKny<1Jxni14RuVgJ*@)p^RFXk5_IPUw505(d
z%(In;9B&>TU^5D{0n6~_mJ@sCi}Zl4MTS6q)hs2bk|s=zN6@M(rX!IzCCH<Nj?B{P
z1Z0qNBKQ<Qq|6NNE2g`y*s9&)z_WlPDObxFB1?l$V-H-`Y_rPq40~0|={iqq4nKq&
z2k3=Dl$n_g62f;3?_AU$^%HziOAV_GfyeWB#ok*B@kj0P@sN&$jwC^=xz}Y3N&xGT
zWn3#iD=Q@=G(cog?YYj@Q)bW0shJf8M&@+%HpyqpeX`wjNgK1V7(-)q8I%(_v3N+Q
zn$x^Hf|-N+Q-M=hA?UZ3vfKpuJ$$30ZZY$I=ji<VOv_qIC%?@yiv~#`71&d__$y;d
zM+shKK^W8LS_f5{3nU?<4auL+L3~2|d|#e4=ef+a-pti4%?oFc){S9T=WS?c(8SEh
zBYIm~7y?z~&K~ux^t~gcg#aoSZYnCjx2idTm%fhLF8gzIl%g?+-9ixs^nZ><M~b`0
zIb9=*&d_>{9vDX>(&Fug3KWr)J>dS&rTnC+`7iRhUZbcPBPBQE&H?-3?lMn&zIF^i
z!zkDF)WxxeB`U2+RL)~Xr=s{!D^9yJ`$To^y_qd=SDT+Dxv}tVKI39-pWQX?<-VMF
z#lRC@2KQ4vbb$doPqJt%fN0yq1*@vOdL_g>Piw*jhrV0)z9b?RXU$el$tZQb#;ITN
zeTmThEZC%@?KV5Y)kY@&#Gu?U^LS^wN3-}D(ShTJsO|_>Z^_#2WzNg=Q}*h;^msY8
zdgx9&B1qzo+&8xa-^An6nTl1AtE??m8_P)=FP9EUR(X{t4~zC8-!NaSNLtij@M4zb
zm+-#gCu-h>a`ej}-*mTh8gfdOl+ggT45NXC$GN)Gd#~qyl*|}j+`{D2xF5v@d{>8^
zxuXUPM4fsEh%MX=u8!VZ0Hak?M3lMC;*wcuMIB?<y7cw>gWUsr(j<%R4_v_29?)YU
zpSV<M&q*R}6Tbrrm~kY1?OYy_g@N>t=HA*w{(Jr9Uk$Hart7cR`69(4bC8SONiyQk
z^y@Z4;iAFc*r1cut91}`*=eN*&oI`I2G361eI?F409pmNDPK;PIvaCUcCs@$Gpwa~
zP>9+~=r2PLVm^yFB->Awfg|Xo*YJw<O(N?oa-<og13E|55+2z57mSs9^&I28g2kR%
zXgV$F+gS{*bsUqnWR2$BE<T>M)npCy@%C@jrA9tnrB_V8Q*5#AjENOAA{H|ZF|jMz
zUud`w<L#*Aw%oaFvFvBb=#|7NB%&;_`im;=wnH9e?wP67@%Fp+BsSyUzQmtF&VqG=
z@-l(#@E|^#`JKVR_99;tJ_)7%*j~DoL0Q~ek_DyG6|??#?CNPRdDu!_k0`4{sqyKp
zK4pkgi;9Zak1ye+h&NXIjoixBK+65GEgEGIm@@#Ec%f1yyq~nk@v@TAihK_l63$Nm
zVISyyR}go%clyL-mt(v*^YkcNvzb_p&Ue;>XVqhEZvShoRjSP1RD{m_@2Hk+rDgcb
zcdgm$b!O7y;b70sm6x^GT$PrFBHPRP5@N;4=Axi2eC;0=Sm!6$L-ppxxoE||q9lw%
z@Uz$EB<II3?3Z!H;Af<kf{@N7Lrl?a_EZOTTDze)_^7TFk?0!B&<!p1!9-kqVm+M~
zQxA}lzUvd^*?L7^x5kk?hzE2t;Wm95>Y&;qN7}Y@>GYbdtuPN=cpb32Eb!;VKj|F}
z<aDLz){T|f@$J$Fw%e?CCiQoFxY2%u+%%GQg!wtvBQXBELp+*|Dze7T)2V}VB|%!~
zeRIob4prn39Ys3XV*4Lq`RvUTu`Em`KEm(x;sJ?+TPE{WO)y|O_z1h*K0e}#=+y(6
zH~yIFa?Ms|aa~a9L&|&FJ?7w1hO&J!lI_bP9YejE35kW#R$0g842Z&x^+Ei{uDiCw
z#5Lmh!$YDE%J$Wl8J2tR-ycF0cO>%p!eb{S#_ZVryGu`Fd-STQRT)hh!mC!?7KgJi
zLxt?gvi64*V^uI-0?_-c4H8#gdpW&kzv66F$9Pq5Y=C#a3MajJh+gF@)zdMT#>3-k
zNrfDgN4l#7?S%zk43ha8(V3$Zue4Up_kiPI6P6BNGy$w=sL1imdpby8RvTI{4~0T$
z0`v@K?HJ@6v1@2&I{g?Urr8C5KGWb;?YbY&ZB?3GxN<O2)3|tiK(aOV=A$Eau{Eh_
zBwfV+oj2uP-ZDm;ov--QvY@5DETk(GSl)tor>@^>(b-{Cygm<<R7fJ}KEOKV!zO&*
zZv;AUx38(^b?oyfD{fya?y%F@{=j=<FtFju?ctoLQo6j>-Ybzx^O}}4#fpJ;uP`xB
z3f`V%Ovf~{T|)WhxF2ac^RW9(?-kJYV8q+Vw1AxGI~;o2`lUBg(D?@di`Y?x&xiUG
zvMcG?ZJ4W%$kEQF*}IotpkxT!W7Y-x9iJ=ybMAgHj$nXQDIq#A=VTV`7L0p<u+kSs
zn!i`m{PxNjT;o+_K&KA!$f)t%cU<1uWZzPG{bBtV;-#(@I*UYI(y%%WDU)F5`w=qZ
z)BR_%z+fB?N!=t@<LZ&j2dUHJ-6ep>@pTe6gVYUU=Gy!$exhRqHqwnWPq!gk<9sQQ
z`L5iycqf8J^|<zXXdXdZ%yzHe$n80AHwn~{n(xKMoc724NZ)B|`lsc`=GI*7t}JZQ
zw$I6*wFjPb_IXix+rV2jMJT36dfiIWDX(y=H>+^_V0(YF+gUf~V0L!a++l^o(t<Nd
z{fF}4V2FE(SBSUl^Ns`_c*b6DRb=we?Dg<pD(S|OSxWKkx+sD=|HB=ZeDgwy)J{Bz
zhtFz}k7nKJZS)h}*`KFe2V3*8F|5jZ%~GN-xC$(dsj^6(*$@v`YKbJrCp7H~qj=!4
ztXt`BoF^>b4cs~N3j6rOq#Q;Z(!Qu-*%5a0iF{ocZ=sVt&5`f2Ukcub7PvjIRPt<&
z0Yg?WX8rx?BFv?O9Tp^*O7MhN5m-C)5+K~qk@;F@g^mZCIQur%m<#*vrCbTM`_i%3
z7R$~Gj5>x%mN;?z&&U99c4;p>eSf3loM=p|R&}U7D+MgCuRXnvQ&nx=Z==#S`?8gF
zp~I<0>4k$<CjH5teR2tIE5&H!)#KI`)+||z#qf1MsHWfCxK3N3YnF)L(IHKG?ZP1F
zK=2?ey(99fN3C*$=v<9AkNS;mKb}iyVNEp{MAPYWwUQtjFeXZbx$^o`0V0@hZ>52h
zMuNHNz5gQVL>Ae_6$TI^FYdnI!+gqWPi*x4rgt5wm97XYZ<3Uum4U*u3h!(7*UB}(
zRH7o6e0G2rG6QgWKJtSe+DpHtE%;z`5rP3G72nMd6<jfiZmVkUuVwbs+FXq<6<}Nd
zT(SJ+UoX93j6p$(gyfw*ZJ#nOA1OGv{8WseKUGo)|22r3X8_7lcEp>wV8or{qz{$A
z;5rfCK3=5l2^ptZfnJSWn3pd3oq!{&6Q9u1+)-Bb(iqPt!T5PMhW4@OUtsMe?=;nR
z-oUfzgrJ@jK}W1tukO-^L*oJ3s*sBv60t^QG^{2gf{6y5MrG?Wan2SbilZ)!DQJj9
zn*++H>%Rl8otLqOM`T=btetBIPrZ8ffh^GYHMPi#O#@3P1IN?D;nFqKzU&<)-yk>#
zk`*L7e|yz+fyo#B{`yxJL89j(Z!*gGds`IU0z^(h75}%$9|Iz%UBmVNTjcS8$l(>=
z{_<;2lLEa?zM@*Xdhsm%*XRL}H_Jl)61fvOAo6$BG7Nu<oK@x_EjKUMUyfI=*EkJu
z(Q*943(Uv4oXEKW)U4;ML4A?WB$uhD1)>FNXLx^IyWDNC9^je&85-99*Q+tfDDx0Q
z>KQC`Sy2=IPy)R8{}+fpVDi^T*Tkn5D+`QZ@>g=`YsPW4k6+Biwe`n|#i!qC|IJ4>
zr_3CAr-OsE-7<QIE%MT-N67eUo%qk2WH%UZVE;^*fOW%t>eAJ33M#%c%v<`UseOCV
z5}Lf8$)G{^?y$?d^VK!{HNA&pn}w1Brjre0RXaD_x0KG<-a6%z-uP?3D)^l1m=)_)
zZgY>;<a(0LuR8Zl^r=st5Xsrh%EroF+6ci}_oKcwto}B#%If`qa9PnD-u}KR8z)wp
zt`dMOk<b=0_Y+nG{k4k552CE|sWBhypWqeS<~J0TAr=|$PpjerhSB_78>7?8E&mIi
z(CGqlg%W@`qios#0LRe%D%-tB1a+&01Ega|iB11JEWM?*@om`LkG5DMfBjMQ5ZuG{
zEWfu(E>kD-*{(y5iW|gB7vHf-?kJA_@LBUB*ymepb6=lp<*39L9+JgL`tHdssiEQE
zEQ9ibzGB&JLdayC^Ujh+r8Ber@{-$fpHh|Ea!szUVjkc9`}bXr{}91?z{M5`0C6CG
zWF&q1EI>rsYuE;xOc5h!rRJM>i3O`54aQ?g8qBRLueNozFHrBHnCk!JG+uFkLh2yB
z#Cy>{G8n$64vPu+V<x}cn_s>(py{MK&#fID8lR`1?nFSkhjwK97=SRTYbet0Zw^bW
z*gcxjClfmY`286Bkz%nU`-|^HJ(h^Y>tX(SwCd`esl|II{d@vGJ3TjfGi8F0Z*Iv&
z++{Th7?ge@MZKR^e_LIG*VVEo3P2$p@TC6cp`rcBr_-Sq&KU*9D|L9bL$-V4^W?ye
zvrbiu76_{=LBwc@+^gk4q9>Evsbhccq+X?^O4!MDJll$(1F=n1@4o^$q=+~vw%lM)
z%G1t;FG8%kKeIxs{Z<D61~`2_Q;qINPmg+cx-=iiW7Vx4@X*`g3v=tj<1*zV6(_3P
zS)RVTu2$)IkMMfjCyeMh=*|MBdam5dw>ChdEfdwADSHvhd#fW^*1b$I%<?xjH#eR0
z*2c>D8lOB1zDCx*GHA!5nmnMHr_Bi~sC7QvvB@{=Ijg_AFTVsc;>%m#rs8dlz=Gy}
z%{0Y~dQtG`Yj4eWSlN$Xt!{cB*=nXGA6plwgsF1(9V(ar{FRh|eGwVQYjjS}AV&Dr
z08%9S<l0_GQoj{z;HjS`T(9@8QOlR7?;#VT?lG)(madb1HzP($Y>@Vo#e)b2gK~$&
zaB4xNh*U8algXL|pNQ6M<;1SqR^D@hiI}3jdgAucG}5Z4J-O5lF+n`vA^#|ma%nZF
zG)LNlOEc@cMSGkguW=0vKw!n?zbI5{i($<&Z3yw8KwVg_ihTTAJ4qu&`4Md-(k%fR
zIlMi0;sPS)MbBpVinr$|ID1_oaHq!4iAt^8@h(3OD>kl$-xE{v*;&O})NQpZZ`n*4
z9C<v3MOL*|IM<C-3oIn|ZY^cH!*gLg=?>VrvpvjR@7b<$AOhxld?M^juo*9uOs^qS
zDiY-Ud);O3!x0%yWOC4cwNu?k@;N+wXiS=={&sqxn#*XpsE{?ixW#wtUzxd2TO#Mm
zr`U#@9jCHYq8@qfsj#c3lb-HXe<^mrh_I`RmP}4RzKWRcM$|V&sFj{t{wf!E`9on*
zA8UK)w<$VxJxaXPZVYTG<Qvp>gdQEbxo#3Zh5Xqy_$2Zu;17AOE+X00(1Mo6K47bk
zzSwqtg-|D1*pA8nXeVZ8xxYHzrv8!Xw5UM9F<$w$E$i;R&6DSxfOpni<!z`A(?Aie
z?{?QvwpHYs<4_jlXpf-c<RL#~WlF$p=~XYPicN9|v|htQN-HsIVS@4lhu+~?UL~Uy
z2Y4P6Cpmw4G4HC)aaSIMT|a}q!iDp1ybG5|yvyrxeUjeTC$HQrzdf%2F>n4y=$0ya
z@<i8adMBrzW6!c$8~?zK(`v_~J+=3H*tyanV`r(MLf-(#GXM8#H$y-UnV#wDkSOnW
zgTh|Ou{4lXT8Z_Dk{e!++IjRrPM5ydb-)8bpg=a5$1~>nW3A;4H2}?e2;KvZ3DqvU
zfr=#ii4`fPT*!>pBCio7gXlUoW1`eBoiE_@AQ5u>X37W&#b#tMdT%zrVA5N1=Bqu{
zFUgn32<LwSV$IaI0LD!bE56%_>{?p~t@W3u`<?7&5H1dy4<IMacOkPms#U&YZ7z=6
z#&2YFY0<8w{1AQi;+>NZ3`_tE^CIy3ACHZw)*H+hIQrmfImXAYM|OkFG9!z6s~mMl
zPX-?Rj;n3S8@@;R#nG^v?#s>CBBym@b_1%--sS4Fm;%i)n5X*U_OSV`gpMmNtAjFZ
z?eOTRqo*!hnEA8xqutWg*~n^zrgx;N5~Q!h-PcxDG1jZy&@0^mvp-28->GW{gGPl_
z)9ES6C3m&`^Hqn6w=75V3+j&-XbZt3hg?ZR#(^EVF(M8$-un|GmMjOty#PU(YAZuK
z$n=6nr78j!<9!&o`_`Sen$E$l@y*9Wiu=oAd+XAS;<xhU3KTm6PTXtkbl+eLy9f*I
z$WKrQSDrYyy%|$G%nVlRDUF?cy<W#)v#wNND3<Lowm%;&Pw%l+()IW?3b{8{dQy)!
zhe#EeupTWba{siuBDIph5Foz}@mjoLIqK6Afu*yOl*3pXsVh>Y_i1M<LCVdA)C2ES
z0zP`jm<w9E!Vcf@>`Nbq^&WxI$FBpf8nj17MV#a5xjTlSt?`Ofke}V58h9wW?+IIL
z%|uqiIKZYx0c@~q@(Q{ZhD2zo0LS)%gaNqHh4nV0dwDxmr-`YmJiwnNd5aVWQKYVL
z<Vf|89%M#*J)n8MEM!L4JRoF;uIoE(DnrK^L(yY}Q;WK&)7+P%0YfTQrTzATxU0zt
zyhbb|#g?VT`XWwj?wG;yGU0C|gu~05Vg`telO?m95!<QmG!Q!!<Q~_VBnWOH0Nh<U
znwSVFQFvz8Ogc4Mfb`Ch|LBlUnXWvC(d#-W$Vu`w+`S1l8Y#h)t&~vGZBk}Wz38qO
z&-LOC-F#X9F@9K<&+ZC(ZLUpg)gI&fuJYQ5Q-Ktm8$3o5WMkr{ef*Y6-=ODqB;8TI
zYpNPa0j(-ye!Nvr66Rhet#kwpr?4IR`_@jHkke+WR)PEO)EiidTiX*(?Qa=CFqCYv
zki&hCpnP|-dxRxvP_)CX3kJ4lrc4L{64r_P+>@)hrP7G%c^`%lMd>$|xZS7BSA}0J
zKIjg3MpHfdtrYmAtKg}AzkfKxR9?5%`tE~!8l-lftM*1pE#{Jl@fcPpxb=RG&({?T
zhSPfiL5YihmPB+BRl9z<5us{Oah|@XXs6*jHV+MI^!R%tb7tAqS|gyKIn(L;M8odf
zQKhtKyRAE&WwyI;q=I&>k2|7Q9${B*!?3=5G?LJTu&0BLo6DiCx>H$$gRen+Dr~Cv
zO0d(@rrh7l#_}M>x#ri3lVMsN$_X51R0f%8MMfXm#fI&dz8Vzd+79M*JH~VAq&iFx
znhfy{Xe>N=ORQflUNr>=Yn7XdENMsGiD%Lk3%s~HY4L9feXgagcjIS*Zsl<@PNPdE
zD~t_zZU<H6V8_a<*V_A7&%g}jDv5MZVtAPN^0y+XqY>CT%&{R~c~H;6_IZtI!;{6k
zbR(p7p-3%j5n%d^J(6RMfJ59D0fv@iS|*sGY#7~<ricjmsN##aXq_k{d3vmX`c#!(
zjGFLi_k))du_esouFZ$c!FGMQ^WwK?88~ZPq2i^`45P6joit&m$(jT7@=n?k5Sejx
zzgoSHSMT9(yRVH5O;Q(^Ire;+le+Sq)r_hHGm$=Pe-xUP?|6oQp)T++hUI+yMi`Xs
z*U5m&jOs#cXR_tdu(>;Q8ByTw??1ty1z1(tc16OtNgz+ha)}{2ld12RKG^`&pWoa=
zOqk)LF2S5bu6w@8MFwv<JlyW+!(_%X)AdWeHoy1ksK3uvPwdtzi!X1K2pg?%9$xxp
z$LfE&n@7#FTT&5cCpmFLnu{JKk#|C65+K}2hAZA@n5)Se8OHUt?iy7m=FKgxx1K03
z{@<?i1>QdD5@4@(<!@5`yccFS$w4lC(}d-PZfgzq-az&nlIu)jh<L<eMC3q)+0&$x
z^?R^fRC)k!-SKfI^<!69|00*W_Mlo}-5QEK7Rqp1tuWK*2o@);OaUKrRteekS-?UG
zpjWT?ags^>$)NZnan{(;-I}JwnM_I=VLR~6Owv4GXIHEXEO_>DfupB+2DTk>>YTOo
zM2S;%TFU+p;WBbptLNI!rv(I?1^Y8e1nSB|-Ox_KpZJL727D6P>%VsCD+sp4AqMG>
z%VJN1_+QRN?iILU`#AgF)~6~(+ke}BN+vmnH+VSyJ%VMdu&>vl3mJ=MeN`&_=K>}I
zNQI+^Gl*la5g$gAVd9F-KD`ID9}8VE+sWd2R_xHdkrHp^1Hf$#Z~o#Iob5SvRL>LC
z7yl|>yTG2|)_i$kVIjrRNW9xylOYWqQh1(DphB8oUT}%+$=4+zbANQdKkKZVCd$v7
zdr6G^?%i1#UHMoet>#dQR3jtVp<VB;b4!%D6w{u$n-;aelO9X7;9n7)J>Q}GNLJWZ
zHxW?9ox~Qq?y_~q0zWyGKYZF<n8+_!*4Z{TCAAO+d@>V<H_qhOA43w4vip;U5C&E{
z{Z`3G{(IS_*72yTUWYr&0FS4e{{Sq&P@dzlURk<TYVf#%?u8Z4A*RqkT16#!4n?l>
zr)nnoCDlLhJ=j;b-rtKqjhdb_K|}7u^MNDc-B0YpBMwPVzbqje&5o#bRD43uq>rWM
zl*uUk06}5Zln(POOhaqWZX85o%Y{fNM|$#Y8GQkqHot6@Rvgk_=fvBX)q`DG`XU9&
zV@@q#{+KCuVhvqS1&ci@9-0_l^zbLpd$ET&_{EIo4iZlqYLqYw>3;m$u@;^4xQXp6
zHx3n#<}=Hlv{_0Ed10SaQ77X?Fqn?@WObX5RW(^i0I=V>;~c7`H&37-Pu_Ai-`y3v
z90}1F9)mLRe2!|JipuQ}u;fU9nhr9}rz+Z-5!HZKR-jdw?zg45NIkUC-vHELz8!eh
zL_-u|t24`<?$=n;vxf$Gf&2$#Ptzzxh*5wy59aF=S;~8f3S=T?S!%U^U2OTR-+zPa
zB^gr(5sFu8ohRm&q?2l8INbJ)pQ{>X{3h}5gfAqxq_pCX<gTgTl~&t<78EHSDkTP-
z99Gc@VAlhG+_1ogm_4mSPAcd3tECI(pNuMAo$ir3dIC6XE%5=NwRzATRcmCv1A+l-
zTf*78D-ZJS8tK^{JDE?k3%?rj{8<%2iK(_~;***4dA@C_YUm01?v2`az5QziS*)?!
zh0S=hc8AY+9IGQD-aeWs&&M7$h|{ap*E?H?Ivz(TTy-9jDbrroMBg#5jzJmdO?|;6
z@6aSxtK9bBL6(!u_3#Cr^7kG-ZtU)76!BxscQ5&0qOg9LGWno!2jDDj_9WMf`KSS#
zCI|4{w*Hpgo~ICW7}V<9s&uu~FYIvUAv>$dR2S%(<Ez^V@e}om5@r?ktIsYpJFptH
z@ZRYaSL>gs@`x63m~`25e+m=bUpbKW#+JT-`uSf&*sc6RL3ac6jl$d1#Iql<%vF`<
z_s7FdB-?5*B}s#6M)GyLBZj0anKbc(z@fKUasBQ_yuozd(9XH-uHlF<XZL4EupNzc
zldW4WV#=M0Tc;kwdjuj+H?QTIO!+_4y4w5kb^wJDV~5(zx-16W10I64R83xWA4I92
zV)hAp+9PPh#;eH0e><@I<45OwD^N^VOnbB`ns4MVrM6dD^6#jb4XGJbxBCK@Oa^37
zq<3?NgWA%kWGjH}aWRqJ-?x?X|A9?(Jgx|d>%e;Bt?e05VRSgzUx%=?)-(zGA6}1<
z^c7J|lkoNvawz@MlR*E7+!~kiCf!N@{s*~)0^?fSv<b<VIrK;Jgi_3)pWQ>fXaGs-
zE&h7Z=%sWBUj@J@+)gE3suso-y<ijM2e2QvIj$+A{0^R_tEzUoogRCO`K*54?bcIY
zFaDIr=R>xK9pgKkoU#WurA2?rLnY8jcqwRRDe#UIL&C`I<viiycEr-E;#IR8^8W<P
zOdC_2$3mHbPD|wpIzgW~e$uVX#h<DYv$t11BD$b*0N_*)y{Qmqs>_G?O=SmBHEl%Y
zz@DH=imQ-Eg5jR;;*o!4FtKFGe3jG_J$!pBM$G+Ks%3>Z(*YxP5rO@S#jTV1ijO?J
zj+qlxW>=8O4~CaPqk7sVPtNXCJh?<gGA<Lcj0%~jJfnK!1L=(LN^yZ}g}FaVkU>)}
zTuy1JIKsar`MFea)?9;w(zjUn;DQbTroP4#45IAhLPqr6(0`>M#{=TJ)lY?&G&H#6
zYcVDj^S*c37c<56;xcdd2-j2SbE&WMn#%{3iF+(0xZSOX^<l-LOQER(-pK;6t=K2v
z<N07eo4M$h)Y*?m9>h$}MPD$k&N<;Vqbr4kmXe!=BQ(~K7aY(YEq?C{fb?7(``=~0
zA}syLXkC~8db0Tdpm}>Tgx+7K6Qec&7MaMYllrf|euDuXHtn&^jeqpS`4!^~z~|qd
z{498pq5@j{fdn{eiPwGiE-$%EBaqa?R>N=gH>GU_kjP#H*<zPg2q*Xr;EYi9GVlJI
zbM65Kxp`g5^{+V*@d0UE8$VP3=Ht_VLC#XgE&Mg7TgJegW<H7iO_)mngZwGT(RDG%
z511264KSxhT33R<2I)l!(Dzo)lmCi8Q}6=j^hR{y`d@?me?ss~iF_srfDQljQo05q
z%V$7DcS^2Qdnk6jr+1d(tKCYzPAzT-u!fY)8j7%`UtgMvJ+S&jM3rkr{WMXIV`W|D
zVC^K6z-`2U_m1-j%3NN1P$EItvCnYSf4JA2`ck$;P!P|wmD2{D2IHSm;Sr=&VI21h
zU8Mvr&h5pn#F4Y^=pyr$wz#%HC4e_%rjL8$B6qy;I{Y5LQklImACR09`fIy<tcD#G
z5Fp^W*GUM`fRy+YWY2ZQ%7;>N-qI0{gaEW(f&~gi-_d$G3ef(_R2tg|XmZDY?uS@D
zs1gaOFrN^2{{7}yz%sSwaHXSfJ21VK)~SZ~oVA_$sUBtC64{}pjxImUVXlxq-pCB6
zKSAOV&<nW}pQo51iUqB@Th*l_qs^M+KWqGQkKuly)|M=szY6$SeRh^ufmp2=Kkw~!
zV3yecoyNlQNH3I<hig6Xmm05O1>^PtPt;9jdBvqq&)cHzzusYZ2;>$XjFm*ox-52M
zQ)lH}*Jh?7<A7jyg;PIoR`Z|X-C~+BCDyuA5o0!$&m6g$2g+ZbytO#oNy@2{1}_49
zYx*3&!wA+UQ@lzXAUwsa4zrozgZVnbEjcj&DgAjnJWBd3mBp$jH6HM*Di>R<T|HJ#
z<c-BAp;8*m)3Incek-sv)(|6UAaVfkdBuRS)WMiCGUUei@HvW3;#t7qGS#MflBQ)(
z5;wrDN1tb&%!97tTFjAUT9j~3)tv>!@fhd=8pd&y#@?vEiEIdPsmIbL7D9fn2P$Dl
z$->f!>J=}(Os_miD&+5b?w3yP4IUgEC;`+DLPqnoxGD{y)UNhbYT*@myE>D)p6q#7
zges#?uaC#h0hLMgWbILVTSn|w3K0ipz*_~#x?_Qbgjn=tak@O*h;kp-5hR8mrIg#p
z|N2FX-g|FZg#{vO1+L7!^j@6U&sOYTDE^7}<2L&#FG9bLaj293&@V47(`hO|7bJal
z942Hv{OksU)bG?;MEO)vh=Rk}!J<i7n$=*?ul)tWZvg3hJL*ucWh_ugrbJ8Ww#DI}
zKdsVdolyxrWeGr#p26c+06VJyP<L3{?s9?^p8{nnKK(1Dj^zQTvLi1GumC8CdG{$<
zUn`{t3StM$+ZeMZRC$hL-Qj48%a%n{e>V_$JGTs@)o-z00P>SKd+Ih~4C?}nxOCu*
zfybMPL~em`=b>u#!BYxSw}04~T$btn`Qf)kkKwQYVwK?;%JN$7ak^KB+G0<mG^G8U
zLh??}Ib3kXtLO&?C_{7sm>V#-V>n|^<LXXRId<vuxy9o}*m8liH%klGh$Lc(@jPRg
znnRL^dyE@)bVPh{)E$%Rdi~Hc!%y1p!yp+c;bJ#*G4*$nRaydo2l+E|Z^LWAmU(Uy
zRgvwP?ijtJb6OYR?m@fmv$dXMdd#H<K$cMORaCK@&-?3imiSx!XGvUj5l6BB2mBIu
zhsb3-+*CeM3bUWP<V*)DD?dc}blGwf4)*GH^%n=`sCw8fyy!0*Jq6iSxjUo>jLPf6
z^*F1;O+L{K&I3@hgUZB@mBD?@_R}7!e}SibcI1M~3I|A`1(Zg@zKD>JHjp35W7D5g
zlyl-ZUePv+UM@?{)6KQ;cN(c0R5_Tibr^csP{;;lI@(^+_^M@Y9z*XneI;MNV7wB(
z&Lo=tc+loYa)EK>N@}J<^<GS!%*|W_KKqqzAoK|#eh71!|1K5J1@3DH0kLpel>MKg
zqR7E@0k5@%`#)hh2WXz#juuHCzD?uO_WG4)P+(7uIoiqXFUBr7m(u6i%ufJGUFh-?
zc?V&g!p-mQ4uI38e6QSL!qMOJ;9Kl&t*cd#+wyU=FzIOfG}%QhJ-&-8VR*O0pk_S0
z42bO4UKt8(6c<oW8%N)n++H|9yV>;X_w?C5UNfxxF*P-nmzfz!(N&^H*JflYXWx;)
zX`Z&NViv!QEKiPTaeiwd8JTm%a;L;+HxKQh@ahAF^)<ZJlD*i2Hz$@~wBF7p?}%yp
zPwr=Uvkj}sN4`U>q%vFG0CD#@9gXjm>vqNq!gK<sP$vnIQkkpCE>qWkpFwvcvy{_~
z9S!TuazJ4g{5|*Vk`MQVV24?4T3O!PIo(p1LK=WW0@%>gr>FZ<0z@Jtg3AL&bkG5f
zkpd&B;t2SWHJx3aL$wE8mUHGifj`yvbx{%eqdm~QqgB^RV9cGu`S*K1^Y=?!18KBN
z|H&Ba{&15SVI^a96?xaK4LC&?6gEEdo3m>Dyk6Y)0B3i1=(WZ0bL5idp1qo+I&G!P
zJN(8fuYq<@MCt#07XV35dFXd>SJd%=#agPjK!Zf)7~JOe_VJ3AK;Hwo-T4<+v%Z6$
z*|tV~(aewu;CxA06RMo2$8T@zx-R8E5BN6(wx>oMy9RQN41PwYTl1t1me`n6i#pcK
z?@#r;{hHY!-mC|s8TzKHTIGgi>(5aY^#>ySNj)waKhtY>Op~3juK|oWs2-k>PeNI{
z@q2q~e=4>sw8^Xx+Iw@9Ub3nqPbYt_t9-Oo7P-{>*+edd;x&m9kO*wi_{SN&GZX<8
zHy{yn=YRYvzCFGxw1zY51;7D}2y+a`Jo4Mxb+41`{+820Xm{#&0C%;Xa=XGxYCGkF
zA+`B6O%1Eu$R{1cr^#5cd%rWf&~0F91)4g%o)__R<%zbq&!HmVsQoJIdhiqOcKmpZ
zEE@o&Y{T~!AF#~d^Kxx!fyA5pj#Uz9!2l20*2MH<T`aw%uR+i3%E4+@unmw@3a5y3
zpUI=M)PeYm=tUl-gNgLD_8l3N^L2Z`{s$Ff>@Gl#@zJY`zBQR?Udj#ro}hO=v%3hu
zqIS=Jvg|iGTubP$`4b53QT7p}Lu>V!3L=u;-IMx$ov6}LXDB|#Np$&O_g=vjbCuBn
z&OV#|tWB>}<01Up8JIh^Ae;0;qv{n2klkX-?$OUrw3a#x+%asb!<cZ1(#(M95uZGD
z`b)3g1Yp;C?w`!BTwE;R%+aj(r^gt1e>A*vu{Z#sCfH;i`j$^<6kNMxmseZ^qA%8i
zQ#x5MgDB4woQBm25BW;^OE&B@JrE00d(BZG@xvuFFz#?Zo-w+4pUdO%m8oB+ulV`M
z<mIc@PmdTnf-h=i0N0W0)!Js?d7%9W4eO2<^o2)O#$E%yY(UY!`%)q&fD&X5uT!(w
zq2Zh3dHcdGLgwq$>^p>)rXs^g1K82lK^&Js7x{)15PSm^S1gc!QD~&<;-7Qrdnuwy
z0GmH{`lQ;W85Gi@1ygV1E<~{+(gTHwxcV-I!YH)kKER28wl?{Rb_mi{)g@rna7)Z(
z?z7)m-9Fv=LB`{!^S`q@1ojd&JZt#e{(-vxLVm!|SYFk=R)fYkO4gP5tSl}{mfLT}
zoMp*|<@{b>Psh8n%ye<d##M1u1l4do1yxrD`iigy0`|WaHBTE{jQeL@t$Gxb2Xbq2
zq}}i?N??ud$~yHzwP&Zff42A*xJ2QL9z$Z(wR=)7KWwFd5C<Y}n$gR$kpRBg!N=mh
zAXo6owHvKVz2*omfV%&X#|62xPBI}tJQ5orW@2Iqv|bVmWZNjGqa;~?@OsbvW*7I1
zWvAnDB?K|?<;~Tg-MTfSY#``#Yw(3h$B3&{Z8dV|5-40dPZp`(Dq~xfwP76la&q*Q
zL<V74$!4Z5hq>5hP|!7C1<5!pWci*~yfVx0>&=wUEL0)Av@;q14c&ykq-<|)DlTdL
zsPI42K6RO2DZM)cyChjgauZ-3DNJHM4s>((l#`!$J>}9Z`Cva$)kRzN<Wi8+H2rN;
zi#_`4nN9CXhsgjVN<MwAt9A7E(!2U7FD@1%IRbz)CC{`!sARazD{YNANh@ytmSxU=
za?v$F$QZ?VzNqAAUs&%;*|5-n%bbMFOX7zDDW6AENiMD`0G*A2cXamc=A^a7bWq{i
zCz5%t3!Z+NdJM3EYfmYAA72s(PVhNEpOGEDK)Rgo$qgSsn1yw+ZsdRUat>O(ZtmTb
zslQd>jJ1usC0bzkvG~}L_c|$x5<4%uNab)<`yV*|K@%`<l<3#FB)kO_a6PcmVTrsx
zFIs;8N+FPTN}La-vKW8IXd~)ia!>!mVN|5$y{MHY5m36j{4KP7Q*W5d>FDk^5Jai^
zjF!XcxU>b4w%}iW{MlaG8*J-eH;8zE^62I<;R-f+&of<`?|QAW%E>89)kLpcUsuXd
zYi}PjTcoD&OL1iQ>qofVPD#sFg=L!2BXy55|Dl7_Q%@hml+a%1`|Ocn0biAEVJF13
z^uM)9kE`n7-!x>q3k?_MDgjdrNIOa7X0H}6a|LymcK7mUvRaP<&eM$`JU45M{*QmY
zZAIofumt8oZm|4RDOcU9{R5?{<8{G<m($N}#){q_i?N!WJ(d1a=)I7m<+9`V9WL#s
zv9KymyAD%cOjjw++KY|Cd@1&6p%(L#I*cx<@c8Z0>YlrEAZ`P44=hpb9P`&@a{^&?
z)wj_MRo31Qraaou1yHa$#twS{|DFsII&i8C*bG_BaWYIqU`G|v`oh`IBPZ!Gt4GIL
zMEug<;?ji%&Akl;{WWv$)P+;Sd!mz&^S>jY&JJ91Ee`&R4!!Dbir5nA0?t4fZ_I2P
zJ7n8;-TS(3Y_=-<;6hJqrt3oc=H{#+nR{6e0?eG~fv?a?y}j-_dYwJ}pBF9oGtr-B
zI8EtVR{ch_`CMbOa^F$x4It=7<iLFEdJ?}~n#A*h@H?D_(`p{rvTo=IUdop*Oi5a-
zbqEg$y75{MV{YI11`<u=nUA{8Zyvt*^ulo8+7j*d6t-@MQOcM`(LNDg6BN^8cY5r-
z5v066dtb;e+TV#%wOXqwyig>z${DiHTj{q`Vc}a9{2_92s!HvFA<Kb&`K@&ATqCkt
zEOtl7?n8hOUE0>ZLphbvRaxJ?n+)kowz8Uz_QjGX;j3qmRKrP>s%9c5)t8r{<KC=V
zZ?Cah&pc`CJ<KMYPo7DXg1$*+AU{T0Zt1E06ACLchnse0C%knSH-05}uI(htriq=^
zbItHK2E(o{sWG<Fe0nw5GedOKwOws@OYx)qsb<|XIqz!y2*OV&Nl2l@AFSMgPn(8f
zuWNjkb@{X82ol=d{@gZBDdYQ(6P;9#?1iOdxctjGpMW$VK-SKnIGgNIwyv*}+9b26
z$}75lp;v8Ym`7M;jLB7to#fj$Z$QfzQ?u5P`aAc$r486IYI1(vJEiR-*=9*9nk=qL
z%f`|sZ$wtZ_b1Pur}^Z4v>(4)jTxBjpENOc5w^1w);Z3+5yNC4QVlM5^8FzK&eL{0
zC;$z0r%_Fn*cc(<SY#MgYo5FvSj$ONa!NBn;<*}H_?uI_ku;q}Jk+S_m)P0>JP=+p
zEMbt>lec#EwNSX(6Fg6h-WiW_<!2bFE4C_kSHmtQ?2olJFvvYRDH3&~+1)EQK_1pE
ze5`V5R|(vU^Xpp5&%szKIa_dgj|xRcgxEby{h~ywm;{QvBfwnq&o>nW4--8Upam6z
zG^@=)`?*p1Kmv(ia~K7R`Q&3{Y`~$H-miqr4~rTj=8FYwl(z{zCOwV0C_5ONJ1i1x
z@tZ>4_tX3^CQcwvY~7w7F&%LcU%?MEJo0Cqdw1uoFMRm$u(h627J?~K-fB928q*yf
ze#1+^GIN4rJ13URcA+@=WN+%K%j%Qw7|yvL+2r0&uC5BTWve%Z6tC9fCly?A64{s8
z93(E6)5qR~l)rOai+ccmqL%uI6O6Rn)V>EXUg?88lTLQ2-P6r-=UXTBO%wIj?P*vm
zeQGA1@qb8r%dj@IZELv23lvI=ySr=gQmn<LxVyW1fg&ZiJ1tt=U4py2I|K_3LBp4Q
z?%8|a_x}C<vYsR?n{$jYWl>KMS7R=W&F;t|#|$sy>BlqAF@6oiGe|Toekykf(FfWm
ztu=WbFYO&$OlWzD%-8;5paLh@be$@;3{Ppj$W%v@P-{gb)|3VWG~aGLs+iBRRm@SY
z-SW(&UNu<TC6Pg&J(`_QEPu4Dh<Hkm+b_{dirUh_jC<1ezzvB%c?3gT77dqdX;UYz
zY9&4uCd9$X<=7l~mGPr~v%;!t16d|DqL854v40b^KaKun4fl6>>Vsf-<|05YZkh%l
zyDrq+UTE-UF7BuKgMHrgg(%`xs~K%L$Lotwdz}2)vCYe01jQt62VWwCm$Ye{=3@#S
zKoZ0>WG$<iJqW8rBJ`llygGukIdVSM;sh<ZFQRYaN4a;=Y}7}(s!gcn1BG%`O?!%%
zd^|?Fw#3U%(A9*I9kexf*BWWgkik7<{wt3f@DPB=na)FPM|}BLv{K;>ZYxvO$LROI
zyH(T^IL|Mn@fPDp2v?x_@+6ymFSP|%8pE(m?e=vrv4}b0{Wu$PlRBE9M<H|kZ`-f@
zLQuZ1dUdJ!rJDSoJJXxzshkZ@Jo&Gmm4>FCv@QU<(m^Ou3IB?k|3v`ns#_5RG!JDj
z?=B#U3=Zw2ye+%J?Xusq^A)nmVd<UUq`&giKd^K@%!}#-jbd*yQ8<Gi-d-IXfhRgQ
zTzBKcn~?-H=Uq%MAyF>ur2}-|TFisGc*=7c(<=pR3I}FveeY?Gy_Rd9f#IBvqfp)M
zr<JxkJHT9JUcfVhSgnQDN*Ac-bZ76`C+{R-0PQl?YYE{bom0K^F!7=A=f{F&R%WhU
zpZl||u=1$`MlSR4fGtY*xSOo4Edlc%E%hf4=2g0@9eNR%gxl)l82@0LPpf|k<Mt_k
zq}SPJu#x=*Kf|;|dSMZJHY=3@zv|x-U{AR0lh6uMoB>yDY3YRfFH>bkGlum9K7yy^
zEgt*nX~WD;dWM7T#Rwa+*}`Fo9HrQ2&-PUa*C(uI0TE4b4nzLW)RRIcEwzdU#ZQw|
z+Zh~C>CwEF$yhX_K${~t#9qigFreM%P$nrETdPLO%`$T2bMP1tEx}hMKYWTqP{f+8
z*x5Yg^H~QI!{vUI<LJE_Q<-G$C9e&2vw<)FXMTczA*It_l?$zUxuo|!6CX?`I-aMS
zp9SMbo(8VkGoAC_`i$TH@RH)uSg!iD<6PxM%Yj?0TQOT>Is$9SmKGFGw^rUs(;;P6
z&qPyGl$>^~Fnj^%ieD4rD?NO$L)cV@e{(%Bz}9SPx4O!#?yB4XIizbri8p9^#o-sF
zt<sCo&NSLBY4M^%nU>>A+u!~*StMAE@9w(Xs-3T*|B1jt_~YD|@&vORSwdv}u>c6;
z?HgQhfG_n69AddStL-v90a>w$-LZ8~c6^5{uVo+M6k>f%z2~?p4nL1W!(E{aLx>OL
z16i#n(Z9iGawvj*0IS*4O-M2&)}7A-u~xHn`79Sx)sc0-&n;<{2r?!~^lo^oV5@O<
zmGYsYIpS~&72aM#0KA!algC_zh^ttky(r7on4m5X%MwuoaK3FpU3G<!zdUY<al<aI
z0C{|*rt?bW__18YxD%;Vh&JFhv%@$`d?Jrw({mA8rf2keWks#q-__H1mRHM2AB)>}
zk3*}Kt4x%`O4K(iyZzzon6{f)fMGAlrDq}P*gw5yuS~phUH5>&R}k7K^CKz4YN+~a
zi>B)G=li|Evk$w&r?2>hEs{?Ngci$xZstjsCB;ru>YDEv@Z(#8VK8xdSyA=We@LmN
z>Etdy<6wA50|Jig=?NRWJW|_xAb@y4NJ*ht%*@KV<1Bi+?$MJYcv&vG!UWV^`)OLj
zIsW##&BprGs`E#n3V***uHMq!?gt)c!&yvwyG6kTdsfn<e&P>WE#7yr`Fv;|eLS(x
zKFhB6O*%1y>2&{OG&U6>;xm4MYYf<muX<_95%!2X7*K#hp_gl&9k-`?H?UG9u6Tx)
z5YB?cTSe^HKrV<5RZcubNFqa~zI$f-K7QK;h}4G1RM4a|@_F8z=8ExGf!(momK>C`
zK%T(rZbYG2_}u)Jjg)0khvsUD2XxtOsbFH#`-@pkQB8I+N&V#yU$<Jl@&-@Y*c&XM
zsdIUN+f@lk0KsZYQ=3Efh~JkDH=E1nn$`6Ali!E*wXmihv>KzW=4^WG6Wg>(GRZ==
zi2~Q!j`<doaZ-AFe7={>_tW#Hacyn&o@XL8OKm~seF=(RBhU}2rJo0A9G}Pv)2fI_
zxNTZa4j>^jWvsXPWaT<`dxT8n%v`f_F3@~HS-`V=X?8M>)rLrSBFKhLQG2heNRc0W
z*q`M0SO(J3<8r$(lfUJvG(*CS8#Bi$<>Av19@lQKsXwYY=4i1aqUL%LjAUMG@*ayE
zmC`3&a&m`8lf1q>1G*G!6t$l)|1YJ+{;x`j-6%qvhR`SxHTtZxXg4;^94~5qI9SFJ
z4Or0C`S$EOv_l_Mr&TqSZB4uYJ$STs^RBiL3`l1foQPUIsvb(pB1=Se?t4lz^9!Eb
za?zl12u&ni0a%%brz!YcOw$ZGx(wUP#Q@~nk5gC&<B>;XFIcmv7nmG8g<MSlwDFWK
zv<&>di36APTw{rA?`kO<4REil$#R+$(Wg9S*4fWeZe}zPLVWh3vPEaxPC*ZcGmZ7$
zRUJecMbgr|CEibs95v+@WX09i1$PA#_**sgm`pZvvAS=GWS}u3(MqHVk+&oQBd}0~
z*|foqiAt8h-*)ahO_d7>gF(MdqKqd#qbnsp5kE~{#skpN^5!n%rMemEmwia};!r%}
z_6vG?;yAO#qsG;u4C7Tv@*;KZ_^cgrjkk#Cm9FJyq#AFGjajR5jpGy2>+<?PD#=Ju
zJS!|XwvgXtK6^Z0Z?wo5ChJ>ab;p9V=aDfBGY55hrdm`1?z-@kE5b3AUN;J+hqIAZ
zHCF((f^!`QPYlyB*ZuOd`ZywUv0`1eHexL<<$Z%TPcd8;ZN{ut*YFzBkiTcq+0OXx
z0=Rvq_NId9HQwti2BMW;b9?91?Zs!|@{rD8b7h)|7f5W!gSd*<k!f?&+|{64e8(NW
zyGS#E7OO?}{n+^=Rdx(}m;3y(TmB-*;OnI=ztF-@TD~YRn#r>d17ClCM$9e#%JH|a
zb96xUgjUY^%mkH6y$Z~LBe0%}o~Bg$Ih~v1!&6Xt;x)T|I~lh{JOQ*l>%Y(V#5?Xv
z{I?he`Tl7-9or9c^&KnL|6$iK*1dEP_2*x}@SjNarWuT*>${5|{OfA}qpN+ohW&kt
zNcsOXlI$FT0k8Ix&`Fa2L-h|}?m3Sy7Y5OK#mKL{!w=|6Tz8h|{zNbUq{sz;lbbeE
zb)Wv3Vyx?5lGkLrp!@cZlf`-+R^7JPAKu{R(zpKWtRwJjgH3P6rtOzSCX(!_AbAAH
z`43fN;}&aifX1nG2wD1MHlw5KsO6h<Udaj)A@bKG%Thm`|2n62-NDWe8)+~B@_*BG
zp^7wV|0n(bFmv6dTEPl=uV*Jd*36W?z2TvXXfWmT6#4lvv?f;yhac#ymA_D1B+b{{
zW>T7|#jc2fN%r1K81)}j(cuHE7Og>W`?n})A}8h4uLCBhb;MR8VI;U`c@L8%yj&=8
z9h#1<y2?anV<z8(u?=VHS?sj$96lv{O`i3C?=1XH{p=%E*u=&f)weg`V!ngbbRK6b
zjqg7)IkIQWCA=ppPFI*#yl>-F+I?jA9~7m_Ja$@a?G_Yj=1Uktysx7*{fYQHid6sx
z{pjxrz4f9;Gg-RC=p6ER&P2GimR(isphElt78S%~qT?nOR~|={{Mo)Lyg-P4{_C@9
z0xp`nYpdoqx=-U}dOOu5oc{<p4%o1X^|!vSP|O>6VihY=kcCu$O_g5sRr0*e((ccE
zm&iQXb;t7SGyWmfF_37F$}A12Kdgjc;g3>VBe?u+fA7_3TCMY~?rMP0xonQYXL<Ic
z93Ittbc<xxnqf}So5%qH4fnJ75$PD&h9aWyyWX=GM6-ZXM26MUoZSFm)_}`~T^fTk
zC`ry7K?uf+CsNFPYhlD$SI|eF)nQ}5IeO?uHbuYp$$`VG#WimJ_dh!4Iqz#xhvRq8
zKk1dqWe~l}^jR2U*(%lUc6aK{4g;9>K5bIav281_XU!Dri!j8E!MdXi((hdr{+wKD
zEILWTd7Kyl?A6MG_yZ{|Du%g|YDRL(0XnJ)25D8Y(XN%`S}GyWAM9Z?8BRezPVFoS
zFsW`z@F<rtHgK8<!)!nA9*0JfYKP84Luk?zO{JSa$NUop?e<dN6GkdaqXDZZNuhhS
z!@Zygz{D6YtvzZy=w+G8c|H>TktRWXpU~e{y;or1dtX?=@v3+{g%>A3k*g%3`Y5ex
zLuP}*rB12wbe){JjUerF<hUwPi|>8JY&j%xZvWEks&9hLU6j&NDUnly^lKbdD~!AP
z#T6WbdJ4N9@4TVFlw-c4Av)P4#?K#+kprmk8tmiCV&+mhr}B1Jqt{e6LqPePbnUwj
zhvZr-W!2bcYto#vo{IvvFoJCgNip~mLQqQsV|ZB0SBXyGUXG=e;{a#lp@4W!S=ynw
zs<>Uh3Aqe~{o`WqA8pSD*GVu(^z{;*VDCI9U^r^?-Ha4G!<~}{-A7=HL(Iv2T_Zxd
zHdP0M%9mtowSq4b>)RO&fXvM6*5(GXz6H^w%oPH1uMEC~1T;KN5QF_uekBxEk3Zv2
ztC%5Gk&PZPsVLa95V>jHVqZw(BNMXjC#|wS#B|7{9zQDy@GANIPn-fK1;Zqh8Kze6
zGxrjekjE^*!uQ=6V4==qfeg0WWx{fQQ4FZIB@@QmzaK3&+tl<Sq-8;}QX={|zc_tZ
zRAa)wCEF`v%a9CVMU)MHLkf01w>^JZYQ=0~EPcV;B)eS~SH^bywY|<&Z?@$8%{<L~
zd45<~%iPMmVN^FsU0eIvHZ@JFIH}oL5gS|i-D||ScF0*K$hi`)36J%NO8+kN1?`k;
z+-2Nr9rGFLe@1}Wts-wAM_>5|p^J?8br~~zfCSnPy8X?OfSoO4n~<1O)Ja^Oy`nOg
ziJ#cq_PakIr)ZrUaRhg68<NbJ?gJmze4Qv6@M2g+16jN5Q@Ps+pdv}pYLwsY_RYfh
z94@3)+^gT`i?SR&8hQjdgCif|I4oAYM(^nq-k8hVS-53iO4-_#PtoS{oPbXZ&CIkn
z3o$pHR!Ca(mf)?K_avmde*dnlo*Bdenblm}7AF?5(-8dBao?Oi^*bk-BwL4f2vyB^
zM`K{+#NoXCUMb$s3+m$J9qK&#S<ABI!BCww+|_kAxT>yNGK1fN>dY2hfeng~935?W
z-OH7<Y;y3atB=|&wLax8zW832jY1rKEK2K!WVOX3Y~WXGqU`5^n2;ot`IYgEu-rs!
ziP0>y(e%L0keuI2=rhS;-lYo$l0$4ZNj5qYnSpmNeqmP|zU2tDJXS@na=7~Mg!e<?
zoQV|2QYiUzrB@3qa%383&#NznIp{og+QCVz+pkfTzQbYvdWA^u2#>;^+Wwj}s8~Mr
zqZ!iW<z?at)hQ5fU0=UY-@4)6-<J|WT)g60v?e8dQyHmO+TbjLS0tUZ`{R^qtLGzP
zLa-L1+VyaD>a?=!iMFxxhE$c07hXd+e<x=u3o~mMz=ON*n2#^0_28alX&vnaO|grX
zBTNISR_6V}7{M&U;k~401C<!RKWqJ~QVd##qDn16Nh|f-qU($#1M4HTEsvjfD{>pn
zZ{K9_=1s-=FfAx)2bBdQzk`7J98up1w;6|*RnIytaRvvbR6iAx0<TvDXzsu_5Q8e4
z-1})t(L>7Zj{EstL-qN+gN=7~DV0A$P$JsH)?<3*11NURDQHrYFrax-T|0$=RSrus
zR@xP*(!{`h3q3BoHQh<a(T`I)=^?&Y#C)En=%}pv65S5RNkXuNws;Br2mwRF4Q?3-
zg+9KY$LXMsZSS%NYwtWkN|UlRQtXA%k=k4Oor3>op+CJwP5t>QSc}U`sU~egh=Z^=
zR|BNTVQ^by;4eLZL1DS6+UzkBX<vL)81YFt>XW*9%VVZF{Rvemm75*P2XVhRjURAW
zKbE!AcvEJUyJX&&no$f-8q?Y2?}n3d#tCq{cDLKfuy411A;uF1rl86sW-k)+>Fl*Z
z*<`^@rcO!$b;tGAMgDr$c12IkuZ=1d!d#S85jt+o3#?IDGY7hqV;Bc~>^R$otA!Zg
zCB=oqlTh1&;Fq?HhSjEAERHM2v0Nthi1qIYDNMxk+|ov14RO|zKB+I^T&aM4+m#b3
zLQ4UrRt}hzK4Fw%7zwyHI1$-PLdyP5VtbN<%*<>rS%(e_`C0bx_F|o>${*VeIcgNM
zvD<+;^x(;tx!VM@MIOUf7*YP{!Y@xBZpYG(bM|==>0!(E*HLAceT`IWe!aLHV(AU@
zgw|nr2I)VuT5ort6zN7$=B`8wWyLhkH-DJqiuolekE%YQIr!+kSq3w)sbLr3B@QpV
zUTfH-UzM0RYpM{jT$p^l6Yz6>&SE&!8q8gANx1Js#Qv^prf_@qk!-75!{FCN?L-Pw
zSAXN{<qil&ZVI#1ZW-U?>G9cc7LZg>(pa-5DVXHsIpe4#VI{l0?|h~7&Sx4^LKc9E
zC16c0bBQ)}5cs$?TY|%CxBR0wpyA-C%s!76Jh}?hASgL`=~Ut-<eE2}!m5;04)sTt
zPkp5mup_*U#I`T?@5Ky8g<VWBvPl2h^~@_QQ*uG$rhOhdj9id3?en_O^OKujYhbN;
zww;PP#Zx9vduDS;`nr<pS$lg9m3wG`VOM*g<%x51Q5|i2&D>o5!<U-)z4Ko8bB~!(
zQ0DDG^ARhP2h_W+RyRbW+GOYOEzn7kYG=?$_nnIv6H+a%aTmjx5oWIDsF(2ltuFS@
zg?&vQuMFM1g3^rmMs^-~5BaYhhgbP~lF?%sd7jT_xpp7OS4!o14wL5eO-{J@wyA4O
zwx`6H%?q-`GjIwIv3T9(`*wJ&EQXVTiLct1PMVQ?lJ_1h6Ck7#=S-?wT-#d_YEC)-
z-j(vsJq~+wA2c`M)_V5ooy~|l@!PjO1-quct={F%GvH-wZ|mcZPxpc+^P05}7m@PS
zvF$lryaU^oAs%z2;S=2t3B`91xfbV(amz6%#f833n*Pa((qS67nHv2iYozydQSRCR
zH(H&HL~YyvV6bjHSS`oY`?Mfjt%d(ML!jG|3RtC_dGxO|69h=aY*lSh!RlG?6BENJ
zCKzc_VsB;GEy_HL+`&nz_ZQXuHTXiT8cfOJsccWz@R#Efls9Mc;o5CYy6bI&D5j??
zQDr@0NjpnM1BrfV2DD@xK(*V^Y+oq<Za76}GhO#P{u{|3!Xn!Il`l-TPxvRNQ)=iR
zDwbNU%XRx~>?LHD8gQD66v(Z>G2vRxsC~_a$m_7Rgx-5LHQ1Z6$0mX4zhGbWNIF}u
zDBPDFRz3y!wsG4DG}y1`&&a0zyQ+T}JF~Uayej3lc1V3t04WvNq6Q3z!xT}@um2>E
zW$0y~+IOlXPPIts$9>o}3S;m<GKBWy+X^wmz2!izx8u@~7+ly$ET9XBR#6w9KMlCH
zh^$%CYePK%TCDs|3lsMDYhVd269~xwr65-2hPgkd8qye;i*YE7@Yf-!=olcIDU|z$
z#6$)1S_3KK0}m8`52e;ZnfC{sB?QacPq1j<w9~GosKtT!&)}owVr<jxN@J`}TD@rm
z^8#ZITCA}QPqVQat;OVWC6;6Mb5gD5_$s*q#E>L3+&{Q#Wp&I3BQCmaxRz&n9^$OI
zvxes+;m`h2^wN3m?oi}m>%rw9s`ckjOV>m~C|zjDorS;21pJzbvA7CNUaE|S`3cAy
zy+L|lnwE*DUWvWuvH~+eg_WXaI5J%TV?m9Hvr%z!f`P>D02)@KdDgVT1nF8_ogE$O
z_<&lIdL?l?r_J<u{1Y73F9T9mgK9k*uXJ+l@xAu=Z{*&<#t62V<&Yn*;4AVG^u_=2
zzq43X^f+I$aw{ulgSXQ4Gb$+LD=L1KHnk|Vb?iyW+;7)YHZL_hy0|dmq3Biej=vm;
z%cVVB-jq}<d+*xVsPqNNFaPeJ(>J6RukoCVA=WQ57@sgkx$H6cLDXivQ8#|Dt8u^9
zgv131KJ@Avd{>IY$3SFl%WU8_@V36T#fC9^VrU3AKv3QB59M94r@TCb%N^XgH87C(
zxLohZJxQdQnGlkd)k=Ohm$C)9OW<MA_d<;FU5l#M9b5TSWosSid}n8+j8zud7B2;B
z^Q01sY@^|!3SdrA9M58TUr87*UM#PtS)%*eOi-;}6(eSS0a)od0e;8rXV&t2#L4M~
z?<2>t-SryqEaG(Un<+J^*RE6B<Eibc{|XDz@#a7F(4IL^wTSW^vF?>}ChxX9(SG70
zmyML-h{CnyQnNw!hLx1OMnUnV+sB932TAJNdrJ4B!CMsBUvd^!4C657)sbR|1P{y|
z5bs^;hm-_uv<vg{4#hm>N9OlEz-xHfYl2iKA)rb3DLTqubLdR-*^SPwQde&#Heu><
z6;5FGf?qnR3i#eyl%<@p-M?_z2HmvE)t$rf`jTQP!K<J>tp=N4da+*v-2ymlT9#GN
zyo8c-$1H=|hbNFXKv*VO!R~kTj5&F7NLNW8n-pTd{)9=$eJ&Y*#m%MsUnKS^km&2L
zOW?Lc{(LnH_8*$p{M)sKVm2&1H~ppR*U1f!M?};PnwYZE(!t=X03%dg0XN*&WG{4s
z<gpCMeZ<CR84hA25Ro5Iitxc2i{b0Xw=hX{MIQcbHs9Xnos-GMW^j)Y-H}Ny4E6nw
zSLKU;^+MxCCH%G_1kO#O^K&HSIqB`EB#)i>mwm>GE7LhR=L6?p=>he$p@OijDMU5>
zZ(I4q@fG`3*Qj$&DgWAPW<&kpT=@<b^Zb9l`#<3FQ(y~or(pxDsNOo!-#_}_0RcwX
zK(vVFI`01&`2Y2ZZ`kxhBc(Oh)7zATWVAhSG>G@1iisoz21!CfU;nvuord%1FDNxN
zHL>Z*_Mt4m)!j$+?B47}W?v6(f&|{ocHizF<%7FI*Y_t)r=VtoJo%;)_u5R^k+7#?
z)*+$G_1iwP!y4-t9PAXsBQg$6FZ!<@r`q-sW4<KKSX*CKS`a}g{>F6&xx2C`Bpk$H
zVe2N`6Mb_Vo4|^!xE8OxDIpxie20}FRW^mm=X`r;o^djfy(rrQta8Go#7?6>`z7&l
z8uL_~%>SMADG)OR?*qDiPKSwLL)Z^;qdn(f(4LrTPTCZlXVAY}Q2iIQ^zpPJAV_^W
zvTcLTKbp^9UXHDKG9$i83;F0QLKKiwp=D@K1GR1^E>FsV=g_))Hr2lGuH4esG-gdc
z`6^*`IES-*lduyjI#)2;MoAq0McmdqkhSzSwE*$F=p)@qzLd<93l*xWY8(;H&pL7B
zD0QdXb`Pb*geX>E8DA>hi!Haps5g<F`9vtlaObr{AAsfL#1MR1_@ujdhgU<Tpf>6}
zc3X=<_8pzQl6EM2uH6GeYSp42KEUqY%VOg5dV>E^)dQUw-$Pd8HRf@{8uEG&1^|!T
z`1ElwN~l<{0%&x^H3JM?`JXcc+s|JWD4GjNM8#~7i@k`K-*x%<3ab@GC|}HC4-O4g
z^B%4Cjbb)PZOV0L{DwGmN7WtZkJGD6+h8sy8@vV21YmkOwOBha95lR^iRX=NXqcTn
z+p{#QN{x><rlzLOHR=hiVji(!H^D(J*VBD{A!n<r8@VsD+(05PB@Bm#EFJ7M4PB`q
zhO|BE2ZN$WT)}gAm(qn-K&UzM3J<?O^muPjR_=4y8PAR0*Wbwv?gw?-Xde-5ptv^L
zp>69PlUd=Jz*k*TthY^Ij6J#KXgfzst0q#_?6kOTuhf4xxBjoq_4f6-C6VYoq<6K%
z3rdJ98vC=Cl<{y0mY*CRAPv@O&I15d3(#kHvwH?s*k196d<U@XZ;*Wd*-rRvSYs{_
zvms|761e^S<ntYmWA8*vgG6Khc#EvRP;#WSMoxb^N0%p5W6C9&J`~WhoNK7=;p;;E
zW+xyLPC~I*4uk8KDThTOqleDpTSMui+udhgZ`O`gq7|l2#FZQj1`n;cJ7eQ~%btgx
z6!N?^f0ni3tQ5g0iHt%F45et`WFtij(Rn;w3ad^u4wL#;Gbp>eX<&f<-sY0YvfHJ~
z<^*%Wer;<pw_r*ZZJNty&v&WXxPM!2?41=_>E+8+d;l-1^4X}=B{aCIranaDOy5$(
zhPO<pjS<(#6<AmG3bY^a{l^XPcYYPhI^T`><mghBd;5v|_E5DWcowlQ7xK}l=WI~E
zDf|{~pQ*jK`bt!y`wU1yr@&R`@lyVr)bbRH5%zMG5IJ8OuszKtO5r_Zy!N}$WZ-w#
zL3N8?Gewwjj=vuvD|iVxEcERrcD|SY9_LRIrW8);3rPg#x4vH~qL*5lKiOzsc&p}U
z^&K}U{$p*9f<D~`*v*FsmgGTVld?i8fzNMx!qEE*WEso@QqESVB$~sJ#+V?(tjk&7
zV<g!h?>eQLnwyD4mfc}5#KcHoV)fpf^N~s%=K0o%Bh=XBvDd_qJs=2}3>Ru%-+#nT
z*}uiUD516dGV<Z|50qpwO~O!G%0a(xyKW6L*Z#NmM?o|_K~?JLVe9X`-=KvebZaAI
zWMdS*(Cr-C2ID>4GmOPUuuTldPil|Hjh~@_CIf^cinqk)w+0svjlXRl1(r6~I4do@
z@i7mA(-FHyR?q?iL*a{L5H&td{v|44(Rsw6TCkqs_6{%#@@DtLPi7v_V|Cu^cl@zs
za(&X&<p1~!+~!3u^A)Sd0t8oUPVTv7k#tEY=xE+=^JTG)fW;skb*a`%J5i1O-m6Zp
zL&oE)f-Nzt{RX0s1LobTJ5d=i$>wBPn)CW`wBXh(FG96}Z}evlQ{d8UO5zTNJiOb2
zM&lN}xA8L>L4m2@O_wyiT&d9Lb1&Kih42Z2wp{j)_%`1H$edDh!}|L0mXMM8#_Bm9
zN<%j3;7`t{y(ET-QKfbvssFWO-w$6nE73e``XN=udzk0vjy+k8Z#x?|UX1%aRQzT#
zT9%CFC&}f=7Bz=_Qx4j1{LLCU8|P;YZ|gUVCo9Y8)T1mb5}l-FJ?gw|MAc6eyQ!yI
zi*x!Te%)XFPB)bHX$vV5-kk^;g`-LJYiY$d*X{Y;8YLNX+18rQC}|In;rmGJy;p%y
zkX0&e4VUKsx}wQM`A-7@&jYdV0613Enx=VCd39PbX?xB4rubWw?%GE`5HHQ5EqDIY
zI}@+*fLVIaRql7UEIJGe`w`9c7dHMC-=eGG@2fe&4Io6H*R$Yrwx|+q)fE&z^6t@K
z>wm-~0!p>WnmL%KZ1{&o713(WW;@!hkY0kO$%qV%?BFK^Pv^5a?^Sg|+crnHX_6{N
z0Fj@D1F80wt&Hpt3GUS8#@D>VUu|H3aM>hg-b@_ZUSAD;e_Cza=<=C4J3kOrLO-hz
ziWd_VZDjZ_rT_KG56h6<21)T@GfwFTsc0adeg*=dG_}zRsj-CH$ub-{ULwW{lY{Km
z(^@1VLKeoJ?rCV(KIh`AM+O<6U^BsaRJ_9{ReUG@lZo1HQg^HBs1*;!)nwSIdsQ`3
zisJ68TF~p8umo;7%m(dSz0Ok5i0kEL?p@%!^|LTQzY0-&!SZ0Ey_xBCQhf-9WVgmh
z92RNl=P9lXy3iL~JYD^Rl2t?`cV~qk4ALLwp^>{lUWSzrGx2m6liZQ|;y{!mCZrmq
zh;MsJ6(|p8&Sz_i8XZXqTUdxSQD6}$zI2Wk#!#z!USq0^5(iJ((|Z-@%1;wEIjIaS
zhfc`W6i%(<zr<`-_Vrlmu(#LozSB(Kws6*nhCil_jg9Ty4w-L_Elu=~(BI_1PfO8J
zr9#YeLZ_piOn6Tz-`{Lx2Sp_zny>DL?TN!jS@1g2@@Q~P@F-nJHk{)Mmzjx*d*5vr
zlH<W^%#Q!|#TpzowQvbx64wKnH{$jLwLe~W7B_-^ePpRu0o%hPQF<<aGnLHg390O$
z_vonm^X_+^RK$HrKxexRAA*9fe%hHft16G6<aW|GPJSeW&UIk%<<2xM!fO+$uK7}5
zOj{nwV(*r3qkBn1pGVOuSaB>Yw(fR^&QI0}>_qM+4R5b<`Gka@u(cKZv9cR&aDQ;7
z#v%WE9E3j@PMo}jb^;;*QzaqhD7JAZD5i`II_v7EHjNJFD}R))I#zQ~nwE?~Twn=B
z?pU_<%96A(D{T%IVQ^xk9--jYV;I|nc;epT5aeN&d?}GdEK~0r<3eal;n0TK%s5z?
zU~)VJN50J{!Da($dAjn-=d2m;u+_c$s={ZaUhS6iA<Bo4KpJDGo6TnGZVBWDa-mY7
z6r|Pnnv48Pmfg`ZO3zl;E41b%PPYn;^jYIYIpy0Z9ASYs<2P-R8tRr|CO7l0bd(=%
zz(o00V?lxz;@ciASKu5-2hZU0B7zOt&s$=u>@F6!fam|759I4<3?Sq7h9w<c34Qt3
z{FJ^5ULtxLTKOqyub+7?(X8%Y`(SZ`+k?eK%9b(|>Cr}F=Xj)x>yIHD7^dlHbs1Va
zytbPp=}lmaa-oj(Y8X35`Md0WpJsr{jH;)si^j(lO(RW3gR-@ZaQ?R>P62|7wxSt7
zK>;75$Oh^IiTiD>Q7`7&{P)X&JLmZaOTr29VXeXPt?P;I>q|>SHoZQ!kBH5TXu454
zAIz+0825DO^etd@l8>G~<8pKR<JO?oeE@$+f4uA$9}Wk1+2$GbitQv($^zRJ)W=S8
zQxeh8)TGkHPYM~;>|1b`<5_d3lx(cHX^-wb-Tg@8S*=~ge$q`L2vo-X$Cl68JSQ34
zl9&CWShdE8-nLL8bv0()0;W3K9t!q%c+l0z>z9U~&TzffU1`I*+Rwg5I|Jl9n)oet
ztKaMgo!!8$wkrw*)_&fnE0!z<PShQr_#2;OpL5+-?m;_=cKnzNn!{1RS8P+qeg#%r
zxr$o{yWw;LG40coo+SS;ktPa6{L%H;n1Umzw1Ho<C1<}&YGuQaf0DK_3tgHu#h2Hk
zT*KIRbg#{RYv@mngF&3|n*{fO|IlsFk3CH8ut-0P7sB$V!8V9H1g8?N<p~vU>6l4X
z&97d3+4Gld6%npOw3@%EVEq1VP)0kB0v(7#6=5DH0lgD`4QwbQs3Ein_pEx!Vda*u
zBIo!E#lM2RAm0-1A<@)Lqcs@~cL>KjiUw_^Mt@r6;??lJ=gQCT$`}bzPo5Op^JS{~
zd^<~dg7FPti9nPCTcUd^uNgAqkR6Cy-*8{{ZjA2e*KrzH3r4HQL(oT_9W`RFZ3dbg
zp#|UJ#Nj|&9)R0@6e$2e#J4@zM3>~;=It)os#faeHWCF>MFtn%B}Md=UaPu+6Ctba
z7jz#*wg`xsb#62<CgwXZz5vVOeWOhJ7Vr;2aaR%Ly_q{q@-N`!V5APdarP6Yc1(Tg
ze-1h$s%B!uw~NiFssMJ~E7Vw+_+eenA7bW0XjA^0PqXhz^x>UqVTbRUwi`w1r#6g%
z_af06&@9<%&lnrqP|t}nfP7RK{_%#TiUJnr72q9tsHlww&#f1Td^*ATrj}u4t?y{$
zMR=uR`l19Q|0iTgJK~ep<MOW(82Hd&43Z|8^!6eMu#2v?v2hl1?R6Yn=&RFjS=}@v
zXm#H_-`Sb+18YyMXswH3ykV938d{&aqpkMJqROy67{)8<hrWc>`%1=o;vM7AY^fz?
zGQ-)U6$s;u#4@p`VDJ9)SZvV{GQ0G5vgTy&6LgGPJ1+kEA?||@MwY+6L)B>8AFf3~
zPj&%Tof4uNTlT!TV47`MOPfxyrpF4wi{(-_f}y^izj@9q&;N)Yt0n!7W+r-Se2P&3
z)#o6lnD^ft2$}wz!TFDCh<;T=%C1SdwoX9*!-O<<QRyyK9e5U0cV%m%Qq=l9_fkZ!
z(V{LGn*_oBXjSvROrY(N7f#<NZ`!Wq_Oz7Q5}S6tei^2J?1i2UH<$Bv>={ITD}MC>
zW6)z%+xsy+wl;#fdt`ZKz!Iq$uJ)-p-E`0B2@tY)Pew1ECFs{NYxp05@+kzgwN(CL
z^%0XjwWuZ72LhJXw<jg_G_-Wn^2+{~(PVYby`U|h*r&ZM?5xMCD&I0zSty)eX6vh;
zkUyyQC#mV->FH#u|AO!n-0^@kL^R(st;_{#QXwV%ZZeV_ktbgIE|@SGBO1l?mj8lP
zx7u(X=T-!QE#AEFbWH*W505_I75w+=DRpMTu5<d;jL8avk}MqOD=yq0L$q3pi`_np
z@b$9-SAXV@*NxP8zm0Pxi)th=?+qd#)o6$h+WhUBngaha2c4K<@_GNSzTrp%mr&HE
zvNMv*oUXBBV|@j8mA<8up;DId&rJUtXS2tDeLK3&9uxHT_y73{I|LD2fc*STZ}w6P
z^oLi#KmYar$U;ZIV9r3`PRUF5{|>ak2LAhrPBpYd>|G5lDK}7QTPodg;wQHNw7ING
zRs1%B{|P93ABICWS3~Mh?*r}aQSj3gtSV|t_17~(TT)y$h7%S)WQ3eW)0#|&)-JUB
zt9zQDmZ2&3-R0yZ_OCtky&+Z{ZQp;((&CC$q@Vd6Caz?@I5VicEZNpYm-Qf5IeZfB
z9rar=B-QFqTQKN~z6Dc^n3Zh6(P*U&Z*(7~&@u!VgmQoWUvfs4Iy74D`H@@m6{gC6
z=Nb2(*w`Y_cJYT5*M9P&*W((Z`Sio^*y{h5Fcc~?w**L*Tm{~8eplhrixHT$eYs&4
zd@{y>MotRFkQfbp8DeSKpTjdV-|p@QCOXeRPQ~=)>b3-ABCtfP-nTtM{$htnSGo^w
zEHG0kUMZhp2nO4*$D|`)O=L-4h8hG;zn?2%7#~+TqL*vV*Cuf*FqE~xyM}t8y@x`P
z@qjPmn|5xR&k4>#Fqr~9oA3T?W^?Xu_x;BJPIqikF55%KnQ(P&joo^eT@R2&OzgU{
z-?VjT88xlaInz}*pDya+!aQDpV`%wBV{X||_(-YzVxf8S{XK*n%33!xvUS;ToBG6z
z6=?qXGbJIfEsE?2p+6nnQ7jB%s5aEsmhOKF+3>PZpyJ!2^gV4>H09NmK57W~>*}4r
z1vBdU`MJ-y+x84Co&9>*Z0&o-x8Ip-$UpZLidOU^$kOmf%+O!g(9z8Tt~bPq3bnXP
zT{hTRvL98;Ky0jRkT=9UD4n5j2pR%R7^!y<s{<9%{~r8VzSli3DrF9+=8nLjVykn9
z*>_ojbzH&o>KnZ&4h});BDeUf!z6l7S&VvByv&F(FYiNEu{ku95x8B>Y=ctlt@B43
z`B>4YUhsb2{UGifLSlnl^$2=!Ph~l9L&!;wj{pG^`CF4#9K<X0sATIz;dqa{-!3C{
zK7=@6!W7Yv;STV1d-{&BU$tvEE&C7?V^<T8Mb&=nLEL*~^~&VaJ1<vu-{GM03V?WA
zs#@e=ieNacw%ESI&6M)TC2dMyXK5$98@B^OThku*dH*`c+P=d(TTQ@3U{uxx<ihmY
z3LF@agB}=ynCM+<UBvtVfXCz5YOMW!@HVWShxXd;d(0U|Vo_pZs$O_l2cWk?)oQpM
ziPyOsGfz9WHfMh+AB3|rMMhc8Aa|V}@pygPFaU``$P4%dXh3<QDGPf#<Bm|d+B)6|
zSEp2TH^RCVTF@U-%_<sob#c+SYqsuK^)yma<-VwzOR5A`yDmAGX;!072t%;@g+-)Z
zzSXbHuj^ahr0>&gzYSf(97skIM;#>nn#NpuH~oj5>cf0=bkY&?*qGS0&)MemydC`)
z#V|#nh$XKHt}WpMgV)~q?i~%9lhJeKprS$utkbF`hYhbOIkoC=;Re>#(0c@-XXacy
zw)bLglx;pYpGIJ>tqiZhTfIP|2Kj4~Y|NnW!S-=vj`s8Db{%)xOUb~R7~<Zv<}>o0
zZ`7IT4^)QT5}xZ$jm{!28}^yLc7*Bj>FAX{JO=SY`s;sUL_b$q0#v^U5|eTe!(t=%
z-9~I}uWazfHpD>&{=xO785N`^M9N$S(h8$myAlJxU<BmtSt}kW0E#%?#WHym9ODYn
zQ4=&<>a!{i&%VNqZ#etpB=%ZJz(eASZ#~Gbc0avDa>6z9TnHAv@6%bgnM_RC5>eWr
z<SIB@j5xTziltdL-q{V8f^5XlCKN^>+ZH5J<a`}%bpTk@yjI^%8)=}0UI;FSy9;=L
zD|U-3vSes4M*5fD+^59Xw<d{{>t^x{^rmnwKh&qejMwZwi0*$7<1Z1kKUZr0ez<Cf
z>oa|#;fm6IhSN-3NjXUy&~VC&7;zVQ&U0Jxph+Fc^UE*DmClXTg1jH7fGE-?PX0qZ
zEKbr@M1=sa#22)=ryX`yVKTlk(TLtB<599HxSr3e7h5?Tp5oUv)-yCyD-UrWX?^@e
zy{q_r*G|qa6^opB<*zWWs@Ht0Of}yTOLWo%8#S{8kRCfXgAPwCDXYvkB<1kz{2td|
zo&1#Rk(ceMQ`?*|8gt~}Ali|fWSses8->SeYEt}>HG#p6o}lz0N%{Lp(0d`lDy)e3
zD@Oqu%pD}|?uv8lllKaoY767Rpj!5=71aYOxUD^tASVMIOy5flVqB<)*ZBIm8kP+C
z<7w=tzT>jH_rF2gJ1xn=)EyresrUINa4>Ryl0)LFfObP1*eRBwjkJ5%Tc?WMO4Q2_
z6^@Bw#l*C}pZy7xlS^!hM&}!g(fR>w6sGAO8mdhZY!v7Pzs$wX--}rp8h-yhqefcm
z?k3$+tw`@Bbk>3g6FLY+bBM~lDtOmLkS0cgmy|7xj@|AZq%tmM>li-19D8$<h+>p)
zc%xZ`#gN-}&n(Y`KYNmn`?jF_i-$3RT*jsJ?L0t#_X5~C4~76bITVLfGqVFD!@0t>
z?>L^w{IJIiQp0-#JT_OiW0I~E%Ec$2lB~{KeX43Ue1~O+{dcN&T-|mhbGib<NO8ee
zpH?u}!(<(qh<%JWYhp-ME}O0o-a?|Y9JizRlv5qW?)f=PkaSn-0%1WKqr>go#3k1!
zPa5D06(-YTjXo3n>$VEx_Nbs<1XJm3smUL2=tsw~y0)ZXuL0BKlVM5^??=guA1yO*
zWu@JOz8`Gx1*_G0`S3cAXZ2LmkuA)*UWCnktlj0}CcS^RJf49}q^L;j_du{a&`<BR
z3yP!54l<dcwFFvX5enat=O+98lxY9m=>!mw8s#gMj1@#5E0hzPHVB}gV}0G{wT;FV
zCuda@uly7rz@-&u(TgWesmT*-+s+ff<z*IN@}TwCjrd2J4}AD5(9Gp^8Il_|qJ0g$
zIh-S@cDh)swjo0WL|pVPhK=oF$T{psMmfnSS|0$wMl7MRB6Dka(IAY?$DXe;n}UxU
zo&}Ke(OrylmxjJx{kM}E2$g3qBw>xndZ$_7x&99ULhIVaO^V;SyaOB&UiwTaCf5`W
zl@r?|m~QD9dm_z99u6f`D&9wqwFA>Cq!%TxEfus$iV+f7guqiX8w4|_sGW}iy`2L~
zNTR0--%sRcZ`Fq<N{%KgD@(vmYkueZW6(Rf)r}9rz8v)i;$`oUkR=_;iw^3O#Z1(|
zLim;U19#F8Zpj6yas0I*<ek3u#ieljwVJvYUyK%Rm#*2G^|Seo+dESYN>0>>r0<uv
z$rboa%N#ZB`v7EQBBn?^3S3KAjzRR>tn))sEPTNFanFa9JUjTYb4VU#Rm>2xk~Mpu
z>I$x^2=a!L;BE}#*Xv6&5~1%+4!}UwPbPY2zy0-`p$7$SHc3W<r_c7&q9H+dn$)(-
zLA(xQKh6e~hxu(ZG>HB7`LU^KBG%>kBm%18#1w@vUO;pVpe$IE>h-SRxHc%>U1ZbK
zhU?>m#z82%1*ve*wRrlc+5So_p+3be8V>7M$D2+dy%wXH<^Ep37KCW%+bQcI&b`b5
zum>f}HU0YzgQ$IyR{EuM0L5@IGV;!>4I6;sr9dXe?5g>U3AF2|xdh0-BY52=ifP~O
z-BYh&V0S?q;O%;xyQ;bkQy1BSguDXq=Aq0%tEw^tg>_t4yI(zTPG7^)PZ$>#`K%%U
z$Npkg_Por*nXx2JDv97gDMb-@G#jEO_v1hpG?C9v=E;RweSIj|yf_`0Q9(%wT&oWo
zk-H=-aUBk1ghHHBGtqM!c^7^jREEpwW*gO#?6;U?70vojyaidyquI~M+c24u%73ZI
z@_h3PM^4KV9_4thpE`#7_Q=l=OMxw~JcB=$BRl^!_TS+`VQhfVy?HB|_0F&`l}?iq
zPJ8U#sANt>XSN?Q2edjY>31QYZg6F;n4pBBaSpD%40$OFEhx%<S)Mq0Bs2#f$_TGz
z=lv&v?^Zfr3?n5;xPueXd(lcUuekLf5Qm}JR<ru_M_km4F?V}5K=Ko0&4_?K{C7@s
zx_<J`o95WAGC599s22Lq<UsQeQ&;y}n}x#{HqWvcbn~>b?e`glbuM4Rk!d3~>mhA<
z2Xn*lJu6<u(6!f&wZPS5{(?%feTT@vofTyEl5#pJkBhFBsT3b(x@-IJv~5xgK+a5V
zBmR9l=~CwBF;F!cr6I1HCA`*>x<_^8TXT7<qFbo-W9??Q7cue8pXo^b4DR+YoE6v8
zV8}bji1(c+JGMRqoxwwZj#FjH<9J2UWA%A|g`NEKhqk?Jf#1Xse0C)deb}4>EpCew
zCNX{Ldg9HbbaIe#rMcuh<lTq}=(?2?)1tzEruh6oo8gQlAt`VD#;S>3<4A!KL8_b9
z;#;eNPUgOl1xzNw^$zHLxbl&=vd9Y~?JkChNJMKQF1EhB@?7Ud5v$!lNC$D5(vLr%
zA)f$m%<tCynS|^KzyIRfn0~uek7kS1nC<7Nj;@vrG003PzxG{uw5|hiPWPSf${hr7
z813Z~sFauYCc0Z+wY+UYgo&J6*Fk-QxPhMM-HLTZiHbyu4t0-rCVObnyLzotI!_M#
zAO2R5c<>C_bzEw-o4Zv;kK;v`XRA$6KKCgJ^FL{_qN^3fA8gguPXpE&S9Kduew{F8
zHa5;jrcSV+RWRzp?G&hu7B49>=}0z4#lY*H+(_;4Ieq@%AzxM2KD{!9RMZ!p5<KVj
zV%(MJKD-H?J~_Sf1R*|=hoS;0Lv?_Z`&2KFpMA_UE8Aiqy_vgW#vdU?xgK77fz)NI
z{-p4dY$y8{c8M!(4rT}qq_X|bxp=S&%MUc6f+N3&m%mYG6EF&W0Q28l$q3$DE$lZ$
zIl$N9T<PV(a^Uju*Oy^AaEv@f7k6|?&2^mLFG)Djod+v;lW;9VQFW62F7kydo|#!D
z<uI$N+MmoKg)FR00P#=0b`8Th-d%=!2}v>75ni{j$V(Lj2x||Xv)FKT#gww7ef`Zk
zAt|n}stz=F$6b)+A0zq(_5egI^*;WHSHE+3!^=5^CG<2*CLvSMO){rkC$4E9x%zxs
z-K?of=L@?)*+ULKD>woss^q5J_<OqABIgL6{Sa5;lJLuKR%iI7bS1}J9`yp0P+cy*
z8CnJ6ag=tbcAQvpo0r{IovMxxh=_P`3blGjCD5@3Ed3hkeEWAEp4@wO=u5MFOJ-U{
z*r)4eP2aWyG&#?Gjymfp-C|A_wJQOllo~{>3TeR#4H6Q`SIsw>g%;m*Kqo9t#z{Iv
zW?!7bLZdZ(*uQGseIe?F`bc?dYSW8{*Ds`ATG7D$s58b2SNlTp#0_|eJlZZmADPP@
zXG;#e-rIB!O!a61NuZt{9R-U@WbE5V4O|CC)h{I}nz$v7xP}N8)~Sy3M8E4P+-R92
z<AP;8x8Xk!UC+O6t7gE}>7`V0roSi+$o_z4es4JT$FKlaxPu#I_R_nvTcBHa`F=wD
zT4ZBp47pUg;oJBKV$1boy0$mqci+<2CVKCFzY*_#!0`UeFdEG1tDL_*m&H&`>d^w!
z);e8+n~f_jX*4xb@t8nMNbMYGZ-6g>`5SzRuovLrgA-c^Q3a7OIj}Wp`7OA%0ybc&
zlpl=9-u)pS5%NXhL`nF{>X?Y*hY=+esdOv<T%Z?6fJli_QFU4C;wXz<SU}<UK-4mq
zx<@H@39b7&KK0heA5K??CoHKw*b`?;!u8oLnA24wLmC}fnYSKI>@eCOFA4^N!rtc?
zKxu@K-+tbV)EZWNDgroqZ@uTn5_h$e{GNTcCbP(6%^Yf{sP13W+pSU4$bVlMbxt4x
zSFH1*u1$2g1ZuIcYPT&u#i*O$yYi$LI>Rm10DLQfK$sw<FgThg&!7WU3B}^e5N@14
zcSxiAf5m*T+0);dFTX<JQeM>bd(hIJAKq|dmEz-t;|OW^KYmb<kl5}mo>{z};N`a3
z#w@K_0O$he{}{}S7za}2<82nZDa)|ef4RmT*9yQT@RF3-o9Q+F;w-7Rq=TQF3NU+Q
z+Xe~$#Gk4agEhqIUr^T4JS^H_kkMM1uns!V$!LZ%PQCQ37C4K^mFDE8AcCc_gpAY)
z4=b5##R=UGPgo?9%JEY}^f}Jl=UXfX5mT-css*mEbPpRCz>)9Kq}v}?wAxx(^tE2u
z0MMU84B+wPm3El-f&R@qaHm+=HQ=y5-G%4sbf5G02ITZ4LAf9w6Ia>>DGPd1XBw+C
zXEYuI1R)mnz~sZ|JvwrYbo~}KEacuQ2RlxflWi;Xt$4iQb3I<i46uI~Nj%X=94O8*
z$JzJgK%O^zPer4<(jeC1=@#YhjA9QDxwUhASo28iOE#@E+$EZctAg^Gbrha3*t$Zp
zKGr(M)pS?rYSLfMr6g_+SPbs*r$3kxt~6kxe^b!AJ0&u!s5rrzEtHCh7W2Mis75_!
z-pz@6|9V!Rn7}`$CZdLSV#&jTNz63^QFiiSCuFeI^DA@1b>VH@rPXoKz4QJyn<#^r
zm-~Uypi%QfF+J5=pU2zY3l7X<GG43J7I*E%rJdChweZY~7R~?-Z*ytOP-~s!@;{j!
z0ip_W8A#2aUApc+=AW$>%-Zd275iFi=qs#WBRf-dV+p>%=aXXKFj3(hEianx!hd8^
zA5^&aYgbWBJjhy5oU2zAt$fOGv|AfCBxkzX1Mm*-E~;Pg6`q{q{o`104JT})hALhV
zowH98K{>re24&sSXekVDEf**8K4cU7JrlW*SQAr(HfA@my*slF?^@8AVB!&3uEf$O
z`gJc|@2fYeauJbf;r}sse1O|!%>MWws-TBQ*m#+iQ7qNH=%jYraYw6>r@w?Mh5cy6
zkw)6&LMHt{L!d{7SqKN}>$7_0hCqt*Iz3+E6W?+6D>H=(Vzm{!;wGt4G(D<i%9&xT
zu`Msox9uq*RL5iX#((PeTPaQ425n3?E$Ml%O4)o;+Tp$c$8xW<Qg+Q@QG_%zMJG>V
z40GsvSiHofJXp8-u7kXpL9njc>$4#G`>rxwYT2*b`XGS5CfFui{ihEx)i|a$eo5x(
z(lUupUppyQ*BJ}td5TLoUU*Uw-LoSh-`EGUL8A@Ick{F`dp~9~Y#}3463;@z-}l$a
zlg4;V`YOo0s6?Ue?oK~ERP4%VdSMa%4h@3@pF@S8&PPPB>`n%66=BSqsGzTsk?CX@
z-MPbdV1f-o$cQPKJsGg+4E*d2ULx}MSdSRQ1Tl#^EB{_M#wbk6;}Wtb$!GrTW)Af=
z<Dm2^_5kXilU&5A$Q*5CynB2mtiuv7uCHv0V`2;Yx&B#^pRK+uY#J7SE-zFR|DlP0
z)ZHJDXtO71F~WjG(_uT(nusd<cp2yidoXqRg?`Us$sM*{l@*8dCzKLIx9cvID!}p#
zwB?^h-OJ?l_oIzUoX<GKgwLtY`cPDF=giYNp>^>y>7MeJ?Oh$0#4A>o;LZ68o*G5z
z!%My_*t-BuP9JI2Lz9Q{T#(oJ&47f8&!aT=h}$D?#@f7}cb4tIj?Q`$Ew>1we=FgC
z;=YGycGX<sj}YSgR@jH7tginRwV5sM{Goy-c{Uf7%*n-NWMTsEbAdT}oV5=K5K@4p
ztGbo*s<(v>C|;8ft3|ynxY9yA$L(RN56t^5G)I!~g4k=e3(Lg1#S=5_OJq`yQW$0o
z64H>jRlZPJ>-a5z+8b*IDo!V**6Xi{;_GX*w^%KEv(A*w)nK3}X!goq!P8q%OZ>K<
zP{t}3qBH*0o*H*yx}Rj(_mb4OqzPJg@Y<d>X!-wR?>(cM?6$U13!;b!f`IfQy-V+)
zh;$H<-n;Zp3>`%gkls5;uc0F)AR@hlA{_!q2@oK(5FnHj_TJC4#dFTD^Nlm!Z+y?6
zjEvm5SDkaNHLp3>y7s?URhCd~LZ>4g%`BG;A$6l9**;nmgRaTpn{lDU!IskSl@&{d
zt}z;}!JhAfgN6jB8+}o3f_QnD7zh0}8Zm4)k>T17s0FSNOqn$hHbeue5=cn0o?{OC
zAtJyj4Bm=LvM(LBmU3{DkbSW-d7RIk8Q;&ctL)7+$eK-7#q%VxQ)w$#;q86B=Lh1~
zoKO{+s9})8SBxxyK6^8Ll53s)sLEk!-E!!u<mgD+tYQgnA6$u-&;5FxK^B|Cg#R61
zM|!XG;{vY9iE#~0u@$r}3W>mNrIQ&th+m&p>h;YaY;SNggJh3F;C)oE`~Nl>3wk(d
zqQrqFyLv4tOcYaerY}MyFb63rEHn&%G||8{VkF`;8OhuY9b%s9Ya)d|Y10dM2vMFU
z>(ytAT3pL`0>W49xX@Jg)Di%J8a;cZ4O$Wkiy5?Ox%7`3UI_y6JIf;#2V_3!-~hiq
z+VHhg5;|odNqP6S08uS-lRaL;P>kKsWFg?g9gCm$EG*-BckD3XLQCNapTyD$-*&dz
zA5Q(|iaZpDKXhu04s7zWG+P8a^^}<f6F8nDK=J6Y3q1C=s^|dS@v?Lx+fu50%6ez#
zpzxz737>CmcJ5J#8X1bM*m*2RRx(Je6hk^=2>U5;)*yr4G)3Mhdg<oOy5|S{a@=}_
z2T<E!S9qdLY5HDY*iH!K%X6Q=MIo=!bH+voksrt3GgF7x_xs#DJ(wGw{wF>u9gg*=
zfBaKeGOM%0tr}b%!<kngf13gE&E2sj2Oi%gky2t1ud7?N=10~(z;ue+-hXm(!Q~$>
z3Pz@9NarqQgOvPFJvAj_R_$MFPeWgS7Oga>kuEg@%QrA0&d(n3Ac>#+Y{E9?2+6Ry
zOy5=7C8wi!{InJm;<^liQR;p8Nh}Jz{U4NZ980+W>)jIymn0YB0nM}54)^%9&hmAx
z|Ft$;28cG2q<zV(>@n%M@JSjnr{F*1Q02-2ZJY58V|^v%s9$PG!ek+pzr(SYS;0vR
znB-UnCaeD@3I99ngvm|DycmAKKS}b}&iL=6IhZG<3d;S@uM~uddtuUxF?kH@Hc1Nl
zcX4t1bMx$(es3zvOYO_B++yqiX`6+SkzZM@&nywd^uSz=mX)<=eEM7HUsmVxoSJkX
z<{lT5@y{6-tNwM19}=NIf=CON5dMI1y*_Q9<Dyq6xqZ?xJqn#CSL<lKRSHLKr9$RF
zr-yQzvu@YU(1*{1>&k{X3T?^+pq-s0^-x{{r38*!(6U;q3bQM{%c92RNfLM;Ohf8V
zE#|q^e$@5i3jpFM^gJv*Ej`XNE-vodNDS4f&<`2Y$A1mSWn*7PVnipUtzDAP>zU0;
z<&K8V@f^9Zu;{{Js?&Ev!0ao#GSuGA%Z-ST5ZRY6rORsH6KnjH1^%y5L}~;W+FI?*
z5^>v-=!p^ou`vmQAN_Ma>Y(8?lhp{5vf36mSVRS&qKnkHT>ACv*Z+@2w3U*HV=g1A
z{P3t3J^q>XkvsgFvhSkJ*RPEW^A1gRWk~8T)}Gt5^%cN<skgt1LTbnFYbjru#h+@|
z@AC=1hdDZ!<B93(3yavU7WFa-;oti<<yKicev+1Ek0CE0GHmqxo-~|eTSis-->lWk
z$Y){Zjm>0%_b})rDElqQp8A!BhDRAVF6OSbw)WgP5-RL2{1Dgxe7k!L8v;2Y;D!?L
zt0C5nhRd+v(ap7q`X=7~x4TuEQS1~>&?+hym)*6|9JjLC^JmZAy#k~Pmf4o!{aJhK
z4N5C}YzWlw;G62(lP5kczr^~ztXoEYNrIb}5(0fOLvZW(mf~DOf>!M~_Md$>zC3ca
zw<%WZ6sEQck@fOwd}OrA0o~GTdTODgBRm~cBS<767<)y<3hgede4+O9`weFRpad!H
z*~8oyr};V4_XLM;#9ZU5NH;Qk!$f@#_(7v!ey8DkCEEVs37mQc1?0MTSEN`va1Rr{
z?elhqU<I}TW*wh#S^W`4&dRtJOjcsu7jvZo%v?${VtT>WR;6=AurX8fQVpZFUUeMF
zSK5z}-q(aCJSBu2VR=^r)za6I7@;oyr;5K7<e!1MVzd5{sJ{|h|D!nnsNPj0_KyMi
zBZcQ51M)w~fK+G|&5Ej*h6|XViSE(@iGH7~Lb)3bGSff9nk;LyxT*P^Vy-Tl(sP(K
zQ@=ig8S(Lt2Versga1F?=rC`I%D_jkUMx&J4$)lZ_1QoW_4L+;kR5;IGgwit?Q88_
zP4+pCo>UGp?&cM_2#?xzw*R<iAK77DJd#$O=vuk;I&@nuUQvhTcdhL=2tXv4{kl#P
zA4e}zaxM9|<Fafvc9497U~Az|=Z_`g#h%C7Q{u7Q{zqYt?>H_588f>-IZl}#OwxYo
zGmx>>*d8KG4iI6<06O8OsSI|EYxG0~ww%(h>`<Hy6@@4{%nQN`e%oq%!(+sp48)FH
zDwn;@lMgWOHX1I>rTh$sMXF1Xw|#%6(H)w;d*taPp0-))>}CgYWi%#yx_jC>7)r}{
zi_UK_$wk`@%S&tl=}|zC8WXI!B+7DJaQ^lc7DV>Q$GypQqK`_W53z=L7b0{!%i*zg
z-n|F0=DP{iM_X&M!jpQ7Q-LZj+F~@%87$1dUwp4n{y8?=^?+BJ`edE1zY)ZEQo9q-
zJTK=Z_`P!}(OHrcA9UXlTc2IYr-JovhH71spElo$kp*KmJuTY8?p{QPb+*3}elufl
zMRnZ|wcA7$+dH!Nwl>2cbr~{Eor6g}`ULNOfYtOV0zZX`2s8J#n73WGPx+~013KrH
zS<%zgTR4Z@&+)Igoe!lBYW_kf{`G(dJIvclbynY2l@2=d=mS-Bku#v8vjiYW1eEYV
zp-(xl>ojs|>FE4wzpWPr1LDkYfdeE5=63h8Xy1y=ut8+&T3=6|ktGCW1Ue?U0C11K
zPHqUPO$i>_vs;!rFTf3VC&{DVRr-=Ait$y%GtW{v>>&MjAB_}UANg^{^Y>}he{F+S
zZed)~X1RE8e`>XNn+kDl){35VFSw;bx1w2l1(fR3+mAG}30z1<+`@Q}T||vld$JWC
zqqn_xk0W&4ah*G8x?+abw=QVk(~<@FRx?wx1G?DT6=4@t;rcUi_(7IWHRHM8H?$xS
zZQuRPX>U%cm?jPZ2f3byEf(`i>~Fa!pDbdPa&Sg-O#9Z~c~zgLOoDnD;QzzgRy8_C
ztxf|Y&xXthK)-fZl;O*uSo$5X+wfEIip>hb?sJxRKcDo;#KTpM`(M;IG*t?*QEkaq
zh+ZHb&5HVGx^4$OdUo3CyPL%F&dT_~9j+<z60D59+<P0A((9Zz>RUKx<4;doKgZi~
zMm6z!bSO!szutBk{5U#E;Pn6i*paRLG<)0UD}LYeifOTKD%dO6CniuMgMN;oImBc3
zXR;M<!ad|-hpbjr`;R5=`Z;>OHOBh3e<4}Izi9lxV$gslB(lQ~jy<S@>Dj)Vcl;i5
zMrW*g3}XETZSNXE*xkFJiGIA_Lp_z9N%^A@$8hSg-JOW8-+fS8tVurocB%JI=_D2L
zzfiujN6%W7LIKxrJ_lvq^YRjO>zdc_VquIpJ-y>6?EG{pA#k`Sh$GF<I$-3csNq5H
z3AjdfeUWNv4u22Ufl&LVazGFLIYNZ*v0w7DxVSeF>|H=uUAZ4`M9*^Y(u)b4Z{J2r
z|26>}vZrzQf{UE&#*`Afx4$Lr+>iE_R}#ed_Ylir0uXnt8(V?&ENNo=kJOM(^f%O*
z^H99{2lW1IHzc&Z*(sBTZ}Sc{H^e6r9x#VodzE_rfNP7qDQhWHJ?UI2XwUMS`Ikhr
zL?w4HSu0Qt*FkH}T60CQ-Ezh}o_e~yay{wsH1UEB=pffmtmXZiNP!#8ltbt!G3tlc
zkIvWJ9|YN*&ytEylB+>~Vh#AHnr_orSDdY6D5_PaJqEwPT1R}Us#!k`uK%WvH4CUk
zb;|ro?#-}1dp(C4dAnZE4r#5!UhGh`$yIcu7XuP-BGk8_Dx3lmpLpNctuF=qP#(CU
z#+wv(Jwb4e$xFMoZS#DMf5ka$qTWW0J+q2g1G|d1`yl-!a&4HCU-+k%ReABLujLBL
zW;;6$PUj^$6Jn$W6zAuX5fS{F4%%b&j*#*ztgQm0m5cXu$GE3%vc+y{#up_&ir|QC
zEnxb_#=_M>tsa@CZ@=IFVkPZxBJh#QoU1XW77rG5oJ^oZx_z8^r=O<g_JSw$ds#SP
zp=jtg&HIcA3ipqpRPk(Hx;e5ShlujEQ+g4E?mi6KP?YN0oL!Q>SA<8B8tNVTU|+Mg
z$V0}OF)AK?Q#OEWbkU9M&D=|KT2zU59dBe&kr^#JC|06Q`S)crOWG3Sea5R4i<=dt
z)9TYDrdgB4rWJ^h`_bvw&()M#Z?)QhhjKaY#4#KGnAJ;enE@Cb$F(Me0qbcbhZO5U
zbA`n|Q#V;-Hyy?X*Tpk4g14WRH=cawwg{ygfGSFg;E$<bHG2xCoDj)I<|^ZmC3?S#
zzsYnSBk^Ss=0G4?o#}X9(fqp3@?wf#=hNbVc1$swc0#?6b=oV>h$J|>xBLp}9arid
zzWI-=#)S57TiBo5heaiemFIe;u~Im4az`kQiO=L4t$0^sdMQw(GnhR_qsQSryYlR1
z^|pg<tXa~3Pr+mG4&<|i-Y=iMo@!L5HdmKL>O5yLBJ<>cwQ|jnm9Q@)RCQ!Qq0ZQ@
zYg;d#kP0l+ItVj(9WM`!vr5Ub$N*M$#(}9h_gaeci}##}SNZ~W)t>}wCLH%d9w@4<
zSE%9*PtM)1>e@AYk_Ony#<FyD?3xnm_@a!{d#Xoa$6iS=s^HUlaf6!3O##G!2cMN*
z*EFg-qvVw}IUaW^81@@iwFukVh)GRqYLq+3CEs8yFP_EAR+wZVvC`XrEob@WQ2t4x
z?x1nJ6tBktK=UIxgwUa3<TZ<zTjt5CuxEy9$5&7!Yv<feesJS7Z;4l(>r>8#im?|@
zf~VqYqz{tZ#>_Nwldd3+82pdz{H_HkLwQ=wvgsM5^l)}Woo<bKEkdqE{9UE-hhNl{
z6|sUn4MnZ3LwIQOkztQP|D=i&tPF}FEM9_`wiwDPakbK7bm${CIASqCu0^;Q{2HaJ
zd3^rm6pyHBVL?RY823D+ZPv8RS?#t8MO|1!jggr=;>@hWc&aX&{>aBmTBDLS?v|uq
z1@V`TcUqC3q;<sNw6u#RD_EN5@79;~(IfnWl9t%L@ug;cNE~Fj*F<+klRuc<sn}E*
zKUw1{tk^wSAd&CodPY+jps5<jL@;LcM60~|k=ALUj*rqHJ~cFtu7!NY2nRZUBtS^@
z<A%=Oxe?L6YpOC@Tcn&*&6_(BRjdC|O8-c7QLQp&UxjA#Y3`${Q}mB=XX5=7WM9$7
zRDS4(Z-T+htnFaDiElYqH0WFW<sljOJkk>2T${5B#A+gn$yUp4pl^`i`e*Rlv+%O`
zMIO~b&UjGm6B0_TiL8y@M452#=QwUqZEa-``0dJPzZmvweNs2bUK=~aNI<5u2lEpc
zN%LaBNxU!l6KwU$H|Y`pk8jSiEAW0zpmudB4EpTz1~#FknUHO*&$9Y(=Fzc!RC{P-
zZ+ut>CN|7?teA8C7gB~-*!oX1XfV}!(3jXIArV-7gEv{_P|HZAxZDT9)+^*$wwVpq
zD#{NmE!Ea?Ds`Cl9IG)%WWQ%ti(L0l!7OK|A2Z4-rL|UR*t9|u5N&5d^t#(xid3m@
zypq||7ygD^{=L9~Ru|{5-MWXP+$bQ8H8sK2E%Z9LNhe6@u(1j@7Ii=J_dQCME#}~b
z)>eBp^0oBfgyq#HI~oM;#WFk1dRAFp8T5Z`N7FILBh@XT-`CVj2mhPFCAQlaYbN%8
zgW8zCnP|zi{hd1U*PA?~7$dm4mpiHYCk8i!!;>_o?)={y!Y(mW3<TFNi^1j^#98aE
zf{U0Z?id`<<KgTj$b1EDaJxK8%cT~&^;aIk-=5V!-S~Sb{x$sn%*OwDLWQ|wsi=-3
zHCjIi*%ezUz>6nmR{bD7E%>2}GLzbEJ1pQ-js_9)J^S?t^fa(dlk&Gaa{g@>0#Ddq
zmb7hF?oa7_6`<||Fkj36_><(@5fpFt*SF3$^W8<~k|I!%t4bN@#qrXvZBxlEXJ<I!
zYsr^PuP~`qJSR_0%blxXCX9gcNCm>F`+K32U9BPC+9pfwzKqp|@U@W7g@S7)p2vRp
zk74*r>3Q%2;pF|>!s#EgGlL&9%JI=0>OBC8>Y2}J(0wiXfUaeWS^49YtZ#T6&U0FP
z2@+MdSXCoh*j-ijy0`z%Sp3WW{qzllkMqrJoykntzp1S3q7SB|NgD5%TxS=h2A=Sb
zjE>+L!MC<<`TP6p=%>OqdKnoRh27UGwxKs}++0}NDw}~}|1k^{nhT9s)e~lw%o^80
z$S*H*XuK&ePQiJ-8%_-?R{bf**m^Z@j4WHGg_EPA0%8aUUJY|`4LZBH3=2FK5+WVY
zuNmKJy?`2grj}5w_m>b14GnePHH#@{<K|YIoSIrc1Wml~^t?YZ%I$A6To^r%EKWgQ
z?YuT^)(MZf$N|b$o3p&fx2Lfj<-EkHe=d7*y?&wf!gDOQXoArxv0P%f%$s|~y6t<%
zMBZS^YuDv&bwjj;7+`Z!7jvzxE)>*aq+3pP61XK$5_IeLRVLuZgt9c!M5{&a(2H3B
zzBvQJUyh_SGkAjG@3XM5bb&g`l5SrO@jd)Hexq3Ru)mx0``#RmfTJ6nR$F{}ib5+P
zLC2Q?C%b?f|AIe{M;CT#I<T<e?BJw^T_JT=p=a|h&54|vI>I_5{ZnD#o0Z8AxH!UZ
zcWANitwr|tD?fjpHX=~33D<IV@f_dE3=8k*_z~9I5+Bbf3fL~S&lCr~A|*f{y?sne
zdrelh;|`ug=;YV8{7xi6<7G3SfQ?#>RregyB)mxyxfm10h$%>eZ{EKDy{G4a!*mTR
zK-Hg_nOSbOi*7iA1MBwf9N>QO{0e(8JB^6f!y;CjUy`D25Ky+C%ZvI*DzS(q)5Vp+
z;7nm0004mDU%jUC!)G~Eq45JXj%-e+-<yeYDtiY9b}QC;ZkTviM<*R4qvr7qdfF^j
z%mGdhASPz)a`1-5%*@QaYx$$QtDBolUjk<w#Fe?>zxStID#XvmZ?)lvY_o$WOY})2
z$`hr|ok!d6g5U3&&G)qpmE5E-?Pz28e6bO<8^)ILz@xX3W(%72E7`8jiS>p9nQ}Od
z)O}Fv`N#6vSo(nYwo*z-^iX%-zS_iT4Y}{h!SD+DSJ;Y9%PIRD=DIx<9^?o+Xff&z
zgC)7ds`|nD7!h~tUNP6V_^u|@+DFDPQu2F;%fMt3?&F6g+80?<tZ49J{XCsNCR*4g
z<?p}&P;KHv&7mrv8<b>jxB5SVrlaqtrKca@v$vi0*F!t~#rp6;32mDP6Gk7J%ZvFB
zcXy+VudNlJplInS-;E;XIAFJ{oS)0iV)OCQZdWGTN-MHXzrtepo#J&^woEY3Qn+rf
z+Yq<0BMRY91Wo4C#~C3aByyRLS|qN%gYJqqH}*#|V&gS}M}X8<w-L75(qpEb`j1C#
zJpt67inOWG#-F#tWQHwGS(Xnm*Jkb<dK9Yb3Y0g!$TJ=+ou6TgOh_2#@oF`AoyR#P
zcC_gRNyN3V%s)flH~F>C&GytNFRc96w+)1U;lu9UUw-Guq|Fy?!7GXp5t3oq?bMgQ
zD)UPFo_|o#skU-xuq$`BKAb_AWG5l?pX|i1^mH`55I>M_=t#AQJecgt<ayNHi<z_e
zK+|@b!k=!OkSA9)aFs60mdBf+&T3!I$!_DF#qQwb1m-fNz)$>?ByBs)O@zcf=o#&d
z96e$e6?l0uhdFFyWMl_f?9`jSJys&ua8@!U@}PV@JVBz!^=+wN%=NN+p5b{-2<p%4
zqsE+oMx_a^FQmr;;>hJA*REQzDk0tc3<>Yo8z17q-DG5By+DzB$APzL*hnp;gnwOE
zPCeYam}$c0DJm8WSVCYoxL3Oa0P^NHNj`C6*L|5>V}2Cy;cn<%vtbtbyLaU8$|t%f
z($3+{0};-_$(Eh~D}WV>3oQj{A55o!rJ=>D#nFQya80#znPw}MO^J<kqqj!etrte@
zYUtp@Ra+|kx;KtnC+o1MBcOS}p((55M_ssYt<C5(SS^^nb#Izt8<lx@($D_V_x#w}
zVkawexu_t+IWy-v!YQXqM<%6Ke5(wpoGvQiG?wGO{wkws>I!*b@SPy{q}_y@1veW9
ziuzDWT>B6{0q*1uFEP6?_NYB^k_pc&%dYrDU*(%wgWRpQV8eR9_uj%4z6QaITBR?C
z{V3ulxFr#c4l__2<ab;AJZqDBmnEhm!=?m?Yl?sa+X=`Um9f3#(cb_OKg&gfLE#wI
z;Tq~E?uVPY4T!+tW-p`q6kuLFyJpM^yVhG|%=zgkYUG#e&T$RSBlg#&zwWzV2tEba
z@4F$NNRvllZrA%^7%y0+->^TDZr&9RpecD>^hG&E*y#KB@1?$8h(iJd*{HS73(-?=
zRO>|}XgJ(D12~-mnys-R>PZ)?r<C-Oud?W2Tj`6hJuC@1EVPR(OV8kGPxBb$_%GE9
z<~sH?R)P_e!z|rvY){rZD8l5oo+VoxXT(-nxtX-toApJML7%{~y)q`?v5`xLNj>|g
zM|A?ij&mnkaDKdzZC-FfM%!k~88pz}=ePr4keO&F#jZ`N)wmxa*8FbjEU{0&$|6}?
zD^<uT{`&mI8kCfZiW9C<0aAdKOP&th+%^xiU*mfN8%T$>Fer_4?499DHOwPsV0zL@
zfHk%e(F0x5l48S>1m$D%VstaPfNh^ceQh*`K~^ybPOj5dOGVJ6W_E@6;8mQo{QIdN
z^0PBMdR}vSKT`Pgk$e+76F-(oH|z>j(jVI4TRiI<U+h>P$#XL{%6+4b@?;ToXEcMn
zF4cJeso&mWR7z;9_sFrU2Y{j8Etj0su$h254@+xEF0M+4fqn1(5vBp9CR(l6j?U3E
zv*0fBHCqH|?q+GptJaya5*%mHJ<Ro}!4ALkE;zSbHj8p~Sorn;<)rkeL+yU=!Xe|z
zL4#6EK~plR*Dr%C-A@Tro4FEs#;CKA-b21>+Gy}b#kR05bqA4l<J)0x)56h$C7O3s
z)FdOU1KOGs^U&U;$o3FBBb#x19Gc?P@yAgUy~VAEC!GoO^ac*)kq5_a(=;RPrJu!Z
ze>!c`K@L4c4NljsGpeaGb7j)6Fmy-lVZEc-1wMM%mkh<K?vgnC(F&BQo#ovK<aIqf
zWn?`cCKMrBXx4AS;uM=?#Vjl%%|Jf(84lel`P7+hchcdq88oly=_8cSU{c`XGd`gj
z({}9f<CEFRp4ba#<J1vB+woF53}d{9Ho9KDRsL{uY7X(fR{hIc7f>m+*V@x{LUVO?
z5Ro`^&1WJ*LNaQbrrA1!uF3FR7a4hKwIS~Eivfk9(BW$<O@04glELd(m-F3pUQDv*
z$7SQgtEp%e9}*eIcRgEY-$JS}@6$b>(q<%LH3j&qX%_xA%hKC$vny4v)>g3(uKyMC
zGd_S>Icd!=Q_9~DRp)q*oL`58Lx<%yK6MPY7iw3}VFLbxphdT}O(0UBQucL;-V{5=
z_P_W_L*%|aD+25mm#R}3C0X4Sa#%?h{zz-bw76K_k+ykH$N_5Rr1<=K5WmgH<eA^m
z&I2Py%#|}SUPw@Es*?>T3d2pk#$(QDT<?)d4L>lmX4NV!oSohvIWE5t`Xcjr%YAK#
z&U^HXF$iqlH(qwg1p15O<dX4YK{_z%uwRfhUIp90uO>nY<)_iGsYP1?8)tiDc~%YT
zixV{PGj_LZqw)5)2kChhj#8|u^Jn1V`3`}DXPsq~6k?geA95LVlarL}3ka<9y+SsW
zDx@DoOHT6@DP;Cc?=&)vn>!c*kMpp!^PYXU`(+=vC3hQq;RhfSc8=nAoRwdNT+D!v
zVo98r!i9e5s`i_<&ozRXANw6^{?yWzZ$WR@@tSukv*S}y8#E|-u=9*%AY9B1*{R@X
z>jcX&j7oZkjXDWuNpupPKg3@Zdez#FOAfTFVm4`2LYTXsZ)`iveLY?sAD6gKby~gL
zLo`XsYDBh+{X0#{GkSuNjHz*A749TJmwuYiu-mK_j<;t5#J?V8NDQkrx~-C|HDx6B
z{vzLgs%oU%P#@4qE{sPm{?iL|ed_}1*XP^sCUX;n-frr0)9$YGAU1~7Oda^Bri%`^
zX@8q(WEuNpDpP9RGEE8xU)X2h*n!MS(eN=4Gkzx@vw(4n&lgB5Qkk3qa^W3Vt3)$4
z3Pz(df-O(K;%rNgOJ=zxdp!D@Uk~+ahl@0vd}t4*@!J%r(SLvHy=~)U%!S+--)($>
z|3>0~tnR<mg_sUHXIvTz4yy<Ga_|+Uy{2*A+D#LNt(EFn?7}A+7*_jcPvqLL#sOJb
z%H;xjd@vdb{#duM<m7kaB3;T(Blp~Zm3#JHHB#C1NekI05$=h71MjANrSxSLK1hx2
z7~3HiyYwiq>4`@FsTr3v@dLj+NfEczsOZ-FiE=bsCP)*n)jSzsZU0lL3tBQ>iyiT0
zH}3$lb95X~vJ5-PbGpJM2W%rT4eOIMPBKEkL3f2y>)%+dvPF7AEXTuo6IdS;`O_ef
zvhUM%&rgqYWrBm1BTpDuUmYm|r_rKjM+9*4v#K`LR6#?sLwm#$@$ZuwV@$glqmW(N
z**nLaTU9Qf7G%?rDv<l?AU=QrCoH0t#h1xGzmTQ%U6T%<!t!-0vyu`PJEu1m%kkg%
zqo?!|X+&I~pU+jxxvuuJHuSe91y;6NZq7C+jpVC5Zg7JgCU<?nCAB~wQjI&igYlb$
z1nW+by0zY@bLQatRB;$d58=8;Y&;_E4;!Q!|DtuCMq}(p`8y|W-~w)tc+wbKtGI2o
z&k1aBVFD@_k)BE%r?$<qy>zGPZ|<3Y+x~LmKn5Hu;*!;1C5zpNB|481b(UBTuL19K
zOL<%dx8D~C>1%-&55Dp~<@?cbVUj_W`q<ogweqC6c(u$j>d#Vr0~v6wJnqBSB35Jw
zhiqv}fMO0Ao3$6ai}(NLh`B5~aQT6Jm1*bU*801bRM_RX(^2MBdZiLoSXFgAS1d}v
zw_5I~<+f54^3Sr_I-5P?%U7m_K;H014@o~;_2G!$6Z6D-N%e9+=5J$t2tjU6lcqe(
z5)$<A)oRec(w%RdQKfCAhG97cgME{lw=Ft9wpZDA;Y_(M)KK!H`B%CLSUX(v6N^85
z$yF$_A89mG?J+xy{-dX_Kmm{6=^CGgX(K8;Cs>TTCrl6N{zZoL_eZW-AcOvZFfoPO
zRUYVTH=dHvCgJh2O#SgfkP(K9_@FcH?-FSL^^L#+L%Kx!K8ETqZl`}gm%e06l5tYT
z`P~3x9{o=)Je|Dl@4Ep0_wB|1+Li}))4~7)R`sY!5s|mQ($Yi$>Rg7^fMi}Lj{etT
zGAYhI58_|!S*gbII=$0-{O`K|&8{VlVb|JqP8ac45JX5ZGOG|Mx#kD>HDqnM?d_1k
zaf5#~@X9yJ<GEbfPC1v|<>?pBNMMW#zuj#bEKoQm`1p4@{8q~;%|juF-WW3TvRJz2
zx<==~=O9M-yX+Y>VJdd1DI1Jt%u~KT&1G3fQTv-y^UW9|ufn<RmCUbtA7*X6vT9Pd
z`%M8)i7~X5GNGDbOW$0M=%xo3@tz}pQ!e>j41qWO^#;n{tuKZ>eEpK_3z|lF#f)6X
zB4m~3NtKu8`rQ;_-ju&2D$5lrc>Y_(muBZVhAN(kFskp5QerMOZ+(FEPr9>cOh-eo
zmR<iSC71M*@(Dfblb3<z?W;XUvii%=7nUo#3B-(UA8P`w7WYr%XAXM;%?swbTrE_&
z8TYMXF~06sROMCPG-34slkt!;!W>odZdHE-*RgxQSwsEA^K~zPVUaqo)930N{^<P!
z0bbv+!4fW?^90*HlTlagE$iFA&j#(nLktyqLCte<<PdbSd<)+5E8IH|zH|JFNwleX
zw8inImrWO-L50hxnWY3k9hX@EN`Mk2D0X}o$@L2Pal3zamL&Mfcm!hM@K_5zweJB$
zA9mjdt~0S3(l*WRwds(xIxBr)kLC7$5i*#pp!b@U0|GS|>vdXR^&N*dF*$Erodff`
z(5lgh{L&iFv%Lwg^&uF(uIWb(z`0+(_|Y)~+3tj>2=F8g#%TY$C}XS^Mk?^wtVb;J
z!8KGM5W~F0+_R7U7%$vMLdBCtm^$veTAItPY_gFC(XELj=rmpvK5(ThaJ&3HbE)r1
zqw9<xaARhjkeZrFPBkMs(odgbiIiEg`;aY8=!$&|2)@=<di#aq3<p*Ez($^fL3V)n
z?m!Kew*R=4m}O@%)gCf;Wp8&)R!g#0aTS-Pb;7BHl}2h--p{u-K39o?H8#-^Z_P{f
zH+jeSsy7~(4BFG`O{_I=pYim;2OH-nq!p8;MWSAV?ET;e{LzcATHPfxag}bx(7@<_
z)8T73TyO~bJM)%y%;5l<gmM{}A`{={(F}7c^Vd4_`8N)R=(--e<MFdso&8<moQBPB
zdtliIHuSUT$B)bHn*dc;B??PDz_jz}59Q+0h;&i*GbT_}*NJMpcR4%zS^uoA;WyT7
z1<;s3#L(z;y>C9Tp}IGfGpBUULtfP=L#bru%5G1Zw&B)VvdT8eoeCdcezp1s`+2Wh
z?0K`5;924+UFFZlegSjUk8g|<EUxGuD#V*L<N@=(^I8u$0?RMli;S7{UJTBgWDc@l
z5!ERB8wdSN6uu_6?3_v^>E$w?pjDe1_tqbW6H#@4{9tGpT;Nn}w)N9`z}EIvQP!+(
zeXhXi+poZTkZK|A>cg(nY<4nlCPS>ypnqAwzdnK#|Ft>m6@PNfWdv?-Y<_Y4ETo4?
zeS!=6AgybTp_p*>*MBs%l&%9KUP)`Tf^<j`x9#TK@Xt{^#t)pI@hZQwvwf&|Gz4cT
zq?Y~n%KINfPmiH1T>9pQIZh=<Eb<T|K=zcvl+XTVjFYDQfQvDyAB1Sfu3Dj2IheoN
z+Iwu1U9n~Iix{iI+I+o8^6J=-V=SD8d5Ih3ioi<W#nAk!EaJ%{uj=Se7L4H|*H8Dp
zDv7VYV(Pr>BwZZ&*WmoCE4eQ&ZL*#OM}#@0Yuz;m*ydrj=Wq2eXkiTC{kD5H3nA~j
zhJ)XT$qC`d%ly{G;TzBGTnJV_DH3(5-xtvhsB?3LzZCk-E)sHMmW^OjXul1^V{o<0
z9g+R0y5u^lE09jPA*K~?r|aI9-@~feeI&A8fn7Cibw%vH*4?59ZOtg1&gF&Oi*-Hb
z?S-1dmKQ?YTsLNA8{&@ad+0vhXq=24j2_GGIOxWHkWl*D;^AC@(eBLfoTr3=F_}7P
zAFqr-kPb#U=&+f*e{1#Sny`RN(2qSIM|ov@uVX#qz;wvWr0VLN65MIQ4DgOh&!0=h
z56q<gQ}{o_@?V{~{PvHu{J$uX^dw{KyG#cY5o!q!qt0?sT0TL_1WPg1ZVVK@k~LMp
zD)&*IHGvQOn)4x}ilSxgII)`|Np<8^yH6YCbt^_7$*=((<ny=p7bU8^Jd8>I`oMH6
z_m%tW4F{3!t9wcLj!T!Z<v)J%^I?Fa)=SBToVQ>07R>%I4ROquzUN`5=cBKxBnV;Z
zhh^j+czf{i<FXS4SyC+CU9m5@_W~L4tgM~HIqH%6oVV2)SKG0}SmZk8$>u7X4YYan
zE2<c1u2yjUHZH@IZRhl3ico1S2La*n=GuE#w%WA+@_#KPss*GB2y3!CDh0ysix?f~
zAt&!Mzq$ArPO;Lx_*fD&5YJxlkVEGs{bLN(cW+k&Rjdbmya`dHJjEL$qQQjn7W~af
zN?*HPfXkr3L-DyI<MhM5!!IxK#eY7{S2^Pw{FN$T$7VPW)K^U4cmM;ciU@ljQZ_W5
z`EGBVp7gyeGHz`_p8p7m#RPEU7bHYQThZcwmV773C#mxOnaXByN1%y~u7bqu5k#s$
zDW`K_8PvLp{Yq0V1Kl1ebxD*ycOiaLUrsAY@pu12y7=K8AWsP-T4m#5FE0guDffw5
z@S`qeNbAlQN~yu-xg@UUt0ws!C&5ThhMZb@;`RMQECX0CW3^&auLz^c^RJ(ET8v3R
zQj{;L^{hZMVM+=2+Q1TcCjMlSKa2Z1!bmNV8)JLR8j#-A0sT_ni}NNq5^f`oa0;Qu
z;uZ|<5+fT%qBLD&lZOGPVg&5QO9ppmE3F~au?VZFYM4|{nn>(2BvY+7o}Kx@g9qEA
zHTN;+T|HX4UuFe(WPq1;7Tc>Zu^4pO>%x~tycXRHeuxGa3_7dZ;`70Nrf$HkUemhF
zuILpbc*EylO<lLu@BQWz6o;uPAyv9sZvrPf8K2cbW5(4DtTYSOJBqE2!bJ>p@tmt;
zk_<AVuBII~(+6|TMA|OBA#3>+P=i24dK))W<STQc&-H*y5(3%GLBYXF9ihZ4!*Vpy
zT!v6j>*{fi(q*##2r@n`FaIg+@lvBDNjah3cy4CjmNmwezC_e?D*#~xM5jCQ`psg2
z&Q9{*?wajwHzDM!^Hs{stq0Sh#~rqvGf{he+&xO%Een29fNdY(<}ULrf?1W4S(8oM
zvlTTvY2J(M?~^?I_MWPAfX4qwwY;?@FHOq-sh8hT^uZQ7+&2_0ppnl4-0e`^`x#3$
zhn~bp=x=)RjE-Q$w3AN|Ydl9U$6b&;Y7TIk7Kf<qKLIQs02^iwMpk<$h=<N@>v>8i
zd#6#l5ickumOn=jF{{QDWcY0tOKWjYEF9L&Aga6oTbnfn$PcRNz8E_2h{J31{uk|g
zsCTyx85Pb?R<wOFKkGf9GCPBM({v{q`=&1=zexYqluNjY4$mra>yG{To5pVEW7Azp
zn{ofz(kY*xC#abX8LcpW?qtTS1e}`90Nz%gs{2c4yRbl`#PKry8Lw817y%C|*}-3?
z?T-8T)OwbvXo%;=bK5epYo=$4)=@Y_mgA*U<8|j>*YhbX7a&qe*D6!d<Z~ATLT5<E
zLRS4c`~2WzJe!|uq97kJ4=?Dnaicry6c}xMyq2Rj+vQ>0>eQMb36>(AtJ6S0eV+$&
z#$HkUz?V3Gg&T`evtzeqFLYVOmG#EDIk(tX2)8yV8{Zg918?coNhKrZ{iQ`)Pm4V^
zMEQ)}dwww*CE7&kRX&ron~!@Gxql1?>Bfj@bHOL)91t-ioK97B0$FnvreFaY&n_-R
zN0q4fX%@fz<Tp{!%eEU;L;Vc{X(H9jkVMEdX+O<$`)U8E8aZ6a=sJ>!ipC8RZ`fk?
zK|2})N{7vQ!3V}$6yw=@qv+a8-8>?;lKHF|RZ{qkVEb2ac7i(zmw@zptLue9xtk4q
z-E9C{-9%g38P6TjXuiOe_@Sz$62wq;ySYT(1T&42MXp_7J_coNfQ){~>5QO4_|dqT
zPwmBP@#vSnc>t2x+HRTHNH5bbsC!d!6q-y_f-BFc&1OyVc261X<;ztK>yKs%r%+l^
zBwmpn4WpR<u9Y!S9e!mAV0cZN+h+fa-J`odc}oHi$<LJ`%LW@@k(o|RVDnb%ndX!u
zO0nz)r3!k)5J%ZQ6-9Y;eoo%zt(8M<)z7=MMmAL1A7i*BeZ_2szckd2>{eO!%@wRQ
z>z@@Uc>9UDzn#RYO`m&OjsC$fIV7z|ntZYxYqUK=!llD-0#U7>b&d6ztPWo8j-G>d
zT=l#N+ykQqlLw-Q<d%}C=SV-6CKe;OW30Ozqido~NA_30U!U`N*B6oV5Rb{@e#v=>
zQBLDTvRovUTPr?aWN{^|V_M8Z)yDp!Dk-}?h5qql%VkjeO6`PEr50BmsMgp+-ZfLw
zxQ7oS;e^=p8l#=&OP8dY<Z*)7na_-m#dugQC83-$rP}(@4#2Z;*Nva7-lSJ?Ug@D*
z&!+kGIjp@z-tK*!k3T<b<8^f!GuYet6wd2<ZUk>U>oRN)+qb@J|F#Shjf|7@^|FCB
zC&xP^aOma^H~<>M*2cGdlX?6;1D9=+kf5jUv3Y@eG~>I9R(H0S6||*nyL>CVK1$v`
z`~b_WJzqEXI)4JGN|*G_zxQb8J-XDzs(Y`C=J2a+_ippCe-mUl+{XWW9Vw~fbnrmp
z1d)WZFj1<@uD2a<eLn0^+HM54H7JBm5p*yE!>-~n1ooFfFfGo9lS}SQ<q{mpBQLs#
zyp{Uatl4_MTC?|Lc`NFnX1nf*-DkL^=Sd5MH`LmW@k>N;&L*x8nQX<^XbhwXY^vxs
zxW;qvh6zn6Xy0-isrkU~1k9-cqp8Uxf04ppPB<cZ%F3J)KTZf#Mp%9ht;%3ULz@iq
z44di>SH|HXM9i}9?b0Ld3V?2~5Xp(d$=xMhzf;8CjFb7Mj9;rQ&vtU1{oID1nCr6B
z$m*e3S>r^Zu3Vkt98;~`MAZ#M{rtu+Nj0GeYLD$GXHe+g70r8<D=qJBl^WN}baS=Q
zOXqBu3~T}tj}<68Xv{0DVNGmrT<$+s+B-es<b8AK=wF3Nhp-G51)F}nsfLM`HznaW
zqM|4q-`JG>@?OH5=p!{gsH1MpVXkp>3;tPbsG*p^LZ^|h?13`dsN`~LDd&!1R-*<H
z#~>QvjwQEWd%ux0xc?T}j0ttipP!Z!hui%uT-?4sZhm4g^CS12)tCjueSe@V&*0dV
z*L?@_3KKjB9ao~}F0y8UFe<_a4;D40z%2@~of%UVSJf9wlQvhPx{N)=NCpwn@|Jxb
z(0gBD-li@HENT25n&jkwIyRSUo&cts^w#tqPLrJqSq^NpWJu)C)Hx(ReIKlME1pH&
z;3FQ@vSuMyTy6>7OuGv*OVYc}HlA%9h(GHOT8pv}vx(d;$n;}+kBwIe&;@a~o_;}}
z*?~Mgow{a+tf#S4Hpa@_#(d@lN+xu`ePhL%vA3z4=hO3`UG?*ai7mdZyNw0fM(h2>
zosNuGHea+4FW08(q+40kWw4E>_rC6RK|(3{E(oJ)lsUy7v5KGGjRwK;F&9(xlq6A0
zc=b+ImwRc0j0`&?(JIq*O?`8*wwa}2Pkra=Bb&6fP;fpAxqCG9+$pjNW?Zy+2oIh8
z=7#Fh>@H79@|TfRe7$-Gz0d-QdYZ#cE(aA*k@a1Cw>hQ$>>sAos6ueN-fg@Q33!Fg
zD2W}HGYT~yA1SrLDjRA5rcLC!E8sI}0)HTpu~PNN4Cr4XIc<YK`C8+f)Z|yTwO7Nu
zsBy;*Lxt?*^VYtt!ao*sWgKr9OvN&*r7ZqvkR^=@Wnb_8ar-`XobSb%HMLu;%-%}a
zh0^tOcJIYgU{3<4uuLf=vz1m1upPBIRgK=Xk#Jr9wE09PYcyYh{li^i#e}X~9hTis
zeqZOmdfs|Q-Oo1Hmm}C$;J>X**fBV8x0f04P%Wm41?%_S2?m-5V#P2djp>&hFB0lD
zw_kJ}Fa+hi$X2de6F|UPnHXrwpI+I|5IEO;i^s{PD~DkmiD*i)_k59K+L{7RobUhe
zZk)Gp8FYC{+;rps95gWjS~qnEW<vHYKxdHzfKOM~9k6r^9$%f43Te;=kF(*>M@smR
z*;X`TRP6_#?3K#PF%dd^D~Ayij=LRZYIRq`_W{xygz|MJTFJGEhhbz*7T=mB=+7l-
zS(HnyCt8MbuYoIz;227rs{p2Bpaq`QmLBE*M?a48L4UrH-yg1;G%ei?g}M}%XKY;p
zzoAwCg0zkZX_Jt7-z9&aHq6FR4uj^1HUbMNuYhX-0o)jn+?Z|iH%#ktT%2n#fKg6r
zaPRLf2xe&iDg1x_ums8*i%r1@C;g5%9$pa+>0$zwG){-mMl~-hjn{7Kx_^iWCe*Ov
zb_ImLLmTxA1M+GZ#HySA@#lBCk~goEe(eUUDh4d=5FjJI3cV6wisk#K*#8BC5TsIP
zd(5j_Z5ywR!yG}AI5m0^mp)VPy)}<UINDu&*oUoT68Bk-HX@C>fJBtnJ&das5DONo
zI|k(+yysdxN;nL^vgqcL_NTH-`A^KVq1U1xZ_lgE?M{4NcQu(m4}g1c)+qF+p4+V|
zPhHIWKLPAh|7FwfG+^-EJ0aF*B8HOaiePP=uvJK6B-B^?#Xah^TK~;L^}TkXdHLrS
zx%Vh}r1MoXmOavh0&zE?l`@h-=gevu&c@<))BNl6m>W*fCib7tErXQN=B_+dReL*{
zh$CK<hYHKKK#La^`Y3IEG;dxTJU4|sGo4-;8Gh_P5MB9LuD7Au+7dm^IgZ%siDh0H
z$qO5)))&&Px2laS`31$aJOoCiM`Ac1jkKHa+P0$jtL5^97<8S0SGz=A<9x26ujID%
zR7{6f2rkSUb)U<)S*LicocQ~6Zc8aXjU>Y;lS)Fh^<dD!D(PS<GyEJ!ydtFR6;2W0
zS$RmA4>JP4&cgt8VgO6DJeqWgVRD%Ms=D;(Z<8v`i}T!FfHk?-)2C8S)mZ*DmD_SZ
zYwLX~dPc>>m@gelIzS|R4uc|baf;PB#J(6vQAjA&l?~?cyBL@lIfSC~oQJ>gdW<}`
zyTD{+b_0xk8I?#lW0aG>F!%?)+df%CzV|yaYJsEk$j*fgN37+!WkZRpBb=aLpEkCf
zH!k;)a?T%|E5Eo;#a5t}o<QFbrjWv~ePIekRYOX7ZO4n2291N&{l=>c_#L6M2C*+l
z&LoWesE6iH(W-(DI^3AFqL{P>H}Cj~LK{8>?_+%bEp_zbj8m>cSi-jW7G9H|F0XZ6
zuTG_V(N8D$^yY(~v4m8H(tE2Ar}Rc^6xaGlL-o&ceKlT-eiJH48f)x53gMT2C*_%&
z$0%dgmlXjPy=fhT(`Usp&(VJ8$&^xF{rA|7Oq%P%p!2<!eHQ4tvKWm2ay(6$DeCgY
z;H&e~(0CR)Oo|@DvxXVa9Vw-YyzuRRB;tAWDUQ?F==)>(+2a|CIU|3Sgp|YK!y~(K
zWmfI%cNTpa?V{r6_38;z6@gNH7^3-H<p$UMbY7jV`<pY?V~DQvdA&MPZo`;gjEai(
z$hy9LB>9X$TZ{JAhf%>${+!!>8}kry1!wdefceM>`Rr_SeQ3s&n7z@dtWSwM1>$YR
zs`Is?3G4{o@(da9LKer5)N6B-9h{-^>)pdGAki|eupamz1ezr5`B}s|fZqWKu7&Tk
z-Q1hT<^Hs88~@6(R}anf`CJ7%b)H?qx);&fSNNbk&vc1tZyqYK8WyeK3X?#|PrKV#
zuBl1&c&MZ*X4A`VZq9*VkaWH+Noj1KxryGTq4S%sptG5NEvGg_18>sEik=LewuF-l
zDtjh#{|F`KcJ#Z=tC)paDF3+<e$;%C#PhWCOmO5h)BUxV|6b)9y8ZTjoh|bVzqc@8
zPgUXT+R)GENK&|4cB|cqSek&oAgbu_f=22P&Ws_Pihg$sS0Tbcq-;r#dF%Lm3AH;8
z%XS^J9k2Xa?qc1K{U0U3_zHF>B^OXU+v`sUKWAVPbiAxcEpLFTh<p27_q$T_C7J+z
zl6>`>8Nt*s?o3H~ehrCQ7vIKS=jjQ+HT~CU$|(AWzzITg_BX0>_6F@hA%pc}xo*e<
z{BtTRNmIDkc3fe9aw%PuC_rVjhltr?|0CWAEH*OtZO_Q71}{wJVyd`fvxoR<<TKg3
zeMjn#!5^1YDWz0-Q%(3}K7Jlg>u_WezK@Gr-#g=Uqf$uuSTs{T))0yTJ<CuhO996>
z-^Lcb2U%oZ<Q+e*^T|^jIdyfebeR(s@jIqQic*afp)gRTE<1(9`BX5CUfc69xKrGe
z|2gY?3ioZFyzfliLkoJN0}j*j?M&fw1zY_7_K}o=uQvqWupEEMSt&8f>>cSS2PTVJ
zH=r+|3CS7-Nz%<9hyykfu`BUZTCz3SS>K%UzXa#Z&BcfTs7umJrOw`rl_@ve9m&<j
zO&0QwXg=#@|8i{S1&<%B@)%`mC^-W&MRBoaqSol9#b~s_Ww^elpWrDb&=Qg|hn){L
z?^%fKp=jsZC4x9$ZLrS!q>IDt+PzBuH_~3qJErI|^jIRY?F_wA3(JVz>Ar&@G&5Sa
zUh(fd-pPKy4d2AW6HnyOS<3*mO#0wtXM)x>@+S+rGh><c+bXt)fLZzji3EX6XQgYT
zWSov)hfjFllul8by)zc;7-RB^z@9xjIS@1sh>u$pg0kSkAn}0yM5Y4O^qO}t>FqYI
zQNM7AK0;TH@8C(GeFvLnu3nkmUI|WN>-jG?G2BehJp3Wfz9j@tXr5k)gp0@cm0_|`
z_Ql2e1<lE=S0yuuDBparn8eiZ+_oMwo-1nee8NZ98MHi@+I1quS8nH{^)CHCo0O;x
zEP9POD&}20ZIG^hzVhiDo5yiXo)&?A`7_xfQ!kvvl!X<N(WPAf&3F!t7rd4YBkhGV
z2;b9?F^b9Wr%z{EJlJ*Lcu}M#eRE1XUefV)pTAhv2;m3k*QZDk)J`aR2U7625Z2T-
zU0iP%#?ntw%@F3Q?*Fdgsg_c^zZcm#kdi8uf$lz?s?JM3zG-kXa3w6UyU!3>H8?~)
z<&_URsJ#H2gIkL<?e@FYh^(LpT9in}@p02x5YDsB4E-(SKJ!?)v9T!lq|w8+T)d$y
z!w_!|8FmvA2RYc$67v6qF9iOIq!4gLB}~KIfhgY+nA*J4OqJ|GSU`%$hMqCc8W{hP
zpuyg<2XdR32P{ABcHT{-rnhAc%Lb7XMDp#k;XY*J2v^xDS?^yT<vr@6S&6TQCcMbE
z*4HR&^jOI&$gFy|dN-au44YrA_2`R%e;?<#%a#C_K~2(Fxy#s$s7PmIZliY7WJ3Kc
z2LywWA_bqIY+*1&2{&Az<f4)bF|?~tB0(YKWLj(bIt~SUsx~q&c1Ec1o^uO1M(s^C
zkQG*w&I{g!L5wR_{h%HY-*c@V7!a<)V^m@!VKZ7+=FuE_%*$#x?QR6?JUrIG+#l@e
zvkkQI=%N}Iz*C0o<ZK}XjiJhkt3tC;45+M&`qxG3?QE?Tl_xdc0N_Hj90Pns{kD;i
zIdtu;<)AZleEUmBsM3UxQT@B|*;T+=m*0FZUOkizl43fO;@Gey2*0SF@A{k&EGB8X
zHJUL?o$2rBYnm^1+R)h;Me~<v6<=l?&Yq58;3_b$RIk7HVbY>USZ-r7X-Sy4P1MXq
ziR8E$Z{z&7Y)wf{yW^H=nR<S3O(7X}lLK53zVorxZn<<la09iHc)0Gmv+#7vl0<w@
zxwe1DKr9}lqr2MgjGUcDZ%%Mn37c>dF$^Y&j@`9_^(UF0wHbg+Wg1LAD%(2ErUUBh
z)#^9qE7Z-C1sPq!s5L>FGwB7b6doI6fXrfWW6I&?G$&(koF^jEN#??N+@w==`eyAo
z7JrI69R=Q7KPuiIk{oChqPkAt8nPfQ96q57<JPT_)+*C6buf-mDi`mM(!)!EKhmc%
zDw5%{dlcNb3if;YVDn+9cbPi8*ZE+%WrA(2Sl{@Dhu4=J{-$&6Vc>=Ue0)~~qUn#=
z;D1BgcqbJ*6r;&;*2Ww5NO~?InYpcou@kYBq@OjGO6yL3LLMwY@W+V|KdT&EVpnT2
z?bOMP@DxFpOptN$Yrz~r!6Zn$-*NOqRF?7ANrk@A8q+f`c(ok@<x{3V?-8-h?hWid
z8r%|N2qxPryYRQ*m&rx$J2IySH_zQ0sE_q)D0nQzKXn270SNcy{0nKtgi9Y;QU0o%
zXn0Fb$;k(<I8l4AqcWxvRRZSmhoswa66S$jGFTnR5gC*abGd;Ea~082$hmfl8Ka&2
zo-E(RsH$i^M0N3ji;#yK(Vewfwe(gox9QiTId4{5Q@rekN?9Ge5GQN15OXU@Tl=1B
z>dJH?5)zUbI?Sfst(>kQgBi%xNi>hlm;gE!D5Q4om!Tuy%mGi2aNtQ>#USARYPDDE
zXfm+pJeSBSsXl$vhyF2rnfMpn##IRb5M>BN`d{$1n?aJf8Be+&=fhNjC$Pmn{4$c5
zlW_r^crQAQK-y7Os&CO~ni@>fnLo?{IQ*Gh*z*{`U?u6HVv?V^KgO=D*N#G>UV0OI
ztZjd3y{K!kADN%{kvk56GD@@_eJB5Zo|^22{vm^}Gm5<_zGO=@!v`jVB9cdv=Y_me
zo>m~}Fv;`&L1c9f1>N!!h`!`e>rF##u-CcK$6(`Qu%z4ZMI=u(<lJy*f+_ztI5e5U
zu3)Dxu(Sn*B1h{P{U^<Y7I}AwkK$Kdy_czq8e}rM)#!X_inwNDr|Hyc_sdhO>_=xy
zmC6l!eiP4O)*A#p5fBOZ{U7e-`kl(^+faj6z9t_ts!_fY<Rbx}q*4L){pt1#UJHI)
zwPddinu}TqFIjC4;|-&lE~A|{eVyUsrv?MByrXX@OtWJ+K0RDms7Oj}a&+IYJzD<`
zy!gmtr<*t6jCj(TmM}9@8!LXir`rL4_mWv9DwSO=L#M=T@mKt}CJR<=?n*9;oc20_
zbsk&8M{=Y`n2dCI!hjXE6H)c2mwa~Rd(~8;NdeY10;q8=hA1!Q<&+?3iD5zu)1i^u
za<3&PixsRW>}f}$co`(+8(`iay<Cpo#-Q<0yVf-8CU`ydTN3-D)Y2-VpKD)@6<ew2
zu@qSzuK!XmP&UFB-z$Wz<4li#=nGAvTN2&WnmJj*hb9_h<0qu*)rSbRj#wJvs+aLY
z3dgB^RHn^KWwK{dZEmIzy5XO{wR3I)p1nY^1l3-gn#b#Zd945!h@v422OU0#@rHFs
z?4Is#D*;lCW}5%6_P#tE%J+RcKBP#BqLd|BLY6ROr|kPKG9%jvAz3oEu~d>6GqxEF
z3WG3~vCSau_9YV%S+d1g$})D|r_cA-w|M`0|9g+)edmukX71ye>$#unzV7?E=RB|T
zdOmJ^T~wB1y%#sV`a4NcZT95jx;pXIs}EL;{J-byB1_<(253<11@Pk8T@lcWo7eB}
zlsq`@^yy*lOBp7PnG-5l->so>gzh3jbxAI^sFO^rQ7|yKR_XMNlnp*oni)7QR#Ln}
zswfoSl-Zuna(Qj<n>WcUXS4A=0n8l8fQID}I_mAfue3N^8D+rzxrGLjMGTa0)^K#P
zGegLZf3{5^Hj7NBmxfD|ZzFvvQ!RAwNb93j%YuI<+qwh-|BRPj-}G)Nnu?7=E8hqR
zBfTJW62OJmEe(0IX|9735#pOUYtLwG;RKOYX)f**v2<Bmrig|g>*IaP5B%4O_^IM~
zj9e)NppjSmT(M!^N|h=vQKcRs*lD7~g|%5&gO?B$;(w{`u>19PzMIR?j+D$POrB33
zy3g0OtHREI)w61QQ0bgi;`AcMHH`Dp%wl?&gA+q+uSb9Nw*NEGj+xLE-RS1s#VYHL
z^JJFd0DEs7-FH4SQa4&vxA9DmLnldL*-`qu?O>gC*Fqn`iz4gCJZadjyiVEKsj<J=
zNZEw9aZK%<#*$0--~#->PKi|T>4-GP4LHl{{cFKRLdIu!JOX}#b5?_%jgMP#Idwev
zjpN+yVCt4mr!&06asfa2kx=-4HVmw!Gi`7fC1QbhWH#L?gu^$Sw&^Hl*yYV_(bB`H
z4$EoxgyIP2*mK_Z*4Afr?^k+DC{%7Rkkj+vKPWlInKB5OkDAZsRz8!vZoD4QhOQT@
zKqv9Ri_-8{MwKjEt1p(%tYNgXzYi%e$MZ<hWQiLjcPGigD?ydk))zBX*CaOP(!Iw!
zT5WGo$dEoIJ+Pr=A~j_uQn{R2wb$~gHRg2Th>WOGqZ7Alu6ob859%BpGrk*4ha0jw
zy<fVO*cHQ6oTl94&&YJomXp_*+uhr0syvF)1#j1qhJy{Wao4Rp`b%B0Y|GK59*&u8
z%c0j6Kv3>Yl`Cs68g@w8pG=nNW2o&TYd_xN`YW>lJyGbD5`Xo|-lE-dD`Iuyo!YLI
zd%>L>Pcb&wP395_o;hMUr`l|WpCNS|=Li{J+&Z$H*RAjEhm`1We`Tz^lI?Hv(=4yu
z(OzOB{bBuZReFeHkgxwq0Yj3Gr5qu$vbr408U)Nr%IuK5?{vjW{_dquORIQr!>(}|
zWvr`+nwBM*b1qC8v2gbG%kMn_UgT=5jmviR4GF|z+CN*n1gqyNK@+o<rA{45e}?tw
z1F+OgT3r$E*KX=t*Qg}(?-lay+zza#PYY~n`#F+P^zfUAL$j)ZkGnGYxkQQ(2IbMG
zw?vHpdGa|@#eRD03&&F>rRCmXvz-J6TM6)(RVg`B5{~L5w>xtuI!id`^ncF@jOS70
zq==M}bP`k$=D{DF1iOG6v-61b>mQ|TLhoTbnf>qDCGcwz!$qa_tih#j?dQFX742O<
zZ#mjh?hZ#y`IvA%*hr7YS{Fd7;uY3DjdU5e2i^9r-xa_8gJUi?i_L!cdf2);v@1j0
zes7%sf~&kyI%mz1&7{?{r+R!r^>)y*@A_9QA8<~V9QK3y|Ky=Yj2=DJ8Q{`^9i8MP
zWvuJ-`c><q2zZT*&$+(W@(tF%22CJTAcEBwkevMQPB*(N(=wk4?NvSl3!ExqvH|8#
zNUNF|lt(>!x14Km+(2frHi%Z4Qqq;%J68U4AP~Z)^YxzwYkL?21rj>R<!f)?0p3u=
z%XeHUHGZ;og>vRLhE#x>exnxw;pyMl4Ka#rAXV?~J+qgkLwzGXQj<NQ+xZ_NV)V-?
zUUY-(ASk=;OEoOkAWgFKSTJ6UMI~*W{w}RZM&b@@_p=w9M=r3^K0DQ%BtY2OXnl4$
zy8d@|X2h){K(g)e_esEe{H*Vh-{{xBIU_%A^5!v1LqSfB=_zc#fAK#@Wbmm;Qj$`#
zxeuVZVE|#UY4|?oK(o<FUbMfSz6r|#Jh&0q1MlFz9S|1K<R1ZOhdhCT{Zw#x_y~{|
z8fNap_h0DjU*0C%96+0~J*=Ph34~9mz48WFipIjL2a-!)2?JJ)+>Xxf&-UgWtpV7J
z5sQrdWYBLx0Nv{TJem_fZUTA(ZxJJneT>kFyH5Zs=C+YRe<wZv;y?f)2u1F+(0;n-
z$W=|iim;fv^1jRx8oF&j)U=xZ<bQYjiGUXVe2Yg1&GU{T4k;6MFZmol;F}!4H(b5v
zE%s5)fNyvJ-@ucuGVB|1wO6KqZ{ppLi$v{X#C}<SU975?aj^LkU_~3mkbHoX`=Je7
z6^}sYf#$nOzxbiFsMdqNxd`|M!8(1Q`KlgZ#k51+<)CkXU|Q9V@jcLdUI4ICFqJKJ
zAog~FVA{-iCx4(h9$>uuEqqPR9tcS|;IJLjZ|4s*YXiyxg%|P##}4>c6>!-9cl-Y%
zZjWdl&+k-taqZx2Iux-^_Z<^w{CNCekg)+lW|wGkVSh9MhXW!Awr^Jt1k?Dh$=c6v
zv40&_<5dB;i1i0o;}1;AtHA7Q0v$d5mwMvYV)WP;VANDD#P8Px9k~h+ZGAq5*B&02
zH{XCh{$Jm9-X0&&^J{;3cl|=y*4)_vpjuEyeW1GdhL1`<KUNJbEaDXSV8STT>Ny#w
zPl{C53ku!}+6WmDN3u0(h=W(IzJXRSJ;12+7PR*W-=~3<-kqVd7MlCqBE7vJghnv^
zxy_+$M^_%kRxGR>m3N4|fm)`2ZeVg#Ff=I_p_8WmjAF!<npVW|<h<&)kn`@BP{Ku*
zMeOxkotsaUY4wCWr^T~#{I!~m-V9gktBEyVn@v6b1*)5T#5qw<L1z*z!Bs4)uNFW@
zII1?z`ri-%<h<R#<QRg8P)EI9S#mX#f6uS)k8I`XHqyiU-0Kbz1kubVo|6CSt+Cp4
zGs+C7W>$#>Y0J7S<!;&v<<0{v>`v3+L%&V)P9FL0Xq=lQoWSpyAFGT6j;H++e@oUy
z7W7ARXqI<KG!-`lHAYoC^?p0GO>;Ely<6l!(%{gi1F7Ftz}i<>Jwx>QZU5g}A@3w0
z3&ago=S=-IT)g3GF94?4u*$G2Zhu?~TLaNLS<MC7pNDK#0x*X!JcGOroRbKgQ@Ccn
zKz`rUNpPp<!`_>2>VhN`o;%*sgKf$SdTr2CsUh2f8ott-=*eK*HnGYu`KU)eS0{eO
z$RX#ijmz;<pYLxMY!iH==j89*crx87l+4JEI_5@JD8pH_=#RcqM}p32P`OSB+nVIs
zokgz9)Envc$Y~>DF5eWmM=jRreZoh)Cs-fYP-E$#DUx!!1#@w1<LY-kZH?HhjxWM{
z=ZKx@0#etslub2lQ#uzKR58PbgMK;+EZ~bX+{KqzPPPl0i<(^ieMO@o5l7oN^cRsA
z>qXNpMu!B$8HCeB5o=+?^4hmrk0BxU!TmxCjm?Usk57q@HmC{@&&$!Q>hDQMtcF>;
zVWeVK0`+s9%O51a3~JEnlF%3qv&r490#33eIetNZ&zHX9EV)@|zOALQvufhux!72{
zdj9(%RT|Xuppk2Ti_mpwXtj;A?$K8W2F?ShuhjQm@t*PyE<Og9*6BpJG0pu1y`sSF
z2cikRqg73Vd{G7_TkSb~b$h2byiAs|+tCz8XM4E%#2|#P2?6X)Q<VIDZWp!;OK-iq
zO^)N?7GGBEO=5&e+Zt3cxgvi^BD(~=Qo5$+k}~BuQuR|cNCrcEPFC}Y^9)A1n0nJ5
z3e~Kq;D!|?ZOUFEv3-Uw7xJ^X$CYZ-k|7IJ0>Wo2fmOd4HZHEq!<N@Nqypw?<UJ!N
z>slw1Bo;4;o$aZ0+|*QzZ(%U6X|W(P-IVbNf>o$jDw(UEefiL*AN{A;NJJ8U8MI%#
zh&2DAKZ#S*kReX@eqX^wxAu{`CL?UcFa^OJyqj##-kFFQtkyZ~TWtBTb?I)7;Ju}G
zK#e)Qm>V?qeCb<U4XFzbpVJwry^mOtrn%>=k-J@S3*Qc@vkl-@74+{Q8q0VJ59Anh
zaS1!nQe;VZkG^hDhV{tTpoTMd*fcWhQPWeNd`?2K#h`|av8fw7X?$zL!WH-8n!{i7
zd3v348*cW0d7L?HN10r7QzzG4yPP)dN}>k)<&*Lu7C@O{Wb^`i%hVHB{Hc2|$~LTD
z>*sUaWw!Hftr-IVZ`tJ}IJ)DX(Y$17HJxoy!n>rVh?H>)vH!W|h;$=p%6gs__MG(%
zbwau)mu4t-4pA~T_@d(<TZl;9^JPM^YJ!_UYD^Ph_zBKRG3!$tm2<Rh-#=rRa2JgA
zt57yyBZ{$a6~$s(-_*>u#0v8Eu8fv}dR&*F<amdB*EcdMI_WZNRv>)ZMs=L9*LWu>
z&kgv}F51xSl83?oar!~MY)D-Dkl$z0?k8fbS>2lBS!%x#C3LKyQp#~bywH28yE0%z
z*KKpd5kqosl#$3Ztmak{C}pu1{hE(q*;o2VmF@+*FrVYphj_G{wqU89c)m>bl|uh2
z+k5t*)(HekHw}!MA139ys^?}}pF7cYM&KfD=YncSrZ9$_pDJ^5Ov-KHj(q5_|NK~@
zkTdl;J&H^x<z~pcwfaeSX=nWkt3%}I5^Sk;g?>42C%jZM_@VC6Qw0`A8qq(E&>~Wy
z@y#>R_@`cX#P3;)_EQ^!HHT-%7_~&xmI>%(hCLCf6*;7t;EAC!UFX(z(bG3-Keac4
z;VzGt)~*|{P!NusM!DHDG<}dh>pIM>ffdFrJ?7b3Dpm4&lwyMbN-?$B5T{a}=Zp4<
z$vkxExPq>Ry2Z2xDfF_GV<qKS$%urL=CE`F>1EH*Lq4!7FqJtA@F46{@37Id9DwRU
z^YyF+BPGp86hIm)VZ(ATtipV&SohXX%V>>-Sc8ex7*fct>~h=#T@aHCQ6%f}V@cuk
z!Cvzs25*sc^VZ3hOWv|_d+O*FGiqGV2wfUMmIrAiSX)KTNcGT9rZruf{_wU3*X6k3
z^O4)_4tpYJZ6IQ9B>37Fxl5OJ1~D;1g37n1Ud2Ov)pix3L3f1iu*<_=GiF!W?L5EG
zHb}^8TA5#vnwJXvEA8%8sv4<TrYCP+dFk~#pB_r;h35_$F{}cUonKaSVZ<kW0!Sos
z={A9qhnpdaWh$0t)CEGk=D%p}4p*vkyL~dSwJf<Xa%WI*S<Wj#&_%Sl*uSWR;)OQ@
zAIDx5cXBmM6|9<VK3CHI!zB@yQp(T6a*jW?<_-#%+E#Y_$6GiJID_(D2;5M_v+4u3
zu0qYk$h;o+U$t8#qq}Do2JMt<G#S%AkJalGZE0AcA>CUGr`+u9ou}-`Hm*Tes%rc@
zY5V;R&(%_Q+-dch<LxCID$}5S0UZutQcsd;e^uAAs~-fp1TDw)LO%*JSE>eS^COPl
zcGBm}*mdgkbe;V?#@%nTbC?uq4%QKYZu%4eMV9#N(T8NslV(Ce*l;dI;L*76{Sl-S
zDLA7K0`^`=_Bc)1H1telfKFQQv6V18BK@js#bE;Rx!u>V+C~_bYf3ZmPl(PxPz_dx
zNMntOOI=phydk3#L{aNBSPf^hdrxlysAR~0C<xo|K0JNpHh5XAc~a&F_i|k8q>N{g
zyw}UGK>-t!TI3y^Tz`mwV6+h|$-(~B-%0Z-beze;607>j$N@@UvpuE1^$z*^)<;}i
z1<8~RhJSB}lJm7HbP95I#W=i)GGv(xk`B2+9yZ616?Yik-RwY{Lf?%tilVWOkgA$B
zQjd%CYbbfkwdc_uwOKLe(ak|uaTaZ`i<Pk;x=M$YniD2Q{>KKa5%os1&93yTs+=-G
zFg$ogrC;w2NTiO6I4@KYnqQRRgbzrB_7fuq8VybaUpKer2E9Ose|#sPkYP=xf(0+l
zkAG1KmjBRwq4Q;=%{+atTD1ucl52{TH|1;6^~p5Y98}Qf*;U!OI#3qr9t>|{m=jy<
zXTx=-<sa_<<+mU!X`1ah7(U!m8HdT7nugpbTHtwm%J4cLR*u&3SPQG~V2a;9Ez(H$
zK4Wl5e(m0^S(s~G#~b6l^h!-FfJOWQUKpqEacg!j5(0fWcG2tBR2?K)yeqVK2P#vM
zToc-fOvH!F=N}CW&5Ko-*!ZR?U3{^9r_`ZkuBXh=OCHweM@Id%-~VCG+tZ%^>D5w+
z?ERKfiTlW78%r(gHqsMw50|Cj<e-`L_d-&)H!XlC=zVlg5HYpZ;)k{*n7*(qzRYBO
zS^DA;MDr#yCC?|>9s1aZQ{IaO4qAQu^l{m)W}dzfv&SbCAMxAws%64(;jWC6JAKL*
z{jHp%3bCjCSJh@Y4s(vG>^}GSj_))q@uIysKTw%?x;AaicbDC!eyHk}Ir$Mjhg0cG
z%SwCfZW~%X*M+S=!D$P<Lvkx>-qz%+sg$`MYWTyJSg*6V%lB3*_Vy2tM>+P%Mi6f3
z!cQC0?D^nmW%yu7Ks}0T;-TQWU>!98StKs_zIP{Nf9%J<vI@TYPXmuNUVYE)RHDR;
z(iDnby6wZfcJAWPS4b>KSu(KdvLq8I)CUgpP$@co5^p1zZvZE~uykPd+uL-_8cFsx
z;VUw*|CzN-a?Gm#SX}1+wPrb>O=kJdp!Z-(^&<rd+xu!SiG<26`3heHZ%-}h8AXM*
zNv+j7nZIBnojBSNqb$B0gM`g*;Q7f9t-Y5cFCkuyzj+wzxLTQZaVINGopHKZfI}Rd
zfb@mJe7@d^?9an#Q{NtSD&7fzOg_&kS#w#|Y%8i6f_hTwhd_G^Nhnz9Q?-@Wr*c1;
zww;5B(Q&M>4U8z$Rkt!XA!#mCD27|#Fso6*?A49*c*(PC(H>d5pVVqil?j)67V!^r
z{IZl6Ejg@vEQ%AF2?%2KYV1*F1N~F}4Qty(-x><ol&$9W=-{M)^s!A(>tTh7+B?Es
z1n{8ClUReyDMk|LNT1BOM1TEPhQYewLDf}Q73bqU!UumIT+~NS*%IH7ShT_{!M|pq
z4Cl~#PNJ5*v}dg8x;AO*nDr$}Ys<)1c^mVR2e2dsNjPzr@ShH9uVMGtgpD<t3Bv_F
zs>Twb@4x++o0;5o-<Wv1k=I|@e0eDsu{01oR~#Y>E2`=m;aRij5M4wJUjEwTiHd`k
z=htJ%HcWcDxJs1rbxs)0foA4b<UlJFSs-r6i1BU^zfmMS-I1!>*9d7EalFd%Ul@${
zG?R?T&0$8U>N!QdzPVw6jS6UTqik`ac`#LnC^g9+HM7y`L3K;34Jot`w$u0^4pP3G
z%JHOPW;R*GlUWQ>waFvBCzWm?X4bA?amm$7*rKw)U@JJY>X5~00(|9pqe~RVerxzG
zLf=z51e0`#X8z%)Th#Qd_WEuy{QHzjp@23kq%HJ&`C;Ipn6*-w?k@uiOtdBtXYs?<
zKxIZFF-{__QG=B=sE;D!_M?a<Tl__?da0N3CK=?n9wm++HtxsZvn<;aAcofsuznzy
zosiE=5;JADur-|0Gkk^vaFBBA+jjKop2mtV^{ZOH<Yd0WJEg&6SG=Yeje@BG%oqE(
zT|!TNWMir8<N^&}z72Z2qNRF!s(s3b{$)_^-Pf-cf%>f7aIN}*$$7kb7byG~0f$Jk
zf?iq#)>LQWS+9Ec!ISd$7f>=qNjImIz=l#d=2SoA7%TFE859HQ{n@sgICJi}zOQt2
zK<rFOLoZ#Sf*r9bYp}%Oy|=8`oOnaiL<vghrUI-UQh8fGuGKkpq>m@bWom?Wd7X<n
zWm?7Da0wk=T@U+YoN{@_d6pDqCBH1kjY2&nw7zQ+(WgE|R`{*?V4PcPTHCx;)c({&
zh~Ve=>_hcKrJmJ^AWFL;uWjVGbW%$ye0CIUs(l*H%XBf6m=`|rYse|Vbh5jNZOV90
z%i5IPDQuUd@r<97pR7I0j2<rL47L`N7W$Zbgs`(%o>Sq{Z$xbH`lrycy_diNjR%QY
z>-KSfmhep#Pa)#gsM#}?!NnV^_d+$LRmo$8CZv@MB@PHr54IGz5n11+{oTnT!>(NX
zmpW&nNAlQam7(`MdFrDqj>RPSvcGBW3;`_4J>BN<@~-6T7Z}`a<q9qRPKTwB+;-r*
zGv!;FOX<EcGv{^Y^Lph8WCO`!MBPWF#X9|5-GBP!GgYhP8uc^@fn>eJ5j&)%hsM&B
zY!}RZGL8I#re@~|?-uD8PRJ(eR_L9CK8F^@evvjXL`HNF8qo0*>)GmQHgbA&wtG@q
zP-izdra22|BxHoy_69NORQXI6(5zKsaceMC(ea@Aw+(oQ&k@52a8n>;<g$C~G2Vw<
zim(q?*sl50kAb21JFkmhMz3Zn!*v7B%Zt7DbuLq3p&82WFWkJE6^oOcN3JGQ(F)FT
zz8+-FSvbd^5d*k@cIAN2!j>^L+}cK1NsrPDY31?({-LIU&1Np_TAFYK&G1Gn#{?R7
z-kACn6Ed;T4qlaZWpaBj)pZ`bz70Cj3o!x9f3|%rq?MwLNITT`?xZRA+XSZ!*6Ew`
zmc30sojX{k-4>!aH6WxwmuG@&5m#l6(l$NrP8xHqDuJ;#IKr2b=Xzs(Aq$vzm{Il`
z+j0<Mt%-AF>Zkawp*B6?r**3IpL?tsK~0YlYVND}K44Lp4;@#sG{-_z%YI#4DiL!H
zqRV)IMo{Cu0w5YOAIEL?fhfPK!~t*#djR8KTi;*siq2C27jayvW&iJr^&im127nF|
zA7ZclfrS3;5-R|$r=L;AAGE>_Ad1co`6dTW`VPR#1+@?!f2^P^crWYf=ak)I<kua1
zcoHZY+JTZOrK{vB!RCr-IQ)TlVoo-n;YOm{h_YwtQMvQarG&=0%>16yv33LaRt)R(
zpK1URxu=@3f}UpV+BWK^be>dGlIqk>co<me3MV8~Gbsivwdds)^Sk^dB1t$CF)0+^
z5);e8nn>R-Sgw{dV_J#|&#ZZ1A-()<27nj%C(Q7=;t>WmlQ-gUG^s{icV0Q${gDqO
zWYD_wXvZAZ&P}?I?V0D9V&P`GVaq3Yl`roE4cW>nT_BqT)Y3T=r~hXlQTDgi2Ba$%
zhiv5Cg51u!qqpbBZ2key=}tG#c7OX`IitiPFhCs~>~EXi3Wz~xh7kR(w6x~&s?q_)
zy2$3G*JDRS?Y<zGLb9$&QU)J3{BhO4pN_NNLYGIKi+=Ifb^hw``Y+~Z{taaR$N;qs
z0RExYr-1V}O7x$L3;)G&jfl@37~g+OxBQ<N-{w(5obeXb3kM$pUb>n_8u)9sBL5dF
CidvEY

diff --git a/docs/management/connectors/index.asciidoc b/docs/management/connectors/index.asciidoc
index 7a3f8f9cb927c..513b4b99d4562 100644
--- a/docs/management/connectors/index.asciidoc
+++ b/docs/management/connectors/index.asciidoc
@@ -1,6 +1,6 @@
 include::action-types/email.asciidoc[]
 include::action-types/resilient.asciidoc[]
-include::action-types/index.asciidoc[]
+include::action-types/index.asciidoc[leveloffset=+1]
 include::action-types/jira.asciidoc[]
 include::action-types/teams.asciidoc[]
 include::action-types/opsgenie.asciidoc[]
diff --git a/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_alerting/connector_types.ts b/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_alerting/connector_types.ts
index 16eb4f7d7a21c..52155e4910b53 100644
--- a/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_alerting/connector_types.ts
+++ b/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_alerting/connector_types.ts
@@ -13,6 +13,15 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const pageObjects = getPageObjects(['common', 'header']);
   const actions = getService('actions');
   const testSubjects = getService('testSubjects');
+  const comboBox = getService('comboBox');
+  const es = getService('es');
+  const testIndex = `test-index`;
+  const indexDocument =
+    `{\n` +
+    `"rule_id": "{{rule.id}}",\n` +
+    `"rule_name": "{{rule.name}}",\n` +
+    `"alert_id": "{{alert.id}}",\n` +
+    `"context_message": "{{context.message}}"\n`;
 
   describe('connector types', function () {
     beforeEach(async () => {
@@ -20,7 +29,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await pageObjects.header.waitUntilLoadingHasFinished();
     });
 
-    it('serverlog connector screenshot', async () => {
+    it('server log connector screenshots', async () => {
       await pageObjects.common.navigateToApp('connectors');
       await pageObjects.header.waitUntilLoadingHasFinished();
       await actions.common.openNewConnectorForm('server-log');
@@ -32,5 +41,38 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       const flyOutCancelButton = await testSubjects.find('euiFlyoutCloseButton');
       await flyOutCancelButton.click();
     });
+
+    it('index connector screenshots', async () => {
+      await es.indices.create({
+        index: testIndex,
+        body: {
+          mappings: {
+            properties: {
+              date_updated: {
+                type: 'date',
+                format: 'epoch_millis',
+              },
+            },
+          },
+        },
+      });
+      await pageObjects.common.navigateToApp('connectors');
+      await pageObjects.header.waitUntilLoadingHasFinished();
+      await actions.common.openNewConnectorForm('index');
+      await testSubjects.setValue('nameInput', 'Index test connector');
+      await comboBox.set('connectorIndexesComboBox', testIndex);
+      const timeFieldToggle = await testSubjects.find('hasTimeFieldCheckbox');
+      await timeFieldToggle.click();
+      await commonScreenshots.takeScreenshot('index-connector', screenshotDirectories);
+      const saveTestButton = await testSubjects.find('create-connector-flyout-save-test-btn');
+      await saveTestButton.click();
+      await testSubjects.setValue('actionJsonEditor', indexDocument);
+      await commonScreenshots.takeScreenshot('index-params-test', screenshotDirectories);
+      const flyOutCancelButton = await testSubjects.find('euiFlyoutCloseButton');
+      await flyOutCancelButton.click();
+    });
+    after(async () => {
+      await es.indices.delete({ index: testIndex });
+    });
   });
 }

From eef575add446d0da68ce6f12467b7f21ab92e4f2 Mon Sep 17 00:00:00 2001
From: James Gowdy <jgowdy@elastic.co>
Date: Tue, 7 Feb 2023 16:44:10 +0000
Subject: [PATCH 082/134] [ML] Fixing sample data link to ML (#150447)

Fixes https://github.com/elastic/kibana/issues/150207
---
 x-pack/plugins/ml/common/constants/locator.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/ml/common/constants/locator.ts b/x-pack/plugins/ml/common/constants/locator.ts
index 8e11a93f059ec..d23a7754d4e75 100644
--- a/x-pack/plugins/ml/common/constants/locator.ts
+++ b/x-pack/plugins/ml/common/constants/locator.ts
@@ -52,7 +52,7 @@ export const ML_PAGES = {
   ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX: 'jobs/new_job/step/index_or_search',
   ANOMALY_DETECTION_CREATE_JOB_FROM_LENS: 'jobs/new_job/from_lens',
   ANOMALY_DETECTION_CREATE_JOB_FROM_MAP: 'jobs/new_job/from_map',
-  ANOMALY_DETECTION_MODULES_VIEW_OR_CREATE: '/modules/check_view_or_create',
+  ANOMALY_DETECTION_MODULES_VIEW_OR_CREATE: 'modules/check_view_or_create',
   SETTINGS: 'settings',
   CALENDARS_MANAGE: 'settings/calendars_list',
   CALENDARS_NEW: 'settings/calendars_list/new_calendar',

From 6ad7ba3ddbb6b9445145ebc55f13f54767f5353e Mon Sep 17 00:00:00 2001
From: Thomas Watson <watson@elastic.co>
Date: Tue, 7 Feb 2023 17:58:47 +0100
Subject: [PATCH 083/134] Fix useless regex escapes (#150043)

---
 .../lib/jquery_flot_axislabels.js             |  2 +-
 .../server/services/saved_object.test.ts      | 22 ++++++++++++++++++-
 .../fleet/server/services/saved_object.ts     |  2 +-
 .../common/utils/resolve_path_variables.ts    |  2 +-
 .../manifest_manager/manifest_manager.mock.ts |  2 +-
 5 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/packages/kbn-flot-charts/lib/jquery_flot_axislabels.js b/packages/kbn-flot-charts/lib/jquery_flot_axislabels.js
index cda8038953c76..27cc7c92eff6c 100644
--- a/packages/kbn-flot-charts/lib/jquery_flot_axislabels.js
+++ b/packages/kbn-flot-charts/lib/jquery_flot_axislabels.js
@@ -380,7 +380,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
                         if (!opts.axisLabelUseHtml &&
                             navigator.appName == 'Microsoft Internet Explorer') {
                             var ua = navigator.userAgent;
-                            var re  = new RegExp("MSIE ([0-9]{1,}[\.0-9]{0,})");
+                            var re = /MSIE ([0-9]{1,}[.0-9]{0,})/;
                             if (re.exec(ua) != null) {
                                 rv = parseFloat(RegExp.$1);
                             }
diff --git a/x-pack/plugins/fleet/server/services/saved_object.test.ts b/x-pack/plugins/fleet/server/services/saved_object.test.ts
index 4dd99a3db2d2b..4b2efa0f042b3 100644
--- a/x-pack/plugins/fleet/server/services/saved_object.test.ts
+++ b/x-pack/plugins/fleet/server/services/saved_object.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { escapeSearchQueryPhrase } from './saved_object';
+import { escapeSearchQueryPhrase, normalizeKuery } from './saved_object';
 
 describe('Saved object service', () => {
   describe('escapeSearchQueryPhrase', () => {
@@ -21,4 +21,24 @@ describe('Saved object service', () => {
       expect(res).toEqual(`"test1\\"test2"`);
     });
   });
+
+  describe('normalizeKuery', () => {
+    it('without attributes postfix', () => {
+      const res = normalizeKuery('foo', 'foo.');
+
+      expect(res).toEqual('foo.attributes.');
+    });
+
+    it('with attributes postfix', () => {
+      const res = normalizeKuery('foo', 'foo.attributes.');
+
+      expect(res).toEqual('foo.attributes.');
+    });
+
+    it('only trigger on literal dots', () => {
+      const res = normalizeKuery('foo', 'foobar');
+
+      expect(res).toEqual('foobar');
+    });
+  });
 });
diff --git a/x-pack/plugins/fleet/server/services/saved_object.ts b/x-pack/plugins/fleet/server/services/saved_object.ts
index 2a1f5e216fb2f..43ec734edceb1 100644
--- a/x-pack/plugins/fleet/server/services/saved_object.ts
+++ b/x-pack/plugins/fleet/server/services/saved_object.ts
@@ -25,7 +25,7 @@ export function escapeSearchQueryPhrase(val: string): string {
 // filtering SOs
 export const normalizeKuery = (savedObjectType: string, kuery: string): string => {
   return kuery.replace(
-    new RegExp(`${savedObjectType}\.(?!attributes\.)`, 'g'),
+    new RegExp(`${savedObjectType}\\.(?!attributes\\.)`, 'g'),
     `${savedObjectType}.attributes.`
   );
 };
diff --git a/x-pack/plugins/security_solution/public/common/utils/resolve_path_variables.ts b/x-pack/plugins/security_solution/public/common/utils/resolve_path_variables.ts
index 585cfb61aafe2..b4605d13583da 100644
--- a/x-pack/plugins/security_solution/public/common/utils/resolve_path_variables.ts
+++ b/x-pack/plugins/security_solution/public/common/utils/resolve_path_variables.ts
@@ -10,5 +10,5 @@ export const resolvePathVariables = (
   variables: { [K: string]: string | number }
 ): string =>
   Object.keys(variables).reduce((acc, paramName) => {
-    return acc.replace(new RegExp(`\{${paramName}\}`, 'g'), String(variables[paramName]));
+    return acc.replace(new RegExp(`\\{${paramName}\\}`, 'g'), String(variables[paramName]));
   }, path);
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts
index 3ce2d546f714c..10eccac516847 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts
@@ -36,7 +36,7 @@ type FindExceptionListItemOptions = Parameters<ExceptionListClient['findExceptio
 
 const FILTER_PROPERTY_PREFIX = 'exception-list-agnostic\\.attributes';
 const FILTER_REGEXP = new RegExp(
-  `^${FILTER_PROPERTY_PREFIX}\.os_types:"([^"]+)"( and \\(${FILTER_PROPERTY_PREFIX}\.tags:"policy:all"( or ${FILTER_PROPERTY_PREFIX}\.tags:"policy:([^"]+)")?\\))?$`
+  `^${FILTER_PROPERTY_PREFIX}\\.os_types:"([^"]+)"( and \\(${FILTER_PROPERTY_PREFIX}\\.tags:"policy:all"( or ${FILTER_PROPERTY_PREFIX}\\.tags:"policy:([^"]+)")?\\))?$`
 );
 
 export const mockFindExceptionListItemResponses = (

From d5d50ff62121a3ac8fbd7d12bce2a27c9250c65f Mon Sep 17 00:00:00 2001
From: "Quynh Nguyen (Quinn)" <43350163+qn895@users.noreply.github.com>
Date: Tue, 7 Feb 2023 11:06:27 -0600
Subject: [PATCH 084/134] [ML] Fix Data visualizer responsive layout (#150120)

## Summary

Fix Data Visualizer responsive layout broken due to a regression
introduced in https://github.com/elastic/kibana/pull/148063

After
<img width="1771" alt="Screen Shot 2023-02-01 at 16 23 06"
src="https://user-images.githubusercontent.com/43350163/216177549-c15c4d81-045a-4540-89ec-af599ede0320.png">
<img width="838" alt="Screen Shot 2023-02-01 at 16 23 18"
src="https://user-images.githubusercontent.com/43350163/216177561-39aac97e-2fff-425b-8872-c2aa796858eb.png">

And adds key to React.Fragment for the action cards.

### Checklist

- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
---
 .../components/actions_panel/actions_panel.tsx        | 11 ++++++-----
 .../index_data_visualizer_view.tsx                    | 11 +++++------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx
index 58d730cff80e8..b92bdeea23a15 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/actions_panel/actions_panel.tsx
@@ -7,7 +7,7 @@
 
 import { css } from '@emotion/react';
 import { flatten } from 'lodash';
-import React, { FC, useState, useEffect } from 'react';
+import React, { FC, Fragment, useState, useEffect } from 'react';
 
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
@@ -120,11 +120,11 @@ export const ActionsPanel: FC<Props> = ({
     discoverLink || (Array.isArray(asyncHrefCards) && asyncHrefCards.length > 0);
 
   const dvActionsPanel = css({
-    [useEuiBreakpoint(['xs', 's', 'm', 'l', 'xl'])]: {
+    [useEuiBreakpoint(['xl', 'xxl'])]: {
       width: ACTIONS_PANEL_WIDTH,
     },
+    width: '100%',
   });
-
   // Note we use display:none for the DataRecognizer section as it needs to be
   // passed the recognizerResults object, and then run the recognizer check which
   // controls whether the recognizer section is ultimately displayed.
@@ -164,16 +164,17 @@ export const ActionsPanel: FC<Props> = ({
 
       {Array.isArray(asyncHrefCards) &&
         asyncHrefCards.map((link) => (
-          <>
+          <Fragment key={`dv-action-card-${link.title}`}>
             <LinkCard
               href={link.href}
               icon={link.icon}
               description={link.description}
               title={link.title}
               data-test-subj={link['data-test-subj']}
+              key={link.href}
             />
             <EuiSpacer size="m" />
-          </>
+          </Fragment>
         ))}
     </div>
   ) : null;
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
index ea72215a89598..1508683fd1a43 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx
@@ -469,15 +469,14 @@ export const IndexDataVisualizerView: FC<IndexDataVisualizerViewProps> = (dataVi
     [currentDataView.timeFieldName]
   );
 
+  const isWithinLargeBreakpoint = useIsWithinMaxBreakpoint('l');
   const dvPageHeader = css({
-    [useEuiBreakpoint(['xs', 's', 'm', 'l', 'xl'])]: {
+    [useEuiBreakpoint(['xs', 's', 'm', 'l'])]: {
       flexDirection: 'column',
       alignItems: 'flex-start',
     },
   });
 
-  const isWithinXl = useIsWithinMaxBreakpoint('xl');
-
   return (
     <EuiPageBody data-test-subj="dataVisualizerIndexPage" paddingSize="none" panelled={false}>
       <EuiFlexGroup gutterSize="m">
@@ -500,7 +499,7 @@ export const IndexDataVisualizerView: FC<IndexDataVisualizerViewProps> = (dataVi
               </EuiFlexGroup>
             </EuiPageContentHeaderSection>
 
-            {isWithinXl ? <EuiSpacer size="m" /> : null}
+            {isWithinLargeBreakpoint ? <EuiSpacer size="m" /> : null}
             <EuiFlexGroup
               alignItems="center"
               justifyContent="flexEnd"
@@ -532,7 +531,7 @@ export const IndexDataVisualizerView: FC<IndexDataVisualizerViewProps> = (dataVi
       </EuiFlexGroup>
       <EuiSpacer size="m" />
       <EuiPageContentBody>
-        <EuiFlexGroup gutterSize="m" direction={isWithinXl ? 'column' : 'row'}>
+        <EuiFlexGroup gutterSize="m" direction={isWithinLargeBreakpoint ? 'column' : 'row'}>
           <EuiFlexItem>
             <EuiPanel hasShadow={false} hasBorder>
               <SearchPanel
@@ -594,7 +593,7 @@ export const IndexDataVisualizerView: FC<IndexDataVisualizerViewProps> = (dataVi
               />
             </EuiPanel>
           </EuiFlexItem>
-          {isWithinXl ? <EuiSpacer size="m" /> : null}
+          {isWithinLargeBreakpoint ? <EuiSpacer size="m" /> : null}
           <EuiFlexItem grow={false}>
             <ActionsPanel
               dataView={currentDataView}

From bd5da594ca548d4f7e269e79010b84660c984e5e Mon Sep 17 00:00:00 2001
From: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
Date: Tue, 7 Feb 2023 12:26:06 -0500
Subject: [PATCH 085/134] [Security Solution][Endpoint] Console UX improvements
 and fixes (#150118)

## Summary

The following updates were done the the Console input area in order to
improve its UX and get it to behave closer to a regular Form text input
field:

- When looking at Argument names that have Value Selectors defined,
ensure that the entire argument name matches as a complete word and
ensure it does not pick up the same word that might be part of a longer
word.
- Example: A argument named `file` should only show its value selector
if the user enter `--file`, and not if user entered `--files` or
`--filesystem`, etc. _(Feedback was provided from
https://github.com/elastic/kibana/pull/148693/files#r1085676372)_
- Better handling of long text commands by allowing the input area to
move the typed content left/right as the user types and ensure that the
cursor is always visible.
- This is very similar to a regular form text fields where typed text
does not wrap, but rather just continues to grow horizontally
- Example: if user starts typing a long text string, as the cursor gets
close to the right edge of the input area, the content should continue
to be typed in a single line, but the entire content inside of the input
area should shift left so that the cursor position is always visible
- Support for clicking on any part of the typed text input in the input
area and having the cursor be positioned at that stop
---
 .../mock/endpoint/app_context_render.tsx      |   3 +
 .../common/mock/intersection_observer_mock.ts |  21 +++
 .../components/command_execution_output.tsx   |   2 +-
 .../command_input/command_input.tsx           |  38 +---
 .../components/argument_selector_wrapper.tsx  |  83 +++------
 .../components/input_display.tsx              | 173 ++++++++++++++++++
 .../components/input_placeholder.tsx          |   3 -
 .../integration_tests/command_input.test.tsx  |  28 ++-
 .../command_input/lib/entered_input.tsx       |  85 ++++++---
 .../console/components/console_header.tsx     |   2 +-
 .../management/components/console/console.tsx |  13 ++
 .../management/components/console/mocks.tsx   |   4 +-
 .../lib/console_commands_definition.ts        |   9 -
 .../endpoint_responder/lib/dev_only.tsx       | 111 -----------
 14 files changed, 325 insertions(+), 250 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/common/mock/intersection_observer_mock.ts
 create mode 100644 x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_display.tsx
 delete mode 100644 x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/dev_only.tsx

diff --git a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
index 5a9d092ad5097..cdccb9dc40edc 100644
--- a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
@@ -24,6 +24,7 @@ import type {
 } from '@testing-library/react-hooks/src/types/react';
 import type { UseBaseQueryResult } from '@tanstack/react-query';
 import ReactDOM from 'react-dom';
+import { applyIntersectionObserverMock } from '../intersection_observer_mock';
 import { ConsoleManager } from '../../../management/components/console';
 import type { StartPlugins, StartServices } from '../../../types';
 import { depsStartMock } from './dependencies_start_mock';
@@ -244,6 +245,8 @@ export const createAppRootMockRenderer = (): AppContextTestRender => {
   );
 
   const render: UiRender = (ui, options) => {
+    applyIntersectionObserverMock();
+
     return reactRender(ui, {
       wrapper: AppWrapper,
       ...options,
diff --git a/x-pack/plugins/security_solution/public/common/mock/intersection_observer_mock.ts b/x-pack/plugins/security_solution/public/common/mock/intersection_observer_mock.ts
new file mode 100644
index 0000000000000..9f4ea013337bd
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/mock/intersection_observer_mock.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const applyIntersectionObserverMock = () => {
+  // @ts-expect-error `.mock` is not part of IntersectionObserver
+  if (!window.IntersectionObserver || window.IntersectionObserver.mock) {
+    // IntersectionObserver isn't available in Jest environment
+    // @ts-expect-error
+    window.IntersectionObserver = jest.fn(() => {
+      return {
+        observe: jest.fn(),
+        unobserve: jest.fn(),
+        disconnect: jest.fn(),
+      };
+    }) as unknown as jest.Mocked<IntersectionObserver>;
+  }
+};
diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_execution_output.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_execution_output.tsx
index 7f5d2a638e59c..b93c6f7626109 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/components/command_execution_output.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_execution_output.tsx
@@ -94,7 +94,7 @@ export const CommandExecutionOutput = memo<CommandExecutionOutputProps>(
         <div>
           <UserCommandInput input={command.inputDisplay} isValid={isValid} />
         </div>
-        <div>
+        <div className="noThemeOverrides">
           {/* UX desire for 12px (current theme): achieved with EuiSpace sizes - s (8px) + xs (4px) */}
           <EuiSpacer size="s" />
           <EuiSpacer size="xs" />
diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/command_input.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/command_input.tsx
index 8aeaf9a4c0043..d6883be2132d9 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/command_input.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/command_input.tsx
@@ -12,6 +12,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiButtonIcon, EuiResizeObserver } from '@el
 import styled from 'styled-components';
 import classNames from 'classnames';
 import type { EuiResizeObserverProps } from '@elastic/eui/src/components/observer/resize_observer/resize_observer';
+import { InputDisplay } from './components/input_display';
 import type { ExecuteCommandPayload, ConsoleDataState } from '../console_state/types';
 import { useWithInputShowPopover } from '../../hooks/state_selectors/use_with_input_show_popover';
 import { EnteredInput } from './lib/entered_input';
@@ -41,13 +42,6 @@ const CommandInputContainer = styled.div`
     border-bottom-color: ${({ theme: { eui } }) => eui.euiColorDanger};
   }
 
-  .inputDisplay {
-    & > * {
-      flex-direction: row;
-      align-items: center;
-    }
-  }
-
   .textEntered {
     white-space: break-spaces;
   }
@@ -56,19 +50,13 @@ const CommandInputContainer = styled.div`
     padding-right: 1ch;
   }
 
-  .cursor {
-    display: inline-block;
-    width: 1px;
-    height: ${({ theme: { eui } }) => eui.euiLineHeight}em;
-    background-color: ${({ theme }) => theme.eui.euiTextSubduedColor};
-  }
-
   &.withPopover {
     border-top-left-radius: 0;
     border-top-right-radius: 0;
   }
 
   &.hasFocus {
+    // Cursor is defined in '<InputDisplay>' component
     .cursor {
       background-color: ${({ theme: { eui } }) => eui.euiTextColor};
       animation: cursor-blink-animation 1s steps(5, start) infinite;
@@ -273,7 +261,7 @@ export const CommandInput = memo<CommandInputProps>(({ prompt = '', focusRef, ..
               ref={resizeRef}
               data-test-subj={getTestId('cmdInput-container')}
             >
-              <EuiFlexGroup wrap responsive={false} alignItems="center" gutterSize="none">
+              <EuiFlexGroup responsive={false} alignItems="center" gutterSize="none">
                 {prompt && (
                   <EuiFlexItem grow={false} data-test-subj={getTestId('cmdInput-prompt')}>
                     <span className="eui-displayInlineBlock prompt">{prompt}</span>
@@ -285,22 +273,10 @@ export const CommandInput = memo<CommandInputProps>(({ prompt = '', focusRef, ..
                     onChangeFocus={handleOnChangeFocus}
                     focusRef={focusRef}
                   >
-                    <EuiFlexGroup
-                      responsive={false}
-                      alignItems="center"
-                      gutterSize="none"
-                      className="inputDisplay"
-                    >
-                      <EuiFlexItem grow={false} data-test-subj={getTestId('cmdInput-leftOfCursor')}>
-                        {userInput.getLeftOfCursorRenderingContent()}
-                      </EuiFlexItem>
-                      <EuiFlexItem grow={false}>
-                        <span className="cursor essentialAnimation" />
-                      </EuiFlexItem>
-                      <EuiFlexItem data-test-subj={getTestId('cmdInput-rightOfCursor')}>
-                        {userInput.getRightOfCursorRenderingContent()}
-                      </EuiFlexItem>
-                    </EuiFlexGroup>
+                    <InputDisplay
+                      leftOfCursor={userInput.getLeftOfCursorRenderingContent()}
+                      rightOfCursor={userInput.getRightOfCursorRenderingContent()}
+                    />
                   </InputCapture>
                   <InputPlaceholder />
                 </EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/argument_selector_wrapper.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/argument_selector_wrapper.tsx
index 28a5a082c2903..d2f1bac87f25f 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/argument_selector_wrapper.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/argument_selector_wrapper.tsx
@@ -7,69 +7,39 @@
 
 import React, { memo, useCallback } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import styled, { createGlobalStyle } from 'styled-components';
-import type { EuiTheme } from '@kbn/kibana-react-plugin/common';
+import styled from 'styled-components';
 import { useConsoleStateDispatch } from '../../../hooks/state_selectors/use_console_state_dispatch';
 import { useWithCommandArgumentState } from '../../../hooks/state_selectors/use_with_command_argument_state';
 import type { CommandArgDefinition, CommandArgumentValueSelectorProps } from '../../../types';
 
 const ArgumentSelectorWrapperContainer = styled.span`
+  border: ${({ theme: { eui } }) => eui.euiBorderThin};
+  border-radius: ${({ theme: { eui } }) => eui.euiBorderRadiusSmall};
+  overflow: hidden;
   user-select: none;
 
+  .flexGroup {
+    align-items: stretch;
+  }
+
   .selectorContainer {
+    padding: 0 ${({ theme: { eui } }) => eui.euiSizeXS};
     max-width: 25vw;
     display: flex;
     align-items: center;
     height: 100%;
   }
-`;
-
-// FIXME:PT Delete below. Only here for DEV purposes
-const DevUxStyles = createGlobalStyle<{ theme: EuiTheme }>`
-
-  body {
-
-    &.style1 .argSelectorWrapper {
-      .style1-hide {
-        display: none;
-      }
-
-      .selectorContainer {
-        border: ${({ theme: { eui } }) => eui.euiBorderThin};
-        border-radius: ${({ theme: { eui } }) => eui.euiBorderRadiusSmall};
-        padding: 0 ${({ theme: { eui } }) => eui.euiSizeXS};
-      }
-    }
-
-    &.style2 {
-      .argSelectorWrapper {
-        border: ${({ theme: { eui } }) => eui.euiBorderThin};
-        border-radius: ${({ theme: { eui } }) => eui.euiBorderRadiusSmall};
-        overflow: hidden;
 
-        & > .euiFlexGroup {
-          align-items: stretch;
-        }
-
-        .style2-hide {
-          display: none;
-        }
-
-        .argNameContainer {
-          background-color: ${({ theme: { eui } }) => eui.euiFormInputGroupLabelBackground};
-        }
+  .argNameContainer {
+    background-color: ${({ theme: { eui } }) => eui.euiFormInputGroupLabelBackground};
+  }
 
-        .argName {
-          padding-left: ${({ theme: { eui } }) => eui.euiSizeXS};
-          height: 100%;
-          display: flex;
-          align-items: center;
-        }
-        .selectorContainer {
-          padding: 0 ${({ theme: { eui } }) => eui.euiSizeXS};
-        }
-      }
-    }
+  .argName {
+    padding-left: ${({ theme: { eui } }) => eui.euiSizeXS};
+    height: 100%;
+    display: flex;
+    align-items: center;
+    white-space: nowrap;
   }
 `;
 
@@ -108,17 +78,21 @@ export const ArgumentSelectorWrapper = memo<ArgumentSelectorWrapperProps>(
     );
 
     return (
-      <ArgumentSelectorWrapperContainer className="eui-displayInlineBlock argSelectorWrapper">
-        <EuiFlexGroup responsive={false} alignItems="center" gutterSize="none">
+      <ArgumentSelectorWrapperContainer className="eui-displayInlineBlock">
+        <EuiFlexGroup
+          className="flexGroup"
+          responsive={false}
+          alignItems="center"
+          gutterSize="none"
+        >
           <EuiFlexItem grow={false} className="argNameContainer">
             <div className="argName">
               <span>{`--${argName}=`}</span>
-              <span className="style1-hide style2-hide">{'"'}</span>
             </div>
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
             {/* `div` below ensures that the `SelectorComponent` does NOT inherit the styles of a `flex` container */}
-            <div className="selectorContainer eui-textTruncate">
+            <div className="selectorContainer noThemeOverrides eui-textTruncate">
               <SelectorComponent
                 value={value}
                 valueText={valueText ?? ''}
@@ -129,12 +103,7 @@ export const ArgumentSelectorWrapper = memo<ArgumentSelectorWrapperProps>(
               />
             </div>
           </EuiFlexItem>
-          <EuiFlexItem grow={false} className="style1-hide style2-hide">
-            {'"'}
-          </EuiFlexItem>
         </EuiFlexGroup>
-
-        <DevUxStyles />
       </ArgumentSelectorWrapperContainer>
     );
   }
diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_display.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_display.tsx
new file mode 100644
index 0000000000000..9bc8f71d11c55
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_display.tsx
@@ -0,0 +1,173 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { MouseEventHandler, ReactNode } from 'react';
+import React, { memo, useCallback, useEffect, useRef } from 'react';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import styled from 'styled-components';
+import { useConsoleStateDispatch } from '../../../hooks/state_selectors/use_console_state_dispatch';
+import { useWithInputTextEntered } from '../../../hooks/state_selectors/use_with_input_text_entered';
+import { useTestIdGenerator } from '../../../../../hooks/use_test_id_generator';
+import { useDataTestSubj } from '../../../hooks/state_selectors/use_data_test_subj';
+
+const SCROLLING_PADDING = 20;
+
+const InputDisplayContainer = styled.div`
+  overflow: hidden !important;
+
+  .inputDisplay {
+    & > * {
+      flex-direction: row;
+      align-items: center;
+    }
+  }
+
+  // Styles for when the console's input has focus are defined in '<CommandInput>' component
+  .cursor {
+    display: inline-block;
+    width: 1px;
+    height: ${({ theme: { eui } }) => eui.euiLineHeight}em;
+    background-color: ${({ theme }) => theme.eui.euiTextSubduedColor};
+  }
+`;
+
+export interface InputDisplayProps {
+  leftOfCursor: ReactNode;
+  rightOfCursor: ReactNode;
+}
+
+export const InputDisplay = memo<InputDisplayProps>(({ leftOfCursor, rightOfCursor }) => {
+  const getTestId = useTestIdGenerator(useDataTestSubj());
+  const dispatch = useConsoleStateDispatch();
+  const { leftOfCursorText, fullTextEntered } = useWithInputTextEntered();
+
+  const observer = useRef<IntersectionObserver | null>(null);
+  const containerRef = useRef<HTMLDivElement | null>(null);
+  const cursorRef = useRef<HTMLSpanElement | null>(null);
+
+  const currentCursorPosition = leftOfCursorText.length;
+
+  const handleSingleClick: MouseEventHandler<HTMLDivElement> = useCallback(
+    (ev) => {
+      const clickedTarget = ev.target as HTMLElement;
+
+      // Handle moving the cursor to the click position
+      if (
+        fullTextEntered.length &&
+        clickedTarget.classList &&
+        clickedTarget.classList.contains('chr')
+      ) {
+        const allInputChars = Array.from(ev.currentTarget.querySelectorAll('span.chr'));
+        const newCursorPosition = allInputChars.indexOf(clickedTarget);
+        const newLeftOfCursorText = fullTextEntered.substring(0, newCursorPosition + 1);
+        const newRightOfCursorText = fullTextEntered.substring(newCursorPosition + 1);
+
+        // reset input
+        dispatch({
+          type: 'updateInputTextEnteredState',
+          payload: {
+            leftOfCursorText: newLeftOfCursorText,
+            rightOfCursorText: newRightOfCursorText,
+          },
+        });
+      }
+    },
+    [dispatch, fullTextEntered]
+  );
+
+  // Setup the Intersection observer
+  useEffect(() => {
+    if (containerRef.current) {
+      const handleIntersection: IntersectionObserverCallback = (entries) => {
+        if (containerRef.current) {
+          const intersection = entries[0];
+
+          if (intersection && intersection.rootBounds) {
+            const currentScrollLeftValue = containerRef.current.scrollLeft;
+            const viewportRightEdge = intersection.rootBounds.right;
+            const viewportLeftEdge = intersection.rootBounds.left;
+            const cursorPosition = intersection.boundingClientRect.right;
+
+            if (cursorPosition > viewportRightEdge - SCROLLING_PADDING) {
+              // cursor is close to the Right Edge of the display input area.
+              // scroll right so that cursor remains visible.
+              const newScrollLeftValue =
+                currentScrollLeftValue +
+                (cursorPosition - intersection.rootBounds.width) +
+                SCROLLING_PADDING;
+
+              containerRef.current.scrollLeft = newScrollLeftValue;
+            } else if (cursorPosition < viewportLeftEdge + SCROLLING_PADDING) {
+              // cursor is close to the Left edge of the display input area.
+              // scroll left so that cursor remains visible;
+              const newScrollLeftValue =
+                cursorPosition - SCROLLING_PADDING < 0
+                  ? 0
+                  : currentScrollLeftValue - SCROLLING_PADDING;
+
+              containerRef.current.scrollLeft = newScrollLeftValue;
+            }
+          }
+        }
+      };
+
+      observer.current = new IntersectionObserver(handleIntersection, {
+        root: containerRef.current,
+        // The `-10px` ensure that the observer is triggered when the cursor is within
+        // 10px of the edge of the viewport (the scrolling container).
+        rootMargin: '0px -10px',
+        threshold: 0,
+      });
+
+      return () => {
+        observer.current?.disconnect();
+        observer.current = null;
+      };
+    }
+  }, []);
+
+  // Anytime the cursor position changes, re-observe the movement of the cursor.
+  useEffect(() => {
+    if (observer.current && cursorRef.current) {
+      const intersectionObserver = observer.current;
+      const cursorEle = cursorRef.current;
+
+      intersectionObserver.observe(cursorEle);
+
+      return () => {
+        intersectionObserver.unobserve(cursorEle);
+      };
+    }
+  }, [currentCursorPosition]);
+
+  return (
+    <InputDisplayContainer ref={containerRef}>
+      <EuiFlexGroup
+        responsive={false}
+        alignItems="center"
+        gutterSize="none"
+        className="inputDisplay"
+        onClick={handleSingleClick}
+      >
+        <EuiFlexItem
+          grow={false}
+          data-test-subj={getTestId('cmdInput-leftOfCursor')}
+          className="noMinWidth"
+        >
+          {leftOfCursor}
+        </EuiFlexItem>
+        <EuiFlexItem grow={false} className="noMinWidth">
+          <span className="cursor essentialAnimation" ref={cursorRef} />
+        </EuiFlexItem>
+        <EuiFlexItem className="noMinWidth" data-test-subj={getTestId('cmdInput-rightOfCursor')}>
+          {rightOfCursor}
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </InputDisplayContainer>
+  );
+});
+InputDisplay.displayName = 'InputDisplay';
diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_placeholder.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_placeholder.tsx
index f0dde8fb95670..046c913f80914 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_placeholder.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_placeholder.tsx
@@ -20,9 +20,6 @@ const InputPlaceholderContainer = styled(EuiText)`
   width: 96%;
   color: ${({ theme: { eui } }) => eui.euiFormControlPlaceholderText};
   user-select: none;
-  line-height: ${({ theme: { eui } }) => {
-    return `calc(${eui.euiLineHeight}em + 0.5em)`;
-  }};
 `;
 
 export const InputPlaceholder = memo(() => {
diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/integration_tests/command_input.test.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/integration_tests/command_input.test.tsx
index 028c4874c1cd6..af9435ecb6cb5 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/integration_tests/command_input.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/integration_tests/command_input.test.tsx
@@ -40,6 +40,10 @@ describe('When entering data into the Console input', () => {
     return renderResult.getByTestId('test-cmdInput-leftOfCursor').textContent;
   };
 
+  const getRightOfCursorText = () => {
+    return renderResult.getByTestId('test-cmdInput-rightOfCursor').textContent;
+  };
+
   const getFooterText = () => {
     return renderResult.getByTestId('test-footer').textContent;
   };
@@ -266,10 +270,6 @@ describe('When entering data into the Console input', () => {
   });
 
   describe('and keyboard special keys are pressed', () => {
-    const getRightOfCursorText = () => {
-      return renderResult.getByTestId('test-cmdInput-rightOfCursor').textContent;
-    };
-
     const selectLeftOfCursorText = () => {
       // Select text to the left of the cursor
       const selection = window.getSelection();
@@ -469,7 +469,23 @@ describe('When entering data into the Console input', () => {
       render();
       enterCommand('cmd7 --foo', { inputOnly: true });
 
-      expect(getLeftOfCursorText()).toEqual('cmd7 --foo="foo[0]: foo selected"');
+      expect(getLeftOfCursorText()).toEqual('cmd7 --foo=foo[0]: foo selected');
+    });
+
+    it('should not insert Selector component if argument name is not a whole word', async () => {
+      render();
+      enterCommand('cmd7 --foobar', { inputOnly: true });
+
+      expect(getLeftOfCursorText()).toEqual('cmd7 --foobar');
+    });
+
+    it('should not insert Selector component if argument name is not a whole word while cursor is between the argument name', async () => {
+      render();
+      enterCommand('cmd7 --fooX', { inputOnly: true });
+      typeKeyboardKey('{ArrowLeft}');
+
+      expect(getLeftOfCursorText()).toEqual('cmd7 --foo');
+      expect(getRightOfCursorText()).toEqual('X');
     });
 
     it('should support using argument multiple times (allowMultiples: true)', async () => {
@@ -477,7 +493,7 @@ describe('When entering data into the Console input', () => {
       enterCommand('cmd7 --foo --foo', { inputOnly: true });
 
       expect(getLeftOfCursorText()).toEqual(
-        'cmd7 --foo="foo[0]: foo selected" --foo="foo[1]: foo selected"'
+        'cmd7 --foo=foo[0]: foo selected --foo=foo[1]: foo selected'
       );
     });
 
diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.tsx
index f6a1b67233355..8ad10f921cea5 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.tsx
@@ -21,6 +21,8 @@ interface InputCharacter {
   argState: undefined | ArgSelectorState;
 }
 
+const ARGUMENT_NAME_VALUE_SEPARATORS: readonly string[] = ['', ' ', '='];
+
 const createInputCharacter = (overrides: Partial<InputCharacter> = {}): InputCharacter => {
   return {
     value: '',
@@ -42,8 +44,12 @@ const getInputCharacters = (input: string): InputCharacter[] => {
   });
 };
 
-const toReactJsxFragment = (prefix: string, item: InputCharacter, index: number) => {
-  return <span key={`${prefix}.${index}.${item.value ?? '$'}`}>{item.renderValue}</span>;
+const toValueDisplayElement = (prefix: string, item: InputCharacter, index: number) => {
+  return (
+    <span className="chr" key={`${prefix}.${index}.${item.value ?? '$'}`}>
+      {item.renderValue}
+    </span>
+  );
 };
 
 const toInputCharacterDisplayString = (
@@ -87,10 +93,12 @@ export class EnteredInput {
         {
           input: leftOfCursorText,
           items: this.leftOfCursorContent,
+          side: 'left',
         },
         {
           input: rightOfCursorText,
           items: this.rightOfCursorContent,
+          side: 'right',
         },
       ];
 
@@ -100,36 +108,55 @@ export class EnteredInput {
           let argIndex = 0;
 
           // Loop through the input pieces (left and right side of cursor) looking for the Argument name
-          for (const { input, items } of inputPieces) {
+          for (const { input, items, side } of inputPieces) {
             const argNameMatch = `--${argName}`;
             let pos = input.indexOf(argNameMatch);
 
             while (pos > -1) {
               const argChrLength = argNameMatch.length;
-              const replaceValues: InputCharacter[] = Array.from(
-                { length: argChrLength },
-                createInputCharacter
-              );
-              const argState = enteredCommand.argState[argName]?.at(argIndex);
-
-              replaceValues[0] = createInputCharacter({
-                value: argNameMatch,
-                renderValue: (
-                  <ArgumentSelectorWrapper
-                    argName={argName}
-                    argIndex={argIndex}
-                    argDefinition={argDef as ArgumentSelectorWrapperProps['argDefinition']}
-                  />
-                ),
-                isArgSelector: true,
-                argName,
-                argIndex: argIndex++,
-                argState,
-              });
-
-              items.splice(pos, argChrLength, ...replaceValues);
-
-              pos = input.indexOf(argNameMatch, pos + argChrLength);
+              const startSearchIndexForNextArg = pos + argChrLength;
+              const charAfterArgName = input.charAt(startSearchIndexForNextArg);
+              const argNameMatchesAsWholeWord =
+                side === 'left' &&
+                charAfterArgName === '' &&
+                // if cursor is at the end of the argument name on the left side of the cursor,
+                // then we check to ensure that the first character of the Right side of the
+                // cursor is one of the separators. Example (| === cursor): `--file|s`
+                ARGUMENT_NAME_VALUE_SEPARATORS.includes(rightOfCursorText.charAt(0));
+
+              // We need to Ensure that the argument name is not part of a longer word
+              // (example: matches `--file` not `--files`)
+              if (
+                ARGUMENT_NAME_VALUE_SEPARATORS.includes(charAfterArgName) &&
+                (argNameMatchesAsWholeWord ||
+                  (side === 'left' && charAfterArgName !== '') ||
+                  side === 'right')
+              ) {
+                const replaceValues: InputCharacter[] = Array.from(
+                  { length: argChrLength },
+                  createInputCharacter
+                );
+                const argState = enteredCommand.argState[argName]?.at(argIndex);
+
+                replaceValues[0] = createInputCharacter({
+                  value: argNameMatch,
+                  renderValue: (
+                    <ArgumentSelectorWrapper
+                      argName={argName}
+                      argIndex={argIndex}
+                      argDefinition={argDef as ArgumentSelectorWrapperProps['argDefinition']}
+                    />
+                  ),
+                  isArgSelector: true,
+                  argName,
+                  argIndex: argIndex++,
+                  argState,
+                });
+
+                items.splice(pos, argChrLength, ...replaceValues);
+              }
+
+              pos = input.indexOf(argNameMatch, startSearchIndexForNextArg);
             }
           }
         }
@@ -212,11 +239,11 @@ export class EnteredInput {
   }
 
   getLeftOfCursorRenderingContent(): ReactNode {
-    return <>{this.leftOfCursorContent.map(toReactJsxFragment.bind(null, 'left'))}</>;
+    return <>{this.leftOfCursorContent.map(toValueDisplayElement.bind(null, 'left'))}</>;
   }
 
   getRightOfCursorRenderingContent(): ReactNode {
-    return <>{this.rightOfCursorContent.map(toReactJsxFragment.bind(null, 'right'))}</>;
+    return <>{this.rightOfCursorContent.map(toValueDisplayElement.bind(null, 'right'))}</>;
   }
 
   getArgState(): undefined | EnteredCommand['argState'] {
diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/console_header.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/console_header.tsx
index 84f227f25334b..4a88c525d6f2e 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/components/console_header.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/components/console_header.tsx
@@ -44,7 +44,7 @@ export const ConsoleHeader = memo<ConsoleHeaderProps>(({ TitleComponent }) => {
       justifyContent="spaceBetween"
       responsive={false}
     >
-      <EuiFlexItem grow={1} className="eui-textTruncate">
+      <EuiFlexItem grow={1} className="eui-textTruncate noThemeOverrides">
         {TitleComponent ? <TitleComponent /> : ''}
       </EuiFlexItem>
       {!isHelpOpen && (
diff --git a/x-pack/plugins/security_solution/public/management/components/console/console.tsx b/x-pack/plugins/security_solution/public/management/components/console/console.tsx
index f1736011ae23e..97f6b7ed85df9 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/console.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/console.tsx
@@ -27,7 +27,10 @@ const ConsoleWindow = styled.div`
 
   .layout {
     height: 100%;
+    width: 100%;
     min-height: 300px;
+    min-width: 300px;
+    overflow: hidden;
 
     &-hideOverflow {
       overflow: hidden;
@@ -75,6 +78,16 @@ const ConsoleWindow = styled.div`
       height: 100%;
       overflow-x: hidden;
     }
+
+    // min-width setting is needed for flex items to ensure that overflow works as expected
+    // in the Input area and not cause the entire UI to expand beyond the overall width of
+    // the console. @see https://css-tricks.com/flexbox-truncated-text
+    // To prevent this from being applied to an individual flex item, use the classname of
+    // 'noMinWidth'. For areas of the Console that render components external to the Console,
+    // use className 'noThemeOverrides' to prevent this from impacting those components/
+    .euiFlexItem:not(.noMinWidth):not(.noThemeOverrides .euiFlexItem) {
+      min-width: 0;
+    }
   }
 
   //-----------------------------------------------------------
diff --git a/x-pack/plugins/security_solution/public/management/components/console/mocks.tsx b/x-pack/plugins/security_solution/public/management/components/console/mocks.tsx
index b50e5ff108512..4dc5d2050450a 100644
--- a/x-pack/plugins/security_solution/public/management/components/console/mocks.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/console/mocks.tsx
@@ -13,10 +13,10 @@ import userEvent from '@testing-library/user-event';
 import { act } from '@testing-library/react';
 import { Console } from './console';
 import type {
-  ConsoleProps,
+  CommandArgumentValueSelectorProps,
   CommandDefinition,
   CommandExecutionComponent,
-  CommandArgumentValueSelectorProps,
+  ConsoleProps,
 } from './types';
 import type { AppContextTestRender } from '../../../common/mock/endpoint';
 import { createAppRootMockRenderer } from '../../../common/mock/endpoint';
diff --git a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts
index 1c57fb6401ec6..f58cf1455ee05 100644
--- a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts
+++ b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts
@@ -7,7 +7,6 @@
 
 import { i18n } from '@kbn/i18n';
 import type { ParsedArgData } from '../../console/service/types';
-import { getUploadCommand } from './dev_only';
 import { ExperimentalFeaturesService } from '../../../../common/experimental_features_service';
 import type {
   EndpointCapabilities,
@@ -371,14 +370,6 @@ export const getEndpointConsoleCommands = ({
     },
   ];
 
-  // FIXME: DELETE PRIOR TO MERGE
-  // for dev purposes only - command only shown if url has `show_upload=`
-  if (location.search.includes('show_upload=')) {
-    consoleCommands.push(
-      getUploadCommand({ endpointAgentId, endpointPrivileges, endpointCapabilities })
-    );
-  }
-
   // `get-file` is currently behind feature flag
   if (isGetFileEnabled) {
     consoleCommands.push({
diff --git a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/dev_only.tsx b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/dev_only.tsx
deleted file mode 100644
index 6ec6cdf801092..0000000000000
--- a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/dev_only.tsx
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable @typescript-eslint/no-explicit-any */
-
-import React, { memo, useEffect } from 'react';
-import type { CommandArgumentValueSelectorProps } from '../../console/types';
-import type { CommandDefinition } from '../../console';
-import { ArgumentFileSelector } from '../../console_argument_selectors';
-
-// FOR DEV PURPOSES ONLY. WILL BE DELETED PRIOR TO MERGE
-// FIXME:PT DELETE FILE
-export const getUploadCommand = ({
-  endpointAgentId,
-  endpointPrivileges,
-  endpointCapabilities,
-}: {
-  endpointAgentId: string;
-  endpointCapabilities: any;
-  endpointPrivileges: any;
-}): CommandDefinition => {
-  return {
-    name: 'upload',
-    about: 'Upload and execute a file on host machine',
-    RenderComponent: (props) => {
-      window.console.log(`upload command rendering...`);
-      window.console.log(props);
-
-      return (
-        <div>
-          <div>{`ExecuteFileAction DEV MOCK`}</div>
-          <div>
-            <strong>{`File Selected: ${props.command.args.args.file[0].name}`}</strong>
-          </div>
-        </div>
-      );
-    },
-    meta: {
-      endpointId: endpointAgentId,
-      capabilities: endpointCapabilities,
-      privileges: endpointPrivileges,
-    },
-    exampleUsage: 'some example goes here',
-    exampleInstruction: 'some instructions here',
-    args: {
-      file: {
-        about: 'Select the file that should be uploaded and executed',
-        required: true,
-        allowMultiples: false,
-        mustHaveValue: true,
-        validate: () => {
-          // FIXME:PT Validate File was selected
-          return true;
-        },
-        SelectorComponent: ArgumentFileSelector,
-      },
-
-      n: {
-        required: false,
-        allowMultiples: true,
-        mustHaveValue: 'number-greater-than-zero',
-        about: 'just a number greater than zero',
-      },
-
-      nn: {
-        required: false,
-        allowMultiples: true,
-        mustHaveValue: 'number',
-        about: 'just a number',
-      },
-
-      mock: {
-        required: false,
-        allowMultiples: false,
-        about: 'using a selector',
-        SelectorComponent: ArgumentSelectorComponentTest,
-      },
-
-      comment: {
-        required: false,
-        allowMultiples: false,
-        mustHaveValue: 'non-empty-string',
-        about: 'A comment',
-      },
-    },
-    helpGroupLabel: 'DEV',
-    helpGroupPosition: 0,
-    helpCommandPosition: 0,
-  };
-};
-
-const ArgumentSelectorComponentTest = memo<
-  CommandArgumentValueSelectorProps<{ selection: string }>
->(({ value, valueText, onChange, argIndex, argName }) => {
-  useEffect(() => {
-    if (!value) {
-      onChange({ valueText: 'foo selected', value: { selection: 'foo' } });
-    }
-  }, [onChange, value]);
-
-  return (
-    <span data-test-subj="argSelectorValueText">{`${argName}[${argIndex}]: ${valueText}`}</span>
-  );
-});
-ArgumentSelectorComponentTest.displayName = 'ArgumentSelectorComponentTest';
-
-document.body.classList.add('style2');

From 315fdfc8fa97641ab4fcd78ed57e7e5ed8198699 Mon Sep 17 00:00:00 2001
From: Walter Rafelsberger <walter.rafelsberger@elastic.co>
Date: Tue, 7 Feb 2023 18:30:34 +0100
Subject: [PATCH 086/134] [ML] Transforms: Health status information in
 transform list. (#150359)

Adds health status information to the transform list.
---
 x-pack/plugins/transform/common/constants.ts  | 53 +++++++++++++++++--
 .../transform/common/types/transform_stats.ts | 11 +++-
 .../transform_list/expanded_row.tsx           | 15 +++++-
 .../transform_health_colored_dot.tsx          | 31 +++++++++++
 .../transform_search_bar_filters.tsx          | 29 +++++++++-
 .../transform_task_state_badge.tsx            | 49 +++++++++++++++++
 .../transform_list/use_columns.test.tsx       |  5 +-
 .../components/transform_list/use_columns.tsx | 49 +++++------------
 8 files changed, 196 insertions(+), 46 deletions(-)
 create mode 100644 x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_health_colored_dot.tsx
 create mode 100644 x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_task_state_badge.tsx

diff --git a/x-pack/plugins/transform/common/constants.ts b/x-pack/plugins/transform/common/constants.ts
index 7366793336f73..dceda770827c7 100644
--- a/x-pack/plugins/transform/common/constants.ts
+++ b/x-pack/plugins/transform/common/constants.ts
@@ -95,16 +95,61 @@ export const TRANSFORM_STATE = {
   WAITING: 'waiting',
 } as const;
 
-const transformStates = Object.values(TRANSFORM_STATE);
-export type TransformState = typeof transformStates[number];
+export type TransformState = typeof TRANSFORM_STATE[keyof typeof TRANSFORM_STATE];
+
+export const TRANSFORM_HEALTH = {
+  GREEN: 'green',
+  UNKNOWN: 'unknown',
+  YELLOW: 'yellow',
+  RED: 'red',
+} as const;
+
+export type TransformHealth = typeof TRANSFORM_HEALTH[keyof typeof TRANSFORM_HEALTH];
+
+export const TRANSFORM_HEALTH_COLOR = {
+  green: 'success',
+  unknown: 'subdued',
+  yellow: 'warning',
+  red: 'danger',
+} as const;
+
+export const TRANSFORM_HEALTH_LABEL = {
+  green: i18n.translate('xpack.transform.transformHealth.greenLabel', {
+    defaultMessage: 'Healthy',
+  }),
+  unknown: i18n.translate('xpack.transform.transformHealth.unknownLabel', {
+    defaultMessage: 'Unknown',
+  }),
+  yellow: i18n.translate('xpack.transform.transformHealth.yellowLabel', {
+    defaultMessage: 'Degraded',
+  }),
+  red: i18n.translate('xpack.transform.transformHealth.redLabel', {
+    defaultMessage: 'Outage',
+  }),
+} as const;
+
+export const TRANSFORM_HEALTH_DESCRIPTION = {
+  green: i18n.translate('xpack.transform.transformHealth.greenDescription', {
+    defaultMessage: 'The transform is healthy.',
+  }),
+  unknown: i18n.translate('xpack.transform.transformHealth.unknownDescription', {
+    defaultMessage: 'The health of the transform could not be determined.',
+  }),
+  yellow: i18n.translate('xpack.transform.transformHealth.yellowDescription', {
+    defaultMessage:
+      'The functionality of the transform is in a degraded state and may need remediation to avoid the health becoming red.',
+  }),
+  red: i18n.translate('xpack.transform.transformHealth.redDescription', {
+    defaultMessage: 'The transform is experiencing an outage or is unavailable for use.',
+  }),
+} as const;
 
 export const TRANSFORM_MODE = {
   BATCH: 'batch',
   CONTINUOUS: 'continuous',
 } as const;
 
-const transformModes = Object.values(TRANSFORM_MODE);
-export type TransformMode = typeof transformModes[number];
+export type TransformMode = typeof TRANSFORM_MODE[keyof typeof TRANSFORM_MODE];
 
 export const TRANSFORM_FUNCTION = {
   PIVOT: 'pivot',
diff --git a/x-pack/plugins/transform/common/types/transform_stats.ts b/x-pack/plugins/transform/common/types/transform_stats.ts
index 2f9319201fd6b..17e5f5a3fa936 100644
--- a/x-pack/plugins/transform/common/types/transform_stats.ts
+++ b/x-pack/plugins/transform/common/types/transform_stats.ts
@@ -7,7 +7,7 @@
 
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 
-import { TransformState, TRANSFORM_STATE } from '../constants';
+import { type TransformHealth, type TransformState, TRANSFORM_STATE } from '../constants';
 import { TransformId } from './transform';
 
 export interface TransformStats {
@@ -27,6 +27,15 @@ export interface TransformStats {
     };
     operations_behind: number;
   };
+  health: {
+    status: TransformHealth;
+    issues?: Array<{
+      issue: string;
+      details?: string;
+      count: number;
+      first_occurrence?: number;
+    }>;
+  };
   node?: {
     id: string;
     name: string;
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.tsx
index 6f1d219ce7928..314162e9b3ea1 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/expanded_row.tsx
@@ -6,21 +6,26 @@
  */
 
 import React, { FC, useMemo } from 'react';
+import moment from 'moment-timezone';
 
 import { EuiButtonEmpty, EuiTabbedContent } from '@elastic/eui';
+
 import { Optional } from '@kbn/utility-types';
 import { i18n } from '@kbn/i18n';
 import { stringHash } from '@kbn/ml-string-hash';
 
-import moment from 'moment-timezone';
 import { isDefined } from '@kbn/ml-is-defined';
+
+import { TransformHealthAlertRule } from '../../../../../../common/types/alerting';
+
 import { TransformListRow } from '../../../../common';
 import { useAppDependencies } from '../../../../app_dependencies';
+
 import { ExpandedRowDetailsPane, SectionConfig, SectionItem } from './expanded_row_details_pane';
 import { ExpandedRowJsonPane } from './expanded_row_json_pane';
 import { ExpandedRowMessagesPane } from './expanded_row_messages_pane';
 import { ExpandedRowPreviewPane } from './expanded_row_preview_pane';
-import { TransformHealthAlertRule } from '../../../../../../common/types/alerting';
+import { TransformHealthColoredDot } from './transform_health_colored_dot';
 
 function getItemDescription(value: any) {
   if (typeof value === 'object') {
@@ -64,6 +69,12 @@ export const ExpandedRow: FC<Props> = ({ item, onAlertEdit }) => {
       description: item.stats.node.name,
     });
   }
+  if (item.stats.health !== undefined) {
+    stateItems.push({
+      title: 'health',
+      description: <TransformHealthColoredDot healthStatus={item.stats.health.status} />,
+    });
+  }
 
   const state: SectionConfig = {
     title: 'State',
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_health_colored_dot.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_health_colored_dot.tsx
new file mode 100644
index 0000000000000..2bb3a9c22654d
--- /dev/null
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_health_colored_dot.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { type FC } from 'react';
+
+import { EuiHealth, EuiToolTip } from '@elastic/eui';
+
+import {
+  type TransformHealth,
+  TRANSFORM_HEALTH_COLOR,
+  TRANSFORM_HEALTH_DESCRIPTION,
+  TRANSFORM_HEALTH_LABEL,
+} from '../../../../../../common/constants';
+
+interface TransformHealthProps {
+  healthStatus: TransformHealth;
+}
+
+export const TransformHealthColoredDot: FC<TransformHealthProps> = ({ healthStatus }) => {
+  return (
+    <EuiToolTip content={TRANSFORM_HEALTH_DESCRIPTION[healthStatus]}>
+      <EuiHealth color={TRANSFORM_HEALTH_COLOR[healthStatus]}>
+        <small>{TRANSFORM_HEALTH_LABEL[healthStatus]}</small>
+      </EuiHealth>
+    </EuiToolTip>
+  );
+};
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_search_bar_filters.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_search_bar_filters.tsx
index 67a32f1abfe1d..cad987a621d7b 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_search_bar_filters.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_search_bar_filters.tsx
@@ -13,10 +13,13 @@ import {
   TRANSFORM_FUNCTION,
   TRANSFORM_MODE,
   TRANSFORM_STATE,
+  TRANSFORM_HEALTH,
+  TRANSFORM_HEALTH_COLOR,
+  TRANSFORM_HEALTH_LABEL,
 } from '../../../../../../common/constants';
 import { isLatestTransform, isPivotTransform } from '../../../../../../common/types/transform';
 import { TransformListRow } from '../../../../common';
-import { getTaskStateBadge } from './use_columns';
+import { TransformTaskStateBadge } from './transform_task_state_badge';
 
 export const transformFilters: SearchFilterConfig[] = [
   {
@@ -27,7 +30,7 @@ export const transformFilters: SearchFilterConfig[] = [
     options: Object.values(TRANSFORM_STATE).map((val) => ({
       value: val,
       name: val,
-      view: getTaskStateBadge(val),
+      view: <TransformTaskStateBadge state={val} />,
     })),
   },
   {
@@ -45,6 +48,25 @@ export const transformFilters: SearchFilterConfig[] = [
       ),
     })),
   },
+  {
+    type: 'field_value_selection',
+    field: 'health',
+    name: i18n.translate('xpack.transform.healthFilter', { defaultMessage: 'Health' }),
+    multiSelect: false,
+    options: Object.values(TRANSFORM_HEALTH).map((val) => ({
+      value: val,
+      name: val,
+      view: (
+        <EuiBadge
+          className="transform__TaskHealthBadge"
+          // For the color icon 'subdued' is used but for the badge we need 'hollow' instead.
+          color={TRANSFORM_HEALTH_COLOR[val] === 'subdued' ? 'hollow' : TRANSFORM_HEALTH_COLOR[val]}
+        >
+          {TRANSFORM_HEALTH_LABEL[val]}
+        </EuiBadge>
+      ),
+    })),
+  },
 ];
 
 function stringMatch(str: string | undefined, substr: any) {
@@ -96,6 +118,9 @@ export const filterTransforms = (transforms: TransformListRow[], clauses: Clause
         ts = transforms.filter((transform) => (c.value as Value[]).includes(transform.stats.state));
       } else {
         ts = transforms.filter((transform) => {
+          if (c.type === 'field' && c.field === 'health') {
+            return transform.stats.health?.status === c.value;
+          }
           if (c.type === 'field' && c.field === 'mode') {
             return transform.mode === c.value;
           }
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_task_state_badge.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_task_state_badge.tsx
new file mode 100644
index 0000000000000..b8510496b8b96
--- /dev/null
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_task_state_badge.tsx
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { type FC } from 'react';
+
+import { EuiBadge, EuiToolTip } from '@elastic/eui';
+
+import { TransformStats } from '../../../../../../common/types/transform_stats';
+import { TRANSFORM_STATE } from '../../../../../../common/constants';
+
+// reflects https://github.com/elastic/elasticsearch/blob/master/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/transforms/TransformStats.java#L250
+const STATE_COLOR = {
+  aborting: 'warning',
+  failed: 'danger',
+  indexing: 'primary',
+  started: 'primary',
+  stopped: 'hollow',
+  stopping: 'hollow',
+  waiting: 'hollow',
+} as const;
+
+interface TransformTaskStateBadgeProps {
+  state: TransformStats['state'];
+  reason?: TransformStats['reason'];
+}
+
+export const TransformTaskStateBadge: FC<TransformTaskStateBadgeProps> = ({ state, reason }) => {
+  const color = STATE_COLOR[state];
+
+  if (state === TRANSFORM_STATE.FAILED && reason !== undefined) {
+    return (
+      <EuiToolTip content={reason}>
+        <EuiBadge className="transform__TaskStateBadge" color={color}>
+          {state}
+        </EuiBadge>
+      </EuiToolTip>
+    );
+  }
+
+  return (
+    <EuiBadge className="transform__TaskStateBadge" color={color}>
+      {state}
+    </EuiBadge>
+  );
+};
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.test.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.test.tsx
index 82d1a7091b8a5..521bd745e8692 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.test.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.test.tsx
@@ -20,7 +20,7 @@ describe('Transform: Job List Columns', () => {
 
     const columns: ReturnType<typeof useColumns>['columns'] = result.current.columns;
 
-    expect(columns).toHaveLength(9);
+    expect(columns).toHaveLength(10);
     expect(columns[0].isExpander).toBeTruthy();
     expect(columns[1].name).toBe('ID');
     expect(columns[2].id).toBe('alertRule');
@@ -29,6 +29,7 @@ describe('Transform: Job List Columns', () => {
     expect(columns[5].name).toBe('Status');
     expect(columns[6].name).toBe('Mode');
     expect(columns[7].name).toBe('Progress');
-    expect(columns[8].name).toBe('Actions');
+    expect(columns[8].name).toBe('Health');
+    expect(columns[9].name).toBe('Actions');
   });
 });
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.tsx
index 5ac8e6597e740..cf3ffa98b0334 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/use_columns.tsx
@@ -29,46 +29,14 @@ import {
   isPivotTransform,
   TransformId,
 } from '../../../../../../common/types/transform';
-import { TransformStats } from '../../../../../../common/types/transform_stats';
 import { TRANSFORM_STATE } from '../../../../../../common/constants';
 
 import { getTransformProgress, TransformListRow, TRANSFORM_LIST_COLUMN } from '../../../../common';
 import { useActions } from './use_actions';
 import { isManagedTransform } from '../../../../common/managed_transforms_utils';
 
-// reflects https://github.com/elastic/elasticsearch/blob/master/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/transforms/TransformStats.java#L250
-const STATE_COLOR = {
-  aborting: 'warning',
-  failed: 'danger',
-  indexing: 'primary',
-  started: 'primary',
-  stopped: 'hollow',
-  stopping: 'hollow',
-  waiting: 'hollow',
-} as const;
-
-export const getTaskStateBadge = (
-  state: TransformStats['state'],
-  reason?: TransformStats['reason']
-) => {
-  const color = STATE_COLOR[state];
-
-  if (state === TRANSFORM_STATE.FAILED && reason !== undefined) {
-    return (
-      <EuiToolTip content={reason}>
-        <EuiBadge className="transform__TaskStateBadge" color={color}>
-          {state}
-        </EuiBadge>
-      </EuiToolTip>
-    );
-  }
-
-  return (
-    <EuiBadge className="transform__TaskStateBadge" color={color}>
-      {state}
-    </EuiBadge>
-  );
-};
+import { TransformHealthColoredDot } from './transform_health_colored_dot';
+import { TransformTaskStateBadge } from './transform_task_state_badge';
 
 export const useColumns = (
   expandedRowItemIds: TransformId[],
@@ -103,6 +71,7 @@ export const useColumns = (
     EuiTableComputedColumnType<TransformListRow>,
     EuiTableComputedColumnType<TransformListRow>,
     EuiTableComputedColumnType<TransformListRow>,
+    EuiTableComputedColumnType<TransformListRow>,
     EuiTableActionsColumnType<TransformListRow>
   ] = [
     {
@@ -233,7 +202,7 @@ export const useColumns = (
       sortable: (item: TransformListRow) => item.stats.state,
       truncateText: true,
       render(item: TransformListRow) {
-        return getTaskStateBadge(item.stats.state, item.stats.reason);
+        return <TransformTaskStateBadge state={item.stats.state} reason={item.stats.reason} />;
       },
       width: '100px',
     },
@@ -309,6 +278,16 @@ export const useColumns = (
       },
       width: '100px',
     },
+    {
+      name: i18n.translate('xpack.transform.health', { defaultMessage: 'Health' }),
+      'data-test-subj': 'transformListColumnHealth',
+      sortable: (item: TransformListRow) => item.stats.health.status,
+      truncateText: true,
+      render(item: TransformListRow) {
+        return <TransformHealthColoredDot healthStatus={item.stats.health.status} />;
+      },
+      width: '100px',
+    },
     {
       name: i18n.translate('xpack.transform.tableActionLabel', { defaultMessage: 'Actions' }),
       actions: actions as EuiTableActionsColumnType<TransformListRow>['actions'],

From 3200cd45c7624475fee615753c27cef13a0368b7 Mon Sep 17 00:00:00 2001
From: Catherine Liu <catherine.liu@elastic.co>
Date: Tue, 7 Feb 2023 09:40:36 -0800
Subject: [PATCH 087/134] [Dashboard] Retain maximized panel  on link/unlink
 from library (#150405)

## Summary

Follow up to #150338.
Closes #150460.

This updates the expanded panel to the newly generated ID when
linking/unlinking a panel from the library to keep the panel maximized.



https://user-images.githubusercontent.com/1697105/217161308-3f953f6e-7a1b-4baa-a243-f9636f04a81d.mp4

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
---
 .../add_to_library_action.tsx                 |  6 ++++--
 .../unlink_from_library_action.tsx            |  5 +++--
 .../embeddable/api/panel_management.ts        | 21 ++++++++++++-------
 3 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx b/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx
index 1431c7fc61ed2..3974c4f713efb 100644
--- a/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx
+++ b/src/plugins/dashboard/public/dashboard_actions/add_to_library_action.tsx
@@ -92,14 +92,16 @@ export class AddToLibraryAction implements Action<AddToLibraryActionContext> {
       type: embeddable.type,
       explicitInput: { ...newInput },
     };
-    dashboard.replacePanel(panelToReplace, newPanel, true);
+    const replacedPanelId = await dashboard.replacePanel(panelToReplace, newPanel, true);
 
     const title = dashboardAddToLibraryActionStrings.getSuccessMessage(
       embeddable.getTitle() ? `'${embeddable.getTitle()}'` : ''
     );
+
     if (dashboard.getExpandedPanelId() !== undefined) {
-      dashboard.setExpandedPanelId(undefined);
+      dashboard.setExpandedPanelId(replacedPanelId);
     }
+
     this.toastsService.addSuccess({
       title,
       'data-test-subj': 'addPanelToLibrarySuccess',
diff --git a/src/plugins/dashboard/public/dashboard_actions/unlink_from_library_action.tsx b/src/plugins/dashboard/public/dashboard_actions/unlink_from_library_action.tsx
index 6be0001c62b59..8980ded00871d 100644
--- a/src/plugins/dashboard/public/dashboard_actions/unlink_from_library_action.tsx
+++ b/src/plugins/dashboard/public/dashboard_actions/unlink_from_library_action.tsx
@@ -86,13 +86,14 @@ export class UnlinkFromLibraryAction implements Action<UnlinkFromLibraryActionCo
       type: embeddable.type,
       explicitInput: { ...newInput, title: embeddable.getTitle() },
     };
-    dashboard.replacePanel(panelToReplace, newPanel, true);
+    const replacedPanelId = await dashboard.replacePanel(panelToReplace, newPanel, true);
 
     const title = dashboardUnlinkFromLibraryActionStrings.getSuccessMessage(
       embeddable.getTitle() ? `'${embeddable.getTitle()}'` : ''
     );
+
     if (dashboard.getExpandedPanelId() !== undefined) {
-      dashboard.setExpandedPanelId(undefined);
+      dashboard.setExpandedPanelId(replacedPanelId);
     }
 
     this.toastsService.addSuccess({
diff --git a/src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts b/src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts
index 9f9357f8fbbff..ee57970a93cd4 100644
--- a/src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts
+++ b/src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts
@@ -46,30 +46,33 @@ export async function replacePanel(
   previousPanelState: DashboardPanelState<EmbeddableInput>,
   newPanelState: Partial<PanelState>,
   generateNewId?: boolean
-) {
+): Promise<string> {
   let panels;
+  let panelId;
+
   if (generateNewId) {
     // replace panel can be called with generateNewId in order to totally destroy and recreate the embeddable
+    panelId = uuidv4();
     panels = { ...this.input.panels };
     delete panels[previousPanelState.explicitInput.id];
-    const newId = uuidv4();
-    panels[newId] = {
+    panels[panelId] = {
       ...previousPanelState,
       ...newPanelState,
       gridData: {
         ...previousPanelState.gridData,
-        i: newId,
+        i: panelId,
       },
       explicitInput: {
         ...newPanelState.explicitInput,
-        id: newId,
+        id: panelId,
       },
     };
   } else {
     // Because the embeddable type can change, we have to operate at the container level here
+    panelId = previousPanelState.explicitInput.id;
     panels = {
       ...this.input.panels,
-      [previousPanelState.explicitInput.id]: {
+      [panelId]: {
         ...previousPanelState,
         ...newPanelState,
         gridData: {
@@ -77,16 +80,18 @@ export async function replacePanel(
         },
         explicitInput: {
           ...newPanelState.explicitInput,
-          id: previousPanelState.explicitInput.id,
+          id: panelId,
         },
       },
     };
   }
 
-  return this.updateInput({
+  await this.updateInput({
     panels,
     lastReloadRequestTime: new Date().getTime(),
   });
+
+  return panelId;
 }
 
 export function showPlaceholderUntil<TPlacementMethodArgs extends IPanelPlacementArgs>(

From bf6be2e70a66f79a8c54132bdc18df17a0663160 Mon Sep 17 00:00:00 2001
From: Shahzad <shahzad31comp@gmail.com>
Date: Tue, 7 Feb 2023 19:20:04 +0100
Subject: [PATCH 088/134] [Uptime] TLS rule allow monitors filtering (#150339)

Fixes https://github.com/elastic/kibana/issues/150330
---
 .../lib/combine_filters_and_user_search.ts    |  2 +-
 .../common/requests/get_certs_request_body.ts |  2 +
 .../common/runtime_types/alerts/tls.ts        | 16 ++++
 .../synthetics/common/runtime_types/certs.ts  |  1 +
 .../status_alert_flyouts_in_alerting_app.ts   |  8 +-
 .../tls_alert_flyouts_in_alerting_app.ts      | 10 ++-
 .../components/overview/alerts/alert_tls.tsx  | 44 ++++++-----
 .../alerts/alerts_containers/alert_tls.tsx    | 56 +++++++++++---
 .../alerts/alerts_containers/use_snap_shot.ts |  2 +-
 .../alert_monitor_status.tsx                  | 34 +++++----
 .../settings_message_expression_popover.tsx   | 76 -------------------
 .../overview/alerts/translations.ts           | 36 ++-------
 .../hooks/use_update_kuery_string.ts          |  2 +-
 .../alert_types/lazy_wrapper/tls_alert.tsx    | 12 ++-
 .../lazy_wrapper/validate_tls_alert.ts        | 27 +++++++
 .../legacy_uptime/lib/alert_types/tls.tsx     | 24 +++++-
 .../lib/alert_types/tls_legacy.tsx            | 11 ++-
 .../legacy_uptime/lib/alerts/status_check.ts  |  8 +-
 .../server/legacy_uptime/lib/alerts/tls.ts    | 50 +++++++-----
 .../translations/translations/fr-FR.json      |  8 --
 .../translations/translations/ja-JP.json      |  8 --
 .../translations/translations/zh-CN.json      |  8 --
 22 files changed, 232 insertions(+), 213 deletions(-)
 create mode 100644 x-pack/plugins/synthetics/common/runtime_types/alerts/tls.ts
 delete mode 100644 x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/settings_message_expression_popover.tsx
 create mode 100644 x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/lazy_wrapper/validate_tls_alert.ts

diff --git a/x-pack/plugins/synthetics/common/lib/combine_filters_and_user_search.ts b/x-pack/plugins/synthetics/common/lib/combine_filters_and_user_search.ts
index a890207867b2a..8583dd951dc8b 100644
--- a/x-pack/plugins/synthetics/common/lib/combine_filters_and_user_search.ts
+++ b/x-pack/plugins/synthetics/common/lib/combine_filters_and_user_search.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export const combineFiltersAndUserSearch = (filters: string, search: string) => {
+export const combineFiltersAndUserSearch = (filters: string, search?: string) => {
   if (!filters && !search) {
     return '';
   }
diff --git a/x-pack/plugins/synthetics/common/requests/get_certs_request_body.ts b/x-pack/plugins/synthetics/common/requests/get_certs_request_body.ts
index ab613c9fcd370..ce6e0ec96313c 100644
--- a/x-pack/plugins/synthetics/common/requests/get_certs_request_body.ts
+++ b/x-pack/plugins/synthetics/common/requests/get_certs_request_body.ts
@@ -40,6 +40,7 @@ export const getCertsRequestBody = ({
   from = DEFAULT_FROM,
   sortBy = DEFAULT_SORT,
   direction = DEFAULT_DIRECTION,
+  filters,
 }: GetCertsParams) => {
   const sort = SortFields[sortBy as keyof typeof SortFields];
 
@@ -77,6 +78,7 @@ export const getCertsRequestBody = ({
               }
             : {}),
           filter: [
+            ...(filters ? [filters] : []),
             {
               exists: {
                 field: 'tls.server.hash.sha256',
diff --git a/x-pack/plugins/synthetics/common/runtime_types/alerts/tls.ts b/x-pack/plugins/synthetics/common/runtime_types/alerts/tls.ts
new file mode 100644
index 0000000000000..564485d44f239
--- /dev/null
+++ b/x-pack/plugins/synthetics/common/runtime_types/alerts/tls.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+export const TLSParamsType = t.partial({
+  search: t.string,
+  certAgeThreshold: t.number,
+  certExpirationThreshold: t.number,
+});
+
+export type TLSParams = t.TypeOf<typeof TLSParamsType>;
diff --git a/x-pack/plugins/synthetics/common/runtime_types/certs.ts b/x-pack/plugins/synthetics/common/runtime_types/certs.ts
index c1a411effb903..b7231da2bb1be 100644
--- a/x-pack/plugins/synthetics/common/runtime_types/certs.ts
+++ b/x-pack/plugins/synthetics/common/runtime_types/certs.ts
@@ -20,6 +20,7 @@ export const GetCertsParamsType = t.intersection([
     sortBy: t.string,
     direction: t.string,
     size: t.number,
+    filters: t.unknown,
   }),
 ]);
 
diff --git a/x-pack/plugins/synthetics/e2e/journeys/uptime/alerts/status_alert_flyouts_in_alerting_app.ts b/x-pack/plugins/synthetics/e2e/journeys/uptime/alerts/status_alert_flyouts_in_alerting_app.ts
index 325633bba7413..6f058d33d7714 100644
--- a/x-pack/plugins/synthetics/e2e/journeys/uptime/alerts/status_alert_flyouts_in_alerting_app.ts
+++ b/x-pack/plugins/synthetics/e2e/journeys/uptime/alerts/status_alert_flyouts_in_alerting_app.ts
@@ -87,7 +87,11 @@ journey('StatusFlyoutInAlertingApp', async ({ page, params }) => {
   });
 
   step('Tls alert flyout has setting values', async () => {
-    await assertText({ page, text: '30 days' });
-    await assertText({ page, text: '730 days' });
+    expect(await page.locator(byTestId('tlsExpirationThreshold')).textContent()).toBe(
+      'has a certificate expiring within days:  30'
+    );
+    expect(await page.locator(byTestId('tlsAgeExpirationThreshold')).textContent()).toBe(
+      'or older than days:  730'
+    );
   });
 });
diff --git a/x-pack/plugins/synthetics/e2e/journeys/uptime/alerts/tls_alert_flyouts_in_alerting_app.ts b/x-pack/plugins/synthetics/e2e/journeys/uptime/alerts/tls_alert_flyouts_in_alerting_app.ts
index 756bb05836035..8b36867fed7a5 100644
--- a/x-pack/plugins/synthetics/e2e/journeys/uptime/alerts/tls_alert_flyouts_in_alerting_app.ts
+++ b/x-pack/plugins/synthetics/e2e/journeys/uptime/alerts/tls_alert_flyouts_in_alerting_app.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { journey, step, before } from '@elastic/synthetics';
+import { journey, step, before, expect } from '@elastic/synthetics';
 import { assertText, byTestId, waitForLoadingToFinish } from '@kbn/observability-plugin/e2e/utils';
 import { recordVideo } from '@kbn/observability-plugin/e2e/record_video';
 import { loginPageProvider } from '../../../page_objects/login';
@@ -36,7 +36,11 @@ journey('TlsFlyoutInAlertingApp', async ({ page, params }) => {
   });
 
   step('Tls alert flyout has setting values', async () => {
-    await assertText({ page, text: '30 days' });
-    await assertText({ page, text: '730 days' });
+    expect(await page.locator(byTestId('tlsExpirationThreshold')).textContent()).toBe(
+      'has a certificate expiring within days:  30'
+    );
+    expect(await page.locator(byTestId('tlsAgeExpirationThreshold')).textContent()).toBe(
+      'or older than days:  730'
+    );
   });
 });
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alert_tls.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alert_tls.tsx
index f7cd341e04dae..d3ba258e3ad54 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alert_tls.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alert_tls.tsx
@@ -7,18 +7,24 @@
 
 import { EuiExpression, EuiFlexItem, EuiFlexGroup, EuiSpacer } from '@elastic/eui';
 import React from 'react';
+import { ValueExpression } from '@kbn/triggers-actions-ui-plugin/public';
 import { TlsTranslations } from './translations';
-import { SettingsMessageExpressionPopover } from './settings_message_expression_popover';
 
 interface Props {
-  ageThreshold?: number;
-  expirationThreshold?: number;
-  setAlertFlyoutVisible: (value: boolean) => void;
+  ageThreshold: number;
+  expirationThreshold: number;
+  setAgeThreshold: (value: number) => void;
+  setExpirationThreshold: (value: number) => void;
 }
 
-export const AlertTlsComponent: React.FC<Props> = (props) => (
+export const AlertTlsComponent: React.FC<Props> = ({
+  ageThreshold,
+  expirationThreshold,
+  setAgeThreshold,
+  setExpirationThreshold,
+}) => (
   <>
-    <EuiSpacer size="l" />
+    <EuiSpacer size="m" />
     <EuiFlexGroup direction="column" gutterSize="none">
       <EuiFlexItem>
         <EuiExpression
@@ -28,22 +34,24 @@ export const AlertTlsComponent: React.FC<Props> = (props) => (
           value={TlsTranslations.criteriaValue}
         />
       </EuiFlexItem>
-      <EuiFlexItem>
-        <SettingsMessageExpressionPopover
-          aria-label={TlsTranslations.expirationAriaLabel}
-          id="expiration"
+      <EuiFlexItem data-test-subj="tlsExpirationThreshold">
+        <ValueExpression
+          value={expirationThreshold}
+          onChangeSelectedValue={(val) => {
+            setExpirationThreshold(val);
+          }}
           description={TlsTranslations.expirationDescription}
-          value={TlsTranslations.expirationValue(props.expirationThreshold)}
-          {...props}
+          errors={[]}
         />
       </EuiFlexItem>
-      <EuiFlexItem>
-        <SettingsMessageExpressionPopover
-          aria-label={TlsTranslations.ageAriaLabel}
-          id="age"
+      <EuiFlexItem data-test-subj="tlsAgeExpirationThreshold">
+        <ValueExpression
+          value={ageThreshold}
+          onChangeSelectedValue={(val) => {
+            setAgeThreshold(val);
+          }}
           description={TlsTranslations.ageDescription}
-          value={TlsTranslations.ageValue(props.ageThreshold)}
-          {...props}
+          errors={[]}
         />
       </EuiFlexItem>
     </EuiFlexGroup>
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alerts_containers/alert_tls.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alerts_containers/alert_tls.tsx
index 9f3da1674ca09..6c7eb5008611b 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alerts_containers/alert_tls.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alerts_containers/alert_tls.tsx
@@ -7,30 +7,64 @@
 
 import { useDispatch, useSelector } from 'react-redux';
 import React, { useCallback, useEffect } from 'react';
+import { RuleTypeParamsExpressionProps } from '@kbn/triggers-actions-ui-plugin/public';
+import { EuiSpacer } from '@elastic/eui';
+import { useSnapShotCount } from './use_snap_shot';
+import { DYNAMIC_SETTINGS_DEFAULTS } from '../../../../../../common/constants';
+import { TLSParams } from '../../../../../../common/runtime_types/alerts/tls';
 import { AlertTlsComponent } from '../alert_tls';
-import { setAlertFlyoutVisible } from '../../../../state/actions';
 import { selectDynamicSettings } from '../../../../state/selectors';
 import { getDynamicSettings } from '../../../../state/actions/dynamic_settings';
+import { AlertQueryBar } from '../alert_query_bar/query_bar';
+import { AlertMonitorCount } from '../monitor_status_alert/alert_monitor_status';
 
-export const AlertTls: React.FC<{}> = () => {
+export const AlertTls: React.FC<{
+  ruleParams: RuleTypeParamsExpressionProps<TLSParams>['ruleParams'];
+  setRuleParams: RuleTypeParamsExpressionProps<TLSParams>['setRuleParams'];
+}> = ({ ruleParams, setRuleParams }) => {
   const dispatch = useDispatch();
-  const setFlyoutVisible = useCallback(
-    (value: boolean) => dispatch(setAlertFlyoutVisible(value)),
-    [dispatch]
-  );
+
   const { settings } = useSelector(selectDynamicSettings);
 
+  const { count, loading } = useSnapShotCount({
+    query: ruleParams.search ?? '',
+  });
+
   useEffect(() => {
     if (typeof settings === 'undefined') {
       dispatch(getDynamicSettings());
     }
   }, [dispatch, settings]);
 
+  const onSearchChange = useCallback(
+    (value: string) => {
+      setRuleParams('search', value === '' ? undefined : value);
+    },
+    [setRuleParams]
+  );
+
   return (
-    <AlertTlsComponent
-      ageThreshold={settings?.certAgeThreshold}
-      expirationThreshold={settings?.certExpirationThreshold}
-      setAlertFlyoutVisible={setFlyoutVisible}
-    />
+    <>
+      <AlertMonitorCount count={count.total} loading={loading} />
+
+      <EuiSpacer size="s" />
+
+      <AlertQueryBar query={ruleParams.search || ''} onChange={onSearchChange} />
+
+      <AlertTlsComponent
+        ageThreshold={
+          ruleParams.certAgeThreshold ??
+          settings?.certAgeThreshold ??
+          DYNAMIC_SETTINGS_DEFAULTS.certAgeThreshold
+        }
+        expirationThreshold={
+          ruleParams.certExpirationThreshold ??
+          settings?.certExpirationThreshold ??
+          DYNAMIC_SETTINGS_DEFAULTS.certExpirationThreshold
+        }
+        setAgeThreshold={(value) => setRuleParams('certAgeThreshold', Number(value))}
+        setExpirationThreshold={(value) => setRuleParams('certExpirationThreshold', Number(value))}
+      />
+    </>
   );
 };
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alerts_containers/use_snap_shot.ts b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alerts_containers/use_snap_shot.ts
index df402944cb462..ec0f03d87bbd0 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alerts_containers/use_snap_shot.ts
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/alerts_containers/use_snap_shot.ts
@@ -9,7 +9,7 @@ import { useFetcher } from '@kbn/observability-plugin/public';
 import { useGenerateUpdatedKueryString } from '../../../../hooks';
 import { fetchSnapshotCount } from '../../../../state/api';
 
-export const useSnapShotCount = ({ query, filters }: { query: string; filters: [] | string }) => {
+export const useSnapShotCount = ({ query, filters }: { query: string; filters?: [] | string }) => {
   const parsedFilters =
     filters === undefined || typeof filters === 'string'
       ? ''
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_status_alert/alert_monitor_status.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_status_alert/alert_monitor_status.tsx
index d2095e01c1a4f..0ff17f22d5c00 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_status_alert/alert_monitor_status.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_status_alert/alert_monitor_status.tsx
@@ -66,20 +66,7 @@ export const AlertMonitorStatusComponent: React.FC<AlertMonitorStatusProps> = (p
     <>
       <OldAlertCallOut isOldAlert={isOldAlert} />
 
-      <EuiCallOut
-        size="s"
-        title={
-          <span data-test-subj="alertSnapShotCount">
-            <FormattedMessage
-              id="xpack.synthetics.alerts.monitorStatus.monitorCallOut.title"
-              defaultMessage="This alert will apply to approximately {snapshotCount} monitors."
-              values={{ snapshotCount: snapshotLoading ? '...' : snapshotCount }}
-            />{' '}
-            {snapshotLoading && <EuiLoadingSpinner />}
-          </span>
-        }
-        iconType="iInCircle"
-      />
+      <AlertMonitorCount count={snapshotCount} loading={snapshotLoading} />
 
       <EuiSpacer size="s" />
 
@@ -128,3 +115,22 @@ export const AlertMonitorStatusComponent: React.FC<AlertMonitorStatusProps> = (p
     </>
   );
 };
+
+export const AlertMonitorCount = ({ count, loading }: { count: number; loading?: boolean }) => {
+  return (
+    <EuiCallOut
+      size="s"
+      title={
+        <span data-test-subj="alertSnapShotCount">
+          <FormattedMessage
+            id="xpack.synthetics.alerts.monitorStatus.monitorCallOut.title"
+            defaultMessage="This alert will apply to approximately {snapshotCount} monitors."
+            values={{ snapshotCount: loading ? '...' : count }}
+          />{' '}
+          {loading && <EuiLoadingSpinner />}
+        </span>
+      }
+      iconType="iInCircle"
+    />
+  );
+};
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/settings_message_expression_popover.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/settings_message_expression_popover.tsx
deleted file mode 100644
index cf4775033443a..0000000000000
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/settings_message_expression_popover.tsx
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiLink } from '@elastic/eui';
-import { EuiExpression, EuiPopover } from '@elastic/eui';
-import React, { useState } from 'react';
-import { FormattedMessage } from '@kbn/i18n-react';
-import { useKibana } from '@kbn/kibana-react-plugin/public';
-
-interface SettingsMessageExpressionPopoverProps {
-  'aria-label': string;
-  description: string;
-  id: string;
-  setAlertFlyoutVisible: (value: boolean) => void;
-  value: string;
-}
-
-export const SettingsMessageExpressionPopover: React.FC<SettingsMessageExpressionPopoverProps> = ({
-  'aria-label': ariaLabel,
-  description,
-  setAlertFlyoutVisible,
-  value,
-  id,
-}) => {
-  const kibana = useKibana();
-  const path = kibana.services?.application?.getUrlForApp('uptime', { path: 'settings' });
-  const [isOpen, setIsOpen] = useState(false);
-  return (
-    <EuiPopover
-      data-test-subj={`xpack.synthetics.alerts.tls.expressionPopover.${id}`}
-      id={id}
-      anchorPosition="downLeft"
-      button={
-        <EuiExpression
-          aria-label={ariaLabel}
-          color="success"
-          description={description}
-          isActive={isOpen}
-          onClick={() => setIsOpen(!isOpen)}
-          value={value}
-        />
-      }
-      isOpen={isOpen}
-      closePopover={() => setIsOpen(false)}
-    >
-      <FormattedMessage
-        id="xpack.synthetics.alerts.tls.settingsPageNav.text"
-        defaultMessage="You can edit these thresholds on the {settingsPageLink}."
-        values={{
-          settingsPageLink: (
-            // this link is wrapped around a span so we can also change the UI state
-            // and hide the alert flyout before triggering the navigation to the settings page
-            <EuiLink href={path} data-test-subj="xpack.synthetics.alerts.tlsFlyout.linkToSettings">
-              <span
-                onClick={() => {
-                  setAlertFlyoutVisible(false);
-                }}
-                onKeyUp={(e) => {
-                  if (e.key === 'Enter') {
-                    setAlertFlyoutVisible(false);
-                  }
-                }}
-              >
-                settings page
-              </span>
-            </EuiLink>
-          ),
-        }}
-      />
-    </EuiPopover>
-  );
-};
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/translations.ts b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/translations.ts
index de9da94460338..bbe794c118fcc 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/translations.ts
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/translations.ts
@@ -270,39 +270,15 @@ export const TlsTranslations = {
         'The context of this `when` is in the conditional sense, like "when there are three cookies, eat them all".',
     }
   ),
-  criteriaValue: i18n.translate('xpack.synthetics.alerts.tls.criteriaExpression.value', {
-    defaultMessage: 'any monitor',
+  criteriaValue: i18n.translate('xpack.synthetics.tls.criteriaExpression.value', {
+    defaultMessage: 'matching monitor',
   }),
-  expirationAriaLabel: i18n.translate(
-    'xpack.synthetics.alerts.tls.expirationExpression.ariaLabel',
-    {
-      defaultMessage:
-        'An expression displaying the threshold that will trigger the TLS alert for certificate expiration',
-    }
-  ),
-  expirationDescription: i18n.translate(
-    'xpack.synthetics.alerts.tls.expirationExpression.description',
-    {
-      defaultMessage: 'has a certificate expiring within',
-    }
-  ),
-  expirationValue: (value?: number) =>
-    i18n.translate('xpack.synthetics.alerts.tls.expirationExpression.value', {
-      defaultMessage: '{value} days',
-      values: { value },
-    }),
-  ageAriaLabel: i18n.translate('xpack.synthetics.alerts.tls.ageExpression.ariaLabel', {
-    defaultMessage:
-      'An expressing displaying the threshold that will trigger the TLS alert for old certificates',
+  expirationDescription: i18n.translate('xpack.synthetics.tls.expirationExpression.description', {
+    defaultMessage: 'has a certificate expiring within days: ',
   }),
-  ageDescription: i18n.translate('xpack.synthetics.alerts.tls.ageExpression.description', {
-    defaultMessage: 'or older than',
+  ageDescription: i18n.translate('xpack.synthetics.tls.ageExpression.description', {
+    defaultMessage: 'or older than days: ',
   }),
-  ageValue: (value?: number) =>
-    i18n.translate('xpack.synthetics.alerts.tls.ageExpression.value', {
-      defaultMessage: '{value} days',
-      values: { value },
-    }),
 };
 
 export const ToggleFlyoutTranslations = {
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/hooks/use_update_kuery_string.ts b/x-pack/plugins/synthetics/public/legacy_uptime/hooks/use_update_kuery_string.ts
index 823c57edfd051..d486c58b0ff74 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/hooks/use_update_kuery_string.ts
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/hooks/use_update_kuery_string.ts
@@ -77,7 +77,7 @@ export const useGenerateUpdatedKueryString = (
   // this try catch is necessary to evaluate user input in kuery bar,
   // this error will be actually shown in UI for user to see
   try {
-    if ((filterQueryString || urlFilters || excludedFilters) && dataView) {
+    if ((filterQueryString || urlFilters || excludedFilters) && dataView && combinedFilterString) {
       const ast = fromKueryExpression(combinedFilterString);
 
       const elasticsearchQuery = toElasticsearchQuery(ast, dataView);
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/lazy_wrapper/tls_alert.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/lazy_wrapper/tls_alert.tsx
index 2d1b8c9898475..bf1affd707859 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/lazy_wrapper/tls_alert.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/lazy_wrapper/tls_alert.tsx
@@ -9,24 +9,30 @@ import React from 'react';
 import { Provider as ReduxProvider } from 'react-redux';
 import { CoreStart } from '@kbn/core/public';
 import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
+import type { RuleTypeParamsExpressionProps } from '@kbn/triggers-actions-ui-plugin/public';
+import type { TLSParams } from '../../../../../common/runtime_types/alerts/tls';
 import { store } from '../../../state';
 import { ClientPluginsStart } from '../../../../plugin';
 import { AlertTls } from '../../../components/overview/alerts/alerts_containers/alert_tls';
 import { kibanaService } from '../../../state/kibana_service';
+import { UptimeDataViewContextProvider } from '../../../contexts/uptime_data_view_context';
 
 interface Props {
   core: CoreStart;
   plugins: ClientPluginsStart;
-  params: any;
+  ruleParams: RuleTypeParamsExpressionProps<TLSParams>['ruleParams'];
+  setRuleParams: RuleTypeParamsExpressionProps<TLSParams>['setRuleParams'];
 }
 
 // eslint-disable-next-line import/no-default-export
-export default function TLSAlert({ core, plugins, params: _params }: Props) {
+export default function TLSAlert({ core, plugins, ruleParams, setRuleParams }: Props) {
   kibanaService.core = core;
   return (
     <ReduxProvider store={store}>
       <KibanaContextProvider services={{ ...core, ...plugins }}>
-        <AlertTls />
+        <UptimeDataViewContextProvider dataViews={plugins.dataViews}>
+          <AlertTls ruleParams={ruleParams} setRuleParams={setRuleParams} />
+        </UptimeDataViewContextProvider>
       </KibanaContextProvider>
     </ReduxProvider>
   );
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/lazy_wrapper/validate_tls_alert.ts b/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/lazy_wrapper/validate_tls_alert.ts
new file mode 100644
index 0000000000000..a30d8c9f0a8ce
--- /dev/null
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/lazy_wrapper/validate_tls_alert.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { PathReporter } from 'io-ts/lib/PathReporter';
+import { isRight } from 'fp-ts/lib/Either';
+import { ValidationResult } from '@kbn/triggers-actions-ui-plugin/public';
+import { TLSParamsType } from '../../../../../common/runtime_types/alerts/tls';
+
+export function validateTLSAlertParams(ruleParams: any): ValidationResult {
+  const errors: Record<string, any> = {};
+  const decoded = TLSParamsType.decode(ruleParams);
+
+  if (!isRight(decoded)) {
+    return {
+      errors: {
+        typeCheckFailure: 'Provided parameters do not conform to the expected type.',
+        typeCheckParsingMessage: PathReporter.report(decoded),
+      },
+    };
+  }
+
+  return { errors };
+}
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/tls.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/tls.tsx
index 2032494da036e..f9d510243393b 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/tls.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/tls.tsx
@@ -8,12 +8,17 @@
 import React from 'react';
 import { ALERT_REASON } from '@kbn/rule-data-utils';
 import { ObservabilityRuleTypeModel } from '@kbn/observability-plugin/public';
+import type { RuleTypeParamsExpressionProps } from '@kbn/triggers-actions-ui-plugin/public';
+import { ValidationResult } from '@kbn/triggers-actions-ui-plugin/public';
+import { TLSParams } from '../../../../common/runtime_types/alerts/tls';
 import { CLIENT_ALERT_TYPES } from '../../../../common/constants/uptime_alerts';
 import { TlsTranslations } from '../../../../common/translations';
 import { AlertTypeInitializer } from '.';
 
 import { CERTIFICATES_ROUTE } from '../../../../common/constants/ui';
 
+let validateFunc: (ruleParams: any) => ValidationResult;
+
 const { defaultActionMessage, defaultRecoveryMessage, description } = TlsTranslations;
 const TLSAlert = React.lazy(() => import('./lazy_wrapper/tls_alert'));
 export const initTlsAlertType: AlertTypeInitializer = ({
@@ -25,9 +30,24 @@ export const initTlsAlertType: AlertTypeInitializer = ({
   documentationUrl(docLinks) {
     return `${docLinks.links.observability.tlsCertificate}`;
   },
-  ruleParamsExpression: (params: any) => <TLSAlert core={core} plugins={plugins} params={params} />,
+  ruleParamsExpression: (params: RuleTypeParamsExpressionProps<TLSParams>) => (
+    <TLSAlert
+      core={core}
+      plugins={plugins}
+      ruleParams={params.ruleParams}
+      setRuleParams={params.setRuleParams}
+    />
+  ),
   description,
-  validate: () => ({ errors: {} }),
+  validate: (ruleParams: any) => {
+    if (!validateFunc) {
+      (async function loadValidate() {
+        const { validateTLSAlertParams } = await import('./lazy_wrapper/validate_tls_alert');
+        validateFunc = validateTLSAlertParams;
+      })();
+    }
+    return validateFunc ? validateFunc(ruleParams) : ({} as ValidationResult);
+  },
   defaultActionMessage,
   defaultRecoveryMessage,
   requiresAppContext: false,
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/tls_legacy.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/tls_legacy.tsx
index c59bedcc70fae..ed67a50ee08b7 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/tls_legacy.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/lib/alert_types/tls_legacy.tsx
@@ -22,9 +22,16 @@ export const initTlsLegacyAlertType: AlertTypeInitializer<RuleTypeModel> = ({
   documentationUrl(docLinks) {
     return `${docLinks.ELASTIC_WEBSITE_URL}guide/en/observability/${docLinks.DOC_LINK_VERSION}/tls-certificate-alert.html`;
   },
-  ruleParamsExpression: (params: any) => <TLSAlert core={core} plugins={plugins} params={params} />,
+  ruleParamsExpression: (params: any) => (
+    <TLSAlert
+      core={core}
+      plugins={plugins}
+      ruleParams={params.ruleParams}
+      setRuleParams={params.setRuleParams}
+    />
+  ),
   description,
   validate: () => ({ errors: {} }),
   defaultActionMessage,
-  requiresAppContext: false,
+  requiresAppContext: true,
 });
diff --git a/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/status_check.ts b/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/status_check.ts
index 66dd5afbbb9e7..6dd200b11fda2 100644
--- a/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/status_check.ts
+++ b/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/status_check.ts
@@ -104,8 +104,8 @@ export const hasFilters = (filters?: StatusCheckFilters) => {
 
 export const generateFilterDSL = async (
   getIndexPattern: () => Promise<IndexPatternTitleAndFields | undefined>,
-  filters: StatusCheckFilters,
-  search: string
+  filters?: StatusCheckFilters,
+  search?: string
 ) => {
   const filtersExist = hasFilters(filters);
   if (!filtersExist && !search) return undefined;
@@ -122,8 +122,8 @@ export const generateFilterDSL = async (
 
 export const formatFilterString = async (
   uptimeEsClient: UptimeEsClient,
-  filters: StatusCheckFilters,
-  search: string,
+  filters?: StatusCheckFilters,
+  search?: string,
   libs?: UMServerLibs
 ) =>
   await generateFilterDSL(
diff --git a/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/tls.ts b/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/tls.ts
index 85de29419b8e7..3d39d1d9329e6 100644
--- a/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/tls.ts
+++ b/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/tls.ts
@@ -8,6 +8,8 @@ import moment from 'moment';
 import { schema } from '@kbn/config-schema';
 import { ALERT_REASON, ALERT_UUID } from '@kbn/rule-data-utils';
 import { ActionGroupIdsOf } from '@kbn/alerting-plugin/common';
+import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
+import { formatFilterString } from './status_check';
 import { UptimeAlertTypeFactory } from './types';
 import {
   updateState,
@@ -108,7 +110,11 @@ export const tlsAlertFactory: UptimeAlertTypeFactory<ActionGroupIds> = (
   producer: 'uptime',
   name: tlsTranslations.alertFactoryName,
   validate: {
-    params: schema.object({}),
+    params: schema.object({
+      search: schema.maybe(schema.string()),
+      certExpirationThreshold: schema.maybe(schema.number()),
+      certAgeThreshold: schema.maybe(schema.number()),
+    }),
   },
   defaultActionGroupId: TLS.id,
   actionGroups: [
@@ -131,6 +137,7 @@ export const tlsAlertFactory: UptimeAlertTypeFactory<ActionGroupIds> = (
   minimumLicenseRequired: 'basic',
   doesSetRecoveryContext: true,
   async executor({
+    params,
     services: {
       alertFactory,
       alertWithLifecycle,
@@ -149,38 +156,39 @@ export const tlsAlertFactory: UptimeAlertTypeFactory<ActionGroupIds> = (
       scopedClusterClient.asCurrentUser
     );
 
+    const certExpirationThreshold =
+      params.certExpirationThreshold ??
+      dynamicSettings?.certExpirationThreshold ??
+      DYNAMIC_SETTINGS_DEFAULTS.certExpirationThreshold;
+
+    const certAgeThreshold =
+      params.certAgeThreshold ??
+      dynamicSettings?.certAgeThreshold ??
+      DYNAMIC_SETTINGS_DEFAULTS.certAgeThreshold;
+
+    let filters: QueryDslQueryContainer | undefined;
+
+    if (params.search) {
+      filters = await formatFilterString(uptimeEsClient, undefined, params.search, libs);
+    }
+
     const { certs, total }: CertResult = await libs.requests.getCerts({
       uptimeEsClient,
       pageIndex: 0,
       size: 1000,
-      notValidAfter: `now+${
-        dynamicSettings?.certExpirationThreshold ??
-        DYNAMIC_SETTINGS_DEFAULTS.certExpirationThreshold
-      }d`,
-      notValidBefore: `now-${
-        dynamicSettings?.certAgeThreshold ?? DYNAMIC_SETTINGS_DEFAULTS.certAgeThreshold
-      }d`,
+      notValidAfter: `now+${certExpirationThreshold}d`,
+      notValidBefore: `now-${certAgeThreshold}d`,
       sortBy: 'common_name',
       direction: 'desc',
+      filters,
     });
 
     const foundCerts = total > 0;
 
     if (foundCerts) {
       certs.forEach((cert) => {
-        const absoluteExpirationThreshold = moment()
-          .add(
-            dynamicSettings.certExpirationThreshold ??
-              DYNAMIC_SETTINGS_DEFAULTS.certExpirationThreshold,
-            'd'
-          )
-          .valueOf();
-        const absoluteAgeThreshold = moment()
-          .subtract(
-            dynamicSettings.certAgeThreshold ?? DYNAMIC_SETTINGS_DEFAULTS.certAgeThreshold,
-            'd'
-          )
-          .valueOf();
+        const absoluteExpirationThreshold = moment().add(certExpirationThreshold, 'd').valueOf();
+        const absoluteAgeThreshold = moment().subtract(certAgeThreshold, 'd').valueOf();
         const summary = getCertSummary(cert, absoluteExpirationThreshold, absoluteAgeThreshold);
 
         if (!summary.summary || !summary.status) {
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index b06153172685e..3d23394419634 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -32739,12 +32739,9 @@
     "xpack.synthetics.alerts.monitorStatus.defaultRecoveryMessage": "L'alerte pour le moniteur {monitorName} possédant l'URL {monitorUrl} depuis {observerLocation} a été résolue",
     "xpack.synthetics.alerts.monitorStatus.monitorCallOut.title": "Cette alerte s'appliquera à environ {snapshotCount} moniteurs.",
     "xpack.synthetics.alerts.monitorStatus.timerangeValueField.value": "dernier/dernière(s) {value}",
-    "xpack.synthetics.alerts.tls.ageExpression.value": "{value} jours",
     "xpack.synthetics.alerts.tls.defaultActionMessage": "Le certificat TLS {commonName} détecté de l'émetteur {issuer} est {status}. Certificat {summary}",
     "xpack.synthetics.alerts.tls.defaultRecoveryMessage": "L'alerte pour le certificat TLS {commonName} détecté de l'émetteur {issuer} a été résolue",
-    "xpack.synthetics.alerts.tls.expirationExpression.value": "{value} jours",
     "xpack.synthetics.alerts.tls.legacy.defaultActionMessage": "Détection de {count} certificats TLS sur le point d'expirer ou devenant trop anciens.\n{expiringConditionalOpen}\nNombre de certificats sur le point d'expirer : {expiringCount}\nCertificats sur le point d'expirer : {expiringCommonNameAndDate}\n{expiringConditionalClose}\n{agingConditionalOpen}\nNombre de certificats vieillissants : {agingCount}\nCertificats vieillissants : {agingCommonNameAndDate}\n{agingConditionalClose}\n",
-    "xpack.synthetics.alerts.tls.settingsPageNav.text": "Vous pouvez modifier ces seuils sur la {settingsPageLink}.",
     "xpack.synthetics.alerts.tls.validAfterExpiredString": "expiré le {date}, il y a {relativeDate} jours.",
     "xpack.synthetics.alerts.tls.validAfterExpiringString": "expire le {date}, dans {relativeDate} jours.",
     "xpack.synthetics.alerts.tls.validBeforeExpiredString": "valide depuis le {date}, il y a {relativeDate} jours.",
@@ -33000,16 +32997,11 @@
     "xpack.synthetics.alerts.tls.actionVariables.state.count": "Nombre de certificats détectés par l'exécuteur d'alertes",
     "xpack.synthetics.alerts.tls.actionVariables.state.expiringCommonNameAndDate": "Noms courants et date/heure d'expiration des certificats détectés",
     "xpack.synthetics.alerts.tls.actionVariables.state.expiringCount": "Nombre de certificats sur le point d'expirer détectés par l'alerte.",
-    "xpack.synthetics.alerts.tls.ageExpression.ariaLabel": "Expression affichant le seuil qui déclenchera l'alerte TLS pour les certificats anciens",
-    "xpack.synthetics.alerts.tls.ageExpression.description": "ou plus anciens que",
     "xpack.synthetics.alerts.tls.agingLabel": "devient trop ancien",
     "xpack.synthetics.alerts.tls.clientName": "Uptime TLS",
     "xpack.synthetics.alerts.tls.criteriaExpression.ariaLabel": "Expression affichant les critères des moniteurs surveillés par cette alerte",
     "xpack.synthetics.alerts.tls.criteriaExpression.description": "quand",
-    "xpack.synthetics.alerts.tls.criteriaExpression.value": "tout moniteur",
     "xpack.synthetics.alerts.tls.description": "Alerte lorsque le certificat TLS d'un moniteur Uptime est sur le point d'expirer.",
-    "xpack.synthetics.alerts.tls.expirationExpression.ariaLabel": "Expression affichant le seuil qui déclenchera l'alerte TLS pour l'expiration des certificats",
-    "xpack.synthetics.alerts.tls.expirationExpression.description": "possède un certificat expirant dans",
     "xpack.synthetics.alerts.tls.expiredLabel": "expiré",
     "xpack.synthetics.alerts.tls.expiringLabel": "sur le point d'expirer",
     "xpack.synthetics.alerts.tls.invalidLabel": "non valide",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 42ffa67a86fd6..f67b34b640c98 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -32710,12 +32710,9 @@
     "xpack.synthetics.alerts.monitorStatus.defaultRecoveryMessage": "{observerLocation}からのurl {monitorUrl}のモニター{monitorName}に関するアラートが回復しました",
     "xpack.synthetics.alerts.monitorStatus.monitorCallOut.title": "このアラートは約{snapshotCount}個のモニターに適用されます。",
     "xpack.synthetics.alerts.monitorStatus.timerangeValueField.value": "最終{value}",
-    "xpack.synthetics.alerts.tls.ageExpression.value": "{value}日以内に期限切れになる",
     "xpack.synthetics.alerts.tls.defaultActionMessage": "発行者{issuer}の検出されたTLS証明書{commonName}は{status}です。証明書{summary}",
     "xpack.synthetics.alerts.tls.defaultRecoveryMessage": "発行者{issuer}のTLS証明書{commonName}のアラートが回復しました",
-    "xpack.synthetics.alerts.tls.expirationExpression.value": "{value}日以内に期限切れになる",
     "xpack.synthetics.alerts.tls.legacy.defaultActionMessage": "期限切れになるか古くなりすぎた{count} TLS個のTLS証明書証明書を検知しました。\n{expiringConditionalOpen}\n期限切れになる証明書数：{expiringCount}\n期限切れになる証明書：{expiringCommonNameAndDate}\n{expiringConditionalClose}\n{agingConditionalOpen}\n古い証明書数：{agingCount}\n古い証明書：{agingCommonNameAndDate}\n{agingConditionalClose}\n",
-    "xpack.synthetics.alerts.tls.settingsPageNav.text": "これらのしきい値は{settingsPageLink}で編集できます。",
     "xpack.synthetics.alerts.tls.validAfterExpiredString": "{relativeDate}日前、{date}に期限切れになりました。",
     "xpack.synthetics.alerts.tls.validAfterExpiringString": "{relativeDate}日以内、{date}に期限切れになります。",
     "xpack.synthetics.alerts.tls.validBeforeExpiredString": "{relativeDate}日前、{date}以降有効です。",
@@ -32971,16 +32968,11 @@
     "xpack.synthetics.alerts.tls.actionVariables.state.count": "アラート実行によって検出された証明書数",
     "xpack.synthetics.alerts.tls.actionVariables.state.expiringCommonNameAndDate": "検出された証明書の共通名と有効期限日時",
     "xpack.synthetics.alerts.tls.actionVariables.state.expiringCount": "アラートによって検出された期限切れになる証明書数",
-    "xpack.synthetics.alerts.tls.ageExpression.ariaLabel": "古い証明書のTLSアラートをトリガーするしきい値を示す式",
-    "xpack.synthetics.alerts.tls.ageExpression.description": "または",
     "xpack.synthetics.alerts.tls.agingLabel": "古すぎます",
     "xpack.synthetics.alerts.tls.clientName": "アップタイムTLS",
     "xpack.synthetics.alerts.tls.criteriaExpression.ariaLabel": "このアラートで監視されるモニターの条件を示す式",
     "xpack.synthetics.alerts.tls.criteriaExpression.description": "タイミング",
-    "xpack.synthetics.alerts.tls.criteriaExpression.value": "任意のモニター",
     "xpack.synthetics.alerts.tls.description": "アップタイム監視の TLS 証明書の有効期限が近いときにアラートを発行します。",
-    "xpack.synthetics.alerts.tls.expirationExpression.ariaLabel": "証明書有効期限の TLS アラートをトリガーするしきい値を示す式",
-    "xpack.synthetics.alerts.tls.expirationExpression.description": "証明書が",
     "xpack.synthetics.alerts.tls.expiredLabel": "期限切れ",
     "xpack.synthetics.alerts.tls.expiringLabel": "まもなく期限切れ",
     "xpack.synthetics.alerts.tls.invalidLabel": "無効",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index e41ae9b029458..c9640871ab546 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -32745,12 +32745,9 @@
     "xpack.synthetics.alerts.monitorStatus.defaultRecoveryMessage": "来自 {observerLocation} 且 url 为 {monitorUrl} 的监测 {monitorName} 的告警已恢复",
     "xpack.synthetics.alerts.monitorStatus.monitorCallOut.title": "此告警将应用到大约 {snapshotCount} 个监测。",
     "xpack.synthetics.alerts.monitorStatus.timerangeValueField.value": "上一 {value}",
-    "xpack.synthetics.alerts.tls.ageExpression.value": "{value} 天内过期的证书",
     "xpack.synthetics.alerts.tls.defaultActionMessage": "检测到来自颁发者 {issuer} 的 TLS 证书 {commonName} 的状态为 {status}。证书 {summary}",
     "xpack.synthetics.alerts.tls.defaultRecoveryMessage": "来自颁发者 {issuer} 的 TLS 证书 {commonName} 的告警已恢复",
-    "xpack.synthetics.alerts.tls.expirationExpression.value": "{value} 天内过期的证书",
     "xpack.synthetics.alerts.tls.legacy.defaultActionMessage": "检测到 {count} 个 TLS 证书即将过期或即将过时。\n{expiringConditionalOpen}\n即将过期的证书计数：{expiringCount}\n即将过期的证书：{expiringCommonNameAndDate}\n{expiringConditionalClose}\n{agingConditionalOpen}\n过时的证书计数：{agingCount}\n过时的证书：{agingCommonNameAndDate}\n{agingConditionalClose}\n",
-    "xpack.synthetics.alerts.tls.settingsPageNav.text": "可以在 {settingsPageLink}上编辑这些阈值。",
     "xpack.synthetics.alerts.tls.validAfterExpiredString": "已于 {relativeDate} 天前，即 {date}到期。",
     "xpack.synthetics.alerts.tls.validAfterExpiringString": "将在{relativeDate} 天后，即 {date}到期。",
     "xpack.synthetics.alerts.tls.validBeforeExpiredString": "自 {relativeDate} 天前，即 {date}开始生效。",
@@ -33006,16 +33003,11 @@
     "xpack.synthetics.alerts.tls.actionVariables.state.count": "告警执行工具检测到的证书数目",
     "xpack.synthetics.alerts.tls.actionVariables.state.expiringCommonNameAndDate": "检测到的证书的常见名称和到期日期/时间",
     "xpack.synthetics.alerts.tls.actionVariables.state.expiringCount": "告警检测到的即将到期证书数目。",
-    "xpack.synthetics.alerts.tls.ageExpression.ariaLabel": "显示将触发旧证书 TLS 告警的阈值的表达式",
-    "xpack.synthetics.alerts.tls.ageExpression.description": "或超过",
     "xpack.synthetics.alerts.tls.agingLabel": "已过旧",
     "xpack.synthetics.alerts.tls.clientName": "Uptime TLS",
     "xpack.synthetics.alerts.tls.criteriaExpression.ariaLabel": "显示此告警监视的监测条件的表达式",
     "xpack.synthetics.alerts.tls.criteriaExpression.description": "当",
-    "xpack.synthetics.alerts.tls.criteriaExpression.value": "任意监测",
     "xpack.synthetics.alerts.tls.description": "运行时间监测的 TLS 证书即将过期时告警。",
-    "xpack.synthetics.alerts.tls.expirationExpression.ariaLabel": "显示将触发证书过期 TLS 告警的阈值的表达式",
-    "xpack.synthetics.alerts.tls.expirationExpression.description": "具有将在",
     "xpack.synthetics.alerts.tls.expiredLabel": "已过期",
     "xpack.synthetics.alerts.tls.expiringLabel": "将到期",
     "xpack.synthetics.alerts.tls.invalidLabel": "无效",

From 4513f7be54def6a916dc4790b9150eccfe3e488d Mon Sep 17 00:00:00 2001
From: Dmitrii Shevchenko <dmitrii.shevchenko@elastic.co>
Date: Tue, 7 Feb 2023 19:32:46 +0100
Subject: [PATCH 089/134] [Security Solution] Remove the advanced sorting
 switch from the rules management page (#149840)

**Resolves: https://github.com/elastic/kibana/issues/138907**
**Resolves: https://github.com/elastic/kibana/issues/148196**

## Summary

- Added missing `outcomeOrder` field to the alerting framework
- Removed the advanced sorting switch from the rules management page
- Both rules management and rules monitoring tables now have all columns
sortable, including indexing time, query time, last gap, and last
response
- Sorting now happens entirely on the server side. No in-memory
structures are needed.
- Removed the version column as intended in
https://github.com/elastic/kibana/issues/148196

There's one caveat, though. The running status is represented as a
different rule field. So when sorting by the last status, if there are
any "running" rules, they could appear in any row on the table:

![Screenshot 2023-01-31 at 16 18
29](https://user-images.githubusercontent.com/1938181/216108688-6abe9cb9-3307-4b72-9b6e-27a485a130d5.png)
---
 x-pack/plugins/alerting/common/rule.ts        |  7 ++
 .../public/lib/common_transformations.test.ts |  4 +
 .../public/lib/common_transformations.ts      |  8 +-
 .../alerting/server/lib/last_run_status.ts    |  8 +-
 .../server/routes/lib/rewrite_rule.ts         |  3 +-
 .../saved_objects/migrations/8.7/index.ts     | 24 +++++-
 .../saved_objects/migrations/index.test.ts    | 22 +++++
 .../alerting/server/task_runner/fixtures.ts   | 12 ++-
 .../server/task_runner/task_runner.test.ts    | 14 ++--
 .../server/task_runner/task_runner.ts         |  5 +-
 .../task_runner/task_runner_cancel.test.ts    |  1 +
 .../rules/find_rules/request_schema.test.ts   | 10 +--
 .../api/rules/find_rules/request_schema.ts    | 25 +++++-
 .../request_schema_validation.test.ts         |  4 +-
 .../schemas/common/sorting.ts                 |  6 --
 .../public/common/lib/apm/user_actions.ts     |  2 -
 .../add_to_rules_options/index.test.tsx       |  8 +-
 .../add_to_rules_table/index.test.tsx         | 11 +--
 .../use_add_to_rules_table.tsx                |  6 +-
 .../rule_management/api/api.test.ts           |  2 +-
 .../rule_management/api/api.ts                |  8 +-
 .../rule_management/logic/types.ts            | 19 +----
 .../rule_management/logic/use_find_rules.ts   |  7 +-
 .../__mocks__/rules_table_context.tsx         |  2 -
 .../rules_table/rules_table_context.test.tsx  |  6 +-
 .../rules_table/rules_table_context.tsx       | 77 ++++++-----------
 .../rules_table/use_find_rules_in_memory.ts   | 50 -----------
 .../rules_table/rules_table/utils.ts          | 77 -----------------
 .../rules_table/rules_table_toolbar.tsx       | 49 +----------
 .../components/rules_table/rules_tables.tsx   |  5 +-
 .../components/rules_table/use_columns.tsx    | 34 ++------
 .../detection_engine/rules/translations.ts    | 29 -------
 .../api/rules/find_rules/route.test.ts        |  2 +-
 .../logic/search/find_rules.ts                |  7 +-
 .../logic/search/transform_sort_field.ts      | 82 +++++++++++++++++++
 .../translations/translations/fr-FR.json      |  4 -
 .../translations/translations/ja-JP.json      |  4 -
 .../translations/translations/zh-CN.json      |  4 -
 .../lib/rule_api/common_transformations.ts    |  2 +
 .../group3/tests/alerting/clone.ts            |  1 +
 .../tests/alerting/group4/migrations.ts       |  1 +
 41 files changed, 271 insertions(+), 381 deletions(-)
 delete mode 100644 x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory.ts
 delete mode 100644 x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/utils.ts
 create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/search/transform_sort_field.ts

diff --git a/x-pack/plugins/alerting/common/rule.ts b/x-pack/plugins/alerting/common/rule.ts
index 162778c8f5826..49c274f140ea9 100644
--- a/x-pack/plugins/alerting/common/rule.ts
+++ b/x-pack/plugins/alerting/common/rule.ts
@@ -35,6 +35,12 @@ export type RuleExecutionStatuses = typeof RuleExecutionStatusValues[number];
 export const RuleLastRunOutcomeValues = ['succeeded', 'warning', 'failed'] as const;
 export type RuleLastRunOutcomes = typeof RuleLastRunOutcomeValues[number];
 
+export const RuleLastRunOutcomeOrderMap: Record<RuleLastRunOutcomes, number> = {
+  succeeded: 0,
+  warning: 10,
+  failed: 20,
+};
+
 export enum RuleExecutionStatusErrorReasons {
   Read = 'read',
   Decrypt = 'decrypt',
@@ -93,6 +99,7 @@ export interface RuleAggregations {
 
 export interface RuleLastRun {
   outcome: RuleLastRunOutcomes;
+  outcomeOrder?: number;
   warning?: RuleExecutionStatusErrorReasons | RuleExecutionStatusWarningReasons | null;
   outcomeMsg?: string[] | null;
   alertsCount: {
diff --git a/x-pack/plugins/alerting/public/lib/common_transformations.test.ts b/x-pack/plugins/alerting/public/lib/common_transformations.test.ts
index 4747ad98412c9..cef3cf8804f40 100644
--- a/x-pack/plugins/alerting/public/lib/common_transformations.test.ts
+++ b/x-pack/plugins/alerting/public/lib/common_transformations.test.ts
@@ -81,6 +81,7 @@ describe('common_transformations', () => {
       },
       last_run: {
         outcome: RuleLastRunOutcomeValues[2],
+        outcome_order: 20,
         outcome_msg: ['this is just a test'],
         warning: RuleExecutionStatusErrorReasons.Unknown,
         alerts_count: {
@@ -137,6 +138,7 @@ describe('common_transformations', () => {
           "outcomeMsg": Array [
             "this is just a test",
           ],
+          "outcomeOrder": 20,
           "warning": "unknown",
         },
         "monitoring": Object {
@@ -255,6 +257,7 @@ describe('common_transformations', () => {
       },
       last_run: {
         outcome: 'failed',
+        outcome_order: 20,
         outcome_msg: ['this is just a test'],
         warning: RuleExecutionStatusErrorReasons.Unknown,
         alerts_count: {
@@ -300,6 +303,7 @@ describe('common_transformations', () => {
           "outcomeMsg": Array [
             "this is just a test",
           ],
+          "outcomeOrder": 20,
           "warning": "unknown",
         },
         "monitoring": Object {
diff --git a/x-pack/plugins/alerting/public/lib/common_transformations.ts b/x-pack/plugins/alerting/public/lib/common_transformations.ts
index 6e3888db451b8..6a89b1ce9958b 100644
--- a/x-pack/plugins/alerting/public/lib/common_transformations.ts
+++ b/x-pack/plugins/alerting/public/lib/common_transformations.ts
@@ -63,10 +63,16 @@ function transformMonitoring(input: RuleMonitoring): RuleMonitoring {
 }
 
 function transformLastRun(input: AsApiContract<RuleLastRun>): RuleLastRun {
-  const { outcome_msg: outcomeMsg, alerts_count: alertsCount, ...rest } = input;
+  const {
+    outcome_msg: outcomeMsg,
+    alerts_count: alertsCount,
+    outcome_order: outcomeOrder,
+    ...rest
+  } = input;
   return {
     outcomeMsg,
     alertsCount,
+    outcomeOrder,
     ...rest,
   };
 }
diff --git a/x-pack/plugins/alerting/server/lib/last_run_status.ts b/x-pack/plugins/alerting/server/lib/last_run_status.ts
index d2bc22cadb285..a007d8637eac0 100644
--- a/x-pack/plugins/alerting/server/lib/last_run_status.ts
+++ b/x-pack/plugins/alerting/server/lib/last_run_status.ts
@@ -8,7 +8,7 @@
 import { RuleTaskStateAndMetrics } from '../task_runner/types';
 import { getReasonFromError } from './error_with_reason';
 import { getEsErrorMessage } from './errors';
-import { ActionsCompletion, RuleLastRunOutcomes } from '../../common';
+import { ActionsCompletion, RuleLastRunOutcomeOrderMap, RuleLastRunOutcomes } from '../../common';
 import {
   RuleLastRunOutcomeValues,
   RuleExecutionStatusWarningReasons,
@@ -65,6 +65,7 @@ export const lastRunFromState = (
   return {
     lastRun: {
       outcome,
+      outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
       outcomeMsg: outcomeMsg.length > 0 ? outcomeMsg : null,
       warning: warning || null,
       alertsCount: {
@@ -80,9 +81,11 @@ export const lastRunFromState = (
 
 export const lastRunFromError = (error: Error): ILastRun => {
   const esErrorMessage = getEsErrorMessage(error);
+  const outcome = RuleLastRunOutcomeValues[2];
   return {
     lastRun: {
-      outcome: RuleLastRunOutcomeValues[2],
+      outcome,
+      outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
       warning: getReasonFromError(error),
       outcomeMsg: esErrorMessage ? [esErrorMessage] : null,
       alertsCount: {},
@@ -104,5 +107,6 @@ export const lastRunToRaw = (lastRun: ILastRun['lastRun']): RawRuleLastRun => {
     },
     warning: warning ?? null,
     outcomeMsg: outcomeMsg && !Array.isArray(outcomeMsg) ? [outcomeMsg] : outcomeMsg,
+    outcomeOrder: RuleLastRunOutcomeOrderMap[lastRun.outcome],
   };
 };
diff --git a/x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts b/x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts
index 0cc910a4af2f0..bbcb489a9597e 100644
--- a/x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts
+++ b/x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts
@@ -9,10 +9,11 @@ import { omit } from 'lodash';
 import { RuleTypeParams, SanitizedRule, RuleLastRun } from '../../types';
 
 export const rewriteRuleLastRun = (lastRun: RuleLastRun) => {
-  const { outcomeMsg, alertsCount, ...rest } = lastRun;
+  const { outcomeMsg, outcomeOrder, alertsCount, ...rest } = lastRun;
   return {
     alerts_count: alertsCount,
     outcome_msg: outcomeMsg,
+    outcome_order: outcomeOrder,
     ...rest,
   };
 };
diff --git a/x-pack/plugins/alerting/server/saved_objects/migrations/8.7/index.ts b/x-pack/plugins/alerting/server/saved_objects/migrations/8.7/index.ts
index b2bd0b01f7f61..1b49f606cb6b5 100644
--- a/x-pack/plugins/alerting/server/saved_objects/migrations/8.7/index.ts
+++ b/x-pack/plugins/alerting/server/saved_objects/migrations/8.7/index.ts
@@ -14,7 +14,7 @@ import {
   isLogThresholdRuleType,
   pipeMigrations,
 } from '../utils';
-import { RawRule } from '../../../types';
+import { RawRule, RuleLastRunOutcomeOrderMap } from '../../../types';
 
 function addGroupByToEsQueryRule(
   doc: SavedObjectUnsanitizedDoc<RawRule>
@@ -70,9 +70,29 @@ function addLogViewRefToLogThresholdRule(
   return doc;
 }
 
+function addOutcomeOrder(
+  doc: SavedObjectUnsanitizedDoc<RawRule>
+): SavedObjectUnsanitizedDoc<RawRule> {
+  if (!doc.attributes.lastRun) {
+    return doc;
+  }
+
+  const outcome = doc.attributes.lastRun.outcome;
+  return {
+    ...doc,
+    attributes: {
+      ...doc.attributes,
+      lastRun: {
+        ...doc.attributes.lastRun,
+        outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
+      },
+    },
+  };
+}
+
 export const getMigrations870 = (encryptedSavedObjects: EncryptedSavedObjectsPluginSetup) =>
   createEsoMigration(
     encryptedSavedObjects,
     (doc: SavedObjectUnsanitizedDoc<RawRule>): doc is SavedObjectUnsanitizedDoc<RawRule> => true,
-    pipeMigrations(addGroupByToEsQueryRule, addLogViewRefToLogThresholdRule)
+    pipeMigrations(addGroupByToEsQueryRule, addLogViewRefToLogThresholdRule, addOutcomeOrder)
   );
diff --git a/x-pack/plugins/alerting/server/saved_objects/migrations/index.test.ts b/x-pack/plugins/alerting/server/saved_objects/migrations/index.test.ts
index 5043cad69b696..7ecf7596259fa 100644
--- a/x-pack/plugins/alerting/server/saved_objects/migrations/index.test.ts
+++ b/x-pack/plugins/alerting/server/saved_objects/migrations/index.test.ts
@@ -2606,6 +2606,28 @@ describe('successful migrations', () => {
         expect(migratedAlert870.references).toEqual([]);
       });
     });
+
+    test('migrates last run outcome order', () => {
+      const migration870 = getMigrations(encryptedSavedObjectsSetup, {}, isPreconfigured)['8.7.0'];
+
+      // Failed rule
+      const failedRule = getMockData({ lastRun: { outcome: 'failed' } });
+      const failedRule870 = migration870(failedRule, migrationContext);
+      expect(failedRule870.attributes.lastRun).toEqual({ outcome: 'failed', outcomeOrder: 20 });
+
+      // Rule with warnings
+      const warningRule = getMockData({ lastRun: { outcome: 'warning' } });
+      const warningRule870 = migration870(warningRule, migrationContext);
+      expect(warningRule870.attributes.lastRun).toEqual({ outcome: 'warning', outcomeOrder: 10 });
+
+      // Succeeded rule
+      const succeededRule = getMockData({ lastRun: { outcome: 'succeeded' } });
+      const succeededRule870 = migration870(succeededRule, migrationContext);
+      expect(succeededRule870.attributes.lastRun).toEqual({
+        outcome: 'succeeded',
+        outcomeOrder: 0,
+      });
+    });
   });
 
   describe('Metrics Inventory Threshold rule', () => {
diff --git a/x-pack/plugins/alerting/server/task_runner/fixtures.ts b/x-pack/plugins/alerting/server/task_runner/fixtures.ts
index 7784247ca75f3..7acb36c34bd9c 100644
--- a/x-pack/plugins/alerting/server/task_runner/fixtures.ts
+++ b/x-pack/plugins/alerting/server/task_runner/fixtures.ts
@@ -6,7 +6,14 @@
  */
 
 import { TaskStatus } from '@kbn/task-manager-plugin/server';
-import { Rule, RuleTypeParams, RecoveredActionGroup, RuleMonitoring } from '../../common';
+import {
+  Rule,
+  RuleTypeParams,
+  RecoveredActionGroup,
+  RuleMonitoring,
+  RuleLastRunOutcomeOrderMap,
+  RuleLastRunOutcomes,
+} from '../../common';
 import { getDefaultMonitoring } from '../lib/monitoring';
 import { UntypedNormalizedRuleType } from '../rule_type_registry';
 import { EVENT_LOG_ACTIONS } from '../plugin';
@@ -74,7 +81,7 @@ export const generateSavedObjectParams = ({
   error?: null | { reason: string; message: string };
   warning?: null | { reason: string; message: string };
   status?: string;
-  outcome?: string;
+  outcome?: RuleLastRunOutcomes;
   nextRun?: string | null;
   successRatio?: number;
   history?: RuleMonitoring['run']['history'];
@@ -110,6 +117,7 @@ export const generateSavedObjectParams = ({
     },
     lastRun: {
       outcome,
+      outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
       outcomeMsg:
         (error?.message && [error?.message]) || (warning?.message && [warning?.message]) || null,
       warning: error?.reason || warning?.reason || null,
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
index d840a9397e248..8b7284bb8ffd4 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
@@ -279,7 +279,7 @@ describe('Task Runner', () => {
     );
     expect(logger.debug).nthCalledWith(
       3,
-      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":0,"new":0,"recovered":0,"ignored":0}}'
+      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":0,"new":0,"recovered":0,"ignored":0}}'
     );
     expect(logger.debug).nthCalledWith(
       4,
@@ -360,7 +360,7 @@ describe('Task Runner', () => {
       );
       expect(logger.debug).nthCalledWith(
         4,
-        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":1,"recovered":0,"ignored":0}}'
+        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":1,"recovered":0,"ignored":0}}'
       );
       expect(logger.debug).nthCalledWith(
         5,
@@ -447,7 +447,7 @@ describe('Task Runner', () => {
     );
     expect(logger.debug).nthCalledWith(
       5,
-      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":1,"recovered":0,"ignored":0}}'
+      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":1,"recovered":0,"ignored":0}}'
     );
     expect(logger.debug).nthCalledWith(
       6,
@@ -627,7 +627,7 @@ describe('Task Runner', () => {
       );
       expect(logger.debug).nthCalledWith(
         5,
-        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":2,"new":2,"recovered":0,"ignored":0}}'
+        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":2,"new":2,"recovered":0,"ignored":0}}'
       );
       expect(logger.debug).nthCalledWith(
         6,
@@ -1066,7 +1066,7 @@ describe('Task Runner', () => {
       );
       expect(logger.debug).nthCalledWith(
         5,
-        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":0,"recovered":1,"ignored":0}}'
+        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":0,"recovered":1,"ignored":0}}'
       );
       expect(logger.debug).nthCalledWith(
         6,
@@ -1192,7 +1192,7 @@ describe('Task Runner', () => {
       );
       expect(logger.debug).nthCalledWith(
         5,
-        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":0,"recovered":1,"ignored":0}}'
+        'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":1,"new":0,"recovered":1,"ignored":0}}'
       );
       expect(logger.debug).nthCalledWith(
         6,
@@ -2330,7 +2330,7 @@ describe('Task Runner', () => {
     );
     expect(logger.debug).nthCalledWith(
       3,
-      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeMsg":null,"warning":null,"alertsCount":{"active":0,"new":0,"recovered":0,"ignored":0}}'
+      'ruleRunStatus for test:1: {"outcome":"succeeded","outcomeOrder":0,"outcomeMsg":null,"warning":null,"alertsCount":{"active":0,"new":0,"recovered":0,"ignored":0}}'
     );
     expect(logger.debug).nthCalledWith(
       4,
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
index 489b633569333..f0727024d277f 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -45,6 +45,7 @@ import {
   RuleTypeState,
   parseDuration,
   RawAlertInstance,
+  RuleLastRunOutcomeOrderMap,
 } from '../../common';
 import { NormalizedRuleType, UntypedNormalizedRuleType } from '../rule_type_registry';
 import { getEsErrorMessage } from '../lib/errors';
@@ -825,10 +826,12 @@ export class TaskRunner<
     this.logger.debug(
       `Updating rule task for ${this.ruleType.id} rule with id ${ruleId} - execution error due to timeout`
     );
+    const outcome = 'failed';
     await this.updateRuleSavedObjectPostRun(ruleId, namespace, {
       executionStatus: ruleExecutionStatusToRaw(executionStatus),
       lastRun: {
-        outcome: 'failed',
+        outcome,
+        outcomeOrder: RuleLastRunOutcomeOrderMap[outcome],
         warning: RuleExecutionStatusErrorReasons.Timeout,
         outcomeMsg,
         alertsCount: {},
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner_cancel.test.ts b/x-pack/plugins/alerting/server/task_runner/task_runner_cancel.test.ts
index 6c094d330bf16..84ee0f101d8b8 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner_cancel.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner_cancel.test.ts
@@ -235,6 +235,7 @@ describe('Task Runner Cancel', () => {
           outcomeMsg: [
             'test:1: execution cancelled due to timeout - exceeded rule type timeout of 5m',
           ],
+          outcomeOrder: 20,
           warning: 'timeout',
         },
         monitoring: {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.test.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.test.ts
index 67a3d045d746d..d0fc36831ad23 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.test.ts
@@ -29,7 +29,7 @@ describe('Find rules request schema', () => {
     const payload: FindRulesRequestQuery = {
       per_page: 5,
       page: 1,
-      sort_field: 'some field',
+      sort_field: 'name',
       fields: ['field 1', 'field 2'],
       filter: 'some filter',
       sort_order: 'asc',
@@ -80,14 +80,14 @@ describe('Find rules request schema', () => {
 
   test('sort_field validates', () => {
     const payload: FindRulesRequestQuery = {
-      sort_field: 'value',
+      sort_field: 'name',
     };
 
     const decoded = FindRulesRequestQuery.decode(payload);
     const checked = exactCheck(payload, decoded);
     const message = pipe(checked, foldLeftRight);
     expect(getPaths(left(message.errors))).toEqual([]);
-    expect((message.schema as FindRulesRequestQuery).sort_field).toEqual('value');
+    expect((message.schema as FindRulesRequestQuery).sort_field).toEqual('name');
   });
 
   test('fields validates with a string', () => {
@@ -173,7 +173,7 @@ describe('Find rules request schema', () => {
   test('sort_order validates with desc and sort_field', () => {
     const payload: FindRulesRequestQuery = {
       sort_order: 'desc',
-      sort_field: 'some field',
+      sort_field: 'name',
     };
 
     const decoded = FindRulesRequestQuery.decode(payload);
@@ -187,7 +187,7 @@ describe('Find rules request schema', () => {
   test('sort_order does not validate with a string other than asc and desc', () => {
     const payload: Omit<FindRulesRequestQuery, 'sort_order'> & { sort_order: string } = {
       sort_order: 'some other string',
-      sort_field: 'some field',
+      sort_field: 'name',
     };
 
     const decoded = FindRulesRequestQuery.decode(payload);
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.ts
index 9b321d443b2de..08d05a54a5753 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema.ts
@@ -8,7 +8,28 @@
 import * as t from 'io-ts';
 import { DefaultPerPage, DefaultPage } from '@kbn/securitysolution-io-ts-alerting-types';
 import type { PerPage, Page } from '../../../../schemas/common';
-import { queryFilter, fields, SortField, SortOrder } from '../../../../schemas/common';
+import { queryFilter, fields, SortOrder } from '../../../../schemas/common';
+
+export type FindRulesSortField = t.TypeOf<typeof FindRulesSortField>;
+export const FindRulesSortField = t.union([
+  t.literal('created_at'),
+  t.literal('createdAt'), // Legacy notation, keeping for backwards compatibility
+  t.literal('enabled'),
+  t.literal('execution_summary.last_execution.date'),
+  t.literal('execution_summary.last_execution.metrics.execution_gap_duration_s'),
+  t.literal('execution_summary.last_execution.metrics.total_indexing_duration_ms'),
+  t.literal('execution_summary.last_execution.metrics.total_search_duration_ms'),
+  t.literal('execution_summary.last_execution.status'),
+  t.literal('name'),
+  t.literal('risk_score'),
+  t.literal('riskScore'), // Legacy notation, keeping for backwards compatibility
+  t.literal('severity'),
+  t.literal('updated_at'),
+  t.literal('updatedAt'), // Legacy notation, keeping for backwards compatibility
+]);
+
+export type FindRulesSortFieldOrUndefined = t.TypeOf<typeof FindRulesSortFieldOrUndefined>;
+export const FindRulesSortFieldOrUndefined = t.union([FindRulesSortField, t.undefined]);
 
 /**
  * Query string parameters of the API route.
@@ -18,7 +39,7 @@ export const FindRulesRequestQuery = t.exact(
   t.partial({
     fields,
     filter: queryFilter,
-    sort_field: SortField,
+    sort_field: FindRulesSortField,
     sort_order: SortOrder,
     page: DefaultPage, // defaults to 1
     per_page: DefaultPerPage, // defaults to 20
diff --git a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema_validation.test.ts b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema_validation.test.ts
index 862bf7cc1a350..6d0cd10b21700 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema_validation.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/find_rules/request_schema_validation.test.ts
@@ -18,7 +18,7 @@ describe('Find rules request schema, additional validation', () => {
 
     test('You can have both a sort_field and and a sort_order', () => {
       const schema: FindRulesRequestQuery = {
-        sort_field: 'some field',
+        sort_field: 'name',
         sort_order: 'asc',
       };
       const errors = validateFindRulesRequestQuery(schema);
@@ -27,7 +27,7 @@ describe('Find rules request schema, additional validation', () => {
 
     test('You cannot have sort_field without sort_order', () => {
       const schema: FindRulesRequestQuery = {
-        sort_field: 'some field',
+        sort_field: 'name',
       };
       const errors = validateFindRulesRequestQuery(schema);
       expect(errors).toEqual([
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/sorting.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/sorting.ts
index 2cf1712e5ffbc..8aa8cf2831ea1 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/sorting.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/sorting.ts
@@ -9,12 +9,6 @@ import * as t from 'io-ts';
 import type { Either } from 'fp-ts/lib/Either';
 import { capitalize } from 'lodash';
 
-export type SortField = t.TypeOf<typeof SortField>;
-export const SortField = t.string;
-
-export type SortFieldOrUndefined = t.TypeOf<typeof SortFieldOrUndefined>;
-export const SortFieldOrUndefined = t.union([SortField, t.undefined]);
-
 export type SortOrder = t.TypeOf<typeof SortOrder>;
 export const SortOrder = t.keyof({ asc: null, desc: null });
 
diff --git a/x-pack/plugins/security_solution/public/common/lib/apm/user_actions.ts b/x-pack/plugins/security_solution/public/common/lib/apm/user_actions.ts
index 44703b4f5707c..64c11e06ae8d1 100644
--- a/x-pack/plugins/security_solution/public/common/lib/apm/user_actions.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/apm/user_actions.ts
@@ -30,8 +30,6 @@ export const RULES_TABLE_ACTIONS = {
   REFRESH: `${APP_UI_ID} rulesTable refresh`,
   FILTER: `${APP_UI_ID} rulesTable filter`,
   LOAD_PREBUILT: `${APP_UI_ID} rulesTable loadPrebuilt`,
-  PREVIEW_ON: `${APP_UI_ID} rulesTable technicalPreview on`,
-  PREVIEW_OFF: `${APP_UI_ID} rulesTable technicalPreview off`,
 };
 
 export const TIMELINE_ACTIONS = {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_options/index.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_options/index.test.tsx
index fe65b3ce0384e..6515d8f5243e3 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_options/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_options/index.test.tsx
@@ -10,17 +10,15 @@ import { mountWithIntl } from '@kbn/test-jest-helpers';
 
 import { ExceptionsAddToRulesOptions } from '.';
 import { TestProviders } from '../../../../../common/mock';
-import { useFindRulesInMemory } from '../../../../rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory';
+import { useFindRules } from '../../../../rule_management/logic/use_find_rules';
 import { getRulesSchemaMock } from '../../../../../../common/detection_engine/rule_schema/mocks';
 import type { Rule } from '../../../../rule_management/logic/types';
 
-jest.mock(
-  '../../../../rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory'
-);
+jest.mock('../../../../rule_management/logic/use_find_rules');
 
 describe('ExceptionsAddToRulesOptions', () => {
   beforeEach(() => {
-    (useFindRulesInMemory as jest.Mock).mockReturnValue({
+    (useFindRules as jest.Mock).mockReturnValue({
       data: {
         rules: [getRulesSchemaMock(), { ...getRulesSchemaMock(), id: '345', name: 'My rule' }],
         total: 0,
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_table/index.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_table/index.test.tsx
index 7d56fcc298f90..4be59efe2e927 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_table/index.test.tsx
@@ -10,18 +10,15 @@ import { mountWithIntl } from '@kbn/test-jest-helpers';
 
 import { ExceptionsAddToRulesTable } from '.';
 import { TestProviders } from '../../../../../common/mock';
-import { useFindRulesInMemory } from '../../../../rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory';
+import { useFindRules } from '../../../../rule_management/logic/use_find_rules';
 import { getRulesSchemaMock } from '../../../../../../common/detection_engine/rule_schema/mocks';
 import type { Rule } from '../../../../rule_management/logic/types';
 
-jest.mock(
-  '../../../../rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory'
-);
-// TODO convert this test to RTL
+jest.mock('../../../../rule_management/logic/use_find_rules');
 
 describe('ExceptionsAddToRulesTable', () => {
   it('it displays loading state while fetching rules', () => {
-    (useFindRulesInMemory as jest.Mock).mockReturnValue({
+    (useFindRules as jest.Mock).mockReturnValue({
       data: { rules: [], total: 0 },
       isFetched: false,
     });
@@ -37,7 +34,7 @@ describe('ExceptionsAddToRulesTable', () => {
   });
 
   it.skip('it displays fetched rules', () => {
-    (useFindRulesInMemory as jest.Mock).mockReturnValue({
+    (useFindRules as jest.Mock).mockReturnValue({
       data: {
         rules: [getRulesSchemaMock(), { ...getRulesSchemaMock(), id: '345', name: 'My rule' }],
         total: 0,
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_table/use_add_to_rules_table.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_table/use_add_to_rules_table.tsx
index dc37a480afcd4..e18cc71802c31 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_table/use_add_to_rules_table.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/add_to_rules_table/use_add_to_rules_table.tsx
@@ -15,10 +15,10 @@ import { i18n } from '@kbn/i18n';
 import * as myI18n from './translations';
 import * as commonI18n from '../translations';
 
-import { useFindRulesInMemory } from '../../../../rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory';
 import type { Rule } from '../../../../rule_management/logic/types';
 import { getRulesTableColumn } from '../utils';
 import { LinkRuleSwitch } from './link_rule_switch';
+import { useFindRules } from '../../../../rule_management/logic/use_find_rules';
 
 export interface ExceptionsAddToRulesComponentProps {
   initiallySelectedRules?: Rule[];
@@ -28,8 +28,7 @@ export const useAddToRulesTable = ({
   initiallySelectedRules,
   onRuleSelectionChange,
 }: ExceptionsAddToRulesComponentProps) => {
-  const { data: { rules } = { rules: [], total: 0 }, isFetched } = useFindRulesInMemory({
-    isInMemorySorting: true,
+  const { data: { rules } = { rules: [], total: 0 }, isFetched } = useFindRules({
     filterOptions: {
       filter: '',
       showCustomRules: false,
@@ -38,7 +37,6 @@ export const useAddToRulesTable = ({
     },
     sortingOptions: undefined,
     pagination: undefined,
-    refetchInterval: false,
   });
 
   const [pagination, setPagination] = useState({
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts
index a1d59efa4c30a..fe111c13debec 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts
@@ -287,7 +287,7 @@ describe('Detections Rules API', () => {
           tags: ['hello', 'world'],
         },
         sortingOptions: {
-          field: 'updated_at',
+          field: 'updatedAt',
           order: 'desc',
         },
         signal: abortCtrl.signal,
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts
index aec165167db59..87334a121c993 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { camelCase } from 'lodash';
 import type {
   CreateRuleExceptionListItemSchema,
   ExceptionListItemSchema,
@@ -152,15 +151,10 @@ export const fetchRules = async ({
 }: FetchRulesProps): Promise<FetchRulesResponse> => {
   const filterString = convertRulesFilterToKQL(filterOptions);
 
-  // Sort field is camel cased because we use that in our mapping, but display snake case on the front end
-  const getFieldNameForSortField = (field: string) => {
-    return field === 'name' ? `${field}.keyword` : camelCase(field);
-  };
-
   const query = {
     page: pagination.page,
     per_page: pagination.perPage,
-    sort_field: getFieldNameForSortField(sortingOptions.field),
+    sort_field: sortingOptions.field,
     sort_order: sortingOptions.order,
     ...(filterString !== '' ? { filter: filterString } : {}),
   };
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/types.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/types.ts
index 246a000356761..1eadf14b02b8c 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/types.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/types.ts
@@ -73,6 +73,7 @@ import {
 } from '../../../../common/detection_engine/rule_schema';
 
 import type { PatchRuleRequestBody } from '../../../../common/detection_engine/rule_management';
+import { FindRulesSortField } from '../../../../common/detection_engine/rule_management';
 import type {
   RuleCreateProps,
   RuleUpdateProps,
@@ -217,25 +218,9 @@ export interface FetchRulesProps {
   signal?: AbortSignal;
 }
 
-export type RulesSortingFields = t.TypeOf<typeof RulesSortingFields>;
-export const RulesSortingFields = t.union([
-  t.literal('created_at'),
-  t.literal('enabled'),
-  t.literal('execution_summary.last_execution.date'),
-  t.literal('execution_summary.last_execution.metrics.execution_gap_duration_s'),
-  t.literal('execution_summary.last_execution.metrics.total_indexing_duration_ms'),
-  t.literal('execution_summary.last_execution.metrics.total_search_duration_ms'),
-  t.literal('execution_summary.last_execution.status'),
-  t.literal('name'),
-  t.literal('risk_score'),
-  t.literal('severity'),
-  t.literal('updated_at'),
-  t.literal('version'),
-]);
-
 export type SortingOptions = t.TypeOf<typeof SortingOptions>;
 export const SortingOptions = t.type({
-  field: RulesSortingFields,
+  field: FindRulesSortField,
   order: SortOrder,
 });
 
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_find_rules.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_find_rules.ts
index 653f1de8e3b3f..df8a79aaafcbc 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_find_rules.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_find_rules.ts
@@ -27,7 +27,12 @@ export interface RulesQueryData {
  */
 export const useFindRules = (
   requestArgs: FindRulesQueryArgs,
-  options: UseQueryOptions<RulesQueryData, Error, RulesQueryData, [...string[], FindRulesQueryArgs]>
+  options?: UseQueryOptions<
+    RulesQueryData,
+    Error,
+    RulesQueryData,
+    [...string[], FindRulesQueryArgs]
+  >
 ) => {
   const { addError } = useAppToasts();
 
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/__mocks__/rules_table_context.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/__mocks__/rules_table_context.tsx
index 1a03370ea5915..688b90c860ceb 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/__mocks__/rules_table_context.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/__mocks__/rules_table_context.tsx
@@ -32,7 +32,6 @@ export const useRulesTableContextMock = {
       isAllSelected: false,
       isFetched: true,
       isFetching: false,
-      isInMemorySorting: false,
       isLoading: false,
       isRefetching: false,
       isRefreshOn: true,
@@ -46,7 +45,6 @@ export const useRulesTableContextMock = {
       reFetchRules: jest.fn(),
       setFilterOptions: jest.fn(),
       setIsAllSelected: jest.fn(),
-      setIsInMemorySorting: jest.fn(),
       setIsRefreshOn: jest.fn(),
       setLoadingRules: jest.fn(),
       setPage: jest.fn(),
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.test.tsx
index 552ca7b0cbd88..cb2eb08c5381b 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.test.tsx
@@ -9,6 +9,7 @@ import { renderHook } from '@testing-library/react-hooks';
 import type { PropsWithChildren } from 'react';
 import React from 'react';
 import { useUiSetting$ } from '../../../../../common/lib/kibana';
+import { useFindRules } from '../../../../rule_management/logic/use_find_rules';
 import type { RulesTableState } from './rules_table_context';
 import { RulesTableContextProvider, useRulesTableContext } from './rules_table_context';
 import {
@@ -18,17 +19,16 @@ import {
   DEFAULT_SORTING_OPTIONS,
 } from './rules_table_defaults';
 import { RuleSource } from './rules_table_saved_state';
-import { useFindRulesInMemory } from './use_find_rules_in_memory';
 import { useRulesTableSavedState } from './use_rules_table_saved_state';
 
 jest.mock('../../../../../common/lib/kibana');
-jest.mock('./use_find_rules_in_memory');
+jest.mock('../../../../rule_management/logic/use_find_rules');
 jest.mock('./use_rules_table_saved_state');
 
 function renderUseRulesTableContext(
   savedState: ReturnType<typeof useRulesTableSavedState>
 ): RulesTableState {
-  (useFindRulesInMemory as jest.Mock).mockReturnValue({
+  (useFindRules as jest.Mock).mockReturnValue({
     data: { rules: [], total: 0 },
     refetch: jest.fn(),
     dataUpdatedAt: 0,
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.tsx
index 5667b544b7b72..f6ec9a3714f66 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/rules_table_context.tsx
@@ -5,38 +5,37 @@
  * 2.0.
  */
 
+import { isEqual } from 'lodash';
 import React, {
   createContext,
   useCallback,
   useContext,
   useEffect,
   useMemo,
-  useState,
   useRef,
+  useState,
 } from 'react';
-import { isEqual } from 'lodash';
 import { DEFAULT_RULES_TABLE_REFRESH_SETTING } from '../../../../../../common/constants';
 import { invariant } from '../../../../../../common/utils/invariant';
-import { useReplaceUrlParams } from '../../../../../common/utils/global_query_string/helpers';
-import { useKibana, useUiSetting$ } from '../../../../../common/lib/kibana';
 import { URL_PARAM_KEY } from '../../../../../common/hooks/use_url_state';
+import { useKibana, useUiSetting$ } from '../../../../../common/lib/kibana';
+import { useReplaceUrlParams } from '../../../../../common/utils/global_query_string/helpers';
 import type {
   FilterOptions,
   PaginationOptions,
   Rule,
   SortingOptions,
 } from '../../../../rule_management/logic/types';
+import { useFindRules } from '../../../../rule_management/logic/use_find_rules';
+import { RULES_TABLE_STATE_STORAGE_KEY } from '../constants';
 import {
+  DEFAULT_FILTER_OPTIONS,
   DEFAULT_PAGE,
   DEFAULT_RULES_PER_PAGE,
-  DEFAULT_FILTER_OPTIONS,
   DEFAULT_SORTING_OPTIONS,
 } from './rules_table_defaults';
 import { RuleSource } from './rules_table_saved_state';
-import { useFindRulesInMemory } from './use_find_rules_in_memory';
 import { useRulesTableSavedState } from './use_rules_table_saved_state';
-import { getRulesComparator } from './utils';
-import { RULES_TABLE_STATE_STORAGE_KEY } from '../constants';
 
 export interface RulesTableState {
   /**
@@ -63,10 +62,6 @@ export interface RulesTableState {
    * Is true whenever a request is in-flight, which includes initial loading as well as background refetches.
    */
   isFetching: boolean;
-  /**
-   * Is true when we store and sort all rules in-memory.
-   */
-  isInMemorySorting: boolean;
   /**
    * Is true then there is no cached data and the query is currently fetching.
    */
@@ -129,10 +124,9 @@ export interface LoadingRules {
 }
 
 export interface RulesTableActions {
-  reFetchRules: ReturnType<typeof useFindRulesInMemory>['refetch'];
+  reFetchRules: ReturnType<typeof useFindRules>['refetch'];
   setFilterOptions: (newFilter: Partial<FilterOptions>) => void;
   setIsAllSelected: React.Dispatch<React.SetStateAction<boolean>>;
-  setIsInMemorySorting: (value: boolean) => void;
   setIsPreflightInProgress: React.Dispatch<React.SetStateAction<boolean>>;
   /**
    * enable/disable rules table auto refresh
@@ -169,24 +163,19 @@ interface RulesTableContextProviderProps {
   children: React.ReactNode;
 }
 
-const IN_MEMORY_STORAGE_KEY = 'detection-rules-table-in-memory';
-
 export const RulesTableContextProvider = ({ children }: RulesTableContextProviderProps) => {
   const [autoRefreshSettings] = useUiSetting$<{
     on: boolean;
     value: number;
     idleTimeout: number;
   }>(DEFAULT_RULES_TABLE_REFRESH_SETTING);
-  const { storage, sessionStorage } = useKibana().services;
+  const { sessionStorage } = useKibana().services;
   const {
     filter: savedFilter,
     sorting: savedSorting,
     pagination: savedPagination,
   } = useRulesTableSavedState();
 
-  const [isInMemorySorting, setIsInMemorySorting] = useState<boolean>(
-    storage.get(IN_MEMORY_STORAGE_KEY) ?? false
-  );
   const [filterOptions, setFilterOptions] = useState<FilterOptions>({
     filter: savedFilter?.searchTerm ?? DEFAULT_FILTER_OPTIONS.filter,
     tags: savedFilter?.tags ?? DEFAULT_FILTER_OPTIONS.tags,
@@ -200,6 +189,7 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
     field: savedSorting?.field ?? DEFAULT_SORTING_OPTIONS.field,
     order: savedSorting?.order ?? DEFAULT_SORTING_OPTIONS.order,
   });
+
   const [isAllSelected, setIsAllSelected] = useState(false);
   const [isRefreshOn, setIsRefreshOn] = useState(autoRefreshSettings.on);
   const [loadingRules, setLoadingRules] = useState<LoadingRules>({
@@ -212,19 +202,6 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
   const [selectedRuleIds, setSelectedRuleIds] = useState<string[]>([]);
   const autoRefreshBeforePause = useRef<boolean | null>(null);
 
-  const toggleInMemorySorting = useCallback(
-    (value: boolean) => {
-      setIsInMemorySorting(value); // Update state so the table gets re-rendered
-      storage.set(IN_MEMORY_STORAGE_KEY, value); // Persist new value in the local storage
-
-      // Reset sorting options when switching to server-side implementation as currently selected sorting might not be supported
-      if (value === false) {
-        setSortingOptions(DEFAULT_SORTING_OPTIONS);
-      }
-    },
-    [storage]
-  );
-
   const isActionInProgress = loadingRules.ids.length > 0;
 
   const pagination = useMemo(() => ({ page, perPage }), [page, perPage]);
@@ -285,25 +262,23 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
     isFetching,
     isLoading,
     isRefetching,
-  } = useFindRulesInMemory({
-    isInMemorySorting,
-    filterOptions,
-    sortingOptions,
-    pagination,
-    refetchInterval: isRefreshOn && !isActionInProgress && autoRefreshSettings.value,
-  });
-
-  // Paginate and sort rules
-  const rulesToDisplay = isInMemorySorting
-    ? rules.sort(getRulesComparator(sortingOptions)).slice((page - 1) * perPage, page * perPage)
-    : rules;
+  } = useFindRules(
+    {
+      filterOptions,
+      sortingOptions,
+      pagination,
+    },
+    {
+      refetchInterval: isRefreshOn && !isActionInProgress && autoRefreshSettings.value,
+      keepPreviousData: true, // Use this option so that the state doesn't jump between "success" and "loading" on page change
+    }
+  );
 
   const actions = useMemo(
     () => ({
       reFetchRules: refetch,
       setFilterOptions: handleFilterOptionsChange,
       setIsAllSelected,
-      setIsInMemorySorting: toggleInMemorySorting,
       setIsRefreshOn,
       setLoadingRules,
       setPage,
@@ -318,7 +293,6 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
       refetch,
       handleFilterOptionsChange,
       setIsAllSelected,
-      toggleInMemorySorting,
       setIsRefreshOn,
       setLoadingRules,
       setPage,
@@ -334,7 +308,7 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
   const providerValue = useMemo(
     () => ({
       state: {
-        rules: rulesToDisplay,
+        rules,
         pagination: {
           page,
           perPage,
@@ -346,7 +320,6 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
         isAllSelected,
         isFetched,
         isFetching,
-        isInMemorySorting,
         isLoading,
         isRefetching,
         isRefreshOn,
@@ -358,17 +331,15 @@ export const RulesTableContextProvider = ({ children }: RulesTableContextProvide
         isDefault: isDefaultState(filterOptions, sortingOptions, {
           page,
           perPage,
-          total: isInMemorySorting ? rules.length : total,
+          total,
         }),
       },
       actions,
     }),
     [
-      rulesToDisplay,
+      rules,
       page,
       perPage,
-      isInMemorySorting,
-      rules.length,
       total,
       filterOptions,
       isPreflightInProgress,
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory.ts
deleted file mode 100644
index c1429fddbd312..0000000000000
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/use_find_rules_in_memory.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { FindRulesQueryArgs } from '../../../../rule_management/api/hooks/use_find_rules_query';
-import { useFindRules } from '../../../../rule_management/logic/use_find_rules';
-
-interface UseFindRulesArgs extends FindRulesQueryArgs {
-  isInMemorySorting: boolean;
-  refetchInterval: number | false;
-}
-
-const MAX_RULES_PER_PAGE = 10000;
-
-/**
- * This hook is used to fetch detection rules. Under the hood, it implements a
- * "feature switch" that allows switching from an in-memory implementation to a
- * backend-based implementation on the fly.
- *
- * @param args - find rules arguments
- * @returns rules query result
- */
-export const useFindRulesInMemory = (args: UseFindRulesArgs) => {
-  const { pagination, filterOptions, sortingOptions, isInMemorySorting, refetchInterval } = args;
-
-  // Use this query result when isInMemorySorting = true
-  const allRules = useFindRules(
-    { pagination: { page: 1, perPage: MAX_RULES_PER_PAGE }, filterOptions },
-    {
-      refetchInterval,
-      enabled: isInMemorySorting,
-      keepPreviousData: true, // Use this option so that the state doesn't jump between "success" and "loading" on page change
-    }
-  );
-
-  // Use this query result when isInMemorySorting = false
-  const pagedRules = useFindRules(
-    { pagination, filterOptions, sortingOptions },
-    {
-      refetchInterval,
-      enabled: !isInMemorySorting,
-      keepPreviousData: true, // Use this option so that the state doesn't jump between "success" and "loading" on page change
-    }
-  );
-
-  return isInMemorySorting ? allRules : pagedRules;
-};
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/utils.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/utils.ts
deleted file mode 100644
index 5382a740f8213..0000000000000
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table/utils.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { get } from 'lodash';
-import type { Rule, SortingOptions } from '../../../../rule_management/logic/types';
-
-/**
- * Returns a comparator function to be used with .sort()
- *
- * @param sortingOptions SortingOptions
- */
-export function getRulesComparator(sortingOptions: SortingOptions) {
-  return (ruleA: Rule, ruleB: Rule): number => {
-    const { field, order } = sortingOptions;
-    const direction = order === 'asc' ? 1 : -1;
-
-    switch (field) {
-      case 'enabled': {
-        const a = get(ruleA, field);
-        const b = get(ruleB, field);
-
-        return compareNumbers(Number(a), Number(b), direction);
-      }
-      case 'version':
-      case 'risk_score':
-      case 'execution_summary.last_execution.metrics.execution_gap_duration_s':
-      case 'execution_summary.last_execution.metrics.total_indexing_duration_ms':
-      case 'execution_summary.last_execution.metrics.total_search_duration_ms': {
-        const a = get(ruleA, field) ?? -Infinity;
-        const b = get(ruleB, field) ?? -Infinity;
-
-        return compareNumbers(a, b, direction);
-      }
-      case 'updated_at':
-      case 'created_at':
-      case 'execution_summary.last_execution.date': {
-        const a = get(ruleA, field);
-        const b = get(ruleB, field);
-
-        return compareNumbers(
-          a == null ? 0 : new Date(a).getTime(),
-          b == null ? 0 : new Date(b).getTime(),
-          direction
-        );
-      }
-      case 'execution_summary.last_execution.status':
-      case 'severity':
-      case 'name': {
-        const a = get(ruleA, field);
-        const b = get(ruleB, field);
-        return (a || '').localeCompare(b || '') * direction;
-      }
-    }
-  };
-}
-
-/**
- * A helper to compare two numbers.
- *
- * @param a - first number
- * @param b - second number
- * @param direction - comparison direction +1 for asc or -1 for desc
- * @returns comparison result
- */
-const compareNumbers = (a: number, b: number, direction: number) => {
-  // We cannot use `return (a - b);` here as it might result in NaN if one of inputs is Infinity.
-  if (a > b) {
-    return direction;
-  } else if (a < b) {
-    return -direction;
-  }
-  return 0;
-};
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table_toolbar.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table_toolbar.tsx
index 46ab8d50998b8..562177371de58 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table_toolbar.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_table_toolbar.tsx
@@ -5,23 +5,9 @@
  * 2.0.
  */
 
-import type { EuiSwitchEvent } from '@elastic/eui';
-import { EuiSwitch, EuiToolTip } from '@elastic/eui';
-import React, { useCallback, useMemo } from 'react';
-import styled from 'styled-components';
+import React, { useMemo } from 'react';
 import { TabNavigationWithBreadcrumbs } from '../../../../common/components/navigation/tab_navigation_with_breadcrumbs';
-import { useRulesTableContext } from './rules_table/rules_table_context';
 import * as i18n from '../../../../detections/pages/detection_engine/rules/translations';
-import { RULES_TABLE_ACTIONS } from '../../../../common/lib/apm/user_actions';
-import { useStartTransaction } from '../../../../common/lib/apm/use_start_transaction';
-
-const ToolbarLayout = styled.div`
-  display: grid;
-  grid-template-columns: 1fr auto;
-  align-items: center;
-  grid-gap: 16px;
-  box-shadow: inset 0 -1px 0 ${({ theme }) => theme.eui.euiBorderColor};
-`;
 
 export enum AllRulesTabs {
   management = 'management',
@@ -29,11 +15,6 @@ export enum AllRulesTabs {
 }
 
 export const RulesTableToolbar = React.memo(() => {
-  const {
-    state: { isInMemorySorting },
-    actions: { setIsInMemorySorting },
-  } = useRulesTableContext();
-  const { startTransaction } = useStartTransaction();
   const ruleTabs = useMemo(
     () => ({
       [AllRulesTabs.management]: {
@@ -52,33 +33,7 @@ export const RulesTableToolbar = React.memo(() => {
     []
   );
 
-  const handleInMemorySwitch = useCallback(
-    (e: EuiSwitchEvent) => {
-      startTransaction({
-        name: isInMemorySorting ? RULES_TABLE_ACTIONS.PREVIEW_OFF : RULES_TABLE_ACTIONS.PREVIEW_ON,
-      });
-      setIsInMemorySorting(e.target.checked);
-    },
-    [isInMemorySorting, setIsInMemorySorting, startTransaction]
-  );
-
-  return (
-    <ToolbarLayout>
-      <TabNavigationWithBreadcrumbs navTabs={ruleTabs} />
-      <EuiToolTip content={i18n.EXPERIMENTAL_DESCRIPTION}>
-        <EuiSwitch
-          data-test-subj={
-            isInMemorySorting
-              ? 'allRulesTableTechnicalPreviewOff'
-              : 'allRulesTableTechnicalPreviewOn'
-          }
-          label={isInMemorySorting ? i18n.EXPERIMENTAL_ON : i18n.EXPERIMENTAL_OFF}
-          checked={isInMemorySorting}
-          onChange={handleInMemorySwitch}
-        />
-      </EuiToolTip>
-    </ToolbarLayout>
-  );
+  return <TabNavigationWithBreadcrumbs navTabs={ruleTabs} />;
 });
 
 RulesTableToolbar.displayName = 'RulesTableToolbar';
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_tables.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_tables.tsx
index 5d426bfc8ed7e..bbe5659e7481b 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_tables.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_tables.tsx
@@ -17,7 +17,7 @@ import { Loader } from '../../../../common/components/loader';
 import { useBoolState } from '../../../../common/hooks/use_bool_state';
 import { useValueChanged } from '../../../../common/hooks/use_value_changed';
 import { PrePackagedRulesPrompt } from '../../../../detections/components/rules/pre_packaged_rules/load_empty_prompt';
-import type { Rule, RulesSortingFields } from '../../../rule_management/logic';
+import type { Rule } from '../../../rule_management/logic';
 import * as i18n from '../../../../detections/pages/detection_engine/rules/translations';
 import type { EuiBasicTableOnChange } from '../../../../detections/pages/detection_engine/rules/types';
 import { BulkActionDryRunConfirmation } from './bulk_actions/bulk_action_dry_run_confirmation';
@@ -39,6 +39,7 @@ import { BulkActionDuplicateExceptionsConfirmation } from './bulk_actions/bulk_d
 import { useStartMlJobs } from '../../../rule_management/logic/use_start_ml_jobs';
 import { RULES_TABLE_PAGE_SIZE_OPTIONS } from './constants';
 import { useRuleManagementFilters } from '../../../rule_management/logic/use_rule_management_filters';
+import type { FindRulesSortField } from '../../../../../common/detection_engine/rule_management';
 
 const INITIAL_SORT_FIELD = 'enabled';
 
@@ -141,7 +142,7 @@ export const RulesTables = React.memo<RulesTableProps>(({ selectedTab }) => {
   const tableOnChangeCallback = useCallback(
     ({ page, sort }: EuiBasicTableOnChange) => {
       setSortingOptions({
-        field: (sort?.field as RulesSortingFields) ?? INITIAL_SORT_FIELD, // Narrowing EuiBasicTable sorting types
+        field: (sort?.field as FindRulesSortField) ?? INITIAL_SORT_FIELD, // Narrowing EuiBasicTable sorting types
         order: sort?.direction ?? 'desc',
       });
       setPage(page.index + 1);
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/use_columns.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/use_columns.tsx
index 5f7bdb2a2745c..fdc9f5f3a5b43 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/use_columns.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/use_columns.tsx
@@ -235,7 +235,6 @@ export const useRulesColumns = ({
 }: UseColumnsProps): TableColumn[] => {
   const actionsColumn = useActionsColumn({ showExceptionsDuplicateConfirmation });
   const ruleNameColumn = useRuleNameColumn();
-  const { isInMemorySorting } = useRulesTableContext().state;
   const [showRelatedIntegrations] = useUiSetting$<boolean>(SHOW_RELATED_INTEGRATIONS_SETTING);
   const enabledColumn = useEnabledColumn({
     hasCRUDPermissions,
@@ -244,7 +243,7 @@ export const useRulesColumns = ({
     startMlJobs,
   });
   const executionStatusColumn = useRuleExecutionStatusColumn({
-    sortable: !!isInMemorySorting,
+    sortable: true,
     width: '16%',
     isLoadingJobs,
     mlJobs,
@@ -290,7 +289,7 @@ export const useRulesColumns = ({
             />
           );
         },
-        sortable: !!isInMemorySorting,
+        sortable: true,
         truncateText: true,
         width: '16%',
       },
@@ -314,22 +313,6 @@ export const useRulesColumns = ({
         width: '18%',
         truncateText: true,
       },
-      {
-        field: 'version',
-        name: i18n.COLUMN_VERSION,
-        render: (value: Rule['version']) => {
-          return value == null ? (
-            getEmptyTagValue()
-          ) : (
-            <EuiText data-test-subj="version" size="s">
-              {value}
-            </EuiText>
-          );
-        },
-        sortable: !!isInMemorySorting,
-        truncateText: true,
-        width: '65px',
-      },
       enabledColumn,
       ...(hasCRUDPermissions ? [actionsColumn] : []),
     ],
@@ -338,7 +321,6 @@ export const useRulesColumns = ({
       enabledColumn,
       executionStatusColumn,
       hasCRUDPermissions,
-      isInMemorySorting,
       ruleNameColumn,
       showRelatedIntegrations,
     ]
@@ -355,7 +337,6 @@ export const useMonitoringColumns = ({
   const docLinks = useKibana().services.docLinks;
   const actionsColumn = useActionsColumn({ showExceptionsDuplicateConfirmation });
   const ruleNameColumn = useRuleNameColumn();
-  const { isInMemorySorting } = useRulesTableContext().state;
   const [showRelatedIntegrations] = useUiSetting$<boolean>(SHOW_RELATED_INTEGRATIONS_SETTING);
   const enabledColumn = useEnabledColumn({
     hasCRUDPermissions,
@@ -364,7 +345,7 @@ export const useMonitoringColumns = ({
     startMlJobs,
   });
   const executionStatusColumn = useRuleExecutionStatusColumn({
-    sortable: !!isInMemorySorting,
+    sortable: true,
     width: '12%',
     isLoadingJobs,
     mlJobs,
@@ -391,7 +372,7 @@ export const useMonitoringColumns = ({
             {value != null ? value.toFixed() : getEmptyTagValue()}
           </EuiText>
         ),
-        sortable: !!isInMemorySorting,
+        sortable: true,
         truncateText: true,
         width: '16%',
       },
@@ -408,7 +389,7 @@ export const useMonitoringColumns = ({
             {value != null ? value.toFixed() : getEmptyTagValue()}
           </EuiText>
         ),
-        sortable: !!isInMemorySorting,
+        sortable: true,
         truncateText: true,
         width: '14%',
       },
@@ -448,7 +429,7 @@ export const useMonitoringColumns = ({
             {value != null ? moment.duration(value, 'seconds').humanize() : getEmptyTagValue()}
           </EuiText>
         ),
-        sortable: !!isInMemorySorting,
+        sortable: true,
         truncateText: true,
         width: '14%',
       },
@@ -468,7 +449,7 @@ export const useMonitoringColumns = ({
             />
           );
         },
-        sortable: !!isInMemorySorting,
+        sortable: true,
         truncateText: true,
         width: '16%',
       },
@@ -481,7 +462,6 @@ export const useMonitoringColumns = ({
       enabledColumn,
       executionStatusColumn,
       hasCRUDPermissions,
-      isInMemorySorting,
       ruleNameColumn,
       showRelatedIntegrations,
     ]
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
index c71cc4cf267a4..9511138f78f34 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
@@ -46,28 +46,6 @@ export const PAGE_TITLE = i18n.translate('xpack.securitySolution.detectionEngine
   defaultMessage: 'Rules',
 });
 
-export const EXPERIMENTAL_ON = i18n.translate(
-  'xpack.securitySolution.detectionEngine.rules.experimentalOn',
-  {
-    defaultMessage: 'Advanced sorting',
-  }
-);
-
-export const EXPERIMENTAL_OFF = i18n.translate(
-  'xpack.securitySolution.detectionEngine.rules.experimentalOff',
-  {
-    defaultMessage: 'Advanced sorting',
-  }
-);
-
-export const EXPERIMENTAL_DESCRIPTION = i18n.translate(
-  'xpack.securitySolution.detectionEngine.rules.experimentalDescription',
-  {
-    defaultMessage:
-      'Turn this on to enable sorting for all table columns. You can turn it off if you encounter table performance issues.',
-  }
-);
-
 export const ADD_PAGE_TITLE = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.addPageTitle',
   {
@@ -561,13 +539,6 @@ export const COLUMN_LAST_RESPONSE = i18n.translate(
   }
 );
 
-export const COLUMN_VERSION = i18n.translate(
-  'xpack.securitySolution.detectionEngine.rules.allRules.columns.versionTitle',
-  {
-    defaultMessage: 'Version',
-  }
-);
-
 export const COLUMN_TAGS = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.allRules.columns.tagsTitle',
   {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/find_rules/route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/find_rules/route.test.ts
index e34dff9733794..76d63ddcd54b0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/find_rules/route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/find_rules/route.test.ts
@@ -67,7 +67,7 @@ describe('Find rules route', () => {
         query: {
           page: 2,
           per_page: 20,
-          sort_field: 'timestamp',
+          sort_field: 'name',
           fields: ['field1', 'field2'],
         },
       });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/search/find_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/search/find_rules.ts
index bb46831417d71..d72e3e6900be3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/search/find_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/search/find_rules.ts
@@ -6,24 +6,25 @@
  */
 
 import type { FindResult, RulesClient } from '@kbn/alerting-plugin/server';
+import type { FindRulesSortFieldOrUndefined } from '../../../../../../common/detection_engine/rule_management';
 
 import type {
   FieldsOrUndefined,
   PageOrUndefined,
   PerPageOrUndefined,
   QueryFilterOrUndefined,
-  SortFieldOrUndefined,
   SortOrderOrUndefined,
 } from '../../../../../../common/detection_engine/schemas/common';
 
 import type { RuleParams } from '../../../rule_schema';
 import { enrichFilterWithRuleTypeMapping } from './enrich_filter_with_rule_type_mappings';
+import { transformSortField } from './transform_sort_field';
 
 export interface FindRuleOptions {
   rulesClient: RulesClient;
   filter: QueryFilterOrUndefined;
   fields: FieldsOrUndefined;
-  sortField: SortFieldOrUndefined;
+  sortField: FindRulesSortFieldOrUndefined;
   sortOrder: SortOrderOrUndefined;
   page: PageOrUndefined;
   perPage: PerPageOrUndefined;
@@ -45,7 +46,7 @@ export const findRules = ({
       perPage,
       filter: enrichFilterWithRuleTypeMapping(filter),
       sortOrder,
-      sortField,
+      sortField: transformSortField(sortField),
     },
   });
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/search/transform_sort_field.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/search/transform_sort_field.ts
new file mode 100644
index 0000000000000..dc94afa07ddb0
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/search/transform_sort_field.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { FindRulesSortFieldOrUndefined } from '../../../../../../common/detection_engine/rule_management';
+import { assertUnreachable } from '../../../../../../common/utility_types';
+
+/**
+ * Transform the sort field name from the request to the Alerting framework
+ * schema.
+ *
+ * It could be a bit confusing what field is used for sorting rules as it is
+ * hidden under several layers of abstraction.
+ *
+ * Sort field as defined in the UI rule schema -> API transformation (this
+ * function) -> Alerting framework transformation -> Saved Object Client
+ * transformation -> Elasticsearch field
+ *
+ * The alerting framework applies the following transformations to the sort
+ * field:
+ * - Some sort fields like `name` are converted to `name.keyword` by the
+ *   Alerting framework automatically
+ * - Sort fields that have corresponding mapped params, like `riskScore`, will
+ *   be prefixed with `mapped_params.` and converted to a snake case
+ *   automatically. So `riskScore` will become `mapped_params.risk_score`
+ * - Other fields will be passed to the saved object client as is.
+ *
+ * Saved objects client also applies some transformations to the sort field:
+ * - First, it appends the saved object type to the sort field. So `name` will
+ *   become `alert.name`
+ * - If the sort field doesn't exist in saved object mappings, then it tries the
+ *   field without prefixes, e.g., just `name`.
+ *
+ * @param sortField Sort field parameter from the request
+ * @returns Sort field matching the Alerting framework schema
+ */
+export function transformSortField(sortField: FindRulesSortFieldOrUndefined): string | undefined {
+  if (!sortField) {
+    return undefined;
+  }
+
+  switch (sortField) {
+    // Without this conversion, rules will be sorted by the top-level SO fields.
+    // That is seldom what is expected from sorting. After conversion, the
+    // fields will be treated as `alert.updatedAt` and `alert.createdAt`
+    case 'created_at':
+      return 'createdAt';
+    case 'updated_at':
+      return 'updatedAt';
+
+    // Convert front-end representation to the field names that match the Alerting framework mappings
+    case 'execution_summary.last_execution.date':
+      return 'monitoring.run.last_run.timestamp';
+    case 'execution_summary.last_execution.metrics.execution_gap_duration_s':
+      return 'monitoring.run.last_run.metrics.gap_duration_s';
+    case 'execution_summary.last_execution.metrics.total_indexing_duration_ms':
+      return 'monitoring.run.last_run.metrics.total_indexing_duration_ms';
+    case 'execution_summary.last_execution.metrics.total_search_duration_ms':
+      return 'monitoring.run.last_run.metrics.total_search_duration_ms';
+    case 'execution_summary.last_execution.status':
+      return 'lastRun.outcomeOrder';
+
+    // Pass these fields as is. They will be converted to `alert.<field>` by the saved object client
+    case 'createdAt':
+    case 'updatedAt':
+    case 'enabled':
+    case 'name':
+      return sortField;
+
+    // Mapped fields will be converted to `mapped_params.risk_score` by the Alerting framework automatically
+    case 'riskScore':
+    case 'risk_score':
+    case 'severity':
+      return `params.${sortField}`;
+
+    default:
+      assertUnreachable(sortField);
+  }
+}
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index 3d23394419634..0e1aabfd937a5 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -28755,7 +28755,6 @@
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.ruleTitle": "Règle",
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.severityTitle": "Sévérité",
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.tagsTitle": "Balises",
-    "xpack.securitySolution.detectionEngine.rules.allRules.columns.versionTitle": "Version",
     "xpack.securitySolution.detectionEngine.rules.allRules.exportFilenameTitle": "rules_export",
     "xpack.securitySolution.detectionEngine.rules.allRules.featureTour.nextStepLabel": "Aller à l'étape suivante",
     "xpack.securitySolution.detectionEngine.rules.allRules.featureTour.previousStepLabel": "Revenir à l'étape précédente",
@@ -28779,9 +28778,6 @@
     "xpack.securitySolution.detectionEngine.rules.defineRuleTitle": "Définir la règle",
     "xpack.securitySolution.detectionEngine.rules.deleteDescription": "Supprimer",
     "xpack.securitySolution.detectionEngine.rules.editPageTitle": "Modifier",
-    "xpack.securitySolution.detectionEngine.rules.experimentalDescription": "Activez cette option pour autoriser le tri sur toutes les colonnes du tableau. Vous pouvez la désactiver si vous rencontrez des problèmes de performances dans votre tableau.",
-    "xpack.securitySolution.detectionEngine.rules.experimentalOff": "Tri avancé",
-    "xpack.securitySolution.detectionEngine.rules.experimentalOn": "Tri avancé",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.installPrebuiltRules.content": "Pour commencer, vous devez charger les règles prédéfinies d'Elastic.",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.installPrebuiltRules.title": "Charger les règles prédéfinies d'Elastic",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.nextButton": "Suivant",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index f67b34b640c98..92cab0ec41d51 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -28727,7 +28727,6 @@
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.ruleTitle": "ルール",
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.severityTitle": "深刻度",
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.tagsTitle": "タグ",
-    "xpack.securitySolution.detectionEngine.rules.allRules.columns.versionTitle": "バージョン",
     "xpack.securitySolution.detectionEngine.rules.allRules.exportFilenameTitle": "rules_export",
     "xpack.securitySolution.detectionEngine.rules.allRules.featureTour.nextStepLabel": "次のステップに進む",
     "xpack.securitySolution.detectionEngine.rules.allRules.featureTour.previousStepLabel": "前のステップに戻る",
@@ -28751,9 +28750,6 @@
     "xpack.securitySolution.detectionEngine.rules.defineRuleTitle": "ルールの定義",
     "xpack.securitySolution.detectionEngine.rules.deleteDescription": "削除",
     "xpack.securitySolution.detectionEngine.rules.editPageTitle": "編集",
-    "xpack.securitySolution.detectionEngine.rules.experimentalDescription": "オンにすると、すべてのテーブル列の並べ替えが有効になります。テーブルのパフォーマンスの問題が発生した場合は、オフにできます。",
-    "xpack.securitySolution.detectionEngine.rules.experimentalOff": "高度な並べ替え",
-    "xpack.securitySolution.detectionEngine.rules.experimentalOn": "高度な並べ替え",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.installPrebuiltRules.content": "開始するには、Elasticの構築済みルールを読み込む必要があります。",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.installPrebuiltRules.title": "Elastic事前構築済みルールを読み込む",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.nextButton": "次へ",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index c9640871ab546..67e7b522e1d1a 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -28761,7 +28761,6 @@
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.ruleTitle": "规则",
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.severityTitle": "严重性",
     "xpack.securitySolution.detectionEngine.rules.allRules.columns.tagsTitle": "标签",
-    "xpack.securitySolution.detectionEngine.rules.allRules.columns.versionTitle": "版本",
     "xpack.securitySolution.detectionEngine.rules.allRules.exportFilenameTitle": "rules_export",
     "xpack.securitySolution.detectionEngine.rules.allRules.featureTour.nextStepLabel": "前往下一步",
     "xpack.securitySolution.detectionEngine.rules.allRules.featureTour.previousStepLabel": "前往上一步",
@@ -28785,9 +28784,6 @@
     "xpack.securitySolution.detectionEngine.rules.defineRuleTitle": "定义规则",
     "xpack.securitySolution.detectionEngine.rules.deleteDescription": "删除",
     "xpack.securitySolution.detectionEngine.rules.editPageTitle": "编辑",
-    "xpack.securitySolution.detectionEngine.rules.experimentalDescription": "打开此项可为所有表列启用排序。如果遇到表性能问题，可以将其关闭。",
-    "xpack.securitySolution.detectionEngine.rules.experimentalOff": "高级排序",
-    "xpack.securitySolution.detectionEngine.rules.experimentalOn": "高级排序",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.installPrebuiltRules.content": "要开始使用，您需要加载 Elastic 预构建规则。",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.installPrebuiltRules.title": "加载 Elastic 预构建规则",
     "xpack.securitySolution.detectionEngine.rules.guidedOnboarding.nextButton": "下一步",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/common_transformations.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/common_transformations.ts
index 430ebb8c3fdf6..f8a9639bb30bd 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/common_transformations.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/common_transformations.ts
@@ -42,10 +42,12 @@ const transformExecutionStatus: RewriteRequestCase<RuleExecutionStatus> = ({
 
 const transformLastRun: RewriteRequestCase<RuleLastRun> = ({
   outcome_msg: outcomeMsg,
+  outcome_order: outcomeOrder,
   alerts_count: alertsCount,
   ...rest
 }) => ({
   outcomeMsg,
+  outcomeOrder,
   alertsCount,
   ...rest,
 });
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/clone.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/clone.ts
index 9bb87db3c7e30..e473394f26b8e 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/clone.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/clone.ts
@@ -173,6 +173,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                   },
                   outcome: 'succeeded',
                   outcome_msg: null,
+                  outcome_order: 0,
                   warning: null,
                 },
                 next_run: response.body.next_run,
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/migrations.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/migrations.ts
index 35ad717ad8096..20980f390c79b 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/migrations.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/migrations.ts
@@ -560,6 +560,7 @@ export default function createGetTests({ getService }: FtrProviderContext) {
       expect(alert?.lastRun).to.eql({
         outcome: 'succeeded',
         outcomeMsg: null,
+        outcomeOrder: 0,
         warning: null,
         alertsCount: {},
       });

From bdbf10a01dbe16f4f1e1fd99ab2e369de6d27165 Mon Sep 17 00:00:00 2001
From: Jonathan Budzenski <jon@elastic.co>
Date: Tue, 7 Feb 2023 12:49:31 -0600
Subject: [PATCH 090/134] skip flaky suite (#100951)

---
 .../__jest__/client_integration/follower_indices_list.test.js  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/cross_cluster_replication/public/__jest__/client_integration/follower_indices_list.test.js b/x-pack/plugins/cross_cluster_replication/public/__jest__/client_integration/follower_indices_list.test.js
index f5b8c48d97a67..dd62cafd3b958 100644
--- a/x-pack/plugins/cross_cluster_replication/public/__jest__/client_integration/follower_indices_list.test.js
+++ b/x-pack/plugins/cross_cluster_replication/public/__jest__/client_integration/follower_indices_list.test.js
@@ -309,7 +309,8 @@ describe('<FollowerIndicesList />', () => {
       });
     });
 
-    describe('detail panel', () => {
+    // FLAKY: https://github.com/elastic/kibana/issues/100951
+    describe.skip('detail panel', () => {
       test('should open a detail panel when clicking on a follower index', async () => {
         expect(exists('followerIndexDetail')).toBe(false);
 

From e143c8eaa67ded3b793e43b3b51e886695135817 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 7 Feb 2023 13:56:16 -0500
Subject: [PATCH 091/134] skip failing test suite (#149794)

---
 x-pack/test/fleet_api_integration/apis/epm/get.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/test/fleet_api_integration/apis/epm/get.ts b/x-pack/test/fleet_api_integration/apis/epm/get.ts
index 21b55e0dd7454..7d33b00f54c89 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/get.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/get.ts
@@ -38,7 +38,8 @@ export default function (providerContext: FtrProviderContext) {
     '../fixtures/direct_upload_packages/apache_0.1.4.zip'
   );
 
-  describe('EPM - get', () => {
+  // Failing: See https://github.com/elastic/kibana/issues/149794
+  describe.skip('EPM - get', () => {
     skipIfNoDockerRegistry(providerContext);
     setupFleetAndAgents(providerContext);
 

From 02af9280267e81bd0fad51111be73ce30a34b2df Mon Sep 17 00:00:00 2001
From: Davis McPhee <davis.mcphee@elastic.co>
Date: Tue, 7 Feb 2023 15:14:06 -0400
Subject: [PATCH 092/134] [Unified Histogram] Create layout container to manage
 Unified Histogram state (#148773)

## Summary

This PR introduces a layout container component to Unified Histogram
which removes the responsibility of state management from the consumer.
The full list of changes includes the following:
- Create a `UnifiedHistogramContainer` component which is responsible
for managing the Unified Histogram state.
- Create a `UnifiedHistogramStateService` to move state management from
React to a dedicated service consumed by the container component.
- Move the state management logic from `use_discover_histogram` to
Unified Histogram so it doesn't need to be reimplemented by each
consumer.
- Create utility functions to access and update Unified Histogram local
storage state.
- Move the edit visualization logic to Unified Histogram so it doesn't
need to be reimplemented by each consumer.
- Add documentation and example usage to the Unified Histogram readme.
- Reorganize the Unified Histogram folder structure.
- Update `useQuerySubscriber` to return the relative time range.

### Checklist

- [ ] ~Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)~
- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] ~Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard
accessibility](https://webaim.org/techniques/keyboard/))~
- [ ] ~Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))~
- [ ] ~If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~
- [ ] ~This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))~
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Julia Rechkunova <julia.rechkunova@elastic.co>
Co-authored-by: Julia Rechkunova <julia.rechkunova@gmail.com>
---
 docs/developer/plugin-list.asciidoc           |   3 +-
 .../discover/public/__mocks__/data_view.ts    |   3 +
 .../discover/public/__mocks__/services.ts     |   4 +
 .../layout/discover_histogram_layout.test.tsx |  73 +--
 .../layout/discover_histogram_layout.tsx      |  41 +-
 .../layout/discover_layout.test.tsx           |  33 +-
 .../components/layout/discover_layout.tsx     |   1 -
 .../layout/use_discover_histogram.test.tsx    | 605 +++++++-----------
 .../layout/use_discover_histogram.ts          | 435 ++++++-------
 .../main/utils/get_state_defaults.ts          |   5 +-
 src/plugins/unified_histogram/README.md       | 137 +++-
 .../public/__mocks__/data_view.ts             |   4 +
 .../__mocks__/data_view_with_timefield.ts     |   1 +
 .../public/__mocks__/services.ts              |  11 +-
 .../chart/breakdown_field_selector.test.tsx   |   4 +-
 .../public/chart/breakdown_field_selector.tsx |   2 +-
 .../public/chart/chart.test.tsx               |  24 +-
 .../unified_histogram/public/chart/chart.tsx  |  39 +-
 .../public/chart/histogram.test.tsx           |   8 +-
 .../public/chart/histogram.tsx                |   8 +-
 .../{ => hooks}/use_chart_actions.test.ts     |   2 +-
 .../chart/{ => hooks}/use_chart_actions.ts    |   2 +-
 .../{ => hooks}/use_chart_panels.test.ts      |   0
 .../chart/{ => hooks}/use_chart_panels.ts     |   2 +-
 .../chart/{ => hooks}/use_chart_styles.tsx    |   0
 .../hooks/use_edit_visualization.test.ts      | 117 ++++
 .../chart/hooks/use_edit_visualization.ts     |  67 ++
 .../chart/{ => hooks}/use_lens_props.test.ts  |   6 +-
 .../chart/{ => hooks}/use_lens_props.ts       |   2 +-
 .../chart/{ => hooks}/use_refetch.test.ts     |   4 +-
 .../public/chart/{ => hooks}/use_refetch.ts   |   4 +-
 .../{ => hooks}/use_request_params.test.ts    |   2 +-
 .../chart/{ => hooks}/use_request_params.tsx  |   2 +-
 .../{ => hooks}/use_stable_callback.test.ts   |   0
 .../chart/{ => hooks}/use_stable_callback.ts  |   4 +-
 .../chart/{ => hooks}/use_time_range.test.tsx |   2 +-
 .../chart/{ => hooks}/use_time_range.tsx      |   2 +-
 .../chart/{ => hooks}/use_total_hits.test.ts  |   4 +-
 .../chart/{ => hooks}/use_total_hits.ts       |   2 +-
 .../{ => utils}/build_bucket_interval.test.ts |   2 +-
 .../{ => utils}/build_bucket_interval.ts      |   4 +-
 .../field_supports_breakdown.test.ts          |   0
 .../{ => utils}/field_supports_breakdown.ts   |   0
 .../{ => utils}/get_chart_agg_config.test.ts  |   2 +-
 .../{ => utils}/get_chart_agg_configs.ts      |   2 +-
 .../{ => utils}/get_lens_attributes.test.ts   |   2 +-
 .../chart/{ => utils}/get_lens_attributes.ts  |   0
 .../public/container/container.test.tsx       |  85 +++
 .../public/container/container.tsx            | 172 +++++
 .../container/hooks/use_state_props.test.ts   | 265 ++++++++
 .../public/container/hooks/use_state_props.ts | 162 +++++
 .../public/{layout => container}/index.tsx    |  23 +-
 .../container/services/state_service.test.ts  | 259 ++++++++
 .../container/services/state_service.ts       | 248 +++++++
 .../utils/local_storage_utils.test.ts         |  73 +++
 .../container/utils/local_storage_utils.ts    |  73 +++
 .../public/container/utils/state_selectors.ts |  22 +
 .../container/utils/use_state_selector.ts     |  31 +
 src/plugins/unified_histogram/public/index.ts |  27 +-
 .../unified_histogram/public/layout/index.ts  |  10 +
 .../public/layout/layout.tsx                  |  19 +-
 src/plugins/unified_histogram/public/mocks.ts |  33 +
 src/plugins/unified_histogram/public/types.ts |  13 +-
 src/plugins/unified_histogram/tsconfig.json   |   2 +
 64 files changed, 2422 insertions(+), 772 deletions(-)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_chart_actions.test.ts (97%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_chart_actions.ts (96%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_chart_panels.test.ts (100%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_chart_panels.ts (98%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_chart_styles.tsx (100%)
 create mode 100644 src/plugins/unified_histogram/public/chart/hooks/use_edit_visualization.test.ts
 create mode 100644 src/plugins/unified_histogram/public/chart/hooks/use_edit_visualization.ts
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_lens_props.test.ts (92%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_lens_props.ts (98%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_refetch.test.ts (96%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_refetch.ts (97%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_request_params.test.ts (95%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_request_params.tsx (96%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_stable_callback.test.ts (100%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_stable_callback.ts (83%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_time_range.test.tsx (99%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_time_range.tsx (98%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_total_hits.test.ts (98%)
 rename src/plugins/unified_histogram/public/chart/{ => hooks}/use_total_hits.ts (99%)
 rename src/plugins/unified_histogram/public/chart/{ => utils}/build_bucket_interval.test.ts (97%)
 rename src/plugins/unified_histogram/public/chart/{ => utils}/build_bucket_interval.ts (91%)
 rename src/plugins/unified_histogram/public/chart/{ => utils}/field_supports_breakdown.test.ts (100%)
 rename src/plugins/unified_histogram/public/chart/{ => utils}/field_supports_breakdown.ts (100%)
 rename src/plugins/unified_histogram/public/chart/{ => utils}/get_chart_agg_config.test.ts (95%)
 rename src/plugins/unified_histogram/public/chart/{ => utils}/get_chart_agg_configs.ts (92%)
 rename src/plugins/unified_histogram/public/chart/{ => utils}/get_lens_attributes.test.ts (99%)
 rename src/plugins/unified_histogram/public/chart/{ => utils}/get_lens_attributes.ts (100%)
 create mode 100644 src/plugins/unified_histogram/public/container/container.test.tsx
 create mode 100644 src/plugins/unified_histogram/public/container/container.tsx
 create mode 100644 src/plugins/unified_histogram/public/container/hooks/use_state_props.test.ts
 create mode 100644 src/plugins/unified_histogram/public/container/hooks/use_state_props.ts
 rename src/plugins/unified_histogram/public/{layout => container}/index.tsx (63%)
 create mode 100644 src/plugins/unified_histogram/public/container/services/state_service.test.ts
 create mode 100644 src/plugins/unified_histogram/public/container/services/state_service.ts
 create mode 100644 src/plugins/unified_histogram/public/container/utils/local_storage_utils.test.ts
 create mode 100644 src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts
 create mode 100644 src/plugins/unified_histogram/public/container/utils/state_selectors.ts
 create mode 100644 src/plugins/unified_histogram/public/container/utils/use_state_selector.ts
 create mode 100644 src/plugins/unified_histogram/public/layout/index.ts
 create mode 100644 src/plugins/unified_histogram/public/mocks.ts

diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index 5cb8398fb9adf..3cdca29fcb49d 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -333,7 +333,8 @@ In general this plugin provides:
 
 
 |{kib-repo}blob/{branch}/src/plugins/unified_histogram/README.md[unifiedHistogram]
-|The unifiedHistogram plugin provides UI components to create a layout including a resizable histogram and a main display.
+|Unified Histogram is a UX Building Block including a layout with a resizable histogram and a main display.
+It manages its own state and data fetching, and can easily be dropped into pages with minimal setup.
 
 
 |{kib-repo}blob/{branch}/src/plugins/unified_search/README.md[unifiedSearch]
diff --git a/src/plugins/discover/public/__mocks__/data_view.ts b/src/plugins/discover/public/__mocks__/data_view.ts
index b63321674ce7b..bb57d9eb932ed 100644
--- a/src/plugins/discover/public/__mocks__/data_view.ts
+++ b/src/plugins/discover/public/__mocks__/data_view.ts
@@ -109,6 +109,9 @@ export const buildDataViewMock = ({
     getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
     isTimeNanosBased: () => false,
     isPersisted: () => true,
+    getTimeField: () => {
+      return dataViewFields.find((field) => field.name === timeFieldName);
+    },
   } as unknown as DataView;
 
   dataView.isTimeBased = () => !!timeFieldName;
diff --git a/src/plugins/discover/public/__mocks__/services.ts b/src/plugins/discover/public/__mocks__/services.ts
index 648ba828489bf..8c1b10f236e9d 100644
--- a/src/plugins/discover/public/__mocks__/services.ts
+++ b/src/plugins/discover/public/__mocks__/services.ts
@@ -51,6 +51,10 @@ export function createDiscoverServicesMock(): DiscoverServices {
   dataPlugin.query.getState = jest.fn(() => ({
     query: { query: '', language: 'lucene' },
     filters: [],
+    time: {
+      from: 'now-15m',
+      to: 'now',
+    },
   }));
   dataPlugin.dataViews = createDiscoverDataViewsMock();
 
diff --git a/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.test.tsx b/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.test.tsx
index 765e8edfcdbaf..2396325ac82cc 100644
--- a/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.test.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.test.tsx
@@ -26,18 +26,15 @@ import { buildDataTableRecord } from '../../../../utils/build_data_record';
 import { DiscoverHistogramLayout, DiscoverHistogramLayoutProps } from './discover_histogram_layout';
 import { SavedSearch, VIEW_MODE } from '@kbn/saved-search-plugin/public';
 import { CoreTheme } from '@kbn/core/public';
-import { act } from 'react-dom/test-utils';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
-import { LocalStorageMock } from '../../../../__mocks__/local_storage_mock';
-import { HISTOGRAM_HEIGHT_KEY } from './use_discover_histogram';
 import { createSearchSessionMock } from '../../../../__mocks__/search_session';
 import { RequestAdapter } from '@kbn/inspector-plugin/public';
 import { searchSourceInstanceMock } from '@kbn/data-plugin/common/search/search_source/mocks';
-import { UnifiedHistogramLayout } from '@kbn/unified-histogram-plugin/public';
 import { getSessionServiceMock } from '@kbn/data-plugin/public/search/session/mocks';
 import { ResetSearchButton } from './reset_search_button';
 import { getDiscoverStateMock } from '../../../../__mocks__/discover_state.mock';
 import { DiscoverMainProvider } from '../../services/discover_state_provider';
+import { act } from 'react-dom/test-utils';
 
 function getStateContainer() {
   const stateContainer = getDiscoverStateMock({ isTimeBased: true });
@@ -52,18 +49,19 @@ function getStateContainer() {
   return stateContainer;
 }
 
-const mountComponent = ({
+const mountComponent = async ({
   isPlainRecord = false,
-  isTimeBased = true,
   storage,
   savedSearch = savedSearchMock,
   resetSavedSearch = jest.fn(),
+  searchSessionId = '123',
 }: {
   isPlainRecord?: boolean;
   isTimeBased?: boolean;
   storage?: Storage;
   savedSearch?: SavedSearch;
   resetSavedSearch?(): void;
+  searchSessionId?: string | null;
 } = {}) => {
   let services = discoverServiceMock;
   services.data.query.timefilter.timefilter.getAbsoluteTime = () => {
@@ -114,7 +112,7 @@ const mountComponent = ({
 
   const session = getSessionServiceMock();
 
-  session.getSession$.mockReturnValue(new BehaviorSubject('123'));
+  session.getSession$.mockReturnValue(new BehaviorSubject(searchSessionId ?? undefined));
 
   const stateContainer = getStateContainer();
   stateContainer.dataState.data$ = savedSearchData$;
@@ -131,7 +129,6 @@ const mountComponent = ({
     viewMode: VIEW_MODE.DOCUMENT_LEVEL,
     onAddFilter: jest.fn(),
     resetSavedSearch,
-    isTimeBased,
     resizeRef: { current: null },
     searchSessionManager: createSearchSessionMock(session).searchSessionManager,
     inspectorAdapters: { requests: new RequestAdapter() },
@@ -149,65 +146,39 @@ const mountComponent = ({
     </KibanaContextProvider>
   );
 
+  // wait for lazy modules
+  await act(() => new Promise((resolve) => setTimeout(resolve, 0)));
+  component.update();
+
   return component;
 };
 
 describe('Discover histogram layout component', () => {
-  describe('topPanelHeight persistence', () => {
-    it('should try to get the initial topPanelHeight for UnifiedHistogramLayout from storage', async () => {
-      const storage = new LocalStorageMock({}) as unknown as Storage;
-      const originalGet = storage.get;
-      storage.get = jest.fn().mockImplementation(originalGet);
-      mountComponent({ storage });
-      expect(storage.get).toHaveBeenCalledWith(HISTOGRAM_HEIGHT_KEY);
+  describe('render', () => {
+    it('should render null if there is no search session', async () => {
+      const component = await mountComponent({ searchSessionId: null });
+      expect(component.isEmptyRender()).toBe(true);
     });
 
-    it('should pass undefined to UnifiedHistogramLayout if no value is found in storage', async () => {
-      const storage = new LocalStorageMock({}) as unknown as Storage;
-      const originalGet = storage.get;
-      storage.get = jest.fn().mockImplementation(originalGet);
-      const component = mountComponent({ storage });
-      expect(storage.get).toHaveBeenCalledWith(HISTOGRAM_HEIGHT_KEY);
-      expect(storage.get).toHaveReturnedWith(null);
-      expect(component.find(UnifiedHistogramLayout).prop('topPanelHeight')).toBe(undefined);
+    it('should not render null if there is a search session', async () => {
+      const component = await mountComponent();
+      expect(component.isEmptyRender()).toBe(false);
     });
 
-    it('should pass the stored topPanelHeight to UnifiedHistogramLayout if a value is found in storage', async () => {
-      const storage = new LocalStorageMock({}) as unknown as Storage;
-      const topPanelHeight = 123;
-      storage.get = jest.fn().mockImplementation(() => topPanelHeight);
-      const component = mountComponent({ storage });
-      expect(storage.get).toHaveBeenCalledWith(HISTOGRAM_HEIGHT_KEY);
-      expect(storage.get).toHaveReturnedWith(topPanelHeight);
-      expect(component.find(UnifiedHistogramLayout).prop('topPanelHeight')).toBe(topPanelHeight);
-    });
-
-    it('should update the topPanelHeight in storage and pass the new value to UnifiedHistogramLayout when the topPanelHeight changes', async () => {
-      const storage = new LocalStorageMock({}) as unknown as Storage;
-      const originalSet = storage.set;
-      storage.set = jest.fn().mockImplementation(originalSet);
-      const component = mountComponent({ storage });
-      const newTopPanelHeight = 123;
-      expect(component.find(UnifiedHistogramLayout).prop('topPanelHeight')).not.toBe(
-        newTopPanelHeight
-      );
-      act(() => {
-        component.find(UnifiedHistogramLayout).prop('onTopPanelHeightChange')!(newTopPanelHeight);
-      });
-      component.update();
-      expect(storage.set).toHaveBeenCalledWith(HISTOGRAM_HEIGHT_KEY, newTopPanelHeight);
-      expect(component.find(UnifiedHistogramLayout).prop('topPanelHeight')).toBe(newTopPanelHeight);
+    it('should not render null if there is no search session, but isPlainRecord is true', async () => {
+      const component = await mountComponent({ isPlainRecord: true });
+      expect(component.isEmptyRender()).toBe(false);
     });
   });
 
   describe('reset search button', () => {
     it('renders the button when there is a saved search', async () => {
-      const component = mountComponent();
+      const component = await mountComponent();
       expect(component.find(ResetSearchButton).exists()).toBe(true);
     });
 
     it('does not render the button when there is no saved search', async () => {
-      const component = mountComponent({
+      const component = await mountComponent({
         savedSearch: { ...savedSearchMock, id: undefined },
       });
       expect(component.find(ResetSearchButton).exists()).toBe(false);
@@ -215,7 +186,7 @@ describe('Discover histogram layout component', () => {
 
     it('should call resetSavedSearch when clicked', async () => {
       const resetSavedSearch = jest.fn();
-      const component = mountComponent({ resetSavedSearch });
+      const component = await mountComponent({ resetSavedSearch });
       component.find(ResetSearchButton).find('button').simulate('click');
       expect(resetSavedSearch).toHaveBeenCalled();
     });
diff --git a/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.tsx b/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.tsx
index 28a6d6c051787..68a5d8e1c7ee9 100644
--- a/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.tsx
@@ -7,9 +7,9 @@
  */
 
 import React, { RefObject } from 'react';
-import { UnifiedHistogramLayout } from '@kbn/unified-histogram-plugin/public';
+import { UnifiedHistogramContainer } from '@kbn/unified-histogram-plugin/public';
 import { css } from '@emotion/react';
-import { useDiscoverServices } from '../../../../hooks/use_discover_services';
+import useObservable from 'react-use/lib/useObservable';
 import { useDiscoverHistogram } from './use_discover_histogram';
 import type { DiscoverSearchSessionManager } from '../../services/discover_search_session';
 import type { InspectorAdapters } from '../../hooks/use_inspector';
@@ -18,68 +18,65 @@ import { ResetSearchButton } from './reset_search_button';
 
 export interface DiscoverHistogramLayoutProps extends DiscoverMainContentProps {
   resetSavedSearch: () => void;
-  isTimeBased: boolean;
   resizeRef: RefObject<HTMLDivElement>;
   inspectorAdapters: InspectorAdapters;
   searchSessionManager: DiscoverSearchSessionManager;
 }
 
+const histogramLayoutCss = css`
+  height: 100%;
+`;
+
 export const DiscoverHistogramLayout = ({
   isPlainRecord,
   dataView,
   resetSavedSearch,
   savedSearch,
   stateContainer,
-  isTimeBased,
   resizeRef,
   inspectorAdapters,
   searchSessionManager,
   ...mainContentProps
 }: DiscoverHistogramLayoutProps) => {
-  const services = useDiscoverServices();
-
   const commonProps = {
     dataView,
-    isPlainRecord,
     stateContainer,
-    savedSearch,
     savedSearchData$: stateContainer.dataState.data$,
   };
 
-  const histogramProps = useDiscoverHistogram({
-    isTimeBased,
+  const searchSessionId = useObservable(searchSessionManager.searchSessionId$);
+
+  const { hideChart, setUnifiedHistogramApi } = useDiscoverHistogram({
     inspectorAdapters,
-    searchSessionManager,
     savedSearchFetch$: stateContainer.dataState.fetch$,
+    searchSessionId,
     ...commonProps,
   });
 
-  if (!histogramProps) {
+  // Initialized when the first search has been requested or
+  // when in text-based mode since search sessions are not supported
+  if (!searchSessionId && !isPlainRecord) {
     return null;
   }
 
-  const histogramLayoutCss = css`
-    height: 100%;
-  `;
-
   return (
-    <UnifiedHistogramLayout
+    <UnifiedHistogramContainer
+      ref={setUnifiedHistogramApi}
       resizeRef={resizeRef}
-      services={services}
-      dataView={dataView}
       appendHitsCounter={
         savedSearch?.id ? <ResetSearchButton resetSavedSearch={resetSavedSearch} /> : undefined
       }
       css={histogramLayoutCss}
-      {...histogramProps}
     >
       <DiscoverMainContent
         {...commonProps}
         {...mainContentProps}
+        savedSearch={savedSearch}
+        isPlainRecord={isPlainRecord}
         // The documents grid doesn't rerender when the chart visibility changes
         // which causes it to render blank space, so we need to force a rerender
-        key={`docKey${histogramProps.chart?.hidden}`}
+        key={`docKey${hideChart}`}
       />
-    </UnifiedHistogramLayout>
+    </UnifiedHistogramContainer>
   );
 };
diff --git a/src/plugins/discover/public/application/main/components/layout/discover_layout.test.tsx b/src/plugins/discover/public/application/main/components/layout/discover_layout.test.tsx
index 13994b401b044..f14d89ead5b81 100644
--- a/src/plugins/discover/public/application/main/components/layout/discover_layout.test.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/discover_layout.test.tsx
@@ -40,10 +40,11 @@ import { getDiscoverStateMock } from '../../../../__mocks__/discover_state.mock'
 import { createSearchSessionMock } from '../../../../__mocks__/search_session';
 import { getSessionServiceMock } from '@kbn/data-plugin/public/search/session/mocks';
 import { DiscoverMainProvider } from '../../services/discover_state_provider';
+import { act } from 'react-dom/test-utils';
 
 setHeaderActionMenuMounter(jest.fn());
 
-function mountComponent(
+async function mountComponent(
   dataView: DataView,
   prevSidebarClosed?: boolean,
   mountOptions: { attachTo?: HTMLElement } = {},
@@ -57,13 +58,17 @@ function mountComponent(
       [SIDEBAR_CLOSED_KEY]: prevSidebarClosed,
     }) as unknown as Storage,
   } as unknown as DiscoverServices;
-  services.data.query.timefilter.timefilter.getTime = () => {
-    return { from: '2020-05-14T11:05:13.590', to: '2020-05-14T11:20:13.590' };
-  };
+  const time = { from: '2020-05-14T11:05:13.590', to: '2020-05-14T11:20:13.590' };
+  services.data.query.timefilter.timefilter.getTime = () => time;
   (services.data.query.queryString.getDefaultQuery as jest.Mock).mockReturnValue({
     language: 'kuery',
     query: '',
   });
+  (services.data.query.getState as jest.Mock).mockReturnValue({
+    filters: [],
+    query,
+    time,
+  });
   (searchSourceInstanceMock.fetch$ as jest.Mock).mockImplementation(
     jest.fn().mockReturnValue(of({ rawResponse: { hits: { total: 2 } } }))
   );
@@ -132,13 +137,19 @@ function mountComponent(
     mountOptions
   );
 
+  // wait for lazy modules
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+  component.update();
+
   return component;
 }
 
 describe('Discover component', () => {
   test('selected data view without time field displays no chart toggle', async () => {
     const container = document.createElement('div');
-    mountComponent(dataViewMock, undefined, { attachTo: container });
+    await mountComponent(dataViewMock, undefined, { attachTo: container });
     expect(
       container.querySelector('[data-test-subj="unifiedHistogramChartOptionsToggle"]')
     ).toBeNull();
@@ -146,7 +157,7 @@ describe('Discover component', () => {
 
   test('selected data view with time field displays chart toggle', async () => {
     const container = document.createElement('div');
-    mountComponent(dataViewWithTimefieldMock, undefined, { attachTo: container });
+    await mountComponent(dataViewWithTimefieldMock, undefined, { attachTo: container });
     expect(
       container.querySelector('[data-test-subj="unifiedHistogramChartOptionsToggle"]')
     ).not.toBeNull();
@@ -154,7 +165,7 @@ describe('Discover component', () => {
 
   test('sql query displays no chart toggle', async () => {
     const container = document.createElement('div');
-    mountComponent(
+    await mountComponent(
       dataViewWithTimefieldMock,
       false,
       { attachTo: container },
@@ -169,7 +180,7 @@ describe('Discover component', () => {
   test('the saved search title h1 gains focus on navigate', async () => {
     const container = document.createElement('div');
     document.body.appendChild(container);
-    const component = mountComponent(dataViewWithTimefieldMock, undefined, {
+    const component = await mountComponent(dataViewWithTimefieldMock, undefined, {
       attachTo: container,
     });
     expect(
@@ -179,17 +190,17 @@ describe('Discover component', () => {
 
   describe('sidebar', () => {
     test('should be opened if discover:sidebarClosed was not set', async () => {
-      const component = mountComponent(dataViewWithTimefieldMock, undefined);
+      const component = await mountComponent(dataViewWithTimefieldMock, undefined);
       expect(component.find(DiscoverSidebar).length).toBe(1);
     }, 10000);
 
     test('should be opened if discover:sidebarClosed is false', async () => {
-      const component = mountComponent(dataViewWithTimefieldMock, false);
+      const component = await mountComponent(dataViewWithTimefieldMock, false);
       expect(component.find(DiscoverSidebar).length).toBe(1);
     }, 10000);
 
     test('should be closed if discover:sidebarClosed is true', async () => {
-      const component = mountComponent(dataViewWithTimefieldMock, true);
+      const component = await mountComponent(dataViewWithTimefieldMock, true);
       expect(component.find(DiscoverSidebar).length).toBe(0);
     }, 10000);
   });
diff --git a/src/plugins/discover/public/application/main/components/layout/discover_layout.tsx b/src/plugins/discover/public/application/main/components/layout/discover_layout.tsx
index 2eec55daf742d..cb7f9c64ff625 100644
--- a/src/plugins/discover/public/application/main/components/layout/discover_layout.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/discover_layout.tsx
@@ -239,7 +239,6 @@ export function DiscoverLayout({
           setExpandedDoc={setExpandedDoc}
           savedSearch={savedSearch}
           stateContainer={stateContainer}
-          isTimeBased={isTimeBased}
           columns={currentColumns}
           viewMode={viewMode}
           onAddFilter={onAddFilter as DocViewFilterFn}
diff --git a/src/plugins/discover/public/application/main/components/layout/use_discover_histogram.test.tsx b/src/plugins/discover/public/application/main/components/layout/use_discover_histogram.test.tsx
index b075e613b6a55..8463b380efc8f 100644
--- a/src/plugins/discover/public/application/main/components/layout/use_discover_histogram.test.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/use_discover_histogram.test.tsx
@@ -5,6 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+
 import React, { ReactElement } from 'react';
 import { buildDataTableRecord } from '../../../../utils/build_data_record';
 import { esHits } from '../../../../__mocks__/es_hits';
@@ -20,51 +21,42 @@ import {
   RecordRawType,
 } from '../../services/discover_data_state_container';
 import type { DiscoverStateContainer } from '../../services/discover_state';
-import { savedSearchMock } from '../../../../__mocks__/saved_search';
-import type { Storage } from '@kbn/kibana-utils-plugin/public';
-import { LocalStorageMock } from '../../../../__mocks__/local_storage_mock';
 import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { dataViewWithTimefieldMock } from '../../../../__mocks__/data_view_with_timefield';
-import {
-  CHART_HIDDEN_KEY,
-  HISTOGRAM_HEIGHT_KEY,
-  useDiscoverHistogram,
-  UseDiscoverHistogramProps,
-} from './use_discover_histogram';
+import { useDiscoverHistogram, UseDiscoverHistogramProps } from './use_discover_histogram';
 import { setTimeout } from 'timers/promises';
-import { calculateBounds } from '@kbn/data-plugin/public';
 import { getDiscoverStateMock } from '../../../../__mocks__/discover_state.mock';
 import { DiscoverMainProvider } from '../../services/discover_state_provider';
-import { createSearchSessionMock } from '../../../../__mocks__/search_session';
 import { RequestAdapter } from '@kbn/inspector-plugin/public';
-import { getSessionServiceMock } from '@kbn/data-plugin/public/search/session/mocks';
-import { UnifiedHistogramFetchStatus } from '@kbn/unified-histogram-plugin/public';
+import {
+  UnifiedHistogramFetchStatus,
+  UnifiedHistogramInitializeOptions,
+  UnifiedHistogramState,
+} from '@kbn/unified-histogram-plugin/public';
+import { createMockUnifiedHistogramApi } from '@kbn/unified-histogram-plugin/public/mocks';
 import { checkHitCount, sendErrorTo } from '../../hooks/use_saved_search_messages';
 import type { InspectorAdapters } from '../../hooks/use_inspector';
-import type { TypedLensByValueInput } from '@kbn/lens-plugin/public';
-import { DiscoverSearchSessionManager } from '../../services/discover_search_session';
 
 const mockData = dataPluginMock.createStartContract();
-
-mockData.query.timefilter.timefilter.getTime = () => {
-  return { from: '1991-03-29T08:04:00.694Z', to: '2021-03-29T07:04:00.695Z' };
-};
-mockData.query.timefilter.timefilter.calculateBounds = (timeRange) => {
-  return calculateBounds(timeRange);
-};
-
-const mockLens = {
-  navigateToPrefilledEditor: jest.fn(),
+const mockQueryState = {
+  query: {
+    query: 'query',
+    language: 'kuery',
+  },
+  filters: [],
+  time: {
+    from: 'now-15m',
+    to: 'now',
+  },
 };
 
-let mockStorage = new LocalStorageMock({}) as unknown as Storage;
-let mockCanVisualize = true;
+mockData.query.getState = () => mockQueryState;
 
 jest.mock('../../../../hooks/use_discover_services', () => {
   const originalModule = jest.requireActual('../../../../hooks/use_discover_services');
   return {
     ...originalModule,
-    useDiscoverServices: () => ({ storage: mockStorage, data: mockData, lens: mockLens }),
+    useDiscoverServices: () => ({ data: mockData }),
   };
 });
 
@@ -72,34 +64,14 @@ jest.mock('@kbn/unified-field-list-plugin/public', () => {
   const originalModule = jest.requireActual('@kbn/unified-field-list-plugin/public');
   return {
     ...originalModule,
-    getVisualizeInformation: jest.fn(() => Promise.resolve(mockCanVisualize)),
     useQuerySubscriber: jest.fn(() => ({
-      query: {
-        query: 'query',
-        language: 'kuery',
-      },
-      filters: [],
+      ...mockQueryState,
       fromDate: 'now-15m',
       toDate: 'now',
     })),
   };
 });
 
-function getStateContainer() {
-  const stateContainer = getDiscoverStateMock({ isTimeBased: true });
-
-  stateContainer.setAppState({
-    interval: 'auto',
-    hideChart: false,
-    breakdownField: 'extension',
-  });
-
-  const wrappedStateContainer = Object.create(stateContainer);
-  wrappedStateContainer.setAppState = jest.fn((newState) => stateContainer.setAppState(newState));
-
-  return wrappedStateContainer;
-}
-
 jest.mock('../../hooks/use_saved_search_messages', () => {
   const originalModule = jest.requireActual('../../hooks/use_saved_search_messages');
   return {
@@ -112,13 +84,20 @@ jest.mock('../../hooks/use_saved_search_messages', () => {
 const mockCheckHitCount = checkHitCount as jest.MockedFunction<typeof checkHitCount>;
 
 describe('useDiscoverHistogram', () => {
+  const getStateContainer = () => {
+    const stateContainer = getDiscoverStateMock({ isTimeBased: true });
+    stateContainer.setAppState({
+      interval: 'auto',
+      hideChart: false,
+      breakdownField: 'extension',
+    });
+    const wrappedStateContainer = Object.create(stateContainer);
+    wrappedStateContainer.setAppState = jest.fn((newState) => stateContainer.setAppState(newState));
+    return wrappedStateContainer;
+  };
+
   const renderUseDiscoverHistogram = async ({
-    isPlainRecord = false,
-    isTimeBased = true,
-    canVisualize = true,
-    storage = new LocalStorageMock({}) as unknown as Storage,
     stateContainer = getStateContainer(),
-    searchSessionManager,
     searchSessionId = '123',
     inspectorAdapters = { requests: new RequestAdapter() },
     totalHits$ = new BehaviorSubject({
@@ -127,26 +106,18 @@ describe('useDiscoverHistogram', () => {
     }) as DataTotalHits$,
     main$ = new BehaviorSubject({
       fetchStatus: FetchStatus.COMPLETE,
-      recordRawType: isPlainRecord ? RecordRawType.PLAIN : RecordRawType.DOCUMENT,
+      recordRawType: RecordRawType.DOCUMENT,
       foundDocuments: true,
     }) as DataMain$,
     savedSearchFetch$ = new Subject() as DataFetch$,
   }: {
-    isPlainRecord?: boolean;
-    isTimeBased?: boolean;
-    canVisualize?: boolean;
-    storage?: Storage;
     stateContainer?: DiscoverStateContainer;
-    searchSessionManager?: DiscoverSearchSessionManager;
-    searchSessionId?: string | null;
+    searchSessionId?: string;
     inspectorAdapters?: InspectorAdapters;
     totalHits$?: DataTotalHits$;
     main$?: DataMain$;
     savedSearchFetch$?: DataFetch$;
   } = {}) => {
-    mockStorage = storage;
-    mockCanVisualize = canVisualize;
-
     const documents$ = new BehaviorSubject({
       fetchStatus: FetchStatus.COMPLETE,
       result: esHits.map((esHit) => buildDataTableRecord(esHit, dataViewWithTimefieldMock)),
@@ -164,22 +135,13 @@ describe('useDiscoverHistogram', () => {
       availableFields$,
     };
 
-    if (!searchSessionManager) {
-      const session = getSessionServiceMock();
-      session.getSession$.mockReturnValue(new BehaviorSubject(searchSessionId ?? undefined));
-      searchSessionManager = createSearchSessionMock(session).searchSessionManager;
-    }
-
     const initialProps = {
       stateContainer,
       savedSearchData$,
       savedSearchFetch$,
       dataView: dataViewWithTimefieldMock,
-      savedSearch: savedSearchMock,
-      isTimeBased,
-      isPlainRecord,
       inspectorAdapters,
-      searchSessionManager: searchSessionManager!,
+      searchSessionId,
     };
 
     const Wrapper: WrapperComponent<UseDiscoverHistogramProps> = ({ children }) => (
@@ -201,262 +163,188 @@ describe('useDiscoverHistogram', () => {
     return { hook, initialProps };
   };
 
-  describe('result', () => {
-    it('should return undefined if there is no search session', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({ searchSessionId: null });
-      expect(result.current).toBeUndefined();
-    });
-
-    it('it should not return undefined if there is no search session, but isPlainRecord is true', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({ searchSessionId: null, isPlainRecord: true });
-      expect(result.current).toBeDefined();
-    });
-  });
-
-  describe('contexts', () => {
-    it('should output the correct hits context', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram();
-      expect(result.current?.hits?.status).toBe(UnifiedHistogramFetchStatus.complete);
-      expect(result.current?.hits?.total).toEqual(esHits.length);
-    });
-
-    it('should output the correct chart context', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram();
-      expect(result.current?.chart?.hidden).toBe(false);
-      expect(result.current?.chart?.timeInterval).toBe('auto');
-    });
-
-    it('should output the correct breakdown context', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram();
-      expect(result.current?.breakdown?.field?.name).toBe('extension');
-    });
-
-    it('should output the correct request context', async () => {
-      const requestAdapter = new RequestAdapter();
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({
-        searchSessionId: '321',
-        inspectorAdapters: { requests: requestAdapter },
-      });
-      expect(result.current?.request.adapter).toBe(requestAdapter);
-      expect(result.current?.request.searchSessionId).toBe('321');
-    });
-
-    it('should output undefined for hits and chart and breakdown if isPlainRecord is true', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({ isPlainRecord: true });
-      expect(result.current?.hits).toBeUndefined();
-      expect(result.current?.chart).toBeUndefined();
-      expect(result.current?.breakdown).toBeUndefined();
-    });
-
-    it('should output undefined for chart and breakdown if isTimeBased is false', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({ isTimeBased: false });
-      expect(result.current?.hits).not.toBeUndefined();
-      expect(result.current?.chart).toBeUndefined();
-      expect(result.current?.breakdown).toBeUndefined();
-    });
-
-    it('should clear lensRequests when chart is undefined', async () => {
-      const inspectorAdapters = {
-        requests: new RequestAdapter(),
-        lensRequests: new RequestAdapter(),
-      };
-      const { hook, initialProps } = await renderUseDiscoverHistogram({
-        inspectorAdapters,
-      });
-      expect(inspectorAdapters.lensRequests).toBeDefined();
-      hook.rerender({ ...initialProps, isPlainRecord: true });
-      expect(inspectorAdapters.lensRequests).toBeUndefined();
-    });
-  });
-
-  describe('search params', () => {
-    it('should return the correct query, filters, and timeRange', async () => {
+  describe('initialization', () => {
+    it('should pass the expected parameters to initialize', async () => {
       const { hook } = await renderUseDiscoverHistogram();
-      expect(hook.result.current?.query).toEqual({
-        query: 'query',
-        language: 'kuery',
-      });
-      expect(hook.result.current?.filters).toEqual([]);
-      expect(hook.result.current?.timeRange).toEqual({
-        from: 'now-15m',
-        to: 'now',
+      const api = createMockUnifiedHistogramApi();
+      let params: UnifiedHistogramInitializeOptions | undefined;
+      api.initialize = jest.fn((p) => {
+        params = p;
       });
-    });
-  });
-
-  describe('onEditVisualization', () => {
-    it('returns a callback for onEditVisualization when the data view can be visualized', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram();
-      expect(result.current?.onEditVisualization).toBeDefined();
-    });
-
-    it('returns undefined for onEditVisualization when the data view cannot be visualized', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({ canVisualize: false });
-      expect(result.current?.onEditVisualization).toBeUndefined();
-    });
-
-    it('should call lens.navigateToPrefilledEditor when onEditVisualization is called', async () => {
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram();
-      const attributes = { title: 'test' } as TypedLensByValueInput['attributes'];
-      result.current?.onEditVisualization!(attributes);
-      expect(mockLens.navigateToPrefilledEditor).toHaveBeenCalledWith({
-        id: '',
-        timeRange: mockData.query.timefilter.timefilter.getTime(),
-        attributes,
+      act(() => {
+        hook.result.current.setUnifiedHistogramApi(api);
       });
+      expect(api.initialize).toHaveBeenCalled();
+      expect(params?.localStorageKeyPrefix).toBe('discover');
+      expect(params?.disableAutoFetching).toBe(true);
+      expect(Object.keys(params?.initialState ?? {})).toEqual([
+        'dataView',
+        'query',
+        'filters',
+        'timeRange',
+        'chartHidden',
+        'timeInterval',
+        'breakdownField',
+        'searchSessionId',
+        'totalHitsStatus',
+        'totalHitsResult',
+        'requestAdapter',
+      ]);
     });
   });
 
-  describe('topPanelHeight', () => {
-    it('should try to get the topPanelHeight from storage', async () => {
-      const storage = new LocalStorageMock({}) as unknown as Storage;
-      storage.get = jest.fn(() => 100);
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({ storage });
-      expect(storage.get).toHaveBeenCalledWith(HISTOGRAM_HEIGHT_KEY);
-      expect(result.current?.topPanelHeight).toBe(100);
-    });
-
-    it('should update topPanelHeight when onTopPanelHeightChange is called', async () => {
-      const storage = new LocalStorageMock({}) as unknown as Storage;
-      storage.get = jest.fn(() => 100);
-      storage.set = jest.fn();
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({ storage });
-      expect(result.current?.topPanelHeight).toBe(100);
+  describe('state', () => {
+    it('should subscribe to state changes', async () => {
+      const { hook } = await renderUseDiscoverHistogram();
+      const api = createMockUnifiedHistogramApi({ initialized: true });
+      jest.spyOn(api.state$, 'subscribe');
       act(() => {
-        result.current?.onTopPanelHeightChange(200);
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      expect(storage.set).toHaveBeenCalledWith(HISTOGRAM_HEIGHT_KEY, 200);
-      expect(result.current?.topPanelHeight).toBe(200);
+      expect(api.state$.subscribe).toHaveBeenCalledTimes(2);
     });
-  });
 
-  describe('callbacks', () => {
-    it('should update chartHidden when onChartHiddenChange is called', async () => {
-      const storage = new LocalStorageMock({}) as unknown as Storage;
-      storage.set = jest.fn();
+    it('should sync Unified Histogram state with the state container', async () => {
       const stateContainer = getStateContainer();
-      const session = getSessionServiceMock();
-      const session$ = new BehaviorSubject('123');
-      session.getSession$.mockReturnValue(session$);
-      const inspectorAdapters = {
-        requests: new RequestAdapter(),
-        lensRequests: new RequestAdapter(),
-      };
-      const { hook } = await renderUseDiscoverHistogram({
-        storage,
-        stateContainer,
-        searchSessionManager: createSearchSessionMock(session).searchSessionManager,
-        inspectorAdapters,
-      });
+      const inspectorAdapters = { requests: new RequestAdapter(), lensRequests: undefined };
+      const { hook } = await renderUseDiscoverHistogram({ stateContainer, inspectorAdapters });
+      const lensRequestAdapter = new RequestAdapter();
+      const state = {
+        timeInterval: '1m',
+        chartHidden: true,
+        breakdownField: 'test',
+        totalHitsStatus: UnifiedHistogramFetchStatus.loading,
+        totalHitsResult: undefined,
+      } as unknown as UnifiedHistogramState;
+      const api = createMockUnifiedHistogramApi({ initialized: true });
+      api.state$ = new BehaviorSubject({ ...state, lensRequestAdapter });
       act(() => {
-        hook.result.current?.onChartHiddenChange(false);
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      expect(inspectorAdapters.lensRequests).toBeDefined();
-      expect(storage.set).toHaveBeenCalledWith(CHART_HIDDEN_KEY, false);
-      expect(stateContainer.setAppState).toHaveBeenCalledWith({ hideChart: false });
-      act(() => {
-        hook.result.current?.onChartHiddenChange(true);
-        session$.next('321');
+      expect(inspectorAdapters.lensRequests).toBe(lensRequestAdapter);
+      expect(stateContainer.setAppState).toHaveBeenCalledWith({
+        interval: state.timeInterval,
+        hideChart: state.chartHidden,
+        breakdownField: state.breakdownField,
       });
-      hook.rerender();
-      expect(inspectorAdapters.lensRequests).toBeUndefined();
-      expect(storage.set).toHaveBeenCalledWith(CHART_HIDDEN_KEY, true);
-      expect(stateContainer.setAppState).toHaveBeenCalledWith({ hideChart: true });
     });
 
-    it('should set lensRequests when onChartLoad is called', async () => {
-      const lensRequests = new RequestAdapter();
-      const inspectorAdapters = {
-        requests: new RequestAdapter(),
-        lensRequests: undefined as RequestAdapter | undefined,
-      };
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({ inspectorAdapters });
-      expect(inspectorAdapters.lensRequests).toBeUndefined();
+    it('should not sync Unified Histogram state with the state container if there are no changes', async () => {
+      const stateContainer = getStateContainer();
+      const { hook } = await renderUseDiscoverHistogram({ stateContainer });
+      const containerState = stateContainer.appState.getState();
+      const state = {
+        timeInterval: containerState.interval,
+        chartHidden: containerState.hideChart,
+        breakdownField: containerState.breakdownField,
+        totalHitsStatus: UnifiedHistogramFetchStatus.loading,
+        totalHitsResult: undefined,
+      } as unknown as UnifiedHistogramState;
+      const api = createMockUnifiedHistogramApi({ initialized: true });
+      api.state$ = new BehaviorSubject(state);
       act(() => {
-        result.current?.onChartLoad({ adapters: { requests: lensRequests } });
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      expect(inspectorAdapters.lensRequests).toBeDefined();
+      expect(stateContainer.setAppState).not.toHaveBeenCalled();
     });
 
-    it('should update chart hidden when onChartHiddenChange is called', async () => {
-      const storage = new LocalStorageMock({}) as unknown as Storage;
-      storage.set = jest.fn();
+    it('should sync the state container state with Unified Histogram', async () => {
       const stateContainer = getStateContainer();
-      const inspectorAdapters = {
-        requests: new RequestAdapter(),
-        lensRequests: new RequestAdapter(),
-      };
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({
-        storage,
-        stateContainer,
-        inspectorAdapters,
+      const { hook } = await renderUseDiscoverHistogram({ stateContainer });
+      const api = createMockUnifiedHistogramApi({ initialized: true });
+      let params: Partial<UnifiedHistogramState> = {};
+      api.setRequestParams = jest.fn((p) => {
+        params = { ...params, ...p };
       });
-      act(() => {
-        result.current?.onChartHiddenChange(true);
+      api.setTotalHits = jest.fn((p) => {
+        params = { ...params, ...p };
       });
-      expect(storage.set).toHaveBeenCalledWith(CHART_HIDDEN_KEY, true);
-      expect(stateContainer.setAppState).toHaveBeenCalledWith({ hideChart: true });
-    });
-
-    it('should update interval when onTimeIntervalChange is called', async () => {
-      const stateContainer = getStateContainer();
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({
-        stateContainer,
+      api.setChartHidden = jest.fn((chartHidden) => {
+        params = { ...params, chartHidden };
+      });
+      api.setTimeInterval = jest.fn((timeInterval) => {
+        params = { ...params, timeInterval };
+      });
+      api.setBreakdownField = jest.fn((breakdownField) => {
+        params = { ...params, breakdownField };
       });
       act(() => {
-        result.current?.onTimeIntervalChange('auto');
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      expect(stateContainer.setAppState).toHaveBeenCalledWith({ interval: 'auto' });
+      expect(api.setRequestParams).toHaveBeenCalled();
+      expect(api.setTotalHits).toHaveBeenCalled();
+      expect(api.setChartHidden).toHaveBeenCalled();
+      expect(api.setTimeInterval).toHaveBeenCalled();
+      expect(api.setBreakdownField).toHaveBeenCalled();
+      expect(Object.keys(params ?? {})).toEqual([
+        'dataView',
+        'query',
+        'filters',
+        'timeRange',
+        'searchSessionId',
+        'requestAdapter',
+        'totalHitsStatus',
+        'totalHitsResult',
+        'chartHidden',
+        'timeInterval',
+        'breakdownField',
+      ]);
     });
 
-    it('should update breakdownField when onBreakdownFieldChange is called', async () => {
+    it('should exclude totalHitsStatus and totalHitsResult from Unified Histogram state updates after the first load', async () => {
       const stateContainer = getStateContainer();
-      const {
-        hook: { result },
-      } = await renderUseDiscoverHistogram({
-        stateContainer,
+      const { hook, initialProps } = await renderUseDiscoverHistogram({ stateContainer });
+      const containerState = stateContainer.appState.getState();
+      const state = {
+        timeInterval: containerState.interval,
+        chartHidden: containerState.hideChart,
+        breakdownField: containerState.breakdownField,
+        totalHitsStatus: UnifiedHistogramFetchStatus.loading,
+        totalHitsResult: undefined,
+      } as unknown as UnifiedHistogramState;
+      const api = createMockUnifiedHistogramApi({ initialized: true });
+      let params: Partial<UnifiedHistogramState> = {};
+      api.setRequestParams = jest.fn((p) => {
+        params = { ...params, ...p };
+      });
+      api.setTotalHits = jest.fn((p) => {
+        params = { ...params, ...p };
       });
+      const subject$ = new BehaviorSubject(state);
+      api.state$ = subject$;
       act(() => {
-        result.current?.onBreakdownFieldChange(
-          dataViewWithTimefieldMock.getFieldByName('extension')
-        );
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      expect(stateContainer.setAppState).toHaveBeenCalledWith({ breakdownField: 'extension' });
+      expect(Object.keys(params ?? {})).toEqual([
+        'dataView',
+        'query',
+        'filters',
+        'timeRange',
+        'searchSessionId',
+        'requestAdapter',
+        'totalHitsStatus',
+        'totalHitsResult',
+      ]);
+      params = {};
+      hook.rerender({ ...initialProps, searchSessionId: '321' });
+      act(() => {
+        subject$.next({
+          ...state,
+          totalHitsStatus: UnifiedHistogramFetchStatus.complete,
+          totalHitsResult: 100,
+        });
+      });
+      expect(Object.keys(params ?? {})).toEqual([
+        'dataView',
+        'query',
+        'filters',
+        'timeRange',
+        'searchSessionId',
+        'requestAdapter',
+      ]);
     });
 
-    it('should update total hits when onTotalHitsChange is called', async () => {
+    it('should update total hits when the total hits state changes', async () => {
       mockCheckHitCount.mockClear();
       const totalHits$ = new BehaviorSubject({
         fetchStatus: FetchStatus.LOADING,
@@ -467,13 +355,25 @@ describe('useDiscoverHistogram', () => {
         recordRawType: RecordRawType.DOCUMENT,
         foundDocuments: true,
       }) as DataMain$;
-      const { hook } = await renderUseDiscoverHistogram({ totalHits$, main$ });
+      const stateContainer = getStateContainer();
+      const { hook } = await renderUseDiscoverHistogram({ stateContainer, totalHits$, main$ });
+      const containerState = stateContainer.appState.getState();
+      const state = {
+        timeInterval: containerState.interval,
+        chartHidden: containerState.hideChart,
+        breakdownField: containerState.breakdownField,
+        totalHitsStatus: UnifiedHistogramFetchStatus.loading,
+        totalHitsResult: undefined,
+      } as unknown as UnifiedHistogramState;
+      const api = createMockUnifiedHistogramApi({ initialized: true });
+      api.state$ = new BehaviorSubject({
+        ...state,
+        totalHitsStatus: UnifiedHistogramFetchStatus.complete,
+        totalHitsResult: 100,
+      });
       act(() => {
-        hook.result.current?.onTotalHitsChange(UnifiedHistogramFetchStatus.complete, 100);
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      hook.rerender();
-      expect(hook.result.current?.hits?.status).toBe(UnifiedHistogramFetchStatus.complete);
-      expect(hook.result.current?.hits?.total).toBe(100);
       expect(totalHits$.value).toEqual({
         fetchStatus: FetchStatus.COMPLETE,
         result: 100,
@@ -481,105 +381,80 @@ describe('useDiscoverHistogram', () => {
       expect(mockCheckHitCount).toHaveBeenCalledWith(main$, 100);
     });
 
-    it('should not update total hits when onTotalHitsChange is called with an error', async () => {
+    it('should not update total hits when the total hits state changes to an error', async () => {
       mockCheckHitCount.mockClear();
       const totalHits$ = new BehaviorSubject({
         fetchStatus: FetchStatus.UNINITIALIZED,
         result: undefined,
       }) as DataTotalHits$;
-      const { hook } = await renderUseDiscoverHistogram({ totalHits$ });
+      const stateContainer = getStateContainer();
+      const { hook } = await renderUseDiscoverHistogram({ stateContainer, totalHits$ });
+      const containerState = stateContainer.appState.getState();
       const error = new Error('test');
+      const state = {
+        timeInterval: containerState.interval,
+        chartHidden: containerState.hideChart,
+        breakdownField: containerState.breakdownField,
+        totalHitsStatus: UnifiedHistogramFetchStatus.loading,
+        totalHitsResult: undefined,
+      } as unknown as UnifiedHistogramState;
+      const api = createMockUnifiedHistogramApi({ initialized: true });
+      api.state$ = new BehaviorSubject({
+        ...state,
+        totalHitsStatus: UnifiedHistogramFetchStatus.error,
+        totalHitsResult: error,
+      });
       act(() => {
-        hook.result.current?.onTotalHitsChange(UnifiedHistogramFetchStatus.error, error);
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      hook.rerender();
       expect(sendErrorTo).toHaveBeenCalledWith(mockData, totalHits$);
-      expect(hook.result.current?.hits?.status).toBe(UnifiedHistogramFetchStatus.error);
-      expect(hook.result.current?.hits?.total).toBeUndefined();
       expect(totalHits$.value).toEqual({
         fetchStatus: FetchStatus.ERROR,
         error,
       });
       expect(mockCheckHitCount).not.toHaveBeenCalled();
     });
-
-    it('should not update total hits when onTotalHitsChange is called with a loading status while totalHits$ has a partial status', async () => {
-      mockCheckHitCount.mockClear();
-      const totalHits$ = new BehaviorSubject({
-        fetchStatus: FetchStatus.PARTIAL,
-        result: undefined,
-      }) as DataTotalHits$;
-      const { hook } = await renderUseDiscoverHistogram({ totalHits$ });
-      act(() => {
-        hook.result.current?.onTotalHitsChange(UnifiedHistogramFetchStatus.loading, undefined);
-      });
-      hook.rerender();
-      expect(hook.result.current?.hits?.status).toBe(UnifiedHistogramFetchStatus.partial);
-      expect(hook.result.current?.hits?.total).toBeUndefined();
-      expect(totalHits$.value).toEqual({
-        fetchStatus: FetchStatus.PARTIAL,
-        result: undefined,
-      });
-      expect(mockCheckHitCount).not.toHaveBeenCalled();
-    });
   });
 
   describe('refetching', () => {
-    it("should call input$.next({ type: 'refetch' }) when savedSearchFetch$ is triggered", async () => {
-      const savedSearchFetch$ = new BehaviorSubject({ reset: false, searchSessionId: '1234' });
+    it('should call refetch when savedSearchFetch$ is triggered', async () => {
+      const savedSearchFetch$ = new Subject<{
+        reset: boolean;
+        searchSessionId: string;
+      }>();
       const { hook } = await renderUseDiscoverHistogram({ savedSearchFetch$ });
-      const onRefetch = jest.fn();
-      hook.result.current?.input$.subscribe(onRefetch);
+      const api = createMockUnifiedHistogramApi({ initialized: true });
       act(() => {
-        savedSearchFetch$.next({ reset: false, searchSessionId: '1234' });
-      });
-      expect(onRefetch).toHaveBeenCalledWith({ type: 'refetch' });
-    });
-
-    it("should not call input$.next({ type: 'refetch' }) when searchSessionId is not set", async () => {
-      const savedSearchFetch$ = new BehaviorSubject({ reset: false, searchSessionId: '1234' });
-      const { hook } = await renderUseDiscoverHistogram({
-        savedSearchFetch$,
-        searchSessionId: null,
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      const onRefetch = jest.fn();
-      hook.result.current?.input$.subscribe(onRefetch);
+      expect(api.refetch).not.toHaveBeenCalled();
       act(() => {
         savedSearchFetch$.next({ reset: false, searchSessionId: '1234' });
       });
-      expect(onRefetch).not.toHaveBeenCalled();
+      expect(api.refetch).toHaveBeenCalled();
     });
 
-    it("should call input$.next({ type: 'refetch' }) when searchSessionId is not set and isPlainRecord is true", async () => {
-      const savedSearchFetch$ = new BehaviorSubject({ reset: false, searchSessionId: '1234' });
-      const { hook } = await renderUseDiscoverHistogram({
-        savedSearchFetch$,
-        searchSessionId: null,
-        isPlainRecord: true,
-      });
-      const onRefetch = jest.fn();
-      hook.result.current?.input$.subscribe(onRefetch);
+    it('should skip the next refetch when hideChart changes from true to false', async () => {
+      const stateContainer = getStateContainer();
+      const savedSearchFetch$ = new Subject<{
+        reset: boolean;
+        searchSessionId: string;
+      }>();
+      const { hook } = await renderUseDiscoverHistogram({ stateContainer, savedSearchFetch$ });
+      const api = createMockUnifiedHistogramApi({ initialized: true });
       act(() => {
-        savedSearchFetch$.next({ reset: false, searchSessionId: '1234' });
+        hook.result.current.setUnifiedHistogramApi(api);
       });
-      expect(onRefetch).toHaveBeenCalledWith({ type: 'refetch' });
-    });
-
-    it('should skip the next refetch when state.hideChart changes from true to false', async () => {
-      const savedSearchFetch$ = new BehaviorSubject({ reset: false, searchSessionId: '1234' });
-      const { hook } = await renderUseDiscoverHistogram({ savedSearchFetch$ });
-      const onRefetch = jest.fn();
-      hook.result.current?.input$.subscribe(onRefetch);
       act(() => {
-        hook.result.current?.onChartHiddenChange(true);
+        stateContainer.setAppState({ hideChart: true });
       });
       act(() => {
-        hook.result.current?.onChartHiddenChange(false);
+        stateContainer.setAppState({ hideChart: false });
       });
       act(() => {
         savedSearchFetch$.next({ reset: false, searchSessionId: '1234' });
       });
-      expect(onRefetch).not.toHaveBeenCalled();
+      expect(api.refetch).not.toHaveBeenCalled();
     });
   });
 });
diff --git a/src/plugins/discover/public/application/main/components/layout/use_discover_histogram.ts b/src/plugins/discover/public/application/main/components/layout/use_discover_histogram.ts
index ad676b1a4247d..d259252f18686 100644
--- a/src/plugins/discover/public/application/main/components/layout/use_discover_histogram.ts
+++ b/src/plugins/discover/public/application/main/components/layout/use_discover_histogram.ts
@@ -6,277 +6,258 @@
  * Side Public License, v 1.
  */
 
-import type { DataView, DataViewField } from '@kbn/data-views-plugin/common';
-import type { SavedSearch } from '@kbn/saved-search-plugin/public';
-import { getVisualizeInformation, useQuerySubscriber } from '@kbn/unified-field-list-plugin/public';
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import type { DataView } from '@kbn/data-views-plugin/common';
+import { useQuerySubscriber } from '@kbn/unified-field-list-plugin/public';
 import {
+  UnifiedHistogramApi,
   UnifiedHistogramFetchStatus,
-  UnifiedHistogramHitsContext,
-  UnifiedHistogramInputMessage,
+  UnifiedHistogramInitializedApi,
+  UnifiedHistogramState,
 } from '@kbn/unified-histogram-plugin/public';
-import type { UnifiedHistogramChartLoadEvent } from '@kbn/unified-histogram-plugin/public';
-import useObservable from 'react-use/lib/useObservable';
-import type { TypedLensByValueInput } from '@kbn/lens-plugin/public';
-import { Subject } from 'rxjs';
-import { useAppStateSelector } from '../../services/discover_app_state_container';
-import { getUiActions } from '../../../../kibana_services';
+import { isEqual } from 'lodash';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { distinctUntilChanged, map, Observable } from 'rxjs';
 import { useDiscoverServices } from '../../../../hooks/use_discover_services';
-import { useDataState } from '../../hooks/use_data_state';
-import type { DataFetch$, SavedSearchData } from '../../services/discover_data_state_container';
-import type { DiscoverStateContainer } from '../../services/discover_state';
+import { getUiActions } from '../../../../kibana_services';
 import { FetchStatus } from '../../../types';
-import type { DiscoverSearchSessionManager } from '../../services/discover_search_session';
+import { useDataState } from '../../hooks/use_data_state';
 import type { InspectorAdapters } from '../../hooks/use_inspector';
+import type { DataFetch$, SavedSearchData } from '../../services/discover_data_state_container';
 import { checkHitCount, sendErrorTo } from '../../hooks/use_saved_search_messages';
-
-export const CHART_HIDDEN_KEY = 'discover:chartHidden';
-export const HISTOGRAM_HEIGHT_KEY = 'discover:histogramHeight';
-export const HISTOGRAM_BREAKDOWN_FIELD_KEY = 'discover:histogramBreakdownField';
+import { useAppStateSelector } from '../../services/discover_app_state_container';
+import type { DiscoverStateContainer } from '../../services/discover_state';
 
 export interface UseDiscoverHistogramProps {
   stateContainer: DiscoverStateContainer;
   savedSearchData$: SavedSearchData;
   dataView: DataView;
-  savedSearch: SavedSearch;
-  isTimeBased: boolean;
-  isPlainRecord: boolean;
   inspectorAdapters: InspectorAdapters;
-  searchSessionManager: DiscoverSearchSessionManager;
   savedSearchFetch$: DataFetch$;
+  searchSessionId: string | undefined;
 }
 
 export const useDiscoverHistogram = ({
   stateContainer,
   savedSearchData$,
   dataView,
-  savedSearch,
-  isTimeBased,
-  isPlainRecord,
   inspectorAdapters,
-  searchSessionManager,
   savedSearchFetch$,
+  searchSessionId,
 }: UseDiscoverHistogramProps) => {
-  const { storage, data, lens } = useDiscoverServices();
-  const [hideChart, interval, breakdownField] = useAppStateSelector((state) => [
-    state.hideChart,
-    state.interval,
-    state.breakdownField,
-  ]);
+  const services = useDiscoverServices();
+  const timefilter = services.data.query.timefilter.timefilter;
 
   /**
-   * Visualize
+   * API initialization
    */
 
-  const timeField = dataView.timeFieldName && dataView.getFieldByName(dataView.timeFieldName);
-  const [canVisualize, setCanVisualize] = useState(false);
+  const [unifiedHistogram, setUnifiedHistogram] = useState<UnifiedHistogramInitializedApi>();
 
-  useEffect(() => {
-    if (!timeField) {
-      return;
-    }
-    getVisualizeInformation(
-      getUiActions(),
-      timeField,
-      dataView,
-      savedSearch.columns || [],
-      []
-    ).then((info) => {
-      setCanVisualize(Boolean(info));
-    });
-  }, [dataView, savedSearch.columns, timeField]);
-
-  const onEditVisualization = useCallback(
-    (lensAttributes: TypedLensByValueInput['attributes']) => {
-      if (!timeField) {
+  const setUnifiedHistogramApi = useCallback(
+    (api: UnifiedHistogramApi | null) => {
+      if (!api) {
         return;
       }
-      lens.navigateToPrefilledEditor({
-        id: '',
-        timeRange: data.query.timefilter.timefilter.getTime(),
-        attributes: lensAttributes,
-      });
+
+      if (api.initialized) {
+        setUnifiedHistogram(api);
+      } else {
+        const {
+          hideChart: chartHidden,
+          interval: timeInterval,
+          breakdownField,
+        } = stateContainer.appState.getState();
+
+        const { fetchStatus: totalHitsStatus, result: totalHitsResult } =
+          savedSearchData$.totalHits$.getValue();
+
+        const { query, filters, time: timeRange } = services.data.query.getState();
+
+        api.initialize({
+          services: { ...services, uiActions: getUiActions() },
+          localStorageKeyPrefix: 'discover',
+          disableAutoFetching: true,
+          getRelativeTimeRange: timefilter.getTime,
+          initialState: {
+            dataView,
+            query,
+            filters,
+            timeRange,
+            chartHidden,
+            timeInterval,
+            breakdownField,
+            searchSessionId,
+            totalHitsStatus: totalHitsStatus.toString() as UnifiedHistogramFetchStatus,
+            totalHitsResult,
+            requestAdapter: inspectorAdapters.requests,
+          },
+        });
+      }
     },
-    [data.query.timefilter.timefilter, lens, timeField]
+    [
+      dataView,
+      inspectorAdapters.requests,
+      savedSearchData$.totalHits$,
+      searchSessionId,
+      services,
+      stateContainer.appState,
+      timefilter.getTime,
+    ]
   );
 
   /**
-   * Height
+   * Sync Unified Histogram state with Discover state
    */
 
-  const [topPanelHeight, setTopPanelHeight] = useState(() => {
-    const storedHeight = storage.get(HISTOGRAM_HEIGHT_KEY);
-    return storedHeight ? Number(storedHeight) : undefined;
-  });
+  useEffect(() => {
+    const subscription = createStateSyncObservable(unifiedHistogram?.state$)?.subscribe((state) => {
+      inspectorAdapters.lensRequests = state.lensRequestAdapter;
+
+      const { hideChart, interval, breakdownField } = stateContainer.appState.getState();
+      const oldState = { hideChart, interval, breakdownField };
+      const newState = {
+        hideChart: state.chartHidden,
+        interval: state.timeInterval,
+        breakdownField: state.breakdownField,
+      };
+
+      if (!isEqual(oldState, newState)) {
+        stateContainer.setAppState(newState);
+      }
+    });
 
-  const onTopPanelHeightChange = useCallback(
-    (newTopPanelHeight: number | undefined) => {
-      storage.set(HISTOGRAM_HEIGHT_KEY, newTopPanelHeight);
-      setTopPanelHeight(newTopPanelHeight);
-    },
-    [storage]
-  );
+    return () => {
+      subscription?.unsubscribe();
+    };
+  }, [inspectorAdapters, stateContainer, unifiedHistogram]);
 
   /**
-   * Time interval
+   * Update Unified Histgoram request params
    */
 
-  const onTimeIntervalChange = useCallback(
-    (newInterval: string) => {
-      stateContainer.setAppState({ interval: newInterval });
-    },
-    [stateContainer]
+  const {
+    query,
+    filters,
+    fromDate: from,
+    toDate: to,
+  } = useQuerySubscriber({ data: services.data });
+
+  const timeRange = useMemo(
+    () => (from && to ? { from, to } : timefilter.getTimeDefaults()),
+    [timefilter, from, to]
   );
 
+  useEffect(() => {
+    unifiedHistogram?.setRequestParams({
+      dataView,
+      query,
+      filters,
+      timeRange,
+      searchSessionId,
+      requestAdapter: inspectorAdapters.requests,
+    });
+  }, [
+    dataView,
+    filters,
+    inspectorAdapters.requests,
+    query,
+    searchSessionId,
+    timeRange,
+    unifiedHistogram,
+  ]);
+
   /**
-   * Total hits
+   * Override Unified Histgoram total hits with Discover partial results
    */
 
-  const [localHitsContext, setLocalHitsContext] = useState<UnifiedHistogramHitsContext>();
-
-  const onTotalHitsChange = useCallback(
-    (status: UnifiedHistogramFetchStatus, result?: number | Error) => {
-      if (result instanceof Error) {
-        // Display the error and set totalHits$ to an error state
-        sendErrorTo(data, savedSearchData$.totalHits$)(result);
-        return;
-      }
-
-      const { fetchStatus, recordRawType } = savedSearchData$.totalHits$.getValue();
-
-      // If we have a partial result already, we don't want to update the total hits back to loading
-      if (fetchStatus === FetchStatus.PARTIAL && status === UnifiedHistogramFetchStatus.loading) {
-        return;
-      }
-
-      // Set a local copy of the hits context to pass to unified histogram
-      setLocalHitsContext({ status, total: result });
+  const firstLoadComplete = useRef(false);
 
-      // Sync the totalHits$ observable with the unified histogram state
-      savedSearchData$.totalHits$.next({
-        fetchStatus: status.toString() as FetchStatus,
-        result,
-        recordRawType,
-      });
-
-      // Check the hits count to set a partial or no results state
-      if (status === UnifiedHistogramFetchStatus.complete && typeof result === 'number') {
-        checkHitCount(savedSearchData$.main$, result);
-      }
-    },
-    [data, savedSearchData$.main$, savedSearchData$.totalHits$]
-  );
-
-  // We only rely on the totalHits$ observable if we don't have a local hits context yet,
-  // since we only want to show the partial results on the first load, or there will be
-  // a flickering effect as the loading spinner is quickly shown and hidden again on fetches
-  const { fetchStatus: hitsFetchStatus, result: hitsTotal } = useDataState(
+  const { fetchStatus: totalHitsStatus, result: totalHitsResult } = useDataState(
     savedSearchData$.totalHits$
   );
 
-  const hits = useMemo(
-    () =>
-      isPlainRecord
-        ? undefined
-        : localHitsContext ?? {
-            status: hitsFetchStatus.toString() as UnifiedHistogramFetchStatus,
-            total: hitsTotal,
-          },
-    [hitsFetchStatus, hitsTotal, isPlainRecord, localHitsContext]
-  );
+  useEffect(() => {
+    // We only want to show the partial results on the first load,
+    // or there will be a flickering effect as the loading spinner
+    // is quickly shown and hidden again on fetches
+    if (!firstLoadComplete.current) {
+      unifiedHistogram?.setTotalHits({
+        totalHitsStatus: totalHitsStatus.toString() as UnifiedHistogramFetchStatus,
+        totalHitsResult,
+      });
+    }
+  }, [totalHitsResult, totalHitsStatus, unifiedHistogram]);
 
   /**
-   * Chart
+   * Sync URL query params with Unified Histogram
    */
 
-  const onChartHiddenChange = useCallback(
-    (chartHidden: boolean) => {
-      storage.set(CHART_HIDDEN_KEY, chartHidden);
-      stateContainer.setAppState({ hideChart: chartHidden });
-    },
-    [stateContainer, storage]
-  );
+  const hideChart = useAppStateSelector((state) => state.hideChart);
 
-  const onChartLoad = useCallback(
-    (event: UnifiedHistogramChartLoadEvent) => {
-      // We need to store the Lens request adapter in order to inspect its requests
-      inspectorAdapters.lensRequests = event.adapters.requests;
-    },
-    [inspectorAdapters]
-  );
-
-  const chart = useMemo(
-    () =>
-      isPlainRecord || !isTimeBased
-        ? undefined
-        : {
-            hidden: hideChart,
-            timeInterval: interval,
-          },
-    [hideChart, interval, isPlainRecord, isTimeBased]
-  );
-
-  // Clear the Lens request adapter when the chart is hidden
   useEffect(() => {
-    if (hideChart || !chart) {
-      inspectorAdapters.lensRequests = undefined;
+    if (typeof hideChart === 'boolean') {
+      unifiedHistogram?.setChartHidden(hideChart);
     }
-  }, [chart, hideChart, inspectorAdapters]);
+  }, [hideChart, unifiedHistogram]);
 
-  /**
-   * Breakdown
-   */
+  const timeInterval = useAppStateSelector((state) => state.interval);
 
-  const onBreakdownFieldChange = useCallback(
-    (newBreakdownField: DataViewField | undefined) => {
-      stateContainer.setAppState({ breakdownField: newBreakdownField?.name });
-    },
-    [stateContainer]
-  );
+  useEffect(() => {
+    if (timeInterval) {
+      unifiedHistogram?.setTimeInterval(timeInterval);
+    }
+  }, [timeInterval, unifiedHistogram]);
 
-  const field = useMemo(
-    () => (breakdownField ? dataView.getFieldByName(breakdownField) : undefined),
-    [dataView, breakdownField]
-  );
+  const breakdownField = useAppStateSelector((state) => state.breakdownField);
 
-  const breakdown = useMemo(
-    () => (isPlainRecord || !isTimeBased ? undefined : { field }),
-    [field, isPlainRecord, isTimeBased]
-  );
+  useEffect(() => {
+    unifiedHistogram?.setBreakdownField(breakdownField);
+  }, [breakdownField, unifiedHistogram]);
 
   /**
-   * Search params
+   * Total hits
    */
 
-  const { query, filters, fromDate: from, toDate: to } = useQuerySubscriber({ data });
-  const timeRange = useMemo(
-    () => (from && to ? { from, to } : data.query.timefilter.timefilter.getTimeDefaults()),
-    [data.query.timefilter.timefilter, from, to]
-  );
+  useEffect(() => {
+    const subscription = createTotalHitsObservable(unifiedHistogram?.state$)?.subscribe(
+      ({ status, result }) => {
+        if (result instanceof Error) {
+          // Display the error and set totalHits$ to an error state
+          sendErrorTo(services.data, savedSearchData$.totalHits$)(result);
+          return;
+        }
+
+        const { recordRawType } = savedSearchData$.totalHits$.getValue();
+
+        // Sync the totalHits$ observable with the unified histogram state
+        savedSearchData$.totalHits$.next({
+          fetchStatus: status.toString() as FetchStatus,
+          result,
+          recordRawType,
+        });
+
+        if (status !== UnifiedHistogramFetchStatus.complete || typeof result !== 'number') {
+          return;
+        }
+
+        // Check the hits count to set a partial or no results state
+        checkHitCount(savedSearchData$.main$, result);
 
-  /**
-   * Request
-   */
+        // Indicate the first load has completed so we don't show
+        // partial results on subsequent fetches
+        firstLoadComplete.current = true;
+      }
+    );
 
-  // The searchSessionId will be updated whenever a new search is started
-  const searchSessionId = useObservable(searchSessionManager.searchSessionId$);
-  const request = useMemo(
-    () => ({
-      searchSessionId,
-      adapter: inspectorAdapters.requests,
-    }),
-    [inspectorAdapters.requests, searchSessionId]
-  );
+    return () => {
+      subscription?.unsubscribe();
+    };
+  }, [savedSearchData$.main$, savedSearchData$.totalHits$, services.data, unifiedHistogram]);
 
   /**
    * Data fetching
    */
 
-  const input$ = useMemo(() => new Subject<UnifiedHistogramInputMessage>(), []);
-
-  // Initialized when the first search has been requested or
-  // when in SQL mode since search sessions are not supported
-  const isInitialized = Boolean(searchSessionId) || isPlainRecord;
   const skipRefetch = useRef<boolean>();
 
   // Skip refetching when showing the chart since Lens will
@@ -292,37 +273,41 @@ export const useDiscoverHistogram = ({
   // Trigger a unified histogram refetch when savedSearchFetch$ is triggered
   useEffect(() => {
     const subscription = savedSearchFetch$.subscribe(() => {
-      if (isInitialized && !skipRefetch.current) {
-        input$.next({ type: 'refetch' });
+      if (!skipRefetch.current) {
+        unifiedHistogram?.refetch();
       }
+
       skipRefetch.current = false;
     });
 
     return () => {
       subscription.unsubscribe();
     };
-  }, [input$, isInitialized, savedSearchFetch$]);
-
-  // Don't render the unified histogram layout until initialized
-  return isInitialized
-    ? {
-        query,
-        filters,
-        timeRange,
-        topPanelHeight,
-        request,
-        hits,
-        chart,
-        breakdown,
-        disableAutoFetching: true,
-        input$,
-        onEditVisualization: canVisualize ? onEditVisualization : undefined,
-        onTopPanelHeightChange,
-        onChartHiddenChange,
-        onTimeIntervalChange,
-        onBreakdownFieldChange,
-        onTotalHitsChange,
-        onChartLoad,
-      }
-    : undefined;
+  }, [savedSearchFetch$, unifiedHistogram]);
+
+  return { hideChart, setUnifiedHistogramApi };
+};
+
+const createStateSyncObservable = (state$?: Observable<UnifiedHistogramState>) => {
+  return state$?.pipe(
+    map(({ lensRequestAdapter, chartHidden, timeInterval, breakdownField }) => ({
+      lensRequestAdapter,
+      chartHidden,
+      timeInterval,
+      breakdownField,
+    })),
+    distinctUntilChanged((prev, curr) => {
+      const { lensRequestAdapter: prevLensRequestAdapter, ...prevRest } = prev;
+      const { lensRequestAdapter: currLensRequestAdapter, ...currRest } = curr;
+
+      return prevLensRequestAdapter === currLensRequestAdapter && isEqual(prevRest, currRest);
+    })
+  );
+};
+
+const createTotalHitsObservable = (state$?: Observable<UnifiedHistogramState>) => {
+  return state$?.pipe(
+    map((state) => ({ status: state.totalHitsStatus, result: state.totalHitsResult })),
+    distinctUntilChanged((prev, curr) => prev.status === curr.status && prev.result === curr.result)
+  );
 };
diff --git a/src/plugins/discover/public/application/main/utils/get_state_defaults.ts b/src/plugins/discover/public/application/main/utils/get_state_defaults.ts
index 9ea56f8b0174f..677a92cb76a96 100644
--- a/src/plugins/discover/public/application/main/utils/get_state_defaults.ts
+++ b/src/plugins/discover/public/application/main/utils/get_state_defaults.ts
@@ -9,6 +9,7 @@
 import { cloneDeep, isEqual } from 'lodash';
 import { IUiSettingsClient } from '@kbn/core/public';
 import { SavedSearch } from '@kbn/saved-search-plugin/public';
+import { getChartHidden } from '@kbn/unified-histogram-plugin/public';
 import { AppState } from '../services/discover_app_state_container';
 import { DiscoverServices } from '../../../build_services';
 import { getDefaultSort, getSortArray } from '../../../utils/sorting';
@@ -19,8 +20,6 @@ import {
   SORT_DEFAULT_ORDER_SETTING,
 } from '../../../../common';
 
-import { CHART_HIDDEN_KEY } from '../components/layout/use_discover_histogram';
-
 function getDefaultColumns(savedSearch: SavedSearch, uiSettings: IUiSettingsClient) {
   if (savedSearch.columns && savedSearch.columns.length > 0) {
     return [...savedSearch.columns];
@@ -48,7 +47,7 @@ export function getStateDefaults({
   const query = searchSource.getField('query') || data.query.queryString.getDefaultQuery();
   const sort = getSortArray(savedSearch.sort ?? [], dataView!);
   const columns = getDefaultColumns(savedSearch, uiSettings);
-  const chartHidden = storage.get(CHART_HIDDEN_KEY);
+  const chartHidden = getChartHidden(storage, 'discover');
 
   const defaultState: AppState = {
     query,
diff --git a/src/plugins/unified_histogram/README.md b/src/plugins/unified_histogram/README.md
index 301216dfefdbf..459eb88aa6610 100755
--- a/src/plugins/unified_histogram/README.md
+++ b/src/plugins/unified_histogram/README.md
@@ -1,3 +1,138 @@
 # unifiedHistogram
 
-The `unifiedHistogram` plugin provides UI components to create a layout including a resizable histogram and a main display.
+Unified Histogram is a UX Building Block including a layout with a resizable histogram and a main display.
+It manages its own state and data fetching, and can easily be dropped into pages with minimal setup.
+
+## Example
+
+```tsx
+// Import the container component and API contract
+import {
+  UnifiedHistogramContainer,
+  type UnifiedHistogramInitializedApi,
+} from '@kbn/unified-histogram-plugin/public';
+
+// Import modules required for your application
+import {
+  useServices,
+  useResizeRef,
+  useCallbacks,
+  useRequestParams,
+  useManualRefetch,
+  MyLayout,
+  MyButton,
+} from './my-modules';
+
+const services = useServices();
+const resizeRef = useResizeRef();
+const { onChartHiddenChange, onLensRequestAdapterChange } = useCallbacks();
+const {
+  dataView,
+  query,
+  filters,
+  timeRange,
+  searchSessionId,
+  requestAdapter,
+} = useRequestParams();
+
+// Use a state variable instead of a ref to preserve reactivity when the API is updated
+const [unifiedHistogram, setUnifiedHistogram] = useState<UnifiedHistogramInitializedApi>();
+
+// Create a callback to set unifiedHistogram, and initialize it if needed
+const setUnifiedHistogramApi = useCallback((api: UnifiedHistogramApi | null) => {
+  // Ignore if the ref is null
+  if (!api) {
+    return;
+  }
+
+  if (api.initialized) {
+    // Update our local reference to the API
+    setUnifiedHistogram(api);
+  } else {
+    // Initialize if not yet initialized
+    api.initialize({
+      // Pass the required services to Unified Histogram
+      services,
+      // Optionally provide a local storage key prefix to save parts of the state,
+      // such as the chart hidden state and top panel height, to local storage
+      localStorageKeyPrefix: 'myApp',
+      // By default Unified Histogram will automatically refetch based on certain
+      // state changes, such as chart hidden and request params, but this can be
+      // disabled in favour of manual fetching if preferred. Note that an initial
+      // request is always triggered when first initialized, and when the chart
+      // changes from hidden to visible, Lens will automatically trigger a refetch
+      // regardless of what this property is set to
+      disableAutoFetching: true,
+      // If passing an absolute time range, provide a function to get the relative range
+      getRelativeTimeRange: services.data.query.timefilter.timefilter.getTime,
+      // At minimum the initial state requires a data view, but additional
+      // parameters can be passed to further customize the state
+      initialState: {
+        dataView,
+        query,
+        filters,
+        timeRange,
+        searchSessionId,
+        requestAdapter,
+      },
+    });
+  }
+}, [...]);
+
+// Manually refetch if disableAutoFetching is true
+useManualRefetch(() => {
+  unifiedHistogram?.refetch();
+});
+
+// Update the Unified Histogram state when our request params change
+useEffect(() => {
+  unifiedHistogram?.setRequestParams({
+    dataView,
+    query,
+    filters,
+    timeRange,
+    searchSessionId,
+    requestAdapter,
+  });
+}, [...]);
+
+// Listen for state changes if your application requires it
+useEffect(() => {
+  const subscription = unifiedHistogram?.state$
+    .pipe(map((state) => state.chartHidden), distinctUntilChanged())
+    .subscribe(onChartHiddenChange);
+
+  return () => {
+    subscription?.unsubscribe();
+  };
+}, [...]);
+
+// Currently Lens does not accept a custom request adapter,
+// so it will not use the one passed to Unified Histogram.
+// Instead you can get access to the one it's using by
+// listening for state changes
+useEffect(() => {
+  const subscription = unifiedHistogram?.state$
+    .pipe(map((state) => state.lensRequestAdapter), distinctUntilChanged())
+    .subscribe(onLensRequestAdapterChange);
+
+  return () => {
+    subscription?.unsubscribe();
+  };
+}, [...]);
+
+return (
+  <UnifiedHistogramContainer
+    // Pass the ref callback to receive the API
+    ref={setUnifiedHistogramApi}
+    // Pass a ref to the containing element to
+    // handle top panel resize functionality
+    resizeRef={resizeRef}
+    // Optionally append an element after the
+    // hits counter display
+    appendHitsCounter={<MyButton />}
+  >
+    <MyLayout />
+  </UnifiedHistogramContainer>
+);
+```
diff --git a/src/plugins/unified_histogram/public/__mocks__/data_view.ts b/src/plugins/unified_histogram/public/__mocks__/data_view.ts
index e51b9560949ab..34043e8348c4b 100644
--- a/src/plugins/unified_histogram/public/__mocks__/data_view.ts
+++ b/src/plugins/unified_histogram/public/__mocks__/data_view.ts
@@ -99,6 +99,10 @@ export const buildDataViewMock = ({
     getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
     isTimeNanosBased: () => false,
     isPersisted: () => true,
+    getTimeField: () => {
+      return dataViewFields.find((field) => field.name === timeFieldName);
+    },
+    toSpec: () => ({}),
   } as unknown as DataView;
 
   dataView.isTimeBased = () => !!timeFieldName;
diff --git a/src/plugins/unified_histogram/public/__mocks__/data_view_with_timefield.ts b/src/plugins/unified_histogram/public/__mocks__/data_view_with_timefield.ts
index b0ec2fcf84ebb..3868ed2c70af5 100644
--- a/src/plugins/unified_histogram/public/__mocks__/data_view_with_timefield.ts
+++ b/src/plugins/unified_histogram/public/__mocks__/data_view_with_timefield.ts
@@ -25,6 +25,7 @@ const fields = [
     filterable: true,
     aggregatable: true,
     sortable: true,
+    visualizable: true,
   },
   {
     name: 'message',
diff --git a/src/plugins/unified_histogram/public/__mocks__/services.ts b/src/plugins/unified_histogram/public/__mocks__/services.ts
index 1ce16ad8fae85..e771ab7ea8c1e 100644
--- a/src/plugins/unified_histogram/public/__mocks__/services.ts
+++ b/src/plugins/unified_histogram/public/__mocks__/services.ts
@@ -17,6 +17,9 @@ dataPlugin.query.filterManager.getFilters = jest.fn(() => []);
 export const unifiedHistogramServicesMock = {
   data: dataPlugin,
   fieldFormats: fieldFormatsMock,
+  uiActions: {
+    getTriggerCompatibleActions: jest.fn(() => Promise.resolve([])),
+  },
   uiSettings: {
     get: jest.fn(),
     isDefault: jest.fn(() => true),
@@ -25,5 +28,11 @@ export const unifiedHistogramServicesMock = {
     useChartsTheme: jest.fn(() => EUI_CHARTS_THEME_LIGHT.theme),
     useChartsBaseTheme: jest.fn(() => EUI_CHARTS_THEME_LIGHT.theme),
   },
-  lens: { EmbeddableComponent: jest.fn(() => null) },
+  lens: { EmbeddableComponent: jest.fn(() => null), navigateToPrefilledEditor: jest.fn() },
+  storage: {
+    get: jest.fn(),
+    set: jest.fn(),
+    remove: jest.fn(),
+    clear: jest.fn(),
+  },
 } as unknown as UnifiedHistogramServices;
diff --git a/src/plugins/unified_histogram/public/chart/breakdown_field_selector.test.tsx b/src/plugins/unified_histogram/public/chart/breakdown_field_selector.test.tsx
index 2b6b8bd7c537f..c0c20a1e1a80e 100644
--- a/src/plugins/unified_histogram/public/chart/breakdown_field_selector.test.tsx
+++ b/src/plugins/unified_histogram/public/chart/breakdown_field_selector.test.tsx
@@ -9,10 +9,10 @@
 import { EuiComboBox } from '@elastic/eui';
 import { mountWithIntl } from '@kbn/test-jest-helpers';
 import React from 'react';
-import { UnifiedHistogramBreakdownContext } from '..';
+import { UnifiedHistogramBreakdownContext } from '../types';
 import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
 import { BreakdownFieldSelector } from './breakdown_field_selector';
-import { fieldSupportsBreakdown } from './field_supports_breakdown';
+import { fieldSupportsBreakdown } from './utils/field_supports_breakdown';
 
 describe('BreakdownFieldSelector', () => {
   it('should pass fields that support breakdown as options to the EuiComboBox', () => {
diff --git a/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx b/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
index ef2a14e4423b6..3e72aaad9d179 100644
--- a/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
+++ b/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
@@ -12,7 +12,7 @@ import { DataView, DataViewField } from '@kbn/data-views-plugin/common';
 import { i18n } from '@kbn/i18n';
 import React, { useCallback, useState } from 'react';
 import { UnifiedHistogramBreakdownContext } from '../types';
-import { fieldSupportsBreakdown } from './field_supports_breakdown';
+import { fieldSupportsBreakdown } from './utils/field_supports_breakdown';
 
 export interface BreakdownFieldSelectorProps {
   dataView: DataView;
diff --git a/src/plugins/unified_histogram/public/chart/chart.test.tsx b/src/plugins/unified_histogram/public/chart/chart.test.tsx
index bc4115590b4e2..151b0f2408150 100644
--- a/src/plugins/unified_histogram/public/chart/chart.test.tsx
+++ b/src/plugins/unified_histogram/public/chart/chart.test.tsx
@@ -20,7 +20,12 @@ import { HitsCounter } from '../hits_counter';
 import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
 import { dataViewMock } from '../__mocks__/data_view';
 import { BreakdownFieldSelector } from './breakdown_field_selector';
-import { Histogram } from './histogram';
+
+let mockUseEditVisualization: jest.Mock | undefined = jest.fn();
+
+jest.mock('./hooks/use_edit_visualization', () => ({
+  useEditVisualization: () => mockUseEditVisualization,
+}));
 
 async function mountComponent({
   noChart,
@@ -28,7 +33,6 @@ async function mountComponent({
   noBreakdown,
   chartHidden = false,
   appendHistogram,
-  onEditVisualization = jest.fn(),
   dataView = dataViewWithTimefieldMock,
 }: {
   noChart?: boolean;
@@ -37,7 +41,6 @@ async function mountComponent({
   chartHidden?: boolean;
   appendHistogram?: ReactElement;
   dataView?: DataView;
-  onEditVisualization?: null | (() => void);
 } = {}) {
   (searchSourceInstanceMock.fetch$ as jest.Mock).mockImplementation(
     jest.fn().mockReturnValue(of({ rawResponse: { hits: { total: noHits ? 0 : 2 } } }))
@@ -72,7 +75,6 @@ async function mountComponent({
         },
     breakdown: noBreakdown ? undefined : { field: undefined },
     appendHistogram,
-    onEditVisualization: onEditVisualization || undefined,
     onResetChartHeight: jest.fn(),
     onChartHiddenChange: jest.fn(),
     onTimeIntervalChange: jest.fn(),
@@ -89,6 +91,10 @@ async function mountComponent({
 }
 
 describe('Chart', () => {
+  beforeEach(() => {
+    mockUseEditVisualization = jest.fn();
+  });
+
   test('render when chart is undefined', async () => {
     const component = await mountComponent({ noChart: true });
     expect(
@@ -97,7 +103,8 @@ describe('Chart', () => {
   });
 
   test('render when chart is defined and onEditVisualization is undefined', async () => {
-    const component = await mountComponent({ onEditVisualization: null });
+    mockUseEditVisualization = undefined;
+    const component = await mountComponent();
     expect(
       component.find('[data-test-subj="unifiedHistogramChartOptionsToggle"]').exists()
     ).toBeTruthy();
@@ -133,16 +140,15 @@ describe('Chart', () => {
   });
 
   test('triggers onEditVisualization on click', async () => {
-    const fn = jest.fn();
-    const component = await mountComponent({ onEditVisualization: fn });
+    expect(mockUseEditVisualization).not.toHaveBeenCalled();
+    const component = await mountComponent();
     await act(async () => {
       component
         .find('[data-test-subj="unifiedHistogramEditVisualization"]')
         .first()
         .simulate('click');
     });
-    const lensAttributes = component.find(Histogram).prop('lensAttributes');
-    expect(fn).toHaveBeenCalledWith(lensAttributes);
+    expect(mockUseEditVisualization).toHaveBeenCalled();
   });
 
   it('should render HitsCounter when hits is defined', async () => {
diff --git a/src/plugins/unified_histogram/public/chart/chart.tsx b/src/plugins/unified_histogram/public/chart/chart.tsx
index ccfadcaa07e97..4c590217d30e0 100644
--- a/src/plugins/unified_histogram/public/chart/chart.tsx
+++ b/src/plugins/unified_histogram/public/chart/chart.tsx
@@ -18,12 +18,12 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { DataView, DataViewField, DataViewType } from '@kbn/data-views-plugin/public';
-import type { LensEmbeddableInput, TypedLensByValueInput } from '@kbn/lens-plugin/public';
+import type { LensEmbeddableInput } from '@kbn/lens-plugin/public';
 import type { AggregateQuery, Filter, Query, TimeRange } from '@kbn/es-query';
 import { Subject } from 'rxjs';
 import { HitsCounter } from '../hits_counter';
 import { Histogram } from './histogram';
-import { useChartPanels } from './use_chart_panels';
+import { useChartPanels } from './hooks/use_chart_panels';
 import type {
   UnifiedHistogramBreakdownContext,
   UnifiedHistogramChartContext,
@@ -36,12 +36,13 @@ import type {
   UnifiedHistogramInputMessage,
 } from '../types';
 import { BreakdownFieldSelector } from './breakdown_field_selector';
-import { useTotalHits } from './use_total_hits';
-import { useRequestParams } from './use_request_params';
-import { useChartStyles } from './use_chart_styles';
-import { useChartActions } from './use_chart_actions';
-import { getLensAttributes } from './get_lens_attributes';
-import { useRefetch } from './use_refetch';
+import { useTotalHits } from './hooks/use_total_hits';
+import { useRequestParams } from './hooks/use_request_params';
+import { useChartStyles } from './hooks/use_chart_styles';
+import { useChartActions } from './hooks/use_chart_actions';
+import { getLensAttributes } from './utils/get_lens_attributes';
+import { useRefetch } from './hooks/use_refetch';
+import { useEditVisualization } from './hooks/use_edit_visualization';
 
 export interface ChartProps {
   className?: string;
@@ -60,7 +61,7 @@ export interface ChartProps {
   disableTriggers?: LensEmbeddableInput['disableTriggers'];
   disabledActions?: LensEmbeddableInput['disabledActions'];
   input$?: UnifiedHistogramInput$;
-  onEditVisualization?: (lensAttributes: TypedLensByValueInput['attributes']) => void;
+  getRelativeTimeRange?: () => TimeRange;
   onResetChartHeight?: () => void;
   onChartHiddenChange?: (chartHidden: boolean) => void;
   onTimeIntervalChange?: (timeInterval: string) => void;
@@ -90,7 +91,7 @@ export function Chart({
   disableTriggers,
   disabledActions,
   input$: originalInput$,
-  onEditVisualization: originalOnEditVisualization,
+  getRelativeTimeRange: originalGetRelativeTimeRange,
   onResetChartHeight,
   onChartHiddenChange,
   onTimeIntervalChange,
@@ -191,16 +192,18 @@ export function Chart({
     [breakdown?.field, chart?.timeInterval, chart?.title, dataView, filters, query]
   );
 
-  const onEditVisualization = useMemo(
-    () =>
-      originalOnEditVisualization
-        ? () => {
-            originalOnEditVisualization(lensAttributes);
-          }
-        : undefined,
-    [lensAttributes, originalOnEditVisualization]
+  const getRelativeTimeRange = useMemo(
+    () => originalGetRelativeTimeRange ?? (() => relativeTimeRange),
+    [originalGetRelativeTimeRange, relativeTimeRange]
   );
 
+  const onEditVisualization = useEditVisualization({
+    services,
+    dataView,
+    getRelativeTimeRange,
+    lensAttributes,
+  });
+
   return (
     <EuiFlexGroup
       className={className}
diff --git a/src/plugins/unified_histogram/public/chart/histogram.test.tsx b/src/plugins/unified_histogram/public/chart/histogram.test.tsx
index 7385f20358be3..dcad0d7387b8c 100644
--- a/src/plugins/unified_histogram/public/chart/histogram.test.tsx
+++ b/src/plugins/unified_histogram/public/chart/histogram.test.tsx
@@ -12,13 +12,13 @@ import { unifiedHistogramServicesMock } from '../__mocks__/services';
 import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
 import { createDefaultInspectorAdapters } from '@kbn/expressions-plugin/common';
 import { UnifiedHistogramFetchStatus, UnifiedHistogramInput$ } from '../types';
-import { getLensAttributes } from './get_lens_attributes';
+import { getLensAttributes } from './utils/get_lens_attributes';
 import { act } from 'react-dom/test-utils';
-import * as buildBucketInterval from './build_bucket_interval';
-import * as useTimeRange from './use_time_range';
+import * as buildBucketInterval from './utils/build_bucket_interval';
+import * as useTimeRange from './hooks/use_time_range';
 import { RequestStatus } from '@kbn/inspector-plugin/public';
 import { Subject } from 'rxjs';
-import { getLensProps } from './use_lens_props';
+import { getLensProps } from './hooks/use_lens_props';
 
 const mockBucketInterval = { description: '1 minute', scale: undefined, scaled: false };
 jest.spyOn(buildBucketInterval, 'buildBucketInterval').mockReturnValue(mockBucketInterval);
diff --git a/src/plugins/unified_histogram/public/chart/histogram.tsx b/src/plugins/unified_histogram/public/chart/histogram.tsx
index 01caba4ad48ad..ab905e33464b0 100644
--- a/src/plugins/unified_histogram/public/chart/histogram.tsx
+++ b/src/plugins/unified_histogram/public/chart/histogram.tsx
@@ -27,10 +27,10 @@ import {
   UnifiedHistogramServices,
   UnifiedHistogramInputMessage,
 } from '../types';
-import { buildBucketInterval } from './build_bucket_interval';
-import { useTimeRange } from './use_time_range';
-import { useStableCallback } from './use_stable_callback';
-import { useLensProps } from './use_lens_props';
+import { buildBucketInterval } from './utils/build_bucket_interval';
+import { useTimeRange } from './hooks/use_time_range';
+import { useStableCallback } from './hooks/use_stable_callback';
+import { useLensProps } from './hooks/use_lens_props';
 
 export interface HistogramProps {
   services: UnifiedHistogramServices;
diff --git a/src/plugins/unified_histogram/public/chart/use_chart_actions.test.ts b/src/plugins/unified_histogram/public/chart/hooks/use_chart_actions.test.ts
similarity index 97%
rename from src/plugins/unified_histogram/public/chart/use_chart_actions.test.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_chart_actions.test.ts
index 5967f01fd543b..120dc0b3d0884 100644
--- a/src/plugins/unified_histogram/public/chart/use_chart_actions.test.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_chart_actions.test.ts
@@ -8,7 +8,7 @@
 
 import { renderHook } from '@testing-library/react-hooks';
 import { act } from 'react-test-renderer';
-import { UnifiedHistogramChartContext } from '..';
+import { UnifiedHistogramChartContext } from '../../types';
 import { useChartActions } from './use_chart_actions';
 
 describe('useChartActions', () => {
diff --git a/src/plugins/unified_histogram/public/chart/use_chart_actions.ts b/src/plugins/unified_histogram/public/chart/hooks/use_chart_actions.ts
similarity index 96%
rename from src/plugins/unified_histogram/public/chart/use_chart_actions.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_chart_actions.ts
index 85b876e0862c1..168db2ca0c4d9 100644
--- a/src/plugins/unified_histogram/public/chart/use_chart_actions.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_chart_actions.ts
@@ -7,7 +7,7 @@
  */
 
 import { useCallback, useEffect, useRef, useState } from 'react';
-import type { UnifiedHistogramChartContext } from '../types';
+import type { UnifiedHistogramChartContext } from '../../types';
 
 export const useChartActions = ({
   chart,
diff --git a/src/plugins/unified_histogram/public/chart/use_chart_panels.test.ts b/src/plugins/unified_histogram/public/chart/hooks/use_chart_panels.test.ts
similarity index 100%
rename from src/plugins/unified_histogram/public/chart/use_chart_panels.test.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_chart_panels.test.ts
diff --git a/src/plugins/unified_histogram/public/chart/use_chart_panels.ts b/src/plugins/unified_histogram/public/chart/hooks/use_chart_panels.ts
similarity index 98%
rename from src/plugins/unified_histogram/public/chart/use_chart_panels.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_chart_panels.ts
index 8f2874baa624e..6c6921ba09d6f 100644
--- a/src/plugins/unified_histogram/public/chart/use_chart_panels.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_chart_panels.ts
@@ -12,7 +12,7 @@ import type {
   EuiContextMenuPanelDescriptor,
 } from '@elastic/eui';
 import { search } from '@kbn/data-plugin/public';
-import type { UnifiedHistogramChartContext } from '../types';
+import type { UnifiedHistogramChartContext } from '../../types';
 
 export function useChartPanels({
   chart,
diff --git a/src/plugins/unified_histogram/public/chart/use_chart_styles.tsx b/src/plugins/unified_histogram/public/chart/hooks/use_chart_styles.tsx
similarity index 100%
rename from src/plugins/unified_histogram/public/chart/use_chart_styles.tsx
rename to src/plugins/unified_histogram/public/chart/hooks/use_chart_styles.tsx
diff --git a/src/plugins/unified_histogram/public/chart/hooks/use_edit_visualization.test.ts b/src/plugins/unified_histogram/public/chart/hooks/use_edit_visualization.test.ts
new file mode 100644
index 0000000000000..1d92db77dc376
--- /dev/null
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_edit_visualization.test.ts
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { DataView } from '@kbn/data-views-plugin/common';
+import type { TypedLensByValueInput } from '@kbn/lens-plugin/public';
+import { renderHook } from '@testing-library/react-hooks';
+import { act } from 'react-test-renderer';
+import { setTimeout } from 'timers/promises';
+import { dataViewMock } from '../../__mocks__/data_view';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
+import { unifiedHistogramServicesMock } from '../../__mocks__/services';
+import { useEditVisualization } from './use_edit_visualization';
+
+const getTriggerCompatibleActions = unifiedHistogramServicesMock.uiActions
+  .getTriggerCompatibleActions as jest.Mock;
+
+const navigateToPrefilledEditor = unifiedHistogramServicesMock.lens
+  .navigateToPrefilledEditor as jest.Mock;
+
+describe('useEditVisualization', () => {
+  beforeEach(() => {
+    getTriggerCompatibleActions.mockClear();
+    navigateToPrefilledEditor.mockClear();
+  });
+
+  it('should return a function to edit the visualization', async () => {
+    getTriggerCompatibleActions.mockReturnValue(Promise.resolve([{ id: 'test' }]));
+    const relativeTimeRange = { from: 'now-15m', to: 'now' };
+    const lensAttributes = {
+      visualizationType: 'lnsXY',
+      title: 'test',
+    } as TypedLensByValueInput['attributes'];
+    const hook = renderHook(() =>
+      useEditVisualization({
+        services: unifiedHistogramServicesMock,
+        dataView: dataViewWithTimefieldMock,
+        getRelativeTimeRange: () => relativeTimeRange,
+        lensAttributes,
+      })
+    );
+    await act(() => setTimeout(0));
+    expect(hook.result.current).toBeDefined();
+    hook.result.current!();
+    expect(navigateToPrefilledEditor).toHaveBeenCalledWith({
+      id: '',
+      timeRange: relativeTimeRange,
+      attributes: lensAttributes,
+    });
+  });
+
+  it('should return undefined if the data view has no ID', async () => {
+    getTriggerCompatibleActions.mockReturnValue(Promise.resolve([{ id: 'test' }]));
+    const hook = renderHook(() =>
+      useEditVisualization({
+        services: unifiedHistogramServicesMock,
+        dataView: { ...dataViewWithTimefieldMock, id: undefined } as DataView,
+        getRelativeTimeRange: () => ({ from: 'now-15m', to: 'now' }),
+        lensAttributes: {} as unknown as TypedLensByValueInput['attributes'],
+      })
+    );
+    await act(() => setTimeout(0));
+    expect(hook.result.current).toBeUndefined();
+  });
+
+  it('should return undefined if the data view is not time based', async () => {
+    getTriggerCompatibleActions.mockReturnValue(Promise.resolve([{ id: 'test' }]));
+    const hook = renderHook(() =>
+      useEditVisualization({
+        services: unifiedHistogramServicesMock,
+        dataView: dataViewMock,
+        getRelativeTimeRange: () => ({ from: 'now-15m', to: 'now' }),
+        lensAttributes: {} as unknown as TypedLensByValueInput['attributes'],
+      })
+    );
+    await act(() => setTimeout(0));
+    expect(hook.result.current).toBeUndefined();
+  });
+
+  it('should return undefined if the time field is not visualizable', async () => {
+    getTriggerCompatibleActions.mockReturnValue(Promise.resolve([{ id: 'test' }]));
+    const dataView = {
+      ...dataViewWithTimefieldMock,
+      getTimeField: () => {
+        return { ...dataViewWithTimefieldMock.getTimeField(), visualizable: false };
+      },
+    } as DataView;
+    const hook = renderHook(() =>
+      useEditVisualization({
+        services: unifiedHistogramServicesMock,
+        dataView,
+        getRelativeTimeRange: () => ({ from: 'now-15m', to: 'now' }),
+        lensAttributes: {} as unknown as TypedLensByValueInput['attributes'],
+      })
+    );
+    await act(() => setTimeout(0));
+    expect(hook.result.current).toBeUndefined();
+  });
+
+  it('should return undefined if there are no compatible actions', async () => {
+    getTriggerCompatibleActions.mockReturnValue(Promise.resolve([]));
+    const hook = renderHook(() =>
+      useEditVisualization({
+        services: unifiedHistogramServicesMock,
+        dataView: dataViewWithTimefieldMock,
+        getRelativeTimeRange: () => ({ from: 'now-15m', to: 'now' }),
+        lensAttributes: {} as unknown as TypedLensByValueInput['attributes'],
+      })
+    );
+    await act(() => setTimeout(0));
+    expect(hook.result.current).toBeUndefined();
+  });
+});
diff --git a/src/plugins/unified_histogram/public/chart/hooks/use_edit_visualization.ts b/src/plugins/unified_histogram/public/chart/hooks/use_edit_visualization.ts
new file mode 100644
index 0000000000000..ba72f5bc9264e
--- /dev/null
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_edit_visualization.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { DataView } from '@kbn/data-views-plugin/common';
+import type { TimeRange } from '@kbn/es-query';
+import type { TypedLensByValueInput } from '@kbn/lens-plugin/public';
+import type { VISUALIZE_FIELD_TRIGGER } from '@kbn/ui-actions-plugin/public';
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import type { UnifiedHistogramServices } from '../..';
+
+// Avoid taking a dependency on uiActionsPlugin just for this const
+const visualizeFieldTrigger: typeof VISUALIZE_FIELD_TRIGGER = 'VISUALIZE_FIELD_TRIGGER';
+
+export const useEditVisualization = ({
+  services,
+  dataView,
+  getRelativeTimeRange,
+  lensAttributes,
+}: {
+  services: UnifiedHistogramServices;
+  dataView: DataView;
+  getRelativeTimeRange: () => TimeRange;
+  lensAttributes: TypedLensByValueInput['attributes'];
+}) => {
+  const [canVisualize, setCanVisualize] = useState(false);
+
+  const checkCanVisualize = useCallback(async () => {
+    if (!dataView.id || !dataView.isTimeBased() || !dataView.getTimeField().visualizable) {
+      return false;
+    }
+
+    const compatibleActions = await services.uiActions.getTriggerCompatibleActions(
+      visualizeFieldTrigger,
+      {
+        dataViewSpec: dataView.toSpec(false),
+        fieldName: dataView.timeFieldName,
+      }
+    );
+
+    return Boolean(compatibleActions.length);
+  }, [dataView, services.uiActions]);
+
+  const onEditVisualization = useMemo(() => {
+    if (!canVisualize) {
+      return undefined;
+    }
+
+    return () => {
+      services.lens.navigateToPrefilledEditor({
+        id: '',
+        timeRange: getRelativeTimeRange(),
+        attributes: lensAttributes,
+      });
+    };
+  }, [canVisualize, getRelativeTimeRange, lensAttributes, services.lens]);
+
+  useEffect(() => {
+    checkCanVisualize().then(setCanVisualize);
+  }, [checkCanVisualize]);
+
+  return onEditVisualization;
+};
diff --git a/src/plugins/unified_histogram/public/chart/use_lens_props.test.ts b/src/plugins/unified_histogram/public/chart/hooks/use_lens_props.test.ts
similarity index 92%
rename from src/plugins/unified_histogram/public/chart/use_lens_props.test.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_lens_props.test.ts
index 289536edd0232..bae6b9ca50b22 100644
--- a/src/plugins/unified_histogram/public/chart/use_lens_props.test.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_lens_props.test.ts
@@ -9,9 +9,9 @@
 import { renderHook } from '@testing-library/react-hooks';
 import { act } from 'react-test-renderer';
 import { Subject } from 'rxjs';
-import type { UnifiedHistogramInputMessage } from '../types';
-import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
-import { getLensAttributes } from './get_lens_attributes';
+import type { UnifiedHistogramInputMessage } from '../../types';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
+import { getLensAttributes } from '../utils/get_lens_attributes';
 import { getLensProps, useLensProps } from './use_lens_props';
 
 describe('useLensProps', () => {
diff --git a/src/plugins/unified_histogram/public/chart/use_lens_props.ts b/src/plugins/unified_histogram/public/chart/hooks/use_lens_props.ts
similarity index 98%
rename from src/plugins/unified_histogram/public/chart/use_lens_props.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_lens_props.ts
index 976f191dba5c3..cea2f28521efd 100644
--- a/src/plugins/unified_histogram/public/chart/use_lens_props.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_lens_props.ts
@@ -12,7 +12,7 @@ import type { DefaultInspectorAdapters } from '@kbn/expressions-plugin/common';
 import type { TypedLensByValueInput } from '@kbn/lens-plugin/public';
 import { useCallback, useEffect, useState } from 'react';
 import type { Observable } from 'rxjs';
-import type { UnifiedHistogramInputMessage, UnifiedHistogramRequestContext } from '../types';
+import type { UnifiedHistogramInputMessage, UnifiedHistogramRequestContext } from '../../types';
 import { useStableCallback } from './use_stable_callback';
 
 export const useLensProps = ({
diff --git a/src/plugins/unified_histogram/public/chart/use_refetch.test.ts b/src/plugins/unified_histogram/public/chart/hooks/use_refetch.test.ts
similarity index 96%
rename from src/plugins/unified_histogram/public/chart/use_refetch.test.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_refetch.test.ts
index 39381ea661865..15ddf1f0f0f81 100644
--- a/src/plugins/unified_histogram/public/chart/use_refetch.test.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_refetch.test.ts
@@ -16,8 +16,8 @@ import {
   UnifiedHistogramHitsContext,
   UnifiedHistogramInput$,
   UnifiedHistogramRequestContext,
-} from '../types';
-import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
+} from '../../types';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
 import { Subject } from 'rxjs';
 
 describe('useRefetch', () => {
diff --git a/src/plugins/unified_histogram/public/chart/use_refetch.ts b/src/plugins/unified_histogram/public/chart/hooks/use_refetch.ts
similarity index 97%
rename from src/plugins/unified_histogram/public/chart/use_refetch.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_refetch.ts
index 31e08f3d732e5..344526860477f 100644
--- a/src/plugins/unified_histogram/public/chart/use_refetch.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_refetch.ts
@@ -17,7 +17,7 @@ import {
   UnifiedHistogramHitsContext,
   UnifiedHistogramInput$,
   UnifiedHistogramRequestContext,
-} from '../types';
+} from '../../types';
 
 export const useRefetch = ({
   dataView,
@@ -48,7 +48,7 @@ export const useRefetch = ({
 }) => {
   const refetchDeps = useRef<ReturnType<typeof getRefetchDeps>>();
 
-  // When the unified histogram props change, we must compare the current subset
+  // When the Unified Histogram props change, we must compare the current subset
   // that should trigger a histogram refetch against the previous subset. If they
   // are different, we must refetch the histogram to ensure it's up to date.
   useEffect(() => {
diff --git a/src/plugins/unified_histogram/public/chart/use_request_params.test.ts b/src/plugins/unified_histogram/public/chart/hooks/use_request_params.test.ts
similarity index 95%
rename from src/plugins/unified_histogram/public/chart/use_request_params.test.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_request_params.test.ts
index c49bcd4ce195b..f3889d1de6a42 100644
--- a/src/plugins/unified_histogram/public/chart/use_request_params.test.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_request_params.test.ts
@@ -7,7 +7,7 @@
  */
 
 import { renderHook } from '@testing-library/react-hooks';
-import { unifiedHistogramServicesMock } from '../__mocks__/services';
+import { unifiedHistogramServicesMock } from '../../__mocks__/services';
 
 const getUseRequestParams = async () => {
   jest.doMock('@kbn/data-plugin/common', () => {
diff --git a/src/plugins/unified_histogram/public/chart/use_request_params.tsx b/src/plugins/unified_histogram/public/chart/hooks/use_request_params.tsx
similarity index 96%
rename from src/plugins/unified_histogram/public/chart/use_request_params.tsx
rename to src/plugins/unified_histogram/public/chart/hooks/use_request_params.tsx
index 8afe803d329af..c5ea702f898f0 100644
--- a/src/plugins/unified_histogram/public/chart/use_request_params.tsx
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_request_params.tsx
@@ -9,7 +9,7 @@
 import { getAbsoluteTimeRange } from '@kbn/data-plugin/common';
 import type { AggregateQuery, Filter, Query, TimeRange } from '@kbn/es-query';
 import { useCallback, useMemo, useRef } from 'react';
-import type { UnifiedHistogramServices } from '../types';
+import type { UnifiedHistogramServices } from '../../types';
 import { useStableCallback } from './use_stable_callback';
 
 export const useRequestParams = ({
diff --git a/src/plugins/unified_histogram/public/chart/use_stable_callback.test.ts b/src/plugins/unified_histogram/public/chart/hooks/use_stable_callback.test.ts
similarity index 100%
rename from src/plugins/unified_histogram/public/chart/use_stable_callback.test.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_stable_callback.test.ts
diff --git a/src/plugins/unified_histogram/public/chart/use_stable_callback.ts b/src/plugins/unified_histogram/public/chart/hooks/use_stable_callback.ts
similarity index 83%
rename from src/plugins/unified_histogram/public/chart/use_stable_callback.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_stable_callback.ts
index 9b81470c5ff5c..2982ca02953b5 100644
--- a/src/plugins/unified_histogram/public/chart/use_stable_callback.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_stable_callback.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { useCallback, useEffect, useRef } from 'react';
+import { useEffect, useRef } from 'react';
 
 /**
  * Accepts a callback and returns a function with a stable identity
@@ -19,5 +19,5 @@ export const useStableCallback = <T extends (...args: any[]) => any>(fn: T | und
     ref.current = fn;
   }, [fn]);
 
-  return useCallback((...args: Parameters<T>) => ref.current?.(...args), []);
+  return useRef((...args: Parameters<T>) => ref.current?.(...args)).current;
 };
diff --git a/src/plugins/unified_histogram/public/chart/use_time_range.test.tsx b/src/plugins/unified_histogram/public/chart/hooks/use_time_range.test.tsx
similarity index 99%
rename from src/plugins/unified_histogram/public/chart/use_time_range.test.tsx
rename to src/plugins/unified_histogram/public/chart/hooks/use_time_range.test.tsx
index 26070db1c7e54..35951d637315c 100644
--- a/src/plugins/unified_histogram/public/chart/use_time_range.test.tsx
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_time_range.test.tsx
@@ -9,7 +9,7 @@
 import { uiSettingsServiceMock } from '@kbn/core-ui-settings-browser-mocks';
 import { TimeRange } from '@kbn/data-plugin/common';
 import { renderHook } from '@testing-library/react-hooks';
-import { UnifiedHistogramBucketInterval } from '../types';
+import { UnifiedHistogramBucketInterval } from '../../types';
 import { useTimeRange } from './use_time_range';
 
 jest.mock('@kbn/datemath', () => ({
diff --git a/src/plugins/unified_histogram/public/chart/use_time_range.tsx b/src/plugins/unified_histogram/public/chart/hooks/use_time_range.tsx
similarity index 98%
rename from src/plugins/unified_histogram/public/chart/use_time_range.tsx
rename to src/plugins/unified_histogram/public/chart/hooks/use_time_range.tsx
index 539f32251b832..dbf563da17588 100644
--- a/src/plugins/unified_histogram/public/chart/use_time_range.tsx
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_time_range.tsx
@@ -13,7 +13,7 @@ import { i18n } from '@kbn/i18n';
 import React, { useCallback, useMemo } from 'react';
 import dateMath from '@kbn/datemath';
 import type { TimeRange } from '@kbn/data-plugin/common';
-import type { UnifiedHistogramBucketInterval } from '../types';
+import type { UnifiedHistogramBucketInterval } from '../../types';
 
 export const useTimeRange = ({
   uiSettings,
diff --git a/src/plugins/unified_histogram/public/chart/use_total_hits.test.ts b/src/plugins/unified_histogram/public/chart/hooks/use_total_hits.test.ts
similarity index 98%
rename from src/plugins/unified_histogram/public/chart/use_total_hits.test.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_total_hits.test.ts
index ea6ab4676e681..fae169c41f2e7 100644
--- a/src/plugins/unified_histogram/public/chart/use_total_hits.test.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_total_hits.test.ts
@@ -7,8 +7,8 @@
  */
 
 import { Filter } from '@kbn/es-query';
-import { UnifiedHistogramFetchStatus, UnifiedHistogramInput$ } from '../types';
-import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
+import { UnifiedHistogramFetchStatus, UnifiedHistogramInput$ } from '../../types';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
 import { useTotalHits } from './use_total_hits';
 import { useEffect as mockUseEffect } from 'react';
 import { renderHook } from '@testing-library/react-hooks';
diff --git a/src/plugins/unified_histogram/public/chart/use_total_hits.ts b/src/plugins/unified_histogram/public/chart/hooks/use_total_hits.ts
similarity index 99%
rename from src/plugins/unified_histogram/public/chart/use_total_hits.ts
rename to src/plugins/unified_histogram/public/chart/hooks/use_total_hits.ts
index e7227edd76684..95916c1f2bc02 100644
--- a/src/plugins/unified_histogram/public/chart/use_total_hits.ts
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_total_hits.ts
@@ -19,7 +19,7 @@ import {
   UnifiedHistogramInputMessage,
   UnifiedHistogramRequestContext,
   UnifiedHistogramServices,
-} from '../types';
+} from '../../types';
 import { useStableCallback } from './use_stable_callback';
 
 export const useTotalHits = ({
diff --git a/src/plugins/unified_histogram/public/chart/build_bucket_interval.test.ts b/src/plugins/unified_histogram/public/chart/utils/build_bucket_interval.test.ts
similarity index 97%
rename from src/plugins/unified_histogram/public/chart/build_bucket_interval.test.ts
rename to src/plugins/unified_histogram/public/chart/utils/build_bucket_interval.test.ts
index 072f7a811babe..058b403c9159a 100644
--- a/src/plugins/unified_histogram/public/chart/build_bucket_interval.test.ts
+++ b/src/plugins/unified_histogram/public/chart/utils/build_bucket_interval.test.ts
@@ -7,7 +7,7 @@
  */
 
 import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
-import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
 import { calculateBounds } from '@kbn/data-plugin/public';
 import { buildBucketInterval } from './build_bucket_interval';
 
diff --git a/src/plugins/unified_histogram/public/chart/build_bucket_interval.ts b/src/plugins/unified_histogram/public/chart/utils/build_bucket_interval.ts
similarity index 91%
rename from src/plugins/unified_histogram/public/chart/build_bucket_interval.ts
rename to src/plugins/unified_histogram/public/chart/utils/build_bucket_interval.ts
index b3c9671662dbc..91dcd18d6f93b 100644
--- a/src/plugins/unified_histogram/public/chart/build_bucket_interval.ts
+++ b/src/plugins/unified_histogram/public/chart/utils/build_bucket_interval.ts
@@ -10,12 +10,12 @@ import type { SearchResponse } from '@elastic/elasticsearch/lib/api/types';
 import { DataPublicPluginStart, search, tabifyAggResponse } from '@kbn/data-plugin/public';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import type { TimeRange } from '@kbn/es-query';
-import type { UnifiedHistogramBucketInterval } from '../types';
+import type { UnifiedHistogramBucketInterval } from '../../types';
 import { getChartAggConfigs } from './get_chart_agg_configs';
 
 /**
  * Convert the response from the chart request into a format that can be used
- * by the unified histogram chart. The returned object should be used to update
+ * by the Unified Histogram chart. The returned object should be used to update
  * time range interval of histogram.
  */
 export const buildBucketInterval = ({
diff --git a/src/plugins/unified_histogram/public/chart/field_supports_breakdown.test.ts b/src/plugins/unified_histogram/public/chart/utils/field_supports_breakdown.test.ts
similarity index 100%
rename from src/plugins/unified_histogram/public/chart/field_supports_breakdown.test.ts
rename to src/plugins/unified_histogram/public/chart/utils/field_supports_breakdown.test.ts
diff --git a/src/plugins/unified_histogram/public/chart/field_supports_breakdown.ts b/src/plugins/unified_histogram/public/chart/utils/field_supports_breakdown.ts
similarity index 100%
rename from src/plugins/unified_histogram/public/chart/field_supports_breakdown.ts
rename to src/plugins/unified_histogram/public/chart/utils/field_supports_breakdown.ts
diff --git a/src/plugins/unified_histogram/public/chart/get_chart_agg_config.test.ts b/src/plugins/unified_histogram/public/chart/utils/get_chart_agg_config.test.ts
similarity index 95%
rename from src/plugins/unified_histogram/public/chart/get_chart_agg_config.test.ts
rename to src/plugins/unified_histogram/public/chart/utils/get_chart_agg_config.test.ts
index ef5ce1b677153..bb6263f31586b 100644
--- a/src/plugins/unified_histogram/public/chart/get_chart_agg_config.test.ts
+++ b/src/plugins/unified_histogram/public/chart/utils/get_chart_agg_config.test.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
 import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { getChartAggConfigs } from './get_chart_agg_configs';
 
diff --git a/src/plugins/unified_histogram/public/chart/get_chart_agg_configs.ts b/src/plugins/unified_histogram/public/chart/utils/get_chart_agg_configs.ts
similarity index 92%
rename from src/plugins/unified_histogram/public/chart/get_chart_agg_configs.ts
rename to src/plugins/unified_histogram/public/chart/utils/get_chart_agg_configs.ts
index d68330a22a45d..6724514cbc546 100644
--- a/src/plugins/unified_histogram/public/chart/get_chart_agg_configs.ts
+++ b/src/plugins/unified_histogram/public/chart/utils/get_chart_agg_configs.ts
@@ -11,7 +11,7 @@ import type { DataView } from '@kbn/data-views-plugin/common';
 import type { TimeRange } from '@kbn/es-query';
 
 /**
- * Helper function to get the agg configs required for the unified histogram chart request
+ * Helper function to get the agg configs required for the Unified Histogram chart request
  */
 export function getChartAggConfigs({
   dataView,
diff --git a/src/plugins/unified_histogram/public/chart/get_lens_attributes.test.ts b/src/plugins/unified_histogram/public/chart/utils/get_lens_attributes.test.ts
similarity index 99%
rename from src/plugins/unified_histogram/public/chart/get_lens_attributes.test.ts
rename to src/plugins/unified_histogram/public/chart/utils/get_lens_attributes.test.ts
index 3e0ac936a6573..442e3d5fa4318 100644
--- a/src/plugins/unified_histogram/public/chart/get_lens_attributes.test.ts
+++ b/src/plugins/unified_histogram/public/chart/utils/get_lens_attributes.test.ts
@@ -9,7 +9,7 @@
 import { getLensAttributes } from './get_lens_attributes';
 import { AggregateQuery, Filter, FilterStateStore, Query } from '@kbn/es-query';
 import type { DataView, DataViewField } from '@kbn/data-views-plugin/public';
-import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
 
 describe('getLensAttributes', () => {
   const dataView: DataView = dataViewWithTimefieldMock;
diff --git a/src/plugins/unified_histogram/public/chart/get_lens_attributes.ts b/src/plugins/unified_histogram/public/chart/utils/get_lens_attributes.ts
similarity index 100%
rename from src/plugins/unified_histogram/public/chart/get_lens_attributes.ts
rename to src/plugins/unified_histogram/public/chart/utils/get_lens_attributes.ts
diff --git a/src/plugins/unified_histogram/public/container/container.test.tsx b/src/plugins/unified_histogram/public/container/container.test.tsx
new file mode 100644
index 0000000000000..c9481c4ff4cbb
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/container.test.tsx
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { RequestAdapter } from '@kbn/inspector-plugin/common';
+import { mountWithIntl } from '@kbn/test-jest-helpers';
+import React from 'react';
+import { act } from 'react-dom/test-utils';
+import { UnifiedHistogramFetchStatus } from '../types';
+import { dataViewWithTimefieldMock } from '../__mocks__/data_view_with_timefield';
+import { unifiedHistogramServicesMock } from '../__mocks__/services';
+import { UnifiedHistogramApi, UnifiedHistogramContainer } from './container';
+import type { UnifiedHistogramState } from './services/state_service';
+
+describe('UnifiedHistogramContainer', () => {
+  const initialState: UnifiedHistogramState = {
+    breakdownField: 'bytes',
+    chartHidden: false,
+    dataView: dataViewWithTimefieldMock,
+    filters: [],
+    lensRequestAdapter: new RequestAdapter(),
+    query: { language: 'kuery', query: '' },
+    requestAdapter: new RequestAdapter(),
+    searchSessionId: '123',
+    timeInterval: 'auto',
+    timeRange: { from: 'now-15m', to: 'now' },
+    topPanelHeight: 100,
+    totalHitsStatus: UnifiedHistogramFetchStatus.uninitialized,
+    totalHitsResult: undefined,
+  };
+
+  it('should set ref', () => {
+    let api: UnifiedHistogramApi | undefined;
+    const setApi = (ref: UnifiedHistogramApi) => {
+      api = ref;
+    };
+    mountWithIntl(<UnifiedHistogramContainer ref={setApi} resizeRef={{ current: null }} />);
+    expect(api).toBeDefined();
+  });
+
+  it('should return null if not initialized', async () => {
+    const component = mountWithIntl(<UnifiedHistogramContainer resizeRef={{ current: null }} />);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(component.update().isEmptyRender()).toBe(true);
+  });
+
+  it('should not return null if initialized', async () => {
+    const setApi = (api: UnifiedHistogramApi | null) => {
+      if (!api || api.initialized) {
+        return;
+      }
+      api?.initialize({
+        services: unifiedHistogramServicesMock,
+        initialState,
+      });
+    };
+    const component = mountWithIntl(
+      <UnifiedHistogramContainer ref={setApi} resizeRef={{ current: null }} />
+    );
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(component.update().isEmptyRender()).toBe(false);
+  });
+
+  it('should update initialized property when initialized', async () => {
+    let api: UnifiedHistogramApi | undefined;
+    const setApi = (ref: UnifiedHistogramApi) => {
+      api = ref;
+    };
+    mountWithIntl(<UnifiedHistogramContainer ref={setApi} resizeRef={{ current: null }} />);
+    expect(api?.initialized).toBe(false);
+    act(() => {
+      if (!api?.initialized) {
+        api?.initialize({
+          services: unifiedHistogramServicesMock,
+          initialState,
+        });
+      }
+    });
+    expect(api?.initialized).toBe(true);
+  });
+});
diff --git a/src/plugins/unified_histogram/public/container/container.tsx b/src/plugins/unified_histogram/public/container/container.tsx
new file mode 100644
index 0000000000000..f079b38d179ff
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/container.tsx
@@ -0,0 +1,172 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { forwardRef, useImperativeHandle, useMemo, useState } from 'react';
+import { Subject } from 'rxjs';
+import { pick } from 'lodash';
+import { UnifiedHistogramLayout, UnifiedHistogramLayoutProps } from '../layout';
+import type { UnifiedHistogramInputMessage } from '../types';
+import {
+  createStateService,
+  UnifiedHistogramStateOptions,
+  UnifiedHistogramStateService,
+} from './services/state_service';
+import { useStateProps } from './hooks/use_state_props';
+import { useStateSelector } from './utils/use_state_selector';
+import {
+  dataViewSelector,
+  filtersSelector,
+  querySelector,
+  timeRangeSelector,
+  topPanelHeightSelector,
+} from './utils/state_selectors';
+
+type LayoutProps = Pick<
+  UnifiedHistogramLayoutProps,
+  | 'services'
+  | 'disableAutoFetching'
+  | 'disableTriggers'
+  | 'disabledActions'
+  | 'getRelativeTimeRange'
+>;
+
+/**
+ * The props exposed by the container
+ */
+export type UnifiedHistogramContainerProps = Pick<
+  UnifiedHistogramLayoutProps,
+  'className' | 'resizeRef' | 'appendHitsCounter' | 'children'
+>;
+
+/**
+ * The options used to initialize the container
+ */
+export type UnifiedHistogramInitializeOptions = UnifiedHistogramStateOptions &
+  Omit<LayoutProps, 'services'>;
+
+/**
+ * The uninitialized API exposed by the container
+ */
+export interface UnifiedHistogramUninitializedApi {
+  /**
+   * Whether the container has been initialized
+   */
+  initialized: false;
+  /**
+   * Initialize the container
+   */
+  initialize: (options: UnifiedHistogramInitializeOptions) => void;
+}
+
+/**
+ * The initialized API exposed by the container
+ */
+export type UnifiedHistogramInitializedApi = {
+  /**
+   * Whether the container has been initialized
+   */
+  initialized: true;
+  /**
+   * Manually trigger a refetch of the data
+   */
+  refetch: () => void;
+} & Pick<
+  UnifiedHistogramStateService,
+  | 'state$'
+  | 'setChartHidden'
+  | 'setTopPanelHeight'
+  | 'setBreakdownField'
+  | 'setTimeInterval'
+  | 'setRequestParams'
+  | 'setTotalHits'
+>;
+
+/**
+ * The API exposed by the container
+ */
+export type UnifiedHistogramApi = UnifiedHistogramUninitializedApi | UnifiedHistogramInitializedApi;
+
+export const UnifiedHistogramContainer = forwardRef<
+  UnifiedHistogramApi,
+  UnifiedHistogramContainerProps
+>((containerProps, ref) => {
+  const [initialized, setInitialized] = useState(false);
+  const [layoutProps, setLayoutProps] = useState<LayoutProps>();
+  const [stateService, setStateService] = useState<UnifiedHistogramStateService>();
+  const [input$] = useState(() => new Subject<UnifiedHistogramInputMessage>());
+  const api = useMemo<UnifiedHistogramApi>(
+    () => ({
+      initialized,
+      initialize: (options: UnifiedHistogramInitializeOptions) => {
+        const {
+          services,
+          disableAutoFetching,
+          disableTriggers,
+          disabledActions,
+          getRelativeTimeRange,
+        } = options;
+
+        setLayoutProps({
+          services,
+          disableAutoFetching,
+          disableTriggers,
+          disabledActions,
+          getRelativeTimeRange,
+        });
+        setStateService(createStateService(options));
+        setInitialized(true);
+      },
+      refetch: () => {
+        input$.next({ type: 'refetch' });
+      },
+      ...pick(
+        stateService!,
+        'state$',
+        'setChartHidden',
+        'setTopPanelHeight',
+        'setBreakdownField',
+        'setTimeInterval',
+        'setRequestParams',
+        'setTotalHits'
+      ),
+    }),
+    [initialized, input$, stateService]
+  );
+
+  // Expose the API to the parent component
+  useImperativeHandle(ref, () => api, [api]);
+
+  const stateProps = useStateProps(stateService);
+  const dataView = useStateSelector(stateService?.state$, dataViewSelector);
+  const query = useStateSelector(stateService?.state$, querySelector);
+  const filters = useStateSelector(stateService?.state$, filtersSelector);
+  const timeRange = useStateSelector(stateService?.state$, timeRangeSelector);
+  const topPanelHeight = useStateSelector(stateService?.state$, topPanelHeightSelector);
+
+  // Don't render anything until the container is initialized
+  if (!layoutProps || !dataView) {
+    return null;
+  }
+
+  return (
+    <UnifiedHistogramLayout
+      {...containerProps}
+      {...layoutProps}
+      {...stateProps}
+      dataView={dataView}
+      query={query}
+      filters={filters}
+      timeRange={timeRange}
+      topPanelHeight={topPanelHeight}
+      input$={input$}
+    />
+  );
+});
+
+// eslint-disable-next-line import/no-default-export
+export default UnifiedHistogramContainer;
diff --git a/src/plugins/unified_histogram/public/container/hooks/use_state_props.test.ts b/src/plugins/unified_histogram/public/container/hooks/use_state_props.test.ts
new file mode 100644
index 0000000000000..c36e5239bfe29
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/hooks/use_state_props.test.ts
@@ -0,0 +1,265 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { DataView, DataViewField, DataViewType } from '@kbn/data-views-plugin/common';
+import { RequestAdapter } from '@kbn/inspector-plugin/common';
+import { renderHook } from '@testing-library/react-hooks';
+import { act } from 'react-test-renderer';
+import { UnifiedHistogramFetchStatus } from '../../types';
+import { dataViewMock } from '../../__mocks__/data_view';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
+import { unifiedHistogramServicesMock } from '../../__mocks__/services';
+import {
+  createStateService,
+  UnifiedHistogramState,
+  UnifiedHistogramStateOptions,
+} from '../services/state_service';
+import { useStateProps } from './use_state_props';
+
+describe('useStateProps', () => {
+  const initialState: UnifiedHistogramState = {
+    breakdownField: 'bytes',
+    chartHidden: false,
+    dataView: dataViewWithTimefieldMock,
+    filters: [],
+    lensRequestAdapter: new RequestAdapter(),
+    query: { language: 'kuery', query: '' },
+    requestAdapter: new RequestAdapter(),
+    searchSessionId: '123',
+    timeInterval: 'auto',
+    timeRange: { from: 'now-15m', to: 'now' },
+    topPanelHeight: 100,
+    totalHitsStatus: UnifiedHistogramFetchStatus.uninitialized,
+    totalHitsResult: undefined,
+  };
+
+  const getStateService = (options: Omit<UnifiedHistogramStateOptions, 'services'>) => {
+    const stateService = createStateService({
+      ...options,
+      services: unifiedHistogramServicesMock,
+    });
+    jest.spyOn(stateService, 'setChartHidden');
+    jest.spyOn(stateService, 'setTopPanelHeight');
+    jest.spyOn(stateService, 'setBreakdownField');
+    jest.spyOn(stateService, 'setTimeInterval');
+    jest.spyOn(stateService, 'setRequestParams');
+    jest.spyOn(stateService, 'setLensRequestAdapter');
+    jest.spyOn(stateService, 'setTotalHits');
+    return stateService;
+  };
+
+  it('should return the correct props', () => {
+    const stateService = getStateService({ initialState });
+    const { result } = renderHook(() => useStateProps(stateService));
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "breakdown": Object {
+          "field": Object {
+            "aggregatable": true,
+            "displayName": "bytes",
+            "filterable": true,
+            "name": "bytes",
+            "scripted": false,
+            "type": "number",
+          },
+        },
+        "chart": Object {
+          "hidden": false,
+          "timeInterval": "auto",
+        },
+        "hits": Object {
+          "status": "uninitialized",
+          "total": undefined,
+        },
+        "onBreakdownFieldChange": [Function],
+        "onChartHiddenChange": [Function],
+        "onChartLoad": [Function],
+        "onTimeIntervalChange": [Function],
+        "onTopPanelHeightChange": [Function],
+        "onTotalHitsChange": [Function],
+        "request": Object {
+          "adapter": RequestAdapter {
+            "_events": Object {},
+            "_eventsCount": 0,
+            "_maxListeners": undefined,
+            "requests": Map {},
+            Symbol(kCapture): false,
+          },
+          "searchSessionId": "123",
+        },
+      }
+    `);
+  });
+
+  it('should return the correct props when an SQL query is used', () => {
+    const stateService = getStateService({
+      initialState: { ...initialState, query: { sql: 'SELECT * FROM index' } },
+    });
+    const { result } = renderHook(() => useStateProps(stateService));
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "breakdown": undefined,
+        "chart": undefined,
+        "hits": undefined,
+        "onBreakdownFieldChange": [Function],
+        "onChartHiddenChange": [Function],
+        "onChartLoad": [Function],
+        "onTimeIntervalChange": [Function],
+        "onTopPanelHeightChange": [Function],
+        "onTotalHitsChange": [Function],
+        "request": Object {
+          "adapter": RequestAdapter {
+            "_events": Object {},
+            "_eventsCount": 0,
+            "_maxListeners": undefined,
+            "requests": Map {},
+            Symbol(kCapture): false,
+          },
+          "searchSessionId": "123",
+        },
+      }
+    `);
+  });
+
+  it('should return the correct props when a rollup data view is used', () => {
+    const stateService = getStateService({
+      initialState: {
+        ...initialState,
+        dataView: {
+          ...dataViewWithTimefieldMock,
+          type: DataViewType.ROLLUP,
+        } as DataView,
+      },
+    });
+    const { result } = renderHook(() => useStateProps(stateService));
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "breakdown": undefined,
+        "chart": undefined,
+        "hits": Object {
+          "status": "uninitialized",
+          "total": undefined,
+        },
+        "onBreakdownFieldChange": [Function],
+        "onChartHiddenChange": [Function],
+        "onChartLoad": [Function],
+        "onTimeIntervalChange": [Function],
+        "onTopPanelHeightChange": [Function],
+        "onTotalHitsChange": [Function],
+        "request": Object {
+          "adapter": RequestAdapter {
+            "_events": Object {},
+            "_eventsCount": 0,
+            "_maxListeners": undefined,
+            "requests": Map {},
+            Symbol(kCapture): false,
+          },
+          "searchSessionId": "123",
+        },
+      }
+    `);
+  });
+
+  it('should return the correct props when a non time based data view is used', () => {
+    const stateService = getStateService({
+      initialState: { ...initialState, dataView: dataViewMock },
+    });
+    const { result } = renderHook(() => useStateProps(stateService));
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "breakdown": undefined,
+        "chart": undefined,
+        "hits": Object {
+          "status": "uninitialized",
+          "total": undefined,
+        },
+        "onBreakdownFieldChange": [Function],
+        "onChartHiddenChange": [Function],
+        "onChartLoad": [Function],
+        "onTimeIntervalChange": [Function],
+        "onTopPanelHeightChange": [Function],
+        "onTotalHitsChange": [Function],
+        "request": Object {
+          "adapter": RequestAdapter {
+            "_events": Object {},
+            "_eventsCount": 0,
+            "_maxListeners": undefined,
+            "requests": Map {},
+            Symbol(kCapture): false,
+          },
+          "searchSessionId": "123",
+        },
+      }
+    `);
+  });
+
+  it('should execute callbacks correctly', () => {
+    const stateService = getStateService({ initialState });
+    const { result } = renderHook(() => useStateProps(stateService));
+    const {
+      onTopPanelHeightChange,
+      onTimeIntervalChange,
+      onTotalHitsChange,
+      onChartHiddenChange,
+      onChartLoad,
+      onBreakdownFieldChange,
+    } = result.current;
+    act(() => {
+      onTopPanelHeightChange(200);
+    });
+    expect(stateService.setTopPanelHeight).toHaveBeenLastCalledWith(200);
+    act(() => {
+      onTimeIntervalChange('1d');
+    });
+    expect(stateService.setTimeInterval).toHaveBeenLastCalledWith('1d');
+    act(() => {
+      onTotalHitsChange(UnifiedHistogramFetchStatus.complete, 100);
+    });
+    expect(stateService.setTotalHits).toHaveBeenLastCalledWith({
+      totalHitsStatus: UnifiedHistogramFetchStatus.complete,
+      totalHitsResult: 100,
+    });
+    act(() => {
+      onChartHiddenChange(true);
+    });
+    expect(stateService.setChartHidden).toHaveBeenLastCalledWith(true);
+    const requests = new RequestAdapter();
+    act(() => {
+      onChartLoad({ adapters: { requests } });
+    });
+    expect(stateService.setLensRequestAdapter).toHaveBeenLastCalledWith(requests);
+    act(() => {
+      onBreakdownFieldChange({ name: 'field' } as DataViewField);
+    });
+    expect(stateService.setBreakdownField).toHaveBeenLastCalledWith('field');
+  });
+
+  it('should clear lensRequestAdapter when chart is hidden', () => {
+    const stateService = getStateService({ initialState });
+    const hook = renderHook(() => useStateProps(stateService));
+    (stateService.setLensRequestAdapter as jest.Mock).mockClear();
+    expect(stateService.setLensRequestAdapter).not.toHaveBeenCalled();
+    act(() => {
+      stateService.setChartHidden(true);
+    });
+    hook.rerender();
+    expect(stateService.setLensRequestAdapter).toHaveBeenLastCalledWith(undefined);
+  });
+
+  it('should clear lensRequestAdapter when chart is undefined', () => {
+    const stateService = getStateService({ initialState });
+    const hook = renderHook(() => useStateProps(stateService));
+    (stateService.setLensRequestAdapter as jest.Mock).mockClear();
+    expect(stateService.setLensRequestAdapter).not.toHaveBeenCalled();
+    act(() => {
+      stateService.setRequestParams({ dataView: dataViewMock });
+    });
+    hook.rerender();
+    expect(stateService.setLensRequestAdapter).toHaveBeenLastCalledWith(undefined);
+  });
+});
diff --git a/src/plugins/unified_histogram/public/container/hooks/use_state_props.ts b/src/plugins/unified_histogram/public/container/hooks/use_state_props.ts
new file mode 100644
index 0000000000000..56b2da38ac2fa
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/hooks/use_state_props.ts
@@ -0,0 +1,162 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { DataViewField, DataViewType } from '@kbn/data-views-plugin/common';
+import { getAggregateQueryMode, isOfAggregateQueryType } from '@kbn/es-query';
+import { useCallback, useEffect, useMemo } from 'react';
+import { UnifiedHistogramChartLoadEvent, UnifiedHistogramFetchStatus } from '../../types';
+import type { UnifiedHistogramStateService } from '../services/state_service';
+import {
+  breakdownFieldSelector,
+  chartHiddenSelector,
+  dataViewSelector,
+  querySelector,
+  requestAdapterSelector,
+  searchSessionIdSelector,
+  timeIntervalSelector,
+  totalHitsResultSelector,
+  totalHitsStatusSelector,
+} from '../utils/state_selectors';
+import { useStateSelector } from '../utils/use_state_selector';
+
+export const useStateProps = (stateService: UnifiedHistogramStateService | undefined) => {
+  const breakdownField = useStateSelector(stateService?.state$, breakdownFieldSelector);
+  const chartHidden = useStateSelector(stateService?.state$, chartHiddenSelector);
+  const dataView = useStateSelector(stateService?.state$, dataViewSelector);
+  const query = useStateSelector(stateService?.state$, querySelector);
+  const requestAdapter = useStateSelector(stateService?.state$, requestAdapterSelector);
+  const searchSessionId = useStateSelector(stateService?.state$, searchSessionIdSelector);
+  const timeInterval = useStateSelector(stateService?.state$, timeIntervalSelector);
+  const totalHitsResult = useStateSelector(stateService?.state$, totalHitsResultSelector);
+  const totalHitsStatus = useStateSelector(stateService?.state$, totalHitsStatusSelector);
+
+  /**
+   * Contexts
+   */
+
+  const isPlainRecord = useMemo(() => {
+    return query && isOfAggregateQueryType(query) && getAggregateQueryMode(query) === 'sql';
+  }, [query]);
+
+  const isTimeBased = useMemo(() => {
+    return dataView && dataView.type !== DataViewType.ROLLUP && dataView.isTimeBased();
+  }, [dataView]);
+
+  const hits = useMemo(() => {
+    if (isPlainRecord || totalHitsResult instanceof Error) {
+      return undefined;
+    }
+
+    return {
+      status: totalHitsStatus,
+      total: totalHitsResult,
+    };
+  }, [isPlainRecord, totalHitsResult, totalHitsStatus]);
+
+  const chart = useMemo(() => {
+    if (isPlainRecord || !isTimeBased) {
+      return undefined;
+    }
+
+    return {
+      hidden: chartHidden,
+      timeInterval,
+    };
+  }, [chartHidden, isPlainRecord, isTimeBased, timeInterval]);
+
+  const breakdown = useMemo(() => {
+    if (isPlainRecord || !isTimeBased) {
+      return undefined;
+    }
+
+    return {
+      field: breakdownField ? dataView?.getFieldByName(breakdownField) : undefined,
+    };
+  }, [breakdownField, dataView, isPlainRecord, isTimeBased]);
+
+  const request = useMemo(() => {
+    return {
+      searchSessionId,
+      adapter: requestAdapter,
+    };
+  }, [requestAdapter, searchSessionId]);
+
+  /**
+   * Callbacks
+   */
+
+  const onTopPanelHeightChange = useCallback(
+    (topPanelHeight: number | undefined) => {
+      stateService?.setTopPanelHeight(topPanelHeight);
+    },
+    [stateService]
+  );
+
+  const onTimeIntervalChange = useCallback(
+    (newTimeInterval: string) => {
+      stateService?.setTimeInterval(newTimeInterval);
+    },
+    [stateService]
+  );
+
+  const onTotalHitsChange = useCallback(
+    (newTotalHitsStatus: UnifiedHistogramFetchStatus, newTotalHitsResult?: number | Error) => {
+      stateService?.setTotalHits({
+        totalHitsStatus: newTotalHitsStatus,
+        totalHitsResult: newTotalHitsResult,
+      });
+    },
+    [stateService]
+  );
+
+  const onChartHiddenChange = useCallback(
+    (newChartHidden: boolean) => {
+      stateService?.setChartHidden(newChartHidden);
+    },
+    [stateService]
+  );
+
+  const onChartLoad = useCallback(
+    (event: UnifiedHistogramChartLoadEvent) => {
+      // We need to store the Lens request adapter in order to inspect its requests
+      stateService?.setLensRequestAdapter(event.adapters.requests);
+    },
+    [stateService]
+  );
+
+  const onBreakdownFieldChange = useCallback(
+    (newBreakdownField: DataViewField | undefined) => {
+      stateService?.setBreakdownField(newBreakdownField?.name);
+    },
+    [stateService]
+  );
+
+  /**
+   * Effects
+   */
+
+  // Clear the Lens request adapter when the chart is hidden
+  useEffect(() => {
+    if (chartHidden || !chart) {
+      stateService?.setLensRequestAdapter(undefined);
+    }
+  }, [chart, chartHidden, stateService]);
+
+  return {
+    hits,
+    chart,
+    breakdown,
+    request,
+    onTopPanelHeightChange,
+    onTimeIntervalChange,
+    onTotalHitsChange,
+    onChartHiddenChange,
+    onChartLoad,
+    onBreakdownFieldChange,
+  };
+};
diff --git a/src/plugins/unified_histogram/public/layout/index.tsx b/src/plugins/unified_histogram/public/container/index.tsx
similarity index 63%
rename from src/plugins/unified_histogram/public/layout/index.tsx
rename to src/plugins/unified_histogram/public/container/index.tsx
index a729bdff0871c..f692401c4fdbf 100644
--- a/src/plugins/unified_histogram/public/layout/index.tsx
+++ b/src/plugins/unified_histogram/public/container/index.tsx
@@ -10,9 +10,24 @@ import { EuiDelayRender, EuiFlexGroup, EuiLoadingSpinner } from '@elastic/eui';
 import { withSuspense } from '@kbn/shared-ux-utility';
 import React, { lazy } from 'react';
 
-export type { UnifiedHistogramLayoutProps } from './layout';
+export type {
+  UnifiedHistogramUninitializedApi,
+  UnifiedHistogramInitializedApi,
+  UnifiedHistogramApi,
+  UnifiedHistogramContainerProps,
+  UnifiedHistogramInitializeOptions,
+} from './container';
+export type { UnifiedHistogramState, UnifiedHistogramStateOptions } from './services/state_service';
+export {
+  getChartHidden,
+  getTopPanelHeight,
+  getBreakdownField,
+  setChartHidden,
+  setTopPanelHeight,
+  setBreakdownField,
+} from './utils/local_storage_utils';
 
-const LazyUnifiedHistogramLayout = lazy(() => import('./layout'));
+const LazyUnifiedHistogramContainer = lazy(() => import('./container'));
 
 /**
  * A resizable layout component with two panels that renders a histogram with a hits
@@ -20,8 +35,8 @@ const LazyUnifiedHistogramLayout = lazy(() => import('./layout'));
  * If all context props are left undefined, the layout will render in a single panel
  * mode including only the main display.
  */
-export const UnifiedHistogramLayout = withSuspense(
-  LazyUnifiedHistogramLayout,
+export const UnifiedHistogramContainer = withSuspense(
+  LazyUnifiedHistogramContainer,
   <EuiDelayRender delay={300}>
     <EuiFlexGroup
       className="eui-fullHeight"
diff --git a/src/plugins/unified_histogram/public/container/services/state_service.test.ts b/src/plugins/unified_histogram/public/container/services/state_service.test.ts
new file mode 100644
index 0000000000000..a663672fb8356
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/services/state_service.test.ts
@@ -0,0 +1,259 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { Filter } from '@kbn/es-query';
+import { RequestAdapter } from '@kbn/inspector-plugin/common';
+import { UnifiedHistogramFetchStatus } from '../..';
+import { dataViewMock } from '../../__mocks__/data_view';
+import { dataViewWithTimefieldMock } from '../../__mocks__/data_view_with_timefield';
+import { unifiedHistogramServicesMock } from '../../__mocks__/services';
+import {
+  getChartHidden,
+  getTopPanelHeight,
+  getBreakdownField,
+  setChartHidden,
+  setTopPanelHeight,
+  setBreakdownField,
+} from '../utils/local_storage_utils';
+import { createStateService, UnifiedHistogramState } from './state_service';
+
+jest.mock('../utils/local_storage_utils', () => {
+  const originalModule = jest.requireActual('../utils/local_storage_utils');
+  return {
+    ...originalModule,
+    getChartHidden: jest.fn(originalModule.getChartHidden),
+    getTopPanelHeight: jest.fn(originalModule.getTopPanelHeight),
+    getBreakdownField: jest.fn(originalModule.getBreakdownField),
+    setChartHidden: jest.fn(originalModule.setChartHidden),
+    setTopPanelHeight: jest.fn(originalModule.setTopPanelHeight),
+    setBreakdownField: jest.fn(originalModule.setBreakdownField),
+  };
+});
+
+describe('UnifiedHistogramStateService', () => {
+  beforeEach(() => {
+    (getChartHidden as jest.Mock).mockClear();
+    (getTopPanelHeight as jest.Mock).mockClear();
+    (getBreakdownField as jest.Mock).mockClear();
+    (setChartHidden as jest.Mock).mockClear();
+    (setTopPanelHeight as jest.Mock).mockClear();
+    (setBreakdownField as jest.Mock).mockClear();
+  });
+
+  const initialState: UnifiedHistogramState = {
+    breakdownField: 'bytes',
+    chartHidden: false,
+    dataView: dataViewWithTimefieldMock,
+    filters: [],
+    lensRequestAdapter: new RequestAdapter(),
+    query: { language: 'kuery', query: '' },
+    requestAdapter: new RequestAdapter(),
+    searchSessionId: '123',
+    timeInterval: 'auto',
+    timeRange: { from: 'now-15m', to: 'now' },
+    topPanelHeight: 100,
+    totalHitsStatus: UnifiedHistogramFetchStatus.uninitialized,
+    totalHitsResult: undefined,
+  };
+
+  it('should initialize state with default values', () => {
+    const stateService = createStateService({
+      services: unifiedHistogramServicesMock,
+      initialState: {
+        dataView: dataViewWithTimefieldMock,
+      },
+    });
+    let state: UnifiedHistogramState | undefined;
+    stateService.state$.subscribe((s) => (state = s));
+    expect(state).toEqual({
+      breakdownField: undefined,
+      chartHidden: false,
+      dataView: dataViewWithTimefieldMock,
+      filters: [],
+      lensRequestAdapter: undefined,
+      query: unifiedHistogramServicesMock.data.query.queryString.getDefaultQuery(),
+      requestAdapter: undefined,
+      searchSessionId: undefined,
+      timeInterval: 'auto',
+      timeRange: unifiedHistogramServicesMock.data.query.timefilter.timefilter.getTimeDefaults(),
+      topPanelHeight: undefined,
+      totalHitsResult: undefined,
+      totalHitsStatus: UnifiedHistogramFetchStatus.uninitialized,
+    });
+  });
+
+  it('should initialize state with initial values', () => {
+    const stateService = createStateService({
+      services: unifiedHistogramServicesMock,
+      initialState,
+    });
+    let state: UnifiedHistogramState | undefined;
+    stateService.state$.subscribe((s) => (state = s));
+    expect(state).toEqual(initialState);
+  });
+
+  it('should get values from storage if localStorageKeyPrefix is provided', () => {
+    const localStorageKeyPrefix = 'test';
+    createStateService({
+      services: unifiedHistogramServicesMock,
+      localStorageKeyPrefix,
+      initialState,
+    });
+    expect(getChartHidden as jest.Mock).toHaveBeenCalledWith(
+      unifiedHistogramServicesMock.storage,
+      localStorageKeyPrefix
+    );
+    expect(getTopPanelHeight as jest.Mock).toHaveBeenCalledWith(
+      unifiedHistogramServicesMock.storage,
+      localStorageKeyPrefix
+    );
+    expect(getBreakdownField as jest.Mock).toHaveBeenCalledWith(
+      unifiedHistogramServicesMock.storage,
+      localStorageKeyPrefix
+    );
+  });
+
+  it('should not get values from storage if localStorageKeyPrefix is not provided', () => {
+    createStateService({
+      services: unifiedHistogramServicesMock,
+      initialState,
+    });
+    expect(getChartHidden as jest.Mock).not.toHaveBeenCalled();
+    expect(getTopPanelHeight as jest.Mock).not.toHaveBeenCalled();
+    expect(getBreakdownField as jest.Mock).not.toHaveBeenCalled();
+  });
+
+  it('should update state', () => {
+    const stateService = createStateService({
+      services: unifiedHistogramServicesMock,
+      initialState,
+    });
+    let state: UnifiedHistogramState | undefined;
+    let newState = initialState;
+    stateService.state$.subscribe((s) => (state = s));
+    expect(state).toEqual(newState);
+    stateService.setChartHidden(true);
+    newState = { ...newState, chartHidden: true };
+    expect(state).toEqual(newState);
+    stateService.setTopPanelHeight(200);
+    newState = { ...newState, topPanelHeight: 200 };
+    expect(state).toEqual(newState);
+    stateService.setBreakdownField('test');
+    newState = { ...newState, breakdownField: 'test' };
+    expect(state).toEqual(newState);
+    stateService.setTimeInterval('test');
+    newState = { ...newState, timeInterval: 'test' };
+    expect(state).toEqual(newState);
+    const requestParams = {
+      dataView: dataViewMock,
+      filters: ['test'] as unknown as Filter[],
+      query: { language: 'kuery', query: 'test' },
+      requestAdapter: undefined,
+      searchSessionId: '321',
+      timeRange: { from: 'now-30m', to: 'now' },
+    };
+    stateService.setRequestParams(requestParams);
+    newState = { ...newState, ...requestParams };
+    expect(state).toEqual(newState);
+    stateService.setLensRequestAdapter(undefined);
+    newState = { ...newState, lensRequestAdapter: undefined };
+    expect(state).toEqual(newState);
+    stateService.setTotalHits({
+      totalHitsStatus: UnifiedHistogramFetchStatus.complete,
+      totalHitsResult: 100,
+    });
+    newState = {
+      ...newState,
+      totalHitsStatus: UnifiedHistogramFetchStatus.complete,
+      totalHitsResult: 100,
+    };
+    expect(state).toEqual(newState);
+  });
+
+  it('should update state and save it to storage if localStorageKeyPrefix is provided', () => {
+    const localStorageKeyPrefix = 'test';
+    const stateService = createStateService({
+      services: unifiedHistogramServicesMock,
+      localStorageKeyPrefix,
+      initialState,
+    });
+    let state: UnifiedHistogramState | undefined;
+    stateService.state$.subscribe((s) => (state = s));
+    expect(state).toEqual(initialState);
+    stateService.setChartHidden(true);
+    stateService.setTopPanelHeight(200);
+    stateService.setBreakdownField('test');
+    expect(state).toEqual({
+      ...initialState,
+      chartHidden: true,
+      topPanelHeight: 200,
+      breakdownField: 'test',
+    });
+    expect(setChartHidden as jest.Mock).toHaveBeenCalledWith(
+      unifiedHistogramServicesMock.storage,
+      localStorageKeyPrefix,
+      true
+    );
+    expect(setTopPanelHeight as jest.Mock).toHaveBeenCalledWith(
+      unifiedHistogramServicesMock.storage,
+      localStorageKeyPrefix,
+      200
+    );
+    expect(setBreakdownField as jest.Mock).toHaveBeenCalledWith(
+      unifiedHistogramServicesMock.storage,
+      localStorageKeyPrefix,
+      'test'
+    );
+  });
+
+  it('should not save state to storage if localStorageKeyPrefix is not provided', () => {
+    const stateService = createStateService({
+      services: unifiedHistogramServicesMock,
+      initialState,
+    });
+    let state: UnifiedHistogramState | undefined;
+    stateService.state$.subscribe((s) => (state = s));
+    expect(state).toEqual(initialState);
+    stateService.setChartHidden(true);
+    stateService.setTopPanelHeight(200);
+    stateService.setBreakdownField('test');
+    expect(state).toEqual({
+      ...initialState,
+      chartHidden: true,
+      topPanelHeight: 200,
+      breakdownField: 'test',
+    });
+    expect(setChartHidden as jest.Mock).not.toHaveBeenCalled();
+    expect(setTopPanelHeight as jest.Mock).not.toHaveBeenCalled();
+    expect(setBreakdownField as jest.Mock).not.toHaveBeenCalled();
+  });
+
+  it('should not update total hits to loading when the current status is partial', () => {
+    const stateService = createStateService({
+      services: unifiedHistogramServicesMock,
+      initialState: {
+        ...initialState,
+        totalHitsStatus: UnifiedHistogramFetchStatus.partial,
+      },
+    });
+    let state: UnifiedHistogramState | undefined;
+    stateService.state$.subscribe((s) => (state = s));
+    expect(state).toEqual({
+      ...initialState,
+      totalHitsStatus: UnifiedHistogramFetchStatus.partial,
+    });
+    stateService.setTotalHits({
+      totalHitsStatus: UnifiedHistogramFetchStatus.loading,
+      totalHitsResult: 100,
+    });
+    expect(state).toEqual({
+      ...initialState,
+      totalHitsStatus: UnifiedHistogramFetchStatus.partial,
+    });
+  });
+});
diff --git a/src/plugins/unified_histogram/public/container/services/state_service.ts b/src/plugins/unified_histogram/public/container/services/state_service.ts
new file mode 100644
index 0000000000000..5e8ad3b8e8b66
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/services/state_service.ts
@@ -0,0 +1,248 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { DataView } from '@kbn/data-views-plugin/common';
+import type { AggregateQuery, Filter, Query, TimeRange } from '@kbn/es-query';
+import type { RequestAdapter } from '@kbn/inspector-plugin/common';
+import { BehaviorSubject, Observable } from 'rxjs';
+import { UnifiedHistogramFetchStatus } from '../..';
+import type { UnifiedHistogramServices } from '../../types';
+import {
+  getBreakdownField,
+  getChartHidden,
+  getTopPanelHeight,
+  setBreakdownField,
+  setChartHidden,
+  setTopPanelHeight,
+} from '../utils/local_storage_utils';
+
+/**
+ * The current state of the container
+ */
+export interface UnifiedHistogramState {
+  /**
+   * The current field used for the breakdown
+   */
+  breakdownField: string | undefined;
+  /**
+   * Whether or not the chart is hidden
+   */
+  chartHidden: boolean;
+  /**
+   * The current data view
+   */
+  dataView: DataView;
+  /**
+   * The current filters
+   */
+  filters: Filter[];
+  /**
+   * The current Lens request adapter
+   */
+  lensRequestAdapter: RequestAdapter | undefined;
+  /**
+   * The current query
+   */
+  query: Query | AggregateQuery;
+  /**
+   * The current request adapter used for non-Lens requests
+   */
+  requestAdapter: RequestAdapter | undefined;
+  /**
+   * The current search session ID
+   */
+  searchSessionId: string | undefined;
+  /**
+   * The current time interval of the chart
+   */
+  timeInterval: string;
+  /**
+   * The current time range
+   */
+  timeRange: TimeRange;
+  /**
+   * The current top panel height
+   */
+  topPanelHeight: number | undefined;
+  /**
+   * The current fetch status of the hits count request
+   */
+  totalHitsStatus: UnifiedHistogramFetchStatus;
+  /**
+   * The current result of the hits count request
+   */
+  totalHitsResult: number | Error | undefined;
+}
+
+/**
+ * The options used to initialize the comntainer state
+ */
+export interface UnifiedHistogramStateOptions {
+  /**
+   * The services required by the Unified Histogram components
+   */
+  services: UnifiedHistogramServices;
+  /**
+   * The prefix for the keys used in local storage -- leave undefined to avoid using local storage
+   */
+  localStorageKeyPrefix?: string;
+  /**
+   * The initial state of the container
+   */
+  initialState: Partial<UnifiedHistogramState> & Pick<UnifiedHistogramState, 'dataView'>;
+}
+
+/**
+ * The service used to manage the state of the container
+ */
+export interface UnifiedHistogramStateService {
+  /**
+   * The current state of the container
+   */
+  state$: Observable<UnifiedHistogramState>;
+  /**
+   * Sets the current chart hidden state
+   */
+  setChartHidden: (chartHidden: boolean) => void;
+  /**
+   * Sets the current top panel height
+   */
+  setTopPanelHeight: (topPanelHeight: number | undefined) => void;
+  /**
+   * Sets the current breakdown field
+   */
+  setBreakdownField: (breakdownField: string | undefined) => void;
+  /**
+   * Sets the current time interval
+   */
+  setTimeInterval: (timeInterval: string) => void;
+  /**
+   * Sets the current request parameters
+   */
+  setRequestParams: (requestParams: {
+    dataView?: DataView;
+    filters?: Filter[];
+    query?: Query | AggregateQuery;
+    requestAdapter?: RequestAdapter | undefined;
+    searchSessionId?: string | undefined;
+    timeRange?: TimeRange;
+  }) => void;
+  /**
+   * Sets the current Lens request adapter
+   */
+  setLensRequestAdapter: (lensRequestAdapter: RequestAdapter | undefined) => void;
+  /**
+   * Sets the current total hits status and result
+   */
+  setTotalHits: (totalHits: {
+    totalHitsStatus: UnifiedHistogramFetchStatus;
+    totalHitsResult: number | Error | undefined;
+  }) => void;
+}
+
+export const createStateService = (
+  options: UnifiedHistogramStateOptions
+): UnifiedHistogramStateService => {
+  const { services, localStorageKeyPrefix, initialState } = options;
+
+  let initialChartHidden = false;
+  let initialTopPanelHeight: number | undefined;
+  let initialBreakdownField: string | undefined;
+
+  if (localStorageKeyPrefix) {
+    initialChartHidden = getChartHidden(services.storage, localStorageKeyPrefix) ?? false;
+    initialTopPanelHeight = getTopPanelHeight(services.storage, localStorageKeyPrefix);
+    initialBreakdownField = getBreakdownField(services.storage, localStorageKeyPrefix);
+  }
+
+  const state$ = new BehaviorSubject({
+    breakdownField: initialBreakdownField,
+    chartHidden: initialChartHidden,
+    filters: [],
+    lensRequestAdapter: undefined,
+    query: services.data.query.queryString.getDefaultQuery(),
+    requestAdapter: undefined,
+    searchSessionId: undefined,
+    timeInterval: 'auto',
+    timeRange: services.data.query.timefilter.timefilter.getTimeDefaults(),
+    topPanelHeight: initialTopPanelHeight,
+    totalHitsResult: undefined,
+    totalHitsStatus: UnifiedHistogramFetchStatus.uninitialized,
+    ...initialState,
+  });
+
+  const updateState = (stateUpdate: Partial<UnifiedHistogramState>) => {
+    state$.next({
+      ...state$.getValue(),
+      ...stateUpdate,
+    });
+  };
+
+  return {
+    state$,
+
+    setChartHidden: (chartHidden: boolean) => {
+      if (localStorageKeyPrefix) {
+        setChartHidden(services.storage, localStorageKeyPrefix, chartHidden);
+      }
+
+      updateState({ chartHidden });
+    },
+
+    setTopPanelHeight: (topPanelHeight: number | undefined) => {
+      if (localStorageKeyPrefix) {
+        setTopPanelHeight(services.storage, localStorageKeyPrefix, topPanelHeight);
+      }
+
+      updateState({ topPanelHeight });
+    },
+
+    setBreakdownField: (breakdownField: string | undefined) => {
+      if (localStorageKeyPrefix) {
+        setBreakdownField(services.storage, localStorageKeyPrefix, breakdownField);
+      }
+
+      updateState({ breakdownField });
+    },
+
+    setTimeInterval: (timeInterval: string) => {
+      updateState({ timeInterval });
+    },
+
+    setRequestParams: (requestParams: {
+      dataView?: DataView;
+      filters?: Filter[];
+      query?: Query | AggregateQuery;
+      requestAdapter?: RequestAdapter | undefined;
+      searchSessionId?: string | undefined;
+      timeRange?: TimeRange;
+    }) => {
+      updateState(requestParams);
+    },
+
+    setLensRequestAdapter: (lensRequestAdapter: RequestAdapter | undefined) => {
+      updateState({ lensRequestAdapter });
+    },
+
+    setTotalHits: (totalHits: {
+      totalHitsStatus: UnifiedHistogramFetchStatus;
+      totalHitsResult: number | Error | undefined;
+    }) => {
+      // If we have a partial result already, we don't
+      // want to update the total hits back to loading
+      if (
+        state$.getValue().totalHitsStatus === UnifiedHistogramFetchStatus.partial &&
+        totalHits.totalHitsStatus === UnifiedHistogramFetchStatus.loading
+      ) {
+        return;
+      }
+
+      updateState(totalHits);
+    },
+  };
+};
diff --git a/src/plugins/unified_histogram/public/container/utils/local_storage_utils.test.ts b/src/plugins/unified_histogram/public/container/utils/local_storage_utils.test.ts
new file mode 100644
index 0000000000000..5b0c8a7363a0a
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/utils/local_storage_utils.test.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { Storage } from '@kbn/kibana-utils-plugin/public';
+import {
+  CHART_HIDDEN_KEY,
+  getBreakdownField,
+  getChartHidden,
+  getTopPanelHeight,
+  HISTOGRAM_BREAKDOWN_FIELD_KEY,
+  HISTOGRAM_HEIGHT_KEY,
+  setBreakdownField,
+  setChartHidden,
+  setTopPanelHeight,
+} from './local_storage_utils';
+
+describe('local storage utils', () => {
+  const localStorageKeyPrefix = 'testPrefix';
+  const mockStorage = {
+    get: jest.fn((key: string) => {
+      switch (key) {
+        case `${localStorageKeyPrefix}:${CHART_HIDDEN_KEY}`:
+          return true;
+        case `${localStorageKeyPrefix}:${HISTOGRAM_HEIGHT_KEY}`:
+          return 100;
+        case `${localStorageKeyPrefix}:${HISTOGRAM_BREAKDOWN_FIELD_KEY}`:
+          return 'testField';
+        default:
+          return undefined;
+      }
+    }),
+    set: jest.fn(),
+  };
+  const storage = mockStorage as unknown as Storage;
+
+  it('should execute get functions correctly', () => {
+    expect(getChartHidden(storage, localStorageKeyPrefix)).toEqual(true);
+    expect(mockStorage.get).toHaveBeenLastCalledWith(
+      `${localStorageKeyPrefix}:${CHART_HIDDEN_KEY}`
+    );
+    expect(getTopPanelHeight(storage, localStorageKeyPrefix)).toEqual(100);
+    expect(mockStorage.get).toHaveBeenLastCalledWith(
+      `${localStorageKeyPrefix}:${HISTOGRAM_HEIGHT_KEY}`
+    );
+    expect(getBreakdownField(storage, localStorageKeyPrefix)).toEqual('testField');
+    expect(mockStorage.get).toHaveBeenLastCalledWith(
+      `${localStorageKeyPrefix}:${HISTOGRAM_BREAKDOWN_FIELD_KEY}`
+    );
+  });
+
+  it('should execute set functions correctly', () => {
+    setChartHidden(storage, localStorageKeyPrefix, false);
+    expect(mockStorage.set).toHaveBeenLastCalledWith(
+      `${localStorageKeyPrefix}:${CHART_HIDDEN_KEY}`,
+      false
+    );
+    setTopPanelHeight(storage, localStorageKeyPrefix, 200);
+    expect(mockStorage.set).toHaveBeenLastCalledWith(
+      `${localStorageKeyPrefix}:${HISTOGRAM_HEIGHT_KEY}`,
+      200
+    );
+    setBreakdownField(storage, localStorageKeyPrefix, 'testField2');
+    expect(mockStorage.set).toHaveBeenLastCalledWith(
+      `${localStorageKeyPrefix}:${HISTOGRAM_BREAKDOWN_FIELD_KEY}`,
+      'testField2'
+    );
+  });
+});
diff --git a/src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts b/src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts
new file mode 100644
index 0000000000000..3b5f89e7d057e
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Storage } from '@kbn/kibana-utils-plugin/public';
+
+export const CHART_HIDDEN_KEY = 'chartHidden';
+export const HISTOGRAM_HEIGHT_KEY = 'histogramHeight';
+export const HISTOGRAM_BREAKDOWN_FIELD_KEY = 'histogramBreakdownField';
+
+const getLocalStorageKey = (prefix: string, key: string) => `${prefix}:${key}`;
+
+/**
+ * Get the chart hidden state from local storage
+ */
+export const getChartHidden = (
+  storage: Storage,
+  localStorageKeyPrefix: string
+): boolean | undefined => storage.get(getLocalStorageKey(localStorageKeyPrefix, CHART_HIDDEN_KEY));
+
+/**
+ * Get the top panel height from local storage
+ */
+export const getTopPanelHeight = (
+  storage: Storage,
+  localStorageKeyPrefix: string
+): number | undefined =>
+  storage.get(getLocalStorageKey(localStorageKeyPrefix, HISTOGRAM_HEIGHT_KEY)) ?? undefined;
+
+/**
+ * Get the breakdown field from local storage
+ */
+export const getBreakdownField = (
+  storage: Storage,
+  localStorageKeyPrefix: string
+): string | undefined =>
+  storage.get(getLocalStorageKey(localStorageKeyPrefix, HISTOGRAM_BREAKDOWN_FIELD_KEY)) ??
+  undefined;
+
+/**
+ * Set the chart hidden state in local storage
+ */
+export const setChartHidden = (
+  storage: Storage,
+  localStorageKeyPrefix: string,
+  chartHidden: boolean | undefined
+) => storage.set(getLocalStorageKey(localStorageKeyPrefix, CHART_HIDDEN_KEY), chartHidden);
+
+/**
+ * Set the top panel height in local storage
+ */
+export const setTopPanelHeight = (
+  storage: Storage,
+  localStorageKeyPrefix: string,
+  topPanelHeight: number | undefined
+) => storage.set(getLocalStorageKey(localStorageKeyPrefix, HISTOGRAM_HEIGHT_KEY), topPanelHeight);
+
+/**
+ * Set the breakdown field in local storage
+ */
+export const setBreakdownField = (
+  storage: Storage,
+  localStorageKeyPrefix: string,
+  breakdownField: string | undefined
+) =>
+  storage.set(
+    getLocalStorageKey(localStorageKeyPrefix, HISTOGRAM_BREAKDOWN_FIELD_KEY),
+    breakdownField
+  );
diff --git a/src/plugins/unified_histogram/public/container/utils/state_selectors.ts b/src/plugins/unified_histogram/public/container/utils/state_selectors.ts
new file mode 100644
index 0000000000000..87f425ae64b45
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/utils/state_selectors.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { UnifiedHistogramState } from '../services/state_service';
+
+export const breakdownFieldSelector = (state: UnifiedHistogramState) => state.breakdownField;
+export const chartHiddenSelector = (state: UnifiedHistogramState) => state.chartHidden;
+export const dataViewSelector = (state: UnifiedHistogramState) => state.dataView;
+export const filtersSelector = (state: UnifiedHistogramState) => state.filters;
+export const querySelector = (state: UnifiedHistogramState) => state.query;
+export const requestAdapterSelector = (state: UnifiedHistogramState) => state.requestAdapter;
+export const searchSessionIdSelector = (state: UnifiedHistogramState) => state.searchSessionId;
+export const timeIntervalSelector = (state: UnifiedHistogramState) => state.timeInterval;
+export const timeRangeSelector = (state: UnifiedHistogramState) => state.timeRange;
+export const topPanelHeightSelector = (state: UnifiedHistogramState) => state.topPanelHeight;
+export const totalHitsResultSelector = (state: UnifiedHistogramState) => state.totalHitsResult;
+export const totalHitsStatusSelector = (state: UnifiedHistogramState) => state.totalHitsStatus;
diff --git a/src/plugins/unified_histogram/public/container/utils/use_state_selector.ts b/src/plugins/unified_histogram/public/container/utils/use_state_selector.ts
new file mode 100644
index 0000000000000..5920a34f90acb
--- /dev/null
+++ b/src/plugins/unified_histogram/public/container/utils/use_state_selector.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Observable } from 'rxjs';
+import { distinctUntilChanged, map } from 'rxjs/operators';
+import { useEffect, useState } from 'react';
+
+export const useStateSelector = <S, R>(
+  state$: Observable<S> | undefined,
+  selector: (state: S) => R,
+  equalityFn?: (arg0: R, arg1: R) => boolean
+) => {
+  const [state, setState] = useState<R>();
+
+  useEffect(() => {
+    const subscription = state$
+      ?.pipe(map(selector), distinctUntilChanged(equalityFn))
+      .subscribe(setState);
+
+    return () => {
+      subscription?.unsubscribe();
+    };
+  }, [equalityFn, selector, state$]);
+
+  return state;
+};
diff --git a/src/plugins/unified_histogram/public/index.ts b/src/plugins/unified_histogram/public/index.ts
index 97cebb51fdc2f..b183a5a1f8180 100644
--- a/src/plugins/unified_histogram/public/index.ts
+++ b/src/plugins/unified_histogram/public/index.ts
@@ -8,19 +8,28 @@
 
 import { UnifiedHistogramPublicPlugin } from './plugin';
 
-export type { UnifiedHistogramLayoutProps } from './layout';
-export { UnifiedHistogramLayout } from './layout';
+export type {
+  UnifiedHistogramUninitializedApi,
+  UnifiedHistogramInitializedApi,
+  UnifiedHistogramApi,
+  UnifiedHistogramContainerProps,
+  UnifiedHistogramInitializeOptions,
+  UnifiedHistogramState,
+  UnifiedHistogramStateOptions,
+} from './container';
+export {
+  UnifiedHistogramContainer,
+  getChartHidden,
+  getTopPanelHeight,
+  getBreakdownField,
+  setChartHidden,
+  setTopPanelHeight,
+  setBreakdownField,
+} from './container';
 export type {
   UnifiedHistogramServices,
-  UnifiedHistogramRequestContext,
-  UnifiedHistogramHitsContext,
-  UnifiedHistogramChartContext,
-  UnifiedHistogramBreakdownContext,
   UnifiedHistogramChartLoadEvent,
   UnifiedHistogramAdapters,
-  UnifiedHistogramRefetchMessage,
-  UnifiedHistogramInputMessage,
-  UnifiedHistogramInput$,
 } from './types';
 export { UnifiedHistogramFetchStatus } from './types';
 
diff --git a/src/plugins/unified_histogram/public/layout/index.ts b/src/plugins/unified_histogram/public/layout/index.ts
new file mode 100644
index 0000000000000..560ea44483c20
--- /dev/null
+++ b/src/plugins/unified_histogram/public/layout/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export type { UnifiedHistogramLayoutProps } from './layout';
+export { UnifiedHistogramLayout } from './layout';
diff --git a/src/plugins/unified_histogram/public/layout/layout.tsx b/src/plugins/unified_histogram/public/layout/layout.tsx
index db6a161a81b7e..5167bbf63f830 100644
--- a/src/plugins/unified_histogram/public/layout/layout.tsx
+++ b/src/plugins/unified_histogram/public/layout/layout.tsx
@@ -12,7 +12,7 @@ import React, { useMemo } from 'react';
 import { createHtmlPortalNode, InPortal, OutPortal } from 'react-reverse-portal';
 import { css } from '@emotion/css';
 import type { DataView, DataViewField } from '@kbn/data-views-plugin/public';
-import type { LensEmbeddableInput, TypedLensByValueInput } from '@kbn/lens-plugin/public';
+import type { LensEmbeddableInput } from '@kbn/lens-plugin/public';
 import type { AggregateQuery, Filter, Query, TimeRange } from '@kbn/es-query';
 import { Chart } from '../chart';
 import { Panels, PANELS_MODE } from '../panels';
@@ -53,7 +53,7 @@ export interface UnifiedHistogramLayoutProps extends PropsWithChildren<unknown>
    */
   timeRange?: TimeRange;
   /**
-   * Context object for requests made by unified histogram components -- optional
+   * Context object for requests made by Unified Histogram components -- optional
    */
   request?: UnifiedHistogramRequestContext;
   /**
@@ -97,13 +97,13 @@ export interface UnifiedHistogramLayoutProps extends PropsWithChildren<unknown>
    */
   input$?: UnifiedHistogramInput$;
   /**
-   * Callback to update the topPanelHeight prop when a resize is triggered
+   * Callback to get the relative time range, useful when passing an absolute time range (e.g. for edit visualization button)
    */
-  onTopPanelHeightChange?: (topPanelHeight: number | undefined) => void;
+  getRelativeTimeRange?: () => TimeRange;
   /**
-   * Callback to invoke when the user clicks the edit visualization button -- leave undefined to hide the button
+   * Callback to update the topPanelHeight prop when a resize is triggered
    */
-  onEditVisualization?: (lensAttributes: TypedLensByValueInput['attributes']) => void;
+  onTopPanelHeightChange?: (topPanelHeight: number | undefined) => void;
   /**
    * Callback to hide or show the chart -- should set {@link UnifiedHistogramChartContext.hidden} to chartHidden
    */
@@ -153,8 +153,8 @@ export const UnifiedHistogramLayout = ({
   disableTriggers,
   disabledActions,
   input$,
+  getRelativeTimeRange,
   onTopPanelHeightChange,
-  onEditVisualization,
   onChartHiddenChange,
   onTimeIntervalChange,
   onBreakdownFieldChange,
@@ -222,7 +222,7 @@ export const UnifiedHistogramLayout = ({
           disableTriggers={disableTriggers}
           disabledActions={disabledActions}
           input$={input$}
-          onEditVisualization={onEditVisualization}
+          getRelativeTimeRange={getRelativeTimeRange}
           onResetChartHeight={onResetChartHeight}
           onChartHiddenChange={onChartHiddenChange}
           onTimeIntervalChange={onTimeIntervalChange}
@@ -248,6 +248,3 @@ export const UnifiedHistogramLayout = ({
     </>
   );
 };
-
-// eslint-disable-next-line import/no-default-export
-export default UnifiedHistogramLayout;
diff --git a/src/plugins/unified_histogram/public/mocks.ts b/src/plugins/unified_histogram/public/mocks.ts
new file mode 100644
index 0000000000000..0258b9900bf97
--- /dev/null
+++ b/src/plugins/unified_histogram/public/mocks.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Observable } from 'rxjs';
+import type { UnifiedHistogramInitializedApi, UnifiedHistogramUninitializedApi } from './container';
+
+export type MockUnifiedHistogramApi = Omit<UnifiedHistogramUninitializedApi, 'initialized'> &
+  Omit<UnifiedHistogramInitializedApi, 'initialized'> & { initialized: boolean };
+
+export const createMockUnifiedHistogramApi = (
+  { initialized }: { initialized: boolean } = { initialized: false }
+) => {
+  const api: MockUnifiedHistogramApi = {
+    initialized,
+    initialize: jest.fn(() => {
+      api.initialized = true;
+    }),
+    state$: new Observable(),
+    setChartHidden: jest.fn(),
+    setTopPanelHeight: jest.fn(),
+    setBreakdownField: jest.fn(),
+    setTimeInterval: jest.fn(),
+    setRequestParams: jest.fn(),
+    setTotalHits: jest.fn(),
+    refetch: jest.fn(),
+  };
+  return api;
+};
diff --git a/src/plugins/unified_histogram/public/types.ts b/src/plugins/unified_histogram/public/types.ts
index f77bfa1bbdbee..d7eacdf9d5c44 100644
--- a/src/plugins/unified_histogram/public/types.ts
+++ b/src/plugins/unified_histogram/public/types.ts
@@ -15,9 +15,11 @@ import type { DataViewField } from '@kbn/data-views-plugin/public';
 import type { RequestAdapter } from '@kbn/inspector-plugin/public';
 import type { DefaultInspectorAdapters } from '@kbn/expressions-plugin/common';
 import type { Subject } from 'rxjs';
+import type { UiActionsStart } from '@kbn/ui-actions-plugin/public';
+import type { Storage } from '@kbn/kibana-utils-plugin/public';
 
 /**
- * The fetch status of a unified histogram request
+ * The fetch status of a Unified Histogram request
  */
 export enum UnifiedHistogramFetchStatus {
   uninitialized = 'uninitialized',
@@ -28,14 +30,16 @@ export enum UnifiedHistogramFetchStatus {
 }
 
 /**
- * The services required by the unified histogram components
+ * The services required by the Unified Histogram components
  */
 export interface UnifiedHistogramServices {
   data: DataPublicPluginStart;
   theme: Theme;
+  uiActions: UiActionsStart;
   uiSettings: IUiSettingsClient;
   fieldFormats: FieldFormatsStart;
   lens: LensPublicStart;
+  storage: Storage;
 }
 
 /**
@@ -47,6 +51,9 @@ export interface UnifiedHistogramBucketInterval {
   scale?: number;
 }
 
+/**
+ * The adapters passed up from Lens
+ */
 export type UnifiedHistogramAdapters = Partial<DefaultInspectorAdapters>;
 
 /**
@@ -60,7 +67,7 @@ export interface UnifiedHistogramChartLoadEvent {
 }
 
 /**
- * Context object for requests made by unified histogram components
+ * Context object for requests made by Unified Histogram components
  */
 export interface UnifiedHistogramRequestContext {
   /**
diff --git a/src/plugins/unified_histogram/tsconfig.json b/src/plugins/unified_histogram/tsconfig.json
index eb7da12b70b29..0e0f18ff9dd56 100644
--- a/src/plugins/unified_histogram/tsconfig.json
+++ b/src/plugins/unified_histogram/tsconfig.json
@@ -22,6 +22,8 @@
     "@kbn/datemath",
     "@kbn/core-ui-settings-browser-mocks",
     "@kbn/shared-ux-utility",
+    "@kbn/ui-actions-plugin",
+    "@kbn/kibana-utils-plugin",
   ],
   "exclude": [
     "target/**/*",

From c8b75b3b72da76968c2a5850ed4198911eb34abf Mon Sep 17 00:00:00 2001
From: Dima Arnautov <dmitrii.arnautov@elastic.co>
Date: Tue, 7 Feb 2023 20:51:02 +0100
Subject: [PATCH 093/134] [ML] Adds change point detection feature (#150308)

## Summary

Part of #145703, adding enhancements to the new Change Point Detection
page for technical preview under the AIOps Labs section in the ML
plugin.

<img width="1406" alt="image"
src="https://user-images.githubusercontent.com/5236598/217035513-86325cd9-17a9-46ed-8aea-77585038a427.png">

- Use the data bounds mode for the Y-axis
- Add a cardinality check for the split field with a hard limit of
10,000
-  Show series labels above charts
- Replace fields `select` controls with the `EuiComboBox`
- Add a filter for change point type
- Display aggregation interval
- Add a docs link to the Change Point Aggregation
- Make split field optional

### Checklist


- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [x] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
---
 packages/kbn-doc-links/src/get_doc_links.ts   |   1 +
 packages/kbn-doc-links/src/types.ts           |   1 +
 x-pack/packages/ml/date_picker/index.ts       |   1 +
 .../date_picker/src/hooks/use_timefilter.ts   |  28 +++
 .../change_point_detection_context.tsx        |  24 ++-
 .../change_point_detection_page.tsx           | 191 ++++++++++++++----
 .../change_point_detetion_root.tsx            |  22 +-
 .../change_point_type_filter.tsx              | 140 +++++++++++++
 .../chart_component.tsx                       |  70 +++----
 .../change_point_detection/constants.ts       |   6 +
 .../metric_field_selector.tsx                 |  29 ++-
 .../split_field_selector.tsx                  |  43 +++-
 .../use_change_point_agg_request.ts           | 179 +++++++++-------
 .../use_split_field_cardinality.ts            |  13 +-
 x-pack/plugins/aiops/tsconfig.json            |   1 +
 .../aiops/change_point_detection.tsx          |   9 +-
 .../components/help_menu/help_menu.tsx        |  11 +-
 17 files changed, 589 insertions(+), 180 deletions(-)
 create mode 100644 x-pack/plugins/aiops/public/components/change_point_detection/change_point_type_filter.tsx

diff --git a/packages/kbn-doc-links/src/get_doc_links.ts b/packages/kbn-doc-links/src/get_doc_links.ts
index 6b30af3f39097..5903bd136ed1f 100644
--- a/packages/kbn-doc-links/src/get_doc_links.ts
+++ b/packages/kbn-doc-links/src/get_doc_links.ts
@@ -241,6 +241,7 @@ export const getDocLinks = ({ kibanaBranch }: GetDocLinkOptions): DocLinks => {
       sum: `${ELASTICSEARCH_DOCS}search-aggregations-metrics-sum-aggregation.html`,
       top_hits: `${ELASTICSEARCH_DOCS}search-aggregations-metrics-top-hits-aggregation.html`,
       top_metrics: `${ELASTICSEARCH_DOCS}search-aggregations-metrics-top-metrics.html`,
+      change_point: `${ELASTICSEARCH_DOCS}search-aggregations-change-point-aggregation.html`,
     },
     runtimeFields: {
       overview: `${ELASTICSEARCH_DOCS}runtime.html`,
diff --git a/packages/kbn-doc-links/src/types.ts b/packages/kbn-doc-links/src/types.ts
index a6284078d3d8d..f7b4019eb599a 100644
--- a/packages/kbn-doc-links/src/types.ts
+++ b/packages/kbn-doc-links/src/types.ts
@@ -218,6 +218,7 @@ export interface DocLinks {
     readonly std_dev: string;
     readonly sum: string;
     readonly top_hits: string;
+    readonly change_point: string;
   };
   readonly runtimeFields: {
     readonly overview: string;
diff --git a/x-pack/packages/ml/date_picker/index.ts b/x-pack/packages/ml/date_picker/index.ts
index c3047c4957d5d..f795d6a4d1f06 100644
--- a/x-pack/packages/ml/date_picker/index.ts
+++ b/x-pack/packages/ml/date_picker/index.ts
@@ -13,6 +13,7 @@ export {
   useRefreshIntervalUpdates,
   useTimefilter,
   useTimeRangeUpdates,
+  useRefresh,
 } from './src/hooks/use_timefilter';
 export { DatePickerWrapper } from './src/components/date_picker_wrapper';
 export {
diff --git a/x-pack/packages/ml/date_picker/src/hooks/use_timefilter.ts b/x-pack/packages/ml/date_picker/src/hooks/use_timefilter.ts
index 9b610908d5dff..ac82a29118192 100644
--- a/x-pack/packages/ml/date_picker/src/hooks/use_timefilter.ts
+++ b/x-pack/packages/ml/date_picker/src/hooks/use_timefilter.ts
@@ -7,6 +7,7 @@
 
 import { useEffect, useMemo } from 'react';
 import useObservable from 'react-use/lib/useObservable';
+import { merge, type Observable } from 'rxjs';
 import { distinctUntilChanged, map } from 'rxjs/operators';
 import { isEqual } from 'lodash';
 
@@ -14,6 +15,7 @@ import type { TimeRange } from '@kbn/es-query';
 import type { TimefilterContract } from '@kbn/data-plugin/public';
 
 import { useDatePickerContext } from './use_date_picker_context';
+import { mlTimefilterRefresh$, Refresh } from '../services/timefilter_refresh_service';
 
 /**
  * Options interface for the `useTimefilter` custom hook.
@@ -100,3 +102,29 @@ export const useTimeRangeUpdates = (absolute = false): TimeRange => {
 
   return useObservable(timeChangeObservable$, getTimeCallback());
 };
+
+/**
+ * Provides the latest refresh, both manual or auto.
+ */
+export const useRefresh = () => {
+  const timefilter = useTimefilter();
+
+  const getTimeRange = () => {
+    const { from, to } = timefilter.getTime();
+    return { start: from, end: to };
+  };
+
+  const refresh$ = useMemo(() => {
+    return merge(
+      mlTimefilterRefresh$,
+      timefilter.getTimeUpdate$().pipe(
+        map(() => {
+          return { lastRefresh: Date.now(), timeRange: getTimeRange() };
+        })
+      )
+    ) as Observable<Refresh>;
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  return useObservable<Refresh>(refresh$);
+};
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detection_context.tsx b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detection_context.tsx
index 7aaf4dbc6dc53..9b9e414a71e6f 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detection_context.tsx
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detection_context.tsx
@@ -19,6 +19,8 @@ import { startWith } from 'rxjs';
 import type { Query, Filter } from '@kbn/es-query';
 import { usePageUrlState } from '@kbn/ml-url-state';
 import { useTimefilter, useTimeRangeUpdates } from '@kbn/ml-date-picker';
+import { DEFAULT_AGG_FUNCTION } from './constants';
+import { useSplitFieldCardinality } from './use_split_field_cardinality';
 import {
   createMergedEsQuery,
   getEsQueryFromSavedSearch,
@@ -36,11 +38,12 @@ export interface ChangePointDetectionPageUrlState {
 
 export interface ChangePointDetectionRequestParams {
   fn: string;
-  splitField: string;
+  splitField?: string;
   metricField: string;
   interval: string;
   query: Query;
   filters: Filter[];
+  changePointType?: ChangePointType[];
 }
 
 export const ChangePointDetectionContext = createContext<{
@@ -61,6 +64,7 @@ export const ChangePointDetectionContext = createContext<{
     pageCount: number;
     updatePagination: (newPage: number) => void;
   };
+  splitFieldCardinality: number | null;
 }>({
   isLoading: false,
   splitFieldsOptions: [],
@@ -79,6 +83,7 @@ export const ChangePointDetectionContext = createContext<{
     pageCount: 1,
     updatePagination: () => {},
   },
+  splitFieldCardinality: null,
 });
 
 export type ChangePointType =
@@ -95,13 +100,14 @@ export interface ChangePointAnnotation {
   label: string;
   reason: string;
   timestamp: string;
-  group_field: string;
+  group?: {
+    name: string;
+    value: string;
+  };
   type: ChangePointType;
   p_value: number;
 }
 
-const DEFAULT_AGG_FUNCTION = 'min';
-
 export const ChangePointDetectionContextProvider: FC = ({ children }) => {
   const { dataView, savedSearch } = useDataSource();
   const {
@@ -181,12 +187,9 @@ export const ChangePointDetectionContextProvider: FC = ({ children }) => {
     if (!params.metricField && metricFieldOptions.length > 0) {
       params.metricField = metricFieldOptions[0].name;
     }
-    if (!params.splitField && splitFieldsOptions.length > 0) {
-      params.splitField = splitFieldsOptions[0].name;
-    }
     params.interval = bucketInterval?.expression!;
     return params;
-  }, [requestParamsFromUrl, metricFieldOptions, splitFieldsOptions, bucketInterval]);
+  }, [requestParamsFromUrl, metricFieldOptions, bucketInterval]);
 
   const updateFilters = useCallback(
     (update: Filter[]) => {
@@ -240,12 +243,14 @@ export const ChangePointDetectionContextProvider: FC = ({ children }) => {
     return mergedQuery;
   }, [resultFilters, resultQuery, uiSettings, dataView, timeRange]);
 
+  const splitFieldCardinality = useSplitFieldCardinality(requestParams.splitField, combinedQuery);
+
   const {
     results: annotations,
     isLoading: annotationsLoading,
     progress,
     pagination,
-  } = useChangePointResults(requestParams, combinedQuery);
+  } = useChangePointResults(requestParams, combinedQuery, splitFieldCardinality);
 
   if (!bucketInterval) return null;
 
@@ -263,6 +268,7 @@ export const ChangePointDetectionContextProvider: FC = ({ children }) => {
     updateFilters,
     resultQuery,
     pagination,
+    splitFieldCardinality,
   };
 
   return (
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detection_page.tsx b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detection_page.tsx
index 8e5c06b38f85c..081961c8b889d 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detection_page.tsx
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detection_page.tsx
@@ -7,24 +7,29 @@
 import React, { FC, useCallback } from 'react';
 import {
   EuiBadge,
+  EuiCallOut,
   EuiDescriptionList,
   EuiEmptyPrompt,
   EuiFlexGrid,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiHorizontalRule,
   EuiIcon,
   EuiPagination,
   EuiPanel,
   EuiProgress,
   EuiSpacer,
-  EuiTitle,
+  EuiText,
   EuiToolTip,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 import type { Query } from '@kbn/es-query';
+import { useDataSource } from '../../hooks/use_data_source';
+import { SPLIT_FIELD_CARDINALITY_LIMIT } from './constants';
+import { ChangePointTypeFilter } from './change_point_type_filter';
 import { SearchBarWrapper } from './search_bar';
-import { useChangePointDetectionContext } from './change_point_detection_context';
+import { ChangePointType, useChangePointDetectionContext } from './change_point_detection_context';
 import { MetricFieldSelector } from './metric_field_selector';
 import { SplitFieldSelector } from './split_field_selector';
 import { FunctionPicker } from './function_picker';
@@ -40,8 +45,13 @@ export const ChangePointDetectionPage: FC = () => {
     resultQuery,
     progress,
     pagination,
+    splitFieldCardinality,
+    splitFieldsOptions,
+    metricFieldOptions,
   } = useChangePointDetectionContext();
 
+  const { dataView } = useDataSource();
+
   const setFn = useCallback(
     (fn: string) => {
       updateRequestParams({ fn });
@@ -50,7 +60,7 @@ export const ChangePointDetectionPage: FC = () => {
   );
 
   const setSplitField = useCallback(
-    (splitField: string) => {
+    (splitField: string | undefined) => {
       updateRequestParams({ splitField });
     },
     [updateRequestParams]
@@ -70,7 +80,37 @@ export const ChangePointDetectionPage: FC = () => {
     [updateRequestParams]
   );
 
-  const selectControlCss = { width: '200px' };
+  const setChangePointType = useCallback(
+    (changePointType: ChangePointType[] | undefined) => {
+      updateRequestParams({ changePointType });
+    },
+    [updateRequestParams]
+  );
+
+  const selectControlCss = { width: '300px' };
+
+  const cardinalityExceeded =
+    splitFieldCardinality && splitFieldCardinality > SPLIT_FIELD_CARDINALITY_LIMIT;
+
+  if (metricFieldOptions.length === 0) {
+    return (
+      <EuiCallOut
+        title={i18n.translate('xpack.aiops.index.dataViewWithoutMetricNotificationTitle', {
+          defaultMessage: 'The data view "{dataViewTitle}" does not contain any metric fields.',
+          values: { dataViewTitle: dataView.getName() },
+        })}
+        color="danger"
+        iconType="alert"
+      >
+        <p>
+          {i18n.translate('xpack.aiops.index.dataViewWithoutMetricNotificationDescription', {
+            defaultMessage:
+              'Change point detection can only be run on data views with a metric field.',
+          })}
+        </p>
+      </EuiCallOut>
+    );
+  }
 
   return (
     <div data-test-subj="aiopsChangePointDetectionPage">
@@ -90,9 +130,11 @@ export const ChangePointDetectionPage: FC = () => {
         <EuiFlexItem grow={false} css={selectControlCss}>
           <MetricFieldSelector value={requestParams.metricField} onChange={setMetricField} />
         </EuiFlexItem>
-        <EuiFlexItem grow={false} css={selectControlCss}>
-          <SplitFieldSelector value={requestParams.splitField} onChange={setSplitField} />
-        </EuiFlexItem>
+        {splitFieldsOptions.length > 0 ? (
+          <EuiFlexItem grow={false} css={selectControlCss}>
+            <SplitFieldSelector value={requestParams.splitField} onChange={setSplitField} />
+          </EuiFlexItem>
+        ) : null}
 
         <EuiFlexItem css={{ visibility: progress === 100 ? 'hidden' : 'visible' }} grow={false}>
           <EuiProgress
@@ -113,6 +155,51 @@ export const ChangePointDetectionPage: FC = () => {
 
       <EuiSpacer size="m" />
 
+      {cardinalityExceeded ? (
+        <>
+          <EuiCallOut
+            title={i18n.translate('xpack.aiops.changePointDetection.cardinalityWarningTitle', {
+              defaultMessage: 'Analysis has been limited',
+            })}
+            color="warning"
+            iconType="alert"
+          >
+            <p>
+              {i18n.translate('xpack.aiops.changePointDetection.cardinalityWarningMessage', {
+                defaultMessage:
+                  'The "{splitField}" field cardinality is {cardinality} which exceeds the limit of {cardinalityLimit}. Only the first {cardinalityLimit} partitions, sorted by document count, are analyzed.',
+                values: {
+                  cardinality: splitFieldCardinality,
+                  cardinalityLimit: SPLIT_FIELD_CARDINALITY_LIMIT,
+                  splitField: requestParams.splitField,
+                },
+              })}
+            </p>
+          </EuiCallOut>
+          <EuiSpacer size="m" />
+        </>
+      ) : null}
+
+      <EuiFlexGroup alignItems={'center'} justifyContent={'spaceBetween'}>
+        <EuiFlexItem grow={false}>
+          <EuiText size={'s'}>
+            <FormattedMessage
+              id="xpack.aiops.changePointDetection.aggregationIntervalTitle"
+              defaultMessage="Aggregation interval: "
+            />
+            {requestParams.interval}
+          </EuiText>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false} css={{ minWidth: '400px' }}>
+          <ChangePointTypeFilter
+            value={requestParams.changePointType}
+            onChange={setChangePointType}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+
+      <EuiSpacer size="s" />
+
       {annotations.length === 0 && progress === 100 ? (
         <>
           <EuiEmptyPrompt
@@ -129,7 +216,7 @@ export const ChangePointDetectionPage: FC = () => {
               <p>
                 <FormattedMessage
                   id="xpack.aiops.changePointDetection.noChangePointsFoundMessage"
-                  defaultMessage="Try to extend the time range or update the query"
+                  defaultMessage="Detect statistically significant change points such as dips, spikes, and distribution changes in a metric. Select a metric and set a time range to start detecting change points in your data."
                 />
               </p>
             }
@@ -140,46 +227,70 @@ export const ChangePointDetectionPage: FC = () => {
       <EuiFlexGrid columns={annotations.length >= 2 ? 2 : 1} responsive gutterSize={'m'}>
         {annotations.map((v) => {
           return (
-            <EuiFlexItem key={v.group_field}>
+            <EuiFlexItem key={v.group?.value ?? 'single_metric'}>
               <EuiPanel paddingSize="s" hasBorder hasShadow={false}>
-                <EuiFlexGroup justifyContent={'spaceBetween'} alignItems={'center'}>
+                <EuiFlexGroup
+                  alignItems={'center'}
+                  justifyContent={'spaceBetween'}
+                  gutterSize={'s'}
+                >
                   <EuiFlexItem grow={false}>
-                    <EuiFlexGroup alignItems={'center'} gutterSize={'s'}>
-                      <EuiFlexItem grow={false}>
-                        <EuiTitle size="xxs">
-                          <h3>{v.group_field}</h3>
-                        </EuiTitle>
-                      </EuiFlexItem>
-                      {v.reason ? (
-                        <EuiFlexItem grow={false}>
-                          <EuiToolTip position="top" content={v.reason}>
-                            <EuiIcon
-                              tabIndex={0}
-                              color={'warning'}
-                              type="alert"
-                              title={i18n.translate(
-                                'xpack.aiops.changePointDetection.notResultsWarning',
-                                {
-                                  defaultMessage: 'No change point agg results warning',
-                                }
-                              )}
-                            />
-                          </EuiToolTip>
-                        </EuiFlexItem>
-                      ) : null}
-                    </EuiFlexGroup>
+                    {v.group ? (
+                      <EuiDescriptionList
+                        type="inline"
+                        listItems={[{ title: v.group.name, description: v.group.value }]}
+                      />
+                    ) : null}
+
+                    {v.reason ? (
+                      <EuiToolTip position="top" content={v.reason}>
+                        <EuiIcon
+                          tabIndex={0}
+                          color={'warning'}
+                          type="alert"
+                          title={i18n.translate(
+                            'xpack.aiops.changePointDetection.notResultsWarning',
+                            {
+                              defaultMessage: 'No change point agg results warning',
+                            }
+                          )}
+                        />
+                      </EuiToolTip>
+                    ) : null}
+                  </EuiFlexItem>
+                  <EuiFlexItem grow={false}>
+                    <EuiText color={'subdued'} size={'s'}>
+                      {requestParams.fn}({requestParams.metricField})
+                    </EuiText>
                   </EuiFlexItem>
+                </EuiFlexGroup>
+
+                <EuiHorizontalRule margin="xs" />
+
+                <EuiFlexGroup justifyContent={'spaceBetween'} alignItems={'center'}>
+                  {v.p_value !== undefined ? (
+                    <EuiFlexItem grow={false}>
+                      <EuiDescriptionList
+                        type="inline"
+                        listItems={[
+                          {
+                            title: (
+                              <FormattedMessage
+                                id="xpack.aiops.explainLogRateSpikes.spikeAnalysisTableGroups.pValueLabel"
+                                defaultMessage="p-value"
+                              />
+                            ),
+                            description: v.p_value.toPrecision(3),
+                          },
+                        ]}
+                      />
+                    </EuiFlexItem>
+                  ) : null}
                   <EuiFlexItem grow={false}>
                     <EuiBadge color="hollow">{v.type}</EuiBadge>
                   </EuiFlexItem>
                 </EuiFlexGroup>
 
-                {v.p_value !== undefined ? (
-                  <EuiDescriptionList
-                    type="inline"
-                    listItems={[{ title: 'p-value', description: v.p_value.toPrecision(3) }]}
-                  />
-                ) : null}
                 <ChartComponent annotation={v} />
               </EuiPanel>
             </EuiFlexItem>
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detetion_root.tsx b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detetion_root.tsx
index d2d275f0b2251..1662dfc09a1bf 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detetion_root.tsx
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_detetion_root.tsx
@@ -8,7 +8,7 @@
 import React, { FC } from 'react';
 import { pick } from 'lodash';
 
-import { EuiSpacer } from '@elastic/eui';
+import { EuiCallOut, EuiSpacer } from '@elastic/eui';
 
 import { DataView } from '@kbn/data-views-plugin/common';
 import type { SavedSearch } from '@kbn/saved-search-plugin/public';
@@ -19,6 +19,7 @@ import { DatePickerContextProvider } from '@kbn/ml-date-picker';
 import { UI_SETTINGS } from '@kbn/data-plugin/common';
 import { toMountPoint, wrapWithTheme } from '@kbn/kibana-react-plugin/public';
 
+import { i18n } from '@kbn/i18n';
 import { DataSourceContext } from '../../hooks/use_data_source';
 import { AiopsAppContext, AiopsAppDependencies } from '../../hooks/use_aiops_app_context';
 import { AIOPS_STORAGE_KEYS } from '../../types/storage';
@@ -48,6 +49,25 @@ export const ChangePointDetectionAppState: FC<ChangePointDetectionAppStateProps>
     uiSettingsKeys: UI_SETTINGS,
   };
 
+  if (!dataView.isTimeBased()) {
+    return (
+      <EuiCallOut
+        title={i18n.translate('xpack.aiops.index.dataViewNotBasedOnTimeSeriesNotificationTitle', {
+          defaultMessage: 'The data view "{dataViewTitle}" is not based on a time series.',
+          values: { dataViewTitle: dataView.getName() },
+        })}
+        color="danger"
+        iconType="alert"
+      >
+        <p>
+          {i18n.translate('xpack.aiops.index.changePointTimeSeriesNotificationDescription', {
+            defaultMessage: 'Change point detection only runs over time-based indices.',
+          })}
+        </p>
+      </EuiCallOut>
+    );
+  }
+
   return (
     <AiopsAppContext.Provider value={appDependencies}>
       <UrlStateProvider>
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/change_point_type_filter.tsx b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_type_filter.tsx
new file mode 100644
index 0000000000000..50441710c33ef
--- /dev/null
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/change_point_type_filter.tsx
@@ -0,0 +1,140 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { type FC, useCallback, useMemo } from 'react';
+import {
+  EuiComboBox,
+  type EuiComboBoxOptionOption,
+  type EuiComboBoxOptionsListProps,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiIcon,
+  EuiToolTip,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { isDefined } from '@kbn/ml-is-defined';
+import { type ChangePointType } from './change_point_detection_context';
+
+export type ChangePointUIValue = ChangePointType | undefined;
+
+interface ChangePointTypeFilterProps {
+  value: ChangePointType[] | undefined;
+  onChange: (changePointType: ChangePointType[] | undefined) => void;
+}
+
+const changePointTypes: Array<{ value: ChangePointType; description: string }> = [
+  {
+    value: 'dip',
+    description: i18n.translate('xpack.aiops.changePointDetection.dipDescription', {
+      defaultMessage: 'A significant dip occurs at this point.',
+    }),
+  },
+  {
+    value: 'spike',
+    description: i18n.translate('xpack.aiops.changePointDetection.spikeDescription', {
+      defaultMessage: 'A significant spike occurs at this point.',
+    }),
+  },
+  {
+    value: 'distribution_change',
+    description: i18n.translate('xpack.aiops.changePointDetection.distributionChangeDescription', {
+      defaultMessage: 'The overall distribution of the values has changed significantly.',
+    }),
+  },
+  {
+    value: 'step_change',
+    description: i18n.translate('xpack.aiops.changePointDetection.stepChangeDescription', {
+      defaultMessage:
+        'The change indicates a statistically significant step up or down in value distribution.',
+    }),
+  },
+  {
+    value: 'trend_change',
+    description: i18n.translate('xpack.aiops.changePointDetection.trendChangeDescription', {
+      defaultMessage: 'An overall trend change occurs at this point.',
+    }),
+  },
+];
+
+interface FilterOption {
+  value: ChangePointUIValue;
+  label: string;
+  description: string;
+}
+
+type ChangePointTypeFilterOptions = Array<EuiComboBoxOptionOption<ChangePointUIValue>>;
+
+export const ChangePointTypeFilter: FC<ChangePointTypeFilterProps> = ({ value, onChange }) => {
+  const options = useMemo<ChangePointTypeFilterOptions>(() => {
+    return [{ value: undefined, description: '' }, ...changePointTypes].map((v) => ({
+      value: v.value,
+      label:
+        v.value ??
+        i18n.translate('xpack.aiops.changePointDetection.selectAllChangePoints', {
+          defaultMessage: 'Select all',
+        }),
+      description: v.description,
+    }));
+  }, []);
+
+  const selection: ChangePointTypeFilterOptions = !value
+    ? [options[0]]
+    : options.filter((v) => value.includes(v.value!));
+
+  const onChangeCallback = useCallback(
+    (selectedOptions: ChangePointTypeFilterOptions) => {
+      if (
+        selectedOptions.length === 0 ||
+        selectedOptions[selectedOptions.length - 1].value === undefined
+      ) {
+        onChange(undefined);
+        return;
+      }
+
+      onChange(selectedOptions.map((v) => v.value as ChangePointType).filter(isDefined));
+    },
+    [onChange]
+  );
+
+  const renderOption = useCallback((option: FilterOption) => {
+    const { label, description } = option;
+
+    if (!description) {
+      return <>{label}</>;
+    }
+    return (
+      <EuiToolTip position="left" content={description}>
+        <EuiFlexGroup gutterSize={'s'} alignItems={'center'}>
+          <EuiFlexItem grow={false}>
+            <EuiIcon type="iInCircle" color={'primary'} />
+          </EuiFlexItem>
+          <EuiFlexItem>{label}</EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiToolTip>
+    );
+  }, []) as unknown as EuiComboBoxOptionsListProps<ChangePointUIValue>['renderOption'];
+
+  return (
+    <EuiFormRow
+      label={i18n.translate('xpack.aiops.changePointDetection.changePointTypeLabel', {
+        defaultMessage: 'Change point type',
+      })}
+      display={'columnCompressed'}
+      fullWidth
+    >
+      <EuiComboBox<ChangePointType | undefined>
+        options={options}
+        selectedOptions={selection}
+        onChange={onChangeCallback}
+        isClearable
+        data-test-subj="aiopsChangePointTypeFilter"
+        renderOption={renderOption}
+      />
+    </EuiFormRow>
+  );
+};
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/chart_component.tsx b/x-pack/plugins/aiops/public/components/change_point_detection/chart_component.tsx
index e1402496800ca..6cc620a804691 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/chart_component.tsx
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/chart_component.tsx
@@ -14,16 +14,14 @@ import { useTimeRangeUpdates } from '@kbn/ml-date-picker';
 import { useDataSource } from '../../hooks/use_data_source';
 import { useAiopsAppContext } from '../../hooks/use_aiops_app_context';
 
-import { useChangePointDetectionContext } from './change_point_detection_context';
+import {
+  type ChangePointAnnotation,
+  useChangePointDetectionContext,
+} from './change_point_detection_context';
 import { fnOperationTypeMapping } from './constants';
 
 export interface ChartComponentProps {
-  annotation: {
-    group_field: string;
-    label: string;
-    timestamp: string;
-    reason: string;
-  };
+  annotation: ChangePointAnnotation;
 }
 
 export const ChartComponent: FC<ChartComponentProps> = React.memo(({ annotation }) => {
@@ -35,37 +33,38 @@ export const ChartComponent: FC<ChartComponentProps> = React.memo(({ annotation
   const { dataView } = useDataSource();
   const { requestParams, bucketInterval } = useChangePointDetectionContext();
 
-  const filters = useMemo(
-    () => [
-      {
-        meta: {
-          index: dataView.id!,
-          alias: null,
-          negate: false,
-          disabled: false,
-          type: 'phrase',
-          key: requestParams.splitField,
-          params: {
-            query: annotation.group_field,
-          },
-        },
-        query: {
-          match_phrase: {
-            [requestParams.splitField]: annotation.group_field,
+  const filters = useMemo(() => {
+    return annotation.group
+      ? [
+          {
+            meta: {
+              index: dataView.id!,
+              alias: null,
+              negate: false,
+              disabled: false,
+              type: 'phrase',
+              key: annotation.group.name,
+              params: {
+                query: annotation.group.value,
+              },
+            },
+            query: {
+              match_phrase: {
+                [annotation.group.name]: annotation.group.value,
+              },
+            },
+            $state: {
+              store: FilterStateStore.APP_STATE,
+            },
           },
-        },
-        $state: {
-          store: FilterStateStore.APP_STATE,
-        },
-      },
-    ],
-    [dataView.id, requestParams.splitField, annotation.group_field]
-  );
+        ]
+      : [];
+  }, [dataView.id, annotation.group]);
 
   // @ts-ignore incorrect types for attributes
   const attributes = useMemo<TypedLensByValueInput['attributes']>(() => {
     return {
-      title: annotation.group_field,
+      title: annotation.group?.value ?? '',
       description: '',
       visualizationType: 'lnsXY',
       type: 'lens',
@@ -83,6 +82,9 @@ export const ChartComponent: FC<ChartComponentProps> = React.memo(({ annotation
       ],
       state: {
         visualization: {
+          yLeftExtent: {
+            mode: 'dataBounds',
+          },
           legend: {
             isVisible: false,
             position: 'right',
@@ -204,7 +206,7 @@ export const ChartComponent: FC<ChartComponentProps> = React.memo(({ annotation
 
   return (
     <EmbeddableComponent
-      id={`changePointChart_${annotation.group_field}`}
+      id={`changePointChart_${annotation.group ? annotation.group.value : annotation.label}`}
       style={{ height: 350 }}
       timeRange={timeRange}
       attributes={attributes}
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/constants.ts b/x-pack/plugins/aiops/public/components/change_point_detection/constants.ts
index d6bbd27858fef..06141db37b060 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/constants.ts
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/constants.ts
@@ -11,3 +11,9 @@ export const fnOperationTypeMapping: Record<string, string> = {
   sum: 'sum',
   avg: 'average',
 } as const;
+
+export const DEFAULT_AGG_FUNCTION = 'avg';
+
+export const SPLIT_FIELD_CARDINALITY_LIMIT = 10000;
+
+export const COMPOSITE_AGG_SIZE = 500;
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/metric_field_selector.tsx b/x-pack/plugins/aiops/public/components/change_point_detection/metric_field_selector.tsx
index bbdc3e5742b08..539df3a13608d 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/metric_field_selector.tsx
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/metric_field_selector.tsx
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import React, { FC, useMemo } from 'react';
+import React, { FC, useCallback, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiFormRow, EuiSelect, EuiSelectOption } from '@elastic/eui';
+import { EuiComboBox, type EuiComboBoxOptionOption, EuiFormRow } from '@elastic/eui';
 import { useChangePointDetectionContext } from './change_point_detection_context';
 
 interface MetricFieldSelectorProps {
@@ -19,19 +19,34 @@ export const MetricFieldSelector: FC<MetricFieldSelectorProps> = React.memo(
   ({ value, onChange }) => {
     const { metricFieldOptions } = useChangePointDetectionContext();
 
-    const options = useMemo<EuiSelectOption[]>(() => {
-      return metricFieldOptions.map((v) => ({ value: v.name, text: v.displayName }));
+    const options = useMemo<EuiComboBoxOptionOption[]>(() => {
+      return metricFieldOptions.map((v) => ({ value: v.name, label: v.displayName }));
     }, [metricFieldOptions]);
 
+    const selection = options.filter((v) => v.value === value);
+
+    const onChangeCallback = useCallback(
+      (selectedOptions: EuiComboBoxOptionOption[]) => {
+        const option = selectedOptions[0];
+        if (typeof option !== 'undefined') {
+          onChange(option.label);
+        }
+      },
+      [onChange]
+    );
+
     return (
       <EuiFormRow>
-        <EuiSelect
+        <EuiComboBox
           prepend={i18n.translate('xpack.aiops.changePointDetection.selectMetricFieldLabel', {
             defaultMessage: 'Metric field',
           })}
+          singleSelection={{ asPlainText: true }}
           options={options}
-          value={value}
-          onChange={(e) => onChange(e.target.value)}
+          selectedOptions={selection}
+          onChange={onChangeCallback}
+          isClearable={false}
+          data-test-subj="aiopsChangePointMetricField"
         />
       </EuiFormRow>
     );
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/split_field_selector.tsx b/x-pack/plugins/aiops/public/components/change_point_detection/split_field_selector.tsx
index 1a91e69af65ba..fbe5478054882 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/split_field_selector.tsx
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/split_field_selector.tsx
@@ -5,32 +5,57 @@
  * 2.0.
  */
 
-import React, { FC, useMemo } from 'react';
+import React, { FC, useMemo, useCallback } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiFormRow, EuiSelect, type EuiSelectOption } from '@elastic/eui';
+import { EuiComboBox, type EuiComboBoxOptionOption, EuiFormRow } from '@elastic/eui';
 import { useChangePointDetectionContext } from './change_point_detection_context';
 
 interface SplitFieldSelectorProps {
-  value: string;
-  onChange: (value: string) => void;
+  value: string | undefined;
+  onChange: (value: string | undefined) => void;
 }
 
 export const SplitFieldSelector: FC<SplitFieldSelectorProps> = React.memo(({ value, onChange }) => {
   const { splitFieldsOptions } = useChangePointDetectionContext();
 
-  const options = useMemo<EuiSelectOption[]>(() => {
-    return splitFieldsOptions.map((v) => ({ value: v.name, text: v.displayName }));
+  const options = useMemo<Array<EuiComboBoxOptionOption<string>>>(() => {
+    return [
+      {
+        name: undefined,
+        displayName: i18n.translate('xpack.aiops.changePointDetection.notSelectedSplitFieldLabel', {
+          defaultMessage: '--- Not selected ---',
+        }),
+      },
+      ...splitFieldsOptions,
+    ].map((v) => ({
+      value: v.name,
+      label: v.displayName,
+    }));
   }, [splitFieldsOptions]);
 
+  const selection = options.filter((v) => v.value === value);
+
+  const onChangeCallback = useCallback(
+    (selectedOptions: Array<EuiComboBoxOptionOption<string>>) => {
+      const option = selectedOptions[0];
+      const newValue = option?.value;
+      onChange(newValue);
+    },
+    [onChange]
+  );
+
   return (
     <EuiFormRow>
-      <EuiSelect
+      <EuiComboBox
         prepend={i18n.translate('xpack.aiops.changePointDetection.selectSpitFieldLabel', {
           defaultMessage: 'Split field',
         })}
+        singleSelection={{ asPlainText: true }}
         options={options}
-        value={value}
-        onChange={(e) => onChange(e.target.value)}
+        selectedOptions={selection}
+        onChange={onChangeCallback}
+        isClearable
+        data-test-subj="aiopsChangePointSplitField"
       />
     </EuiFormRow>
   );
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/use_change_point_agg_request.ts b/x-pack/plugins/aiops/public/components/change_point_detection/use_change_point_agg_request.ts
index b00c5dab790b7..35d2f768fc45b 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/use_change_point_agg_request.ts
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/use_change_point_agg_request.ts
@@ -8,6 +8,8 @@
 import { useEffect, useCallback, useState, useMemo } from 'react';
 import { type QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
 import { i18n } from '@kbn/i18n';
+import { useRefresh } from '@kbn/ml-date-picker';
+import { isDefined } from '@kbn/ml-is-defined';
 import { useAiopsAppContext } from '../../hooks/use_aiops_app_context';
 import {
   ChangePointAnnotation,
@@ -16,78 +18,87 @@ import {
 } from './change_point_detection_context';
 import { useDataSource } from '../../hooks/use_data_source';
 import { useCancellableSearch } from '../../hooks/use_cancellable_search';
-import { useSplitFieldCardinality } from './use_split_field_cardinality';
+import { SPLIT_FIELD_CARDINALITY_LIMIT, COMPOSITE_AGG_SIZE } from './constants';
 
 interface RequestOptions {
   index: string;
   fn: string;
   metricField: string;
-  splitField: string;
+  splitField?: string;
   timeField: string;
   timeInterval: string;
   afterKey?: string;
 }
 
-export const COMPOSITE_AGG_SIZE = 500;
-
 function getChangePointDetectionRequestBody(
   { index, fn, metricField, splitField, timeInterval, timeField, afterKey }: RequestOptions,
   query: QueryDslQueryContainer
 ) {
-  return {
-    params: {
-      index,
-      size: 0,
-      body: {
-        query,
-        aggregations: {
-          groupings: {
-            composite: {
-              size: COMPOSITE_AGG_SIZE,
-              ...(afterKey !== undefined ? { after: { splitFieldTerm: afterKey } } : {}),
-              sources: [
-                {
-                  splitFieldTerm: {
-                    terms: {
-                      field: splitField,
-                    },
-                  },
-                },
-              ],
+  const timeSeriesAgg = {
+    over_time: {
+      date_histogram: {
+        field: timeField,
+        fixed_interval: timeInterval,
+      },
+      aggs: {
+        function_value: {
+          [fn]: {
+            field: metricField,
+          },
+        },
+      },
+    },
+    change_point_request: {
+      change_point: {
+        buckets_path: 'over_time>function_value',
+      },
+    },
+    // Bucket selecting and sorting are only applicable for partitions
+    ...(isDefined(splitField)
+      ? {
+          select: {
+            bucket_selector: {
+              buckets_path: { p_value: 'change_point_request.p_value' },
+              script: 'params.p_value < 1',
             },
-            aggregations: {
-              over_time: {
-                date_histogram: {
-                  field: timeField,
-                  fixed_interval: timeInterval,
-                },
-                aggs: {
-                  function_value: {
-                    [fn]: {
-                      field: metricField,
-                    },
+          },
+          sort: {
+            bucket_sort: {
+              sort: [{ 'change_point_request.p_value': { order: 'asc' } }],
+            },
+          },
+        }
+      : {}),
+  };
+
+  const aggregations = splitField
+    ? {
+        groupings: {
+          composite: {
+            size: COMPOSITE_AGG_SIZE,
+            ...(afterKey !== undefined ? { after: { splitFieldTerm: afterKey } } : {}),
+            sources: [
+              {
+                splitFieldTerm: {
+                  terms: {
+                    field: splitField,
                   },
                 },
               },
-              change_point_request: {
-                change_point: {
-                  buckets_path: 'over_time>function_value',
-                },
-              },
-              select: {
-                bucket_selector: {
-                  buckets_path: { p_value: 'change_point_request.p_value' },
-                  script: 'params.p_value < 1',
-                },
-              },
-              sort: {
-                bucket_sort: {
-                  sort: [{ 'change_point_request.p_value': { order: 'asc' } }],
-                },
-              },
-            },
+            ],
           },
+          aggregations: timeSeriesAgg,
         },
+      }
+    : timeSeriesAgg;
+
+  return {
+    params: {
+      index,
+      size: 0,
+      body: {
+        query,
+        aggregations,
       },
     },
   };
@@ -97,7 +108,8 @@ const CHARTS_PER_PAGE = 6;
 
 export function useChangePointResults(
   requestParams: ChangePointDetectionRequestParams,
-  query: QueryDslQueryContainer
+  query: QueryDslQueryContainer,
+  splitFieldCardinality: number | null
 ) {
   const {
     notifications: { toasts },
@@ -105,11 +117,19 @@ export function useChangePointResults(
 
   const { dataView } = useDataSource();
 
+  const refresh = useRefresh();
+
   const [results, setResults] = useState<ChangePointAnnotation[]>([]);
   const [activePage, setActivePage] = useState<number>(0);
   const [progress, setProgress] = useState<number>(0);
 
-  const splitFieldCardinality = useSplitFieldCardinality(requestParams.splitField, query);
+  const isSingleMetric = !isDefined(requestParams.splitField);
+
+  const totalAggPages = useMemo<number>(() => {
+    return Math.ceil(
+      Math.min(splitFieldCardinality ?? 0, SPLIT_FIELD_CARDINALITY_LIMIT) / COMPOSITE_AGG_SIZE
+    );
+  }, [splitFieldCardinality]);
 
   const { runRequest, cancelRequest, isLoading } = useCancellableSearch();
 
@@ -121,9 +141,9 @@ export function useChangePointResults(
   }, [cancelRequest]);
 
   const fetchResults = useCallback(
-    async (afterKey?: string, prevBucketsCount?: number) => {
+    async (pageNumber: number = 1, afterKey?: string) => {
       try {
-        if (!splitFieldCardinality) {
+        if (!isSingleMetric && !totalAggPages) {
           setProgress(100);
           return;
         }
@@ -150,22 +170,28 @@ export function useChangePointResults(
           return;
         }
 
-        const buckets = result.rawResponse.aggregations.groupings.buckets;
+        const buckets = (
+          isSingleMetric
+            ? [result.rawResponse.aggregations]
+            : result.rawResponse.aggregations.groupings.buckets
+        ) as ChangePointAggResponse['aggregations']['groupings']['buckets'];
 
-        setProgress(
-          Math.min(
-            Math.round(((buckets.length + (prevBucketsCount ?? 0)) / splitFieldCardinality) * 100),
-            100
-          )
-        );
+        setProgress(Math.min(Math.round((pageNumber / totalAggPages) * 100), 100));
 
-        const groups = buckets.map((v) => {
+        let groups = buckets.map((v) => {
           const changePointType = Object.keys(v.change_point_request.type)[0] as ChangePointType;
           const timeAsString = v.change_point_request.bucket?.key;
           const rawPValue = v.change_point_request.type[changePointType].p_value;
 
           return {
-            group_field: v.key.splitFieldTerm,
+            ...(isSingleMetric
+              ? {}
+              : {
+                  group: {
+                    name: requestParams.splitField,
+                    value: v.key.splitFieldTerm,
+                  },
+                }),
             type: changePointType,
             p_value: rawPValue,
             timestamp: timeAsString,
@@ -174,6 +200,10 @@ export function useChangePointResults(
           } as ChangePointAnnotation;
         });
 
+        if (Array.isArray(requestParams.changePointType)) {
+          groups = groups.filter((v) => requestParams.changePointType!.includes(v.type));
+        }
+
         setResults((prev) => {
           return (
             (prev ?? [])
@@ -183,10 +213,13 @@ export function useChangePointResults(
           );
         });
 
-        if (result.rawResponse.aggregations.groupings.after_key?.splitFieldTerm) {
+        if (
+          result.rawResponse.aggregations?.groupings?.after_key?.splitFieldTerm &&
+          pageNumber < totalAggPages
+        ) {
           await fetchResults(
-            result.rawResponse.aggregations.groupings.after_key.splitFieldTerm,
-            buckets.length + (prevBucketsCount ?? 0)
+            pageNumber + 1,
+            result.rawResponse.aggregations.groupings.after_key.splitFieldTerm
           );
         } else {
           setProgress(100);
@@ -199,7 +232,7 @@ export function useChangePointResults(
         });
       }
     },
-    [runRequest, requestParams, query, dataView, splitFieldCardinality, toasts]
+    [runRequest, requestParams, query, dataView, totalAggPages, toasts, isSingleMetric]
   );
 
   useEffect(
@@ -211,7 +244,7 @@ export function useChangePointResults(
         cancelRequest();
       };
     },
-    [requestParams, query, splitFieldCardinality, fetchResults, reset, cancelRequest]
+    [requestParams, query, splitFieldCardinality, fetchResults, reset, cancelRequest, refresh]
   );
 
   const pagination = useMemo(() => {
@@ -230,11 +263,15 @@ export function useChangePointResults(
   return { results: resultPerPage, isLoading, reset, progress, pagination };
 }
 
+/**
+ * Response type for aggregation with composite agg pagination.
+ * TODO: update type for the single metric
+ */
 interface ChangePointAggResponse {
   took: number;
   timed_out: boolean;
   _shards: { total: number; failed: number; successful: number; skipped: number };
-  hits: { hits: any[]; total: number; max_score: null };
+  hits: { hits: unknown[]; total: number; max_score: null };
   aggregations: {
     groupings: {
       after_key?: {
diff --git a/x-pack/plugins/aiops/public/components/change_point_detection/use_split_field_cardinality.ts b/x-pack/plugins/aiops/public/components/change_point_detection/use_split_field_cardinality.ts
index 19e8212f1b8a8..5bfaf09693184 100644
--- a/x-pack/plugins/aiops/public/components/change_point_detection/use_split_field_cardinality.ts
+++ b/x-pack/plugins/aiops/public/components/change_point_detection/use_split_field_cardinality.ts
@@ -19,8 +19,11 @@ import { useDataSource } from '../../hooks/use_data_source';
  * @param splitField
  * @param query
  */
-export function useSplitFieldCardinality(splitField: string, query: QueryDslQueryContainer) {
-  const [cardinality, setCardinality] = useState<number>();
+export function useSplitFieldCardinality(
+  splitField: string | undefined,
+  query: QueryDslQueryContainer
+) {
+  const [cardinality, setCardinality] = useState<number | null>(null);
   const { dataView } = useDataSource();
 
   const requestPayload = useMemo(() => {
@@ -46,6 +49,10 @@ export function useSplitFieldCardinality(splitField: string, query: QueryDslQuer
 
   useEffect(
     function performCardinalityCheck() {
+      if (splitField === undefined) {
+        return;
+      }
+
       cancelRequest();
 
       getSplitFieldCardinality<
@@ -62,7 +69,7 @@ export function useSplitFieldCardinality(splitField: string, query: QueryDslQuer
         }
       });
     },
-    [getSplitFieldCardinality, requestPayload, cancelRequest]
+    [getSplitFieldCardinality, requestPayload, cancelRequest, splitField]
   );
 
   return cardinality;
diff --git a/x-pack/plugins/aiops/tsconfig.json b/x-pack/plugins/aiops/tsconfig.json
index a5f260e695cbb..1f465d61f80ab 100644
--- a/x-pack/plugins/aiops/tsconfig.json
+++ b/x-pack/plugins/aiops/tsconfig.json
@@ -47,6 +47,7 @@
     "@kbn/ml-date-picker",
     "@kbn/ml-local-storage",
     "@kbn/ml-query-utils",
+    "@kbn/ml-is-defined",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/ml/public/application/aiops/change_point_detection.tsx b/x-pack/plugins/ml/public/application/aiops/change_point_detection.tsx
index b3d3a537b9be1..77642001757ab 100644
--- a/x-pack/plugins/ml/public/application/aiops/change_point_detection.tsx
+++ b/x-pack/plugins/ml/public/application/aiops/change_point_detection.tsx
@@ -7,7 +7,7 @@
 
 import React, { FC } from 'react';
 import { pick } from 'lodash';
-
+import { i18n } from '@kbn/i18n';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 
 import { FormattedMessage } from '@kbn/i18n-react';
@@ -62,7 +62,12 @@ export const ChangePointDetectionPage: FC = () => {
           ])}
         />
       ) : null}
-      <HelpMenu docLink={services.docLinks.links.ml.guide} />
+      <HelpMenu
+        docLink={services.docLinks.links.aggs.change_point}
+        appName={i18n.translate('xpack.ml.changePointDetection.pageHeader', {
+          defaultMessage: 'Change point detection',
+        })}
+      />
     </>
   );
 };
diff --git a/x-pack/plugins/ml/public/application/components/help_menu/help_menu.tsx b/x-pack/plugins/ml/public/application/components/help_menu/help_menu.tsx
index 4d0c88036dad3..ab92a134e421e 100644
--- a/x-pack/plugins/ml/public/application/components/help_menu/help_menu.tsx
+++ b/x-pack/plugins/ml/public/application/components/help_menu/help_menu.tsx
@@ -11,17 +11,20 @@ import { useMlKibana } from '../../contexts/kibana';
 
 interface HelpMenuProps {
   docLink: string;
+  appName?: string;
 }
 
 // Component for adding a documentation link to the help menu
-export const HelpMenu: FC<HelpMenuProps> = React.memo(({ docLink }) => {
+export const HelpMenu: FC<HelpMenuProps> = React.memo(({ docLink, appName }) => {
   const { chrome } = useMlKibana().services;
 
   useEffect(() => {
     chrome.setHelpExtension({
-      appName: i18n.translate('xpack.ml.chrome.help.appName', {
-        defaultMessage: 'Machine Learning',
-      }),
+      appName:
+        appName ??
+        i18n.translate('xpack.ml.chrome.help.appName', {
+          defaultMessage: 'Machine Learning',
+        }),
       links: [
         {
           href: docLink,

From d6f68c24402120aad0aad64ec716ef287c766eee Mon Sep 17 00:00:00 2001
From: Marshall Main <55718608+marshallmain@users.noreply.github.com>
Date: Tue, 7 Feb 2023 11:54:56 -0800
Subject: [PATCH 094/134] [Security Solution][Alerts] Fix bug when suppression
 has both created and updated alerts (#150236)

## Summary

A bug in the `alertWithSuppression` logic caused rules to fail (with
`cannot read property create of undefined`) when the rule found alerts
to both create and update. The bulk response items length is equal to
the number of updated + new alerts, but the `duplicateAlertUpdates`
array length is actually 2x the number of updated alerts because it has
an update instruction in addition to each updated alert.

The fix is simply to shift the index into the bulk response by
`duplicateAlerts.length` instead of `duplicateAlertUpdates.length`.
---
 .../create_persistence_rule_type_wrapper.ts   |  7 +-
 .../rule_execution_logic/query.ts             | 89 +++++++++++++++++++
 2 files changed, 94 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts b/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts
index 6109eabb87e96..9f10d7e537a9f 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts
@@ -329,14 +329,17 @@ export const createPersistenceRuleTypeWrapper: CreatePersistenceRuleTypeWrapper
                   createdAlerts: augmentedAlerts
                     .map((alert, idx) => {
                       const responseItem =
-                        bulkResponse.body.items[idx + duplicateAlertUpdates.length].create;
+                        bulkResponse.body.items[idx + duplicateAlerts.length].create;
                       return {
                         _id: responseItem?._id ?? '',
                         _index: responseItem?._index ?? '',
                         ...alert._source,
                       };
                     })
-                    .filter((_, idx) => bulkResponse.body.items[idx].create?.status === 201),
+                    .filter(
+                      (_, idx) =>
+                        bulkResponse.body.items[idx + duplicateAlerts.length].create?.status === 201
+                    ),
                   errors: errorAggregator(bulkResponse.body, [409]),
                 };
               } else {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts
index e25f0099a608f..efacbb687b5f2 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts
@@ -1285,6 +1285,95 @@ export default ({ getService }: FtrProviderContext) => {
           });
         });
 
+        it('should create and update alerts in the same rule run without errors', async () => {
+          const id = uuidv4();
+          const timestamp = '2020-10-28T06:00:00.000Z';
+          // agent-1 should create an alert on the first rule run, then the second rule run should update that
+          // alert and make a new alert for agent-2
+          const firstDoc = {
+            id,
+            '@timestamp': timestamp,
+            agent: {
+              name: 'agent-1',
+            },
+          };
+          const laterTimestamp = '2020-10-28T07:00:00.000Z';
+          const secondDoc = {
+            id,
+            '@timestamp': laterTimestamp,
+            agent: {
+              name: 'agent-1',
+            },
+          };
+          const thirdDoc = {
+            id,
+            '@timestamp': laterTimestamp,
+            agent: {
+              name: 'agent-2',
+            },
+          };
+          await indexDocuments([firstDoc, secondDoc, thirdDoc]);
+
+          const rule: QueryRuleCreateProps = {
+            ...getRuleForSignalTesting(['ecs_compliant']),
+            query: `id:${id}`,
+            alert_suppression: {
+              group_by: ['agent.name'],
+              duration: {
+                value: 300,
+                unit: 'm',
+              },
+            },
+            from: 'now-1h',
+            interval: '1h',
+            timestamp_override: 'event.ingested',
+            max_signals: 150,
+          };
+
+          const { previewId, logs } = await previewRule({
+            supertest,
+            rule,
+            timeframeEnd: new Date('2020-10-28T07:30:00.000Z'),
+            invocationCount: 2,
+          });
+          const previewAlerts = await getPreviewAlerts({
+            es,
+            previewId,
+            size: 10,
+            sort: ['agent.name', ALERT_ORIGINAL_TIME],
+          });
+          expect(previewAlerts.length).to.eql(2);
+          expect(previewAlerts[0]._source).to.eql({
+            ...previewAlerts[0]._source,
+            [ALERT_SUPPRESSION_TERMS]: [
+              {
+                field: 'agent.name',
+                value: 'agent-1',
+              },
+            ],
+            [ALERT_ORIGINAL_TIME]: timestamp,
+            [ALERT_SUPPRESSION_START]: timestamp,
+            [ALERT_SUPPRESSION_END]: laterTimestamp,
+            [ALERT_SUPPRESSION_DOCS_COUNT]: 1,
+          });
+          expect(previewAlerts[1]._source).to.eql({
+            ...previewAlerts[1]._source,
+            [ALERT_SUPPRESSION_TERMS]: [
+              {
+                field: 'agent.name',
+                value: 'agent-2',
+              },
+            ],
+            [ALERT_ORIGINAL_TIME]: laterTimestamp,
+            [ALERT_SUPPRESSION_START]: laterTimestamp,
+            [ALERT_SUPPRESSION_END]: laterTimestamp,
+            [ALERT_SUPPRESSION_DOCS_COUNT]: 0,
+          });
+          for (const logEntry of logs) {
+            expect(logEntry.errors.length).to.eql(0);
+          }
+        });
+
         describe('with host risk index', async () => {
           before(async () => {
             await esArchiver.load('x-pack/test/functional/es_archives/entity/host_risk');

From 4052d18cefdf7d86b1c62df0a28ab658a5f2411a Mon Sep 17 00:00:00 2001
From: Luke Elmers <luke.elmers@elastic.co>
Date: Tue, 7 Feb 2023 13:53:49 -0700
Subject: [PATCH 095/134] Adds link to Jan 2023 contributors newsletter.
 (#150259)

---
 nav-kibana-dev.docnav.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nav-kibana-dev.docnav.json b/nav-kibana-dev.docnav.json
index 683722674a631..e397d30dff1e2 100644
--- a/nav-kibana-dev.docnav.json
+++ b/nav-kibana-dev.docnav.json
@@ -175,6 +175,9 @@
     {
       "label": "Contributors Newsletters",
       "items": [
+        {
+          "id": "kibJanuary2023ContributorNewsletter"
+        },
         {
           "id": "kibNovember2022ContributorNewsletter"
         },

From 92a1689e95fe68654382eaed6b20ba29f66420ec Mon Sep 17 00:00:00 2001
From: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
Date: Tue, 7 Feb 2023 16:20:39 -0500
Subject: [PATCH 096/134] [Security Solution][Exceptions] Rule exceptions TTL -
 Expiration (#145180)

---
 .../meta/details_info/index.tsx               |  30 +++--
 .../src/exception_item_card/meta/index.tsx    |  27 ++++
 .../src/exception_item_card/translations.ts   |  14 ++
 .../src/list_header/index.tsx                 |   6 +-
 .../src/list_header/menu_items/index.tsx      |   6 +-
 .../menu_items/menu_items.test.tsx            |   2 +-
 .../mocks/exception_list_item_schema.mock.ts  |   1 +
 .../src/common/expire_time/index.ts           |  14 ++
 .../include_expired_exceptions/index.ts       |  20 +++
 .../src/common/index.ts                       |   1 +
 .../create_endpoint_list_item_schema/index.ts |   5 +-
 .../index.ts                                  |   5 +-
 .../index.ts                                  |   6 +-
 .../index.mock.ts                             |   1 +
 .../index.test.ts                             |   1 +
 .../index.ts                                  |   2 +
 .../index.mock.ts                             |   1 +
 .../import_exception_item_schema/index.ts     |   6 +-
 .../update_endpoint_list_item_schema/index.ts |   5 +-
 .../index.ts                                  |   5 +-
 .../exception_list_item_schema/index.mock.ts  |   1 +
 .../exception_list_item_schema/index.ts       |   2 +
 .../src/typescript_types/index.ts             |   2 +
 .../src/api/index.ts                          |  11 +-
 .../exception_list_item_schema.mock.ts        |   1 +
 .../src/use_api/index.ts                      |   2 +
 .../src/helpers/index.ts                      |  16 +++
 .../migrations/check_registered_types.test.ts |   4 +-
 .../request/import_exceptions_schema.mock.ts  |   1 +
 .../exception_list_item_schema.mock.ts        |   1 +
 .../lists/public/exceptions/api.test.ts       |   3 +
 .../routes/create_endpoint_list_item_route.ts |   2 +
 .../create_exception_list_item_route.ts       |   2 +
 .../lists/server/routes/delete_list_route.ts  |   1 +
 .../routes/export_exception_list_route.ts     |  13 +-
 .../routes/find_exception_list_item_route.ts  |   5 +
 .../routes/get_exception_filter_route.ts      |   1 +
 .../routes/update_endpoint_list_item_route.ts |   2 +
 .../update_exception_list_item_route.ts       |   2 +
 .../server/saved_objects/exception_list.ts    |   3 +
 .../server/saved_objects/migrations.test.ts   |   1 +
 .../exceptions_list_so_schema.ts              |   2 +
 .../build_exception_filter.test.ts            | 114 ++++++++++++++++
 .../exception_lists/build_exception_filter.ts |  19 ++-
 .../bulk_create_exception_list_items.ts       |   1 +
 .../exception_lists/create_endpoint_list.ts   |   1 +
 .../create_endpoint_trusted_apps_list.ts      |   1 +
 .../exception_lists/create_exception_list.ts  |   1 +
 .../create_exception_list_item.ts             |   4 +
 .../exception_list_client.mock.ts             |  19 ++-
 .../exception_list_client.test.ts             |   1 +
 .../exception_lists/exception_list_client.ts  |  11 ++
 .../exception_list_client_types.ts            |  11 ++
 .../export_exception_list_and_items.test.ts   |   2 +
 .../export_exception_list_and_items.ts        |   9 +-
 .../update_exception_list_item.ts             |   4 +
 .../get_exception_lists_item_filter.test.ts   |   8 +-
 .../utils/get_exception_lists_item_filter.ts  |   2 +-
 .../import/bulk_create_imported_items.test.ts |   1 +
 .../import/bulk_create_imported_lists.test.ts |   1 +
 ...find_all_exception_list_item_types.test.ts |   6 +-
 .../sort_exception_items_to_create_update.ts  |   2 +
 .../sort_exception_lists_to_create_update.ts  |   2 +
 .../services/exception_lists/utils/index.ts   |   8 ++
 .../exceptions_list_item_generator.ts         |  11 +-
 .../cypress/screens/exceptions.ts             |   4 +-
 .../cypress/tasks/exceptions_table.ts         |   6 +-
 .../common/components/utility_bar/styles.tsx  |   6 +-
 .../utility_bar/utility_bar_text.tsx          |   5 +-
 .../components/add_exception_flyout/index.tsx |  34 +++++
 .../add_exception_flyout/reducer.ts           |  29 +++++
 .../all_exception_items_table/index.test.tsx  |  11 ++
 .../all_exception_items_table/index.tsx       | 122 +++++++++++++++---
 .../all_exception_items_table/reducer.ts      |  20 +++
 .../all_exception_items_table/translations.ts |  14 ++
 .../utility_bar.test.tsx                      |   4 +
 .../all_exception_items_table/utility_bar.tsx |  85 +++++++-----
 .../edit_exception_flyout/index.tsx           |  40 +++++-
 .../edit_exception_flyout/reducer.ts          |  27 ++++
 .../components/exception_item_card/meta.tsx   |  49 +++++--
 .../exception_item_card/translations.ts       |  14 ++
 .../flyout_components/expire_time/index.tsx   |  75 +++++++++++
 .../expire_time/translations.ts               |  29 +++++
 .../flyout_components/utils.test.tsx          |   3 +
 .../components/flyout_components/utils.tsx    |  22 ++++
 .../rule_exceptions/utils/helpers.tsx         |  18 +++
 .../components/alerts_table/actions.test.tsx  |   1 +
 .../components/exceptions_list_card/index.tsx |  12 ++
 .../export_exceptions_list_modal/index.tsx    |  50 +++++++
 .../hooks/use_exceptions_list.card/index.tsx  |  48 +++++--
 .../hooks/use_list_detail_view/index.ts       |  48 +++----
 .../pages/list_detail_view/index.tsx          |  20 ++-
 .../exceptions/pages/shared_lists/index.tsx   |  13 +-
 .../exceptions/translations/shared_list.ts    |  28 ++++
 .../handlers/create_event_filters.ts          |   1 +
 .../handlers/remove_policy_from_artifacts.ts  |   1 +
 .../api/create_rule_exceptions/route.ts       |   1 +
 .../export/get_export_rule_exceptions.ts      |   1 +
 .../create_security_rule_type_wrapper.ts      |   1 +
 .../signals/build_events_query.test.ts        |   1 +
 .../signals/get_filter.test.ts                |   1 +
 .../signals/get_query_filter.test.ts          |   5 +
 .../rule_execution_logic/query.ts             |  94 ++++++++++++++
 .../tests/create_exception_list_items.ts      |  38 ++++++
 .../tests/export_exception_list.ts            |  44 ++++++-
 .../apis/endpoint_artifacts/blocklists.ts     |   2 +-
 .../apis/endpoint_artifacts/event_filters.ts  |   2 +-
 .../host_isolation_exceptions.ts              |   2 +-
 .../apis/endpoint_artifacts/trusted_apps.ts   |   2 +-
 109 files changed, 1343 insertions(+), 165 deletions(-)
 create mode 100644 packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts
 create mode 100644 packages/kbn-securitysolution-io-ts-list-types/src/common/include_expired_exceptions/index.ts
 create mode 100644 x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/expire_time/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/expire_time/translations.ts
 create mode 100644 x-pack/plugins/security_solution/public/exceptions/components/export_exceptions_list_modal/index.tsx

diff --git a/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/details_info/index.tsx b/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/details_info/index.tsx
index f18b5c0dd31df..213ddaebb7fa9 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/details_info/index.tsx
+++ b/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/details_info/index.tsx
@@ -15,7 +15,7 @@ import * as i18n from '../../translations';
 interface MetaInfoDetailsProps {
   label: string;
   lastUpdate: JSX.Element | string;
-  lastUpdateValue: string;
+  lastUpdateValue?: string;
   dataTestSubj?: string;
 }
 
@@ -42,20 +42,24 @@ export const MetaInfoDetails = memo<MetaInfoDetailsProps>(
             {lastUpdate}
           </EuiBadge>
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiText size="xs" css={euiBadgeFontFamily}>
-            {i18n.EXCEPTION_ITEM_CARD_META_BY}
-          </EuiText>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false} data-test-subj={`${dataTestSubj || ''}lastUpdateValue`}>
-          <EuiFlexGroup responsive gutterSize="xs" alignItems="center">
+        {lastUpdateValue != null && (
+          <>
             <EuiFlexItem grow={false}>
-              <EuiBadge color="hollow" css={euiBadgeFontFamily}>
-                {lastUpdateValue}
-              </EuiBadge>
+              <EuiText size="xs" css={euiBadgeFontFamily}>
+                {i18n.EXCEPTION_ITEM_CARD_META_BY}
+              </EuiText>
             </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiFlexItem>
+            <EuiFlexItem grow={false} data-test-subj={`${dataTestSubj || ''}lastUpdateValue`}>
+              <EuiFlexGroup responsive gutterSize="xs" alignItems="center">
+                <EuiFlexItem grow={false}>
+                  <EuiBadge color="hollow" css={euiBadgeFontFamily}>
+                    {lastUpdateValue}
+                  </EuiBadge>
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            </EuiFlexItem>
+          </>
+        )}
       </EuiFlexGroup>
     );
   }
diff --git a/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx b/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx
index 1d7d6a3568380..2fffe08b5b091 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx
+++ b/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx
@@ -44,6 +44,12 @@ export const ExceptionItemCardMetaInfo = memo<ExceptionItemCardMetaInfoProps>(
         }),
       [dataTestSubj, rules, securityLinkAnchorComponent]
     );
+
+    const isExpired = useMemo(
+      () => (item.expire_time ? new Date(item.expire_time) <= new Date() : false),
+      [item]
+    );
+
     return (
       <EuiFlexGroup alignItems="center" responsive gutterSize="s" data-test-subj={dataTestSubj}>
         {FormattedDateComponent !== null && (
@@ -77,6 +83,27 @@ export const ExceptionItemCardMetaInfo = memo<ExceptionItemCardMetaInfoProps>(
                 dataTestSubj={`${dataTestSubj || ''}UpdatedBy`}
               />
             </EuiFlexItem>
+            {item.expire_time != null && (
+              <>
+                <EuiFlexItem css={itemCss} grow={false}>
+                  <MetaInfoDetails
+                    label={
+                      isExpired
+                        ? i18n.EXCEPTION_ITEM_CARD_EXPIRED_LABEL
+                        : i18n.EXCEPTION_ITEM_CARD_EXPIRES_LABEL
+                    }
+                    lastUpdate={
+                      <FormattedDateComponent
+                        data-test-subj={`{dataTestSubj||''}formattedDateComponentExpireTime`}
+                        fieldName="expire_time"
+                        value={item.expire_time}
+                      />
+                    }
+                    dataTestSubj={`${dataTestSubj || ''}ExpireTime`}
+                  />
+                </EuiFlexItem>
+              </>
+            )}
           </>
         )}
         <EuiFlexItem>
diff --git a/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/translations.ts b/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/translations.ts
index 2fa7524291025..915311db19f4a 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/translations.ts
+++ b/packages/kbn-securitysolution-exception-list-components/src/exception_item_card/translations.ts
@@ -34,6 +34,20 @@ export const EXCEPTION_ITEM_CARD_UPDATED_LABEL = i18n.translate(
   }
 );
 
+export const EXCEPTION_ITEM_CARD_EXPIRES_LABEL = i18n.translate(
+  'exceptionList-components.exceptions.exceptionItem.card.expiresLabel',
+  {
+    defaultMessage: 'Expires at',
+  }
+);
+
+export const EXCEPTION_ITEM_CARD_EXPIRED_LABEL = i18n.translate(
+  'exceptionList-components.exceptions.exceptionItem.card.expiredLabel',
+  {
+    defaultMessage: 'Expired at',
+  }
+);
+
 export const EXCEPTION_ITEM_CARD_META_BY = i18n.translate(
   'exceptionList-components.exceptions.exceptionItem.card.metaDetailsBy',
   {
diff --git a/packages/kbn-securitysolution-exception-list-components/src/list_header/index.tsx b/packages/kbn-securitysolution-exception-list-components/src/list_header/index.tsx
index 95546ee84eaf5..5bd90189c14bc 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/list_header/index.tsx
+++ b/packages/kbn-securitysolution-exception-list-components/src/list_header/index.tsx
@@ -29,9 +29,9 @@ interface ExceptionListHeaderComponentProps {
   canUserEditList?: boolean;
   securityLinkAnchorComponent: React.ElementType; // This property needs to be removed to avoid the Prop Drilling, once we move all the common components from x-pack/security-solution/common
   onEditListDetails: (listDetails: ListDetails) => void;
-  onExportList: () => void;
   onDeleteList: () => void;
   onManageRules: () => void;
+  onExportList: () => void;
 }
 
 export interface BackOptions {
@@ -51,9 +51,9 @@ const ExceptionListHeaderComponent: FC<ExceptionListHeaderComponentProps> = ({
   backOptions,
   canUserEditList = true,
   onEditListDetails,
-  onExportList,
   onDeleteList,
   onManageRules,
+  onExportList,
 }) => {
   const { isModalVisible, listDetails, onEdit, onSave, onCancel } = useExceptionListHeader({
     name,
@@ -97,9 +97,9 @@ const ExceptionListHeaderComponent: FC<ExceptionListHeaderComponentProps> = ({
             isReadonly={isReadonly}
             canUserEditList={canUserEditList}
             securityLinkAnchorComponent={securityLinkAnchorComponent}
-            onExportList={onExportList}
             onDeleteList={onDeleteList}
             onManageRules={onManageRules}
+            onExportList={onExportList}
           />,
         ]}
         breadcrumbs={[
diff --git a/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/index.tsx b/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/index.tsx
index 5897361d3df30..14aa823046ff4 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/index.tsx
+++ b/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/index.tsx
@@ -18,9 +18,9 @@ interface MenuItemsProps {
   linkedRules: Rule[];
   canUserEditList?: boolean;
   securityLinkAnchorComponent: React.ElementType; // This property needs to be removed to avoid the Prop Drilling, once we move all the common components from x-pack/security-solution/common
-  onExportList: () => void;
   onDeleteList: () => void;
   onManageRules: () => void;
+  onExportList: () => void;
 }
 
 const MenuItemsComponent: FC<MenuItemsProps> = ({
@@ -29,9 +29,9 @@ const MenuItemsComponent: FC<MenuItemsProps> = ({
   securityLinkAnchorComponent,
   isReadonly,
   canUserEditList = true,
-  onExportList,
   onDeleteList,
   onManageRules,
+  onExportList,
 }) => {
   const referencedLinks = useMemo(
     () =>
@@ -78,7 +78,7 @@ const MenuItemsComponent: FC<MenuItemsProps> = ({
             data-test-subj={`${dataTestSubj || ''}ManageRulesButton`}
             fill
             onClick={() => {
-              if (typeof onExportList === 'function') onManageRules();
+              if (typeof onManageRules === 'function') onManageRules();
             }}
           >
             {i18n.EXCEPTION_LIST_HEADER_MANAGE_RULES_BUTTON}
diff --git a/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/menu_items.test.tsx b/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/menu_items.test.tsx
index 9e8935ba4deea..2efbb36998424 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/menu_items.test.tsx
+++ b/packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/menu_items.test.tsx
@@ -108,7 +108,7 @@ describe('MenuItems', () => {
     fireEvent.click(wrapper.getByTestId('ManageRulesButton'));
     expect(onManageRules).toHaveBeenCalled();
   });
-  it('should call onExportList', () => {
+  it('should call onExportModalOpen', () => {
     const wrapper = render(
       <MenuItems
         isReadonly={false}
diff --git a/packages/kbn-securitysolution-exception-list-components/src/mocks/exception_list_item_schema.mock.ts b/packages/kbn-securitysolution-exception-list-components/src/mocks/exception_list_item_schema.mock.ts
index 40f6d5292f317..8ee659e09146e 100644
--- a/packages/kbn-securitysolution-exception-list-components/src/mocks/exception_list_item_schema.mock.ts
+++ b/packages/kbn-securitysolution-exception-list-components/src/mocks/exception_list_item_schema.mock.ts
@@ -26,6 +26,7 @@ export const getExceptionListItemSchemaMock = (
     },
     { field: 'some.not.nested.field', operator: 'included', type: 'match', value: 'some value' },
   ],
+  expire_time: undefined,
   id: '1',
   item_id: 'endpoint_list_item',
   list_id: 'endpoint_list_id',
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts
new file mode 100644
index 0000000000000..e840ac83f19a0
--- /dev/null
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import * as t from 'io-ts';
+import { IsoDateString } from '@kbn/securitysolution-io-ts-types';
+
+export const expireTime = IsoDateString;
+export const expireTimeOrUndefined = t.union([expireTime, t.undefined]);
+export type ExpireTimeOrUndefined = t.TypeOf<typeof expireTimeOrUndefined>;
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/common/include_expired_exceptions/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/common/include_expired_exceptions/index.ts
new file mode 100644
index 0000000000000..12b2f2be7331f
--- /dev/null
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/common/include_expired_exceptions/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+/* eslint-disable @typescript-eslint/naming-convention */
+
+import * as t from 'io-ts';
+
+export const include_expired_exceptions = t.keyof({ true: null, false: null });
+export const includeExpiredExceptionsOrUndefined = t.union([
+  include_expired_exceptions,
+  t.undefined,
+]);
+export type IncludeExpiredExceptionsOrUndefined = t.TypeOf<
+  typeof includeExpiredExceptionsOrUndefined
+>;
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/common/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/common/index.ts
index 7f92649fd07d8..e50500f87f61a 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/common/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/common/index.ts
@@ -28,6 +28,7 @@ export * from './entry_nested';
 export * from './exception_export_details';
 export * from './exception_list';
 export * from './exception_list_item_type';
+export * from './expire_time';
 export * from './filter';
 export * from './id';
 export * from './immutable';
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts
index 8c8e1d3e0db4b..0262e16539e9f 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts
@@ -22,6 +22,7 @@ import { description } from '../../common/description';
 import { name } from '../../common/name';
 import { meta } from '../../common/meta';
 import { tags } from '../../common/tags';
+import { ExpireTimeOrUndefined, expireTimeOrUndefined } from '../../common';
 
 export const createEndpointListItemSchema = t.intersection([
   t.exact(
@@ -39,6 +40,7 @@ export const createEndpointListItemSchema = t.intersection([
       meta, // defaults to undefined if not set during decode
       os_types: osTypeArrayOrUndefined, // defaults to empty array if not set during decode
       tags, // defaults to empty array if not set during decode
+      expire_time: expireTimeOrUndefined, // defaults to undefined if not set during decode
     })
   ),
 ]);
@@ -48,11 +50,12 @@ export type CreateEndpointListItemSchema = t.OutputOf<typeof createEndpointListI
 // This type is used after a decode since some things are defaults after a decode.
 export type CreateEndpointListItemSchemaDecoded = Omit<
   RequiredKeepUndefined<t.TypeOf<typeof createEndpointListItemSchema>>,
-  'tags' | 'item_id' | 'entries' | 'comments' | 'os_types'
+  'tags' | 'item_id' | 'entries' | 'comments' | 'os_types' | 'expire_time'
 > & {
   comments: CreateCommentsArray;
   tags: Tags;
   item_id: ItemId;
   entries: EntriesArray;
   os_types: OsTypeArray;
+  expire_time: ExpireTimeOrUndefined;
 };
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts
index e4f92c2819664..a97280056da73 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts
@@ -25,6 +25,7 @@ import { meta } from '../../common/meta';
 import { namespace_type } from '../../common/namespace_type';
 import { tags } from '../../common/tags';
 import { nonEmptyEntriesArray } from '../../common/non_empty_entries_array';
+import { ExpireTimeOrUndefined, expireTimeOrUndefined } from '../../common';
 
 export const createExceptionListItemSchema = t.intersection([
   t.exact(
@@ -39,6 +40,7 @@ export const createExceptionListItemSchema = t.intersection([
   t.exact(
     t.partial({
       comments: DefaultCreateCommentsArray, // defaults to empty array if not set during decode
+      expire_time: expireTimeOrUndefined,
       item_id: DefaultUuid, // defaults to GUID (uuid v4) if not set during decode
       meta, // defaults to undefined if not set during decode
       namespace_type, // defaults to 'single' if not set during decode
@@ -53,9 +55,10 @@ export type CreateExceptionListItemSchema = t.OutputOf<typeof createExceptionLis
 // This type is used after a decode since some things are defaults after a decode.
 export type CreateExceptionListItemSchemaDecoded = Omit<
   RequiredKeepUndefined<t.TypeOf<typeof createExceptionListItemSchema>>,
-  'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments'
+  'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments' | 'expire_time'
 > & {
   comments: CreateCommentsArray;
+  expire_time: ExpireTimeOrUndefined;
   tags: Tags;
   item_id: ItemId;
   entries: EntriesArray;
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts
index b710ffde0a6d8..e231d3978cde3 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts
@@ -25,6 +25,8 @@ import {
   Tags,
   tags,
   name,
+  ExpireTimeOrUndefined,
+  expireTimeOrUndefined,
 } from '../../common';
 import { RequiredKeepUndefined } from '../../common/required_keep_undefined';
 
@@ -46,6 +48,7 @@ export const createRuleExceptionListItemSchema = t.intersection([
       namespace_type: namespaceType, // defaults to 'single' if not set during decode
       os_types: osTypeArrayOrUndefined, // defaults to empty array if not set during decode
       tags, // defaults to empty array if not set during decode
+      expire_time: expireTimeOrUndefined,
     })
   ),
 ]);
@@ -57,7 +60,7 @@ export type CreateRuleExceptionListItemSchema = t.OutputOf<
 // This type is used after a decode since some things are defaults after a decode.
 export type CreateRuleExceptionListItemSchemaDecoded = Omit<
   RequiredKeepUndefined<t.TypeOf<typeof createRuleExceptionListItemSchema>>,
-  'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments'
+  'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments' | 'expire_time'
 > & {
   comments: CreateCommentsArray;
   tags: Tags;
@@ -65,4 +68,5 @@ export type CreateRuleExceptionListItemSchemaDecoded = Omit<
   entries: EntriesArray;
   namespace_type: NamespaceType;
   os_types: OsTypeArray;
+  expire_time: ExpireTimeOrUndefined;
 };
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.mock.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.mock.ts
index a5542d99b007c..863429b5b5340 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.mock.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.mock.ts
@@ -14,4 +14,5 @@ export const getExportExceptionListQuerySchemaMock = (): ExportExceptionListQuer
   id: ID,
   list_id: LIST_ID,
   namespace_type: NAMESPACE_TYPE,
+  include_expired_exceptions: 'true',
 });
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.test.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.test.ts
index 3d1fcba3f7dbf..382fab3f7b604 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.test.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.test.ts
@@ -45,6 +45,7 @@ describe('export_exception_list_schema', () => {
 
     expect(message.schema).toEqual({
       id: 'uuid_here',
+      include_expired_exceptions: 'true',
       list_id: 'some-list-id',
       namespace_type: 'single',
     });
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.ts
index ce6dc9a561293..bcdcc46dadb39 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.ts
@@ -9,6 +9,7 @@
 import * as t from 'io-ts';
 
 import { id } from '../../common/id';
+import { includeExpiredExceptionsOrUndefined } from '../../common/include_expired_exceptions';
 import { list_id } from '../../common/list_id';
 import { namespace_type } from '../../common/namespace_type';
 
@@ -17,6 +18,7 @@ export const exportExceptionListQuerySchema = t.exact(
     id,
     list_id,
     namespace_type,
+    include_expired_exceptions: includeExpiredExceptionsOrUndefined,
     // TODO: Add file_name here with a default value
   })
 );
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.mock.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.mock.ts
index 03ec225351e6d..2ed82b20efd7c 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.mock.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.mock.ts
@@ -31,4 +31,5 @@ export const getImportExceptionsListItemSchemaDecodedMock = (
   namespace_type: 'single',
   os_types: [],
   tags: [],
+  expire_time: undefined,
 });
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts
index dc5a48597211e..6b1590397b585 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts
@@ -30,7 +30,7 @@ import { exceptionListItemType } from '../../common/exception_list_item_type';
 import { ItemId } from '../../common/item_id';
 import { EntriesArray } from '../../common/entries';
 import { DefaultImportCommentsArray } from '../../common/default_import_comments_array';
-import { ImportCommentsArray } from '../../common';
+import { ExpireTimeOrUndefined, expireTimeOrUndefined, ImportCommentsArray } from '../../common';
 
 /**
  * Differences from this and the createExceptionsListItemSchema are
@@ -67,6 +67,7 @@ export const importExceptionListItemSchema = t.intersection([
       namespace_type, // defaults to 'single' if not set during decode
       os_types: osTypeArrayOrUndefined, // defaults to empty array if not set during decode
       tags, // defaults to empty array if not set during decode
+      expire_time: expireTimeOrUndefined,
     })
   ),
 ]);
@@ -76,7 +77,7 @@ export type ImportExceptionListItemSchema = t.OutputOf<typeof importExceptionLis
 // This type is used after a decode since some things are defaults after a decode.
 export type ImportExceptionListItemSchemaDecoded = Omit<
   ImportExceptionListItemSchema,
-  'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments'
+  'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments' | 'expire_time'
 > & {
   comments: ImportCommentsArray;
   tags: Tags;
@@ -84,4 +85,5 @@ export type ImportExceptionListItemSchemaDecoded = Omit<
   entries: EntriesArray;
   namespace_type: NamespaceType;
   os_types: OsTypeArray;
+  expire_time: ExpireTimeOrUndefined;
 };
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts
index 8e5aa41e1fad2..b0669b05463cf 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts
@@ -21,6 +21,7 @@ import { Tags, tags } from '../../common/tags';
 import { RequiredKeepUndefined } from '../../common/required_keep_undefined';
 import { UpdateCommentsArray } from '../../common/update_comment';
 import { EntriesArray } from '../../common/entries';
+import { ExpireTimeOrUndefined, expireTimeOrUndefined } from '../../common';
 
 export const updateEndpointListItemSchema = t.intersection([
   t.exact(
@@ -40,6 +41,7 @@ export const updateEndpointListItemSchema = t.intersection([
       meta, // defaults to undefined if not set during decode
       os_types: osTypeArrayOrUndefined, // defaults to empty array if not set during decode
       tags, // defaults to empty array if not set during decode
+      expire_time: expireTimeOrUndefined,
     })
   ),
 ]);
@@ -49,10 +51,11 @@ export type UpdateEndpointListItemSchema = t.OutputOf<typeof updateEndpointListI
 // This type is used after a decode since some things are defaults after a decode.
 export type UpdateEndpointListItemSchemaDecoded = Omit<
   RequiredKeepUndefined<t.TypeOf<typeof updateEndpointListItemSchema>>,
-  'tags' | 'entries' | 'comments'
+  'tags' | 'entries' | 'comments' | 'expire_time'
 > & {
   comments: UpdateCommentsArray;
   tags: Tags;
   entries: EntriesArray;
   os_types: OsTypeArray;
+  expire_time: ExpireTimeOrUndefined;
 };
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts
index 2624f36329562..bb6ae55c0f037 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts
@@ -22,6 +22,7 @@ import { _version } from '../../common/underscore_version';
 import { id } from '../../common/id';
 import { meta } from '../../common/meta';
 import { namespace_type } from '../../common/namespace_type';
+import { ExpireTimeOrUndefined, expireTimeOrUndefined } from '../../common';
 
 export const updateExceptionListItemSchema = t.intersection([
   t.exact(
@@ -36,6 +37,7 @@ export const updateExceptionListItemSchema = t.intersection([
     t.partial({
       _version, // defaults to undefined if not set during decode
       comments: DefaultUpdateCommentsArray, // defaults to empty array if not set during decode
+      expire_time: expireTimeOrUndefined,
       id, // defaults to undefined if not set during decode
       item_id: t.union([t.string, t.undefined]),
       meta, // defaults to undefined if not set during decode
@@ -51,11 +53,12 @@ export type UpdateExceptionListItemSchema = t.OutputOf<typeof updateExceptionLis
 // This type is used after a decode since some things are defaults after a decode.
 export type UpdateExceptionListItemSchemaDecoded = Omit<
   RequiredKeepUndefined<t.TypeOf<typeof updateExceptionListItemSchema>>,
-  'tags' | 'entries' | 'namespace_type' | 'comments' | 'os_types'
+  'tags' | 'entries' | 'namespace_type' | 'comments' | 'os_types' | 'expire_time'
 > & {
   comments: UpdateCommentsArray;
   tags: Tags;
   entries: EntriesArray;
   namespace_type: NamespaceType;
   os_types: OsTypeArray;
+  expire_time: ExpireTimeOrUndefined;
 };
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.mock.ts b/packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.mock.ts
index c06a5439d11d8..b57d00eed29ee 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.mock.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.mock.ts
@@ -34,6 +34,7 @@ export const getExceptionListItemSchemaMock = (
   created_by: USER,
   description: DESCRIPTION,
   entries: ENTRIES,
+  expire_time: undefined,
   id: '1',
   item_id: 'endpoint_list_item',
   list_id: 'endpoint_list_id',
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.ts
index d2fc52b38f95b..d4b5478551901 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.ts
@@ -26,6 +26,7 @@ import { commentsArray } from '../../common/comment';
 import { entriesArray } from '../../common/entries';
 import { item_id } from '../../common/item_id';
 import { exceptionListItemType } from '../../common/exception_list_item_type';
+import { expireTimeOrUndefined } from '../../common/expire_time';
 
 export const exceptionListItemSchema = t.exact(
   t.type({
@@ -35,6 +36,7 @@ export const exceptionListItemSchema = t.exact(
     created_by,
     description,
     entries: entriesArray,
+    expire_time: expireTimeOrUndefined,
     id,
     item_id,
     list_id,
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts
index 63711c8a036bd..d3e10619b15cb 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts
@@ -77,6 +77,7 @@ export interface ApiCallMemoProps {
 // remove unnecessary validation checks
 export interface ApiListExportProps {
   id: string;
+  includeExpiredExceptions: boolean;
   listId: string;
   namespaceType: NamespaceType;
   onError: (err: Error) => void;
@@ -133,6 +134,7 @@ export interface ExportExceptionListProps {
   id: string;
   listId: string;
   namespaceType: NamespaceType;
+  includeExpiredExceptions: boolean;
   signal: AbortSignal;
 }
 
diff --git a/packages/kbn-securitysolution-list-api/src/api/index.ts b/packages/kbn-securitysolution-list-api/src/api/index.ts
index 440217ff65167..ea324f0dd033b 100644
--- a/packages/kbn-securitysolution-list-api/src/api/index.ts
+++ b/packages/kbn-securitysolution-list-api/src/api/index.ts
@@ -532,10 +532,11 @@ const addEndpointExceptionListWithValidation = async ({
 export { addEndpointExceptionListWithValidation as addEndpointExceptionList };
 
 /**
- * Fetch an ExceptionList by providing a ExceptionList ID
+ * Export an ExceptionList by providing a ExceptionList ID
  *
  * @param http Kibana http service
  * @param id ExceptionList ID (not list_id)
+ * @param includeExpiredExceptions boolean for including expired exceptions
  * @param listId ExceptionList LIST_ID (not id)
  * @param namespaceType ExceptionList namespace_type
  * @param signal to cancel request
@@ -545,13 +546,19 @@ export { addEndpointExceptionListWithValidation as addEndpointExceptionList };
 export const exportExceptionList = async ({
   http,
   id,
+  includeExpiredExceptions,
   listId,
   namespaceType,
   signal,
 }: ExportExceptionListProps): Promise<Blob> =>
   http.fetch<Blob>(`${EXCEPTION_LIST_URL}/_export`, {
     method: 'POST',
-    query: { id, list_id: listId, namespace_type: namespaceType },
+    query: {
+      id,
+      list_id: listId,
+      namespace_type: namespaceType,
+      include_expired_exceptions: includeExpiredExceptions,
+    },
     signal,
   });
 
diff --git a/packages/kbn-securitysolution-list-hooks/src/mocks/response/exception_list_item_schema.mock.ts b/packages/kbn-securitysolution-list-hooks/src/mocks/response/exception_list_item_schema.mock.ts
index 4ba6066564d0d..dab3b67ee31ee 100644
--- a/packages/kbn-securitysolution-list-hooks/src/mocks/response/exception_list_item_schema.mock.ts
+++ b/packages/kbn-securitysolution-list-hooks/src/mocks/response/exception_list_item_schema.mock.ts
@@ -34,6 +34,7 @@ export const getExceptionListItemSchemaMock = (
   created_by: USER,
   description: DESCRIPTION,
   entries: ENTRIES,
+  expire_time: undefined,
   id: '1',
   item_id: 'endpoint_list_item',
   list_id: 'endpoint_list_id',
diff --git a/packages/kbn-securitysolution-list-hooks/src/use_api/index.ts b/packages/kbn-securitysolution-list-hooks/src/use_api/index.ts
index 30664df147252..2d3321bfa72f9 100644
--- a/packages/kbn-securitysolution-list-hooks/src/use_api/index.ts
+++ b/packages/kbn-securitysolution-list-hooks/src/use_api/index.ts
@@ -112,6 +112,7 @@ export const useApi = (http: HttpStart): ExceptionsApi => {
       },
       async exportExceptionList({
         id,
+        includeExpiredExceptions,
         listId,
         namespaceType,
         onError,
@@ -123,6 +124,7 @@ export const useApi = (http: HttpStart): ExceptionsApi => {
           const blob = await Api.exportExceptionList({
             http,
             id,
+            includeExpiredExceptions,
             listId,
             namespaceType,
             signal: abortCtrl.signal,
diff --git a/packages/kbn-securitysolution-list-utils/src/helpers/index.ts b/packages/kbn-securitysolution-list-utils/src/helpers/index.ts
index 38a41393b867c..403b07c0ba058 100644
--- a/packages/kbn-securitysolution-list-utils/src/helpers/index.ts
+++ b/packages/kbn-securitysolution-list-utils/src/helpers/index.ts
@@ -60,6 +60,7 @@ import {
   ExceptionsBuilderReturnExceptionItem,
   FormattedBuilderEntry,
   OperatorOption,
+  SavedObjectType,
 } from '../types';
 
 export const isEntryNested = (item: BuilderEntry): item is EntryNested => {
@@ -914,6 +915,21 @@ export const getDefaultNestedEmptyEntry = (): EmptyNestedEntry => ({
 export const containsValueListEntry = (items: ExceptionsBuilderExceptionItem[]): boolean =>
   items.some((item) => item.entries.some(({ type }) => type === OperatorTypeEnum.LIST));
 
+export const buildShowActiveExceptionsFilter = (savedObjectPrefix: SavedObjectType[]): string => {
+  const now = new Date().toISOString();
+  const filters = savedObjectPrefix.map(
+    (prefix) =>
+      `${prefix}.attributes.expire_time > "${now}" OR NOT ${prefix}.attributes.expire_time: *`
+  );
+  return filters.join(',');
+};
+
+export const buildShowExpiredExceptionsFilter = (savedObjectPrefix: SavedObjectType[]): string => {
+  const now = new Date().toISOString();
+  const filters = savedObjectPrefix.map((prefix) => `${prefix}.attributes.expire_time <= "${now}"`);
+  return filters.join(',');
+};
+
 const getIndexGroupName = (indexName: string): string => {
   // Check whether it is a Data Stream index
   const dataStreamExp = /.ds-(.*?)-[0-9]{4}\.[0-9]{2}\.[0-9]{2}-[0-9]{6}/;
diff --git a/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts b/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
index bafc64776b6dd..d5f7c58abc07f 100644
--- a/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
+++ b/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
@@ -87,8 +87,8 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "epm-packages": "1922a722ea42ab4953a96037fabb81a9ded8e240",
         "epm-packages-assets": "00c8b5e5bf059627ffc9fbde920e1ac75926c5f6",
         "event_loop_delays_daily": "ef49e7f15649b551b458c7ea170f3ed17f89abd0",
-        "exception-list": "aae42e8f19017277d194d37d4898ed6598c03e9a",
-        "exception-list-agnostic": "2634ee4219d27663a5755536fc06cbf3bb4beba5",
+        "exception-list": "38181294f64fc406c15f20d85ca306c8a4feb3c0",
+        "exception-list-agnostic": "d527ce9d12b134cb163150057b87529043a8ec77",
         "file": "d12998f49bc82da596a9e6c8397999930187ec6a",
         "file-upload-usage-collection-telemetry": "c6fcb9a7efcf19b2bb66ca6e005bfee8961f6073",
         "fileShare": "f07d346acbb724eacf139a0fb781c38dc5280115",
diff --git a/x-pack/plugins/lists/common/schemas/request/import_exceptions_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/import_exceptions_schema.mock.ts
index a9440520ec27b..9baf9f77c785b 100644
--- a/x-pack/plugins/lists/common/schemas/request/import_exceptions_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/request/import_exceptions_schema.mock.ts
@@ -53,6 +53,7 @@ export const getImportExceptionsListItemSchemaDecodedMock = (
 ): ImportExceptionListItemSchemaDecoded => ({
   ...getImportExceptionsListItemSchemaMock(itemId, listId),
   comments: [],
+  expire_time: undefined,
   meta: undefined,
   namespace_type: 'single',
   os_types: [],
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.mock.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.mock.ts
index b49ad7150bdbc..4ebfcd0fec910 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.mock.ts
@@ -33,6 +33,7 @@ export const getExceptionListItemSchemaMock = (
   created_by: USER,
   description: DESCRIPTION,
   entries: ENTRIES,
+  expire_time: undefined,
   id: '1',
   item_id: 'endpoint_list_item',
   list_id: 'endpoint_list_id',
diff --git a/x-pack/plugins/lists/public/exceptions/api.test.ts b/x-pack/plugins/lists/public/exceptions/api.test.ts
index c6f423184f926..95675fe96aee8 100644
--- a/x-pack/plugins/lists/public/exceptions/api.test.ts
+++ b/x-pack/plugins/lists/public/exceptions/api.test.ts
@@ -698,6 +698,7 @@ describe('Exceptions Lists API', () => {
       await exportExceptionList({
         http: httpMock,
         id: 'some-id',
+        includeExpiredExceptions: true,
         listId: 'list-id',
         namespaceType: 'single',
         signal: abortCtrl.signal,
@@ -707,6 +708,7 @@ describe('Exceptions Lists API', () => {
         method: 'POST',
         query: {
           id: 'some-id',
+          include_expired_exceptions: true,
           list_id: 'list-id',
           namespace_type: 'single',
         },
@@ -718,6 +720,7 @@ describe('Exceptions Lists API', () => {
       const exceptionResponse = await exportExceptionList({
         http: httpMock,
         id: 'some-id',
+        includeExpiredExceptions: true,
         listId: 'list-id',
         namespaceType: 'single',
         signal: abortCtrl.signal,
diff --git a/x-pack/plugins/lists/server/routes/create_endpoint_list_item_route.ts b/x-pack/plugins/lists/server/routes/create_endpoint_list_item_route.ts
index d6272626618ec..f031b9d1e2882 100644
--- a/x-pack/plugins/lists/server/routes/create_endpoint_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/create_endpoint_list_item_route.ts
@@ -43,6 +43,7 @@ export const createEndpointListItemRoute = (router: ListsPluginRouter): void =>
           comments,
           description,
           entries,
+          expire_time: expireTime,
           item_id: itemId,
           os_types: osTypes,
           type,
@@ -62,6 +63,7 @@ export const createEndpointListItemRoute = (router: ListsPluginRouter): void =>
             comments,
             description,
             entries,
+            expireTime,
             itemId,
             meta,
             name,
diff --git a/x-pack/plugins/lists/server/routes/create_exception_list_item_route.ts b/x-pack/plugins/lists/server/routes/create_exception_list_item_route.ts
index 1659fc2645f16..7754bc9cc31b5 100644
--- a/x-pack/plugins/lists/server/routes/create_exception_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/create_exception_list_item_route.ts
@@ -50,6 +50,7 @@ export const createExceptionListItemRoute = (router: ListsPluginRouter): void =>
           list_id: listId,
           os_types: osTypes,
           type,
+          expire_time: expireTime,
         } = request.body;
         const exceptionLists = await getExceptionListClient(context);
         const exceptionList = await exceptionLists.getExceptionList({
@@ -92,6 +93,7 @@ export const createExceptionListItemRoute = (router: ListsPluginRouter): void =>
               comments,
               description,
               entries,
+              expireTime,
               itemId,
               listId,
               meta,
diff --git a/x-pack/plugins/lists/server/routes/delete_list_route.ts b/x-pack/plugins/lists/server/routes/delete_list_route.ts
index 57923699c25eb..e9f0e1245f1d7 100644
--- a/x-pack/plugins/lists/server/routes/delete_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/delete_list_route.ts
@@ -217,6 +217,7 @@ const updateExceptionListItems = async (
     comments: listItem.comments,
     description: listItem.description,
     entries: remainingEntries,
+    expireTime: listItem.expire_time,
     id: listItem.id,
     itemId: listItem.item_id,
     meta: listItem.meta,
diff --git a/x-pack/plugins/lists/server/routes/export_exception_list_route.ts b/x-pack/plugins/lists/server/routes/export_exception_list_route.ts
index 03c7b416ab54f..71f67ead4a8a1 100644
--- a/x-pack/plugins/lists/server/routes/export_exception_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/export_exception_list_route.ts
@@ -28,11 +28,22 @@ export const exportExceptionsRoute = (router: ListsPluginRouter): void => {
       const siemResponse = buildSiemResponse(response);
 
       try {
-        const { id, list_id: listId, namespace_type: namespaceType } = request.query;
+        const {
+          id,
+          list_id: listId,
+          namespace_type: namespaceType,
+          include_expired_exceptions: includeExpiredExceptionsString,
+        } = request.query;
         const exceptionListsClient = await getExceptionListClient(context);
 
+        // Defaults to including expired exceptions if query param is not present
+        const includeExpiredExceptions =
+          includeExpiredExceptionsString !== undefined
+            ? includeExpiredExceptionsString === 'true'
+            : true;
         const exportContent = await exceptionListsClient.exportExceptionListAndItems({
           id,
+          includeExpiredExceptions,
           listId,
           namespaceType,
         });
diff --git a/x-pack/plugins/lists/server/routes/find_exception_list_item_route.ts b/x-pack/plugins/lists/server/routes/find_exception_list_item_route.ts
index f77a3a7327d69..c337ac818cbfc 100644
--- a/x-pack/plugins/lists/server/routes/find_exception_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/find_exception_list_item_route.ts
@@ -52,6 +52,11 @@ export const findExceptionListItemRoute = (router: ListsPluginRouter): void => {
             body: `list_id and namespace_id need to have the same comma separated number of values. Expected list_id length: ${listId.length} to equal namespace_type length: ${namespaceType.length}`,
             statusCode: 400,
           });
+        } else if (listId.length !== filter.length && filter.length !== 0) {
+          return siemResponse.error({
+            body: `list_id and filter need to have the same comma separated number of values. Expected list_id length: ${listId.length} to equal filter length: ${filter.length}`,
+            statusCode: 400,
+          });
         } else {
           const exceptionListItems = await exceptionLists.findExceptionListsItem({
             filter,
diff --git a/x-pack/plugins/lists/server/routes/get_exception_filter_route.ts b/x-pack/plugins/lists/server/routes/get_exception_filter_route.ts
index 0746421e1ee49..b06076e0fbbef 100644
--- a/x-pack/plugins/lists/server/routes/get_exception_filter_route.ts
+++ b/x-pack/plugins/lists/server/routes/get_exception_filter_route.ts
@@ -82,6 +82,7 @@ export const getExceptionFilterRoute = (router: ListsPluginRouter): void => {
           excludeExceptions,
           listClient,
           lists: exceptionItems,
+          startedAt: new Date(),
         });
 
         return response.ok({ body: { filter } ?? {} });
diff --git a/x-pack/plugins/lists/server/routes/update_endpoint_list_item_route.ts b/x-pack/plugins/lists/server/routes/update_endpoint_list_item_route.ts
index e1e117f6c5604..a0a2c8f43f83f 100644
--- a/x-pack/plugins/lists/server/routes/update_endpoint_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/update_endpoint_list_item_route.ts
@@ -49,6 +49,7 @@ export const updateEndpointListItemRoute = (router: ListsPluginRouter): void =>
           entries,
           item_id: itemId,
           tags,
+          expire_time: expireTime,
         } = request.body;
         const exceptionLists = await getExceptionListClient(context);
         const exceptionListItem = await exceptionLists.updateEndpointListItem({
@@ -56,6 +57,7 @@ export const updateEndpointListItemRoute = (router: ListsPluginRouter): void =>
           comments,
           description,
           entries,
+          expireTime,
           id,
           itemId,
           meta,
diff --git a/x-pack/plugins/lists/server/routes/update_exception_list_item_route.ts b/x-pack/plugins/lists/server/routes/update_exception_list_item_route.ts
index a997ac132e7cf..e4751662a1949 100644
--- a/x-pack/plugins/lists/server/routes/update_exception_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/update_exception_list_item_route.ts
@@ -56,6 +56,7 @@ export const updateExceptionListItemRoute = (router: ListsPluginRouter): void =>
           namespace_type: namespaceType,
           os_types: osTypes,
           tags,
+          expire_time: expireTime,
         } = request.body;
         if (id == null && itemId == null) {
           return siemResponse.error({
@@ -69,6 +70,7 @@ export const updateExceptionListItemRoute = (router: ListsPluginRouter): void =>
             comments,
             description,
             entries,
+            expireTime,
             id,
             itemId,
             meta,
diff --git a/x-pack/plugins/lists/server/saved_objects/exception_list.ts b/x-pack/plugins/lists/server/saved_objects/exception_list.ts
index be0a9982e2913..4d401da8d74d2 100644
--- a/x-pack/plugins/lists/server/saved_objects/exception_list.ts
+++ b/x-pack/plugins/lists/server/saved_objects/exception_list.ts
@@ -159,6 +159,9 @@ export const exceptionListItemMapping: SavedObjectsType['mappings'] = {
         },
       },
     },
+    expire_time: {
+      type: 'date',
+    },
     item_id: {
       type: 'keyword',
     },
diff --git a/x-pack/plugins/lists/server/saved_objects/migrations.test.ts b/x-pack/plugins/lists/server/saved_objects/migrations.test.ts
index f4b594e63fe1d..85167aa0aadb7 100644
--- a/x-pack/plugins/lists/server/saved_objects/migrations.test.ts
+++ b/x-pack/plugins/lists/server/saved_objects/migrations.test.ts
@@ -22,6 +22,7 @@ const DEFAULT_EXCEPTION_LIST_SO: ExceptionListSoSchema = {
   created_by: 'user',
   description: 'description',
   entries: undefined,
+  expire_time: undefined,
   immutable: false,
   item_id: undefined,
   list_id: 'some_list',
diff --git a/x-pack/plugins/lists/server/schemas/saved_objects/exceptions_list_so_schema.ts b/x-pack/plugins/lists/server/schemas/saved_objects/exceptions_list_so_schema.ts
index b5583e5bc9820..4c06f7276661c 100644
--- a/x-pack/plugins/lists/server/schemas/saved_objects/exceptions_list_so_schema.ts
+++ b/x-pack/plugins/lists/server/schemas/saved_objects/exceptions_list_so_schema.ts
@@ -14,6 +14,7 @@ import {
   entriesArrayOrUndefined,
   exceptionListItemType,
   exceptionListType,
+  expireTimeOrUndefined,
   immutableOrUndefined,
   itemIdOrUndefined,
   list_id,
@@ -37,6 +38,7 @@ export const exceptionListSoSchema = t.exact(
     created_by,
     description,
     entries: entriesArrayOrUndefined,
+    expire_time: expireTimeOrUndefined,
     immutable: immutableOrUndefined,
     item_id: itemIdOrUndefined,
     list_id,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.test.ts b/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.test.ts
index 17f15a39bc21f..2c1f61fabd54f 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.test.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.test.ts
@@ -11,6 +11,7 @@ import type {
   ExceptionListItemSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 
+import { ENTRIES } from '../../../common/constants.mock';
 import {
   getEntryMatchAnyExcludeMock,
   getEntryMatchAnyMock,
@@ -51,6 +52,7 @@ import {
   buildNestedClause,
   createOrClauses,
   filterOutUnprocessableValueLists,
+  removeExpiredExceptions,
 } from './build_exception_filter';
 
 const modifiedGetEntryMatchAnyMock = (): EntryMatchAny => ({
@@ -70,6 +72,7 @@ describe('build_exceptions_filter', () => {
         excludeExceptions: false,
         listClient,
         lists: [],
+        startedAt: new Date(),
       });
       expect(filter).toBeUndefined();
     });
@@ -81,6 +84,7 @@ describe('build_exceptions_filter', () => {
         excludeExceptions: false,
         listClient,
         lists: [getExceptionListItemSchemaMock()],
+        startedAt: new Date(),
       });
 
       expect(filter).toMatchInlineSnapshot(`
@@ -154,6 +158,7 @@ describe('build_exceptions_filter', () => {
         excludeExceptions: true,
         listClient,
         lists: [exceptionItem1, exceptionItem2],
+        startedAt: new Date(),
       });
       expect(filter).toMatchInlineSnapshot(`
         Object {
@@ -236,6 +241,7 @@ describe('build_exceptions_filter', () => {
         excludeExceptions: true,
         listClient,
         lists: [exceptionItem1, exceptionItem2, exceptionItem3],
+        startedAt: new Date(),
       });
 
       expect(filter).toMatchInlineSnapshot(`
@@ -325,6 +331,7 @@ describe('build_exceptions_filter', () => {
         excludeExceptions: true,
         listClient,
         lists: exceptions,
+        startedAt: new Date(),
       });
 
       expect(filter).toMatchInlineSnapshot(`
@@ -479,6 +486,95 @@ describe('build_exceptions_filter', () => {
         }
       `);
     });
+
+    test('it should remove all exception items that are expired', async () => {
+      const futureDate = new Date(Date.now() + 1000000).toISOString();
+      const expiredDate = new Date(Date.now() - 1000000).toISOString();
+      const exceptions = [
+        { ...getExceptionListItemSchemaMock(), entries: [ENTRIES[0]], expire_time: futureDate },
+        { ...getExceptionListItemSchemaMock(), entries: [ENTRIES[1]], expire_time: expiredDate },
+        getExceptionListItemSchemaMock(),
+      ];
+
+      const { filter } = await buildExceptionFilter({
+        alias: null,
+        chunkSize: 1,
+        excludeExceptions: true,
+        listClient,
+        lists: exceptions,
+        startedAt: new Date(),
+      });
+
+      expect(filter).toMatchInlineSnapshot(`
+        Object {
+          "meta": Object {
+            "alias": null,
+            "disabled": false,
+            "negate": true,
+          },
+          "query": Object {
+            "bool": Object {
+              "should": Array [
+                Object {
+                  "nested": Object {
+                    "path": "some.parentField",
+                    "query": Object {
+                      "bool": Object {
+                        "minimum_should_match": 1,
+                        "should": Array [
+                          Object {
+                            "match_phrase": Object {
+                              "some.parentField.nested.field": "some value",
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    "score_mode": "none",
+                  },
+                },
+                Object {
+                  "bool": Object {
+                    "filter": Array [
+                      Object {
+                        "nested": Object {
+                          "path": "some.parentField",
+                          "query": Object {
+                            "bool": Object {
+                              "minimum_should_match": 1,
+                              "should": Array [
+                                Object {
+                                  "match_phrase": Object {
+                                    "some.parentField.nested.field": "some value",
+                                  },
+                                },
+                              ],
+                            },
+                          },
+                          "score_mode": "none",
+                        },
+                      },
+                      Object {
+                        "bool": Object {
+                          "minimum_should_match": 1,
+                          "should": Array [
+                            Object {
+                              "match_phrase": Object {
+                                "some.not.nested.field": "some value",
+                              },
+                            },
+                          ],
+                        },
+                      },
+                    ],
+                  },
+                },
+              ],
+            },
+          },
+        }
+      `);
+    });
   });
 
   describe('createOrClauses', () => {
@@ -1297,4 +1393,22 @@ describe('build_exceptions_filter', () => {
       expect(unprocessableValueListExceptions).toEqual([listExceptionItem]);
     });
   });
+
+  describe('removeExpiredExceptions', () => {
+    test('it should filter out expired exceptions', () => {
+      const futureDate = new Date(Date.now() + 1000000).toISOString();
+      const expiredDate = new Date(Date.now() - 1000000).toISOString();
+      const exceptions = [
+        { ...getExceptionListItemSchemaMock(), expire_time: futureDate },
+        { ...getExceptionListItemSchemaMock(), expire_time: expiredDate },
+        getExceptionListItemSchemaMock(),
+      ];
+      const filteredExceptions = removeExpiredExceptions(exceptions, new Date());
+
+      expect(filteredExceptions).toEqual([
+        { ...getExceptionListItemSchemaMock(), expire_time: futureDate },
+        getExceptionListItemSchemaMock(),
+      ]);
+    });
+  });
 });
diff --git a/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.ts b/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.ts
index 1eb17fe40ab26..8e453a30fc766 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.ts
@@ -273,6 +273,19 @@ export const filterOutUnprocessableValueLists = async <
   return { filteredExceptions, unprocessableValueListExceptions };
 };
 
+export const removeExpiredExceptions = <
+  T extends ExceptionListItemSchema | CreateExceptionListItemSchema
+>(
+  lists: T[],
+  startedAt: Date
+): T[] =>
+  lists.filter((listItem) => {
+    if (listItem.expire_time && new Date(listItem.expire_time) < startedAt) {
+      return false;
+    }
+    return true;
+  });
+
 export const buildExceptionFilter = async <
   T extends ExceptionListItemSchema | CreateExceptionListItemSchema
 >({
@@ -281,17 +294,21 @@ export const buildExceptionFilter = async <
   chunkSize,
   alias = null,
   listClient,
+  startedAt,
 }: {
   lists: T[];
   excludeExceptions: boolean;
   chunkSize: number;
   alias: string | null;
   listClient: ListClient;
+  startedAt: Date;
 }): Promise<{ filter: Filter | undefined; unprocessedExceptions: T[] }> => {
+  const filteredLists = removeExpiredExceptions<T>(lists, startedAt);
+
   // Remove exception items with large value lists. These are evaluated
   // elsewhere for the moment being.
   const [exceptionsWithoutValueLists, valueListExceptions] = partition(
-    lists,
+    filteredLists,
     (item): item is T => !hasLargeValueList(item.entries)
   );
 
diff --git a/x-pack/plugins/lists/server/services/exception_lists/bulk_create_exception_list_items.ts b/x-pack/plugins/lists/server/services/exception_lists/bulk_create_exception_list_items.ts
index 0d770fa699ad4..5043c16ca6f75 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/bulk_create_exception_list_items.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/bulk_create_exception_list_items.ts
@@ -41,6 +41,7 @@ export const bulkCreateExceptionListItems = async ({
         created_by: user,
         description: item.description,
         entries: item.entries,
+        expire_time: item.expire_time,
         immutable: false,
         item_id: item.item_id,
         list_id: item.list_id,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts b/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts
index deed1b41bd8ed..d939d1f7baf1b 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts
@@ -44,6 +44,7 @@ export const createEndpointList = async ({
         created_by: user,
         description: ENDPOINT_LIST_DESCRIPTION,
         entries: undefined,
+        expire_time: undefined,
         immutable: false,
         item_id: undefined,
         list_id: ENDPOINT_LIST_ID,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_trusted_apps_list.ts b/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_trusted_apps_list.ts
index bf6a0bd00ff4c..ea08f03aac6f8 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_trusted_apps_list.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_trusted_apps_list.ts
@@ -52,6 +52,7 @@ export const createEndpointTrustedAppsList = async ({
         created_by: user,
         description: ENDPOINT_TRUSTED_APPS_LIST_DESCRIPTION,
         entries: undefined,
+        expire_time: undefined,
         immutable: false,
         item_id: undefined,
         list_id: ENDPOINT_TRUSTED_APPS_LIST_ID,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list.ts b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list.ts
index 466c877a1abf4..7fcb831ed6e91 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list.ts
@@ -62,6 +62,7 @@ export const createExceptionList = async ({
     created_by: user,
     description,
     entries: undefined,
+    expire_time: undefined,
     immutable,
     item_id: undefined,
     list_id: listId,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
index 44fac7b07f8d2..eb6e2ca85546d 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
@@ -13,6 +13,7 @@ import type {
   EntriesArray,
   ExceptionListItemSchema,
   ExceptionListItemType,
+  ExpireTimeOrUndefined,
   ItemId,
   ListId,
   MetaOrUndefined,
@@ -45,11 +46,13 @@ interface CreateExceptionListItemOptions {
   tieBreaker?: string;
   type: ExceptionListItemType;
   osTypes: OsTypeArray;
+  expireTime: ExpireTimeOrUndefined;
 }
 
 export const createExceptionListItem = async ({
   comments,
   entries,
+  expireTime,
   itemId,
   listId,
   savedObjectsClient,
@@ -75,6 +78,7 @@ export const createExceptionListItem = async ({
     created_by: user,
     description,
     entries,
+    expire_time: expireTime,
     immutable: undefined,
     item_id: itemId,
     list_id: listId,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts
index 218ccf585dec4..303a0751e4d2a 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts
@@ -88,6 +88,7 @@ export const getCreateExceptionListItemOptionsMock = (): CreateExceptionListItem
     comments,
     description,
     entries,
+    expire_time: expireTime,
     item_id: itemId,
     list_id: listId,
     meta,
@@ -102,6 +103,7 @@ export const getCreateExceptionListItemOptionsMock = (): CreateExceptionListItem
     comments,
     description,
     entries,
+    expireTime,
     itemId,
     listId,
     meta,
@@ -114,14 +116,26 @@ export const getCreateExceptionListItemOptionsMock = (): CreateExceptionListItem
 };
 
 export const getUpdateExceptionListItemOptionsMock = (): UpdateExceptionListItemOptions => {
-  const { comments, entries, itemId, namespaceType, name, osTypes, description, meta, tags, type } =
-    getCreateExceptionListItemOptionsMock();
+  const {
+    comments,
+    entries,
+    expireTime,
+    itemId,
+    namespaceType,
+    name,
+    osTypes,
+    description,
+    meta,
+    tags,
+    type,
+  } = getCreateExceptionListItemOptionsMock();
 
   return {
     _version: undefined,
     comments,
     description,
     entries,
+    expireTime,
     id: ID,
     itemId,
     meta,
@@ -161,6 +175,7 @@ export const getExceptionListSoSchemaMock = (
     created_by,
     description,
     entries,
+    expire_time: undefined,
     immutable: undefined,
     item_id,
     list_id,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.test.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.test.ts
index 8ad92f5d14bff..95064ddaa3f97 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.test.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.test.ts
@@ -247,6 +247,7 @@ describe('exception_list_client', () => {
         (): ReturnType<ExceptionListClient['exportExceptionListAndItems']> => {
           return exceptionListClient.exportExceptionListAndItems({
             id: '1',
+            includeExpiredExceptions: true,
             listId: '1',
             namespaceType: 'agnostic',
           });
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts
index 562ebffc9f00c..b8fbb35f29354 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts
@@ -287,6 +287,7 @@ export class ExceptionListClient {
     comments,
     description,
     entries,
+    expireTime,
     itemId,
     meta,
     name,
@@ -300,6 +301,7 @@ export class ExceptionListClient {
       comments,
       description,
       entries,
+      expireTime,
       itemId,
       listId: ENDPOINT_LIST_ID,
       meta,
@@ -356,6 +358,7 @@ export class ExceptionListClient {
     comments,
     description,
     entries,
+    expireTime,
     id,
     itemId,
     meta,
@@ -371,6 +374,7 @@ export class ExceptionListClient {
       comments,
       description,
       entries,
+      expireTime,
       id,
       itemId,
       meta,
@@ -526,6 +530,7 @@ export class ExceptionListClient {
     comments,
     description,
     entries,
+    expireTime,
     itemId,
     listId,
     meta,
@@ -540,6 +545,7 @@ export class ExceptionListClient {
       comments,
       description,
       entries,
+      expireTime,
       itemId,
       listId,
       meta,
@@ -593,6 +599,7 @@ export class ExceptionListClient {
     comments,
     description,
     entries,
+    expireTime,
     id,
     itemId,
     meta,
@@ -608,6 +615,7 @@ export class ExceptionListClient {
       comments,
       description,
       entries,
+      expireTime,
       id,
       itemId,
       meta,
@@ -970,6 +978,7 @@ export class ExceptionListClient {
     listId,
     id,
     namespaceType,
+    includeExpiredExceptions,
   }: ExportExceptionListAndItemsOptions): Promise<ExportExceptionListAndItemsReturn | null> => {
     const { savedObjectsClient } = this;
 
@@ -978,6 +987,7 @@ export class ExceptionListClient {
         'exceptionsListPreExport',
         {
           id,
+          includeExpiredExceptions,
           listId,
           namespaceType,
         },
@@ -987,6 +997,7 @@ export class ExceptionListClient {
 
     return exportExceptionListAndItems({
       id,
+      includeExpiredExceptions,
       listId,
       namespaceType,
       savedObjectsClient,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
index 6b87945710a37..b994919398a1c 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
@@ -21,6 +21,7 @@ import type {
   ExceptionListItemTypeOrUndefined,
   ExceptionListType,
   ExceptionListTypeOrUndefined,
+  ExpireTimeOrUndefined,
   ExportExceptionDetails,
   FilterOrUndefined,
   FoundExceptionListItemSchema,
@@ -242,6 +243,8 @@ export interface CreateExceptionListItemOptions {
   comments: CreateCommentsArray;
   /** an array with the exception list item entries */
   entries: EntriesArray;
+  /** an optional datetime string with an expiration time */
+  expireTime: ExpireTimeOrUndefined;
   /** the "item_id" of the exception list item */
   itemId: ItemId;
   /** the "list_id" of the parent exception list */
@@ -271,6 +274,8 @@ export interface CreateEndpointListItemOptions {
   comments: CreateCommentsArray;
   /** The entries of the endpoint list item */
   entries: EntriesArray;
+  /** an optional datetime string with an expiration time */
+  expireTime: ExpireTimeOrUndefined;
   /** The item id of the list item */
   itemId: ItemId;
   /** The name of the list item */
@@ -309,6 +314,8 @@ export interface UpdateExceptionListItemOptions {
   comments: UpdateCommentsArray;
   /** item exception entries logic */
   entries: EntriesArray;
+  /** an optional datetime string with an expiration time */
+  expireTime: ExpireTimeOrUndefined;
   /** the "id" of the exception list item */
   id: IdOrUndefined;
   /** the "item_id" of the exception list item */
@@ -340,6 +347,8 @@ export interface UpdateEndpointListItemOptions {
   comments: UpdateCommentsArray;
   /** The entries of the endpoint list item */
   entries: EntriesArray;
+  /** an optional datetime string with an expiration time */
+  expireTime: ExpireTimeOrUndefined;
   /** The id of the list item (Either this or itemId has to be defined) */
   id: IdOrUndefined;
   /** The item id of the list item (Either this or id has to be defined) */
@@ -490,6 +499,8 @@ export interface ExportExceptionListAndItemsOptions {
   id: IdOrUndefined;
   /** saved object namespace (single | agnostic) */
   namespaceType: NamespaceType;
+  /** whether or not to include expired exceptions */
+  includeExpiredExceptions: boolean;
 }
 
 /**
diff --git a/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.test.ts b/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.test.ts
index 06e764bd1658b..acad2dd0f45ee 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.test.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.test.ts
@@ -29,6 +29,7 @@ describe('export_exception_list_and_items', () => {
 
       const result = await exportExceptionListAndItems({
         id: '123',
+        includeExpiredExceptions: true,
         listId: 'non-existent',
         namespaceType: 'single',
         savedObjectsClient: savedObjectsClientMock.create(),
@@ -45,6 +46,7 @@ describe('export_exception_list_and_items', () => {
       );
       const result = await exportExceptionListAndItems({
         id: '123',
+        includeExpiredExceptions: true,
         listId: 'non-existent',
         namespaceType: 'single',
         savedObjectsClient: savedObjectsClientMock.create(),
diff --git a/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts b/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts
index fecbb91837b6f..006c7773e4e89 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts
@@ -15,6 +15,7 @@ import type {
 } from '@kbn/securitysolution-io-ts-list-types';
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 import type { SavedObjectsClientContract } from '@kbn/core/server';
+import { getSavedObjectType } from '@kbn/securitysolution-list-utils';
 
 import { findExceptionListItemPointInTimeFinder } from './find_exception_list_item_point_in_time_finder';
 import { getExceptionList } from './get_exception_list';
@@ -24,6 +25,7 @@ interface ExportExceptionListAndItemsOptions {
   listId: ListIdOrUndefined;
   savedObjectsClient: SavedObjectsClientContract;
   namespaceType: NamespaceType;
+  includeExpiredExceptions: boolean;
 }
 
 export interface ExportExceptionListAndItemsReturn {
@@ -35,6 +37,7 @@ export const exportExceptionListAndItems = async ({
   id,
   listId,
   namespaceType,
+  includeExpiredExceptions,
   savedObjectsClient,
 }: ExportExceptionListAndItemsOptions): Promise<ExportExceptionListAndItemsReturn | null> => {
   const exceptionList = await getExceptionList({
@@ -52,10 +55,14 @@ export const exportExceptionListAndItems = async ({
     const executeFunctionOnStream = (response: FoundExceptionListItemSchema): void => {
       exceptionItems = [...exceptionItems, ...response.data];
     };
+    const savedObjectPrefix = getSavedObjectType({ namespaceType });
+    const filter = includeExpiredExceptions
+      ? undefined
+      : `(${savedObjectPrefix}.attributes.expire_time > "${new Date().toISOString()}" OR NOT ${savedObjectPrefix}.attributes.expire_time: *)`;
 
     await findExceptionListItemPointInTimeFinder({
       executeFunctionOnStream,
-      filter: undefined,
+      filter,
       listId: exceptionList.list_id,
       maxSize: undefined, // NOTE: This is unbounded when it is "undefined"
       namespaceType: exceptionList.namespace_type,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts b/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
index 81e58709528c7..e3fcb9d2461e4 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
@@ -11,6 +11,7 @@ import type {
   EntriesArray,
   ExceptionListItemSchema,
   ExceptionListItemTypeOrUndefined,
+  ExpireTimeOrUndefined,
   IdOrUndefined,
   ItemIdOrUndefined,
   MetaOrUndefined,
@@ -38,6 +39,7 @@ interface UpdateExceptionListItemOptions {
   name: NameOrUndefined;
   description: DescriptionOrUndefined;
   entries: EntriesArray;
+  expireTime: ExpireTimeOrUndefined;
   savedObjectsClient: SavedObjectsClientContract;
   namespaceType: NamespaceType;
   osTypes: OsTypeArray;
@@ -53,6 +55,7 @@ export const updateExceptionListItem = async ({
   _version,
   comments,
   entries,
+  expireTime,
   id,
   savedObjectsClient,
   namespaceType,
@@ -87,6 +90,7 @@ export const updateExceptionListItem = async ({
         comments: transformedComments,
         description,
         entries,
+        expire_time: expireTime,
         meta,
         name,
         os_types: osTypes,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils/get_exception_lists_item_filter.test.ts b/x-pack/plugins/lists/server/services/exception_lists/utils/get_exception_lists_item_filter.test.ts
index 8e8b3499338dc..33ef8f1936aa5 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils/get_exception_lists_item_filter.test.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils/get_exception_lists_item_filter.test.ts
@@ -39,7 +39,7 @@ describe('getExceptionListsItemFilter', () => {
       savedObjectType: ['exception-list'],
     });
     expect(filter).toEqual(
-      '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "some-list-id") AND exception-list.attributes.name: "Sample Endpoint Exception List")'
+      '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "some-list-id") AND (exception-list.attributes.name: "Sample Endpoint Exception List"))'
     );
   });
 
@@ -61,7 +61,7 @@ describe('getExceptionListsItemFilter', () => {
       savedObjectType: ['exception-list', 'exception-list-agnostic'],
     });
     expect(filter).toEqual(
-      '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "list-1") AND exception-list.attributes.name: "Sample Endpoint Exception List") OR (exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-2")'
+      '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "list-1") AND (exception-list.attributes.name: "Sample Endpoint Exception List")) OR (exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-2")'
     );
   });
 
@@ -83,7 +83,7 @@ describe('getExceptionListsItemFilter', () => {
       savedObjectType: ['exception-list', 'exception-list-agnostic', 'exception-list-agnostic'],
     });
     expect(filter).toEqual(
-      '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "list-1") AND exception-list.attributes.name: "Sample Endpoint Exception List") OR (exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-2") OR (exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-3")'
+      '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "list-1") AND (exception-list.attributes.name: "Sample Endpoint Exception List")) OR (exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-2") OR (exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-3")'
     );
   });
 
@@ -98,7 +98,7 @@ describe('getExceptionListsItemFilter', () => {
       savedObjectType: ['exception-list', 'exception-list-agnostic', 'exception-list-agnostic'],
     });
     expect(filter).toEqual(
-      '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "list-1") AND exception-list.attributes.name: "Sample Endpoint Exception List 1") OR ((exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-2") AND exception-list.attributes.name: "Sample Endpoint Exception List 2") OR ((exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-3") AND exception-list.attributes.name: "Sample Endpoint Exception List 3")'
+      '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "list-1") AND (exception-list.attributes.name: "Sample Endpoint Exception List 1")) OR ((exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-2") AND (exception-list.attributes.name: "Sample Endpoint Exception List 2")) OR ((exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "list-3") AND (exception-list.attributes.name: "Sample Endpoint Exception List 3"))'
     );
   });
 });
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils/get_exception_lists_item_filter.ts b/x-pack/plugins/lists/server/services/exception_lists/utils/get_exception_lists_item_filter.ts
index 935ae8839a71d..fdb2ca954f070 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils/get_exception_lists_item_filter.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils/get_exception_lists_item_filter.ts
@@ -26,7 +26,7 @@ export const getExceptionListsItemFilter = ({
     const escapedListId = escapeQuotes(singleListId);
     const listItemAppend = `(${savedObjectType[index]}.attributes.list_type: item AND ${savedObjectType[index]}.attributes.list_id: "${escapedListId}")`;
     const listItemAppendWithFilter =
-      filter[index] != null ? `(${listItemAppend} AND ${filter[index]})` : listItemAppend;
+      filter[index] != null ? `(${listItemAppend} AND (${filter[index]}))` : listItemAppend;
     if (accum === '') {
       return listItemAppendWithFilter;
     } else {
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils/import/bulk_create_imported_items.test.ts b/x-pack/plugins/lists/server/services/exception_lists/utils/import/bulk_create_imported_items.test.ts
index a3dbc4cdfa9eb..91fa46fe953f5 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils/import/bulk_create_imported_items.test.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils/import/bulk_create_imported_items.test.ts
@@ -22,6 +22,7 @@ describe('bulkCreateImportedItems', () => {
         created_by: 'elastic',
         description: 'description here',
         entries: ENTRIES,
+        expire_time: undefined,
         immutable: undefined,
         item_id: 'item-id',
         list_id: 'list-id',
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils/import/bulk_create_imported_lists.test.ts b/x-pack/plugins/lists/server/services/exception_lists/utils/import/bulk_create_imported_lists.test.ts
index 9001f225e7364..dfac36c2bf874 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils/import/bulk_create_imported_lists.test.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils/import/bulk_create_imported_lists.test.ts
@@ -21,6 +21,7 @@ describe('bulkCreateImportedLists', () => {
         created_by: 'elastic',
         description: 'some description',
         entries: undefined,
+        expire_time: undefined,
         immutable: false,
         item_id: undefined,
         list_id: 'list-id',
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils/import/find_all_exception_list_item_types.test.ts b/x-pack/plugins/lists/server/services/exception_lists/utils/import/find_all_exception_list_item_types.test.ts
index 60d63c00b0114..7320d7dafe397 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils/import/find_all_exception_list_item_types.test.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils/import/find_all_exception_list_item_types.test.ts
@@ -65,7 +65,7 @@ describe('find_all_exception_list_item_types', () => {
 
       expect(savedObjectsClient.find).toHaveBeenCalledWith({
         filter:
-          '((exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "detection_list_id") AND exception-list-agnostic.attributes.item_id:(1))',
+          '((exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "detection_list_id") AND (exception-list-agnostic.attributes.item_id:(1)))',
         page: undefined,
         perPage: 100,
         sortField: undefined,
@@ -83,7 +83,7 @@ describe('find_all_exception_list_item_types', () => {
 
       expect(savedObjectsClient.find).toHaveBeenCalledWith({
         filter:
-          '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "detection_list_id") AND exception-list.attributes.item_id:(1))',
+          '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "detection_list_id") AND (exception-list.attributes.item_id:(1)))',
         page: undefined,
         perPage: 100,
         sortField: undefined,
@@ -101,7 +101,7 @@ describe('find_all_exception_list_item_types', () => {
 
       expect(savedObjectsClient.find).toHaveBeenCalledWith({
         filter:
-          '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "detection_list_id") AND exception-list.attributes.item_id:(2)) OR ((exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "detection_list_id") AND exception-list-agnostic.attributes.item_id:(1))',
+          '((exception-list.attributes.list_type: item AND exception-list.attributes.list_id: "detection_list_id") AND (exception-list.attributes.item_id:(2))) OR ((exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.list_id: "detection_list_id") AND (exception-list-agnostic.attributes.item_id:(1)))',
         page: undefined,
         perPage: 100,
         sortField: undefined,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils/import/sort_exception_items_to_create_update.ts b/x-pack/plugins/lists/server/services/exception_lists/utils/import/sort_exception_items_to_create_update.ts
index 2c93b0d33e35c..0eca82c3ac325 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils/import/sort_exception_items_to_create_update.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils/import/sort_exception_items_to_create_update.ts
@@ -50,6 +50,7 @@ export const sortExceptionItemsToUpdateOrCreate = ({
       comments,
       description,
       entries,
+      expire_time: expireTime,
       item_id: itemId,
       meta,
       list_id: listId,
@@ -89,6 +90,7 @@ export const sortExceptionItemsToUpdateOrCreate = ({
             created_by: user,
             description,
             entries,
+            expire_time: expireTime,
             immutable: undefined,
             item_id: itemId,
             list_id: listId,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils/import/sort_exception_lists_to_create_update.ts b/x-pack/plugins/lists/server/services/exception_lists/utils/import/sort_exception_lists_to_create_update.ts
index 6dbfea6e724db..cb255eab3c66e 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils/import/sort_exception_lists_to_create_update.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils/import/sort_exception_lists_to_create_update.ts
@@ -71,6 +71,7 @@ export const sortExceptionListsToUpdateOrCreate = ({
             created_by: user,
             description,
             entries: undefined,
+            expire_time: undefined,
             immutable: false,
             item_id: undefined,
             list_id: listId,
@@ -112,6 +113,7 @@ export const sortExceptionListsToUpdateOrCreate = ({
         created_by: user,
         description,
         entries: undefined,
+        expire_time: undefined,
         immutable: false,
         item_id: undefined,
         list_type: 'list',
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils/index.ts b/x-pack/plugins/lists/server/services/exception_lists/utils/index.ts
index 1cfce1208ece0..8af2bfcfa7175 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils/index.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils/index.ts
@@ -150,6 +150,7 @@ export const transformSavedObjectToExceptionListItem = ({
       created_by,
       description,
       entries,
+      expire_time,
       item_id: itemId,
       list_id,
       meta,
@@ -174,6 +175,7 @@ export const transformSavedObjectToExceptionListItem = ({
     created_by,
     description,
     entries: entries ?? [],
+    expire_time,
     id,
     item_id: itemId ?? '(unknown)',
     list_id,
@@ -203,6 +205,7 @@ export const transformSavedObjectUpdateToExceptionListItem = ({
       comments,
       description,
       entries,
+      expire_time: expireTime,
       meta,
       name,
       os_types: osTypes,
@@ -225,6 +228,7 @@ export const transformSavedObjectUpdateToExceptionListItem = ({
     created_by: exceptionListItem.created_by,
     description: description ?? exceptionListItem.description,
     entries: entries ?? exceptionListItem.entries,
+    expire_time: expireTime ?? exceptionListItem.expire_time,
     id,
     item_id: exceptionListItem.item_id,
     list_id: exceptionListItem.list_id,
@@ -308,6 +312,7 @@ export const transformCreateCommentsToComments = ({
 };
 
 export const transformCreateExceptionListItemOptionsToCreateExceptionListItemSchema = ({
+  expireTime,
   listId,
   itemId,
   namespaceType,
@@ -316,6 +321,7 @@ export const transformCreateExceptionListItemOptionsToCreateExceptionListItemSch
 }: CreateExceptionListItemOptions): CreateExceptionListItemSchema => {
   return {
     ...rest,
+    expire_time: expireTime,
     item_id: itemId,
     list_id: listId,
     namespace_type: namespaceType,
@@ -327,6 +333,7 @@ export const transformUpdateExceptionListItemOptionsToUpdateExceptionListItemSch
   itemId,
   namespaceType,
   osTypes,
+  expireTime,
   // The `UpdateExceptionListItemOptions` type differs from the schema in that some properties are
   // marked as having `undefined` as a valid value, where the schema, however, requires it.
   // So we assign defaults here
@@ -338,6 +345,7 @@ export const transformUpdateExceptionListItemOptionsToUpdateExceptionListItemSch
   return {
     ...rest,
     description,
+    expire_time: expireTime,
     item_id: itemId,
     name,
     namespace_type: namespaceType,
diff --git a/x-pack/plugins/security_solution/common/endpoint/data_generators/exceptions_list_item_generator.ts b/x-pack/plugins/security_solution/common/endpoint/data_generators/exceptions_list_item_generator.ts
index 737d81cc9d1ed..a9b2cbd697f4a 100644
--- a/x-pack/plugins/security_solution/common/endpoint/data_generators/exceptions_list_item_generator.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/data_generators/exceptions_list_item_generator.ts
@@ -30,14 +30,14 @@ type NonNullableTypeProperties<T> = {
  * create a value for (almost) all properties
  */
 type CreateExceptionListItemSchemaWithNonNullProps = NonNullableTypeProperties<
-  Omit<CreateExceptionListItemSchema, 'meta'>
+  Omit<CreateExceptionListItemSchema, 'meta' | 'expire_time'>
 > &
-  Pick<CreateExceptionListItemSchema, 'meta'>;
+  Pick<CreateExceptionListItemSchema, 'meta' | 'expire_time'>;
 
 type UpdateExceptionListItemSchemaWithNonNullProps = NonNullableTypeProperties<
-  Omit<UpdateExceptionListItemSchema, 'meta'>
+  Omit<UpdateExceptionListItemSchema, 'meta' | 'expire_time'>
 > &
-  Pick<UpdateExceptionListItemSchema, 'meta'>;
+  Pick<UpdateExceptionListItemSchema, 'meta' | 'expire_time'>;
 
 const exceptionItemToCreateExceptionItem = (
   exceptionItem: ExceptionListItemSchema
@@ -46,6 +46,7 @@ const exceptionItemToCreateExceptionItem = (
     /* eslint-disable @typescript-eslint/naming-convention */
     description,
     entries,
+    expire_time,
     list_id,
     name,
     type,
@@ -61,6 +62,7 @@ const exceptionItemToCreateExceptionItem = (
   return {
     description,
     entries,
+    expire_time,
     list_id,
     name,
     type,
@@ -109,6 +111,7 @@ export class ExceptionsListItemGenerator extends BaseDataGenerator<ExceptionList
           value: '741462ab431a22233C787BAAB9B653C7',
         },
       ],
+      expire_time: undefined,
       id: this.seededUUIDv4(),
       item_id: this.seededUUIDv4(),
       list_id: 'endpoint_list_id',
diff --git a/x-pack/plugins/security_solution/cypress/screens/exceptions.ts b/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
index 2776f4a35ff0d..37e9bb01f8d7f 100644
--- a/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
@@ -46,9 +46,11 @@ export const EXCEPTIONS_TABLE_SHOWING_LISTS = '[data-test-subj="showingException
 export const EXCEPTIONS_TABLE_DELETE_BTN =
   '[data-test-subj="sharedListOverflowCardActionItemDelete"]';
 
-export const EXCEPTIONS_TABLE_EXPORT_BTN =
+export const EXCEPTIONS_TABLE_EXPORT_MODAL_BTN =
   '[data-test-subj="sharedListOverflowCardActionItemExport"]';
 
+export const EXCEPTIONS_TABLE_EXPORT_CONFIRM_BTN = '[data-test-subj="confirmModalConfirmButton"]';
+
 export const EXCEPTIONS_TABLE_SEARCH_CLEAR =
   '[data-test-subj="allExceptionListsPanel"] button.euiFormControlLayoutClearButton';
 
diff --git a/x-pack/plugins/security_solution/cypress/tasks/exceptions_table.ts b/x-pack/plugins/security_solution/cypress/tasks/exceptions_table.ts
index c4ceae7032ac0..38f2542a22db4 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/exceptions_table.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/exceptions_table.ts
@@ -12,8 +12,9 @@ import {
   EXCEPTIONS_TABLE_SEARCH_CLEAR,
   EXCEPTIONS_TABLE_MODAL,
   EXCEPTIONS_TABLE_MODAL_CONFIRM_BTN,
-  EXCEPTIONS_TABLE_EXPORT_BTN,
+  EXCEPTIONS_TABLE_EXPORT_MODAL_BTN,
   EXCEPTIONS_OVERFLOW_ACTIONS_BTN,
+  EXCEPTIONS_TABLE_EXPORT_CONFIRM_BTN,
 } from '../screens/exceptions';
 
 export const clearSearchSelection = () => {
@@ -26,7 +27,8 @@ export const expandExceptionActions = () => {
 
 export const exportExceptionList = () => {
   cy.get(EXCEPTIONS_OVERFLOW_ACTIONS_BTN).first().click();
-  cy.get(EXCEPTIONS_TABLE_EXPORT_BTN).first().click();
+  cy.get(EXCEPTIONS_TABLE_EXPORT_MODAL_BTN).first().click();
+  cy.get(EXCEPTIONS_TABLE_EXPORT_CONFIRM_BTN).first().click();
 };
 
 export const deleteExceptionListWithoutRuleReference = () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/utility_bar/styles.tsx b/x-pack/plugins/security_solution/public/common/components/utility_bar/styles.tsx
index 82200b4f7478c..8e1836d733a88 100644
--- a/x-pack/plugins/security_solution/public/common/components/utility_bar/styles.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/utility_bar/styles.tsx
@@ -112,9 +112,9 @@ export const BarGroup = styled.div.attrs({
 `;
 BarGroup.displayName = 'BarGroup';
 
-export const BarText = styled.p.attrs({
-  className: 'siemUtilityBar__text',
-})<{ shouldWrap: boolean }>`
+export const BarText = styled.p.attrs(({ className }) => ({
+  className: className || 'siemUtilityBar__text',
+}))<{ shouldWrap: boolean }>`
   ${({ shouldWrap, theme }) => css`
     color: ${theme.eui.euiTextSubduedColor};
     font-size: ${theme.eui.euiFontSizeXS};
diff --git a/x-pack/plugins/security_solution/public/common/components/utility_bar/utility_bar_text.tsx b/x-pack/plugins/security_solution/public/common/components/utility_bar/utility_bar_text.tsx
index c9e9d0a0b8769..4dd2de98695d9 100644
--- a/x-pack/plugins/security_solution/public/common/components/utility_bar/utility_bar_text.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/utility_bar/utility_bar_text.tsx
@@ -13,11 +13,12 @@ export interface UtilityBarTextProps {
   children: string | JSX.Element;
   dataTestSubj?: string;
   shouldWrap?: boolean;
+  className?: string;
 }
 
 export const UtilityBarText = React.memo<UtilityBarTextProps>(
-  ({ children, dataTestSubj, shouldWrap = false }) => (
-    <BarText data-test-subj={dataTestSubj} shouldWrap={shouldWrap}>
+  ({ children, dataTestSubj, shouldWrap = false, className }) => (
+    <BarText data-test-subj={dataTestSubj} shouldWrap={shouldWrap} className={className}>
       {children}
     </BarText>
   )
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/add_exception_flyout/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/add_exception_flyout/index.tsx
index f031344631faa..b91367a019244 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/add_exception_flyout/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/add_exception_flyout/index.tsx
@@ -33,6 +33,7 @@ import type {
   ExceptionsBuilderReturnExceptionItem,
 } from '@kbn/securitysolution-list-utils';
 
+import type { Moment } from 'moment';
 import type { Status } from '../../../../../common/detection_engine/schemas/common/schemas';
 import * as i18n from './translations';
 import { ExceptionItemComments } from '../item_comments';
@@ -54,6 +55,7 @@ import { enrichNewExceptionItems } from '../flyout_components/utils';
 import { useCloseAlertsFromExceptions } from '../../logic/use_close_alerts';
 import { ruleTypesThatAllowLargeValueLists } from '../../utils/constants';
 import { useInvalidateFetchRuleByIdQuery } from '../../../rule_management/api/hooks/use_fetch_rule_by_id_query';
+import { ExceptionsExpireTime } from '../flyout_components/expire_time';
 
 const SectionHeader = styled(EuiTitle)`
   ${() => css`
@@ -153,6 +155,8 @@ export const AddExceptionFlyout = memo(function AddExceptionFlyout({
       newComment,
       itemConditionValidationErrorExists,
       errorSubmitting,
+      expireTime,
+      expireErrorExists,
     },
     dispatch,
   ] = useReducer(createExceptionItemsReducer(), {
@@ -312,6 +316,26 @@ export const AddExceptionFlyout = memo(function AddExceptionFlyout({
     [dispatch]
   );
 
+  const setExpireTime = useCallback(
+    (exceptionExpireTime: Moment | undefined): void => {
+      dispatch({
+        type: 'setExpireTime',
+        expireTime: exceptionExpireTime,
+      });
+    },
+    [dispatch]
+  );
+
+  const setExpireError = useCallback(
+    (errorExists: boolean): void => {
+      dispatch({
+        type: 'setExpireError',
+        errorExists,
+      });
+    },
+    [dispatch]
+  );
+
   useEffect((): void => {
     if (listType === ExceptionListTypeEnum.ENDPOINT && alertData != null) {
       setInitialExceptionItems(
@@ -343,6 +367,7 @@ export const AddExceptionFlyout = memo(function AddExceptionFlyout({
         sharedLists,
         listType,
         selectedOs: osTypesSelection,
+        expireTime,
         items: exceptionItems,
       });
 
@@ -391,6 +416,7 @@ export const AddExceptionFlyout = memo(function AddExceptionFlyout({
     bulkCloseIndex,
     setErrorSubmitting,
     invalidateFetchRuleByIdQuery,
+    expireTime,
   ]);
 
   const isSubmitButtonDisabled = useMemo(
@@ -401,6 +427,7 @@ export const AddExceptionFlyout = memo(function AddExceptionFlyout({
       exceptionItemName.trim() === '' ||
       exceptionItems.every((item) => item.entries.length === 0) ||
       itemConditionValidationErrorExists ||
+      expireErrorExists ||
       (addExceptionToRadioSelection === 'add_to_lists' && isEmpty(exceptionListsToAddTo)),
     [
       isSubmitting,
@@ -411,6 +438,7 @@ export const AddExceptionFlyout = memo(function AddExceptionFlyout({
       itemConditionValidationErrorExists,
       addExceptionToRadioSelection,
       exceptionListsToAddTo,
+      expireErrorExists,
     ]
   );
 
@@ -502,6 +530,12 @@ export const AddExceptionFlyout = memo(function AddExceptionFlyout({
             newCommentValue={newComment}
             newCommentOnChange={setComment}
           />
+          <EuiHorizontalRule />
+          <ExceptionsExpireTime
+            expireTime={expireTime}
+            setExpireTime={setExpireTime}
+            setExpireError={setExpireError}
+          />
           {showAlertCloseOptions && (
             <>
               <EuiHorizontalRule />
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/add_exception_flyout/reducer.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/add_exception_flyout/reducer.ts
index c36c842930b0f..04d13c3a1b4e9 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/add_exception_flyout/reducer.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/add_exception_flyout/reducer.ts
@@ -11,6 +11,7 @@ import type {
   ExceptionsBuilderExceptionItem,
   ExceptionsBuilderReturnExceptionItem,
 } from '@kbn/securitysolution-list-utils';
+import type { Moment } from 'moment';
 
 import type { Rule } from '../../../rule_management/logic/types';
 
@@ -30,6 +31,8 @@ export interface State {
   exceptionListsToAddTo: ExceptionListSchema[];
   selectedRulesToAddTo: Rule[];
   errorSubmitting: Error | null;
+  expireTime: Moment | undefined;
+  expireErrorExists: boolean;
 }
 
 export const initialState: State = {
@@ -48,6 +51,8 @@ export const initialState: State = {
   selectedRulesToAddTo: [],
   listType: ExceptionListTypeEnum.RULE_DEFAULT,
   errorSubmitting: null,
+  expireTime: undefined,
+  expireErrorExists: false,
 };
 
 export type Action =
@@ -110,6 +115,14 @@ export type Action =
   | {
       type: 'setErrorSubmitting';
       err: Error | null;
+    }
+  | {
+      type: 'setExpireTime';
+      expireTime: Moment | undefined;
+    }
+  | {
+      type: 'setExpireError';
+      errorExists: boolean;
     };
 
 export const createExceptionItemsReducer =
@@ -244,6 +257,22 @@ export const createExceptionItemsReducer =
           errorSubmitting: err,
         };
       }
+      case 'setExpireTime': {
+        const { expireTime } = action;
+
+        return {
+          ...state,
+          expireTime,
+        };
+      }
+      case 'setExpireError': {
+        const { errorExists } = action;
+
+        return {
+          ...state,
+          expireErrorExists: errorExists,
+        };
+      }
       default:
         return state;
     }
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/index.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/index.test.tsx
index dc6a0ea238310..1d1dd112da377 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/index.test.tsx
@@ -10,6 +10,8 @@ import { mount, shallow } from 'enzyme';
 
 import { ExceptionListTypeEnum } from '@kbn/securitysolution-io-ts-list-types';
 
+import { fetchExceptionListsItemsByListIds } from '@kbn/securitysolution-list-api';
+
 import { ExceptionsViewer } from '.';
 import { useKibana } from '../../../../common/lib/kibana';
 import { TestProviders } from '../../../../common/mock';
@@ -20,6 +22,7 @@ import * as i18n from './translations';
 
 jest.mock('../../../../common/lib/kibana');
 jest.mock('@kbn/securitysolution-list-hooks');
+jest.mock('@kbn/securitysolution-list-api');
 jest.mock('../../logic/use_find_references');
 jest.mock('react', () => {
   const r = jest.requireActual('react');
@@ -78,6 +81,8 @@ describe('ExceptionsViewer', () => {
       },
     });
 
+    (fetchExceptionListsItemsByListIds as jest.Mock).mockReturnValue({ total: 0 });
+
     (useFindExceptionListReferences as jest.Mock).mockReturnValue([
       false,
       false,
@@ -130,6 +135,7 @@ describe('ExceptionsViewer', () => {
         exceptionToEdit: null,
         viewerState: 'loading',
         exceptionLists: [],
+        exceptionsToShow: { active: true },
       },
       jest.fn(),
     ]);
@@ -168,6 +174,7 @@ describe('ExceptionsViewer', () => {
         exceptionToEdit: null,
         viewerState: 'empty_search',
         exceptionLists: [],
+        exceptionsToShow: { active: true },
       },
       jest.fn(),
     ]);
@@ -206,6 +213,7 @@ describe('ExceptionsViewer', () => {
         exceptionToEdit: null,
         viewerState: 'empty',
         exceptionLists: [],
+        exceptionsToShow: { active: true },
       },
       jest.fn(),
     ]);
@@ -250,6 +258,7 @@ describe('ExceptionsViewer', () => {
         exceptionToEdit: null,
         viewerState: 'empty',
         exceptionLists: [],
+        exceptionsToShow: { active: true },
       },
       jest.fn(),
     ]);
@@ -294,6 +303,7 @@ describe('ExceptionsViewer', () => {
         exceptionToEdit: null,
         viewerState: null,
         exceptionLists: [],
+        exceptionsToShow: { active: true },
       },
       jest.fn(),
     ]);
@@ -328,6 +338,7 @@ describe('ExceptionsViewer', () => {
         exceptionToEdit: sampleExceptionItem,
         viewerState: null,
         exceptionLists: [],
+        exceptionsToShow: { active: true },
       },
       jest.fn(),
     ]);
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/index.tsx
index 41482bccaf3b7..adcbd7ac36b5f 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/index.tsx
@@ -24,6 +24,11 @@ import {
   fetchExceptionListsItemsByListIds,
 } from '@kbn/securitysolution-list-api';
 
+import {
+  buildShowActiveExceptionsFilter,
+  buildShowExpiredExceptionsFilter,
+  getSavedObjectTypes,
+} from '@kbn/securitysolution-list-utils';
 import { useUserData } from '../../../../detections/components/user_info';
 import { useKibana, useToasts } from '../../../../common/lib/kibana';
 import { ExceptionsViewerSearchBar } from './search_bar';
@@ -44,7 +49,7 @@ const StyledText = styled(EuiText)`
   font-style: italic;
 `;
 
-const STATES_SEARCH_HIDDEN: ViewerState[] = ['error', 'empty'];
+const STATES_FILTERS_HIDDEN: ViewerState[] = ['error'];
 const STATES_PAGINATION_UTILITY_HIDDEN: ViewerState[] = [
   'loading',
   'empty_search',
@@ -66,6 +71,7 @@ const initialState: State = {
   viewerState: 'loading',
   isReadOnly: true,
   lastUpdated: Date.now(),
+  exceptionsToShow: { active: true },
 };
 
 export interface GetExceptionItemProps {
@@ -116,7 +122,16 @@ const ExceptionsViewerComponent = ({
 
   // Reducer state
   const [
-    { exceptions, pagination, currenFlyout, exceptionToEdit, viewerState, isReadOnly, lastUpdated },
+    {
+      exceptions,
+      pagination,
+      currenFlyout,
+      exceptionToEdit,
+      viewerState,
+      isReadOnly,
+      lastUpdated,
+      exceptionsToShow,
+    },
     dispatch,
   ] = useReducer(allExceptionItemsReducer(), {
     ...initialState,
@@ -179,6 +194,16 @@ const ExceptionsViewerComponent = ({
     [dispatch]
   );
 
+  const setExceptionsToShow = useCallback(
+    (optionId: string): void => {
+      dispatch({
+        type: 'setExceptionsToShow',
+        optionId,
+      });
+    },
+    [dispatch]
+  );
+
   const [isLoadingReferences, isFetchReferencesError, allReferences, fetchReferences] =
     useFindExceptionListReferences();
 
@@ -198,6 +223,26 @@ const ExceptionsViewerComponent = ({
     }
   }, [isLoadingReferences, isFetchReferencesError, setViewerState, viewerState]);
 
+  const namespaceTypes = useMemo(
+    () => exceptionListsToQuery.map((list) => list.namespace_type),
+    [exceptionListsToQuery]
+  );
+
+  const exceptionListFilter = useMemo(() => {
+    if (exceptionsToShow.active && exceptionsToShow.expired) {
+      return undefined;
+    }
+    const savedObjectPrefixes = getSavedObjectTypes({
+      namespaceType: namespaceTypes,
+    });
+    if (exceptionsToShow.active) {
+      return buildShowActiveExceptionsFilter(savedObjectPrefixes);
+    }
+    if (exceptionsToShow.expired) {
+      return buildShowExpiredExceptionsFilter(savedObjectPrefixes);
+    }
+  }, [exceptionsToShow, namespaceTypes]);
+
   const handleFetchItems = useCallback(
     async (options?: GetExceptionItemProps) => {
       const abortCtrl = new AbortController();
@@ -228,10 +273,10 @@ const ExceptionsViewerComponent = ({
         total,
         data,
       } = await fetchExceptionListsItemsByListIds({
-        filter: undefined,
+        filter: exceptionListFilter,
         http: services.http,
         listIds: exceptionListsToQuery.map((list) => list.list_id),
-        namespaceTypes: exceptionListsToQuery.map((list) => list.namespace_type),
+        namespaceTypes,
         search: options?.search,
         pagination: newPagination,
         signal: abortCtrl.signal,
@@ -248,9 +293,34 @@ const ExceptionsViewerComponent = ({
         total,
       };
     },
-    [pagination.pageIndex, pagination.pageSize, exceptionListsToQuery, services.http]
+    [
+      pagination.pageIndex,
+      pagination.pageSize,
+      exceptionListsToQuery,
+      services.http,
+      exceptionListFilter,
+      namespaceTypes,
+    ]
   );
 
+  const getTotalExceptionCount = useCallback(async () => {
+    const abortCtrl = new AbortController();
+
+    if (exceptionListsToQuery.length === 0) {
+      return 0;
+    }
+
+    const { total } = await fetchExceptionListsItemsByListIds({
+      filter: undefined,
+      http: services.http,
+      listIds: exceptionListsToQuery.map((list) => list.list_id),
+      namespaceTypes,
+      pagination: {},
+      signal: abortCtrl.signal,
+    });
+    return total;
+  }, [exceptionListsToQuery, namespaceTypes, services.http]);
+
   const handleGetExceptionListItems = useCallback(
     async (options?: GetExceptionItemProps) => {
       try {
@@ -266,7 +336,9 @@ const ExceptionsViewerComponent = ({
           },
         });
 
-        setViewerState(total > 0 ? null : 'empty');
+        setViewerState(
+          total > 0 ? null : (await getTotalExceptionCount()) > 0 ? 'empty_search' : 'empty'
+        );
       } catch (e) {
         setViewerState('error');
 
@@ -276,7 +348,7 @@ const ExceptionsViewerComponent = ({
         });
       }
     },
-    [handleFetchItems, setExceptions, setViewerState, toasts]
+    [handleFetchItems, setExceptions, setViewerState, toasts, getTotalExceptionCount]
   );
 
   const handleSearch = useCallback(
@@ -306,6 +378,13 @@ const ExceptionsViewerComponent = ({
     [handleFetchItems, setExceptions, setViewerState, toasts]
   );
 
+  const handleExceptionsToShow = useCallback(
+    (optionId: string): void => {
+      setExceptionsToShow(optionId);
+    },
+    [setExceptionsToShow]
+  );
+
   const handleAddException = useCallback((): void => {
     setFlyoutType('addException');
   }, [setFlyoutType]);
@@ -430,22 +509,25 @@ const ExceptionsViewerComponent = ({
             {isEndpointSpecified ? i18n.ENDPOINT_EXCEPTIONS_TAB_ABOUT : i18n.EXCEPTIONS_TAB_ABOUT}
           </StyledText>
           <EuiSpacer size="l" />
-          {!STATES_SEARCH_HIDDEN.includes(viewerState) && (
-            <ExceptionsViewerSearchBar
-              canAddException={isReadOnly}
-              isEndpoint={isEndpointSpecified}
-              isSearching={viewerState === 'searching'}
-              onSearch={handleSearch}
-              onAddExceptionClick={handleAddException}
-            />
-          )}
-          {!STATES_PAGINATION_UTILITY_HIDDEN.includes(viewerState) && (
+          {!STATES_FILTERS_HIDDEN.includes(viewerState) && (
             <>
-              <EuiSpacer size="l" />
-
-              <ExceptionsViewerUtility pagination={pagination} lastUpdated={lastUpdated} />
+              <ExceptionsViewerUtility
+                pagination={pagination}
+                exceptionsToShow={exceptionsToShow}
+                onChangeExceptionsToShow={handleExceptionsToShow}
+                lastUpdated={lastUpdated}
+              />
+              <EuiSpacer size="m" />
+              <ExceptionsViewerSearchBar
+                canAddException={isReadOnly}
+                isEndpoint={isEndpointSpecified}
+                isSearching={viewerState === 'searching'}
+                onSearch={handleSearch}
+                onAddExceptionClick={handleAddException}
+              />
             </>
           )}
+          <EuiSpacer size="l" />
 
           <ExceptionsViewerItems
             isReadOnly={isReadOnly}
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/reducer.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/reducer.ts
index 8489c983c6f0e..9b408a9f4516c 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/reducer.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/reducer.ts
@@ -29,6 +29,7 @@ export interface State {
   viewerState: ViewerState;
   isReadOnly: boolean;
   lastUpdated: string | number;
+  exceptionsToShow: { [id: string]: boolean };
 }
 
 export type Action =
@@ -53,6 +54,10 @@ export type Action =
   | {
       type: 'setLastUpdateTime';
       lastUpdate: string | number;
+    }
+  | {
+      type: 'setExceptionsToShow';
+      optionId: string;
     };
 
 export const allExceptionItemsReducer =
@@ -104,6 +109,21 @@ export const allExceptionItemsReducer =
           lastUpdated: action.lastUpdate,
         };
       }
+      case 'setExceptionsToShow': {
+        const newExceptionsToShow = {
+          ...state.exceptionsToShow,
+          ...{ [action.optionId]: !state.exceptionsToShow[action.optionId] },
+        };
+
+        // At least one button must be selected
+        if (!newExceptionsToShow.active && !newExceptionsToShow.expired) {
+          return { ...state, exceptionsToShow: { active: true } };
+        }
+        return {
+          ...state,
+          exceptionsToShow: newExceptionsToShow,
+        };
+      }
       default:
         return state;
     }
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/translations.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/translations.ts
index 6e50d5d28fe3e..45f2ada3ff711 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/translations.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/translations.ts
@@ -150,3 +150,17 @@ export const ADD_TO_DETECTIONS_LIST = i18n.translate(
     defaultMessage: 'Add rule exception',
   }
 );
+
+export const ACTIVE_EXCEPTIONS = i18n.translate(
+  'xpack.securitySolution.ruleExceptions.allExceptionItems.activeDetectionsLabel',
+  {
+    defaultMessage: 'Active exceptions',
+  }
+);
+
+export const EXPIRED_EXCEPTIONS = i18n.translate(
+  'xpack.securitySolution.ruleExceptions.allExceptionItems.expiredDetectionsLabel',
+  {
+    defaultMessage: 'Expired exceptions',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/utility_bar.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/utility_bar.test.tsx
index d9fe0218311c5..d23e27fd2c2b2 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/utility_bar.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/utility_bar.test.tsx
@@ -22,6 +22,8 @@ describe('ExceptionsViewerUtility', () => {
             totalItemCount: 105,
             pageSizeOptions: [5, 10, 20, 50, 100],
           }}
+          exceptionsToShow={{ active: true }}
+          onChangeExceptionsToShow={(optionId: string) => {}}
           lastUpdated={1660534202}
         />
       </TestProviders>
@@ -42,6 +44,8 @@ describe('ExceptionsViewerUtility', () => {
             totalItemCount: 1,
             pageSizeOptions: [5, 10, 20, 50, 100],
           }}
+          exceptionsToShow={{ active: true }}
+          onChangeExceptionsToShow={(optionId: string) => {}}
           lastUpdated={Date.now()}
         />
       </TestProviders>
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/utility_bar.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/utility_bar.tsx
index 0f1a24df3b3a5..d7ea7acfd5f31 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/utility_bar.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/all_exception_items_table/utility_bar.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { EuiText, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiText, EuiButtonGroup, EuiFlexGroup } from '@elastic/eui';
 import styled from 'styled-components';
 
 import { FormattedMessage } from '@kbn/i18n-react';
@@ -18,24 +18,30 @@ import {
   UtilityBarText,
 } from '../../../../common/components/utility_bar';
 import { FormattedRelativePreferenceDate } from '../../../../common/components/formatted_date';
+import * as i18n from './translations';
 
 const StyledText = styled.span`
   font-weight: bold;
 `;
 
-const MyUtilities = styled(EuiFlexGroup)`
+const MyUtilities = styled.div`
   height: 50px;
 `;
 
-const StyledCondition = styled.span`
-  display: inline-block !important;
-  vertical-align: middle !important;
+const StyledBarGroup = styled(EuiFlexGroup)`
+  align-items: center;
+`;
+
+const PaginationUtilityBarText = styled(UtilityBarText)`
+  align-self: center;
 `;
 
 interface ExceptionsViewerUtilityProps {
   pagination: ExceptionsPagination;
   // Corresponds to last time exception items were fetched
   lastUpdated: string | number;
+  exceptionsToShow: { [id: string]: boolean };
+  onChangeExceptionsToShow: (optionId: string) => void;
 }
 
 /**
@@ -44,19 +50,21 @@ interface ExceptionsViewerUtilityProps {
 const ExceptionsViewerUtilityComponent: React.FC<ExceptionsViewerUtilityProps> = ({
   pagination,
   lastUpdated,
-}): JSX.Element => (
-  <MyUtilities alignItems="center" justifyContent="spaceBetween">
-    <EuiFlexItem grow={false}>
+  exceptionsToShow,
+  onChangeExceptionsToShow,
+}): JSX.Element => {
+  return (
+    <MyUtilities>
       <UtilityBar>
         <UtilityBarSection>
           <UtilityBarGroup>
-            <UtilityBarText dataTestSubj="exceptionsShowing">
+            <PaginationUtilityBarText dataTestSubj="exceptionsShowing">
               <FormattedMessage
                 id="xpack.securitySolution.exceptions.viewer.paginationDetails"
                 defaultMessage="Showing {partOne} of {partTwo}"
                 values={{
                   partOne: (
-                    <StyledText>{`1-${Math.min(
+                    <StyledText>{`${pagination.totalItemCount === 0 ? '0' : '1'}-${Math.min(
                       pagination.pageSize,
                       pagination.totalItemCount
                     )}`}</StyledText>
@@ -64,31 +72,44 @@ const ExceptionsViewerUtilityComponent: React.FC<ExceptionsViewerUtilityProps> =
                   partTwo: <StyledText>{`${pagination.totalItemCount}`}</StyledText>,
                 }}
               />
-            </UtilityBarText>
+            </PaginationUtilityBarText>
           </UtilityBarGroup>
         </UtilityBarSection>
-      </UtilityBar>
-    </EuiFlexItem>
-    <EuiFlexItem grow={false}>
-      <EuiText size="s" data-test-subj="exceptionsViewerLastUpdated">
-        <FormattedMessage
-          id="xpack.securitySolution.exceptions.viewer.lastUpdated"
-          defaultMessage="Updated {updated}"
-          values={{
-            updated: (
-              <StyledCondition>
-                <FormattedRelativePreferenceDate
-                  value={lastUpdated}
-                  tooltipAnchorClassName="eui-textTruncate"
+        <UtilityBarSection>
+          <StyledBarGroup>
+            <UtilityBarText dataTestSubj="lastUpdated">
+              <EuiText size="s" data-test-subj="exceptionsViewerLastUpdated">
+                <FormattedMessage
+                  id="xpack.securitySolution.exceptions.viewer.lastUpdated"
+                  defaultMessage="Updated {updated}"
+                  values={{
+                    updated: <FormattedRelativePreferenceDate value={lastUpdated} />,
+                  }}
                 />
-              </StyledCondition>
-            ),
-          }}
-        />
-      </EuiText>
-    </EuiFlexItem>
-  </MyUtilities>
-);
+              </EuiText>
+            </UtilityBarText>
+            <EuiButtonGroup
+              legend="Displayed exceptions button group"
+              options={[
+                {
+                  id: `active`,
+                  label: i18n.ACTIVE_EXCEPTIONS,
+                },
+                {
+                  id: `expired`,
+                  label: i18n.EXPIRED_EXCEPTIONS,
+                },
+              ]}
+              idToSelectedMap={exceptionsToShow}
+              onChange={onChangeExceptionsToShow}
+              type="multi"
+            />
+          </StyledBarGroup>
+        </UtilityBarSection>
+      </UtilityBar>
+    </MyUtilities>
+  );
+};
 
 ExceptionsViewerUtilityComponent.displayName = 'ExceptionsViewerUtilityComponent';
 
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/edit_exception_flyout/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/edit_exception_flyout/index.tsx
index 6bf0b87652e3e..04a350e328a26 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/edit_exception_flyout/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/edit_exception_flyout/index.tsx
@@ -33,6 +33,8 @@ import {
 
 import type { ExceptionsBuilderReturnExceptionItem } from '@kbn/securitysolution-list-utils';
 
+import type { Moment } from 'moment';
+import moment from 'moment';
 import {
   isEqlRule,
   isNewTermsRule,
@@ -56,6 +58,7 @@ import { createExceptionItemsReducer } from './reducer';
 import { useEditExceptionItems } from './use_edit_exception';
 
 import * as i18n from './translations';
+import { ExceptionsExpireTime } from '../flyout_components/expire_time';
 
 interface EditExceptionFlyoutProps {
   list: ExceptionListSchema;
@@ -119,6 +122,8 @@ const EditExceptionFlyoutComponent: React.FC<EditExceptionFlyoutProps> = ({
       disableBulkClose,
       bulkCloseIndex,
       entryErrorExists,
+      expireTime,
+      expireErrorExists,
     },
     dispatch,
   ] = useReducer(createExceptionItemsReducer(), {
@@ -129,6 +134,8 @@ const EditExceptionFlyoutComponent: React.FC<EditExceptionFlyoutProps> = ({
     disableBulkClose: true,
     bulkCloseIndex: undefined,
     entryErrorExists: false,
+    expireTime: itemToEdit.expire_time !== undefined ? moment(itemToEdit.expire_time) : undefined,
+    expireErrorExists: false,
   });
 
   const allowLargeValueLists = useMemo((): boolean => {
@@ -231,6 +238,26 @@ const EditExceptionFlyoutComponent: React.FC<EditExceptionFlyoutProps> = ({
     [dispatch]
   );
 
+  const setExpireTime = useCallback(
+    (exceptionExpireTime: Moment | undefined): void => {
+      dispatch({
+        type: 'setExpireTime',
+        expireTime: exceptionExpireTime,
+      });
+    },
+    [dispatch]
+  );
+
+  const setExpireError = useCallback(
+    (errorExists: boolean): void => {
+      dispatch({
+        type: 'setExpireError',
+        errorExists,
+      });
+    },
+    [dispatch]
+  );
+
   const handleCloseFlyout = useCallback((): void => {
     onCancel(false);
   }, [onCancel]);
@@ -251,6 +278,7 @@ const EditExceptionFlyoutComponent: React.FC<EditExceptionFlyoutProps> = ({
         commentToAdd: newComment,
         listType,
         selectedOs: itemToEdit.os_types,
+        expireTime,
         items: exceptionItems,
       });
 
@@ -292,6 +320,7 @@ const EditExceptionFlyoutComponent: React.FC<EditExceptionFlyoutProps> = ({
     onConfirm,
     bulkCloseIndex,
     onCancel,
+    expireTime,
   ]);
 
   const editExceptionMessage = useMemo(
@@ -308,8 +337,9 @@ const EditExceptionFlyoutComponent: React.FC<EditExceptionFlyoutProps> = ({
       isClosingAlerts ||
       exceptionItems.every((item) => item.entries.length === 0) ||
       isLoading ||
-      entryErrorExists,
-    [isLoading, entryErrorExists, exceptionItems, isSubmitting, isClosingAlerts]
+      entryErrorExists ||
+      expireErrorExists,
+    [isLoading, entryErrorExists, exceptionItems, isSubmitting, isClosingAlerts, expireErrorExists]
   );
 
   return (
@@ -370,6 +400,12 @@ const EditExceptionFlyoutComponent: React.FC<EditExceptionFlyoutProps> = ({
           newCommentValue={newComment}
           newCommentOnChange={setComment}
         />
+        <EuiHorizontalRule />
+        <ExceptionsExpireTime
+          expireTime={expireTime}
+          setExpireTime={setExpireTime}
+          setExpireError={setExpireError}
+        />
         {showAlertCloseOptions && (
           <>
             <EuiHorizontalRule />
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/edit_exception_flyout/reducer.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/edit_exception_flyout/reducer.ts
index 22fefe760e4aa..e08b3c8d135c0 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/edit_exception_flyout/reducer.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/edit_exception_flyout/reducer.ts
@@ -6,6 +6,7 @@
  */
 
 import type { ExceptionsBuilderReturnExceptionItem } from '@kbn/securitysolution-list-utils';
+import type { Moment } from 'moment';
 
 export interface State {
   exceptionItems: ExceptionsBuilderReturnExceptionItem[];
@@ -15,6 +16,8 @@ export interface State {
   disableBulkClose: boolean;
   bulkCloseIndex: string[] | undefined;
   entryErrorExists: boolean;
+  expireTime: Moment | undefined;
+  expireErrorExists: boolean;
 }
 
 export type Action =
@@ -45,6 +48,14 @@ export type Action =
   | {
       type: 'setConditionValidationErrorExists';
       errorExists: boolean;
+    }
+  | {
+      type: 'setExpireTime';
+      expireTime: Moment | undefined;
+    }
+  | {
+      type: 'setExpireError';
+      errorExists: boolean;
     };
 
 export const createExceptionItemsReducer =
@@ -110,6 +121,22 @@ export const createExceptionItemsReducer =
           entryErrorExists: errorExists,
         };
       }
+      case 'setExpireTime': {
+        const { expireTime } = action;
+
+        return {
+          ...state,
+          expireTime,
+        };
+      }
+      case 'setExpireError': {
+        const { errorExists } = action;
+
+        return {
+          ...state,
+          expireErrorExists: errorExists,
+        };
+      }
       default:
         return state;
     }
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/exception_item_card/meta.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/exception_item_card/meta.tsx
index 667883d666bdc..d53ef1c54d5b4 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/exception_item_card/meta.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/exception_item_card/meta.tsx
@@ -51,6 +51,11 @@ export const ExceptionItemCardMetaInfo = memo<ExceptionItemCardMetaInfoProps>(
     const onCloseRulesPopover = () => setIsRulesPopoverOpen(false);
     const onClosListsPopover = () => setIsListsPopoverOpen(false);
 
+    const isExpired = useMemo(
+      () => (item.expire_time ? new Date(item.expire_time) <= new Date() : false),
+      [item]
+    );
+
     const itemActions = useMemo((): EuiContextMenuPanelProps['items'] => {
       if (listAndReferences == null) {
         return [];
@@ -177,6 +182,20 @@ export const ExceptionItemCardMetaInfo = memo<ExceptionItemCardMetaInfoProps>(
             dataTestSubj={`${dataTestSubj}-updatedBy`}
           />
         </StyledFlexItem>
+        {item.expire_time != null && (
+          <>
+            <StyledFlexItem grow={false}>
+              <MetaInfoDetails
+                fieldName="expire_time"
+                label={
+                  isExpired ? i18n.EXCEPTION_ITEM_EXPIRED_LABEL : i18n.EXCEPTION_ITEM_EXPIRES_LABEL
+                }
+                value1={<FormattedDate fieldName="expire_time" value={item.expire_time} />}
+                dataTestSubj={`${dataTestSubj}-expireTime`}
+              />
+            </StyledFlexItem>
+          </>
+        )}
         {listAndReferences != null && (
           <>
             {rulesAffected}
@@ -193,7 +212,7 @@ interface MetaInfoDetailsProps {
   fieldName: string;
   label: string;
   value1: JSX.Element | string;
-  value2: string;
+  value2?: string;
   dataTestSubj: string;
 }
 
@@ -210,20 +229,24 @@ const MetaInfoDetails = memo<MetaInfoDetailsProps>(({ label, value1, value2, dat
           {value1}
         </EuiBadge>
       </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <EuiText size="xs" style={{ fontFamily: 'Inter' }}>
-          {i18n.EXCEPTION_ITEM_META_BY}
-        </EuiText>
-      </EuiFlexItem>
-      <EuiFlexItem grow={false} data-test-subj={`${dataTestSubj}-value2`}>
-        <EuiFlexGroup responsive={false} gutterSize="xs" alignItems="center" wrap={false}>
+      {value2 != null && (
+        <>
           <EuiFlexItem grow={false}>
-            <EuiBadge color="hollow" style={{ fontFamily: 'Inter' }}>
-              {value2}
-            </EuiBadge>
+            <EuiText size="xs" style={{ fontFamily: 'Inter' }}>
+              {i18n.EXCEPTION_ITEM_META_BY}
+            </EuiText>
           </EuiFlexItem>
-        </EuiFlexGroup>
-      </EuiFlexItem>
+          <EuiFlexItem grow={false} data-test-subj={`${dataTestSubj}-value2`}>
+            <EuiFlexGroup responsive={false} gutterSize="xs" alignItems="center" wrap={false}>
+              <EuiFlexItem grow={false}>
+                <EuiBadge color="hollow" style={{ fontFamily: 'Inter' }}>
+                  {value2}
+                </EuiBadge>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFlexItem>
+        </>
+      )}
     </EuiFlexGroup>
   );
 });
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/exception_item_card/translations.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/exception_item_card/translations.ts
index 75d0b098c297e..4e1525adf2fba 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/exception_item_card/translations.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/exception_item_card/translations.ts
@@ -49,6 +49,20 @@ export const EXCEPTION_ITEM_UPDATED_LABEL = i18n.translate(
   }
 );
 
+export const EXCEPTION_ITEM_EXPIRES_LABEL = i18n.translate(
+  'xpack.securitySolution.ruleExceptions.exceptionItem.expiresLabel',
+  {
+    defaultMessage: 'Expires at',
+  }
+);
+
+export const EXCEPTION_ITEM_EXPIRED_LABEL = i18n.translate(
+  'xpack.securitySolution.ruleExceptions.exceptionItem.expiredLabel',
+  {
+    defaultMessage: 'Expired at',
+  }
+);
+
 export const EXCEPTION_ITEM_META_BY = i18n.translate(
   'xpack.securitySolution.ruleExceptions.exceptionItem.metaDetailsBy',
   {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/expire_time/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/expire_time/index.tsx
new file mode 100644
index 0000000000000..1f71c7a2fe51c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/expire_time/index.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiDatePicker, EuiFormRow, EuiSpacer, EuiTitle } from '@elastic/eui';
+import type { Moment } from 'moment';
+import moment from 'moment';
+import React, { useCallback, useState } from 'react';
+import styled, { css } from 'styled-components';
+import * as i18n from './translations';
+
+interface ExceptionItmeExpireTimeProps {
+  expireTime: Moment | undefined;
+  setExpireTime: (date: Moment | undefined) => void;
+  setExpireError: (errorExists: boolean) => void;
+}
+
+const SectionHeader = styled(EuiTitle)`
+  ${() => css`
+    font-weight: ${({ theme }) => theme.eui.euiFontWeightSemiBold};
+  `}
+`;
+
+const ExceptionItemExpireTime: React.FC<ExceptionItmeExpireTimeProps> = ({
+  expireTime,
+  setExpireTime,
+  setExpireError,
+}): JSX.Element => {
+  const [dateTime, setDateTime] = useState<Moment | undefined>(expireTime);
+  const [isInvalid, setIsInvalid] = useState(false);
+  const [errors, setErrors] = useState<string[]>([]);
+
+  const handleChange = useCallback(
+    (date: Moment | null) => {
+      setDateTime(date ?? undefined);
+      setExpireTime(date ?? undefined);
+      if (date?.isBefore()) {
+        setIsInvalid(true);
+        setErrors([i18n.EXCEPTION_EXPIRE_TIME_ERROR]);
+        setExpireError(true);
+      } else {
+        setIsInvalid(false);
+        setErrors([]);
+        setExpireError(false);
+      }
+    },
+    [setDateTime, setExpireTime, setExpireError]
+  );
+
+  return (
+    <div>
+      <SectionHeader size="xs">
+        <h3>{i18n.EXCEPTION_EXPIRE_TIME_HEADER}</h3>
+      </SectionHeader>
+      <EuiSpacer size="s" />
+      <EuiFormRow error={errors} isInvalid={isInvalid} label={i18n.EXPIRE_TIME_LABEL}>
+        <EuiDatePicker
+          showTimeSelect
+          selected={dateTime}
+          isInvalid={isInvalid}
+          onChange={handleChange}
+          onClear={() => handleChange(null)}
+          minDate={moment()}
+        />
+      </EuiFormRow>
+    </div>
+  );
+};
+
+export const ExceptionsExpireTime = React.memo(ExceptionItemExpireTime);
+
+ExceptionsExpireTime.displayName = 'ExceptionsExpireTime';
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/expire_time/translations.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/expire_time/translations.ts
new file mode 100644
index 0000000000000..6e02591bfe41b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/expire_time/translations.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const EXPIRE_TIME_LABEL = i18n.translate(
+  'xpack.securitySolution.rule_exceptions.flyoutComponents.expireTime.expireTimeLabel',
+  {
+    defaultMessage: 'Exception will expire at',
+  }
+);
+
+export const EXCEPTION_EXPIRE_TIME_HEADER = i18n.translate(
+  'xpack.securitySolution.rule_exceptions.flyoutComponents.expireTime.exceptionExpireTime',
+  {
+    defaultMessage: 'Exception Expiration',
+  }
+);
+
+export const EXCEPTION_EXPIRE_TIME_ERROR = i18n.translate(
+  'xpack.securitySolution.rule_exceptions.flyoutComponents.expireTime.exceptionExpireTimeError',
+  {
+    defaultMessage: 'Selected date and time must be in the future.',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/utils.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/utils.test.tsx
index 4096cd03f2bc3..0c1e4a40d8373 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/utils.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/utils.test.tsx
@@ -39,6 +39,7 @@ describe('add_exception_flyout#utils', () => {
           selectedOs: [],
           listType: ExceptionListTypeEnum.RULE_DEFAULT,
           items,
+          expireTime: undefined,
         })
       ).toEqual([
         {
@@ -75,6 +76,7 @@ describe('add_exception_flyout#utils', () => {
           selectedOs: [],
           listType: ExceptionListTypeEnum.DETECTION,
           items,
+          expireTime: undefined,
         })
       ).toEqual([
         {
@@ -114,6 +116,7 @@ describe('add_exception_flyout#utils', () => {
           selectedOs: ['windows'],
           listType: ExceptionListTypeEnum.ENDPOINT,
           items,
+          expireTime: undefined,
         })
       ).toEqual([
         {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/utils.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/utils.tsx
index f2b18680b3542..e70844348c385 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/utils.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/utils.tsx
@@ -13,6 +13,7 @@ import { ExceptionListTypeEnum } from '@kbn/securitysolution-io-ts-list-types';
 import type { ExceptionsBuilderReturnExceptionItem } from '@kbn/securitysolution-list-utils';
 
 import type { HorizontalAlignment } from '@elastic/eui';
+import type { Moment } from 'moment';
 import {
   HeaderMenu,
   generateLinkedRulesMenuItems,
@@ -22,6 +23,7 @@ import { ListDetailsLinkAnchor } from '../../../../exceptions/components';
 import {
   enrichExceptionItemsWithOS,
   enrichNewExceptionItemsWithComments,
+  enrichNewExceptionItemsWithExpireTime,
   enrichNewExceptionItemsWithName,
   enrichRuleExceptions,
   enrichSharedExceptions,
@@ -58,6 +60,18 @@ export const enrichItemWithName =
     return itemName.trim() !== '' ? enrichNewExceptionItemsWithName(items, itemName) : items;
   };
 
+/**
+ * Adds expiration datetime to all new exceptionItems
+ * @param expireTimeToAdd new expireTime to add to item
+ */
+export const enrichItemWithExpireTime =
+  (expireTimeToAdd: Moment | undefined) =>
+  (items: ExceptionsBuilderReturnExceptionItem[]): ExceptionsBuilderReturnExceptionItem[] => {
+    return expireTimeToAdd != null
+      ? enrichNewExceptionItemsWithExpireTime(items, expireTimeToAdd)
+      : items;
+  };
+
 /**
  * Modifies item entries to be in correct format and adds os selection to items
  * @param listType exception list type
@@ -114,6 +128,7 @@ export const enrichItemsForSharedLists =
  * @param sharedLists shared exception lists that were selected to add items to
  * @param selectedOs os selection
  * @param listType exception list type
+ * @param expireTime exception item expire time
  * @param items exception items to be modified
  */
 export const enrichNewExceptionItems = ({
@@ -124,6 +139,7 @@ export const enrichNewExceptionItems = ({
   sharedLists,
   selectedOs,
   listType,
+  expireTime,
   items,
 }: {
   itemName: string;
@@ -133,10 +149,12 @@ export const enrichNewExceptionItems = ({
   addToSharedLists: boolean;
   sharedLists: ExceptionListSchema[];
   listType: ExceptionListTypeEnum;
+  expireTime: Moment | undefined;
   items: ExceptionsBuilderReturnExceptionItem[];
 }): ExceptionsBuilderReturnExceptionItem[] => {
   const enriched: ExceptionsBuilderReturnExceptionItem[] = pipe(
     enrichItemWithComment(commentToAdd),
+    enrichItemWithExpireTime(expireTime),
     enrichItemWithName(itemName),
     enrichEndpointItems(listType, selectedOs),
     enrichItemsForDefaultRuleList(listType, addToRules),
@@ -155,6 +173,7 @@ export const enrichNewExceptionItems = ({
  * @param sharedLists shared exception lists that were selected to add items to
  * @param selectedOs os selection
  * @param listType exception list type
+ * @param expireTime exception item expire time
  * @param items exception items to be modified
  */
 export const enrichExceptionItemsForUpdate = ({
@@ -162,16 +181,19 @@ export const enrichExceptionItemsForUpdate = ({
   commentToAdd,
   selectedOs,
   listType,
+  expireTime,
   items,
 }: {
   itemName: string;
   commentToAdd: string;
   selectedOs: OsType[];
   listType: ExceptionListTypeEnum;
+  expireTime: Moment | undefined;
   items: ExceptionsBuilderReturnExceptionItem[];
 }): ExceptionsBuilderReturnExceptionItem[] => {
   const enriched: ExceptionsBuilderReturnExceptionItem[] = pipe(
     enrichItemWithComment(commentToAdd),
+    enrichItemWithExpireTime(expireTime),
     enrichItemWithName(itemName),
     enrichEndpointItems(listType, selectedOs)
   )(items);
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.tsx
index 6547785e29cc9..6a739fd34a05a 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.tsx
@@ -9,6 +9,7 @@ import React from 'react';
 import type { EuiCommentProps } from '@elastic/eui';
 import { EuiText, EuiAvatar } from '@elastic/eui';
 import { capitalize, omit } from 'lodash';
+import type { Moment } from 'moment';
 import moment from 'moment';
 
 import type {
@@ -177,6 +178,23 @@ export const enrichNewExceptionItemsWithComments = (
   });
 };
 
+/**
+ * Adds expireTime to all new exceptionItems if not present already
+ * @param exceptionItems new or existing ExceptionItem[]
+ * @param expireTime new expireTime
+ */
+export const enrichNewExceptionItemsWithExpireTime = (
+  exceptionItems: ExceptionsBuilderReturnExceptionItem[],
+  expireTime: Moment
+): ExceptionsBuilderReturnExceptionItem[] => {
+  return exceptionItems.map((item: ExceptionsBuilderReturnExceptionItem) => {
+    return {
+      ...item,
+      expire_time: expireTime.toISOString(),
+    };
+  });
+};
+
 export const buildGetAlertByIdQuery = (id: string | undefined) => ({
   query: {
     match: {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
index bd58da0521c2c..dab1bf3b68285 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
@@ -78,6 +78,7 @@ export const getExceptionListItemSchemaMock = (
   created_by: USER,
   description: DESCRIPTION,
   entries: ENTRIES,
+  expire_time: undefined,
   id: '1',
   item_id: 'endpoint_list_item',
   list_id: 'endpoint_list_id',
diff --git a/x-pack/plugins/security_solution/public/exceptions/components/exceptions_list_card/index.tsx b/x-pack/plugins/security_solution/public/exceptions/components/exceptions_list_card/index.tsx
index 478bdb9f2f5b5..54f2b0cf6c5d3 100644
--- a/x-pack/plugins/security_solution/public/exceptions/components/exceptions_list_card/index.tsx
+++ b/x-pack/plugins/security_solution/public/exceptions/components/exceptions_list_card/index.tsx
@@ -33,6 +33,7 @@ import { ListExceptionItems } from '../list_exception_items';
 import { useListDetailsView } from '../../hooks';
 import { useExceptionsListCard } from '../../hooks/use_exceptions_list.card';
 import { ManageRules } from '../manage_rules';
+import { ExportExceptionsListModal } from '../export_exceptions_list_modal';
 
 interface ExceptionsListCardProps {
   exceptionsList: ExceptionListInfo;
@@ -47,10 +48,12 @@ interface ExceptionsListCardProps {
   }) => () => Promise<void>;
   handleExport: ({
     id,
+    includeExpiredExceptions,
     listId,
     namespaceType,
   }: {
     id: string;
+    includeExpiredExceptions: boolean;
     listId: string;
     namespaceType: NamespaceType;
   }) => () => Promise<void>;
@@ -115,6 +118,9 @@ export const ExceptionsListCard = memo<ExceptionsListCardProps>(
       emptyViewerTitle,
       emptyViewerBody,
       emptyViewerButtonText,
+      handleCancelExportModal,
+      handleConfirmExportModal,
+      showExportModal,
     } = useExceptionsListCard({
       exceptionsList,
       handleExport,
@@ -248,6 +254,12 @@ export const ExceptionsListCard = memo<ExceptionsListCardProps>(
             onRuleSelectionChange={onRuleSelectionChange}
           />
         ) : null}
+        {showExportModal ? (
+          <ExportExceptionsListModal
+            handleCloseModal={handleCancelExportModal}
+            onModalConfirm={handleConfirmExportModal}
+          />
+        ) : null}
       </EuiFlexGroup>
     );
   }
diff --git a/x-pack/plugins/security_solution/public/exceptions/components/export_exceptions_list_modal/index.tsx b/x-pack/plugins/security_solution/public/exceptions/components/export_exceptions_list_modal/index.tsx
new file mode 100644
index 0000000000000..7316925cc24cf
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/exceptions/components/export_exceptions_list_modal/index.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, useCallback, useState } from 'react';
+
+import { EuiConfirmModal, EuiSwitch } from '@elastic/eui';
+import * as i18n from '../../translations';
+
+interface ExportExceptionsListModalProps {
+  handleCloseModal: () => void;
+  onModalConfirm: (includeExpired: boolean) => void;
+}
+
+export const ExportExceptionsListModal = memo<ExportExceptionsListModalProps>(
+  ({ handleCloseModal, onModalConfirm }) => {
+    const [exportExpired, setExportExpired] = useState(true);
+
+    const handleSwitchChange = useCallback(() => {
+      setExportExpired(!exportExpired);
+    }, [setExportExpired, exportExpired]);
+
+    const handleConfirm = useCallback(() => {
+      onModalConfirm(exportExpired);
+      handleCloseModal();
+    }, [exportExpired, handleCloseModal, onModalConfirm]);
+
+    return (
+      <EuiConfirmModal
+        title={i18n.EXPORT_MODAL_TITLE}
+        onCancel={handleCloseModal}
+        onConfirm={handleConfirm}
+        cancelButtonText={i18n.EXPORT_MODAL_CANCEL_BUTTON}
+        confirmButtonText={i18n.EXPORT_MODAL_CONFIRM_BUTTON}
+        defaultFocusedButton="confirm"
+      >
+        <EuiSwitch
+          label={i18n.EXPORT_MODAL_INCLUDE_SWITCH_LABEL}
+          checked={exportExpired}
+          onChange={handleSwitchChange}
+        />
+      </EuiConfirmModal>
+    );
+  }
+);
+
+ExportExceptionsListModal.displayName = 'ExportExceptionsListModal';
diff --git a/x-pack/plugins/security_solution/public/exceptions/hooks/use_exceptions_list.card/index.tsx b/x-pack/plugins/security_solution/public/exceptions/hooks/use_exceptions_list.card/index.tsx
index 3fb44d2d5b5c5..5a8912a422f5c 100644
--- a/x-pack/plugins/security_solution/public/exceptions/hooks/use_exceptions_list.card/index.tsx
+++ b/x-pack/plugins/security_solution/public/exceptions/hooks/use_exceptions_list.card/index.tsx
@@ -21,6 +21,12 @@ import { useListExceptionItems } from '../use_list_exception_items';
 import * as i18n from '../../translations';
 import { checkIfListCannotBeEdited } from '../../utils/list.utils';
 
+interface ExportListAction {
+  id: string;
+  listId: string;
+  namespaceType: NamespaceType;
+  includeExpiredExceptions: boolean;
+}
 interface ListAction {
   id: string;
   listId: string;
@@ -33,7 +39,12 @@ export const useExceptionsListCard = ({
   handleManageRules,
 }: {
   exceptionsList: ExceptionListInfo;
-  handleExport: ({ id, listId, namespaceType }: ListAction) => () => Promise<void>;
+  handleExport: ({
+    id,
+    listId,
+    namespaceType,
+    includeExpiredExceptions,
+  }: ExportListAction) => () => Promise<void>;
   handleDelete: ({ id, listId, namespaceType }: ListAction) => () => Promise<void>;
   handleManageRules: () => void;
 }) => {
@@ -41,6 +52,7 @@ export const useExceptionsListCard = ({
   const [exceptionToEdit, setExceptionToEdit] = useState<ExceptionListItemSchema>();
   const [showAddExceptionFlyout, setShowAddExceptionFlyout] = useState(false);
   const [showEditExceptionFlyout, setShowEditExceptionFlyout] = useState(false);
+  const [showExportModal, setShowExportModal] = useState(false);
 
   const {
     name: listName,
@@ -111,13 +123,7 @@ export const useExceptionsListCard = ({
         key: 'Export',
         icon: 'exportAction',
         label: i18n.EXPORT_EXCEPTION_LIST,
-        onClick: (e: React.MouseEvent<Element, MouseEvent>) => {
-          handleExport({
-            id: exceptionsList.id,
-            listId: exceptionsList.list_id,
-            namespaceType: exceptionsList.namespace_type,
-          })();
-        },
+        onClick: (e: React.MouseEvent<Element, MouseEvent>) => setShowExportModal(true),
       },
       {
         key: 'Delete',
@@ -147,7 +153,7 @@ export const useExceptionsListCard = ({
       exceptionsList.list_id,
       exceptionsList.namespace_type,
       handleDelete,
-      handleExport,
+      setShowExportModal,
       listCannotBeEdited,
       handleManageRules,
     ]
@@ -173,6 +179,26 @@ export const useExceptionsListCard = ({
     [fetchItems, setShowAddExceptionFlyout, setShowEditExceptionFlyout]
   );
 
+  const onExportListClick = useCallback(() => {
+    setShowExportModal(true);
+  }, [setShowExportModal]);
+
+  const handleCancelExportModal = () => {
+    setShowExportModal(false);
+  };
+
+  const handleConfirmExportModal = useCallback(
+    (includeExpiredExceptions: boolean): void => {
+      handleExport({
+        id: exceptionsList.id,
+        listId: exceptionsList.list_id,
+        namespaceType: exceptionsList.namespace_type,
+        includeExpiredExceptions,
+      })();
+    },
+    [handleExport, exceptionsList]
+  );
+
   // routes to x-pack/plugins/security_solution/public/exceptions/routes.tsx
   // details component is here: x-pack/plugins/security_solution/public/exceptions/pages/list_detail_view/index.tsx
   const { onClick: goToExceptionDetail } = useGetSecuritySolutionLinkProps()({
@@ -211,5 +237,9 @@ export const useExceptionsListCard = ({
     emptyViewerTitle,
     emptyViewerBody,
     emptyViewerButtonText,
+    showExportModal,
+    onExportListClick,
+    handleCancelExportModal,
+    handleConfirmExportModal,
   };
 };
diff --git a/x-pack/plugins/security_solution/public/exceptions/hooks/use_list_detail_view/index.ts b/x-pack/plugins/security_solution/public/exceptions/hooks/use_list_detail_view/index.ts
index 50db0ee551d72..949854d78ae65 100644
--- a/x-pack/plugins/security_solution/public/exceptions/hooks/use_list_detail_view/index.ts
+++ b/x-pack/plugins/security_solution/public/exceptions/hooks/use_list_detail_view/index.ts
@@ -163,28 +163,32 @@ export const useListDetailsView = (exceptionListId: string) => {
     },
     [exceptionListId, handleErrorStatus, http, list]
   );
-  const onExportList = useCallback(async () => {
-    try {
-      if (!list) return;
-      await exportExceptionList({
-        id: list.id,
-        listId: list.list_id,
-        namespaceType: list.namespace_type,
-        onError: (error: Error) => handleErrorStatus(error),
-        onSuccess: (blob) => {
-          setExportedList(blob);
-          toasts?.addSuccess(i18n.EXCEPTION_LIST_EXPORTED_SUCCESSFULLY(list.list_id));
-        },
-      });
-    } catch (error) {
-      handleErrorStatus(
-        error,
-        undefined,
-        i18n.EXCEPTION_EXPORT_ERROR,
-        i18n.EXCEPTION_EXPORT_ERROR_DESCRIPTION
-      );
-    }
-  }, [list, exportExceptionList, handleErrorStatus, toasts]);
+  const onExportList = useCallback(
+    async (includeExpiredExceptions: boolean) => {
+      try {
+        if (!list) return;
+        await exportExceptionList({
+          id: list.id,
+          listId: list.list_id,
+          includeExpiredExceptions,
+          namespaceType: list.namespace_type,
+          onError: (error: Error) => handleErrorStatus(error),
+          onSuccess: (blob) => {
+            setExportedList(blob);
+            toasts?.addSuccess(i18n.EXCEPTION_LIST_EXPORTED_SUCCESSFULLY(list.list_id));
+          },
+        });
+      } catch (error) {
+        handleErrorStatus(
+          error,
+          undefined,
+          i18n.EXCEPTION_EXPORT_ERROR,
+          i18n.EXCEPTION_EXPORT_ERROR_DESCRIPTION
+        );
+      }
+    },
+    [list, exportExceptionList, handleErrorStatus, toasts]
+  );
 
   // #region DeleteList
 
diff --git a/x-pack/plugins/security_solution/public/exceptions/pages/list_detail_view/index.tsx b/x-pack/plugins/security_solution/public/exceptions/pages/list_detail_view/index.tsx
index 4e7a85e616fbe..0be51bf851ba1 100644
--- a/x-pack/plugins/security_solution/public/exceptions/pages/list_detail_view/index.tsx
+++ b/x-pack/plugins/security_solution/public/exceptions/pages/list_detail_view/index.tsx
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import React, { useMemo } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
 import type { FC } from 'react';
 
 import {
@@ -24,6 +24,7 @@ import { AutoDownload } from '../../../common/components/auto_download/auto_down
 import { ListWithSearch, ManageRules, ListDetailsLinkAnchor } from '../../components';
 import { useListDetailsView } from '../../hooks';
 import * as i18n from '../../translations';
+import { ExportExceptionsListModal } from '../../components/export_exceptions_list_modal';
 
 export const ListsDetailViewComponent: FC = () => {
   const { detailName: exceptionListId } = useParams<{
@@ -59,6 +60,12 @@ export const ListsDetailViewComponent: FC = () => {
     handleReferenceDelete,
   } = useListDetailsView(exceptionListId);
 
+  const [showExportModal, setShowExportModal] = useState(false);
+
+  const onModalClose = useCallback(() => setShowExportModal(false), [setShowExportModal]);
+
+  const onModalOpen = useCallback(() => setShowExportModal(true), [setShowExportModal]);
+
   const detailsViewContent = useMemo(() => {
     if (viewerStatus === ViewerStatus.ERROR)
       return <EmptyViewerState isReadOnly={isReadOnly} viewerStatus={viewerStatus} />;
@@ -79,7 +86,7 @@ export const ListsDetailViewComponent: FC = () => {
           backOptions={headerBackOptions}
           securityLinkAnchorComponent={ListDetailsLinkAnchor}
           onEditListDetails={onEditListDetails}
-          onExportList={onExportList}
+          onExportList={onModalOpen}
           onDeleteList={handleDelete}
           onManageRules={onManageRules}
         />
@@ -107,6 +114,12 @@ export const ListsDetailViewComponent: FC = () => {
             onRuleSelectionChange={onRuleSelectionChange}
           />
         ) : null}
+        {showExportModal && (
+          <ExportExceptionsListModal
+            onModalConfirm={onExportList}
+            handleCloseModal={onModalClose}
+          />
+        )}
       </>
     );
   }, [
@@ -128,6 +141,7 @@ export const ListsDetailViewComponent: FC = () => {
     showManageButtonLoader,
     showManageRulesFlyout,
     showReferenceErrorModal,
+    showExportModal,
     viewerStatus,
     onCancelManageRules,
     onEditListDetails,
@@ -138,6 +152,8 @@ export const ListsDetailViewComponent: FC = () => {
     handleCloseReferenceErrorModal,
     handleDelete,
     handleReferenceDelete,
+    onModalClose,
+    onModalOpen,
   ]);
   return (
     <>
diff --git a/x-pack/plugins/security_solution/public/exceptions/pages/shared_lists/index.tsx b/x-pack/plugins/security_solution/public/exceptions/pages/shared_lists/index.tsx
index 8ca9f19f99485..57dc0249979d3 100644
--- a/x-pack/plugins/security_solution/public/exceptions/pages/shared_lists/index.tsx
+++ b/x-pack/plugins/security_solution/public/exceptions/pages/shared_lists/index.tsx
@@ -192,10 +192,21 @@ export const SharedLists = React.memo(() => {
   );
 
   const handleExport = useCallback(
-    ({ id, listId, namespaceType }: { id: string; listId: string; namespaceType: NamespaceType }) =>
+    ({
+        id,
+        listId,
+        namespaceType,
+        includeExpiredExceptions,
+      }: {
+        id: string;
+        listId: string;
+        namespaceType: NamespaceType;
+        includeExpiredExceptions: boolean;
+      }) =>
       async () => {
         await exportExceptionList({
           id,
+          includeExpiredExceptions,
           listId,
           namespaceType,
           onError: handleExportError,
diff --git a/x-pack/plugins/security_solution/public/exceptions/translations/shared_list.ts b/x-pack/plugins/security_solution/public/exceptions/translations/shared_list.ts
index 746b1df962c64..b024934fd0da2 100644
--- a/x-pack/plugins/security_solution/public/exceptions/translations/shared_list.ts
+++ b/x-pack/plugins/security_solution/public/exceptions/translations/shared_list.ts
@@ -358,3 +358,31 @@ export const SORT_BY_CREATE_AT = i18n.translate(
     defaultMessage: 'Created At',
   }
 );
+
+export const EXPORT_MODAL_CANCEL_BUTTON = i18n.translate(
+  'xpack.securitySolution.exceptions.exportModalCancelButton',
+  {
+    defaultMessage: 'Cancel',
+  }
+);
+
+export const EXPORT_MODAL_TITLE = i18n.translate(
+  'xpack.securitySolution.exceptions.exportModalTitle',
+  {
+    defaultMessage: 'Export exception list',
+  }
+);
+
+export const EXPORT_MODAL_INCLUDE_SWITCH_LABEL = i18n.translate(
+  'xpack.securitySolution.exceptions.exportModalIncludeSwitchLabel',
+  {
+    defaultMessage: 'Include expired exceptions',
+  }
+);
+
+export const EXPORT_MODAL_CONFIRM_BUTTON = i18n.translate(
+  'xpack.securitySolution.exceptions.exportModalConfirmButton',
+  {
+    defaultMessage: 'Export',
+  }
+);
diff --git a/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_event_filters.ts b/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_event_filters.ts
index 70be4f5e19870..d9bab942de2ae 100644
--- a/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_event_filters.ts
+++ b/x-pack/plugins/security_solution/server/fleet_integration/handlers/create_event_filters.ts
@@ -97,6 +97,7 @@ export const createNonInteractiveSessionEventFilter = (
       itemId: uuidv4(),
       meta: [],
       comments: [],
+      expireTime: undefined,
     });
   } catch (err) {
     logger.error(`Error creating Event Filter: ${wrapErrorIfNeeded(err)}`);
diff --git a/x-pack/plugins/security_solution/server/fleet_integration/handlers/remove_policy_from_artifacts.ts b/x-pack/plugins/security_solution/server/fleet_integration/handlers/remove_policy_from_artifacts.ts
index b423c47f6ca65..6d706c91ce121 100644
--- a/x-pack/plugins/security_solution/server/fleet_integration/handlers/remove_policy_from_artifacts.ts
+++ b/x-pack/plugins/security_solution/server/fleet_integration/handlers/remove_policy_from_artifacts.ts
@@ -57,6 +57,7 @@ export const removePolicyFromArtifacts = async (
         namespaceType: artifact.namespace_type,
         osTypes: artifact.os_types,
         tags: artifact.tags.filter((currentPolicy) => currentPolicy !== `policy:${policy.id}`),
+        expireTime: artifact.expire_time,
       }),
     {
       /** Number of concurrent executions till the end of the artifacts array */
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_exceptions/api/create_rule_exceptions/route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_exceptions/api/create_rule_exceptions/route.ts
index 6a658fe6e9dca..f2cf69d66fb5a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_exceptions/api/create_rule_exceptions/route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_exceptions/api/create_rule_exceptions/route.ts
@@ -190,6 +190,7 @@ export const createExceptionListItems = async ({
         comments: item.comments,
         description: item.description,
         entries: item.entries,
+        expireTime: item.expire_time,
         itemId: item.item_id,
         listId: defaultList.list_id,
         meta: item.meta,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_rule_exceptions.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_rule_exceptions.ts
index a1af3ee76e007..bf662d1f8abb9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_rule_exceptions.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_rule_exceptions.ts
@@ -94,6 +94,7 @@ export const createPromises = (
         id,
         listId,
         namespaceType,
+        includeExpiredExceptions: true, // TODO: pass this arg in via the rule export api
       });
     }
   );
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
index bc738c4f397a0..5be1d2f23df2d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
@@ -313,6 +313,7 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
             });
 
             const { filter: exceptionFilter, unprocessedExceptions } = await buildExceptionFilter({
+              startedAt,
               alias: null,
               excludeExceptions: true,
               chunkSize: 10,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts
index 7c3ded7fdc921..8aa51719a69bb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts
@@ -789,6 +789,7 @@ describe('create_signals', () => {
         alias: null,
         chunkSize: 1024,
         excludeExceptions: true,
+        startedAt: new Date(),
       });
       const request = buildEqlSearchRequest({
         query: 'process where true',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
index 3b2f2907cf2f0..4fb7bc2f14a87 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
@@ -233,6 +233,7 @@ describe('get_filter', () => {
 
     test('returns a query when given a list', async () => {
       const { filter } = await buildExceptionFilter({
+        startedAt: new Date(),
         listClient: getListClientMock(),
         lists: [getExceptionListItemSchemaMock()],
         alias: null,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.test.ts
index c6acfc6d66477..7413541892610 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.test.ts
@@ -511,6 +511,7 @@ describe('get_filter', () => {
 
       test('it should work with a list', async () => {
         const { filter } = await buildExceptionFilter({
+          startedAt: new Date(),
           listClient: getListClientMock(),
           lists: [getExceptionListItemSchemaMock()],
           alias: null,
@@ -595,6 +596,7 @@ describe('get_filter', () => {
 
     test('it should work with a list with multiple items', async () => {
       const { filter } = await buildExceptionFilter({
+        startedAt: new Date(),
         listClient: getListClientMock(),
         lists: [getExceptionListItemSchemaMock(), getExceptionListItemSchemaMock()],
         alias: null,
@@ -714,6 +716,7 @@ describe('get_filter', () => {
 
     test('it should work with an exception list that includes a nested type', async () => {
       const { filter } = await buildExceptionFilter({
+        startedAt: new Date(),
         listClient: getListClientMock(),
         lists: [getExceptionListItemSchemaMock()],
         alias: null,
@@ -819,6 +822,7 @@ describe('get_filter', () => {
     describe('when "excludeExceptions" is false', () => {
       test('it should work with a list', async () => {
         const { filter } = await buildExceptionFilter({
+          startedAt: new Date(),
           listClient: getListClientMock(),
           lists: [getExceptionListItemSchemaMock()],
           alias: null,
@@ -901,6 +905,7 @@ describe('get_filter', () => {
 
       test('it should work with a list with multiple items', async () => {
         const { filter } = await buildExceptionFilter({
+          startedAt: new Date(),
           listClient: getListClientMock(),
           lists: [getExceptionListItemSchemaMock(), getExceptionListItemSchemaMock()],
           alias: null,
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts
index efacbb687b5f2..0b457365d4a8a 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts
@@ -34,7 +34,10 @@ import {
   ALERT_ORIGINAL_EVENT,
 } from '@kbn/security-solution-plugin/common/field_maps/field_names';
 import { DETECTION_ENGINE_SIGNALS_STATUS_URL } from '@kbn/security-solution-plugin/common/constants';
+import { deleteAllExceptions } from '../../../lists_api_integration/utils';
 import {
+  createExceptionList,
+  createExceptionListItem,
   createRule,
   deleteAllAlerts,
   deleteSignalsIndex,
@@ -1431,5 +1434,96 @@ export default ({ getService }: FtrProviderContext) => {
         });
       });
     });
+
+    describe('with exceptions', async () => {
+      afterEach(async () => {
+        await deleteAllExceptions(supertest, log);
+      });
+      it('should correctly evaluate exceptions with expiration time in the past', async () => {
+        // create an exception list container of type "detection"
+        const {
+          id,
+          list_id: listId,
+          namespace_type: namespaceType,
+          type,
+        } = await createExceptionList(supertest, log, {
+          description: 'description',
+          list_id: '123',
+          name: 'test list',
+          type: 'detection',
+        });
+
+        await createExceptionListItem(supertest, log, {
+          description: 'endpoint description',
+          entries: [
+            {
+              field: 'host.name',
+              operator: 'included',
+              type: 'match',
+              value: 'suricata-sensor-london',
+            },
+          ],
+          list_id: listId,
+          name: 'endpoint_list',
+          os_types: [],
+          type: 'simple',
+          expire_time: new Date(Date.now() - 1000000).toISOString(),
+        });
+
+        const rule: QueryRuleCreateProps = {
+          ...getRuleForSignalTesting(['auditbeat-*']),
+          query: `_id:${ID} or _id:GBbXBmkBR346wHgn5_eR or _id:x10zJ2oE9v5HJNSHhyxi`,
+          exceptions_list: [{ id, list_id: listId, type, namespace_type: namespaceType }],
+        };
+
+        const { previewId } = await previewRule({ supertest, rule });
+        const previewAlerts = await getPreviewAlerts({ es, previewId });
+
+        expect(previewAlerts.length).equal(2);
+      });
+
+      it('should correctly evaluate exceptions with expiration time in the future', async () => {
+        // create an exception list container of type "detection"
+        const {
+          id,
+          list_id: listId,
+          namespace_type: namespaceType,
+          type,
+        } = await createExceptionList(supertest, log, {
+          description: 'description',
+          list_id: '123',
+          name: 'test list',
+          type: 'detection',
+        });
+
+        await createExceptionListItem(supertest, log, {
+          description: 'endpoint description',
+          entries: [
+            {
+              field: 'host.name',
+              operator: 'included',
+              type: 'match',
+              value: 'suricata-sensor-london',
+            },
+          ],
+          list_id: listId,
+          name: 'endpoint_list',
+          os_types: [],
+          type: 'simple',
+          expire_time: new Date(Date.now() + 1000000).toISOString(),
+        });
+
+        const rule: QueryRuleCreateProps = {
+          ...getRuleForSignalTesting(['auditbeat-*']),
+          query: `_id:${ID} or _id:GBbXBmkBR346wHgn5_eR or _id:x10zJ2oE9v5HJNSHhyxi`,
+          exceptions_list: [{ id, list_id: listId, type, namespace_type: namespaceType }],
+        };
+
+        const { previewId } = await previewRule({ supertest, rule });
+        const previewAlerts = await getPreviewAlerts({ es, previewId });
+
+        expect(previewAlerts.length).equal(1);
+      });
+    });
   });
 };
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_list_items.ts
index fd8039f4005be..cc916862a6313 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_list_items.ts
@@ -112,6 +112,44 @@ export default ({ getService }: FtrProviderContext) => {
           status_code: 409,
         });
       });
+
+      it('should create an exception list item if we pass a Date string for expire_time', async () => {
+        await supertest
+          .post(EXCEPTION_LIST_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListMinimalSchemaMock())
+          .expect(200);
+
+        const datetime = new Date().toISOString();
+        const { body } = await supertest
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .set('kbn-xsrf', 'true')
+          .send({
+            ...getCreateExceptionListItemMinimalSchemaMock(),
+            expire_time: datetime,
+          })
+          .expect(200);
+
+        const bodyToCompare = removeExceptionListItemServerGeneratedProperties(body);
+        expect(bodyToCompare).to.eql({
+          ...getExceptionListItemResponseMockWithoutAutoGeneratedValues(),
+          expire_time: datetime,
+        });
+      });
+
+      it('should cause an error if we attempt to pass a non Date string for expire_time', async () => {
+        await supertest
+          .post(EXCEPTION_LIST_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListMinimalSchemaMock())
+          .expect(200);
+
+        await supertest
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .set('kbn-xsrf', 'true')
+          .send({ ...getCreateExceptionListItemMinimalSchemaMock(), expire_time: 'abc' })
+          .expect(400);
+      });
     });
   });
 };
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts
index b3f8e7c0697fe..bfde054eb8f1e 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts
@@ -47,7 +47,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
         await supertest
           .post(
-            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single`
+            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single&include_expired_exceptions=true`
           )
           .set('kbn-xsrf', 'true')
           .expect('Content-Disposition', `attachment; filename="${body.list_id}"`)
@@ -71,7 +71,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
         const { body: exportBody } = await supertest
           .post(
-            `${EXCEPTION_LIST_URL}/_export?id=not_exist&list_id=not_exist&namespace_type=single`
+            `${EXCEPTION_LIST_URL}/_export?id=not_exist&list_id=not_exist&namespace_type=single&include_expired_exceptions=true`
           )
           .set('kbn-xsrf', 'true')
           .expect(400);
@@ -97,7 +97,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
         const { body: exportResult } = await supertest
           .post(
-            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single`
+            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single&include_expired_exceptions=true`
           )
           .set('kbn-xsrf', 'true')
           .expect(200)
@@ -140,7 +140,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
         const { body: exportResult } = await supertest
           .post(
-            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single`
+            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single&include_expired_exceptions=true`
           )
           .set('kbn-xsrf', 'true')
           .expect(200)
@@ -150,6 +150,42 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(bodyString.includes('some-list-item-id-2')).to.be(true);
         expect(bodyString.includes('some-list-item-id')).to.be(true);
       });
+
+      it('should export a single list with no expired exception items', async () => {
+        const { body } = await supertest
+          .post(EXCEPTION_LIST_URL)
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListMinimalSchemaMock())
+          .expect(200);
+
+        const { body: itemBody } = await supertest
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .set('kbn-xsrf', 'true')
+          .send({
+            ...getCreateExceptionListItemMinimalSchemaMock(),
+            expire_time: new Date().toISOString(),
+          })
+          .expect(200);
+
+        const { body: exportResult } = await supertest
+          .post(
+            `${EXCEPTION_LIST_URL}/_export?id=${body.id}&list_id=${body.list_id}&namespace_type=single&include_expired_exceptions=false`
+          )
+          .set('kbn-xsrf', 'true')
+          .expect(200)
+          .parse(binaryToString);
+
+        const exportedItemsToArray = exportResult.toString().split('\n');
+        const list = JSON.parse(exportedItemsToArray[0]);
+        const item = JSON.parse(exportedItemsToArray[1]);
+
+        expect(removeExceptionListServerGeneratedProperties(list)).to.eql(
+          removeExceptionListServerGeneratedProperties(body)
+        );
+        expect(removeExceptionListItemServerGeneratedProperties(item)).to.not.contain(
+          removeExceptionListItemServerGeneratedProperties(itemBody)
+        );
+      });
     });
   });
 };
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/blocklists.ts b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/blocklists.ts
index cb43aa5db89a4..1c081b2d734f1 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/blocklists.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/blocklists.ts
@@ -142,7 +142,7 @@ export default function ({ getService }: FtrProviderContext) {
           method: 'post',
           info: 'list export',
           get path() {
-            return `${EXCEPTION_LIST_URL}/_export?list_id=${blocklistData.artifact.list_id}&namespace_type=${blocklistData.artifact.namespace_type}&id=${blocklistData.artifact.id}`;
+            return `${EXCEPTION_LIST_URL}/_export?list_id=${blocklistData.artifact.list_id}&namespace_type=${blocklistData.artifact.namespace_type}&id=${blocklistData.artifact.id}&include_expired_exceptions=true`;
           },
           getBody: () => undefined,
         },
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/event_filters.ts b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/event_filters.ts
index 2bcfdb5baa934..b425a10b75102 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/event_filters.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/event_filters.ts
@@ -140,7 +140,7 @@ export default function ({ getService }: FtrProviderContext) {
         method: 'post',
         info: 'list export',
         get path() {
-          return `${EXCEPTION_LIST_URL}/_export?list_id=${eventFilterData.artifact.list_id}&namespace_type=${eventFilterData.artifact.namespace_type}&id=${eventFilterData.artifact.id}`;
+          return `${EXCEPTION_LIST_URL}/_export?list_id=${eventFilterData.artifact.list_id}&namespace_type=${eventFilterData.artifact.namespace_type}&id=${eventFilterData.artifact.id}&include_expired_exceptions=true`;
         },
         getBody: () => undefined,
       },
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/host_isolation_exceptions.ts b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/host_isolation_exceptions.ts
index 08f0d33faca4c..250f2add8d48c 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/host_isolation_exceptions.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/host_isolation_exceptions.ts
@@ -130,7 +130,7 @@ export default function ({ getService }: FtrProviderContext) {
         method: 'post',
         info: 'list export',
         get path() {
-          return `${EXCEPTION_LIST_URL}/_export?list_id=${hostIsolationExceptionData.artifact.list_id}&namespace_type=${hostIsolationExceptionData.artifact.namespace_type}&id=${hostIsolationExceptionData.artifact.id}`;
+          return `${EXCEPTION_LIST_URL}/_export?list_id=${hostIsolationExceptionData.artifact.list_id}&namespace_type=${hostIsolationExceptionData.artifact.namespace_type}&id=${hostIsolationExceptionData.artifact.id}&include_expired_exceptions=true`;
         },
         getBody: () => undefined,
       },
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/trusted_apps.ts b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/trusted_apps.ts
index bd1f4c1b519af..dcc10b178d5e5 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/trusted_apps.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/trusted_apps.ts
@@ -141,7 +141,7 @@ export default function ({ getService }: FtrProviderContext) {
           method: 'post',
           info: 'list export',
           get path() {
-            return `${EXCEPTION_LIST_URL}/_export?list_id=${trustedAppData.artifact.list_id}&namespace_type=${trustedAppData.artifact.namespace_type}&id=${trustedAppData.artifact.id}`;
+            return `${EXCEPTION_LIST_URL}/_export?list_id=${trustedAppData.artifact.list_id}&namespace_type=${trustedAppData.artifact.namespace_type}&id=${trustedAppData.artifact.id}&include_expired_exceptions=true`;
           },
           getBody: () => undefined,
         },

From d223f427a429bd59df9e815563eaad7118a330c8 Mon Sep 17 00:00:00 2001
From: Rodney Norris <rodney.norris@elastic.co>
Date: Tue, 7 Feb 2023 15:21:05 -0600
Subject: [PATCH 097/134] [enterprise search]: disallow removing last index
 from engine (#150464)

## Summary

Removing the option to remove the last index from an engine. We don't
allow creating engines with no indices, so allowing a user to remove all
indices from an engine doesn't make sense either.

### Screenshots
Engine with 1 index

![image](https://user-images.githubusercontent.com/1972968/217327460-62ff5b9c-3802-4997-b47c-5ddf52cdc300.png)
Engines with >1 index (has remove index action)

![image](https://user-images.githubusercontent.com/1972968/217327536-67e24d14-c6e2-48c6-be95-8ce9d5316b7a.png)
---
 .../components/engine/engine_indices.tsx      | 59 +++++++++----------
 1 file changed, 29 insertions(+), 30 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
index da664b3d97490..745a6ed5e131e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
@@ -10,6 +10,7 @@ import React, { useState } from 'react';
 import { useActions, useValues } from 'kea';
 
 import {
+  EuiTableActionsColumnType,
   EuiBasicTableColumn,
   EuiButton,
   EuiConfirmModal,
@@ -52,6 +53,33 @@ export const EngineIndices: React.FC = () => {
   if (!engineData) return null;
   const { indices } = engineData;
 
+  const removeIndexAction: EuiTableActionsColumnType<EnterpriseSearchEngineIndex>['actions'][0] = {
+    color: 'danger',
+    'data-test-subj': 'engine-remove-index-btn',
+    description: i18n.translate(
+      'xpack.enterpriseSearch.content.engine.indices.actions.removeIndex.title',
+      {
+        defaultMessage: 'Remove this index from engine',
+      }
+    ),
+    icon: 'minusInCircle',
+    isPrimary: false,
+    name: (index: EnterpriseSearchEngineIndex) =>
+      i18n.translate('xpack.enterpriseSearch.content.engine.indices.actions.removeIndex.caption', {
+        defaultMessage: 'Remove index {indexName}',
+        values: {
+          indexName: index.name,
+        },
+      }),
+    onClick: (index: EnterpriseSearchEngineIndex) => {
+      setConfirmRemoveIndex(index.name);
+      sendEnterpriseSearchTelemetry({
+        action: 'clicked',
+        metric: 'entSearchContent-engines-indices-removeIndex',
+      });
+    },
+    type: 'icon',
+  };
   const columns: Array<EuiBasicTableColumn<EnterpriseSearchEngineIndex>> = [
     {
       field: 'name',
@@ -138,36 +166,7 @@ export const EngineIndices: React.FC = () => {
             ),
           type: 'icon',
         },
-        {
-          color: 'danger',
-          'data-test-subj': 'engine-remove-index-btn',
-          description: i18n.translate(
-            'xpack.enterpriseSearch.content.engine.indices.actions.removeIndex.title',
-            {
-              defaultMessage: 'Remove this index from engine',
-            }
-          ),
-          icon: 'minusInCircle',
-          isPrimary: false,
-          name: (index) =>
-            i18n.translate(
-              'xpack.enterpriseSearch.content.engine.indices.actions.removeIndex.caption',
-              {
-                defaultMessage: 'Remove index {indexName}',
-                values: {
-                  indexName: index.name,
-                },
-              }
-            ),
-          onClick: (index) => {
-            setConfirmRemoveIndex(index.name);
-            sendEnterpriseSearchTelemetry({
-              action: 'clicked',
-              metric: 'entSearchContent-engines-indices-removeIndex',
-            });
-          },
-          type: 'icon',
-        },
+        ...(indices.length > 1 ? [removeIndexAction] : []),
       ],
       name: i18n.translate('xpack.enterpriseSearch.content.engine.indices.actions.columnTitle', {
         defaultMessage: 'Actions',

From 0f2e190aa7589a92f65474549c589eb5f62a9f70 Mon Sep 17 00:00:00 2001
From: Philippe Oberti <philippe.oberti@elastic.co>
Date: Tue, 7 Feb 2023 15:21:21 -0600
Subject: [PATCH 098/134] [TIP] fix broken cypress tests after change made in
 cases plugin (#150479)

## Summary

This
[commit](https://github.com/elastic/kibana/commit/c3ea5e5b3a2f0e13e743eea059404c81a07576c1)
updated some of the `data-test-subj` values in the Cases plugin. The
Threat Intelligence plugin was using a couple of these and now the
Cypress tests are failing.
This PR fixes that!
---
 .../plugins/threat_intelligence/cypress/screens/indicators.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/threat_intelligence/cypress/screens/indicators.ts b/x-pack/plugins/threat_intelligence/cypress/screens/indicators.ts
index 764d6348a07a8..31134d6691f48 100644
--- a/x-pack/plugins/threat_intelligence/cypress/screens/indicators.ts
+++ b/x-pack/plugins/threat_intelligence/cypress/screens/indicators.ts
@@ -191,9 +191,9 @@ export const CASE_COMMENT_EXTERNAL_REFERENCE = `[data-test-subj="comment-externa
 
 export const CASE_ACTION_WRAPPER = `[data-test-subj="case-action-bar-wrapper"]`;
 
-export const CASE_ELLIPSE_BUTTON = `[data-test-subj="property-actions-ellipses"]`;
+export const CASE_ELLIPSE_BUTTON = `[data-test-subj="property-actions-case-ellipses"]`;
 
-export const CASE_ELLIPSE_DELETE_CASE_OPTION = `[data-test-subj="property-actions-trash"]`;
+export const CASE_ELLIPSE_DELETE_CASE_OPTION = `[data-test-subj="property-actions-case-trash"]`;
 
 export const CASE_ELLIPSE_DELETE_CASE_CONFIRMATION_BUTTON = `[data-test-subj="confirmModalConfirmButton"]`;
 

From 8c01d182a4836be9a90ad69ff2ac6532a5ca426f Mon Sep 17 00:00:00 2001
From: Kevin Logan <56395104+kevinlog@users.noreply.github.com>
Date: Tue, 7 Feb 2023 16:31:21 -0500
Subject: [PATCH 099/134] Uncomment tests (#150481)

## Summary

Uncomment tests


### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 x-pack/test/api_integration/apis/index.ts | 58 +++++++++++------------
 1 file changed, 29 insertions(+), 29 deletions(-)

diff --git a/x-pack/test/api_integration/apis/index.ts b/x-pack/test/api_integration/apis/index.ts
index 3f2b5febb12ef..0278c439c5995 100644
--- a/x-pack/test/api_integration/apis/index.ts
+++ b/x-pack/test/api_integration/apis/index.ts
@@ -9,35 +9,35 @@ import { FtrProviderContext } from '../ftr_provider_context';
 
 export default function ({ loadTestFile }: FtrProviderContext) {
   describe('apis', function () {
-    // loadTestFile(require.resolve('./search'));
-    // loadTestFile(require.resolve('./es'));
+    loadTestFile(require.resolve('./search'));
+    loadTestFile(require.resolve('./es'));
     loadTestFile(require.resolve('./security'));
-    // loadTestFile(require.resolve('./spaces'));
-    // loadTestFile(require.resolve('./monitoring'));
-    // loadTestFile(require.resolve('./features'));
-    // loadTestFile(require.resolve('./telemetry'));
-    // loadTestFile(require.resolve('./logstash'));
-    // loadTestFile(require.resolve('./kibana'));
-    // loadTestFile(require.resolve('./metrics_ui'));
-    // loadTestFile(require.resolve('./console'));
-    // loadTestFile(require.resolve('./management'));
-    // loadTestFile(require.resolve('./uptime'));
-    // loadTestFile(require.resolve('./synthetics'));
-    // loadTestFile(require.resolve('./maps'));
-    // loadTestFile(require.resolve('./security_solution'));
-    // loadTestFile(require.resolve('./transform'));
-    // loadTestFile(require.resolve('./lists'));
-    // loadTestFile(require.resolve('./upgrade_assistant'));
-    // loadTestFile(require.resolve('./searchprofiler'));
-    // loadTestFile(require.resolve('./painless_lab'));
-    // loadTestFile(require.resolve('./file_upload'));
-    // loadTestFile(require.resolve('./aiops'));
-    // loadTestFile(require.resolve('./ml'));
-    // loadTestFile(require.resolve('./watcher'));
-    // loadTestFile(require.resolve('./logs_ui'));
-    // loadTestFile(require.resolve('./osquery'));
-    // loadTestFile(require.resolve('./cases'));
-    // loadTestFile(require.resolve('./monitoring_collection'));
-    // loadTestFile(require.resolve('./cloud_security_posture'));
+    loadTestFile(require.resolve('./spaces'));
+    loadTestFile(require.resolve('./monitoring'));
+    loadTestFile(require.resolve('./features'));
+    loadTestFile(require.resolve('./telemetry'));
+    loadTestFile(require.resolve('./logstash'));
+    loadTestFile(require.resolve('./kibana'));
+    loadTestFile(require.resolve('./metrics_ui'));
+    loadTestFile(require.resolve('./console'));
+    loadTestFile(require.resolve('./management'));
+    loadTestFile(require.resolve('./uptime'));
+    loadTestFile(require.resolve('./synthetics'));
+    loadTestFile(require.resolve('./maps'));
+    loadTestFile(require.resolve('./security_solution'));
+    loadTestFile(require.resolve('./transform'));
+    loadTestFile(require.resolve('./lists'));
+    loadTestFile(require.resolve('./upgrade_assistant'));
+    loadTestFile(require.resolve('./searchprofiler'));
+    loadTestFile(require.resolve('./painless_lab'));
+    loadTestFile(require.resolve('./file_upload'));
+    loadTestFile(require.resolve('./aiops'));
+    loadTestFile(require.resolve('./ml'));
+    loadTestFile(require.resolve('./watcher'));
+    loadTestFile(require.resolve('./logs_ui'));
+    loadTestFile(require.resolve('./osquery'));
+    loadTestFile(require.resolve('./cases'));
+    loadTestFile(require.resolve('./monitoring_collection'));
+    loadTestFile(require.resolve('./cloud_security_posture'));
   });
 }

From 95fc20b92e26e1b625e9d86a8e720ca2d9d80ca8 Mon Sep 17 00:00:00 2001
From: Dominique Clarke <dominique.clarke@elastic.co>
Date: Tue, 7 Feb 2023 17:00:21 -0500
Subject: [PATCH 100/134] [Synthetics] errors - adjust empty state content
 (#150455)

## Summary

We noticed the text for the empty state for monitor errors looked off.
We could use a suggestion for improving it. It used to say "Keep calm
and carry on."

<img width="1434" alt="Screen Shot 2023-02-07 at 12 00 21 PM"
src="https://user-images.githubusercontent.com/11356435/217312594-05efd752-9eec-49e3-a890-adebdebb5f2a.png">

---------

Co-authored-by: florent-leborgne <florent.leborgne@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../monitor_details/monitor_errors/monitor_errors.tsx          | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/monitor_errors.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/monitor_errors.tsx
index 527033f16c7ce..ce367ef72ba3d 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/monitor_errors.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/monitor_errors.tsx
@@ -80,7 +80,8 @@ const EmptyErrors = () => {
 };
 
 const KEEP_CALM = i18n.translate('xpack.synthetics.errors.keepCalm', {
-  defaultMessage: 'Keep calm and carry on.',
+  defaultMessage:
+    'This monitor ran successfully during the selected period. Increase the time range to check for older errors.',
 });
 
 const NO_ERRORS_FOUND = i18n.translate('xpack.synthetics.errors.noErrorsFound', {

From 447cbfdf6d733c39bc0d2e1f63a21a42ab763f0f Mon Sep 17 00:00:00 2001
From: Xavier Mouligneau <xavier.mouligneau@elastic.co>
Date: Tue, 7 Feb 2023 18:31:24 -0500
Subject: [PATCH 101/134] [RAM] Allow alert table to show new alert status on
 apm (#150500)

## Summary

Add new alert status on APM alerts table

Before:
<img width="1318" alt="image"
src="https://user-images.githubusercontent.com/189600/217375931-167777fb-b71c-4bfb-9c34-cbebb3d69a89.png">


After:
<img width="1310" alt="image"
src="https://user-images.githubusercontent.com/189600/217375668-6e9ee5af-1163-4f3e-aded-b83ac12b0b8f.png">
---
 .../plugins/apm/public/components/app/alerts_overview/index.tsx  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/x-pack/plugins/apm/public/components/app/alerts_overview/index.tsx b/x-pack/plugins/apm/public/components/app/alerts_overview/index.tsx
index 898762c8350fa..541a4619300f3 100644
--- a/x-pack/plugins/apm/public/components/app/alerts_overview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/alerts_overview/index.tsx
@@ -103,6 +103,7 @@ export function AlertsOverview() {
               configurationId={AlertConsumers.OBSERVABILITY}
               featureIds={[AlertConsumers.APM]}
               query={esQuery}
+              showAlertStatusWithFlapping
               showExpandToDetails={false}
             />
           )}

From a2c5bf82732f10263ceed9eedd4efe3fe5cdfb9b Mon Sep 17 00:00:00 2001
From: Matthew Kime <matt@mattki.me>
Date: Tue, 7 Feb 2023 21:05:59 -0600
Subject: [PATCH 102/134] [data view mgmt] fix field refresh when index pattern
 is changed. (#150403)

Data view management now updates the field list of an edited data view
upon save.

Closes: https://github.com/elastic/kibana/issues/150248
---
 .../edit_index_pattern/edit_index_pattern.tsx |  5 ++-
 .../table/__snapshots__/table.test.tsx.snap   | 16 +++++++---
 .../components/table/table.tsx                |  2 +-
 .../_index_pattern_create_delete.ts           | 31 +++++++++++++++++++
 4 files changed, 48 insertions(+), 6 deletions(-)

diff --git a/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx b/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx
index 811222ef71e88..de421c0b8945e 100644
--- a/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx
+++ b/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx
@@ -128,7 +128,10 @@ export const EditIndexPattern = withRouter(
     const isRollup = new URLSearchParams(useLocation().search).get('type') === 'rollup';
     const displayIndexPatternEditor = showEditDialog ? (
       <IndexPatternEditor
-        onSave={() => setShowEditDialog(false)}
+        onSave={() => {
+          setFields(indexPattern.getNonScriptedFields());
+          setShowEditDialog(false);
+        }}
         onCancel={() => setShowEditDialog(false)}
         defaultTypeIsRollup={isRollup}
         editData={indexPattern}
diff --git a/src/plugins/data_view_management/public/components/edit_index_pattern/indexed_fields_table/components/table/__snapshots__/table.test.tsx.snap b/src/plugins/data_view_management/public/components/edit_index_pattern/indexed_fields_table/components/table/__snapshots__/table.test.tsx.snap
index ac6ab1172a535..65c124c6676fa 100644
--- a/src/plugins/data_view_management/public/components/edit_index_pattern/indexed_fields_table/components/table/__snapshots__/table.test.tsx.snap
+++ b/src/plugins/data_view_management/public/components/edit_index_pattern/indexed_fields_table/components/table/__snapshots__/table.test.tsx.snap
@@ -82,13 +82,17 @@ exports[`Table render conflict summary modal  1`] = `
 `;
 
 exports[`Table render name 1`] = `
-<span>
+<span
+  data-test-subj="field-name-customer"
+>
   customer
 </span>
 `;
 
 exports[`Table render name 2`] = `
-<span>
+<span
+  data-test-subj="field-name-customer"
+>
   customer
   <span>
      
@@ -126,7 +130,9 @@ exports[`Table should render mixed, non-conflicting type 1`] = `
 `;
 
 exports[`Table should render normal field name 1`] = `
-<span>
+<span
+  data-test-subj="field-name-Elastic"
+>
   Elastic
 </span>
 `;
@@ -324,7 +330,9 @@ exports[`Table should render the boolean template (true) 1`] = `
 `;
 
 exports[`Table should render timestamp field name 1`] = `
-<span>
+<span
+  data-test-subj="field-name-timestamp"
+>
   timestamp
   <span>
      
diff --git a/src/plugins/data_view_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.tsx b/src/plugins/data_view_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.tsx
index a7b6cf621bb64..b7ed701b31c68 100644
--- a/src/plugins/data_view_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.tsx
+++ b/src/plugins/data_view_management/public/components/edit_index_pattern/indexed_fields_table/components/table/table.tsx
@@ -220,7 +220,7 @@ const getItems = (conflictDescriptions: IndexedFieldItem['conflictDescriptions']
 };
 
 export const renderFieldName = (field: IndexedFieldItem, timeFieldName?: string) => (
-  <span>
+  <span data-test-subj={`field-name-${field.name}`}>
     {field.name}
     {field.info && field.info.length ? (
       <span>
diff --git a/test/functional/apps/management/_index_pattern_create_delete.ts b/test/functional/apps/management/_index_pattern_create_delete.ts
index 8447610d60aa8..f89013eac43fa 100644
--- a/test/functional/apps/management/_index_pattern_create_delete.ts
+++ b/test/functional/apps/management/_index_pattern_create_delete.ts
@@ -22,11 +22,20 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   describe('creating and deleting default index', function describeIndexTests() {
     before(async function () {
       await esArchiver.emptyKibanaIndex();
+      await esArchiver.loadIfNeeded(
+        'test/functional/fixtures/es_archiver/kibana_sample_data_flights_index_pattern'
+      );
       await kibanaServer.uiSettings.replace({});
       await PageObjects.settings.navigateTo();
       await PageObjects.settings.clickKibanaIndexPatterns();
     });
 
+    after(async function () {
+      await esArchiver.unload(
+        'test/functional/fixtures/es_archiver/kibana_sample_data_flights_index_pattern'
+      );
+    });
+
     describe('can open and close editor', function () {
       it('without creating index pattern', async function () {
         await PageObjects.settings.clickKibanaIndexPatterns();
@@ -157,6 +166,28 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
     });
 
+    describe('index pattern edit', function () {
+      it('should update field list', async function () {
+        await PageObjects.settings.editIndexPattern(
+          'kibana_sample_data_flights',
+          'timestamp',
+          undefined,
+          true
+        );
+
+        await retry.try(async () => {
+          // verify initial field list
+          expect(await testSubjects.exists('field-name-AvgTicketPrice')).to.be(true);
+        });
+
+        await PageObjects.settings.editIndexPattern('logstash-*', '@timestamp', undefined, true);
+        await retry.try(async () => {
+          // verify updated field list
+          expect(await testSubjects.exists('field-name-agent')).to.be(true);
+        });
+      });
+    });
+
     describe('index pattern deletion', function indexDelete() {
       before(function () {
         const expectedAlertText = 'Delete data view';

From 01f07bccf1c2e68663c157b31f70ff11605bd6e4 Mon Sep 17 00:00:00 2001
From: Xavier Mouligneau <xavier.mouligneau@elastic.co>
Date: Tue, 7 Feb 2023 22:52:26 -0500
Subject: [PATCH 103/134] [RAM] Bring flapping status and settings in o11y
 (#150483)

## Summary

Bring shareable components to set the flapping configuration on rule
management in o11y and update the status alert around flapping.

<img width="1697" alt="image"
src="https://user-images.githubusercontent.com/189600/217358288-57eb93ef-94e2-4576-9e99-baee8c2ef2b2.png">

<img width="1696" alt="Screenshot 2023-02-07 at 3 15 01 PM"
src="https://user-images.githubusercontent.com/189600/217356846-441eaf51-f6c9-4afd-9f6b-9c8f5a3531bd.png">


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .github/CODEOWNERS                            |  1 +
 .i18nrc.json                                  |  1 +
 package.json                                  |  1 +
 packages/kbn-alerts-ui-shared/README.mdx      | 14 +++
 packages/kbn-alerts-ui-shared/index.ts        | 10 ++
 packages/kbn-alerts-ui-shared/jest.config.js  | 13 +++
 packages/kbn-alerts-ui-shared/kibana.jsonc    |  5 +
 packages/kbn-alerts-ui-shared/package.json    |  6 ++
 .../index.test.tsx                            |  7 +-
 .../alert_lifecycle_status_badge/index.tsx    | 92 +++++++++++++++++++
 packages/kbn-alerts-ui-shared/tsconfig.json   | 22 +++++
 tsconfig.base.json                            |  2 +
 ...bservability_public_plugins_start.mock.tsx |  3 +
 .../alerts_flyout/alerts_flyout_body.tsx      |  6 +-
 .../public/pages/rules/index.tsx              |  7 +-
 x-pack/plugins/observability/tsconfig.json    |  1 +
 .../alert_lifecycle_status_badge.tsx          | 90 +-----------------
 .../plugins/triggers_actions_ui/tsconfig.json |  1 +
 yarn.lock                                     |  4 +
 19 files changed, 193 insertions(+), 93 deletions(-)
 create mode 100644 packages/kbn-alerts-ui-shared/README.mdx
 create mode 100644 packages/kbn-alerts-ui-shared/index.ts
 create mode 100644 packages/kbn-alerts-ui-shared/jest.config.js
 create mode 100644 packages/kbn-alerts-ui-shared/kibana.jsonc
 create mode 100644 packages/kbn-alerts-ui-shared/package.json
 rename x-pack/plugins/triggers_actions_ui/public/application/components/alert_lifecycle_status_badge.test.tsx => packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.test.tsx (88%)
 create mode 100644 packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx
 create mode 100644 packages/kbn-alerts-ui-shared/tsconfig.json

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index c6e2a9202f804..547c8f5d33edd 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -882,6 +882,7 @@ packages/home/sample_data_tab @elastic/appex-sharedux
 packages/home/sample_data_types @elastic/appex-sharedux
 packages/kbn-ace @elastic/platform-deployment-management
 packages/kbn-alerts @elastic/security-solution
+packages/kbn-alerts-ui-shared @elastic/response-ops
 packages/kbn-ambient-common-types @elastic/kibana-operations
 packages/kbn-ambient-ftr-types @elastic/kibana-operations
 packages/kbn-ambient-storybook-types @elastic/kibana-operations
diff --git a/.i18nrc.json b/.i18nrc.json
index a4bb5c900fa57..d8a6b4689f78e 100644
--- a/.i18nrc.json
+++ b/.i18nrc.json
@@ -2,6 +2,7 @@
   "paths": {
     "advancedSettings": "src/plugins/advanced_settings",
     "alerts": "packages/kbn-alerts/src",
+    "alertsUIShared": "packages/kbn-alerts-ui-shared/src",
     "apmOss": "src/plugins/apm_oss",
     "autocomplete": "packages/kbn-securitysolution-autocomplete/src",
     "bfetch": "src/plugins/bfetch",
diff --git a/package.json b/package.json
index 04f0e1035325b..e10addc6cec12 100644
--- a/package.json
+++ b/package.json
@@ -133,6 +133,7 @@
     "@kbn/aiops-components": "link:x-pack/packages/ml/aiops_components",
     "@kbn/aiops-utils": "link:x-pack/packages/ml/aiops_utils",
     "@kbn/alerts": "link:packages/kbn-alerts",
+    "@kbn/alerts-ui-shared": "link:packages/kbn-alerts-ui-shared",
     "@kbn/analytics": "link:packages/kbn-analytics",
     "@kbn/analytics-client": "link:packages/analytics/client",
     "@kbn/analytics-shippers-elastic-v3-browser": "link:packages/analytics/shippers/elastic_v3/browser",
diff --git a/packages/kbn-alerts-ui-shared/README.mdx b/packages/kbn-alerts-ui-shared/README.mdx
new file mode 100644
index 0000000000000..8903565a90751
--- /dev/null
+++ b/packages/kbn-alerts-ui-shared/README.mdx
@@ -0,0 +1,14 @@
+# @kbn/alerts-ui-shared
+
+---
+id: AlertsUIShared/Components/AlertLifecycleStatusBadge
+slug: /kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx
+title: Alert Lifecycle Status
+description: A component to show the status of an alert
+tags: ['kbn-alerts-ui-shared', 'component']
+date: 2023-02-07
+---
+
+## Description
+
+A component to show the status of an alert
\ No newline at end of file
diff --git a/packages/kbn-alerts-ui-shared/index.ts b/packages/kbn-alerts-ui-shared/index.ts
new file mode 100644
index 0000000000000..431c6803c36d4
--- /dev/null
+++ b/packages/kbn-alerts-ui-shared/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { AlertLifecycleStatusBadge } from './src/alert_lifecycle_status_badge';
+export type { AlertLifecycleStatusBadgeProps } from './src/alert_lifecycle_status_badge';
diff --git a/packages/kbn-alerts-ui-shared/jest.config.js b/packages/kbn-alerts-ui-shared/jest.config.js
new file mode 100644
index 0000000000000..31062b3280e41
--- /dev/null
+++ b/packages/kbn-alerts-ui-shared/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-alerts-ui-shared'],
+};
diff --git a/packages/kbn-alerts-ui-shared/kibana.jsonc b/packages/kbn-alerts-ui-shared/kibana.jsonc
new file mode 100644
index 0000000000000..da035e4fbb8f8
--- /dev/null
+++ b/packages/kbn-alerts-ui-shared/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/alerts-ui-shared",
+  "owner": "@elastic/response-ops"
+}
diff --git a/packages/kbn-alerts-ui-shared/package.json b/packages/kbn-alerts-ui-shared/package.json
new file mode 100644
index 0000000000000..cddedc28c624f
--- /dev/null
+++ b/packages/kbn-alerts-ui-shared/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/alerts-ui-shared",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}
\ No newline at end of file
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/alert_lifecycle_status_badge.test.tsx b/packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.test.tsx
similarity index 88%
rename from x-pack/plugins/triggers_actions_ui/public/application/components/alert_lifecycle_status_badge.test.tsx
rename to packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.test.tsx
index 0b959e6b8a2d7..1fe498fb5a660 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/alert_lifecycle_status_badge.test.tsx
+++ b/packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.test.tsx
@@ -1,13 +1,14 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import React from 'react';
 import { render } from '@testing-library/react';
-import { AlertLifecycleStatusBadge } from './alert_lifecycle_status_badge';
+import { AlertLifecycleStatusBadge } from '.';
 
 describe('alertLifecycleStatusBadge', () => {
   it('should display the alert status correctly when active and not flapping', () => {
diff --git a/packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx b/packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx
new file mode 100644
index 0000000000000..35519fba7dd1e
--- /dev/null
+++ b/packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { memo } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiBadge, EuiBadgeProps } from '@elastic/eui';
+import { AlertStatus, ALERT_STATUS_RECOVERED } from '@kbn/rule-data-utils';
+
+export interface AlertLifecycleStatusBadgeProps {
+  alertStatus: AlertStatus;
+  flapping?: boolean | string;
+}
+
+const ACTIVE_LABEL = i18n.translate(
+  'alertsUIShared.components.alertLifecycleStatusBadge.activeLabel',
+  {
+    defaultMessage: 'Active',
+  }
+);
+
+const RECOVERED_LABEL = i18n.translate(
+  'alertsUIShared.components.alertLifecycleStatusBadge.recoveredLabel',
+  {
+    defaultMessage: 'Recovered',
+  }
+);
+
+const FLAPPING_LABEL = i18n.translate(
+  'alertsUIShared.components.alertLifecycleStatusBadge.flappingLabel',
+  {
+    defaultMessage: 'Flapping',
+  }
+);
+
+interface BadgeProps {
+  label: string;
+  color: string;
+  iconProps?: {
+    iconType: EuiBadgeProps['iconType'];
+  };
+}
+
+const getBadgeProps = (alertStatus: AlertStatus, flapping: boolean | undefined): BadgeProps => {
+  // Prefer recovered over flapping
+  if (alertStatus === ALERT_STATUS_RECOVERED) {
+    return {
+      label: RECOVERED_LABEL,
+      color: 'success',
+    };
+  }
+
+  if (flapping) {
+    return {
+      label: FLAPPING_LABEL,
+      color: 'danger',
+      iconProps: {
+        iconType: 'visGauge',
+      },
+    };
+  }
+
+  return {
+    label: ACTIVE_LABEL,
+    color: 'danger',
+  };
+};
+
+const castFlapping = (flapping: boolean | string | undefined) => {
+  if (typeof flapping === 'string') {
+    return flapping === 'true';
+  }
+  return flapping;
+};
+
+export const AlertLifecycleStatusBadge = memo((props: AlertLifecycleStatusBadgeProps) => {
+  const { alertStatus, flapping } = props;
+
+  const castedFlapping = castFlapping(flapping);
+
+  const { label, color, iconProps } = getBadgeProps(alertStatus, castedFlapping);
+
+  return (
+    <EuiBadge data-test-subj="alertLifecycleStatusBadge" color={color} {...iconProps}>
+      {label}
+    </EuiBadge>
+  );
+});
diff --git a/packages/kbn-alerts-ui-shared/tsconfig.json b/packages/kbn-alerts-ui-shared/tsconfig.json
new file mode 100644
index 0000000000000..045e79467b3b7
--- /dev/null
+++ b/packages/kbn-alerts-ui-shared/tsconfig.json
@@ -0,0 +1,22 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node",
+      "react"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx"
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/i18n",
+    "@kbn/rule-data-utils"
+  ]
+}
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 98d79a813b6c8..63e43cf855daf 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -26,6 +26,8 @@
       "@kbn/alerting-plugin/*": ["x-pack/plugins/alerting/*"],
       "@kbn/alerts": ["packages/kbn-alerts"],
       "@kbn/alerts/*": ["packages/kbn-alerts/*"],
+      "@kbn/alerts-ui-shared": ["packages/kbn-alerts-ui-shared"],
+      "@kbn/alerts-ui-shared/*": ["packages/kbn-alerts-ui-shared/*"],
       "@kbn/ambient-common-types": ["packages/kbn-ambient-common-types"],
       "@kbn/ambient-common-types/*": ["packages/kbn-ambient-common-types/*"],
       "@kbn/ambient-ftr-types": ["packages/kbn-ambient-ftr-types"],
diff --git a/x-pack/plugins/observability/public/observability_public_plugins_start.mock.tsx b/x-pack/plugins/observability/public/observability_public_plugins_start.mock.tsx
index 6ccca21b37907..f31f41c6a6357 100644
--- a/x-pack/plugins/observability/public/observability_public_plugins_start.mock.tsx
+++ b/x-pack/plugins/observability/public/observability_public_plugins_start.mock.tsx
@@ -59,6 +59,9 @@ const triggersActionsUiStartMock = {
       )),
       getRuleTagFilter: jest.fn(() => <div data-test-subj="rule-tag-filter">mocked component</div>),
       getRulesList: jest.fn(() => <div data-test-subj="rules-list">mocked component</div>),
+      getRulesSettingsLink: jest.fn(() => (
+        <div data-test-subj="rules-settings-link">mocked component</div>
+      )),
       ruleTypeRegistry: {
         has: jest.fn(),
         register: jest.fn(),
diff --git a/x-pack/plugins/observability/public/pages/alerts/components/alerts_flyout/alerts_flyout_body.tsx b/x-pack/plugins/observability/public/pages/alerts/components/alerts_flyout/alerts_flyout_body.tsx
index 56daa3a4f8f9b..ead2b83388f87 100644
--- a/x-pack/plugins/observability/public/pages/alerts/components/alerts_flyout/alerts_flyout_body.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/components/alerts_flyout/alerts_flyout_body.tsx
@@ -19,17 +19,18 @@ import {
   ALERT_DURATION,
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
+  ALERT_FLAPPING,
   ALERT_RULE_CATEGORY,
   ALERT_RULE_UUID,
   ALERT_STATUS_ACTIVE,
   ALERT_STATUS_RECOVERED,
 } from '@kbn/rule-data-utils';
+import { AlertLifecycleStatusBadge } from '@kbn/alerts-ui-shared';
 import moment from 'moment-timezone';
 import { useKibana, useUiSetting } from '@kbn/kibana-react-plugin/public';
 import { RULE_DETAILS_PAGE_ID } from '../../../rule_details/constants';
 import { asDuration } from '../../../../../common/utils/formatters';
 import { translations, paths } from '../../../../config';
-import { AlertStatusIndicator } from '../../../../components/shared/alert_status_indicator';
 import { FlyoutProps } from './types';
 
 // eslint-disable-next-line import/no-default-export
@@ -47,8 +48,9 @@ export default function AlertsFlyoutBody({ alert, id: pageId }: FlyoutProps) {
     {
       title: translations.alertsFlyout.statusLabel,
       description: (
-        <AlertStatusIndicator
+        <AlertLifecycleStatusBadge
           alertStatus={alert.active ? ALERT_STATUS_ACTIVE : ALERT_STATUS_RECOVERED}
+          flapping={alert.fields[ALERT_FLAPPING]}
         />
       ),
     },
diff --git a/x-pack/plugins/observability/public/pages/rules/index.tsx b/x-pack/plugins/observability/public/pages/rules/index.tsx
index 36968f5fc1b2b..28c37ad7c454d 100644
--- a/x-pack/plugins/observability/public/pages/rules/index.tsx
+++ b/x-pack/plugins/observability/public/pages/rules/index.tsx
@@ -34,7 +34,11 @@ function RulesPage() {
   const {
     http,
     docLinks,
-    triggersActionsUi: { getAddAlertFlyout: AddAlertFlyout, getRulesList: RuleList },
+    triggersActionsUi: {
+      getAddAlertFlyout: AddAlertFlyout,
+      getRulesList: RuleList,
+      getRulesSettingsLink: RulesSettingsLink,
+    },
   } = useKibana().services;
 
   const { status, setStatus, lastResponse, setLastResponse } = useRulesPageStateContainer();
@@ -83,6 +87,7 @@ function RulesPage() {
               defaultMessage="Create rule"
             />
           </EuiButton>,
+          <RulesSettingsLink />,
           <EuiButtonEmpty
             href={docLinks.links.observability.createAlerts}
             target="_blank"
diff --git a/x-pack/plugins/observability/tsconfig.json b/x-pack/plugins/observability/tsconfig.json
index 04217f4087e17..2deabdc736d47 100644
--- a/x-pack/plugins/observability/tsconfig.json
+++ b/x-pack/plugins/observability/tsconfig.json
@@ -69,6 +69,7 @@
     "@kbn/guided-onboarding",
     "@kbn/charts-plugin",
     "@kbn/securitysolution-ecs",
+    "@kbn/alerts-ui-shared",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/alert_lifecycle_status_badge.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/alert_lifecycle_status_badge.tsx
index 46d8753d3c0cd..e45df25453295 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/alert_lifecycle_status_badge.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/alert_lifecycle_status_badge.tsx
@@ -4,91 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { AlertLifecycleStatusBadge, AlertLifecycleStatusBadgeProps } from '@kbn/alerts-ui-shared';
 
-import React, { memo } from 'react';
-import { i18n } from '@kbn/i18n';
-import { EuiBadge, EuiBadgeProps } from '@elastic/eui';
-import { AlertStatus, ALERT_STATUS_RECOVERED } from '@kbn/rule-data-utils';
-
-export interface AlertLifecycleStatusBadgeProps {
-  alertStatus: AlertStatus;
-  flapping?: boolean | string;
-}
-
-const ACTIVE_LABEL = i18n.translate(
-  'xpack.triggersActionsUI.components.alertLifecycleStatusBadge.activeLabel',
-  {
-    defaultMessage: 'Active',
-  }
-);
-
-const RECOVERED_LABEL = i18n.translate(
-  'xpack.triggersActionsUI.components.alertLifecycleStatusBadge.recoveredLabel',
-  {
-    defaultMessage: 'Recovered',
-  }
-);
-
-const FLAPPING_LABEL = i18n.translate(
-  'xpack.triggersActionsUI.components.alertLifecycleStatusBadge.flappingLabel',
-  {
-    defaultMessage: 'Flapping',
-  }
-);
-
-interface BadgeProps {
-  label: string;
-  color: string;
-  iconProps?: {
-    iconType: EuiBadgeProps['iconType'];
-  };
-}
-
-const getBadgeProps = (alertStatus: AlertStatus, flapping: boolean | undefined): BadgeProps => {
-  // Prefer recovered over flapping
-  if (alertStatus === ALERT_STATUS_RECOVERED) {
-    return {
-      label: RECOVERED_LABEL,
-      color: 'success',
-    };
-  }
-
-  if (flapping) {
-    return {
-      label: FLAPPING_LABEL,
-      color: 'danger',
-      iconProps: {
-        iconType: 'visGauge',
-      },
-    };
-  }
-
-  return {
-    label: ACTIVE_LABEL,
-    color: 'danger',
-  };
-};
-
-const castFlapping = (flapping: boolean | string | undefined) => {
-  if (typeof flapping === 'string') {
-    return flapping === 'true';
-  }
-  return flapping;
-};
-
-export const AlertLifecycleStatusBadge = memo((props: AlertLifecycleStatusBadgeProps) => {
-  const { alertStatus, flapping } = props;
-
-  const castedFlapping = castFlapping(flapping);
-
-  const { label, color, iconProps } = getBadgeProps(alertStatus, castedFlapping);
-
-  return (
-    <EuiBadge data-test-subj="alertLifecycleStatusBadge" color={color} {...iconProps}>
-      {label}
-    </EuiBadge>
-  );
-});
-
-// eslint-disable-next-line import/no-default-export
-export { AlertLifecycleStatusBadge as default };
+export { AlertLifecycleStatusBadge };
+export type { AlertLifecycleStatusBadgeProps };
diff --git a/x-pack/plugins/triggers_actions_ui/tsconfig.json b/x-pack/plugins/triggers_actions_ui/tsconfig.json
index 96024fb676b14..e6f7ac42c3cc4 100644
--- a/x-pack/plugins/triggers_actions_ui/tsconfig.json
+++ b/x-pack/plugins/triggers_actions_ui/tsconfig.json
@@ -44,6 +44,7 @@
     "@kbn/ui-theme",
     "@kbn/datemath",
     "@kbn/core-capabilities-common",
+    "@kbn/alerts-ui-shared",
   ],
   "exclude": [
     "target/**/*",
diff --git a/yarn.lock b/yarn.lock
index 4613bc8853a69..ddef865f3ea99 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2749,6 +2749,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/alerts-ui-shared@link:packages/kbn-alerts-ui-shared":
+  version "0.0.0"
+  uid ""
+
 "@kbn/alerts@link:packages/kbn-alerts":
   version "0.0.0"
   uid ""

From f4c733099f1d5f5a4dd39bfb07c54b11d7f1efa0 Mon Sep 17 00:00:00 2001
From: Thomas Watson <watson@elastic.co>
Date: Wed, 8 Feb 2023 06:41:12 +0100
Subject: [PATCH 104/134] [canvas] Run tests against @kbn/handlebars compileAST
 function (#150439)

The `Handlebars` object exposed by the tested file
(`x-pack/plugins/canvas/common/lib/handlebars.js`) is primarily meant to
have its `compileAST` function called and not the `compile` function.
This PR just updates the tests to reflect that.
---
 x-pack/plugins/canvas/common/lib/handlebars.test.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/canvas/common/lib/handlebars.test.js b/x-pack/plugins/canvas/common/lib/handlebars.test.js
index 5a0ee7f2746e6..1670a9f70067c 100644
--- a/x-pack/plugins/canvas/common/lib/handlebars.test.js
+++ b/x-pack/plugins/canvas/common/lib/handlebars.test.js
@@ -10,11 +10,11 @@ import { Handlebars } from './handlebars';
 
 describe('handlebars', () => {
   it('registers math function and returns argument error', () => {
-    const template = Handlebars.compile("test math: {{math rows 'mean(price * quantity)' 2}}");
+    const template = Handlebars.compileAST("test math: {{math rows 'mean(price * quantity)' 2}}");
     expect(template()).toBe('test math: MATH ERROR: first argument must be an array');
   });
   it('evaluates math function successfully', () => {
-    const template = Handlebars.compile("test math: {{math rows 'mean(price * quantity)' 2}}");
+    const template = Handlebars.compileAST("test math: {{math rows 'mean(price * quantity)' 2}}");
     expect(template(testTable)).toBe('test math: 82164.33');
   });
 });

From 1e133e39cdbfce99acbdba17df9f5cc9560f075d Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Wed, 8 Feb 2023 00:48:07 -0500
Subject: [PATCH 105/134] [api-docs] 2023-02-08 Daily api_docs build (#150518)

Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/242
---
 api_docs/actions.mdx                          |    2 +-
 api_docs/advanced_settings.mdx                |    2 +-
 api_docs/aiops.mdx                            |    2 +-
 api_docs/alerting.devdocs.json                |   65 +-
 api_docs/alerting.mdx                         |    4 +-
 api_docs/apm.devdocs.json                     |    6 +
 api_docs/apm.mdx                              |    2 +-
 api_docs/banners.mdx                          |    2 +-
 api_docs/bfetch.mdx                           |    2 +-
 api_docs/canvas.mdx                           |    2 +-
 api_docs/cases.mdx                            |    2 +-
 api_docs/charts.mdx                           |    2 +-
 api_docs/cloud.mdx                            |    2 +-
 api_docs/cloud_chat.mdx                       |    2 +-
 api_docs/cloud_data_migration.mdx             |    2 +-
 api_docs/cloud_defend.mdx                     |    2 +-
 api_docs/cloud_experiments.mdx                |    2 +-
 api_docs/cloud_security_posture.mdx           |    2 +-
 api_docs/console.mdx                          |    2 +-
 api_docs/content_management.devdocs.json      |  291 ++-
 api_docs/content_management.mdx               |   10 +-
 api_docs/controls.mdx                         |    2 +-
 api_docs/core.devdocs.json                    |   60 +
 api_docs/core.mdx                             |    4 +-
 api_docs/custom_integrations.mdx              |    2 +-
 api_docs/dashboard.devdocs.json               |    4 +-
 api_docs/dashboard.mdx                        |    2 +-
 api_docs/dashboard_enhanced.mdx               |    2 +-
 api_docs/data.devdocs.json                    |    8 +
 api_docs/data.mdx                             |    2 +-
 api_docs/data_query.mdx                       |    2 +-
 api_docs/data_search.mdx                      |    2 +-
 api_docs/data_view_editor.mdx                 |    2 +-
 api_docs/data_view_field_editor.mdx           |    2 +-
 api_docs/data_view_management.mdx             |    2 +-
 api_docs/data_views.devdocs.json              |   12 +
 api_docs/data_views.mdx                       |    2 +-
 api_docs/data_visualizer.mdx                  |    2 +-
 api_docs/deprecations_by_api.mdx              |    2 +-
 api_docs/deprecations_by_plugin.mdx           |    8 +-
 api_docs/deprecations_by_team.mdx             |    2 +-
 api_docs/dev_tools.mdx                        |    2 +-
 api_docs/discover.mdx                         |    2 +-
 api_docs/discover_enhanced.mdx                |    2 +-
 api_docs/ecs_data_quality_dashboard.mdx       |    2 +-
 api_docs/embeddable.mdx                       |    2 +-
 api_docs/embeddable_enhanced.mdx              |    2 +-
 api_docs/encrypted_saved_objects.mdx          |    2 +-
 api_docs/enterprise_search.mdx                |    2 +-
 api_docs/es_ui_shared.mdx                     |    2 +-
 api_docs/event_annotation.mdx                 |    2 +-
 api_docs/event_log.mdx                        |    2 +-
 api_docs/expression_error.mdx                 |    2 +-
 api_docs/expression_gauge.mdx                 |    2 +-
 api_docs/expression_heatmap.mdx               |    2 +-
 api_docs/expression_image.mdx                 |    2 +-
 api_docs/expression_legacy_metric_vis.mdx     |    2 +-
 api_docs/expression_metric.mdx                |    2 +-
 api_docs/expression_metric_vis.mdx            |    2 +-
 api_docs/expression_partition_vis.mdx         |    2 +-
 api_docs/expression_repeat_image.mdx          |    2 +-
 api_docs/expression_reveal_image.mdx          |    2 +-
 api_docs/expression_shape.mdx                 |    2 +-
 api_docs/expression_tagcloud.mdx              |    2 +-
 api_docs/expression_x_y.mdx                   |    2 +-
 api_docs/expressions.mdx                      |    2 +-
 api_docs/features.mdx                         |    2 +-
 api_docs/field_formats.mdx                    |    2 +-
 api_docs/file_upload.mdx                      |    2 +-
 api_docs/files.mdx                            |    2 +-
 api_docs/files_management.mdx                 |    2 +-
 api_docs/fleet.devdocs.json                   |   16 +-
 api_docs/fleet.mdx                            |    4 +-
 api_docs/global_search.mdx                    |    2 +-
 api_docs/guided_onboarding.mdx                |    2 +-
 api_docs/home.mdx                             |    2 +-
 api_docs/image_embeddable.mdx                 |    2 +-
 api_docs/index_lifecycle_management.mdx       |    2 +-
 api_docs/index_management.mdx                 |    2 +-
 api_docs/infra.mdx                            |    2 +-
 api_docs/inspector.mdx                        |    2 +-
 api_docs/interactive_setup.mdx                |    2 +-
 api_docs/kbn_ace.mdx                          |    2 +-
 api_docs/kbn_aiops_components.mdx             |    2 +-
 api_docs/kbn_aiops_utils.mdx                  |    2 +-
 api_docs/kbn_alerts.mdx                       |    2 +-
 api_docs/kbn_alerts_ui_shared.devdocs.json    |  119 ++
 api_docs/kbn_alerts_ui_shared.mdx             |   33 +
 api_docs/kbn_analytics.mdx                    |    2 +-
 api_docs/kbn_analytics_client.mdx             |    2 +-
 ..._analytics_shippers_elastic_v3_browser.mdx |    2 +-
 ...n_analytics_shippers_elastic_v3_common.mdx |    2 +-
 ...n_analytics_shippers_elastic_v3_server.mdx |    2 +-
 api_docs/kbn_analytics_shippers_fullstory.mdx |    2 +-
 api_docs/kbn_analytics_shippers_gainsight.mdx |    2 +-
 api_docs/kbn_apm_config_loader.mdx            |    2 +-
 api_docs/kbn_apm_synthtrace.mdx               |    2 +-
 .../kbn_apm_synthtrace_client.devdocs.json    |    8 +-
 api_docs/kbn_apm_synthtrace_client.mdx        |    2 +-
 api_docs/kbn_apm_utils.mdx                    |    2 +-
 api_docs/kbn_axe_config.mdx                   |    2 +-
 api_docs/kbn_cases_components.mdx             |    2 +-
 api_docs/kbn_cell_actions.mdx                 |    2 +-
 api_docs/kbn_chart_icons.mdx                  |    2 +-
 api_docs/kbn_ci_stats_core.mdx                |    2 +-
 api_docs/kbn_ci_stats_performance_metrics.mdx |    2 +-
 api_docs/kbn_ci_stats_reporter.mdx            |    2 +-
 api_docs/kbn_cli_dev_mode.mdx                 |    2 +-
 api_docs/kbn_code_editor.mdx                  |    2 +-
 api_docs/kbn_code_editor_mocks.mdx            |    2 +-
 api_docs/kbn_coloring.mdx                     |    2 +-
 api_docs/kbn_config.mdx                       |    2 +-
 api_docs/kbn_config_mocks.mdx                 |    2 +-
 api_docs/kbn_config_schema.mdx                |    2 +-
 .../kbn_content_management_content_editor.mdx |    2 +-
 .../kbn_content_management_table_list.mdx     |    2 +-
 api_docs/kbn_core_analytics_browser.mdx       |    2 +-
 .../kbn_core_analytics_browser_internal.mdx   |    2 +-
 api_docs/kbn_core_analytics_browser_mocks.mdx |    2 +-
 api_docs/kbn_core_analytics_server.mdx        |    2 +-
 .../kbn_core_analytics_server_internal.mdx    |    2 +-
 api_docs/kbn_core_analytics_server_mocks.mdx  |    2 +-
 api_docs/kbn_core_application_browser.mdx     |    2 +-
 .../kbn_core_application_browser_internal.mdx |    2 +-
 .../kbn_core_application_browser_mocks.mdx    |    2 +-
 api_docs/kbn_core_application_common.mdx      |    2 +-
 api_docs/kbn_core_apps_browser_internal.mdx   |    2 +-
 api_docs/kbn_core_apps_browser_mocks.mdx      |    2 +-
 api_docs/kbn_core_apps_server_internal.mdx    |    2 +-
 api_docs/kbn_core_base_browser_mocks.mdx      |    2 +-
 api_docs/kbn_core_base_common.mdx             |    2 +-
 api_docs/kbn_core_base_server_internal.mdx    |    2 +-
 api_docs/kbn_core_base_server_mocks.mdx       |    2 +-
 .../kbn_core_capabilities_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_capabilities_common.mdx     |    2 +-
 api_docs/kbn_core_capabilities_server.mdx     |    2 +-
 .../kbn_core_capabilities_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_chrome_browser.mdx          |    2 +-
 api_docs/kbn_core_chrome_browser_mocks.mdx    |    2 +-
 api_docs/kbn_core_config_server_internal.mdx  |    2 +-
 api_docs/kbn_core_custom_branding_browser.mdx |    2 +-
 ..._core_custom_branding_browser_internal.mdx |    2 +-
 ...kbn_core_custom_branding_browser_mocks.mdx |    2 +-
 api_docs/kbn_core_custom_branding_common.mdx  |    2 +-
 api_docs/kbn_core_custom_branding_server.mdx  |    2 +-
 ...n_core_custom_branding_server_internal.mdx |    2 +-
 .../kbn_core_custom_branding_server_mocks.mdx |    2 +-
 api_docs/kbn_core_deprecations_browser.mdx    |    2 +-
 ...kbn_core_deprecations_browser_internal.mdx |    2 +-
 .../kbn_core_deprecations_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_deprecations_common.mdx     |    2 +-
 api_docs/kbn_core_deprecations_server.mdx     |    2 +-
 .../kbn_core_deprecations_server_internal.mdx |    2 +-
 .../kbn_core_deprecations_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_doc_links_browser.mdx       |    2 +-
 api_docs/kbn_core_doc_links_browser_mocks.mdx |    2 +-
 api_docs/kbn_core_doc_links_server.mdx        |    2 +-
 api_docs/kbn_core_doc_links_server_mocks.mdx  |    2 +-
 ...e_elasticsearch_client_server_internal.mdx |    2 +-
 ...core_elasticsearch_client_server_mocks.mdx |    2 +-
 api_docs/kbn_core_elasticsearch_server.mdx    |    2 +-
 ...kbn_core_elasticsearch_server_internal.mdx |    2 +-
 .../kbn_core_elasticsearch_server_mocks.mdx   |    2 +-
 .../kbn_core_environment_server_internal.mdx  |    2 +-
 .../kbn_core_environment_server_mocks.mdx     |    2 +-
 .../kbn_core_execution_context_browser.mdx    |    2 +-
 ...ore_execution_context_browser_internal.mdx |    2 +-
 ...n_core_execution_context_browser_mocks.mdx |    2 +-
 .../kbn_core_execution_context_common.mdx     |    2 +-
 .../kbn_core_execution_context_server.mdx     |    2 +-
 ...core_execution_context_server_internal.mdx |    2 +-
 ...bn_core_execution_context_server_mocks.mdx |    2 +-
 api_docs/kbn_core_fatal_errors_browser.mdx    |    2 +-
 .../kbn_core_fatal_errors_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_http_browser.mdx            |    2 +-
 api_docs/kbn_core_http_browser_internal.mdx   |    2 +-
 api_docs/kbn_core_http_browser_mocks.mdx      |    2 +-
 api_docs/kbn_core_http_common.mdx             |    2 +-
 .../kbn_core_http_context_server_mocks.mdx    |    2 +-
 ...re_http_request_handler_context_server.mdx |    2 +-
 api_docs/kbn_core_http_resources_server.mdx   |    2 +-
 ...bn_core_http_resources_server_internal.mdx |    2 +-
 .../kbn_core_http_resources_server_mocks.mdx  |    2 +-
 .../kbn_core_http_router_server_internal.mdx  |    2 +-
 .../kbn_core_http_router_server_mocks.mdx     |    2 +-
 api_docs/kbn_core_http_server.mdx             |    2 +-
 ...kbn_core_http_server_internal.devdocs.json |   17 +-
 api_docs/kbn_core_http_server_internal.mdx    |    4 +-
 api_docs/kbn_core_http_server_mocks.mdx       |    2 +-
 api_docs/kbn_core_i18n_browser.mdx            |    2 +-
 api_docs/kbn_core_i18n_browser_mocks.mdx      |    2 +-
 api_docs/kbn_core_i18n_server.mdx             |    2 +-
 api_docs/kbn_core_i18n_server_internal.mdx    |    2 +-
 api_docs/kbn_core_i18n_server_mocks.mdx       |    2 +-
 ...n_core_injected_metadata_browser_mocks.mdx |    2 +-
 ...kbn_core_integrations_browser_internal.mdx |    2 +-
 .../kbn_core_integrations_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_lifecycle_browser.mdx       |    2 +-
 api_docs/kbn_core_lifecycle_browser_mocks.mdx |    2 +-
 api_docs/kbn_core_lifecycle_server.mdx        |    2 +-
 api_docs/kbn_core_lifecycle_server_mocks.mdx  |    2 +-
 api_docs/kbn_core_logging_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_logging_common_internal.mdx |    2 +-
 api_docs/kbn_core_logging_server.mdx          |    2 +-
 api_docs/kbn_core_logging_server_internal.mdx |    2 +-
 api_docs/kbn_core_logging_server_mocks.mdx    |    2 +-
 ...ore_metrics_collectors_server_internal.mdx |    2 +-
 ...n_core_metrics_collectors_server_mocks.mdx |    2 +-
 api_docs/kbn_core_metrics_server.mdx          |    2 +-
 api_docs/kbn_core_metrics_server_internal.mdx |    2 +-
 api_docs/kbn_core_metrics_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_mount_utils_browser.mdx     |    2 +-
 api_docs/kbn_core_node_server.mdx             |    2 +-
 api_docs/kbn_core_node_server_internal.mdx    |    2 +-
 api_docs/kbn_core_node_server_mocks.mdx       |    2 +-
 api_docs/kbn_core_notifications_browser.mdx   |    2 +-
 ...bn_core_notifications_browser_internal.mdx |    2 +-
 .../kbn_core_notifications_browser_mocks.mdx  |    2 +-
 api_docs/kbn_core_overlays_browser.mdx        |    2 +-
 .../kbn_core_overlays_browser_internal.mdx    |    2 +-
 api_docs/kbn_core_overlays_browser_mocks.mdx  |    2 +-
 api_docs/kbn_core_plugins_browser.mdx         |    2 +-
 api_docs/kbn_core_plugins_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_plugins_server.mdx          |    2 +-
 api_docs/kbn_core_plugins_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_preboot_server.mdx          |    2 +-
 api_docs/kbn_core_preboot_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_rendering_browser_mocks.mdx |    2 +-
 .../kbn_core_rendering_server_internal.mdx    |    2 +-
 api_docs/kbn_core_rendering_server_mocks.mdx  |    2 +-
 api_docs/kbn_core_root_server_internal.mdx    |    2 +-
 .../kbn_core_saved_objects_api_browser.mdx    |    2 +-
 .../kbn_core_saved_objects_api_server.mdx     |    2 +-
 ...core_saved_objects_api_server_internal.mdx |    2 +-
 ...bn_core_saved_objects_api_server_mocks.mdx |    2 +-
 ...ore_saved_objects_base_server_internal.mdx |    2 +-
 ...n_core_saved_objects_base_server_mocks.mdx |    2 +-
 api_docs/kbn_core_saved_objects_browser.mdx   |    2 +-
 ...bn_core_saved_objects_browser_internal.mdx |    2 +-
 .../kbn_core_saved_objects_browser_mocks.mdx  |    2 +-
 api_docs/kbn_core_saved_objects_common.mdx    |    2 +-
 ..._objects_import_export_server_internal.mdx |    2 +-
 ...ved_objects_import_export_server_mocks.mdx |    2 +-
 ...aved_objects_migration_server_internal.mdx |    2 +-
 ...e_saved_objects_migration_server_mocks.mdx |    2 +-
 ...kbn_core_saved_objects_server.devdocs.json |  685 +++++++
 api_docs/kbn_core_saved_objects_server.mdx    |    4 +-
 ...kbn_core_saved_objects_server_internal.mdx |    2 +-
 .../kbn_core_saved_objects_server_mocks.mdx   |    2 +-
 .../kbn_core_saved_objects_utils_server.mdx   |    2 +-
 api_docs/kbn_core_status_common.mdx           |    2 +-
 api_docs/kbn_core_status_common_internal.mdx  |    2 +-
 api_docs/kbn_core_status_server.mdx           |    2 +-
 api_docs/kbn_core_status_server_internal.mdx  |    2 +-
 api_docs/kbn_core_status_server_mocks.mdx     |    2 +-
 ...core_test_helpers_deprecations_getters.mdx |    2 +-
 ...n_core_test_helpers_http_setup_browser.mdx |    2 +-
 api_docs/kbn_core_test_helpers_kbn_server.mdx |    2 +-
 ...st_helpers_so_type_serializer.devdocs.json |   29 +
 ...n_core_test_helpers_so_type_serializer.mdx |    4 +-
 api_docs/kbn_core_test_helpers_test_utils.mdx |    2 +-
 api_docs/kbn_core_theme_browser.mdx           |    2 +-
 api_docs/kbn_core_theme_browser_internal.mdx  |    2 +-
 api_docs/kbn_core_theme_browser_mocks.mdx     |    2 +-
 api_docs/kbn_core_ui_settings_browser.mdx     |    2 +-
 .../kbn_core_ui_settings_browser_internal.mdx |    2 +-
 .../kbn_core_ui_settings_browser_mocks.mdx    |    2 +-
 api_docs/kbn_core_ui_settings_common.mdx      |    2 +-
 api_docs/kbn_core_ui_settings_server.mdx      |    2 +-
 .../kbn_core_ui_settings_server_internal.mdx  |    2 +-
 .../kbn_core_ui_settings_server_mocks.mdx     |    2 +-
 api_docs/kbn_core_usage_data_server.mdx       |    2 +-
 .../kbn_core_usage_data_server_internal.mdx   |    2 +-
 api_docs/kbn_core_usage_data_server_mocks.mdx |    2 +-
 api_docs/kbn_crypto.mdx                       |    2 +-
 api_docs/kbn_crypto_browser.mdx               |    2 +-
 api_docs/kbn_cypress_config.mdx               |    2 +-
 api_docs/kbn_datemath.mdx                     |    2 +-
 api_docs/kbn_dev_cli_errors.mdx               |    2 +-
 api_docs/kbn_dev_cli_runner.mdx               |    2 +-
 api_docs/kbn_dev_proc_runner.mdx              |    2 +-
 api_docs/kbn_dev_utils.mdx                    |    2 +-
 api_docs/kbn_doc_links.devdocs.json           |    2 +-
 api_docs/kbn_doc_links.mdx                    |    2 +-
 api_docs/kbn_docs_utils.mdx                   |    2 +-
 api_docs/kbn_ebt_tools.mdx                    |    2 +-
 api_docs/kbn_ecs.mdx                          |    2 +-
 api_docs/kbn_ecs_data_quality_dashboard.mdx   |    2 +-
 api_docs/kbn_es.mdx                           |    2 +-
 api_docs/kbn_es_archiver.mdx                  |    2 +-
 api_docs/kbn_es_errors.mdx                    |    2 +-
 api_docs/kbn_es_query.mdx                     |    2 +-
 api_docs/kbn_es_types.mdx                     |    2 +-
 api_docs/kbn_eslint_plugin_imports.mdx        |    2 +-
 api_docs/kbn_field_types.mdx                  |    2 +-
 api_docs/kbn_find_used_node_modules.mdx       |    2 +-
 .../kbn_ftr_common_functional_services.mdx    |    2 +-
 api_docs/kbn_generate.mdx                     |    2 +-
 api_docs/kbn_get_repo_files.mdx               |    2 +-
 api_docs/kbn_guided_onboarding.mdx            |    2 +-
 api_docs/kbn_handlebars.devdocs.json          |  218 +--
 api_docs/kbn_handlebars.mdx                   |   10 +-
 api_docs/kbn_hapi_mocks.mdx                   |    2 +-
 api_docs/kbn_health_gateway_server.mdx        |    2 +-
 api_docs/kbn_home_sample_data_card.mdx        |    2 +-
 api_docs/kbn_home_sample_data_tab.mdx         |    2 +-
 api_docs/kbn_i18n.mdx                         |    2 +-
 api_docs/kbn_i18n_react.mdx                   |    2 +-
 api_docs/kbn_import_resolver.mdx              |    2 +-
 api_docs/kbn_interpreter.mdx                  |    2 +-
 api_docs/kbn_io_ts_utils.mdx                  |    2 +-
 api_docs/kbn_jest_serializers.mdx             |    2 +-
 api_docs/kbn_journeys.mdx                     |    2 +-
 api_docs/kbn_json_ast.mdx                     |    2 +-
 api_docs/kbn_kibana_manifest_schema.mdx       |    2 +-
 .../kbn_language_documentation_popover.mdx    |    2 +-
 api_docs/kbn_logging.mdx                      |    2 +-
 api_docs/kbn_logging_mocks.mdx                |    2 +-
 api_docs/kbn_managed_vscode_config.mdx        |    2 +-
 api_docs/kbn_mapbox_gl.mdx                    |    2 +-
 api_docs/kbn_ml_agg_utils.mdx                 |    2 +-
 api_docs/kbn_ml_date_picker.devdocs.json      |   27 +
 api_docs/kbn_ml_date_picker.mdx               |    4 +-
 api_docs/kbn_ml_is_defined.mdx                |    2 +-
 api_docs/kbn_ml_is_populated_object.mdx       |    2 +-
 api_docs/kbn_ml_local_storage.mdx             |    2 +-
 api_docs/kbn_ml_nested_property.mdx           |    2 +-
 api_docs/kbn_ml_query_utils.mdx               |    2 +-
 api_docs/kbn_ml_string_hash.mdx               |    2 +-
 api_docs/kbn_ml_url_state.mdx                 |    2 +-
 api_docs/kbn_monaco.mdx                       |    2 +-
 api_docs/kbn_optimizer.mdx                    |    2 +-
 api_docs/kbn_optimizer_webpack_helpers.mdx    |    2 +-
 api_docs/kbn_osquery_io_ts_types.mdx          |    2 +-
 ..._performance_testing_dataset_extractor.mdx |    2 +-
 api_docs/kbn_plugin_generator.mdx             |    2 +-
 api_docs/kbn_plugin_helpers.mdx               |    2 +-
 api_docs/kbn_react_field.mdx                  |    2 +-
 api_docs/kbn_repo_file_maps.mdx               |    2 +-
 api_docs/kbn_repo_linter.mdx                  |    2 +-
 api_docs/kbn_repo_path.mdx                    |    2 +-
 api_docs/kbn_repo_source_classifier.mdx       |    2 +-
 api_docs/kbn_rison.mdx                        |    2 +-
 api_docs/kbn_rule_data_utils.mdx              |    2 +-
 .../kbn_securitysolution_autocomplete.mdx     |    2 +-
 api_docs/kbn_securitysolution_ecs.mdx         |    2 +-
 api_docs/kbn_securitysolution_es_utils.mdx    |    2 +-
 ...ion_exception_list_components.devdocs.json |   10 +-
 ...ritysolution_exception_list_components.mdx |    2 +-
 api_docs/kbn_securitysolution_hook_utils.mdx  |    2 +-
 ..._securitysolution_io_ts_alerting_types.mdx |    2 +-
 ...ritysolution_io_ts_list_types.devdocs.json |  227 ++-
 .../kbn_securitysolution_io_ts_list_types.mdx |    4 +-
 api_docs/kbn_securitysolution_io_ts_types.mdx |    2 +-
 api_docs/kbn_securitysolution_io_ts_utils.mdx |    2 +-
 ...kbn_securitysolution_list_api.devdocs.json |   16 +-
 api_docs/kbn_securitysolution_list_api.mdx    |    2 +-
 .../kbn_securitysolution_list_constants.mdx   |    2 +-
 ...n_securitysolution_list_hooks.devdocs.json |   34 +-
 api_docs/kbn_securitysolution_list_hooks.mdx  |    2 +-
 ...n_securitysolution_list_utils.devdocs.json |  102 +-
 api_docs/kbn_securitysolution_list_utils.mdx  |    4 +-
 api_docs/kbn_securitysolution_rules.mdx       |    2 +-
 api_docs/kbn_securitysolution_t_grid.mdx      |    2 +-
 api_docs/kbn_securitysolution_utils.mdx       |    2 +-
 api_docs/kbn_server_http_tools.mdx            |    2 +-
 api_docs/kbn_server_route_repository.mdx      |    2 +-
 api_docs/kbn_shared_svg.mdx                   |    2 +-
 api_docs/kbn_shared_ux_avatar_solution.mdx    |    2 +-
 ...ared_ux_avatar_user_profile_components.mdx |    2 +-
 .../kbn_shared_ux_button_exit_full_screen.mdx |    2 +-
 ...hared_ux_button_exit_full_screen_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_button_toolbar.mdx     |    2 +-
 api_docs/kbn_shared_ux_card_no_data.mdx       |    2 +-
 api_docs/kbn_shared_ux_card_no_data_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_file_context.mdx       |    2 +-
 api_docs/kbn_shared_ux_file_image.mdx         |    2 +-
 api_docs/kbn_shared_ux_file_image_mocks.mdx   |    2 +-
 api_docs/kbn_shared_ux_file_mocks.mdx         |    2 +-
 api_docs/kbn_shared_ux_file_picker.mdx        |    2 +-
 api_docs/kbn_shared_ux_file_upload.mdx        |    2 +-
 api_docs/kbn_shared_ux_file_util.mdx          |    2 +-
 api_docs/kbn_shared_ux_link_redirect_app.mdx  |    2 +-
 .../kbn_shared_ux_link_redirect_app_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_markdown.mdx           |    2 +-
 api_docs/kbn_shared_ux_markdown_mocks.mdx     |    2 +-
 .../kbn_shared_ux_page_analytics_no_data.mdx  |    2 +-
 ...shared_ux_page_analytics_no_data_mocks.mdx |    2 +-
 .../kbn_shared_ux_page_kibana_no_data.mdx     |    2 +-
 ...bn_shared_ux_page_kibana_no_data_mocks.mdx |    2 +-
 .../kbn_shared_ux_page_kibana_template.mdx    |    2 +-
 ...n_shared_ux_page_kibana_template_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_page_no_data.mdx       |    2 +-
 .../kbn_shared_ux_page_no_data_config.mdx     |    2 +-
 ...bn_shared_ux_page_no_data_config_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_page_no_data_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_page_solution_nav.mdx  |    2 +-
 .../kbn_shared_ux_prompt_no_data_views.mdx    |    2 +-
 ...n_shared_ux_prompt_no_data_views_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_prompt_not_found.mdx   |    2 +-
 api_docs/kbn_shared_ux_router.mdx             |    2 +-
 api_docs/kbn_shared_ux_router_mocks.mdx       |    2 +-
 api_docs/kbn_shared_ux_storybook_config.mdx   |    2 +-
 api_docs/kbn_shared_ux_storybook_mock.mdx     |    2 +-
 api_docs/kbn_shared_ux_utility.mdx            |    2 +-
 api_docs/kbn_slo_schema.mdx                   |    2 +-
 api_docs/kbn_some_dev_log.mdx                 |    2 +-
 api_docs/kbn_std.mdx                          |    2 +-
 api_docs/kbn_stdio_dev_helpers.mdx            |    2 +-
 api_docs/kbn_storybook.mdx                    |    2 +-
 api_docs/kbn_telemetry_tools.mdx              |    2 +-
 api_docs/kbn_test.mdx                         |    2 +-
 api_docs/kbn_test_jest_helpers.mdx            |    2 +-
 api_docs/kbn_test_subj_selector.mdx           |    2 +-
 api_docs/kbn_tooling_log.mdx                  |    2 +-
 api_docs/kbn_ts_projects.mdx                  |    2 +-
 api_docs/kbn_typed_react_router_config.mdx    |    2 +-
 api_docs/kbn_ui_actions_browser.mdx           |    2 +-
 api_docs/kbn_ui_shared_deps_src.mdx           |    2 +-
 api_docs/kbn_ui_theme.mdx                     |    2 +-
 api_docs/kbn_user_profile_components.mdx      |    2 +-
 api_docs/kbn_utility_types.mdx                |    2 +-
 api_docs/kbn_utility_types_jest.mdx           |    2 +-
 api_docs/kbn_utils.mdx                        |    2 +-
 api_docs/kbn_yarn_lock_validator.mdx          |    2 +-
 api_docs/kibana_overview.mdx                  |    2 +-
 api_docs/kibana_react.mdx                     |    2 +-
 api_docs/kibana_utils.mdx                     |    2 +-
 api_docs/kubernetes_security.mdx              |    2 +-
 api_docs/lens.devdocs.json                    |    4 +-
 api_docs/lens.mdx                             |    2 +-
 api_docs/license_api_guard.mdx                |    2 +-
 api_docs/license_management.mdx               |    2 +-
 api_docs/licensing.mdx                        |    2 +-
 api_docs/lists.devdocs.json                   |   78 +-
 api_docs/lists.mdx                            |    4 +-
 api_docs/management.mdx                       |    2 +-
 api_docs/maps.mdx                             |    2 +-
 api_docs/maps_ems.mdx                         |    2 +-
 api_docs/ml.devdocs.json                      |    2 +-
 api_docs/ml.mdx                               |    2 +-
 api_docs/monitoring.mdx                       |    2 +-
 api_docs/monitoring_collection.mdx            |    2 +-
 api_docs/navigation.mdx                       |    2 +-
 api_docs/newsfeed.mdx                         |    2 +-
 api_docs/notifications.mdx                    |    2 +-
 api_docs/observability.devdocs.json           |  238 +++
 api_docs/observability.mdx                    |    4 +-
 api_docs/osquery.mdx                          |    2 +-
 api_docs/plugin_directory.mdx                 |   35 +-
 api_docs/presentation_util.mdx                |    2 +-
 api_docs/profiling.devdocs.json               |    2 +-
 api_docs/profiling.mdx                        |    2 +-
 api_docs/remote_clusters.mdx                  |    2 +-
 api_docs/reporting.mdx                        |    2 +-
 api_docs/rollup.mdx                           |    2 +-
 api_docs/rule_registry.mdx                    |    2 +-
 api_docs/runtime_fields.mdx                   |    2 +-
 api_docs/saved_objects.mdx                    |    2 +-
 api_docs/saved_objects_finder.mdx             |    2 +-
 api_docs/saved_objects_management.mdx         |    2 +-
 api_docs/saved_objects_tagging.mdx            |    2 +-
 api_docs/saved_objects_tagging_oss.mdx        |    2 +-
 api_docs/saved_search.mdx                     |    2 +-
 api_docs/screenshot_mode.mdx                  |    2 +-
 api_docs/screenshotting.mdx                   |    2 +-
 api_docs/security.mdx                         |    2 +-
 api_docs/security_solution.mdx                |    2 +-
 api_docs/session_view.mdx                     |    2 +-
 api_docs/share.mdx                            |    2 +-
 api_docs/snapshot_restore.mdx                 |    2 +-
 api_docs/spaces.mdx                           |    2 +-
 api_docs/stack_alerts.mdx                     |    2 +-
 api_docs/stack_connectors.mdx                 |    2 +-
 api_docs/task_manager.mdx                     |    2 +-
 api_docs/telemetry.mdx                        |    2 +-
 api_docs/telemetry_collection_manager.mdx     |    2 +-
 api_docs/telemetry_collection_xpack.mdx       |    2 +-
 api_docs/telemetry_management_section.mdx     |    2 +-
 api_docs/threat_intelligence.mdx              |    2 +-
 api_docs/timelines.devdocs.json               |    4 +-
 api_docs/timelines.mdx                        |    2 +-
 api_docs/transform.mdx                        |    2 +-
 api_docs/triggers_actions_ui.devdocs.json     |    6 +-
 api_docs/triggers_actions_ui.mdx              |    2 +-
 api_docs/ui_actions.mdx                       |    2 +-
 api_docs/ui_actions_enhanced.mdx              |    2 +-
 api_docs/unified_field_list.mdx               |    2 +-
 api_docs/unified_histogram.devdocs.json       | 1731 ++++++++---------
 api_docs/unified_histogram.mdx                |    4 +-
 api_docs/unified_search.mdx                   |    2 +-
 api_docs/unified_search_autocomplete.mdx      |    2 +-
 api_docs/url_forwarding.mdx                   |    2 +-
 api_docs/usage_collection.mdx                 |    2 +-
 api_docs/ux.mdx                               |    2 +-
 api_docs/vis_default_editor.mdx               |    2 +-
 api_docs/vis_type_gauge.mdx                   |    2 +-
 api_docs/vis_type_heatmap.mdx                 |    2 +-
 api_docs/vis_type_pie.mdx                     |    2 +-
 api_docs/vis_type_table.mdx                   |    2 +-
 api_docs/vis_type_timelion.mdx                |    2 +-
 api_docs/vis_type_timeseries.mdx              |    2 +-
 api_docs/vis_type_vega.mdx                    |    2 +-
 api_docs/vis_type_vislib.mdx                  |    2 +-
 api_docs/vis_type_xy.mdx                      |    2 +-
 api_docs/visualizations.mdx                   |    2 +-
 506 files changed, 3356 insertions(+), 1729 deletions(-)
 create mode 100644 api_docs/kbn_alerts_ui_shared.devdocs.json
 create mode 100644 api_docs/kbn_alerts_ui_shared.mdx

diff --git a/api_docs/actions.mdx b/api_docs/actions.mdx
index 3ba970f4118c1..ef35d56d63b16 100644
--- a/api_docs/actions.mdx
+++ b/api_docs/actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/actions
 title: "actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the actions plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'actions']
 ---
 import actionsObj from './actions.devdocs.json';
diff --git a/api_docs/advanced_settings.mdx b/api_docs/advanced_settings.mdx
index db3fe435f1a30..928057041b4d1 100644
--- a/api_docs/advanced_settings.mdx
+++ b/api_docs/advanced_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/advancedSettings
 title: "advancedSettings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the advancedSettings plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'advancedSettings']
 ---
 import advancedSettingsObj from './advanced_settings.devdocs.json';
diff --git a/api_docs/aiops.mdx b/api_docs/aiops.mdx
index 5af3e2fb16988..b792796879d8f 100644
--- a/api_docs/aiops.mdx
+++ b/api_docs/aiops.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/aiops
 title: "aiops"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the aiops plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'aiops']
 ---
 import aiopsObj from './aiops.devdocs.json';
diff --git a/api_docs/alerting.devdocs.json b/api_docs/alerting.devdocs.json
index 6d65646822c9c..23201eb38ee2b 100644
--- a/api_docs/alerting.devdocs.json
+++ b/api_docs/alerting.devdocs.json
@@ -1994,7 +1994,7 @@
                 "section": "def-common.SanitizedRule",
                 "text": "SanitizedRule"
               },
-              "<never>, \"name\" | \"tags\" | \"id\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }"
+              "<never>, \"name\" | \"tags\" | \"id\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"muteAll\" | \"notifyWhen\" | \"snoozeSchedule\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }"
             ],
             "path": "x-pack/plugins/alerting/server/types.ts",
             "deprecated": false,
@@ -6080,6 +6080,20 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.RuleLastRun.outcomeOrder",
+            "type": "number",
+            "tags": [],
+            "label": "outcomeOrder",
+            "description": [],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/common/rule.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "alerting",
             "id": "def-common.RuleLastRun.warning",
@@ -7998,7 +8012,7 @@
             "section": "def-common.SanitizedRule",
             "text": "SanitizedRule"
           },
-          "<never>, \"name\" | \"tags\" | \"id\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }"
+          "<never>, \"name\" | \"tags\" | \"id\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"muteAll\" | \"notifyWhen\" | \"snoozeSchedule\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }"
         ],
         "path": "x-pack/plugins/alerting/common/rule.ts",
         "deprecated": false,
@@ -8400,6 +8414,53 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "alerting",
+        "id": "def-common.RuleLastRunOutcomeOrderMap",
+        "type": "Object",
+        "tags": [],
+        "label": "RuleLastRunOutcomeOrderMap",
+        "description": [],
+        "path": "x-pack/plugins/alerting/common/rule.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.RuleLastRunOutcomeOrderMap.succeeded",
+            "type": "number",
+            "tags": [],
+            "label": "succeeded",
+            "description": [],
+            "path": "x-pack/plugins/alerting/common/rule.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.RuleLastRunOutcomeOrderMap.warning",
+            "type": "number",
+            "tags": [],
+            "label": "warning",
+            "description": [],
+            "path": "x-pack/plugins/alerting/common/rule.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.RuleLastRunOutcomeOrderMap.failed",
+            "type": "number",
+            "tags": [],
+            "label": "failed",
+            "description": [],
+            "path": "x-pack/plugins/alerting/common/rule.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "alerting",
         "id": "def-common.RuleLastRunOutcomeValues",
diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx
index cbc14cce11e3e..d22dbd1c249b1 100644
--- a/api_docs/alerting.mdx
+++ b/api_docs/alerting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/alerting
 title: "alerting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the alerting plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'alerting']
 ---
 import alertingObj from './alerting.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Response Ops](https://github.com/orgs/elastic/teams/response-ops) for q
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 471 | 1 | 461 | 39 |
+| 476 | 1 | 466 | 39 |
 
 ## Client
 
diff --git a/api_docs/apm.devdocs.json b/api_docs/apm.devdocs.json
index b51fad1b153ba..5beab1c31de15 100644
--- a/api_docs/apm.devdocs.json
+++ b/api_docs/apm.devdocs.json
@@ -1358,6 +1358,10 @@
           "TypeC",
           "<{ useSpanName: ",
           "Type",
+          "<boolean, unknown, unknown>; enableServiceTransactionMetrics: ",
+          "Type",
+          "<boolean, unknown, unknown>; enableContinuousRollups: ",
+          "Type",
           "<boolean, unknown, unknown>; }>, ",
           "TypeC",
           "<{ kuery: ",
@@ -6620,6 +6624,8 @@
           "StringC",
           "; serviceGroup: ",
           "StringC",
+          "; kuery: ",
+          "StringC",
           "; }>, ",
           "TypeC",
           "<{ environment: ",
diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx
index 0165d4f0b364a..cf0a9adf1e71a 100644
--- a/api_docs/apm.mdx
+++ b/api_docs/apm.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apm
 title: "apm"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apm plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apm']
 ---
 import apmObj from './apm.devdocs.json';
diff --git a/api_docs/banners.mdx b/api_docs/banners.mdx
index f292ea0186524..a8bbe1bdcf5b2 100644
--- a/api_docs/banners.mdx
+++ b/api_docs/banners.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/banners
 title: "banners"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the banners plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'banners']
 ---
 import bannersObj from './banners.devdocs.json';
diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx
index ebf72b61a4b2a..de115543071b6 100644
--- a/api_docs/bfetch.mdx
+++ b/api_docs/bfetch.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/bfetch
 title: "bfetch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the bfetch plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'bfetch']
 ---
 import bfetchObj from './bfetch.devdocs.json';
diff --git a/api_docs/canvas.mdx b/api_docs/canvas.mdx
index c22791f7de815..8a8585f198ac5 100644
--- a/api_docs/canvas.mdx
+++ b/api_docs/canvas.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/canvas
 title: "canvas"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the canvas plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'canvas']
 ---
 import canvasObj from './canvas.devdocs.json';
diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx
index 3dabaf44f09a4..ef505bea85c3a 100644
--- a/api_docs/cases.mdx
+++ b/api_docs/cases.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cases
 title: "cases"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cases plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cases']
 ---
 import casesObj from './cases.devdocs.json';
diff --git a/api_docs/charts.mdx b/api_docs/charts.mdx
index 23d021370466a..0da599274c98f 100644
--- a/api_docs/charts.mdx
+++ b/api_docs/charts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/charts
 title: "charts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the charts plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'charts']
 ---
 import chartsObj from './charts.devdocs.json';
diff --git a/api_docs/cloud.mdx b/api_docs/cloud.mdx
index aede4e71fd19e..ff486e08150ba 100644
--- a/api_docs/cloud.mdx
+++ b/api_docs/cloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloud
 title: "cloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloud plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloud']
 ---
 import cloudObj from './cloud.devdocs.json';
diff --git a/api_docs/cloud_chat.mdx b/api_docs/cloud_chat.mdx
index 6b2bbf437d941..1f83dbad63dae 100644
--- a/api_docs/cloud_chat.mdx
+++ b/api_docs/cloud_chat.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudChat
 title: "cloudChat"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudChat plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudChat']
 ---
 import cloudChatObj from './cloud_chat.devdocs.json';
diff --git a/api_docs/cloud_data_migration.mdx b/api_docs/cloud_data_migration.mdx
index d0810c875d703..9a8cb6b18d019 100644
--- a/api_docs/cloud_data_migration.mdx
+++ b/api_docs/cloud_data_migration.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDataMigration
 title: "cloudDataMigration"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDataMigration plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDataMigration']
 ---
 import cloudDataMigrationObj from './cloud_data_migration.devdocs.json';
diff --git a/api_docs/cloud_defend.mdx b/api_docs/cloud_defend.mdx
index df770a4f04e89..1e519b6111a6e 100644
--- a/api_docs/cloud_defend.mdx
+++ b/api_docs/cloud_defend.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDefend
 title: "cloudDefend"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDefend plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDefend']
 ---
 import cloudDefendObj from './cloud_defend.devdocs.json';
diff --git a/api_docs/cloud_experiments.mdx b/api_docs/cloud_experiments.mdx
index d3904afff1417..72b099491f954 100644
--- a/api_docs/cloud_experiments.mdx
+++ b/api_docs/cloud_experiments.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudExperiments
 title: "cloudExperiments"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudExperiments plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudExperiments']
 ---
 import cloudExperimentsObj from './cloud_experiments.devdocs.json';
diff --git a/api_docs/cloud_security_posture.mdx b/api_docs/cloud_security_posture.mdx
index 990ab1988d90b..55990918e4035 100644
--- a/api_docs/cloud_security_posture.mdx
+++ b/api_docs/cloud_security_posture.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudSecurityPosture
 title: "cloudSecurityPosture"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudSecurityPosture plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudSecurityPosture']
 ---
 import cloudSecurityPostureObj from './cloud_security_posture.devdocs.json';
diff --git a/api_docs/console.mdx b/api_docs/console.mdx
index 71c4d57113721..ff5bc21ddb6bc 100644
--- a/api_docs/console.mdx
+++ b/api_docs/console.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/console
 title: "console"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the console plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'console']
 ---
 import consoleObj from './console.devdocs.json';
diff --git a/api_docs/content_management.devdocs.json b/api_docs/content_management.devdocs.json
index 338c6568fdb4d..191b6341bb3b0 100644
--- a/api_docs/content_management.devdocs.json
+++ b/api_docs/content_management.devdocs.json
@@ -17,7 +17,22 @@
       "path": "src/plugins/content_management/public/types.ts",
       "deprecated": false,
       "trackAdoption": false,
-      "children": [],
+      "children": [
+        {
+          "parentPluginId": "contentManagement",
+          "id": "def-public.ContentManagementPublicStart.client",
+          "type": "Object",
+          "tags": [],
+          "label": "client",
+          "description": [],
+          "signature": [
+            "ContentClient"
+          ],
+          "path": "src/plugins/content_management/public/types.ts",
+          "deprecated": false,
+          "trackAdoption": false
+        }
+      ],
       "lifecycle": "start",
       "initialIsOpen": true
     }
@@ -61,7 +76,192 @@
   "common": {
     "classes": [],
     "functions": [],
-    "interfaces": [],
+    "interfaces": [
+      {
+        "parentPluginId": "contentManagement",
+        "id": "def-common.CreateIn",
+        "type": "Interface",
+        "tags": [],
+        "label": "CreateIn",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "contentManagement",
+            "scope": "common",
+            "docId": "kibContentManagementPluginApi",
+            "section": "def-common.CreateIn",
+            "text": "CreateIn"
+          },
+          "<T, Data, Options>"
+        ],
+        "path": "src/plugins/content_management/common/rpc.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.CreateIn.contentType",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "contentType",
+            "description": [],
+            "signature": [
+              "T"
+            ],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.CreateIn.data",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "data",
+            "description": [],
+            "signature": [
+              "Data"
+            ],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.CreateIn.options",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "options",
+            "description": [],
+            "signature": [
+              "Options | undefined"
+            ],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "contentManagement",
+        "id": "def-common.GetIn",
+        "type": "Interface",
+        "tags": [],
+        "label": "GetIn",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "contentManagement",
+            "scope": "common",
+            "docId": "kibContentManagementPluginApi",
+            "section": "def-common.GetIn",
+            "text": "GetIn"
+          },
+          "<Options>"
+        ],
+        "path": "src/plugins/content_management/common/rpc.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.GetIn.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.GetIn.contentType",
+            "type": "string",
+            "tags": [],
+            "label": "contentType",
+            "description": [],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.GetIn.options",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "options",
+            "description": [],
+            "signature": [
+              "Options | undefined"
+            ],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "contentManagement",
+        "id": "def-common.ProcedureSchemas",
+        "type": "Interface",
+        "tags": [],
+        "label": "ProcedureSchemas",
+        "description": [],
+        "path": "src/plugins/content_management/common/rpc.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.ProcedureSchemas.in",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "in",
+            "description": [],
+            "signature": [
+              "false | ",
+              {
+                "pluginId": "@kbn/config-schema",
+                "scope": "common",
+                "docId": "kibKbnConfigSchemaPluginApi",
+                "section": "def-common.Type",
+                "text": "Type"
+              },
+              "<any> | undefined"
+            ],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.ProcedureSchemas.out",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "out",
+            "description": [],
+            "signature": [
+              "false | ",
+              {
+                "pluginId": "@kbn/config-schema",
+                "scope": "common",
+                "docId": "kibKbnConfigSchemaPluginApi",
+                "section": "def-common.Type",
+                "text": "Type"
+              },
+              "<any> | undefined"
+            ],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
     "enums": [],
     "misc": [
       {
@@ -93,8 +293,93 @@
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "contentManagement",
+        "id": "def-common.ProcedureName",
+        "type": "Type",
+        "tags": [],
+        "label": "ProcedureName",
+        "description": [],
+        "signature": [
+          "\"get\" | \"create\""
+        ],
+        "path": "src/plugins/content_management/common/rpc.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
       }
     ],
-    "objects": []
+    "objects": [
+      {
+        "parentPluginId": "contentManagement",
+        "id": "def-common.procedureNames",
+        "type": "Object",
+        "tags": [],
+        "label": "procedureNames",
+        "description": [],
+        "signature": [
+          "readonly [\"get\", \"create\"]"
+        ],
+        "path": "src/plugins/content_management/common/rpc.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "contentManagement",
+        "id": "def-common.schemas",
+        "type": "Object",
+        "tags": [],
+        "label": "schemas",
+        "description": [],
+        "path": "src/plugins/content_management/common/rpc.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.schemas.get",
+            "type": "Object",
+            "tags": [],
+            "label": "get",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "contentManagement",
+                "scope": "common",
+                "docId": "kibContentManagementPluginApi",
+                "section": "def-common.ProcedureSchemas",
+                "text": "ProcedureSchemas"
+              }
+            ],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "contentManagement",
+            "id": "def-common.schemas.create",
+            "type": "Object",
+            "tags": [],
+            "label": "create",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "contentManagement",
+                "scope": "common",
+                "docId": "kibContentManagementPluginApi",
+                "section": "def-common.ProcedureSchemas",
+                "text": "ProcedureSchemas"
+              }
+            ],
+            "path": "src/plugins/content_management/common/rpc.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ]
   }
 }
\ No newline at end of file
diff --git a/api_docs/content_management.mdx b/api_docs/content_management.mdx
index e7cf55833194e..b6960949cd248 100644
--- a/api_docs/content_management.mdx
+++ b/api_docs/content_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/contentManagement
 title: "contentManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the contentManagement plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'contentManagement']
 ---
 import contentManagementObj from './content_management.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-global-experience](https://github.com/orgs/elastic/team
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 5 | 0 | 5 | 0 |
+| 22 | 0 | 22 | 1 |
 
 ## Client
 
@@ -38,6 +38,12 @@ Contact [@elastic/kibana-global-experience](https://github.com/orgs/elastic/team
 
 ## Common
 
+### Objects
+<DocDefinitionList data={contentManagementObj.common.objects}/>
+
+### Interfaces
+<DocDefinitionList data={contentManagementObj.common.interfaces}/>
+
 ### Consts, variables and types
 <DocDefinitionList data={contentManagementObj.common.misc}/>
 
diff --git a/api_docs/controls.mdx b/api_docs/controls.mdx
index 0e6b485d34eab..6b4e0c8f5605e 100644
--- a/api_docs/controls.mdx
+++ b/api_docs/controls.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/controls
 title: "controls"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the controls plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'controls']
 ---
 import controlsObj from './controls.devdocs.json';
diff --git a/api_docs/core.devdocs.json b/api_docs/core.devdocs.json
index 4c82e4fc45cc0..f9698898bc46e 100644
--- a/api_docs/core.devdocs.json
+++ b/api_docs/core.devdocs.json
@@ -23432,6 +23432,17 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.CspConfig.disableUnsafeEval",
+            "type": "boolean",
+            "tags": [],
+            "label": "disableUnsafeEval",
+            "description": [],
+            "path": "packages/core/http/core-http-server-internal/src/csp/csp_config.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "core",
             "id": "def-server.CspConfig.warnLegacyBrowsers",
@@ -62931,6 +62942,55 @@
             "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsType.modelVersions",
+            "type": "CompoundType",
+            "tags": [
+              "alpha"
+            ],
+            "label": "modelVersions",
+            "description": [
+              "\nA map of model versions associated with this type.\n\nModel versions supersede the {@link SavedObjectsType.migrations | migrations} (and {@link SavedObjectsType.schemas | schemas}) APIs\nby exposing an unified way of describing the changes of shape or data of the type.\n\nModel versioning is decoupled from Kibana versioning, and isolated between types.\nModel versions are identified by a single numeric value, starting at `1` and without gaps.\n\nPlease refer to {@link SavedObjectsModelVersion} for details on the API's usages.\n\nA **valid** versioning would be:\n\n```ts\n{\n  name: 'foo',\n  // other mandatory attributes...\n  modelVersions: {\n    '1': modelVersion1,\n    '2': modelVersion2,\n    '3': modelVersion3,\n  }\n}\n```\n\nA **invalid** versioning would be:\n\n```ts\n{\n  name: 'foo',\n  // other mandatory attributes...\n  modelVersions: {\n    '1': modelVersion1,\n    '3': modelVersion3, // ERROR, no model version 2\n    '3.1': modelVersion31, // ERROR, model version is a single numeric value\n  }\n}\n```\n"
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsModelVersionMap",
+                "text": "SavedObjectsModelVersionMap"
+              },
+              " | ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsModelVersionMapProvider",
+                "text": "SavedObjectsModelVersionMapProvider"
+              },
+              " | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsType.switchToModelVersionAt",
+            "type": "string",
+            "tags": [],
+            "label": "switchToModelVersionAt",
+            "description": [
+              "\nAllows to opt-in to the new model version API.\n\nMust be a valid semver version (with the patch version being necessarily 0)\n\nWhen specified, the type will switch from using the {@link SavedObjectsType.migrations | legacy migration API}\nto use the {@link SavedObjectsType.modelVersions | modelVersion API} after the specified version.\n\nWhen opted in, it will no longer be possible to use the legacy migration API after the specified version.\n\nA **valid** usage example would be:\n\n```ts\n{\n  name: 'foo',\n  // other mandatory attributes...\n  switchToModelVersionAt: '8.8.0',\n  migrations: {\n    '8.1.0': migrateTo810,\n    '8.7.0': migrateTo870,\n  },\n  modelVersions: {\n    '1': modelVersion1\n  }\n}\n```\n\nAn **invalid** usage example would be:\n\n```ts\n{\n  name: 'foo',\n  // other mandatory attributes...\n  switchToModelVersionAt: '8.9.0',\n  migrations: {\n    '8.1.0': migrateTo8_1,\n    '8.9.0': migrateTo8_9, // error: migration registered for the switch version\n    '8.10.0': migrateTo8_10, // error: migration registered for after the switch version\n  },\n  modelVersions: {\n    '1': modelVersion1\n  }\n}\n```\n\nPlease refer to the {@link SavedObjectsType.modelVersions | modelVersion API} for more documentation on\nthe new API.\n"
+            ],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/core.mdx b/api_docs/core.mdx
index 98ade83d17019..04a997143d21b 100644
--- a/api_docs/core.mdx
+++ b/api_docs/core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/core
 title: "core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the core plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core']
 ---
 import coreObj from './core.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 2845 | 17 | 1029 | 0 |
+| 2848 | 17 | 1030 | 0 |
 
 ## Client
 
diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx
index 11e0ff18cd678..abac3f825321a 100644
--- a/api_docs/custom_integrations.mdx
+++ b/api_docs/custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/customIntegrations
 title: "customIntegrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the customIntegrations plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'customIntegrations']
 ---
 import customIntegrationsObj from './custom_integrations.devdocs.json';
diff --git a/api_docs/dashboard.devdocs.json b/api_docs/dashboard.devdocs.json
index 7a51fb8b8f8a7..f65ebc3b42b65 100644
--- a/api_docs/dashboard.devdocs.json
+++ b/api_docs/dashboard.devdocs.json
@@ -876,7 +876,7 @@
                 "section": "def-common.PanelState",
                 "text": "PanelState"
               },
-              "<{ id: string; }>>, generateNewId?: boolean | undefined) => Promise<void>"
+              "<{ id: string; }>>, generateNewId?: boolean | undefined) => Promise<string>"
             ],
             "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
             "deprecated": false,
@@ -1094,7 +1094,7 @@
                 "section": "def-public.DashboardContainer",
                 "text": "DashboardContainer"
               },
-              ", type: string, explicitInput: Partial<EEI>, embeddableId?: string | undefined) => Promise<void | ",
+              ", type: string, explicitInput: Partial<EEI>, embeddableId?: string | undefined) => Promise<string | ",
               {
                 "pluginId": "embeddable",
                 "scope": "public",
diff --git a/api_docs/dashboard.mdx b/api_docs/dashboard.mdx
index 30d924a498aee..6a36650dd0299 100644
--- a/api_docs/dashboard.mdx
+++ b/api_docs/dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboard
 title: "dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboard plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboard']
 ---
 import dashboardObj from './dashboard.devdocs.json';
diff --git a/api_docs/dashboard_enhanced.mdx b/api_docs/dashboard_enhanced.mdx
index 0b50bda4b45cd..a58e5a17d3173 100644
--- a/api_docs/dashboard_enhanced.mdx
+++ b/api_docs/dashboard_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboardEnhanced
 title: "dashboardEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboardEnhanced plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboardEnhanced']
 ---
 import dashboardEnhancedObj from './dashboard_enhanced.devdocs.json';
diff --git a/api_docs/data.devdocs.json b/api_docs/data.devdocs.json
index 2760bc6c34e27..e45037b395b16 100644
--- a/api_docs/data.devdocs.json
+++ b/api_docs/data.devdocs.json
@@ -15040,6 +15040,10 @@
                 "plugin": "dataViewManagement",
                 "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
               },
+              {
+                "plugin": "dataViewManagement",
+                "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
+              },
               {
                 "plugin": "dataViews",
                 "path": "src/plugins/data_views/common/data_views/data_view.test.ts"
@@ -22647,6 +22651,10 @@
                 "plugin": "dataViewManagement",
                 "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
               },
+              {
+                "plugin": "dataViewManagement",
+                "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
+              },
               {
                 "plugin": "dataViews",
                 "path": "src/plugins/data_views/common/data_views/data_view.test.ts"
diff --git a/api_docs/data.mdx b/api_docs/data.mdx
index 4a319348aef3b..641772aeb00d6 100644
--- a/api_docs/data.mdx
+++ b/api_docs/data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data
 title: "data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data']
 ---
 import dataObj from './data.devdocs.json';
diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx
index c4eb3f5f85c0d..a36d52cb234dd 100644
--- a/api_docs/data_query.mdx
+++ b/api_docs/data_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-query
 title: "data.query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.query plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.query']
 ---
 import dataQueryObj from './data_query.devdocs.json';
diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx
index 98409cf43954f..bccab23f18514 100644
--- a/api_docs/data_search.mdx
+++ b/api_docs/data_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-search
 title: "data.search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.search plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.search']
 ---
 import dataSearchObj from './data_search.devdocs.json';
diff --git a/api_docs/data_view_editor.mdx b/api_docs/data_view_editor.mdx
index fc0cd6752eb1c..310813248be79 100644
--- a/api_docs/data_view_editor.mdx
+++ b/api_docs/data_view_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewEditor
 title: "dataViewEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewEditor plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewEditor']
 ---
 import dataViewEditorObj from './data_view_editor.devdocs.json';
diff --git a/api_docs/data_view_field_editor.mdx b/api_docs/data_view_field_editor.mdx
index aca829f9055ee..b08a8d1c481f5 100644
--- a/api_docs/data_view_field_editor.mdx
+++ b/api_docs/data_view_field_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewFieldEditor
 title: "dataViewFieldEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewFieldEditor plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewFieldEditor']
 ---
 import dataViewFieldEditorObj from './data_view_field_editor.devdocs.json';
diff --git a/api_docs/data_view_management.mdx b/api_docs/data_view_management.mdx
index 63782947a7d1b..7e53119bc73f6 100644
--- a/api_docs/data_view_management.mdx
+++ b/api_docs/data_view_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewManagement
 title: "dataViewManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewManagement plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewManagement']
 ---
 import dataViewManagementObj from './data_view_management.devdocs.json';
diff --git a/api_docs/data_views.devdocs.json b/api_docs/data_views.devdocs.json
index 7a30addcc1725..683efe42f2752 100644
--- a/api_docs/data_views.devdocs.json
+++ b/api_docs/data_views.devdocs.json
@@ -1530,6 +1530,10 @@
                 "plugin": "dataViewManagement",
                 "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
               },
+              {
+                "plugin": "dataViewManagement",
+                "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
+              },
               {
                 "plugin": "visTypeTimeseries",
                 "path": "src/plugins/vis_types/timeseries/public/application/lib/fetch_fields.ts"
@@ -9722,6 +9726,10 @@
                 "plugin": "dataViewManagement",
                 "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
               },
+              {
+                "plugin": "dataViewManagement",
+                "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
+              },
               {
                 "plugin": "visTypeTimeseries",
                 "path": "src/plugins/vis_types/timeseries/public/application/lib/fetch_fields.ts"
@@ -17009,6 +17017,10 @@
                 "plugin": "dataViewManagement",
                 "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
               },
+              {
+                "plugin": "dataViewManagement",
+                "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx"
+              },
               {
                 "plugin": "visTypeTimeseries",
                 "path": "src/plugins/vis_types/timeseries/public/application/lib/fetch_fields.ts"
diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx
index 9a8f7e7172efc..e45421b10e193 100644
--- a/api_docs/data_views.mdx
+++ b/api_docs/data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViews
 title: "dataViews"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViews plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViews']
 ---
 import dataViewsObj from './data_views.devdocs.json';
diff --git a/api_docs/data_visualizer.mdx b/api_docs/data_visualizer.mdx
index d6a01cccb285c..b7ac68d20045d 100644
--- a/api_docs/data_visualizer.mdx
+++ b/api_docs/data_visualizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataVisualizer
 title: "dataVisualizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataVisualizer plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataVisualizer']
 ---
 import dataVisualizerObj from './data_visualizer.devdocs.json';
diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx
index e5e89e69a1a14..d98b577c8c240 100644
--- a/api_docs/deprecations_by_api.mdx
+++ b/api_docs/deprecations_by_api.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByApi
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-api
 title: Deprecated API usage by API
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx
index 1c078353fcc59..7785577922539 100644
--- a/api_docs/deprecations_by_plugin.mdx
+++ b/api_docs/deprecations_by_plugin.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByPlugin
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-plugin
 title: Deprecated API usage by plugin
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -667,15 +667,15 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | ---------------|-----------|-----------|
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.title" text="title"/> | [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [test_script.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/components/scripting_help/test_script.tsx#:~:text=title), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=title), [create_edit_field.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/create_edit_field/create_edit_field.tsx#:~:text=title), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [test_script.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/components/scripting_help/test_script.tsx#:~:text=title), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=title), [create_edit_field.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/create_edit_field/create_edit_field.tsx#:~:text=title) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.removeScriptedField" text="removeScriptedField"/> | [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=removeScriptedField), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=removeScriptedField), [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=removeScriptedField), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=removeScriptedField) | - |
-| <DocLink id="kibDataPluginApi" section="def-common.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields) | - |
+| <DocLink id="kibDataPluginApi" section="def-common.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields) | - |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.getScriptedFields" text="getScriptedFields"/> | [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=getScriptedFields), [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=getScriptedFields) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.title" text="title"/> | [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [test_script.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/components/scripting_help/test_script.tsx#:~:text=title), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=title), [create_edit_field.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/create_edit_field/create_edit_field.tsx#:~:text=title), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [test_script.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/components/scripting_help/test_script.tsx#:~:text=title), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=title), [create_edit_field.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/create_edit_field/create_edit_field.tsx#:~:text=title) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.removeScriptedField" text="removeScriptedField"/> | [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=removeScriptedField), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=removeScriptedField), [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=removeScriptedField), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=removeScriptedField) | - |
-| <DocLink id="kibDataPluginApi" section="def-server.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields) | - |
+| <DocLink id="kibDataPluginApi" section="def-server.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields) | - |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.getScriptedFields" text="getScriptedFields"/> | [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=getScriptedFields), [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=getScriptedFields) | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.title" text="title"/> | [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=title), [test_script.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/components/scripting_help/test_script.tsx#:~:text=title), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=title), [create_edit_field.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/create_edit_field/create_edit_field.tsx#:~:text=title) | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.removeScriptedField" text="removeScriptedField"/> | [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=removeScriptedField), [field_editor.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/field_editor/field_editor.tsx#:~:text=removeScriptedField) | - |
-| <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields) | - |
+| <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.getNonScriptedFields" text="getNonScriptedFields"/> | [table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields), [edit_index_pattern.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx#:~:text=getNonScriptedFields) | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.getScriptedFields" text="getScriptedFields"/> | [scripted_fields_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx#:~:text=getScriptedFields) | - |
 
 
diff --git a/api_docs/deprecations_by_team.mdx b/api_docs/deprecations_by_team.mdx
index 4ab6c7239919f..7ed175273aff5 100644
--- a/api_docs/deprecations_by_team.mdx
+++ b/api_docs/deprecations_by_team.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsDueByTeam
 slug: /kibana-dev-docs/api-meta/deprecations-due-by-team
 title: Deprecated APIs due to be removed, by team
 description: Lists the teams that are referencing deprecated APIs with a remove by date.
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
diff --git a/api_docs/dev_tools.mdx b/api_docs/dev_tools.mdx
index 56812df7a1d37..01d6abca8a3ff 100644
--- a/api_docs/dev_tools.mdx
+++ b/api_docs/dev_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/devTools
 title: "devTools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the devTools plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'devTools']
 ---
 import devToolsObj from './dev_tools.devdocs.json';
diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx
index 1e26ab13c2deb..b582a8ab7082d 100644
--- a/api_docs/discover.mdx
+++ b/api_docs/discover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discover
 title: "discover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discover plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discover']
 ---
 import discoverObj from './discover.devdocs.json';
diff --git a/api_docs/discover_enhanced.mdx b/api_docs/discover_enhanced.mdx
index 3dc9d5192dcf4..95d841d278fa9 100644
--- a/api_docs/discover_enhanced.mdx
+++ b/api_docs/discover_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discoverEnhanced
 title: "discoverEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discoverEnhanced plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverEnhanced']
 ---
 import discoverEnhancedObj from './discover_enhanced.devdocs.json';
diff --git a/api_docs/ecs_data_quality_dashboard.mdx b/api_docs/ecs_data_quality_dashboard.mdx
index d24bd912d018b..b9ef67e54beb0 100644
--- a/api_docs/ecs_data_quality_dashboard.mdx
+++ b/api_docs/ecs_data_quality_dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ecsDataQualityDashboard
 title: "ecsDataQualityDashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ecsDataQualityDashboard plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ecsDataQualityDashboard']
 ---
 import ecsDataQualityDashboardObj from './ecs_data_quality_dashboard.devdocs.json';
diff --git a/api_docs/embeddable.mdx b/api_docs/embeddable.mdx
index e960942ffc7ac..74e447101a8d6 100644
--- a/api_docs/embeddable.mdx
+++ b/api_docs/embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddable
 title: "embeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddable plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddable']
 ---
 import embeddableObj from './embeddable.devdocs.json';
diff --git a/api_docs/embeddable_enhanced.mdx b/api_docs/embeddable_enhanced.mdx
index 81b3dc703df6c..3ea0c6c5a1004 100644
--- a/api_docs/embeddable_enhanced.mdx
+++ b/api_docs/embeddable_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddableEnhanced
 title: "embeddableEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddableEnhanced plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddableEnhanced']
 ---
 import embeddableEnhancedObj from './embeddable_enhanced.devdocs.json';
diff --git a/api_docs/encrypted_saved_objects.mdx b/api_docs/encrypted_saved_objects.mdx
index 3d02811b73d7c..4d6b875f064f3 100644
--- a/api_docs/encrypted_saved_objects.mdx
+++ b/api_docs/encrypted_saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/encryptedSavedObjects
 title: "encryptedSavedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the encryptedSavedObjects plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'encryptedSavedObjects']
 ---
 import encryptedSavedObjectsObj from './encrypted_saved_objects.devdocs.json';
diff --git a/api_docs/enterprise_search.mdx b/api_docs/enterprise_search.mdx
index 9f4d87207eb71..6ea8c2cfdc964 100644
--- a/api_docs/enterprise_search.mdx
+++ b/api_docs/enterprise_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/enterpriseSearch
 title: "enterpriseSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the enterpriseSearch plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'enterpriseSearch']
 ---
 import enterpriseSearchObj from './enterprise_search.devdocs.json';
diff --git a/api_docs/es_ui_shared.mdx b/api_docs/es_ui_shared.mdx
index 6f1afc25be0de..1d502a267de4c 100644
--- a/api_docs/es_ui_shared.mdx
+++ b/api_docs/es_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/esUiShared
 title: "esUiShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the esUiShared plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'esUiShared']
 ---
 import esUiSharedObj from './es_ui_shared.devdocs.json';
diff --git a/api_docs/event_annotation.mdx b/api_docs/event_annotation.mdx
index 0051a373b10dc..e613aec503e91 100644
--- a/api_docs/event_annotation.mdx
+++ b/api_docs/event_annotation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotation
 title: "eventAnnotation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotation plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotation']
 ---
 import eventAnnotationObj from './event_annotation.devdocs.json';
diff --git a/api_docs/event_log.mdx b/api_docs/event_log.mdx
index 389b02648a8ea..f0997f74e72bb 100644
--- a/api_docs/event_log.mdx
+++ b/api_docs/event_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventLog
 title: "eventLog"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventLog plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventLog']
 ---
 import eventLogObj from './event_log.devdocs.json';
diff --git a/api_docs/expression_error.mdx b/api_docs/expression_error.mdx
index 5f28b2b8ca52b..ac72fd3254383 100644
--- a/api_docs/expression_error.mdx
+++ b/api_docs/expression_error.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionError
 title: "expressionError"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionError plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionError']
 ---
 import expressionErrorObj from './expression_error.devdocs.json';
diff --git a/api_docs/expression_gauge.mdx b/api_docs/expression_gauge.mdx
index 8c8835a3e342b..b832096373d3e 100644
--- a/api_docs/expression_gauge.mdx
+++ b/api_docs/expression_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionGauge
 title: "expressionGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionGauge plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionGauge']
 ---
 import expressionGaugeObj from './expression_gauge.devdocs.json';
diff --git a/api_docs/expression_heatmap.mdx b/api_docs/expression_heatmap.mdx
index 08243c1f43720..9fa3043100d66 100644
--- a/api_docs/expression_heatmap.mdx
+++ b/api_docs/expression_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionHeatmap
 title: "expressionHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionHeatmap plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionHeatmap']
 ---
 import expressionHeatmapObj from './expression_heatmap.devdocs.json';
diff --git a/api_docs/expression_image.mdx b/api_docs/expression_image.mdx
index c391a56806965..f90dc600273e1 100644
--- a/api_docs/expression_image.mdx
+++ b/api_docs/expression_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionImage
 title: "expressionImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionImage plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionImage']
 ---
 import expressionImageObj from './expression_image.devdocs.json';
diff --git a/api_docs/expression_legacy_metric_vis.mdx b/api_docs/expression_legacy_metric_vis.mdx
index ece42bacfcfcd..47ae9efe174a8 100644
--- a/api_docs/expression_legacy_metric_vis.mdx
+++ b/api_docs/expression_legacy_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionLegacyMetricVis
 title: "expressionLegacyMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionLegacyMetricVis plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionLegacyMetricVis']
 ---
 import expressionLegacyMetricVisObj from './expression_legacy_metric_vis.devdocs.json';
diff --git a/api_docs/expression_metric.mdx b/api_docs/expression_metric.mdx
index caa39ea326958..4c033f6a5e918 100644
--- a/api_docs/expression_metric.mdx
+++ b/api_docs/expression_metric.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetric
 title: "expressionMetric"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetric plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetric']
 ---
 import expressionMetricObj from './expression_metric.devdocs.json';
diff --git a/api_docs/expression_metric_vis.mdx b/api_docs/expression_metric_vis.mdx
index 338a5a7cb0f43..79cd19c112954 100644
--- a/api_docs/expression_metric_vis.mdx
+++ b/api_docs/expression_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetricVis
 title: "expressionMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetricVis plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetricVis']
 ---
 import expressionMetricVisObj from './expression_metric_vis.devdocs.json';
diff --git a/api_docs/expression_partition_vis.mdx b/api_docs/expression_partition_vis.mdx
index 961157460f1a6..a26eda9594dd6 100644
--- a/api_docs/expression_partition_vis.mdx
+++ b/api_docs/expression_partition_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionPartitionVis
 title: "expressionPartitionVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionPartitionVis plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionPartitionVis']
 ---
 import expressionPartitionVisObj from './expression_partition_vis.devdocs.json';
diff --git a/api_docs/expression_repeat_image.mdx b/api_docs/expression_repeat_image.mdx
index 8a9499ea73f28..8f2aa24fbf52d 100644
--- a/api_docs/expression_repeat_image.mdx
+++ b/api_docs/expression_repeat_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRepeatImage
 title: "expressionRepeatImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRepeatImage plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRepeatImage']
 ---
 import expressionRepeatImageObj from './expression_repeat_image.devdocs.json';
diff --git a/api_docs/expression_reveal_image.mdx b/api_docs/expression_reveal_image.mdx
index 619626f6e0814..8ebf1cb95670f 100644
--- a/api_docs/expression_reveal_image.mdx
+++ b/api_docs/expression_reveal_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRevealImage
 title: "expressionRevealImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRevealImage plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRevealImage']
 ---
 import expressionRevealImageObj from './expression_reveal_image.devdocs.json';
diff --git a/api_docs/expression_shape.mdx b/api_docs/expression_shape.mdx
index fea5fd680ebc3..ff4341f5d4251 100644
--- a/api_docs/expression_shape.mdx
+++ b/api_docs/expression_shape.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionShape
 title: "expressionShape"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionShape plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionShape']
 ---
 import expressionShapeObj from './expression_shape.devdocs.json';
diff --git a/api_docs/expression_tagcloud.mdx b/api_docs/expression_tagcloud.mdx
index be59582602b8c..c85eda0ebf2ae 100644
--- a/api_docs/expression_tagcloud.mdx
+++ b/api_docs/expression_tagcloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionTagcloud
 title: "expressionTagcloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionTagcloud plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionTagcloud']
 ---
 import expressionTagcloudObj from './expression_tagcloud.devdocs.json';
diff --git a/api_docs/expression_x_y.mdx b/api_docs/expression_x_y.mdx
index 6fe27e22692ac..7c2fb48e77aa5 100644
--- a/api_docs/expression_x_y.mdx
+++ b/api_docs/expression_x_y.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionXY
 title: "expressionXY"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionXY plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionXY']
 ---
 import expressionXYObj from './expression_x_y.devdocs.json';
diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx
index facc51eb94450..72f38cbcf706c 100644
--- a/api_docs/expressions.mdx
+++ b/api_docs/expressions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressions
 title: "expressions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressions plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressions']
 ---
 import expressionsObj from './expressions.devdocs.json';
diff --git a/api_docs/features.mdx b/api_docs/features.mdx
index b2c0f12638ddc..dd358f351027e 100644
--- a/api_docs/features.mdx
+++ b/api_docs/features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/features
 title: "features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the features plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'features']
 ---
 import featuresObj from './features.devdocs.json';
diff --git a/api_docs/field_formats.mdx b/api_docs/field_formats.mdx
index ed72a41dc4fa6..aba2831e7ceb5 100644
--- a/api_docs/field_formats.mdx
+++ b/api_docs/field_formats.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fieldFormats
 title: "fieldFormats"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fieldFormats plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fieldFormats']
 ---
 import fieldFormatsObj from './field_formats.devdocs.json';
diff --git a/api_docs/file_upload.mdx b/api_docs/file_upload.mdx
index d1398101e0fcc..92fffad68e1e7 100644
--- a/api_docs/file_upload.mdx
+++ b/api_docs/file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fileUpload
 title: "fileUpload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fileUpload plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fileUpload']
 ---
 import fileUploadObj from './file_upload.devdocs.json';
diff --git a/api_docs/files.mdx b/api_docs/files.mdx
index e72ef4a7726ff..cfcd4ef908577 100644
--- a/api_docs/files.mdx
+++ b/api_docs/files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/files
 title: "files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the files plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'files']
 ---
 import filesObj from './files.devdocs.json';
diff --git a/api_docs/files_management.mdx b/api_docs/files_management.mdx
index ae937b38ab5dd..1e9862d13ff31 100644
--- a/api_docs/files_management.mdx
+++ b/api_docs/files_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/filesManagement
 title: "filesManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the filesManagement plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'filesManagement']
 ---
 import filesManagementObj from './files_management.devdocs.json';
diff --git a/api_docs/fleet.devdocs.json b/api_docs/fleet.devdocs.json
index b50d330b5bfd7..b5be9409262d9 100644
--- a/api_docs/fleet.devdocs.json
+++ b/api_docs/fleet.devdocs.json
@@ -17584,7 +17584,7 @@
             "label": "agent",
             "description": [],
             "signature": [
-              "{ monitoring: { namespace?: string | undefined; use_output?: string | undefined; enabled: boolean; metrics: boolean; logs: boolean; }; download: { sourceURI: string; }; } | undefined"
+              "{ monitoring: { namespace?: string | undefined; use_output?: string | undefined; enabled: boolean; metrics: boolean; logs: boolean; }; download: { sourceURI: string; }; features: Record<string, { enabled: boolean; }>; } | undefined"
             ],
             "path": "x-pack/plugins/fleet/common/types/models/agent_policy.ts",
             "deprecated": false,
@@ -19167,6 +19167,20 @@
             "path": "x-pack/plugins/fleet/common/types/models/agent_policy.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "fleet",
+            "id": "def-common.NewAgentPolicy.agent_features",
+            "type": "Array",
+            "tags": [],
+            "label": "agent_features",
+            "description": [],
+            "signature": [
+              "{ name: string; enabled: boolean; }[] | undefined"
+            ],
+            "path": "x-pack/plugins/fleet/common/types/models/agent_policy.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx
index 5619c453e6e7f..f9f2f24138784 100644
--- a/api_docs/fleet.mdx
+++ b/api_docs/fleet.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fleet
 title: "fleet"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fleet plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fleet']
 ---
 import fleetObj from './fleet.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Fleet](https://github.com/orgs/elastic/teams/fleet) for questions regar
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 1068 | 3 | 963 | 26 |
+| 1069 | 3 | 964 | 26 |
 
 ## Client
 
diff --git a/api_docs/global_search.mdx b/api_docs/global_search.mdx
index 98efd78f2657a..a6403e4ca59f1 100644
--- a/api_docs/global_search.mdx
+++ b/api_docs/global_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/globalSearch
 title: "globalSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the globalSearch plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'globalSearch']
 ---
 import globalSearchObj from './global_search.devdocs.json';
diff --git a/api_docs/guided_onboarding.mdx b/api_docs/guided_onboarding.mdx
index e18937f0e4b0e..2822ee9463157 100644
--- a/api_docs/guided_onboarding.mdx
+++ b/api_docs/guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/guidedOnboarding
 title: "guidedOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the guidedOnboarding plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'guidedOnboarding']
 ---
 import guidedOnboardingObj from './guided_onboarding.devdocs.json';
diff --git a/api_docs/home.mdx b/api_docs/home.mdx
index 4878e8d8fad62..b8812dca0b8a6 100644
--- a/api_docs/home.mdx
+++ b/api_docs/home.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/home
 title: "home"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the home plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'home']
 ---
 import homeObj from './home.devdocs.json';
diff --git a/api_docs/image_embeddable.mdx b/api_docs/image_embeddable.mdx
index e9147a31f60d1..038ab616592e5 100644
--- a/api_docs/image_embeddable.mdx
+++ b/api_docs/image_embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/imageEmbeddable
 title: "imageEmbeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the imageEmbeddable plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'imageEmbeddable']
 ---
 import imageEmbeddableObj from './image_embeddable.devdocs.json';
diff --git a/api_docs/index_lifecycle_management.mdx b/api_docs/index_lifecycle_management.mdx
index 60011f99267e6..e5727037baf62 100644
--- a/api_docs/index_lifecycle_management.mdx
+++ b/api_docs/index_lifecycle_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexLifecycleManagement
 title: "indexLifecycleManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexLifecycleManagement plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexLifecycleManagement']
 ---
 import indexLifecycleManagementObj from './index_lifecycle_management.devdocs.json';
diff --git a/api_docs/index_management.mdx b/api_docs/index_management.mdx
index 709f27c8dbca9..ec494ff345957 100644
--- a/api_docs/index_management.mdx
+++ b/api_docs/index_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexManagement
 title: "indexManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexManagement plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexManagement']
 ---
 import indexManagementObj from './index_management.devdocs.json';
diff --git a/api_docs/infra.mdx b/api_docs/infra.mdx
index 56bb5ed0e56dd..37fe8b8f2cb86 100644
--- a/api_docs/infra.mdx
+++ b/api_docs/infra.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/infra
 title: "infra"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the infra plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'infra']
 ---
 import infraObj from './infra.devdocs.json';
diff --git a/api_docs/inspector.mdx b/api_docs/inspector.mdx
index 4bc5f5a9f5ce9..5f8d797df6719 100644
--- a/api_docs/inspector.mdx
+++ b/api_docs/inspector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/inspector
 title: "inspector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the inspector plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'inspector']
 ---
 import inspectorObj from './inspector.devdocs.json';
diff --git a/api_docs/interactive_setup.mdx b/api_docs/interactive_setup.mdx
index af939ff0a6862..9b3e8d6409daf 100644
--- a/api_docs/interactive_setup.mdx
+++ b/api_docs/interactive_setup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/interactiveSetup
 title: "interactiveSetup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the interactiveSetup plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'interactiveSetup']
 ---
 import interactiveSetupObj from './interactive_setup.devdocs.json';
diff --git a/api_docs/kbn_ace.mdx b/api_docs/kbn_ace.mdx
index bd5959e7d82f3..677de56e3d211 100644
--- a/api_docs/kbn_ace.mdx
+++ b/api_docs/kbn_ace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ace
 title: "@kbn/ace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ace plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ace']
 ---
 import kbnAceObj from './kbn_ace.devdocs.json';
diff --git a/api_docs/kbn_aiops_components.mdx b/api_docs/kbn_aiops_components.mdx
index 8e82d362e6d17..ede2ec9b2a899 100644
--- a/api_docs/kbn_aiops_components.mdx
+++ b/api_docs/kbn_aiops_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-components
 title: "@kbn/aiops-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-components plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-components']
 ---
 import kbnAiopsComponentsObj from './kbn_aiops_components.devdocs.json';
diff --git a/api_docs/kbn_aiops_utils.mdx b/api_docs/kbn_aiops_utils.mdx
index 59618d0d654b1..12ace727a2a86 100644
--- a/api_docs/kbn_aiops_utils.mdx
+++ b/api_docs/kbn_aiops_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-utils
 title: "@kbn/aiops-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-utils']
 ---
 import kbnAiopsUtilsObj from './kbn_aiops_utils.devdocs.json';
diff --git a/api_docs/kbn_alerts.mdx b/api_docs/kbn_alerts.mdx
index b6dbebf027522..45812c6ee2511 100644
--- a/api_docs/kbn_alerts.mdx
+++ b/api_docs/kbn_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts
 title: "@kbn/alerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts']
 ---
 import kbnAlertsObj from './kbn_alerts.devdocs.json';
diff --git a/api_docs/kbn_alerts_ui_shared.devdocs.json b/api_docs/kbn_alerts_ui_shared.devdocs.json
new file mode 100644
index 0000000000000..7577f6d8519f5
--- /dev/null
+++ b/api_docs/kbn_alerts_ui_shared.devdocs.json
@@ -0,0 +1,119 @@
+{
+  "id": "@kbn/alerts-ui-shared",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [
+      {
+        "parentPluginId": "@kbn/alerts-ui-shared",
+        "id": "def-common.AlertLifecycleStatusBadge",
+        "type": "Function",
+        "tags": [],
+        "label": "AlertLifecycleStatusBadge",
+        "description": [],
+        "signature": [
+          "React.NamedExoticComponent<",
+          {
+            "pluginId": "@kbn/alerts-ui-shared",
+            "scope": "common",
+            "docId": "kibKbnAlertsUiSharedPluginApi",
+            "section": "def-common.AlertLifecycleStatusBadgeProps",
+            "text": "AlertLifecycleStatusBadgeProps"
+          },
+          "> & { readonly type: (props: ",
+          {
+            "pluginId": "@kbn/alerts-ui-shared",
+            "scope": "common",
+            "docId": "kibKbnAlertsUiSharedPluginApi",
+            "section": "def-common.AlertLifecycleStatusBadgeProps",
+            "text": "AlertLifecycleStatusBadgeProps"
+          },
+          ") => JSX.Element; }"
+        ],
+        "path": "packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [
+          {
+            "parentPluginId": "@kbn/alerts-ui-shared",
+            "id": "def-common.AlertLifecycleStatusBadge.$1",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "props",
+            "description": [],
+            "signature": [
+              "P"
+            ],
+            "path": "node_modules/@types/react/index.d.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/alerts-ui-shared",
+        "id": "def-common.AlertLifecycleStatusBadgeProps",
+        "type": "Interface",
+        "tags": [],
+        "label": "AlertLifecycleStatusBadgeProps",
+        "description": [],
+        "path": "packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/alerts-ui-shared",
+            "id": "def-common.AlertLifecycleStatusBadgeProps.alertStatus",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "alertStatus",
+            "description": [],
+            "signature": [
+              "\"recovered\" | \"active\""
+            ],
+            "path": "packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/alerts-ui-shared",
+            "id": "def-common.AlertLifecycleStatusBadgeProps.flapping",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "flapping",
+            "description": [],
+            "signature": [
+              "string | boolean | undefined"
+            ],
+            "path": "packages/kbn-alerts-ui-shared/src/alert_lifecycle_status_badge/index.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_alerts_ui_shared.mdx b/api_docs/kbn_alerts_ui_shared.mdx
new file mode 100644
index 0000000000000..b6ad53e41b2c9
--- /dev/null
+++ b/api_docs/kbn_alerts_ui_shared.mdx
@@ -0,0 +1,33 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnAlertsUiSharedPluginApi
+slug: /kibana-dev-docs/api/kbn-alerts-ui-shared
+title: "@kbn/alerts-ui-shared"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/alerts-ui-shared plugin
+date: 2023-02-08
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts-ui-shared']
+---
+import kbnAlertsUiSharedObj from './kbn_alerts_ui_shared.devdocs.json';
+
+
+
+Contact [Owner missing] for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 5 | 0 | 4 | 0 |
+
+## Common
+
+### Functions
+<DocDefinitionList data={kbnAlertsUiSharedObj.common.functions}/>
+
+### Interfaces
+<DocDefinitionList data={kbnAlertsUiSharedObj.common.interfaces}/>
+
diff --git a/api_docs/kbn_analytics.mdx b/api_docs/kbn_analytics.mdx
index f01e1f34223d4..2e658ae6c9565 100644
--- a/api_docs/kbn_analytics.mdx
+++ b/api_docs/kbn_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics
 title: "@kbn/analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics']
 ---
 import kbnAnalyticsObj from './kbn_analytics.devdocs.json';
diff --git a/api_docs/kbn_analytics_client.mdx b/api_docs/kbn_analytics_client.mdx
index 4fb8f6e1b58cd..0bf7133dca38b 100644
--- a/api_docs/kbn_analytics_client.mdx
+++ b/api_docs/kbn_analytics_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-client
 title: "@kbn/analytics-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-client plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-client']
 ---
 import kbnAnalyticsClientObj from './kbn_analytics_client.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
index e9d4ca59b0c2a..c9d24795e3a7a 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-browser
 title: "@kbn/analytics-shippers-elastic-v3-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-browser']
 ---
 import kbnAnalyticsShippersElasticV3BrowserObj from './kbn_analytics_shippers_elastic_v3_browser.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
index e48d7b3694b51..deffa9d10e139 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-common
 title: "@kbn/analytics-shippers-elastic-v3-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-common']
 ---
 import kbnAnalyticsShippersElasticV3CommonObj from './kbn_analytics_shippers_elastic_v3_common.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
index 1c3dec0b3d1b0..d3d88e10dab86 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-server
 title: "@kbn/analytics-shippers-elastic-v3-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-server']
 ---
 import kbnAnalyticsShippersElasticV3ServerObj from './kbn_analytics_shippers_elastic_v3_server.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_fullstory.mdx b/api_docs/kbn_analytics_shippers_fullstory.mdx
index c579c08e89a57..47073a516cccd 100644
--- a/api_docs/kbn_analytics_shippers_fullstory.mdx
+++ b/api_docs/kbn_analytics_shippers_fullstory.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-fullstory
 title: "@kbn/analytics-shippers-fullstory"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-fullstory plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-fullstory']
 ---
 import kbnAnalyticsShippersFullstoryObj from './kbn_analytics_shippers_fullstory.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_gainsight.mdx b/api_docs/kbn_analytics_shippers_gainsight.mdx
index c07838b49a8a8..1b79a515a5916 100644
--- a/api_docs/kbn_analytics_shippers_gainsight.mdx
+++ b/api_docs/kbn_analytics_shippers_gainsight.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-gainsight
 title: "@kbn/analytics-shippers-gainsight"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-gainsight plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-gainsight']
 ---
 import kbnAnalyticsShippersGainsightObj from './kbn_analytics_shippers_gainsight.devdocs.json';
diff --git a/api_docs/kbn_apm_config_loader.mdx b/api_docs/kbn_apm_config_loader.mdx
index b61b78269d4a1..44fcc17d2a883 100644
--- a/api_docs/kbn_apm_config_loader.mdx
+++ b/api_docs/kbn_apm_config_loader.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-config-loader
 title: "@kbn/apm-config-loader"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-config-loader plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-config-loader']
 ---
 import kbnApmConfigLoaderObj from './kbn_apm_config_loader.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace.mdx b/api_docs/kbn_apm_synthtrace.mdx
index 24ed27014b0e9..d9b40cb43524e 100644
--- a/api_docs/kbn_apm_synthtrace.mdx
+++ b/api_docs/kbn_apm_synthtrace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace
 title: "@kbn/apm-synthtrace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace']
 ---
 import kbnApmSynthtraceObj from './kbn_apm_synthtrace.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace_client.devdocs.json b/api_docs/kbn_apm_synthtrace_client.devdocs.json
index 7c272f970dbc0..30e1816ad036a 100644
--- a/api_docs/kbn_apm_synthtrace_client.devdocs.json
+++ b/api_docs/kbn_apm_synthtrace_client.devdocs.json
@@ -1892,7 +1892,7 @@
         "label": "timerange",
         "description": [],
         "signature": [
-          "(from: number | Date, to: number | Date) => ",
+          "(from: number | Date | moment.Moment, to: number | Date | moment.Moment) => ",
           {
             "pluginId": "@kbn/apm-synthtrace-client",
             "scope": "common",
@@ -1913,7 +1913,7 @@
             "label": "from",
             "description": [],
             "signature": [
-              "number | Date"
+              "number | Date | moment.Moment"
             ],
             "path": "packages/kbn-apm-synthtrace-client/src/lib/timerange.ts",
             "deprecated": false,
@@ -1928,7 +1928,7 @@
             "label": "to",
             "description": [],
             "signature": [
-              "number | Date"
+              "number | Date | moment.Moment"
             ],
             "path": "packages/kbn-apm-synthtrace-client/src/lib/timerange.ts",
             "deprecated": false,
@@ -2318,7 +2318,7 @@
           "GeoLocation",
           "; 'client.geo.region_iso_code': string; 'client.geo.region_name': string; 'client.ip': string; 'cloud.account.id': string; 'cloud.account.name': string; 'cloud.availability_zone': string; 'cloud.machine.type': string; 'cloud.project.id': string; 'cloud.project.name': string; 'cloud.provider': string; 'cloud.region': string; 'cloud.service.name': string; 'container.id': string; 'destination.address': string; 'destination.port': number; 'device.id': string; 'device.manufacturer': string; 'device.model.identifier': string; 'device.model.name': string; 'ecs.version': string; 'error.exception': ",
           "ApmException",
-          "[]; 'error.grouping_key': string; 'error.grouping_name': string; 'error.id': string; 'event.ingested': number; 'event.name': string; 'event.outcome': string; 'event.outcome_numeric': number | { sum: number; value_count: number; }; 'faas.coldstart': boolean; 'faas.execution': string; 'faas.id': string; 'faas.name': string; 'faas.trigger.type': string; 'faas.version': string; 'host.architecture': string; 'host.hostname': string; 'host.name': string; 'host.os.full': string; 'host.os.name': string; 'host.os.platform': string; 'host.os.type': string; 'host.os.version': string; 'http.request.method': string; 'http.response.status_code': number; 'kubernetes.pod.name': string; 'kubernetes.pod.uid': string; 'metricset.name': string; 'network.carrier.icc': string; 'network.carrier.mcc': string; 'network.carrier.mnc': string; 'network.carrier.name': string; 'network.connection.subtype': string; 'network.connection.type': string; 'observer.type': string; 'observer.version_major': number; 'observer.version': string; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'session.id': string; 'trace.id': string; 'transaction.aggregation.overflow_count': number; 'transaction.duration.us': number; 'transaction.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'service.environment': string; 'service.framework.name': string; 'service.framework.version': string; 'service.language.name': string; 'service.language.version': string; 'service.name': string; 'service.node.name': string; 'service.runtime.name': string; 'service.runtime.version': string; 'service.target.name': string; 'service.target.type': string; 'service.version': string; 'span.action': string; 'span.destination.service.resource': string; 'span.destination.service.response_time.count': number; 'span.destination.service.response_time.sum.us': number; 'span.duration.us': number; 'span.id': string; 'span.name': string; 'span.self_time.count': number; 'span.self_time.sum.us': number; 'span.subtype': string; 'span.type': string; 'transaction.result': string; 'transaction.sampled': true; 'span.links': { trace: { id: string; }; span: { id: string; }; }[]; 'url.original': string; }> & Partial<{ 'system.process.memory.size': number; 'system.memory.actual.free': number; 'system.memory.total': number; 'system.cpu.total.norm.pct': number; 'system.process.memory.rss.bytes': number; 'system.process.cpu.total.norm.pct': number; 'jvm.memory.heap.used': number; 'jvm.memory.non_heap.used': number; 'jvm.thread.count': number; 'faas.billed_duration': number; 'faas.timeout': number; 'faas.coldstart_duration': number; 'faas.duration': number; }> & Partial<{ 'metricset.interval': string; 'transaction.duration.summary': string; }>"
+          "[]; 'error.grouping_key': string; 'error.grouping_name': string; 'error.id': string; 'event.ingested': number; 'event.name': string; 'event.outcome': string; 'event.outcome_numeric': number | { sum: number; value_count: number; }; 'faas.coldstart': boolean; 'faas.execution': string; 'faas.id': string; 'faas.name': string; 'faas.trigger.type': string; 'faas.version': string; 'host.architecture': string; 'host.hostname': string; 'host.name': string; 'host.os.full': string; 'host.os.name': string; 'host.os.platform': string; 'host.os.type': string; 'host.os.version': string; 'http.request.method': string; 'http.response.status_code': number; 'kubernetes.pod.name': string; 'kubernetes.pod.uid': string; 'labels.name': string; 'metricset.name': string; 'network.carrier.icc': string; 'network.carrier.mcc': string; 'network.carrier.mnc': string; 'network.carrier.name': string; 'network.connection.subtype': string; 'network.connection.type': string; 'observer.type': string; 'observer.version_major': number; 'observer.version': string; 'parent.id': string; 'processor.event': string; 'processor.name': string; 'session.id': string; 'trace.id': string; 'transaction.aggregation.overflow_count': number; 'transaction.duration.us': number; 'transaction.id': string; 'transaction.name': string; 'transaction.type': string; 'transaction.duration.histogram': { values: number[]; counts: number[]; }; 'service.environment': string; 'service.framework.name': string; 'service.framework.version': string; 'service.language.name': string; 'service.language.version': string; 'service.name': string; 'service.node.name': string; 'service.runtime.name': string; 'service.runtime.version': string; 'service.target.name': string; 'service.target.type': string; 'service.version': string; 'span.action': string; 'span.destination.service.resource': string; 'span.destination.service.response_time.count': number; 'span.destination.service.response_time.sum.us': number; 'span.duration.us': number; 'span.id': string; 'span.name': string; 'span.self_time.count': number; 'span.self_time.sum.us': number; 'span.subtype': string; 'span.type': string; 'transaction.result': string; 'transaction.sampled': true; 'span.links': { trace: { id: string; }; span: { id: string; }; }[]; 'url.original': string; }> & Partial<{ 'system.process.memory.size': number; 'system.memory.actual.free': number; 'system.memory.total': number; 'system.cpu.total.norm.pct': number; 'system.process.memory.rss.bytes': number; 'system.process.cpu.total.norm.pct': number; 'jvm.memory.heap.used': number; 'jvm.memory.non_heap.used': number; 'jvm.thread.count': number; 'faas.billed_duration': number; 'faas.timeout': number; 'faas.coldstart_duration': number; 'faas.duration': number; }> & Partial<{ 'metricset.interval': string; 'transaction.duration.summary': string; }>"
         ],
         "path": "packages/kbn-apm-synthtrace-client/src/lib/apm/apm_fields.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_apm_synthtrace_client.mdx b/api_docs/kbn_apm_synthtrace_client.mdx
index 98372dda14b2f..e9c2fc217b306 100644
--- a/api_docs/kbn_apm_synthtrace_client.mdx
+++ b/api_docs/kbn_apm_synthtrace_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace-client
 title: "@kbn/apm-synthtrace-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace-client plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace-client']
 ---
 import kbnApmSynthtraceClientObj from './kbn_apm_synthtrace_client.devdocs.json';
diff --git a/api_docs/kbn_apm_utils.mdx b/api_docs/kbn_apm_utils.mdx
index e46a72c8945d9..25fa157ba4c69 100644
--- a/api_docs/kbn_apm_utils.mdx
+++ b/api_docs/kbn_apm_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-utils
 title: "@kbn/apm-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-utils']
 ---
 import kbnApmUtilsObj from './kbn_apm_utils.devdocs.json';
diff --git a/api_docs/kbn_axe_config.mdx b/api_docs/kbn_axe_config.mdx
index 27cfdc9b8f946..8dfe0fe549118 100644
--- a/api_docs/kbn_axe_config.mdx
+++ b/api_docs/kbn_axe_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-axe-config
 title: "@kbn/axe-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/axe-config plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/axe-config']
 ---
 import kbnAxeConfigObj from './kbn_axe_config.devdocs.json';
diff --git a/api_docs/kbn_cases_components.mdx b/api_docs/kbn_cases_components.mdx
index b1b97ecf4d3f7..935a9a733919f 100644
--- a/api_docs/kbn_cases_components.mdx
+++ b/api_docs/kbn_cases_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cases-components
 title: "@kbn/cases-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cases-components plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cases-components']
 ---
 import kbnCasesComponentsObj from './kbn_cases_components.devdocs.json';
diff --git a/api_docs/kbn_cell_actions.mdx b/api_docs/kbn_cell_actions.mdx
index 0f325222fdda7..2744f18e717d5 100644
--- a/api_docs/kbn_cell_actions.mdx
+++ b/api_docs/kbn_cell_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cell-actions
 title: "@kbn/cell-actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cell-actions plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cell-actions']
 ---
 import kbnCellActionsObj from './kbn_cell_actions.devdocs.json';
diff --git a/api_docs/kbn_chart_icons.mdx b/api_docs/kbn_chart_icons.mdx
index 17f6642bf7f54..b68b44968e822 100644
--- a/api_docs/kbn_chart_icons.mdx
+++ b/api_docs/kbn_chart_icons.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-icons
 title: "@kbn/chart-icons"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-icons plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-icons']
 ---
 import kbnChartIconsObj from './kbn_chart_icons.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_core.mdx b/api_docs/kbn_ci_stats_core.mdx
index 4049aa1a32456..f4b6ce6d4175a 100644
--- a/api_docs/kbn_ci_stats_core.mdx
+++ b/api_docs/kbn_ci_stats_core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-core
 title: "@kbn/ci-stats-core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-core plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-core']
 ---
 import kbnCiStatsCoreObj from './kbn_ci_stats_core.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_performance_metrics.mdx b/api_docs/kbn_ci_stats_performance_metrics.mdx
index 470d03ab737fb..72c5c59b36b73 100644
--- a/api_docs/kbn_ci_stats_performance_metrics.mdx
+++ b/api_docs/kbn_ci_stats_performance_metrics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-performance-metrics
 title: "@kbn/ci-stats-performance-metrics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-performance-metrics plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-performance-metrics']
 ---
 import kbnCiStatsPerformanceMetricsObj from './kbn_ci_stats_performance_metrics.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_reporter.mdx b/api_docs/kbn_ci_stats_reporter.mdx
index 396571acc2dab..133590a9dd98a 100644
--- a/api_docs/kbn_ci_stats_reporter.mdx
+++ b/api_docs/kbn_ci_stats_reporter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-reporter
 title: "@kbn/ci-stats-reporter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-reporter plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-reporter']
 ---
 import kbnCiStatsReporterObj from './kbn_ci_stats_reporter.devdocs.json';
diff --git a/api_docs/kbn_cli_dev_mode.mdx b/api_docs/kbn_cli_dev_mode.mdx
index 0ba2c6c354b0c..d447910ea6ec4 100644
--- a/api_docs/kbn_cli_dev_mode.mdx
+++ b/api_docs/kbn_cli_dev_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cli-dev-mode
 title: "@kbn/cli-dev-mode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cli-dev-mode plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cli-dev-mode']
 ---
 import kbnCliDevModeObj from './kbn_cli_dev_mode.devdocs.json';
diff --git a/api_docs/kbn_code_editor.mdx b/api_docs/kbn_code_editor.mdx
index 7635df0d50818..460d88762880c 100644
--- a/api_docs/kbn_code_editor.mdx
+++ b/api_docs/kbn_code_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor
 title: "@kbn/code-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor']
 ---
 import kbnCodeEditorObj from './kbn_code_editor.devdocs.json';
diff --git a/api_docs/kbn_code_editor_mocks.mdx b/api_docs/kbn_code_editor_mocks.mdx
index def3e23f62e11..df7cad5a23567 100644
--- a/api_docs/kbn_code_editor_mocks.mdx
+++ b/api_docs/kbn_code_editor_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor-mocks
 title: "@kbn/code-editor-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor-mocks']
 ---
 import kbnCodeEditorMocksObj from './kbn_code_editor_mocks.devdocs.json';
diff --git a/api_docs/kbn_coloring.mdx b/api_docs/kbn_coloring.mdx
index 34d399a215ee2..a115f85570790 100644
--- a/api_docs/kbn_coloring.mdx
+++ b/api_docs/kbn_coloring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-coloring
 title: "@kbn/coloring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/coloring plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/coloring']
 ---
 import kbnColoringObj from './kbn_coloring.devdocs.json';
diff --git a/api_docs/kbn_config.mdx b/api_docs/kbn_config.mdx
index b05a88c1d3160..62f78030f6b17 100644
--- a/api_docs/kbn_config.mdx
+++ b/api_docs/kbn_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config
 title: "@kbn/config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config']
 ---
 import kbnConfigObj from './kbn_config.devdocs.json';
diff --git a/api_docs/kbn_config_mocks.mdx b/api_docs/kbn_config_mocks.mdx
index 50a4abde17ce4..9c975724ceab0 100644
--- a/api_docs/kbn_config_mocks.mdx
+++ b/api_docs/kbn_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-mocks
 title: "@kbn/config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-mocks']
 ---
 import kbnConfigMocksObj from './kbn_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_config_schema.mdx b/api_docs/kbn_config_schema.mdx
index d3dafba3e6a04..435f2a4ab2ae1 100644
--- a/api_docs/kbn_config_schema.mdx
+++ b/api_docs/kbn_config_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-schema
 title: "@kbn/config-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-schema plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-schema']
 ---
 import kbnConfigSchemaObj from './kbn_config_schema.devdocs.json';
diff --git a/api_docs/kbn_content_management_content_editor.mdx b/api_docs/kbn_content_management_content_editor.mdx
index b8c31b8fb0151..f7cc48ab128de 100644
--- a/api_docs/kbn_content_management_content_editor.mdx
+++ b/api_docs/kbn_content_management_content_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-content-editor
 title: "@kbn/content-management-content-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-content-editor plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-content-editor']
 ---
 import kbnContentManagementContentEditorObj from './kbn_content_management_content_editor.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list.mdx b/api_docs/kbn_content_management_table_list.mdx
index eafc1dae14998..7d2aa2feb41af 100644
--- a/api_docs/kbn_content_management_table_list.mdx
+++ b/api_docs/kbn_content_management_table_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list
 title: "@kbn/content-management-table-list"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list']
 ---
 import kbnContentManagementTableListObj from './kbn_content_management_table_list.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser.mdx b/api_docs/kbn_core_analytics_browser.mdx
index a16db42bb56dc..8267f6fee8fe8 100644
--- a/api_docs/kbn_core_analytics_browser.mdx
+++ b/api_docs/kbn_core_analytics_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser
 title: "@kbn/core-analytics-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser']
 ---
 import kbnCoreAnalyticsBrowserObj from './kbn_core_analytics_browser.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_internal.mdx b/api_docs/kbn_core_analytics_browser_internal.mdx
index 37ce06dd81d6c..cbff31b1cff0c 100644
--- a/api_docs/kbn_core_analytics_browser_internal.mdx
+++ b/api_docs/kbn_core_analytics_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-internal
 title: "@kbn/core-analytics-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-internal']
 ---
 import kbnCoreAnalyticsBrowserInternalObj from './kbn_core_analytics_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_mocks.mdx b/api_docs/kbn_core_analytics_browser_mocks.mdx
index 3f040deea4fad..f3d0de1df3441 100644
--- a/api_docs/kbn_core_analytics_browser_mocks.mdx
+++ b/api_docs/kbn_core_analytics_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-mocks
 title: "@kbn/core-analytics-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-mocks']
 ---
 import kbnCoreAnalyticsBrowserMocksObj from './kbn_core_analytics_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server.mdx b/api_docs/kbn_core_analytics_server.mdx
index 768433cd1e855..f6a4d660ae92c 100644
--- a/api_docs/kbn_core_analytics_server.mdx
+++ b/api_docs/kbn_core_analytics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server
 title: "@kbn/core-analytics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server']
 ---
 import kbnCoreAnalyticsServerObj from './kbn_core_analytics_server.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_internal.mdx b/api_docs/kbn_core_analytics_server_internal.mdx
index 4dc8b069b776a..396cce3ac4fc9 100644
--- a/api_docs/kbn_core_analytics_server_internal.mdx
+++ b/api_docs/kbn_core_analytics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-internal
 title: "@kbn/core-analytics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-internal']
 ---
 import kbnCoreAnalyticsServerInternalObj from './kbn_core_analytics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_mocks.mdx b/api_docs/kbn_core_analytics_server_mocks.mdx
index edf5e7ce0b7ef..d3480f74daf5a 100644
--- a/api_docs/kbn_core_analytics_server_mocks.mdx
+++ b/api_docs/kbn_core_analytics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-mocks
 title: "@kbn/core-analytics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-mocks']
 ---
 import kbnCoreAnalyticsServerMocksObj from './kbn_core_analytics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser.mdx b/api_docs/kbn_core_application_browser.mdx
index 4d2e574b934e0..33447456eca36 100644
--- a/api_docs/kbn_core_application_browser.mdx
+++ b/api_docs/kbn_core_application_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser
 title: "@kbn/core-application-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser']
 ---
 import kbnCoreApplicationBrowserObj from './kbn_core_application_browser.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_internal.mdx b/api_docs/kbn_core_application_browser_internal.mdx
index bdbd0607fc99d..f0423843f854a 100644
--- a/api_docs/kbn_core_application_browser_internal.mdx
+++ b/api_docs/kbn_core_application_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-internal
 title: "@kbn/core-application-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-internal']
 ---
 import kbnCoreApplicationBrowserInternalObj from './kbn_core_application_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_mocks.mdx b/api_docs/kbn_core_application_browser_mocks.mdx
index a4780d77ec77e..b4868f10b0684 100644
--- a/api_docs/kbn_core_application_browser_mocks.mdx
+++ b/api_docs/kbn_core_application_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-mocks
 title: "@kbn/core-application-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-mocks']
 ---
 import kbnCoreApplicationBrowserMocksObj from './kbn_core_application_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_common.mdx b/api_docs/kbn_core_application_common.mdx
index 86c7adf9a0e35..a434bfa348ed4 100644
--- a/api_docs/kbn_core_application_common.mdx
+++ b/api_docs/kbn_core_application_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-common
 title: "@kbn/core-application-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-common']
 ---
 import kbnCoreApplicationCommonObj from './kbn_core_application_common.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_internal.mdx b/api_docs/kbn_core_apps_browser_internal.mdx
index 8739ec300f427..6a844c29e713c 100644
--- a/api_docs/kbn_core_apps_browser_internal.mdx
+++ b/api_docs/kbn_core_apps_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-internal
 title: "@kbn/core-apps-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-internal']
 ---
 import kbnCoreAppsBrowserInternalObj from './kbn_core_apps_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_mocks.mdx b/api_docs/kbn_core_apps_browser_mocks.mdx
index 5cb5d6c0c0545..8106de9d0d800 100644
--- a/api_docs/kbn_core_apps_browser_mocks.mdx
+++ b/api_docs/kbn_core_apps_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-mocks
 title: "@kbn/core-apps-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-mocks']
 ---
 import kbnCoreAppsBrowserMocksObj from './kbn_core_apps_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_apps_server_internal.mdx b/api_docs/kbn_core_apps_server_internal.mdx
index ac34095183b62..0d7dca019de50 100644
--- a/api_docs/kbn_core_apps_server_internal.mdx
+++ b/api_docs/kbn_core_apps_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-server-internal
 title: "@kbn/core-apps-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-server-internal']
 ---
 import kbnCoreAppsServerInternalObj from './kbn_core_apps_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_browser_mocks.mdx b/api_docs/kbn_core_base_browser_mocks.mdx
index 05f5ea2574f8e..ab6e34a3b97d4 100644
--- a/api_docs/kbn_core_base_browser_mocks.mdx
+++ b/api_docs/kbn_core_base_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-browser-mocks
 title: "@kbn/core-base-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-browser-mocks']
 ---
 import kbnCoreBaseBrowserMocksObj from './kbn_core_base_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_base_common.mdx b/api_docs/kbn_core_base_common.mdx
index bd16e1a4ef812..d25d7ca2c4c1c 100644
--- a/api_docs/kbn_core_base_common.mdx
+++ b/api_docs/kbn_core_base_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-common
 title: "@kbn/core-base-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-common']
 ---
 import kbnCoreBaseCommonObj from './kbn_core_base_common.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_internal.mdx b/api_docs/kbn_core_base_server_internal.mdx
index c45eb938ea8d0..15992e1ca9875 100644
--- a/api_docs/kbn_core_base_server_internal.mdx
+++ b/api_docs/kbn_core_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-internal
 title: "@kbn/core-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-internal']
 ---
 import kbnCoreBaseServerInternalObj from './kbn_core_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_mocks.mdx b/api_docs/kbn_core_base_server_mocks.mdx
index d3b7d86398dea..001d47fb324b0 100644
--- a/api_docs/kbn_core_base_server_mocks.mdx
+++ b/api_docs/kbn_core_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-mocks
 title: "@kbn/core-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-mocks']
 ---
 import kbnCoreBaseServerMocksObj from './kbn_core_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_browser_mocks.mdx b/api_docs/kbn_core_capabilities_browser_mocks.mdx
index 4b9f07da23df1..7de06c0b77a19 100644
--- a/api_docs/kbn_core_capabilities_browser_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-browser-mocks
 title: "@kbn/core-capabilities-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-browser-mocks']
 ---
 import kbnCoreCapabilitiesBrowserMocksObj from './kbn_core_capabilities_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_common.mdx b/api_docs/kbn_core_capabilities_common.mdx
index edf627592e10d..7877c02e40f39 100644
--- a/api_docs/kbn_core_capabilities_common.mdx
+++ b/api_docs/kbn_core_capabilities_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-common
 title: "@kbn/core-capabilities-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-common']
 ---
 import kbnCoreCapabilitiesCommonObj from './kbn_core_capabilities_common.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server.mdx b/api_docs/kbn_core_capabilities_server.mdx
index 95733e9018c01..a5df12de2a679 100644
--- a/api_docs/kbn_core_capabilities_server.mdx
+++ b/api_docs/kbn_core_capabilities_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server
 title: "@kbn/core-capabilities-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server']
 ---
 import kbnCoreCapabilitiesServerObj from './kbn_core_capabilities_server.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server_mocks.mdx b/api_docs/kbn_core_capabilities_server_mocks.mdx
index 3ed44bc6e330c..08274aadeedf1 100644
--- a/api_docs/kbn_core_capabilities_server_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server-mocks
 title: "@kbn/core-capabilities-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server-mocks']
 ---
 import kbnCoreCapabilitiesServerMocksObj from './kbn_core_capabilities_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser.mdx b/api_docs/kbn_core_chrome_browser.mdx
index 92599f78fd0d6..8dc321718000f 100644
--- a/api_docs/kbn_core_chrome_browser.mdx
+++ b/api_docs/kbn_core_chrome_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser
 title: "@kbn/core-chrome-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser']
 ---
 import kbnCoreChromeBrowserObj from './kbn_core_chrome_browser.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser_mocks.mdx b/api_docs/kbn_core_chrome_browser_mocks.mdx
index 6edcdd3bfe0ae..746ffe4d21d4e 100644
--- a/api_docs/kbn_core_chrome_browser_mocks.mdx
+++ b/api_docs/kbn_core_chrome_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser-mocks
 title: "@kbn/core-chrome-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser-mocks']
 ---
 import kbnCoreChromeBrowserMocksObj from './kbn_core_chrome_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_config_server_internal.mdx b/api_docs/kbn_core_config_server_internal.mdx
index 845a862f30d92..9456355503080 100644
--- a/api_docs/kbn_core_config_server_internal.mdx
+++ b/api_docs/kbn_core_config_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-config-server-internal
 title: "@kbn/core-config-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-config-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-config-server-internal']
 ---
 import kbnCoreConfigServerInternalObj from './kbn_core_config_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser.mdx b/api_docs/kbn_core_custom_branding_browser.mdx
index 63f4552466d56..cef9ed7fc18e5 100644
--- a/api_docs/kbn_core_custom_branding_browser.mdx
+++ b/api_docs/kbn_core_custom_branding_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser
 title: "@kbn/core-custom-branding-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser']
 ---
 import kbnCoreCustomBrandingBrowserObj from './kbn_core_custom_branding_browser.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_internal.mdx b/api_docs/kbn_core_custom_branding_browser_internal.mdx
index 59c453123678c..44d33dc612e2d 100644
--- a/api_docs/kbn_core_custom_branding_browser_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-internal
 title: "@kbn/core-custom-branding-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-internal']
 ---
 import kbnCoreCustomBrandingBrowserInternalObj from './kbn_core_custom_branding_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_mocks.mdx b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
index f6e4aea1420fd..ea9d44e30dcca 100644
--- a/api_docs/kbn_core_custom_branding_browser_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-mocks
 title: "@kbn/core-custom-branding-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-mocks']
 ---
 import kbnCoreCustomBrandingBrowserMocksObj from './kbn_core_custom_branding_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_common.mdx b/api_docs/kbn_core_custom_branding_common.mdx
index 6c06210748748..f2ec1363d9769 100644
--- a/api_docs/kbn_core_custom_branding_common.mdx
+++ b/api_docs/kbn_core_custom_branding_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-common
 title: "@kbn/core-custom-branding-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-common']
 ---
 import kbnCoreCustomBrandingCommonObj from './kbn_core_custom_branding_common.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server.mdx b/api_docs/kbn_core_custom_branding_server.mdx
index ffe766f46c68f..dd6e031a56b91 100644
--- a/api_docs/kbn_core_custom_branding_server.mdx
+++ b/api_docs/kbn_core_custom_branding_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server
 title: "@kbn/core-custom-branding-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server']
 ---
 import kbnCoreCustomBrandingServerObj from './kbn_core_custom_branding_server.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_internal.mdx b/api_docs/kbn_core_custom_branding_server_internal.mdx
index e578ff6f222e7..3a929657a8e3f 100644
--- a/api_docs/kbn_core_custom_branding_server_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-internal
 title: "@kbn/core-custom-branding-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-internal']
 ---
 import kbnCoreCustomBrandingServerInternalObj from './kbn_core_custom_branding_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_mocks.mdx b/api_docs/kbn_core_custom_branding_server_mocks.mdx
index ec61d9e871e69..e8d75dd1ecbe2 100644
--- a/api_docs/kbn_core_custom_branding_server_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-mocks
 title: "@kbn/core-custom-branding-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-mocks']
 ---
 import kbnCoreCustomBrandingServerMocksObj from './kbn_core_custom_branding_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser.mdx b/api_docs/kbn_core_deprecations_browser.mdx
index 1c3712442b5f0..dc541c38ccf07 100644
--- a/api_docs/kbn_core_deprecations_browser.mdx
+++ b/api_docs/kbn_core_deprecations_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser
 title: "@kbn/core-deprecations-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser']
 ---
 import kbnCoreDeprecationsBrowserObj from './kbn_core_deprecations_browser.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_internal.mdx b/api_docs/kbn_core_deprecations_browser_internal.mdx
index a1901060a7e91..9be3e542c85b8 100644
--- a/api_docs/kbn_core_deprecations_browser_internal.mdx
+++ b/api_docs/kbn_core_deprecations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-internal
 title: "@kbn/core-deprecations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-internal']
 ---
 import kbnCoreDeprecationsBrowserInternalObj from './kbn_core_deprecations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_mocks.mdx b/api_docs/kbn_core_deprecations_browser_mocks.mdx
index 13e7500bca429..2f1de0733dee2 100644
--- a/api_docs/kbn_core_deprecations_browser_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-mocks
 title: "@kbn/core-deprecations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-mocks']
 ---
 import kbnCoreDeprecationsBrowserMocksObj from './kbn_core_deprecations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_common.mdx b/api_docs/kbn_core_deprecations_common.mdx
index 359636705dd71..aa35952826f33 100644
--- a/api_docs/kbn_core_deprecations_common.mdx
+++ b/api_docs/kbn_core_deprecations_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-common
 title: "@kbn/core-deprecations-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-common']
 ---
 import kbnCoreDeprecationsCommonObj from './kbn_core_deprecations_common.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server.mdx b/api_docs/kbn_core_deprecations_server.mdx
index 1df75311b4c81..89945cc0a4e0c 100644
--- a/api_docs/kbn_core_deprecations_server.mdx
+++ b/api_docs/kbn_core_deprecations_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server
 title: "@kbn/core-deprecations-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server']
 ---
 import kbnCoreDeprecationsServerObj from './kbn_core_deprecations_server.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_internal.mdx b/api_docs/kbn_core_deprecations_server_internal.mdx
index b6aca33a1ac27..2285f349d2078 100644
--- a/api_docs/kbn_core_deprecations_server_internal.mdx
+++ b/api_docs/kbn_core_deprecations_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-internal
 title: "@kbn/core-deprecations-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-internal']
 ---
 import kbnCoreDeprecationsServerInternalObj from './kbn_core_deprecations_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_mocks.mdx b/api_docs/kbn_core_deprecations_server_mocks.mdx
index 180a778426ad6..373042c7e38a3 100644
--- a/api_docs/kbn_core_deprecations_server_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-mocks
 title: "@kbn/core-deprecations-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-mocks']
 ---
 import kbnCoreDeprecationsServerMocksObj from './kbn_core_deprecations_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser.mdx b/api_docs/kbn_core_doc_links_browser.mdx
index b6c238567ffca..ff7cd97728f99 100644
--- a/api_docs/kbn_core_doc_links_browser.mdx
+++ b/api_docs/kbn_core_doc_links_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser
 title: "@kbn/core-doc-links-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser']
 ---
 import kbnCoreDocLinksBrowserObj from './kbn_core_doc_links_browser.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser_mocks.mdx b/api_docs/kbn_core_doc_links_browser_mocks.mdx
index f9fba5f4c6094..428ed28b0a4d2 100644
--- a/api_docs/kbn_core_doc_links_browser_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser-mocks
 title: "@kbn/core-doc-links-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser-mocks']
 ---
 import kbnCoreDocLinksBrowserMocksObj from './kbn_core_doc_links_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server.mdx b/api_docs/kbn_core_doc_links_server.mdx
index 16818648c7493..6d539752ce544 100644
--- a/api_docs/kbn_core_doc_links_server.mdx
+++ b/api_docs/kbn_core_doc_links_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server
 title: "@kbn/core-doc-links-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server']
 ---
 import kbnCoreDocLinksServerObj from './kbn_core_doc_links_server.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server_mocks.mdx b/api_docs/kbn_core_doc_links_server_mocks.mdx
index 541a80d1bea04..1dbb30fa5d0a3 100644
--- a/api_docs/kbn_core_doc_links_server_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server-mocks
 title: "@kbn/core-doc-links-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server-mocks']
 ---
 import kbnCoreDocLinksServerMocksObj from './kbn_core_doc_links_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
index 929ca5e6caa1e..e781f5f88763f 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-internal
 title: "@kbn/core-elasticsearch-client-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-internal']
 ---
 import kbnCoreElasticsearchClientServerInternalObj from './kbn_core_elasticsearch_client_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
index 498cb10a4def6..f9480ca088d8d 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-mocks
 title: "@kbn/core-elasticsearch-client-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-mocks']
 ---
 import kbnCoreElasticsearchClientServerMocksObj from './kbn_core_elasticsearch_client_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server.mdx b/api_docs/kbn_core_elasticsearch_server.mdx
index e65237e9ac49c..fb1248043c3d6 100644
--- a/api_docs/kbn_core_elasticsearch_server.mdx
+++ b/api_docs/kbn_core_elasticsearch_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server
 title: "@kbn/core-elasticsearch-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server']
 ---
 import kbnCoreElasticsearchServerObj from './kbn_core_elasticsearch_server.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_internal.mdx b/api_docs/kbn_core_elasticsearch_server_internal.mdx
index 4ddb09949223d..3be12a5f639d5 100644
--- a/api_docs/kbn_core_elasticsearch_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-internal
 title: "@kbn/core-elasticsearch-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-internal']
 ---
 import kbnCoreElasticsearchServerInternalObj from './kbn_core_elasticsearch_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
index 8a9797e655519..d80166fc58fc6 100644
--- a/api_docs/kbn_core_elasticsearch_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-mocks
 title: "@kbn/core-elasticsearch-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-mocks']
 ---
 import kbnCoreElasticsearchServerMocksObj from './kbn_core_elasticsearch_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_internal.mdx b/api_docs/kbn_core_environment_server_internal.mdx
index f6393471dcd17..448f794aa605d 100644
--- a/api_docs/kbn_core_environment_server_internal.mdx
+++ b/api_docs/kbn_core_environment_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-internal
 title: "@kbn/core-environment-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-internal']
 ---
 import kbnCoreEnvironmentServerInternalObj from './kbn_core_environment_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_mocks.mdx b/api_docs/kbn_core_environment_server_mocks.mdx
index 6165d77ee5eca..64e728ad17fc4 100644
--- a/api_docs/kbn_core_environment_server_mocks.mdx
+++ b/api_docs/kbn_core_environment_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-mocks
 title: "@kbn/core-environment-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-mocks']
 ---
 import kbnCoreEnvironmentServerMocksObj from './kbn_core_environment_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser.mdx b/api_docs/kbn_core_execution_context_browser.mdx
index fe060d70c55c5..7271800a87656 100644
--- a/api_docs/kbn_core_execution_context_browser.mdx
+++ b/api_docs/kbn_core_execution_context_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser
 title: "@kbn/core-execution-context-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser']
 ---
 import kbnCoreExecutionContextBrowserObj from './kbn_core_execution_context_browser.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_internal.mdx b/api_docs/kbn_core_execution_context_browser_internal.mdx
index a2b222884a4df..519c9c0dd7bf0 100644
--- a/api_docs/kbn_core_execution_context_browser_internal.mdx
+++ b/api_docs/kbn_core_execution_context_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-internal
 title: "@kbn/core-execution-context-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-internal']
 ---
 import kbnCoreExecutionContextBrowserInternalObj from './kbn_core_execution_context_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_mocks.mdx b/api_docs/kbn_core_execution_context_browser_mocks.mdx
index c113243dee092..34fbdd850faf0 100644
--- a/api_docs/kbn_core_execution_context_browser_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-mocks
 title: "@kbn/core-execution-context-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-mocks']
 ---
 import kbnCoreExecutionContextBrowserMocksObj from './kbn_core_execution_context_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_common.mdx b/api_docs/kbn_core_execution_context_common.mdx
index d29a072ce8f79..ce7dee6ae3e27 100644
--- a/api_docs/kbn_core_execution_context_common.mdx
+++ b/api_docs/kbn_core_execution_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-common
 title: "@kbn/core-execution-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-common']
 ---
 import kbnCoreExecutionContextCommonObj from './kbn_core_execution_context_common.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server.mdx b/api_docs/kbn_core_execution_context_server.mdx
index 7ca7ed98f95ef..d68cb5e03b9b9 100644
--- a/api_docs/kbn_core_execution_context_server.mdx
+++ b/api_docs/kbn_core_execution_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server
 title: "@kbn/core-execution-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server']
 ---
 import kbnCoreExecutionContextServerObj from './kbn_core_execution_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_internal.mdx b/api_docs/kbn_core_execution_context_server_internal.mdx
index 45bc829fb0f88..f8a0bdf6d90a2 100644
--- a/api_docs/kbn_core_execution_context_server_internal.mdx
+++ b/api_docs/kbn_core_execution_context_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-internal
 title: "@kbn/core-execution-context-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-internal']
 ---
 import kbnCoreExecutionContextServerInternalObj from './kbn_core_execution_context_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_mocks.mdx b/api_docs/kbn_core_execution_context_server_mocks.mdx
index 9f7cfa97b24a3..926858f6bc233 100644
--- a/api_docs/kbn_core_execution_context_server_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-mocks
 title: "@kbn/core-execution-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-mocks']
 ---
 import kbnCoreExecutionContextServerMocksObj from './kbn_core_execution_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser.mdx b/api_docs/kbn_core_fatal_errors_browser.mdx
index d5bb1f575c6f8..c472c963b1903 100644
--- a/api_docs/kbn_core_fatal_errors_browser.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser
 title: "@kbn/core-fatal-errors-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser']
 ---
 import kbnCoreFatalErrorsBrowserObj from './kbn_core_fatal_errors_browser.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
index e264d8198b711..dc08f5123aa2d 100644
--- a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser-mocks
 title: "@kbn/core-fatal-errors-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser-mocks']
 ---
 import kbnCoreFatalErrorsBrowserMocksObj from './kbn_core_fatal_errors_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser.mdx b/api_docs/kbn_core_http_browser.mdx
index 63967be48f38f..82bc094ae6a46 100644
--- a/api_docs/kbn_core_http_browser.mdx
+++ b/api_docs/kbn_core_http_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser
 title: "@kbn/core-http-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser']
 ---
 import kbnCoreHttpBrowserObj from './kbn_core_http_browser.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_internal.mdx b/api_docs/kbn_core_http_browser_internal.mdx
index fc84c83a80837..c0739384e19ba 100644
--- a/api_docs/kbn_core_http_browser_internal.mdx
+++ b/api_docs/kbn_core_http_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-internal
 title: "@kbn/core-http-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-internal']
 ---
 import kbnCoreHttpBrowserInternalObj from './kbn_core_http_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_mocks.mdx b/api_docs/kbn_core_http_browser_mocks.mdx
index 71bd148c57a2d..a775e3254de3b 100644
--- a/api_docs/kbn_core_http_browser_mocks.mdx
+++ b/api_docs/kbn_core_http_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-mocks
 title: "@kbn/core-http-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-mocks']
 ---
 import kbnCoreHttpBrowserMocksObj from './kbn_core_http_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_common.mdx b/api_docs/kbn_core_http_common.mdx
index 1d13ce00852ac..d9c8e8d1c5dfd 100644
--- a/api_docs/kbn_core_http_common.mdx
+++ b/api_docs/kbn_core_http_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-common
 title: "@kbn/core-http-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-common']
 ---
 import kbnCoreHttpCommonObj from './kbn_core_http_common.devdocs.json';
diff --git a/api_docs/kbn_core_http_context_server_mocks.mdx b/api_docs/kbn_core_http_context_server_mocks.mdx
index cd6feaac819b1..57ad45d054f53 100644
--- a/api_docs/kbn_core_http_context_server_mocks.mdx
+++ b/api_docs/kbn_core_http_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-context-server-mocks
 title: "@kbn/core-http-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-context-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-context-server-mocks']
 ---
 import kbnCoreHttpContextServerMocksObj from './kbn_core_http_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_request_handler_context_server.mdx b/api_docs/kbn_core_http_request_handler_context_server.mdx
index 81147ac9134ee..8262f80f7bffa 100644
--- a/api_docs/kbn_core_http_request_handler_context_server.mdx
+++ b/api_docs/kbn_core_http_request_handler_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-request-handler-context-server
 title: "@kbn/core-http-request-handler-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-request-handler-context-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-request-handler-context-server']
 ---
 import kbnCoreHttpRequestHandlerContextServerObj from './kbn_core_http_request_handler_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server.mdx b/api_docs/kbn_core_http_resources_server.mdx
index 04589671d9c8b..473f67a2effd9 100644
--- a/api_docs/kbn_core_http_resources_server.mdx
+++ b/api_docs/kbn_core_http_resources_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server
 title: "@kbn/core-http-resources-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server']
 ---
 import kbnCoreHttpResourcesServerObj from './kbn_core_http_resources_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_internal.mdx b/api_docs/kbn_core_http_resources_server_internal.mdx
index 8048532f90fd9..e2caa7bac1675 100644
--- a/api_docs/kbn_core_http_resources_server_internal.mdx
+++ b/api_docs/kbn_core_http_resources_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-internal
 title: "@kbn/core-http-resources-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-internal']
 ---
 import kbnCoreHttpResourcesServerInternalObj from './kbn_core_http_resources_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_mocks.mdx b/api_docs/kbn_core_http_resources_server_mocks.mdx
index aedf50d4022af..25ed715de528f 100644
--- a/api_docs/kbn_core_http_resources_server_mocks.mdx
+++ b/api_docs/kbn_core_http_resources_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-mocks
 title: "@kbn/core-http-resources-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-mocks']
 ---
 import kbnCoreHttpResourcesServerMocksObj from './kbn_core_http_resources_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_internal.mdx b/api_docs/kbn_core_http_router_server_internal.mdx
index 5edcfeacf73fb..9cb73653f3d2c 100644
--- a/api_docs/kbn_core_http_router_server_internal.mdx
+++ b/api_docs/kbn_core_http_router_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-internal
 title: "@kbn/core-http-router-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-internal']
 ---
 import kbnCoreHttpRouterServerInternalObj from './kbn_core_http_router_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_mocks.mdx b/api_docs/kbn_core_http_router_server_mocks.mdx
index 1b41384d41792..f7561515e9b4a 100644
--- a/api_docs/kbn_core_http_router_server_mocks.mdx
+++ b/api_docs/kbn_core_http_router_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-mocks
 title: "@kbn/core-http-router-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-mocks']
 ---
 import kbnCoreHttpRouterServerMocksObj from './kbn_core_http_router_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_server.mdx b/api_docs/kbn_core_http_server.mdx
index de04a5d277297..607e2f0a15cc6 100644
--- a/api_docs/kbn_core_http_server.mdx
+++ b/api_docs/kbn_core_http_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server
 title: "@kbn/core-http-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server']
 ---
 import kbnCoreHttpServerObj from './kbn_core_http_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_internal.devdocs.json b/api_docs/kbn_core_http_server_internal.devdocs.json
index bee16276e70e4..60d62f15f154d 100644
--- a/api_docs/kbn_core_http_server_internal.devdocs.json
+++ b/api_docs/kbn_core_http_server_internal.devdocs.json
@@ -93,6 +93,17 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "@kbn/core-http-server-internal",
+            "id": "def-common.CspConfig.disableUnsafeEval",
+            "type": "boolean",
+            "tags": [],
+            "label": "disableUnsafeEval",
+            "description": [],
+            "path": "packages/core/http/core-http-server-internal/src/csp/csp_config.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "@kbn/core-http-server-internal",
             "id": "def-common.CspConfig.warnLegacyBrowsers",
@@ -912,10 +923,10 @@
                 "pluginId": "@kbn/config-schema",
                 "scope": "common",
                 "docId": "kibKbnConfigSchemaPluginApi",
-                "section": "def-common.ConditionalType",
-                "text": "ConditionalType"
+                "section": "def-common.Type",
+                "text": "Type"
               },
-              "<true, boolean, boolean>; script_src: ",
+              "<boolean>; script_src: ",
               {
                 "pluginId": "@kbn/config-schema",
                 "scope": "common",
diff --git a/api_docs/kbn_core_http_server_internal.mdx b/api_docs/kbn_core_http_server_internal.mdx
index aca4f2410ad30..005bd4490a0b9 100644
--- a/api_docs/kbn_core_http_server_internal.mdx
+++ b/api_docs/kbn_core_http_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-internal
 title: "@kbn/core-http-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-internal']
 ---
 import kbnCoreHttpServerInternalObj from './kbn_core_http_server_internal.devdocs.json';
@@ -21,7 +21,7 @@ Contact Kibana Core for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 54 | 0 | 48 | 6 |
+| 55 | 0 | 49 | 6 |
 
 ## Common
 
diff --git a/api_docs/kbn_core_http_server_mocks.mdx b/api_docs/kbn_core_http_server_mocks.mdx
index 4d3f0730e5acf..dc33168bf536b 100644
--- a/api_docs/kbn_core_http_server_mocks.mdx
+++ b/api_docs/kbn_core_http_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-mocks
 title: "@kbn/core-http-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-mocks']
 ---
 import kbnCoreHttpServerMocksObj from './kbn_core_http_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser.mdx b/api_docs/kbn_core_i18n_browser.mdx
index c86f6a4c451f2..9ef4fae9d9b0c 100644
--- a/api_docs/kbn_core_i18n_browser.mdx
+++ b/api_docs/kbn_core_i18n_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser
 title: "@kbn/core-i18n-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser']
 ---
 import kbnCoreI18nBrowserObj from './kbn_core_i18n_browser.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser_mocks.mdx b/api_docs/kbn_core_i18n_browser_mocks.mdx
index 8de9286f4106e..21dc9418a0b81 100644
--- a/api_docs/kbn_core_i18n_browser_mocks.mdx
+++ b/api_docs/kbn_core_i18n_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser-mocks
 title: "@kbn/core-i18n-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser-mocks']
 ---
 import kbnCoreI18nBrowserMocksObj from './kbn_core_i18n_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server.mdx b/api_docs/kbn_core_i18n_server.mdx
index eb15fb4a47b67..30f06f7816615 100644
--- a/api_docs/kbn_core_i18n_server.mdx
+++ b/api_docs/kbn_core_i18n_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server
 title: "@kbn/core-i18n-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server']
 ---
 import kbnCoreI18nServerObj from './kbn_core_i18n_server.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_internal.mdx b/api_docs/kbn_core_i18n_server_internal.mdx
index 06ffcd6a61b4a..01be69e512f7b 100644
--- a/api_docs/kbn_core_i18n_server_internal.mdx
+++ b/api_docs/kbn_core_i18n_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-internal
 title: "@kbn/core-i18n-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-internal']
 ---
 import kbnCoreI18nServerInternalObj from './kbn_core_i18n_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_mocks.mdx b/api_docs/kbn_core_i18n_server_mocks.mdx
index 9d52f727daa74..1c0a3e24f9b51 100644
--- a/api_docs/kbn_core_i18n_server_mocks.mdx
+++ b/api_docs/kbn_core_i18n_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-mocks
 title: "@kbn/core-i18n-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-mocks']
 ---
 import kbnCoreI18nServerMocksObj from './kbn_core_i18n_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
index d30da2296a083..ac2590408c594 100644
--- a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
+++ b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-injected-metadata-browser-mocks
 title: "@kbn/core-injected-metadata-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-injected-metadata-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-injected-metadata-browser-mocks']
 ---
 import kbnCoreInjectedMetadataBrowserMocksObj from './kbn_core_injected_metadata_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_internal.mdx b/api_docs/kbn_core_integrations_browser_internal.mdx
index 2dae763b46197..7fe560c8497a1 100644
--- a/api_docs/kbn_core_integrations_browser_internal.mdx
+++ b/api_docs/kbn_core_integrations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-internal
 title: "@kbn/core-integrations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-internal']
 ---
 import kbnCoreIntegrationsBrowserInternalObj from './kbn_core_integrations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_mocks.mdx b/api_docs/kbn_core_integrations_browser_mocks.mdx
index d578e8d7b0d8b..54f2f1bc1d329 100644
--- a/api_docs/kbn_core_integrations_browser_mocks.mdx
+++ b/api_docs/kbn_core_integrations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-mocks
 title: "@kbn/core-integrations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-mocks']
 ---
 import kbnCoreIntegrationsBrowserMocksObj from './kbn_core_integrations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser.mdx b/api_docs/kbn_core_lifecycle_browser.mdx
index 67232d6f5d9cf..8667e9ef00e47 100644
--- a/api_docs/kbn_core_lifecycle_browser.mdx
+++ b/api_docs/kbn_core_lifecycle_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser
 title: "@kbn/core-lifecycle-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser']
 ---
 import kbnCoreLifecycleBrowserObj from './kbn_core_lifecycle_browser.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser_mocks.mdx b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
index 3869ee3e94ed8..933afe38cd83d 100644
--- a/api_docs/kbn_core_lifecycle_browser_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser-mocks
 title: "@kbn/core-lifecycle-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser-mocks']
 ---
 import kbnCoreLifecycleBrowserMocksObj from './kbn_core_lifecycle_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server.mdx b/api_docs/kbn_core_lifecycle_server.mdx
index 18fd2df3edc1b..243aa8dd2e3fb 100644
--- a/api_docs/kbn_core_lifecycle_server.mdx
+++ b/api_docs/kbn_core_lifecycle_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server
 title: "@kbn/core-lifecycle-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server']
 ---
 import kbnCoreLifecycleServerObj from './kbn_core_lifecycle_server.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server_mocks.mdx b/api_docs/kbn_core_lifecycle_server_mocks.mdx
index 7f5da2fc1f82d..4dc2b975b502f 100644
--- a/api_docs/kbn_core_lifecycle_server_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server-mocks
 title: "@kbn/core-lifecycle-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server-mocks']
 ---
 import kbnCoreLifecycleServerMocksObj from './kbn_core_lifecycle_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_browser_mocks.mdx b/api_docs/kbn_core_logging_browser_mocks.mdx
index fc76dcd0f04a6..0ae241385b9b2 100644
--- a/api_docs/kbn_core_logging_browser_mocks.mdx
+++ b/api_docs/kbn_core_logging_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-browser-mocks
 title: "@kbn/core-logging-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-browser-mocks']
 ---
 import kbnCoreLoggingBrowserMocksObj from './kbn_core_logging_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_common_internal.mdx b/api_docs/kbn_core_logging_common_internal.mdx
index 9fdb05e88447a..86727bbc72215 100644
--- a/api_docs/kbn_core_logging_common_internal.mdx
+++ b/api_docs/kbn_core_logging_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-common-internal
 title: "@kbn/core-logging-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-common-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-common-internal']
 ---
 import kbnCoreLoggingCommonInternalObj from './kbn_core_logging_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server.mdx b/api_docs/kbn_core_logging_server.mdx
index 29d4095e5395b..15e7ad74618a9 100644
--- a/api_docs/kbn_core_logging_server.mdx
+++ b/api_docs/kbn_core_logging_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server
 title: "@kbn/core-logging-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server']
 ---
 import kbnCoreLoggingServerObj from './kbn_core_logging_server.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_internal.mdx b/api_docs/kbn_core_logging_server_internal.mdx
index 35a50425965d2..10f0dbc980b71 100644
--- a/api_docs/kbn_core_logging_server_internal.mdx
+++ b/api_docs/kbn_core_logging_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-internal
 title: "@kbn/core-logging-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-internal']
 ---
 import kbnCoreLoggingServerInternalObj from './kbn_core_logging_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_mocks.mdx b/api_docs/kbn_core_logging_server_mocks.mdx
index c6057a0dad1b4..28e7d1aee06ab 100644
--- a/api_docs/kbn_core_logging_server_mocks.mdx
+++ b/api_docs/kbn_core_logging_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-mocks
 title: "@kbn/core-logging-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-mocks']
 ---
 import kbnCoreLoggingServerMocksObj from './kbn_core_logging_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_internal.mdx b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
index d988e2469ded8..1339e9b86302f 100644
--- a/api_docs/kbn_core_metrics_collectors_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-internal
 title: "@kbn/core-metrics-collectors-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-internal']
 ---
 import kbnCoreMetricsCollectorsServerInternalObj from './kbn_core_metrics_collectors_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
index 3a633bd70ae8d..2106369a6e067 100644
--- a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-mocks
 title: "@kbn/core-metrics-collectors-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-mocks']
 ---
 import kbnCoreMetricsCollectorsServerMocksObj from './kbn_core_metrics_collectors_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server.mdx b/api_docs/kbn_core_metrics_server.mdx
index 6a801616924de..fc82c9518b224 100644
--- a/api_docs/kbn_core_metrics_server.mdx
+++ b/api_docs/kbn_core_metrics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server
 title: "@kbn/core-metrics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server']
 ---
 import kbnCoreMetricsServerObj from './kbn_core_metrics_server.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_internal.mdx b/api_docs/kbn_core_metrics_server_internal.mdx
index 98f16d74311a3..fc39bc2a73b8d 100644
--- a/api_docs/kbn_core_metrics_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-internal
 title: "@kbn/core-metrics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-internal']
 ---
 import kbnCoreMetricsServerInternalObj from './kbn_core_metrics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_mocks.mdx b/api_docs/kbn_core_metrics_server_mocks.mdx
index 155ba6e7be2ab..cc0c1114bad3d 100644
--- a/api_docs/kbn_core_metrics_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-mocks
 title: "@kbn/core-metrics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-mocks']
 ---
 import kbnCoreMetricsServerMocksObj from './kbn_core_metrics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_mount_utils_browser.mdx b/api_docs/kbn_core_mount_utils_browser.mdx
index 1a4d662b3a2df..f39452bf8e070 100644
--- a/api_docs/kbn_core_mount_utils_browser.mdx
+++ b/api_docs/kbn_core_mount_utils_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-mount-utils-browser
 title: "@kbn/core-mount-utils-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-mount-utils-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-mount-utils-browser']
 ---
 import kbnCoreMountUtilsBrowserObj from './kbn_core_mount_utils_browser.devdocs.json';
diff --git a/api_docs/kbn_core_node_server.mdx b/api_docs/kbn_core_node_server.mdx
index 03bd610124f17..b5bd6a96a4aca 100644
--- a/api_docs/kbn_core_node_server.mdx
+++ b/api_docs/kbn_core_node_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server
 title: "@kbn/core-node-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server']
 ---
 import kbnCoreNodeServerObj from './kbn_core_node_server.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_internal.mdx b/api_docs/kbn_core_node_server_internal.mdx
index 0df9692e82295..21162f1a31434 100644
--- a/api_docs/kbn_core_node_server_internal.mdx
+++ b/api_docs/kbn_core_node_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-internal
 title: "@kbn/core-node-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-internal']
 ---
 import kbnCoreNodeServerInternalObj from './kbn_core_node_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_mocks.mdx b/api_docs/kbn_core_node_server_mocks.mdx
index 1af721281233c..e30c59be682b6 100644
--- a/api_docs/kbn_core_node_server_mocks.mdx
+++ b/api_docs/kbn_core_node_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-mocks
 title: "@kbn/core-node-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-mocks']
 ---
 import kbnCoreNodeServerMocksObj from './kbn_core_node_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser.mdx b/api_docs/kbn_core_notifications_browser.mdx
index e5ceb80bfbf3d..1670159e2f687 100644
--- a/api_docs/kbn_core_notifications_browser.mdx
+++ b/api_docs/kbn_core_notifications_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser
 title: "@kbn/core-notifications-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser']
 ---
 import kbnCoreNotificationsBrowserObj from './kbn_core_notifications_browser.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_internal.mdx b/api_docs/kbn_core_notifications_browser_internal.mdx
index db585e1e7019d..d325d094d4def 100644
--- a/api_docs/kbn_core_notifications_browser_internal.mdx
+++ b/api_docs/kbn_core_notifications_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-internal
 title: "@kbn/core-notifications-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-internal']
 ---
 import kbnCoreNotificationsBrowserInternalObj from './kbn_core_notifications_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_mocks.mdx b/api_docs/kbn_core_notifications_browser_mocks.mdx
index 67229dca7a43b..fe3bdbbf829b6 100644
--- a/api_docs/kbn_core_notifications_browser_mocks.mdx
+++ b/api_docs/kbn_core_notifications_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-mocks
 title: "@kbn/core-notifications-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-mocks']
 ---
 import kbnCoreNotificationsBrowserMocksObj from './kbn_core_notifications_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser.mdx b/api_docs/kbn_core_overlays_browser.mdx
index 35e54d77796de..eb925a4e42d84 100644
--- a/api_docs/kbn_core_overlays_browser.mdx
+++ b/api_docs/kbn_core_overlays_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser
 title: "@kbn/core-overlays-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser']
 ---
 import kbnCoreOverlaysBrowserObj from './kbn_core_overlays_browser.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_internal.mdx b/api_docs/kbn_core_overlays_browser_internal.mdx
index b6f0a91c14752..2d519679f553c 100644
--- a/api_docs/kbn_core_overlays_browser_internal.mdx
+++ b/api_docs/kbn_core_overlays_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-internal
 title: "@kbn/core-overlays-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-internal']
 ---
 import kbnCoreOverlaysBrowserInternalObj from './kbn_core_overlays_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_mocks.mdx b/api_docs/kbn_core_overlays_browser_mocks.mdx
index 4b7d2625fd3c1..1b8f5f179d50d 100644
--- a/api_docs/kbn_core_overlays_browser_mocks.mdx
+++ b/api_docs/kbn_core_overlays_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-mocks
 title: "@kbn/core-overlays-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-mocks']
 ---
 import kbnCoreOverlaysBrowserMocksObj from './kbn_core_overlays_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser.mdx b/api_docs/kbn_core_plugins_browser.mdx
index 86f325a025185..4a8934e207fa2 100644
--- a/api_docs/kbn_core_plugins_browser.mdx
+++ b/api_docs/kbn_core_plugins_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser
 title: "@kbn/core-plugins-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser']
 ---
 import kbnCorePluginsBrowserObj from './kbn_core_plugins_browser.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser_mocks.mdx b/api_docs/kbn_core_plugins_browser_mocks.mdx
index 82a3ca522cb2b..e962cd3083098 100644
--- a/api_docs/kbn_core_plugins_browser_mocks.mdx
+++ b/api_docs/kbn_core_plugins_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser-mocks
 title: "@kbn/core-plugins-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser-mocks']
 ---
 import kbnCorePluginsBrowserMocksObj from './kbn_core_plugins_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server.mdx b/api_docs/kbn_core_plugins_server.mdx
index 998a86017f32b..4444c4d6a9cb1 100644
--- a/api_docs/kbn_core_plugins_server.mdx
+++ b/api_docs/kbn_core_plugins_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server
 title: "@kbn/core-plugins-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server']
 ---
 import kbnCorePluginsServerObj from './kbn_core_plugins_server.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server_mocks.mdx b/api_docs/kbn_core_plugins_server_mocks.mdx
index 7b6c1e6265bff..88e742da3699c 100644
--- a/api_docs/kbn_core_plugins_server_mocks.mdx
+++ b/api_docs/kbn_core_plugins_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server-mocks
 title: "@kbn/core-plugins-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server-mocks']
 ---
 import kbnCorePluginsServerMocksObj from './kbn_core_plugins_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server.mdx b/api_docs/kbn_core_preboot_server.mdx
index 859ae78a6bc92..82f9c4abc73be 100644
--- a/api_docs/kbn_core_preboot_server.mdx
+++ b/api_docs/kbn_core_preboot_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server
 title: "@kbn/core-preboot-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server']
 ---
 import kbnCorePrebootServerObj from './kbn_core_preboot_server.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server_mocks.mdx b/api_docs/kbn_core_preboot_server_mocks.mdx
index 0a2fc227d5caa..ceb899ef4a90d 100644
--- a/api_docs/kbn_core_preboot_server_mocks.mdx
+++ b/api_docs/kbn_core_preboot_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server-mocks
 title: "@kbn/core-preboot-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server-mocks']
 ---
 import kbnCorePrebootServerMocksObj from './kbn_core_preboot_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_browser_mocks.mdx b/api_docs/kbn_core_rendering_browser_mocks.mdx
index 191991e420a16..0274f4c1a4620 100644
--- a/api_docs/kbn_core_rendering_browser_mocks.mdx
+++ b/api_docs/kbn_core_rendering_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-browser-mocks
 title: "@kbn/core-rendering-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-browser-mocks']
 ---
 import kbnCoreRenderingBrowserMocksObj from './kbn_core_rendering_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_internal.mdx b/api_docs/kbn_core_rendering_server_internal.mdx
index e003dcea80ff6..184db0f4d4fd8 100644
--- a/api_docs/kbn_core_rendering_server_internal.mdx
+++ b/api_docs/kbn_core_rendering_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-internal
 title: "@kbn/core-rendering-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-internal']
 ---
 import kbnCoreRenderingServerInternalObj from './kbn_core_rendering_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_mocks.mdx b/api_docs/kbn_core_rendering_server_mocks.mdx
index e77835e381a14..93da8edb91bc4 100644
--- a/api_docs/kbn_core_rendering_server_mocks.mdx
+++ b/api_docs/kbn_core_rendering_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-mocks
 title: "@kbn/core-rendering-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-mocks']
 ---
 import kbnCoreRenderingServerMocksObj from './kbn_core_rendering_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_root_server_internal.mdx b/api_docs/kbn_core_root_server_internal.mdx
index 3bab1873e311b..cba0484b0eb04 100644
--- a/api_docs/kbn_core_root_server_internal.mdx
+++ b/api_docs/kbn_core_root_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-root-server-internal
 title: "@kbn/core-root-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-root-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-root-server-internal']
 ---
 import kbnCoreRootServerInternalObj from './kbn_core_root_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_browser.mdx b/api_docs/kbn_core_saved_objects_api_browser.mdx
index b717e572cd129..b5a336adde3ce 100644
--- a/api_docs/kbn_core_saved_objects_api_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_api_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-browser
 title: "@kbn/core-saved-objects-api-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-browser']
 ---
 import kbnCoreSavedObjectsApiBrowserObj from './kbn_core_saved_objects_api_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server.mdx b/api_docs/kbn_core_saved_objects_api_server.mdx
index f528f3c2a7c21..d1a85a7e43662 100644
--- a/api_docs/kbn_core_saved_objects_api_server.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server
 title: "@kbn/core-saved-objects-api-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server']
 ---
 import kbnCoreSavedObjectsApiServerObj from './kbn_core_saved_objects_api_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_internal.mdx b/api_docs/kbn_core_saved_objects_api_server_internal.mdx
index 4cb188adf676c..90dac2cb4466d 100644
--- a/api_docs/kbn_core_saved_objects_api_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-internal
 title: "@kbn/core-saved-objects-api-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-internal']
 ---
 import kbnCoreSavedObjectsApiServerInternalObj from './kbn_core_saved_objects_api_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
index 01da8e89e62fc..990d07e6d15ec 100644
--- a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-mocks
 title: "@kbn/core-saved-objects-api-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-mocks']
 ---
 import kbnCoreSavedObjectsApiServerMocksObj from './kbn_core_saved_objects_api_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_internal.mdx b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
index 54bb3e5d59610..c24bed21e641f 100644
--- a/api_docs/kbn_core_saved_objects_base_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-internal
 title: "@kbn/core-saved-objects-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-internal']
 ---
 import kbnCoreSavedObjectsBaseServerInternalObj from './kbn_core_saved_objects_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
index 35e22c223d0ee..b110c4a9ef8f2 100644
--- a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-mocks
 title: "@kbn/core-saved-objects-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-mocks']
 ---
 import kbnCoreSavedObjectsBaseServerMocksObj from './kbn_core_saved_objects_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser.mdx b/api_docs/kbn_core_saved_objects_browser.mdx
index 03c1b6ea78491..002fb201413a2 100644
--- a/api_docs/kbn_core_saved_objects_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser
 title: "@kbn/core-saved-objects-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser']
 ---
 import kbnCoreSavedObjectsBrowserObj from './kbn_core_saved_objects_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_internal.mdx b/api_docs/kbn_core_saved_objects_browser_internal.mdx
index 46f1fc4e5eeaf..b8efbdbf1f382 100644
--- a/api_docs/kbn_core_saved_objects_browser_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-internal
 title: "@kbn/core-saved-objects-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-internal']
 ---
 import kbnCoreSavedObjectsBrowserInternalObj from './kbn_core_saved_objects_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_mocks.mdx b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
index 77fcd6aec301f..01f7bd6b42ce9 100644
--- a/api_docs/kbn_core_saved_objects_browser_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-mocks
 title: "@kbn/core-saved-objects-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-mocks']
 ---
 import kbnCoreSavedObjectsBrowserMocksObj from './kbn_core_saved_objects_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_common.mdx b/api_docs/kbn_core_saved_objects_common.mdx
index bceaf34acb141..63fd8f4d83b47 100644
--- a/api_docs/kbn_core_saved_objects_common.mdx
+++ b/api_docs/kbn_core_saved_objects_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-common
 title: "@kbn/core-saved-objects-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-common']
 ---
 import kbnCoreSavedObjectsCommonObj from './kbn_core_saved_objects_common.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
index 76df69eb5e2b3..02907deecd41e 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-internal
 title: "@kbn/core-saved-objects-import-export-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-internal']
 ---
 import kbnCoreSavedObjectsImportExportServerInternalObj from './kbn_core_saved_objects_import_export_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
index 2217467893a31..5984dd9889d01 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-mocks
 title: "@kbn/core-saved-objects-import-export-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-mocks']
 ---
 import kbnCoreSavedObjectsImportExportServerMocksObj from './kbn_core_saved_objects_import_export_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
index 4c3a30ef6b819..9838057eaae58 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-internal
 title: "@kbn/core-saved-objects-migration-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-internal']
 ---
 import kbnCoreSavedObjectsMigrationServerInternalObj from './kbn_core_saved_objects_migration_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
index f58d85478ab76..e32c04a7e3925 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-mocks
 title: "@kbn/core-saved-objects-migration-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-mocks']
 ---
 import kbnCoreSavedObjectsMigrationServerMocksObj from './kbn_core_saved_objects_migration_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server.devdocs.json b/api_docs/kbn_core_saved_objects_server.devdocs.json
index 3890cd7f96e1e..1500c2294268b 100644
--- a/api_docs/kbn_core_saved_objects_server.devdocs.json
+++ b/api_docs/kbn_core_saved_objects_server.devdocs.json
@@ -3081,6 +3081,301 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectModelBidirectionalTransformation",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectModelBidirectionalTransformation",
+        "description": [
+          "\nA bidirectional transformation.\n\nBidirectional transformations define migration functions that can be used to\ntransform a document from the lower version to the higher one (`up`), and\nthe other way around, from the higher version to the lower one (`down`)\n"
+        ],
+        "signature": [
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectModelBidirectionalTransformation",
+            "text": "SavedObjectModelBidirectionalTransformation"
+          },
+          "<PreviousAttributes, NewAttributes>"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectModelBidirectionalTransformation.up",
+            "type": "Function",
+            "tags": [],
+            "label": "up",
+            "description": [
+              "\nThe upward (previous=>next) transformation."
+            ],
+            "signature": [
+              "(document: ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectModelTransformationDoc",
+                "text": "SavedObjectModelTransformationDoc"
+              },
+              "<PreviousAttributes>, context: ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectModelTransformationContext",
+                "text": "SavedObjectModelTransformationContext"
+              },
+              ") => ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectModelTransformationResult",
+                "text": "SavedObjectModelTransformationResult"
+              },
+              "<NewAttributes>"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "@kbn/core-saved-objects-server",
+                "id": "def-common.SavedObjectModelBidirectionalTransformation.up.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "document",
+                "description": [],
+                "signature": [
+                  "SavedObjectDoc<InputAttributes> & { references: ",
+                  {
+                    "pluginId": "@kbn/core-saved-objects-common",
+                    "scope": "common",
+                    "docId": "kibKbnCoreSavedObjectsCommonPluginApi",
+                    "section": "def-common.SavedObjectReference",
+                    "text": "SavedObjectReference"
+                  },
+                  "[]; }"
+                ],
+                "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/core-saved-objects-server",
+                "id": "def-common.SavedObjectModelBidirectionalTransformation.up.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "context",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-saved-objects-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                    "section": "def-common.SavedObjectModelTransformationContext",
+                    "text": "SavedObjectModelTransformationContext"
+                  }
+                ],
+                "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectModelBidirectionalTransformation.down",
+            "type": "Function",
+            "tags": [],
+            "label": "down",
+            "description": [
+              "\nThe downward (next=>previous) transformation."
+            ],
+            "signature": [
+              "(document: ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectModelTransformationDoc",
+                "text": "SavedObjectModelTransformationDoc"
+              },
+              "<NewAttributes>, context: ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectModelTransformationContext",
+                "text": "SavedObjectModelTransformationContext"
+              },
+              ") => ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectModelTransformationResult",
+                "text": "SavedObjectModelTransformationResult"
+              },
+              "<PreviousAttributes>"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "@kbn/core-saved-objects-server",
+                "id": "def-common.SavedObjectModelBidirectionalTransformation.down.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "document",
+                "description": [],
+                "signature": [
+                  "SavedObjectDoc<InputAttributes> & { references: ",
+                  {
+                    "pluginId": "@kbn/core-saved-objects-common",
+                    "scope": "common",
+                    "docId": "kibKbnCoreSavedObjectsCommonPluginApi",
+                    "section": "def-common.SavedObjectReference",
+                    "text": "SavedObjectReference"
+                  },
+                  "[]; }"
+                ],
+                "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/core-saved-objects-server",
+                "id": "def-common.SavedObjectModelBidirectionalTransformation.down.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "context",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-saved-objects-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                    "section": "def-common.SavedObjectModelTransformationContext",
+                    "text": "SavedObjectModelTransformationContext"
+                  }
+                ],
+                "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectModelTransformationContext",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectModelTransformationContext",
+        "description": [
+          "\nContext passed down to {@link SavedObjectModelTransformationFn | transformation functions}.\n"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectModelTransformationContext.log",
+            "type": "Object",
+            "tags": [],
+            "label": "log",
+            "description": [
+              "\nlogger instance to be used by the migration handler"
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsMigrationLogger",
+                "text": "SavedObjectsMigrationLogger"
+              }
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectModelTransformationContext.modelVersion",
+            "type": "number",
+            "tags": [],
+            "label": "modelVersion",
+            "description": [
+              "\nThe model version this migration is registered for"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectModelTransformationResult",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectModelTransformationResult",
+        "description": [
+          "\nReturn type for the {@link SavedObjectModelTransformationFn | transformation functions}\n"
+        ],
+        "signature": [
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectModelTransformationResult",
+            "text": "SavedObjectModelTransformationResult"
+          },
+          "<DocAttrs>"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectModelTransformationResult.document",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "document",
+            "description": [],
+            "signature": [
+              "SavedObjectDoc<DocAttrs> & { references: ",
+              {
+                "pluginId": "@kbn/core-saved-objects-common",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsCommonPluginApi",
+                "section": "def-common.SavedObjectReference",
+                "text": "SavedObjectReference"
+              },
+              "[]; }"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/core-saved-objects-server",
         "id": "def-common.SavedObjectReference",
@@ -3936,6 +4231,186 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectsModelExpansionChange",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsModelExpansionChange",
+        "description": [
+          "\n{@link SavedObjectsModelChange | model change} representing an expansion.\n\nA model expansion can do either, or both, or those:\n- add new mappings\n- migrate data in a backward-compatible way\n"
+        ],
+        "signature": [
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectsModelExpansionChange",
+            "text": "SavedObjectsModelExpansionChange"
+          },
+          "<PreviousAttributes, NewAttributes>"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsModelExpansionChange.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [
+              "\nThe type of {@link SavedObjectsModelChange | change}, used to identify them internally."
+            ],
+            "signature": [
+              "\"expansion\""
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsModelExpansionChange.transformation",
+            "type": "Object",
+            "tags": [],
+            "label": "transformation",
+            "description": [
+              "\n(optional) A bidirectional transformation to migrate the document from and/or to the previous model version."
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectModelBidirectionalTransformation",
+                "text": "SavedObjectModelBidirectionalTransformation"
+              },
+              "<PreviousAttributes, NewAttributes> | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsModelExpansionChange.addedMappings",
+            "type": "Object",
+            "tags": [],
+            "label": "addedMappings",
+            "description": [
+              "\n(optional) The new mappings introduced in this version."
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsMappingProperties",
+                "text": "SavedObjectsMappingProperties"
+              },
+              " | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsModelExpansionChange.deprecatedMappings",
+            "type": "Array",
+            "tags": [],
+            "label": "deprecatedMappings",
+            "description": [
+              "\n(optional) A list of paths to mappings to flag as deprecated. Deprecated mappings should no longer be used and will\neventually be deleted later."
+            ],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectsModelVersion",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsModelVersion",
+        "description": [
+          "\nRepresents a model version of a given savedObjects type.\n\nModel versions supersede the {@link SavedObjectsType.migrations | migrations} (and {@link SavedObjectsType.schemas | schemas}) APIs\nby exposing an unified way of describing the changes of shape or data of a type.\n"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsModelVersion.modelChange",
+            "type": "Object",
+            "tags": [],
+            "label": "modelChange",
+            "description": [
+              "\nThe {@link SavedObjectsModelChange | changes} associated with this version."
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsModelExpansionChange",
+                "text": "SavedObjectsModelExpansionChange"
+              },
+              "<unknown, unknown>"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectsModelVersionMap",
+        "type": "Interface",
+        "tags": [],
+        "label": "SavedObjectsModelVersionMap",
+        "description": [
+          "\nA record of {@link SavedObjectsModelVersion | model versions} for a given savedObjects type.\nThe record's keys must be integers, starting with 1 for the first entry, and there shouldn't be gaps.\n"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsModelVersionMap.Unnamed",
+            "type": "IndexSignature",
+            "tags": [],
+            "label": "[modelVersion: string]: SavedObjectsModelVersion",
+            "description": [],
+            "signature": [
+              "[modelVersion: string]:  ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsModelVersion",
+                "text": "SavedObjectsModelVersion"
+              }
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/core-saved-objects-server",
         "id": "def-common.SavedObjectsRawDoc",
@@ -5917,6 +6392,55 @@
             "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsType.modelVersions",
+            "type": "CompoundType",
+            "tags": [
+              "alpha"
+            ],
+            "label": "modelVersions",
+            "description": [
+              "\nA map of model versions associated with this type.\n\nModel versions supersede the {@link SavedObjectsType.migrations | migrations} (and {@link SavedObjectsType.schemas | schemas}) APIs\nby exposing an unified way of describing the changes of shape or data of the type.\n\nModel versioning is decoupled from Kibana versioning, and isolated between types.\nModel versions are identified by a single numeric value, starting at `1` and without gaps.\n\nPlease refer to {@link SavedObjectsModelVersion} for details on the API's usages.\n\nA **valid** versioning would be:\n\n```ts\n{\n  name: 'foo',\n  // other mandatory attributes...\n  modelVersions: {\n    '1': modelVersion1,\n    '2': modelVersion2,\n    '3': modelVersion3,\n  }\n}\n```\n\nA **invalid** versioning would be:\n\n```ts\n{\n  name: 'foo',\n  // other mandatory attributes...\n  modelVersions: {\n    '1': modelVersion1,\n    '3': modelVersion3, // ERROR, no model version 2\n    '3.1': modelVersion31, // ERROR, model version is a single numeric value\n  }\n}\n```\n"
+            ],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsModelVersionMap",
+                "text": "SavedObjectsModelVersionMap"
+              },
+              " | ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsModelVersionMapProvider",
+                "text": "SavedObjectsModelVersionMapProvider"
+              },
+              " | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsType.switchToModelVersionAt",
+            "type": "string",
+            "tags": [],
+            "label": "switchToModelVersionAt",
+            "description": [
+              "\nAllows to opt-in to the new model version API.\n\nMust be a valid semver version (with the patch version being necessarily 0)\n\nWhen specified, the type will switch from using the {@link SavedObjectsType.migrations | legacy migration API}\nto use the {@link SavedObjectsType.modelVersions | modelVersion API} after the specified version.\n\nWhen opted in, it will no longer be possible to use the legacy migration API after the specified version.\n\nA **valid** usage example would be:\n\n```ts\n{\n  name: 'foo',\n  // other mandatory attributes...\n  switchToModelVersionAt: '8.8.0',\n  migrations: {\n    '8.1.0': migrateTo810,\n    '8.7.0': migrateTo870,\n  },\n  modelVersions: {\n    '1': modelVersion1\n  }\n}\n```\n\nAn **invalid** usage example would be:\n\n```ts\n{\n  name: 'foo',\n  // other mandatory attributes...\n  switchToModelVersionAt: '8.9.0',\n  migrations: {\n    '8.1.0': migrateTo8_1,\n    '8.9.0': migrateTo8_9, // error: migration registered for the switch version\n    '8.10.0': migrateTo8_10, // error: migration registered for after the switch version\n  },\n  modelVersions: {\n    '1': modelVersion1\n  }\n}\n```\n\nPlease refer to the {@link SavedObjectsType.modelVersions | modelVersion API} for more documentation on\nthe new API.\n"
+            ],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -6559,6 +7083,117 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectModelTransformationDoc",
+        "type": "Type",
+        "tags": [],
+        "label": "SavedObjectModelTransformationDoc",
+        "description": [
+          "\nDocument type used during model migration.\n"
+        ],
+        "signature": [
+          "SavedObjectDoc<T> & { references: ",
+          {
+            "pluginId": "@kbn/core-saved-objects-common",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsCommonPluginApi",
+            "section": "def-common.SavedObjectReference",
+            "text": "SavedObjectReference"
+          },
+          "[]; }"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectModelTransformationFn",
+        "type": "Type",
+        "tags": [],
+        "label": "SavedObjectModelTransformationFn",
+        "description": [
+          "\nTransformation function for the model version API.\n\nSimilar to the old migration system, model version transformations take the document to migrate\nand a context object as input and must return the transformed document in its return value.\n"
+        ],
+        "signature": [
+          "(document: ",
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectModelTransformationDoc",
+            "text": "SavedObjectModelTransformationDoc"
+          },
+          "<InputAttributes>, context: ",
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectModelTransformationContext",
+            "text": "SavedObjectModelTransformationContext"
+          },
+          ") => ",
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectModelTransformationResult",
+            "text": "SavedObjectModelTransformationResult"
+          },
+          "<OutputAttributes>"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectModelTransformationFn.$1",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "document",
+            "description": [],
+            "signature": [
+              "SavedObjectDoc<InputAttributes> & { references: ",
+              {
+                "pluginId": "@kbn/core-saved-objects-common",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsCommonPluginApi",
+                "section": "def-common.SavedObjectReference",
+                "text": "SavedObjectReference"
+              },
+              "[]; }"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectModelTransformationFn.$2",
+            "type": "Object",
+            "tags": [],
+            "label": "context",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectModelTransformationContext",
+                "text": "SavedObjectModelTransformationContext"
+              }
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/transformations.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/core-saved-objects-server",
         "id": "def-common.SavedObjectSanitizedDoc",
@@ -7077,6 +7712,56 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectsModelChange",
+        "type": "Type",
+        "tags": [],
+        "label": "SavedObjectsModelChange",
+        "description": [
+          "\nIdentify the model change associated with a given {@link SavedObjectsModelVersion}.\n\nAt the moment, Only one type of change is supported: {@link SavedObjectsModelExpansionChange | expansions}.\n"
+        ],
+        "signature": [
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectsModelExpansionChange",
+            "text": "SavedObjectsModelExpansionChange"
+          },
+          "<unknown, unknown>"
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/core-saved-objects-server",
+        "id": "def-common.SavedObjectsModelVersionMapProvider",
+        "type": "Type",
+        "tags": [],
+        "label": "SavedObjectsModelVersionMapProvider",
+        "description": [
+          "\nA function returning a {@link SavedObjectsModelVersionMap | model version map}\n\nEnsured to be called after all plugins executed their `setup` phase.\nSimilar to what was done with migrations, can be used to defer resolving the model versions\nassociated to a type to after all plugins have been set up.\n"
+        ],
+        "signature": [
+          "() => ",
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectsModelVersionMap",
+            "text": "SavedObjectsModelVersionMap"
+          }
+        ],
+        "path": "packages/core/saved-objects/core-saved-objects-server/src/model_version/model_version.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/core-saved-objects-server",
         "id": "def-common.SavedObjectsSecurityExtensionFactory",
diff --git a/api_docs/kbn_core_saved_objects_server.mdx b/api_docs/kbn_core_saved_objects_server.mdx
index 0972d95cd67b3..b066ca00e218f 100644
--- a/api_docs/kbn_core_saved_objects_server.mdx
+++ b/api_docs/kbn_core_saved_objects_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server
 title: "@kbn/core-saved-objects-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server']
 ---
 import kbnCoreSavedObjectsServerObj from './kbn_core_saved_objects_server.devdocs.json';
@@ -21,7 +21,7 @@ Contact Kibana Core for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 329 | 0 | 96 | 1 |
+| 358 | 0 | 104 | 1 |
 
 ## Common
 
diff --git a/api_docs/kbn_core_saved_objects_server_internal.mdx b/api_docs/kbn_core_saved_objects_server_internal.mdx
index 6f327ed6d46cd..43d284da0bade 100644
--- a/api_docs/kbn_core_saved_objects_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-internal
 title: "@kbn/core-saved-objects-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-internal']
 ---
 import kbnCoreSavedObjectsServerInternalObj from './kbn_core_saved_objects_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_mocks.mdx b/api_docs/kbn_core_saved_objects_server_mocks.mdx
index dcb59cf245b2d..f700f12335378 100644
--- a/api_docs/kbn_core_saved_objects_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-mocks
 title: "@kbn/core-saved-objects-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-mocks']
 ---
 import kbnCoreSavedObjectsServerMocksObj from './kbn_core_saved_objects_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_utils_server.mdx b/api_docs/kbn_core_saved_objects_utils_server.mdx
index a71f5aa44486e..f4a0f73809a90 100644
--- a/api_docs/kbn_core_saved_objects_utils_server.mdx
+++ b/api_docs/kbn_core_saved_objects_utils_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-utils-server
 title: "@kbn/core-saved-objects-utils-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-utils-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-utils-server']
 ---
 import kbnCoreSavedObjectsUtilsServerObj from './kbn_core_saved_objects_utils_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_common.mdx b/api_docs/kbn_core_status_common.mdx
index 99371df20a800..26757f46823fd 100644
--- a/api_docs/kbn_core_status_common.mdx
+++ b/api_docs/kbn_core_status_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common
 title: "@kbn/core-status-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common']
 ---
 import kbnCoreStatusCommonObj from './kbn_core_status_common.devdocs.json';
diff --git a/api_docs/kbn_core_status_common_internal.mdx b/api_docs/kbn_core_status_common_internal.mdx
index 10d10f176db26..2c358781e9f0e 100644
--- a/api_docs/kbn_core_status_common_internal.mdx
+++ b/api_docs/kbn_core_status_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common-internal
 title: "@kbn/core-status-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common-internal']
 ---
 import kbnCoreStatusCommonInternalObj from './kbn_core_status_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server.mdx b/api_docs/kbn_core_status_server.mdx
index cb47fa309e3da..5dc293b7c5127 100644
--- a/api_docs/kbn_core_status_server.mdx
+++ b/api_docs/kbn_core_status_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server
 title: "@kbn/core-status-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server']
 ---
 import kbnCoreStatusServerObj from './kbn_core_status_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_internal.mdx b/api_docs/kbn_core_status_server_internal.mdx
index a442f76ebbd8f..8748d7014e393 100644
--- a/api_docs/kbn_core_status_server_internal.mdx
+++ b/api_docs/kbn_core_status_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-internal
 title: "@kbn/core-status-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-internal']
 ---
 import kbnCoreStatusServerInternalObj from './kbn_core_status_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_mocks.mdx b/api_docs/kbn_core_status_server_mocks.mdx
index e4c9055227729..ca7ae3a224734 100644
--- a/api_docs/kbn_core_status_server_mocks.mdx
+++ b/api_docs/kbn_core_status_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-mocks
 title: "@kbn/core-status-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-mocks']
 ---
 import kbnCoreStatusServerMocksObj from './kbn_core_status_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
index 793ca7f5bd0c8..5347d5e3682b3 100644
--- a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
+++ b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-deprecations-getters
 title: "@kbn/core-test-helpers-deprecations-getters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-deprecations-getters plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-deprecations-getters']
 ---
 import kbnCoreTestHelpersDeprecationsGettersObj from './kbn_core_test_helpers_deprecations_getters.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
index 5e8abda566982..979a31c0ff625 100644
--- a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
+++ b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-http-setup-browser
 title: "@kbn/core-test-helpers-http-setup-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-http-setup-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-http-setup-browser']
 ---
 import kbnCoreTestHelpersHttpSetupBrowserObj from './kbn_core_test_helpers_http_setup_browser.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_kbn_server.mdx b/api_docs/kbn_core_test_helpers_kbn_server.mdx
index 67bef888192aa..26ab3d8e58fe4 100644
--- a/api_docs/kbn_core_test_helpers_kbn_server.mdx
+++ b/api_docs/kbn_core_test_helpers_kbn_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-kbn-server
 title: "@kbn/core-test-helpers-kbn-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-kbn-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-kbn-server']
 ---
 import kbnCoreTestHelpersKbnServerObj from './kbn_core_test_helpers_kbn_server.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_so_type_serializer.devdocs.json b/api_docs/kbn_core_test_helpers_so_type_serializer.devdocs.json
index 82290b2116ef2..89a4cdb2015f7 100644
--- a/api_docs/kbn_core_test_helpers_so_type_serializer.devdocs.json
+++ b/api_docs/kbn_core_test_helpers_so_type_serializer.devdocs.json
@@ -242,6 +242,35 @@
             "path": "packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-test-helpers-so-type-serializer",
+            "id": "def-common.SavedObjectTypeMigrationInfo.modelVersions",
+            "type": "Array",
+            "tags": [],
+            "label": "modelVersions",
+            "description": [],
+            "signature": [
+              "ModelVersionSummary",
+              "[]"
+            ],
+            "path": "packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/core-test-helpers-so-type-serializer",
+            "id": "def-common.SavedObjectTypeMigrationInfo.switchToModelVersionAt",
+            "type": "string",
+            "tags": [],
+            "label": "switchToModelVersionAt",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/core/test-helpers/core-test-helpers-so-type-serializer/src/extract_migration_info.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
index a5e87c444766d..b146eb5577bbc 100644
--- a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
+++ b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-so-type-serializer
 title: "@kbn/core-test-helpers-so-type-serializer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-so-type-serializer plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-so-type-serializer']
 ---
 import kbnCoreTestHelpersSoTypeSerializerObj from './kbn_core_test_helpers_so_type_serializer.devdocs.json';
@@ -21,7 +21,7 @@ Contact Kibana Core for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 13 | 0 | 12 | 0 |
+| 15 | 0 | 14 | 1 |
 
 ## Common
 
diff --git a/api_docs/kbn_core_test_helpers_test_utils.mdx b/api_docs/kbn_core_test_helpers_test_utils.mdx
index a06a9084b18b1..26f135670b35e 100644
--- a/api_docs/kbn_core_test_helpers_test_utils.mdx
+++ b/api_docs/kbn_core_test_helpers_test_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-test-utils
 title: "@kbn/core-test-helpers-test-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-test-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-test-utils']
 ---
 import kbnCoreTestHelpersTestUtilsObj from './kbn_core_test_helpers_test_utils.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser.mdx b/api_docs/kbn_core_theme_browser.mdx
index a8cd19ae434d3..10f574c4ae7cc 100644
--- a/api_docs/kbn_core_theme_browser.mdx
+++ b/api_docs/kbn_core_theme_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser
 title: "@kbn/core-theme-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser']
 ---
 import kbnCoreThemeBrowserObj from './kbn_core_theme_browser.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_internal.mdx b/api_docs/kbn_core_theme_browser_internal.mdx
index d397fd1b9bc19..384afff458347 100644
--- a/api_docs/kbn_core_theme_browser_internal.mdx
+++ b/api_docs/kbn_core_theme_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-internal
 title: "@kbn/core-theme-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-internal']
 ---
 import kbnCoreThemeBrowserInternalObj from './kbn_core_theme_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_mocks.mdx b/api_docs/kbn_core_theme_browser_mocks.mdx
index 118532bd25a1a..82493b26f3074 100644
--- a/api_docs/kbn_core_theme_browser_mocks.mdx
+++ b/api_docs/kbn_core_theme_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-mocks
 title: "@kbn/core-theme-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-mocks']
 ---
 import kbnCoreThemeBrowserMocksObj from './kbn_core_theme_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser.mdx b/api_docs/kbn_core_ui_settings_browser.mdx
index 8f0ffccb27c9c..90367f863c499 100644
--- a/api_docs/kbn_core_ui_settings_browser.mdx
+++ b/api_docs/kbn_core_ui_settings_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser
 title: "@kbn/core-ui-settings-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser']
 ---
 import kbnCoreUiSettingsBrowserObj from './kbn_core_ui_settings_browser.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_internal.mdx b/api_docs/kbn_core_ui_settings_browser_internal.mdx
index 91b5622bf35c5..c500702f66b1b 100644
--- a/api_docs/kbn_core_ui_settings_browser_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-internal
 title: "@kbn/core-ui-settings-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-internal']
 ---
 import kbnCoreUiSettingsBrowserInternalObj from './kbn_core_ui_settings_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_mocks.mdx b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
index c475e76a698ba..42bfe1d721920 100644
--- a/api_docs/kbn_core_ui_settings_browser_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-mocks
 title: "@kbn/core-ui-settings-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-mocks']
 ---
 import kbnCoreUiSettingsBrowserMocksObj from './kbn_core_ui_settings_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_common.mdx b/api_docs/kbn_core_ui_settings_common.mdx
index 58816825f33fe..3610d8a24330b 100644
--- a/api_docs/kbn_core_ui_settings_common.mdx
+++ b/api_docs/kbn_core_ui_settings_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-common
 title: "@kbn/core-ui-settings-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-common plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-common']
 ---
 import kbnCoreUiSettingsCommonObj from './kbn_core_ui_settings_common.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server.mdx b/api_docs/kbn_core_ui_settings_server.mdx
index 7159a34214e63..98143b14d96cb 100644
--- a/api_docs/kbn_core_ui_settings_server.mdx
+++ b/api_docs/kbn_core_ui_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server
 title: "@kbn/core-ui-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server']
 ---
 import kbnCoreUiSettingsServerObj from './kbn_core_ui_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_internal.mdx b/api_docs/kbn_core_ui_settings_server_internal.mdx
index 9fea9dbb6b2d1..b8ee9132cd4ae 100644
--- a/api_docs/kbn_core_ui_settings_server_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-internal
 title: "@kbn/core-ui-settings-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-internal']
 ---
 import kbnCoreUiSettingsServerInternalObj from './kbn_core_ui_settings_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_mocks.mdx b/api_docs/kbn_core_ui_settings_server_mocks.mdx
index 98e0a21db126f..b0658255b66c6 100644
--- a/api_docs/kbn_core_ui_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-mocks
 title: "@kbn/core-ui-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-mocks']
 ---
 import kbnCoreUiSettingsServerMocksObj from './kbn_core_ui_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server.mdx b/api_docs/kbn_core_usage_data_server.mdx
index 8040f1bbb40a1..3e60641c257b6 100644
--- a/api_docs/kbn_core_usage_data_server.mdx
+++ b/api_docs/kbn_core_usage_data_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server
 title: "@kbn/core-usage-data-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server']
 ---
 import kbnCoreUsageDataServerObj from './kbn_core_usage_data_server.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_internal.mdx b/api_docs/kbn_core_usage_data_server_internal.mdx
index 7a8d46712ec62..635cc81f1f886 100644
--- a/api_docs/kbn_core_usage_data_server_internal.mdx
+++ b/api_docs/kbn_core_usage_data_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-internal
 title: "@kbn/core-usage-data-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-internal plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-internal']
 ---
 import kbnCoreUsageDataServerInternalObj from './kbn_core_usage_data_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_mocks.mdx b/api_docs/kbn_core_usage_data_server_mocks.mdx
index 88b2724c6628b..31432f5fc2e65 100644
--- a/api_docs/kbn_core_usage_data_server_mocks.mdx
+++ b/api_docs/kbn_core_usage_data_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-mocks
 title: "@kbn/core-usage-data-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-mocks']
 ---
 import kbnCoreUsageDataServerMocksObj from './kbn_core_usage_data_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_crypto.mdx b/api_docs/kbn_crypto.mdx
index 54cbf7b9c3128..e59119daef449 100644
--- a/api_docs/kbn_crypto.mdx
+++ b/api_docs/kbn_crypto.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto
 title: "@kbn/crypto"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto']
 ---
 import kbnCryptoObj from './kbn_crypto.devdocs.json';
diff --git a/api_docs/kbn_crypto_browser.mdx b/api_docs/kbn_crypto_browser.mdx
index 7c46776abe985..615f9aadbeab8 100644
--- a/api_docs/kbn_crypto_browser.mdx
+++ b/api_docs/kbn_crypto_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto-browser
 title: "@kbn/crypto-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto-browser']
 ---
 import kbnCryptoBrowserObj from './kbn_crypto_browser.devdocs.json';
diff --git a/api_docs/kbn_cypress_config.mdx b/api_docs/kbn_cypress_config.mdx
index 2dad325478146..6c04240b236d3 100644
--- a/api_docs/kbn_cypress_config.mdx
+++ b/api_docs/kbn_cypress_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cypress-config
 title: "@kbn/cypress-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cypress-config plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cypress-config']
 ---
 import kbnCypressConfigObj from './kbn_cypress_config.devdocs.json';
diff --git a/api_docs/kbn_datemath.mdx b/api_docs/kbn_datemath.mdx
index 5d30b54a0587e..0544d9edf8187 100644
--- a/api_docs/kbn_datemath.mdx
+++ b/api_docs/kbn_datemath.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-datemath
 title: "@kbn/datemath"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/datemath plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/datemath']
 ---
 import kbnDatemathObj from './kbn_datemath.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_errors.mdx b/api_docs/kbn_dev_cli_errors.mdx
index 560e2ae92467d..3a089f493ec5e 100644
--- a/api_docs/kbn_dev_cli_errors.mdx
+++ b/api_docs/kbn_dev_cli_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-errors
 title: "@kbn/dev-cli-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-errors plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-errors']
 ---
 import kbnDevCliErrorsObj from './kbn_dev_cli_errors.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_runner.mdx b/api_docs/kbn_dev_cli_runner.mdx
index 39204d4ac0b22..4947603b2f3ae 100644
--- a/api_docs/kbn_dev_cli_runner.mdx
+++ b/api_docs/kbn_dev_cli_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-runner
 title: "@kbn/dev-cli-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-runner plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-runner']
 ---
 import kbnDevCliRunnerObj from './kbn_dev_cli_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_proc_runner.mdx b/api_docs/kbn_dev_proc_runner.mdx
index 4769b3108a57b..b5376671b964e 100644
--- a/api_docs/kbn_dev_proc_runner.mdx
+++ b/api_docs/kbn_dev_proc_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-proc-runner
 title: "@kbn/dev-proc-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-proc-runner plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-proc-runner']
 ---
 import kbnDevProcRunnerObj from './kbn_dev_proc_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx
index b0839412cd4d9..1f6cceed24ebf 100644
--- a/api_docs/kbn_dev_utils.mdx
+++ b/api_docs/kbn_dev_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-utils
 title: "@kbn/dev-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-utils']
 ---
 import kbnDevUtilsObj from './kbn_dev_utils.devdocs.json';
diff --git a/api_docs/kbn_doc_links.devdocs.json b/api_docs/kbn_doc_links.devdocs.json
index 7bdb77584718b..5c2b615b39011 100644
--- a/api_docs/kbn_doc_links.devdocs.json
+++ b/api_docs/kbn_doc_links.devdocs.json
@@ -398,7 +398,7 @@
             "label": "aggs",
             "description": [],
             "signature": [
-              "{ readonly composite: string; readonly composite_missing_bucket: string; readonly date_histogram: string; readonly date_range: string; readonly date_format_pattern: string; readonly filter: string; readonly filters: string; readonly geohash_grid: string; readonly histogram: string; readonly ip_range: string; readonly range: string; readonly significant_terms: string; readonly terms: string; readonly terms_doc_count_error: string; readonly rare_terms: string; readonly avg: string; readonly avg_bucket: string; readonly max_bucket: string; readonly min_bucket: string; readonly sum_bucket: string; readonly cardinality: string; readonly count: string; readonly cumulative_sum: string; readonly derivative: string; readonly geo_bounds: string; readonly geo_centroid: string; readonly max: string; readonly median: string; readonly min: string; readonly moving_avg: string; readonly percentile_ranks: string; readonly serial_diff: string; readonly std_dev: string; readonly sum: string; readonly top_hits: string; }"
+              "{ readonly composite: string; readonly composite_missing_bucket: string; readonly date_histogram: string; readonly date_range: string; readonly date_format_pattern: string; readonly filter: string; readonly filters: string; readonly geohash_grid: string; readonly histogram: string; readonly ip_range: string; readonly range: string; readonly significant_terms: string; readonly terms: string; readonly terms_doc_count_error: string; readonly rare_terms: string; readonly avg: string; readonly avg_bucket: string; readonly max_bucket: string; readonly min_bucket: string; readonly sum_bucket: string; readonly cardinality: string; readonly count: string; readonly cumulative_sum: string; readonly derivative: string; readonly geo_bounds: string; readonly geo_centroid: string; readonly max: string; readonly median: string; readonly min: string; readonly moving_avg: string; readonly percentile_ranks: string; readonly serial_diff: string; readonly std_dev: string; readonly sum: string; readonly top_hits: string; readonly change_point: string; }"
             ],
             "path": "packages/kbn-doc-links/src/types.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_doc_links.mdx b/api_docs/kbn_doc_links.mdx
index bb9fbbee94fee..18676e953ebd3 100644
--- a/api_docs/kbn_doc_links.mdx
+++ b/api_docs/kbn_doc_links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-doc-links
 title: "@kbn/doc-links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/doc-links plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/doc-links']
 ---
 import kbnDocLinksObj from './kbn_doc_links.devdocs.json';
diff --git a/api_docs/kbn_docs_utils.mdx b/api_docs/kbn_docs_utils.mdx
index b217ba24d780b..aae474232c77e 100644
--- a/api_docs/kbn_docs_utils.mdx
+++ b/api_docs/kbn_docs_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-docs-utils
 title: "@kbn/docs-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/docs-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/docs-utils']
 ---
 import kbnDocsUtilsObj from './kbn_docs_utils.devdocs.json';
diff --git a/api_docs/kbn_ebt_tools.mdx b/api_docs/kbn_ebt_tools.mdx
index 9ae9f63865031..2fbb9b87425b9 100644
--- a/api_docs/kbn_ebt_tools.mdx
+++ b/api_docs/kbn_ebt_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ebt-tools
 title: "@kbn/ebt-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ebt-tools plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ebt-tools']
 ---
 import kbnEbtToolsObj from './kbn_ebt_tools.devdocs.json';
diff --git a/api_docs/kbn_ecs.mdx b/api_docs/kbn_ecs.mdx
index 0f385928af215..5058d0d699ab7 100644
--- a/api_docs/kbn_ecs.mdx
+++ b/api_docs/kbn_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs
 title: "@kbn/ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs']
 ---
 import kbnEcsObj from './kbn_ecs.devdocs.json';
diff --git a/api_docs/kbn_ecs_data_quality_dashboard.mdx b/api_docs/kbn_ecs_data_quality_dashboard.mdx
index 527468ce299d5..b959f93de3d3a 100644
--- a/api_docs/kbn_ecs_data_quality_dashboard.mdx
+++ b/api_docs/kbn_ecs_data_quality_dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs-data-quality-dashboard
 title: "@kbn/ecs-data-quality-dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs-data-quality-dashboard plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs-data-quality-dashboard']
 ---
 import kbnEcsDataQualityDashboardObj from './kbn_ecs_data_quality_dashboard.devdocs.json';
diff --git a/api_docs/kbn_es.mdx b/api_docs/kbn_es.mdx
index 4ecc3ffd100eb..de1dc993dba64 100644
--- a/api_docs/kbn_es.mdx
+++ b/api_docs/kbn_es.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es
 title: "@kbn/es"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es']
 ---
 import kbnEsObj from './kbn_es.devdocs.json';
diff --git a/api_docs/kbn_es_archiver.mdx b/api_docs/kbn_es_archiver.mdx
index e75dac18dd5ed..83ccb0b73cf91 100644
--- a/api_docs/kbn_es_archiver.mdx
+++ b/api_docs/kbn_es_archiver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-archiver
 title: "@kbn/es-archiver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-archiver plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-archiver']
 ---
 import kbnEsArchiverObj from './kbn_es_archiver.devdocs.json';
diff --git a/api_docs/kbn_es_errors.mdx b/api_docs/kbn_es_errors.mdx
index cb48293350234..5e52db6c43404 100644
--- a/api_docs/kbn_es_errors.mdx
+++ b/api_docs/kbn_es_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-errors
 title: "@kbn/es-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-errors plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-errors']
 ---
 import kbnEsErrorsObj from './kbn_es_errors.devdocs.json';
diff --git a/api_docs/kbn_es_query.mdx b/api_docs/kbn_es_query.mdx
index 5a4c847cc29e9..51b09726d5ced 100644
--- a/api_docs/kbn_es_query.mdx
+++ b/api_docs/kbn_es_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-query
 title: "@kbn/es-query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-query plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-query']
 ---
 import kbnEsQueryObj from './kbn_es_query.devdocs.json';
diff --git a/api_docs/kbn_es_types.mdx b/api_docs/kbn_es_types.mdx
index dc66020dc884e..1bc7b7380e390 100644
--- a/api_docs/kbn_es_types.mdx
+++ b/api_docs/kbn_es_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-types
 title: "@kbn/es-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-types plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-types']
 ---
 import kbnEsTypesObj from './kbn_es_types.devdocs.json';
diff --git a/api_docs/kbn_eslint_plugin_imports.mdx b/api_docs/kbn_eslint_plugin_imports.mdx
index e5c350063e150..e39c81260da9c 100644
--- a/api_docs/kbn_eslint_plugin_imports.mdx
+++ b/api_docs/kbn_eslint_plugin_imports.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-eslint-plugin-imports
 title: "@kbn/eslint-plugin-imports"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/eslint-plugin-imports plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/eslint-plugin-imports']
 ---
 import kbnEslintPluginImportsObj from './kbn_eslint_plugin_imports.devdocs.json';
diff --git a/api_docs/kbn_field_types.mdx b/api_docs/kbn_field_types.mdx
index ca6213c81e380..2667fcce6c1d9 100644
--- a/api_docs/kbn_field_types.mdx
+++ b/api_docs/kbn_field_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-types
 title: "@kbn/field-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-types plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-types']
 ---
 import kbnFieldTypesObj from './kbn_field_types.devdocs.json';
diff --git a/api_docs/kbn_find_used_node_modules.mdx b/api_docs/kbn_find_used_node_modules.mdx
index 7b9d7a56bcd77..5211d59ed0e15 100644
--- a/api_docs/kbn_find_used_node_modules.mdx
+++ b/api_docs/kbn_find_used_node_modules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-find-used-node-modules
 title: "@kbn/find-used-node-modules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/find-used-node-modules plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/find-used-node-modules']
 ---
 import kbnFindUsedNodeModulesObj from './kbn_find_used_node_modules.devdocs.json';
diff --git a/api_docs/kbn_ftr_common_functional_services.mdx b/api_docs/kbn_ftr_common_functional_services.mdx
index 95e49b66ce1fc..edb9ebe7f1ce0 100644
--- a/api_docs/kbn_ftr_common_functional_services.mdx
+++ b/api_docs/kbn_ftr_common_functional_services.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ftr-common-functional-services
 title: "@kbn/ftr-common-functional-services"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ftr-common-functional-services plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ftr-common-functional-services']
 ---
 import kbnFtrCommonFunctionalServicesObj from './kbn_ftr_common_functional_services.devdocs.json';
diff --git a/api_docs/kbn_generate.mdx b/api_docs/kbn_generate.mdx
index b37050dc7dfa8..8946a109f08ef 100644
--- a/api_docs/kbn_generate.mdx
+++ b/api_docs/kbn_generate.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate
 title: "@kbn/generate"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate']
 ---
 import kbnGenerateObj from './kbn_generate.devdocs.json';
diff --git a/api_docs/kbn_get_repo_files.mdx b/api_docs/kbn_get_repo_files.mdx
index 3e18fd3dabc7e..958daed209096 100644
--- a/api_docs/kbn_get_repo_files.mdx
+++ b/api_docs/kbn_get_repo_files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-get-repo-files
 title: "@kbn/get-repo-files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/get-repo-files plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/get-repo-files']
 ---
 import kbnGetRepoFilesObj from './kbn_get_repo_files.devdocs.json';
diff --git a/api_docs/kbn_guided_onboarding.mdx b/api_docs/kbn_guided_onboarding.mdx
index 3ad32ba17077c..2f7ebd1c99470 100644
--- a/api_docs/kbn_guided_onboarding.mdx
+++ b/api_docs/kbn_guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-guided-onboarding
 title: "@kbn/guided-onboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/guided-onboarding plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/guided-onboarding']
 ---
 import kbnGuidedOnboardingObj from './kbn_guided_onboarding.devdocs.json';
diff --git a/api_docs/kbn_handlebars.devdocs.json b/api_docs/kbn_handlebars.devdocs.json
index 7136c0d8fdbba..d3edc8759dbe3 100644
--- a/api_docs/kbn_handlebars.devdocs.json
+++ b/api_docs/kbn_handlebars.devdocs.json
@@ -18,189 +18,10 @@
   },
   "common": {
     "classes": [],
-    "functions": [
-      {
-        "parentPluginId": "@kbn/handlebars",
-        "id": "def-common.create",
-        "type": "Function",
-        "tags": [],
-        "label": "create",
-        "description": [
-          "\nCreates an isolated Handlebars environment.\n\nEach environment has its own helpers.\nThis is only necessary for use cases that demand distinct helpers.\nMost use cases can use the root Handlebars environment directly.\n"
-        ],
-        "signature": [
-          "() => typeof ",
-          "node_modules/handlebars/types/index.d.ts"
-        ],
-        "path": "packages/kbn-handlebars/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [],
-        "returnComment": [
-          "A sandboxed/scoped version of the"
-        ],
-        "initialIsOpen": false
-      }
-    ],
-    "interfaces": [
-      {
-        "parentPluginId": "@kbn/handlebars",
-        "id": "def-common.DecoratorOptions",
-        "type": "Interface",
-        "tags": [],
-        "label": "DecoratorOptions",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "@kbn/handlebars",
-            "scope": "common",
-            "docId": "kibKbnHandlebarsPluginApi",
-            "section": "def-common.DecoratorOptions",
-            "text": "DecoratorOptions"
-          },
-          " extends Omit<",
-          "HelperOptions",
-          ", \"lookupProperties\">"
-        ],
-        "path": "packages/kbn-handlebars/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/handlebars",
-            "id": "def-common.DecoratorOptions.args",
-            "type": "Array",
-            "tags": [],
-            "label": "args",
-            "description": [],
-            "signature": [
-              "any[] | undefined"
-            ],
-            "path": "packages/kbn-handlebars/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/handlebars",
-        "id": "def-common.DecoratorsHash",
-        "type": "Interface",
-        "tags": [],
-        "label": "DecoratorsHash",
-        "description": [],
-        "path": "packages/kbn-handlebars/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/handlebars",
-            "id": "def-common.DecoratorsHash.Unnamed",
-            "type": "IndexSignature",
-            "tags": [],
-            "label": "[name: string]: DecoratorFunction",
-            "description": [],
-            "signature": [
-              "[name: string]:  ",
-              {
-                "pluginId": "@kbn/handlebars",
-                "scope": "common",
-                "docId": "kibKbnHandlebarsPluginApi",
-                "section": "def-common.DecoratorFunction",
-                "text": "DecoratorFunction"
-              }
-            ],
-            "path": "packages/kbn-handlebars/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/handlebars",
-        "id": "def-common.HelpersHash",
-        "type": "Interface",
-        "tags": [],
-        "label": "HelpersHash",
-        "description": [],
-        "path": "packages/kbn-handlebars/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/handlebars",
-            "id": "def-common.HelpersHash.Unnamed",
-            "type": "IndexSignature",
-            "tags": [],
-            "label": "[name: string]: HelperDelegate",
-            "description": [],
-            "signature": [
-              "[name: string]:  ",
-              "HelperDelegate"
-            ],
-            "path": "packages/kbn-handlebars/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/handlebars",
-        "id": "def-common.PartialsHash",
-        "type": "Interface",
-        "tags": [],
-        "label": "PartialsHash",
-        "description": [],
-        "path": "packages/kbn-handlebars/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/handlebars",
-            "id": "def-common.PartialsHash.Unnamed",
-            "type": "IndexSignature",
-            "tags": [],
-            "label": "[name: string]: HandlebarsTemplateDelegate<any>",
-            "description": [],
-            "signature": [
-              "[name: string]:  HandlebarsTemplateDelegate<any>"
-            ],
-            "path": "packages/kbn-handlebars/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      }
-    ],
+    "functions": [],
+    "interfaces": [],
     "enums": [],
     "misc": [
-      {
-        "parentPluginId": "@kbn/handlebars",
-        "id": "def-common.AmbiguousHelperOptions",
-        "type": "Type",
-        "tags": [],
-        "label": "AmbiguousHelperOptions",
-        "description": [],
-        "signature": [
-          "HelperOptions",
-          " | ",
-          {
-            "pluginId": "@kbn/handlebars",
-            "scope": "common",
-            "docId": "kibKbnHandlebarsPluginApi",
-            "section": "def-common.NonBlockHelperOptions",
-            "text": "NonBlockHelperOptions"
-          }
-        ],
-        "path": "packages/kbn-handlebars/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "@kbn/handlebars",
         "id": "def-common.compileFnName",
@@ -230,9 +51,11 @@
         "signature": [
           "(prog: ",
           "TemplateDelegate",
-          "<any>, props: Record<string, any>, container: Container, options: any) => any"
+          "<any>, props: Record<string, any>, container: ",
+          "Container",
+          ", options: any) => any"
         ],
-        "path": "packages/kbn-handlebars/index.ts",
+        "path": "packages/kbn-handlebars/src/types.ts",
         "deprecated": false,
         "trackAdoption": false,
         "returnComment": [],
@@ -248,7 +71,7 @@
               "TemplateDelegate",
               "<any>"
             ],
-            "path": "packages/kbn-handlebars/index.ts",
+            "path": "packages/kbn-handlebars/src/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
@@ -262,7 +85,7 @@
             "signature": [
               "{ [x: string]: any; }"
             ],
-            "path": "packages/kbn-handlebars/index.ts",
+            "path": "packages/kbn-handlebars/src/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
@@ -276,7 +99,7 @@
             "signature": [
               "Container"
             ],
-            "path": "packages/kbn-handlebars/index.ts",
+            "path": "packages/kbn-handlebars/src/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
@@ -290,7 +113,7 @@
             "signature": [
               "any"
             ],
-            "path": "packages/kbn-handlebars/index.ts",
+            "path": "packages/kbn-handlebars/src/types.ts",
             "deprecated": false,
             "trackAdoption": false
           }
@@ -309,7 +132,7 @@
         "signature": [
           "{ data?: boolean | undefined; strict?: boolean | undefined; knownHelpers?: KnownHelpers | undefined; knownHelpersOnly?: boolean | undefined; noEscape?: boolean | undefined; assumeObjects?: boolean | undefined; preventIndent?: boolean | undefined; explicitPartialContext?: boolean | undefined; }"
         ],
-        "path": "packages/kbn-handlebars/index.ts",
+        "path": "packages/kbn-handlebars/src/types.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -326,22 +149,7 @@
         "signature": [
           "{ data?: any; helpers?: { [name: string]: Function; } | undefined; partials?: { [name: string]: HandlebarsTemplateDelegate<any>; } | undefined; decorators?: { [name: string]: Function; } | undefined; blockParams?: any[] | undefined; }"
         ],
-        "path": "packages/kbn-handlebars/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/handlebars",
-        "id": "def-common.NonBlockHelperOptions",
-        "type": "Type",
-        "tags": [],
-        "label": "NonBlockHelperOptions",
-        "description": [],
-        "signature": [
-          "{ name: string; data?: any; hash: any; loc: { start: hbs.AST.Position; end: hbs.AST.Position; }; lookupProperty: LookupProperty; }"
-        ],
-        "path": "packages/kbn-handlebars/index.ts",
+        "path": "packages/kbn-handlebars/src/types.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -361,7 +169,7 @@
           "typeof ",
           "node_modules/handlebars/types/index.d.ts"
         ],
-        "path": "packages/kbn-handlebars/index.ts",
+        "path": "packages/kbn-handlebars/src/types.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
diff --git a/api_docs/kbn_handlebars.mdx b/api_docs/kbn_handlebars.mdx
index 158c60596c1d5..f8c58f04f6db8 100644
--- a/api_docs/kbn_handlebars.mdx
+++ b/api_docs/kbn_handlebars.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-handlebars
 title: "@kbn/handlebars"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/handlebars plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/handlebars']
 ---
 import kbnHandlebarsObj from './kbn_handlebars.devdocs.json';
@@ -21,19 +21,13 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 21 | 1 | 14 | 0 |
+| 10 | 1 | 4 | 1 |
 
 ## Common
 
 ### Objects
 <DocDefinitionList data={kbnHandlebarsObj.common.objects}/>
 
-### Functions
-<DocDefinitionList data={kbnHandlebarsObj.common.functions}/>
-
-### Interfaces
-<DocDefinitionList data={kbnHandlebarsObj.common.interfaces}/>
-
 ### Consts, variables and types
 <DocDefinitionList data={kbnHandlebarsObj.common.misc}/>
 
diff --git a/api_docs/kbn_hapi_mocks.mdx b/api_docs/kbn_hapi_mocks.mdx
index a2f8c6c95fde7..c66c96ad011c2 100644
--- a/api_docs/kbn_hapi_mocks.mdx
+++ b/api_docs/kbn_hapi_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-hapi-mocks
 title: "@kbn/hapi-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/hapi-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/hapi-mocks']
 ---
 import kbnHapiMocksObj from './kbn_hapi_mocks.devdocs.json';
diff --git a/api_docs/kbn_health_gateway_server.mdx b/api_docs/kbn_health_gateway_server.mdx
index 4327ab9588121..2bc9c0508211f 100644
--- a/api_docs/kbn_health_gateway_server.mdx
+++ b/api_docs/kbn_health_gateway_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-health-gateway-server
 title: "@kbn/health-gateway-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/health-gateway-server plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/health-gateway-server']
 ---
 import kbnHealthGatewayServerObj from './kbn_health_gateway_server.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_card.mdx b/api_docs/kbn_home_sample_data_card.mdx
index 2a833b8f08d08..e7c6a45663900 100644
--- a/api_docs/kbn_home_sample_data_card.mdx
+++ b/api_docs/kbn_home_sample_data_card.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-card
 title: "@kbn/home-sample-data-card"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-card plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-card']
 ---
 import kbnHomeSampleDataCardObj from './kbn_home_sample_data_card.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_tab.mdx b/api_docs/kbn_home_sample_data_tab.mdx
index 1f5da1d622c5b..63e21688ef709 100644
--- a/api_docs/kbn_home_sample_data_tab.mdx
+++ b/api_docs/kbn_home_sample_data_tab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-tab
 title: "@kbn/home-sample-data-tab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-tab plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-tab']
 ---
 import kbnHomeSampleDataTabObj from './kbn_home_sample_data_tab.devdocs.json';
diff --git a/api_docs/kbn_i18n.mdx b/api_docs/kbn_i18n.mdx
index 8893927e1e0d9..8cd02148d237e 100644
--- a/api_docs/kbn_i18n.mdx
+++ b/api_docs/kbn_i18n.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n
 title: "@kbn/i18n"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n']
 ---
 import kbnI18nObj from './kbn_i18n.devdocs.json';
diff --git a/api_docs/kbn_i18n_react.mdx b/api_docs/kbn_i18n_react.mdx
index 808d0020d6066..e9821a162593f 100644
--- a/api_docs/kbn_i18n_react.mdx
+++ b/api_docs/kbn_i18n_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n-react
 title: "@kbn/i18n-react"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n-react plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n-react']
 ---
 import kbnI18nReactObj from './kbn_i18n_react.devdocs.json';
diff --git a/api_docs/kbn_import_resolver.mdx b/api_docs/kbn_import_resolver.mdx
index 6abed10054cc2..a0ce56db33dc6 100644
--- a/api_docs/kbn_import_resolver.mdx
+++ b/api_docs/kbn_import_resolver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-import-resolver
 title: "@kbn/import-resolver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/import-resolver plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/import-resolver']
 ---
 import kbnImportResolverObj from './kbn_import_resolver.devdocs.json';
diff --git a/api_docs/kbn_interpreter.mdx b/api_docs/kbn_interpreter.mdx
index 0274e4c8fc0d8..a2dd8cef6ad27 100644
--- a/api_docs/kbn_interpreter.mdx
+++ b/api_docs/kbn_interpreter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-interpreter
 title: "@kbn/interpreter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/interpreter plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/interpreter']
 ---
 import kbnInterpreterObj from './kbn_interpreter.devdocs.json';
diff --git a/api_docs/kbn_io_ts_utils.mdx b/api_docs/kbn_io_ts_utils.mdx
index a63fdf66043cc..5982dfe196071 100644
--- a/api_docs/kbn_io_ts_utils.mdx
+++ b/api_docs/kbn_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-io-ts-utils
 title: "@kbn/io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/io-ts-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/io-ts-utils']
 ---
 import kbnIoTsUtilsObj from './kbn_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_jest_serializers.mdx b/api_docs/kbn_jest_serializers.mdx
index 06ec7740a70be..39247278e6b3d 100644
--- a/api_docs/kbn_jest_serializers.mdx
+++ b/api_docs/kbn_jest_serializers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-jest-serializers
 title: "@kbn/jest-serializers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/jest-serializers plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/jest-serializers']
 ---
 import kbnJestSerializersObj from './kbn_jest_serializers.devdocs.json';
diff --git a/api_docs/kbn_journeys.mdx b/api_docs/kbn_journeys.mdx
index 2d3bf270d4e04..bbfd294a03d06 100644
--- a/api_docs/kbn_journeys.mdx
+++ b/api_docs/kbn_journeys.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-journeys
 title: "@kbn/journeys"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/journeys plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/journeys']
 ---
 import kbnJourneysObj from './kbn_journeys.devdocs.json';
diff --git a/api_docs/kbn_json_ast.mdx b/api_docs/kbn_json_ast.mdx
index 53b66596abe06..8ff203b3f108f 100644
--- a/api_docs/kbn_json_ast.mdx
+++ b/api_docs/kbn_json_ast.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-json-ast
 title: "@kbn/json-ast"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/json-ast plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/json-ast']
 ---
 import kbnJsonAstObj from './kbn_json_ast.devdocs.json';
diff --git a/api_docs/kbn_kibana_manifest_schema.mdx b/api_docs/kbn_kibana_manifest_schema.mdx
index 40e9af3dd0942..6bd575022a626 100644
--- a/api_docs/kbn_kibana_manifest_schema.mdx
+++ b/api_docs/kbn_kibana_manifest_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-kibana-manifest-schema
 title: "@kbn/kibana-manifest-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/kibana-manifest-schema plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/kibana-manifest-schema']
 ---
 import kbnKibanaManifestSchemaObj from './kbn_kibana_manifest_schema.devdocs.json';
diff --git a/api_docs/kbn_language_documentation_popover.mdx b/api_docs/kbn_language_documentation_popover.mdx
index 4f17f96800d1b..21ced2a72f06e 100644
--- a/api_docs/kbn_language_documentation_popover.mdx
+++ b/api_docs/kbn_language_documentation_popover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-language-documentation-popover
 title: "@kbn/language-documentation-popover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/language-documentation-popover plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/language-documentation-popover']
 ---
 import kbnLanguageDocumentationPopoverObj from './kbn_language_documentation_popover.devdocs.json';
diff --git a/api_docs/kbn_logging.mdx b/api_docs/kbn_logging.mdx
index 5235b83bc90ac..d1ce2f1c57e48 100644
--- a/api_docs/kbn_logging.mdx
+++ b/api_docs/kbn_logging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging
 title: "@kbn/logging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging']
 ---
 import kbnLoggingObj from './kbn_logging.devdocs.json';
diff --git a/api_docs/kbn_logging_mocks.mdx b/api_docs/kbn_logging_mocks.mdx
index f08b27876fcbe..502ac16e3e17c 100644
--- a/api_docs/kbn_logging_mocks.mdx
+++ b/api_docs/kbn_logging_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging-mocks
 title: "@kbn/logging-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging-mocks']
 ---
 import kbnLoggingMocksObj from './kbn_logging_mocks.devdocs.json';
diff --git a/api_docs/kbn_managed_vscode_config.mdx b/api_docs/kbn_managed_vscode_config.mdx
index 1ef83c71f603b..39eca8890c670 100644
--- a/api_docs/kbn_managed_vscode_config.mdx
+++ b/api_docs/kbn_managed_vscode_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-managed-vscode-config
 title: "@kbn/managed-vscode-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/managed-vscode-config plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/managed-vscode-config']
 ---
 import kbnManagedVscodeConfigObj from './kbn_managed_vscode_config.devdocs.json';
diff --git a/api_docs/kbn_mapbox_gl.mdx b/api_docs/kbn_mapbox_gl.mdx
index 14965886a3e6e..dc067eec0906b 100644
--- a/api_docs/kbn_mapbox_gl.mdx
+++ b/api_docs/kbn_mapbox_gl.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-mapbox-gl
 title: "@kbn/mapbox-gl"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/mapbox-gl plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mapbox-gl']
 ---
 import kbnMapboxGlObj from './kbn_mapbox_gl.devdocs.json';
diff --git a/api_docs/kbn_ml_agg_utils.mdx b/api_docs/kbn_ml_agg_utils.mdx
index c40a53ad05568..a864e918ad789 100644
--- a/api_docs/kbn_ml_agg_utils.mdx
+++ b/api_docs/kbn_ml_agg_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-agg-utils
 title: "@kbn/ml-agg-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-agg-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-agg-utils']
 ---
 import kbnMlAggUtilsObj from './kbn_ml_agg_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_date_picker.devdocs.json b/api_docs/kbn_ml_date_picker.devdocs.json
index e50bbe5efc0a0..53d6b048fdbcb 100644
--- a/api_docs/kbn_ml_date_picker.devdocs.json
+++ b/api_docs/kbn_ml_date_picker.devdocs.json
@@ -234,6 +234,33 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/ml-date-picker",
+        "id": "def-common.useRefresh",
+        "type": "Function",
+        "tags": [],
+        "label": "useRefresh",
+        "description": [
+          "\nProvides the latest refresh, both manual or auto."
+        ],
+        "signature": [
+          "() => ",
+          {
+            "pluginId": "@kbn/ml-date-picker",
+            "scope": "common",
+            "docId": "kibKbnMlDatePickerPluginApi",
+            "section": "def-common.Refresh",
+            "text": "Refresh"
+          },
+          " | undefined"
+        ],
+        "path": "x-pack/packages/ml/date_picker/src/hooks/use_timefilter.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/ml-date-picker",
         "id": "def-common.useRefreshIntervalUpdates",
diff --git a/api_docs/kbn_ml_date_picker.mdx b/api_docs/kbn_ml_date_picker.mdx
index 4a3ebca5864dd..916da1a9c29e4 100644
--- a/api_docs/kbn_ml_date_picker.mdx
+++ b/api_docs/kbn_ml_date_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-picker
 title: "@kbn/ml-date-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-picker plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-picker']
 ---
 import kbnMlDatePickerObj from './kbn_ml_date_picker.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 49 | 0 | 4 | 0 |
+| 50 | 0 | 4 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_ml_is_defined.mdx b/api_docs/kbn_ml_is_defined.mdx
index 9669b49177e5e..7fa5360a5c451 100644
--- a/api_docs/kbn_ml_is_defined.mdx
+++ b/api_docs/kbn_ml_is_defined.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-defined
 title: "@kbn/ml-is-defined"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-defined plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-defined']
 ---
 import kbnMlIsDefinedObj from './kbn_ml_is_defined.devdocs.json';
diff --git a/api_docs/kbn_ml_is_populated_object.mdx b/api_docs/kbn_ml_is_populated_object.mdx
index dfe7bf6280cb3..9433f9f616e7b 100644
--- a/api_docs/kbn_ml_is_populated_object.mdx
+++ b/api_docs/kbn_ml_is_populated_object.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-populated-object
 title: "@kbn/ml-is-populated-object"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-populated-object plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-populated-object']
 ---
 import kbnMlIsPopulatedObjectObj from './kbn_ml_is_populated_object.devdocs.json';
diff --git a/api_docs/kbn_ml_local_storage.mdx b/api_docs/kbn_ml_local_storage.mdx
index 299ca53741106..b8e3e252851ba 100644
--- a/api_docs/kbn_ml_local_storage.mdx
+++ b/api_docs/kbn_ml_local_storage.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-local-storage
 title: "@kbn/ml-local-storage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-local-storage plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-local-storage']
 ---
 import kbnMlLocalStorageObj from './kbn_ml_local_storage.devdocs.json';
diff --git a/api_docs/kbn_ml_nested_property.mdx b/api_docs/kbn_ml_nested_property.mdx
index 9d52c5879194f..9dba1efc923d1 100644
--- a/api_docs/kbn_ml_nested_property.mdx
+++ b/api_docs/kbn_ml_nested_property.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-nested-property
 title: "@kbn/ml-nested-property"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-nested-property plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-nested-property']
 ---
 import kbnMlNestedPropertyObj from './kbn_ml_nested_property.devdocs.json';
diff --git a/api_docs/kbn_ml_query_utils.mdx b/api_docs/kbn_ml_query_utils.mdx
index a529d972ab9aa..4c3b9362af006 100644
--- a/api_docs/kbn_ml_query_utils.mdx
+++ b/api_docs/kbn_ml_query_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-query-utils
 title: "@kbn/ml-query-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-query-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-query-utils']
 ---
 import kbnMlQueryUtilsObj from './kbn_ml_query_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_string_hash.mdx b/api_docs/kbn_ml_string_hash.mdx
index f183462e4a98b..6b978e1ec3aa9 100644
--- a/api_docs/kbn_ml_string_hash.mdx
+++ b/api_docs/kbn_ml_string_hash.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-string-hash
 title: "@kbn/ml-string-hash"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-string-hash plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-string-hash']
 ---
 import kbnMlStringHashObj from './kbn_ml_string_hash.devdocs.json';
diff --git a/api_docs/kbn_ml_url_state.mdx b/api_docs/kbn_ml_url_state.mdx
index e5c1fc22380f7..f22f6640f9b8d 100644
--- a/api_docs/kbn_ml_url_state.mdx
+++ b/api_docs/kbn_ml_url_state.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-url-state
 title: "@kbn/ml-url-state"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-url-state plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-url-state']
 ---
 import kbnMlUrlStateObj from './kbn_ml_url_state.devdocs.json';
diff --git a/api_docs/kbn_monaco.mdx b/api_docs/kbn_monaco.mdx
index 481afd6c398b1..fe48c552db063 100644
--- a/api_docs/kbn_monaco.mdx
+++ b/api_docs/kbn_monaco.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-monaco
 title: "@kbn/monaco"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/monaco plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/monaco']
 ---
 import kbnMonacoObj from './kbn_monaco.devdocs.json';
diff --git a/api_docs/kbn_optimizer.mdx b/api_docs/kbn_optimizer.mdx
index 2ca82258c2e62..157fba5b113c3 100644
--- a/api_docs/kbn_optimizer.mdx
+++ b/api_docs/kbn_optimizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer
 title: "@kbn/optimizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer']
 ---
 import kbnOptimizerObj from './kbn_optimizer.devdocs.json';
diff --git a/api_docs/kbn_optimizer_webpack_helpers.mdx b/api_docs/kbn_optimizer_webpack_helpers.mdx
index 36428b40abbab..5b39ddb812a8d 100644
--- a/api_docs/kbn_optimizer_webpack_helpers.mdx
+++ b/api_docs/kbn_optimizer_webpack_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer-webpack-helpers
 title: "@kbn/optimizer-webpack-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer-webpack-helpers plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer-webpack-helpers']
 ---
 import kbnOptimizerWebpackHelpersObj from './kbn_optimizer_webpack_helpers.devdocs.json';
diff --git a/api_docs/kbn_osquery_io_ts_types.mdx b/api_docs/kbn_osquery_io_ts_types.mdx
index 7f9edf9420173..d7fc9e0aa989e 100644
--- a/api_docs/kbn_osquery_io_ts_types.mdx
+++ b/api_docs/kbn_osquery_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-osquery-io-ts-types
 title: "@kbn/osquery-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/osquery-io-ts-types plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/osquery-io-ts-types']
 ---
 import kbnOsqueryIoTsTypesObj from './kbn_osquery_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_performance_testing_dataset_extractor.mdx b/api_docs/kbn_performance_testing_dataset_extractor.mdx
index 6992d7584228b..ae9ec0da0563c 100644
--- a/api_docs/kbn_performance_testing_dataset_extractor.mdx
+++ b/api_docs/kbn_performance_testing_dataset_extractor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-performance-testing-dataset-extractor
 title: "@kbn/performance-testing-dataset-extractor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/performance-testing-dataset-extractor plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/performance-testing-dataset-extractor']
 ---
 import kbnPerformanceTestingDatasetExtractorObj from './kbn_performance_testing_dataset_extractor.devdocs.json';
diff --git a/api_docs/kbn_plugin_generator.mdx b/api_docs/kbn_plugin_generator.mdx
index f55faae505430..0a1e1a1fc3034 100644
--- a/api_docs/kbn_plugin_generator.mdx
+++ b/api_docs/kbn_plugin_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-generator
 title: "@kbn/plugin-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-generator plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-generator']
 ---
 import kbnPluginGeneratorObj from './kbn_plugin_generator.devdocs.json';
diff --git a/api_docs/kbn_plugin_helpers.mdx b/api_docs/kbn_plugin_helpers.mdx
index fcb46b33ef383..5eaabe15b12c0 100644
--- a/api_docs/kbn_plugin_helpers.mdx
+++ b/api_docs/kbn_plugin_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-helpers
 title: "@kbn/plugin-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-helpers plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-helpers']
 ---
 import kbnPluginHelpersObj from './kbn_plugin_helpers.devdocs.json';
diff --git a/api_docs/kbn_react_field.mdx b/api_docs/kbn_react_field.mdx
index 9797c96594f31..720de9e2cebdc 100644
--- a/api_docs/kbn_react_field.mdx
+++ b/api_docs/kbn_react_field.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-field
 title: "@kbn/react-field"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-field plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-field']
 ---
 import kbnReactFieldObj from './kbn_react_field.devdocs.json';
diff --git a/api_docs/kbn_repo_file_maps.mdx b/api_docs/kbn_repo_file_maps.mdx
index b4b8e854ab7f7..a2d4dbadb6df0 100644
--- a/api_docs/kbn_repo_file_maps.mdx
+++ b/api_docs/kbn_repo_file_maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-file-maps
 title: "@kbn/repo-file-maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-file-maps plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-file-maps']
 ---
 import kbnRepoFileMapsObj from './kbn_repo_file_maps.devdocs.json';
diff --git a/api_docs/kbn_repo_linter.mdx b/api_docs/kbn_repo_linter.mdx
index 6d9d4bd31633f..d8b41a4a84944 100644
--- a/api_docs/kbn_repo_linter.mdx
+++ b/api_docs/kbn_repo_linter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-linter
 title: "@kbn/repo-linter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-linter plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-linter']
 ---
 import kbnRepoLinterObj from './kbn_repo_linter.devdocs.json';
diff --git a/api_docs/kbn_repo_path.mdx b/api_docs/kbn_repo_path.mdx
index 20a7f7e792f7d..2a4440cf0651f 100644
--- a/api_docs/kbn_repo_path.mdx
+++ b/api_docs/kbn_repo_path.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-path
 title: "@kbn/repo-path"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-path plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-path']
 ---
 import kbnRepoPathObj from './kbn_repo_path.devdocs.json';
diff --git a/api_docs/kbn_repo_source_classifier.mdx b/api_docs/kbn_repo_source_classifier.mdx
index 62c5b1327bfed..2fd30a14e9412 100644
--- a/api_docs/kbn_repo_source_classifier.mdx
+++ b/api_docs/kbn_repo_source_classifier.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-source-classifier
 title: "@kbn/repo-source-classifier"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-source-classifier plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-source-classifier']
 ---
 import kbnRepoSourceClassifierObj from './kbn_repo_source_classifier.devdocs.json';
diff --git a/api_docs/kbn_rison.mdx b/api_docs/kbn_rison.mdx
index 6d9a81f63c935..a8276f3dce124 100644
--- a/api_docs/kbn_rison.mdx
+++ b/api_docs/kbn_rison.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rison
 title: "@kbn/rison"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rison plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rison']
 ---
 import kbnRisonObj from './kbn_rison.devdocs.json';
diff --git a/api_docs/kbn_rule_data_utils.mdx b/api_docs/kbn_rule_data_utils.mdx
index 9b1a46ae7fbb4..fb177a8c1370b 100644
--- a/api_docs/kbn_rule_data_utils.mdx
+++ b/api_docs/kbn_rule_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rule-data-utils
 title: "@kbn/rule-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rule-data-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rule-data-utils']
 ---
 import kbnRuleDataUtilsObj from './kbn_rule_data_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_autocomplete.mdx b/api_docs/kbn_securitysolution_autocomplete.mdx
index 52cd9fca3742e..c3a27e0cd07bb 100644
--- a/api_docs/kbn_securitysolution_autocomplete.mdx
+++ b/api_docs/kbn_securitysolution_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-autocomplete
 title: "@kbn/securitysolution-autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-autocomplete plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-autocomplete']
 ---
 import kbnSecuritysolutionAutocompleteObj from './kbn_securitysolution_autocomplete.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_ecs.mdx b/api_docs/kbn_securitysolution_ecs.mdx
index 3cf533ae5676a..d3b9ed5dc3320 100644
--- a/api_docs/kbn_securitysolution_ecs.mdx
+++ b/api_docs/kbn_securitysolution_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-ecs
 title: "@kbn/securitysolution-ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-ecs plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-ecs']
 ---
 import kbnSecuritysolutionEcsObj from './kbn_securitysolution_ecs.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_es_utils.mdx b/api_docs/kbn_securitysolution_es_utils.mdx
index 2ec7d76728d08..fde1cd53fcb60 100644
--- a/api_docs/kbn_securitysolution_es_utils.mdx
+++ b/api_docs/kbn_securitysolution_es_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-es-utils
 title: "@kbn/securitysolution-es-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-es-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-es-utils']
 ---
 import kbnSecuritysolutionEsUtilsObj from './kbn_securitysolution_es_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_exception_list_components.devdocs.json b/api_docs/kbn_securitysolution_exception_list_components.devdocs.json
index c798c33780ef8..ac133f4bb5cda 100644
--- a/api_docs/kbn_securitysolution_exception_list_components.devdocs.json
+++ b/api_docs/kbn_securitysolution_exception_list_components.devdocs.json
@@ -721,7 +721,7 @@
             "label": "item",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
             ],
             "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/header/index.tsx",
             "deprecated": false,
@@ -788,7 +788,7 @@
             "label": "item",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
             ],
             "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx",
             "deprecated": false,
@@ -904,7 +904,7 @@
             "label": "exceptionItem",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
             ],
             "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/exception_item_card.tsx",
             "deprecated": false,
@@ -1095,7 +1095,7 @@
             "label": "onEditException",
             "description": [],
             "signature": [
-              "(item: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void"
+              "(item: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void"
             ],
             "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/exception_item_card.tsx",
             "deprecated": false,
@@ -1109,7 +1109,7 @@
                 "label": "item",
                 "description": [],
                 "signature": [
-                  "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+                  "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
                 ],
                 "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/exception_item_card.tsx",
                 "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_exception_list_components.mdx b/api_docs/kbn_securitysolution_exception_list_components.mdx
index bae06c5a982fa..7eabfe249b136 100644
--- a/api_docs/kbn_securitysolution_exception_list_components.mdx
+++ b/api_docs/kbn_securitysolution_exception_list_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-exception-list-components
 title: "@kbn/securitysolution-exception-list-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-exception-list-components plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-exception-list-components']
 ---
 import kbnSecuritysolutionExceptionListComponentsObj from './kbn_securitysolution_exception_list_components.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_hook_utils.mdx b/api_docs/kbn_securitysolution_hook_utils.mdx
index d2cb1e09271b4..6bf6e2f225458 100644
--- a/api_docs/kbn_securitysolution_hook_utils.mdx
+++ b/api_docs/kbn_securitysolution_hook_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-hook-utils
 title: "@kbn/securitysolution-hook-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-hook-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-hook-utils']
 ---
 import kbnSecuritysolutionHookUtilsObj from './kbn_securitysolution_hook_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
index ddcf822de96fd..f888f3c7759fc 100644
--- a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-alerting-types
 title: "@kbn/securitysolution-io-ts-alerting-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-alerting-types plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-alerting-types']
 ---
 import kbnSecuritysolutionIoTsAlertingTypesObj from './kbn_securitysolution_io_ts_alerting_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json b/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json
index 9bcbaf8108ab8..e0f7d8909b79b 100644
--- a/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json
+++ b/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json
@@ -27,7 +27,7 @@
         "label": "updateExceptionListItemValidate",
         "description": [],
         "signature": [
-          "(schema: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]"
+          "(schema: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts",
         "deprecated": false,
@@ -41,7 +41,7 @@
             "label": "schema",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts",
             "deprecated": false,
@@ -60,7 +60,7 @@
         "label": "validateComments",
         "description": [],
         "signature": [
-          "(item: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]"
+          "(item: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts",
         "deprecated": false,
@@ -74,7 +74,7 @@
             "label": "item",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts",
             "deprecated": false,
@@ -162,7 +162,7 @@
             "label": "listItem",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
             "deprecated": false,
@@ -718,7 +718,7 @@
             "label": "exceptions",
             "description": [],
             "signature": [
-              "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]"
+              "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
             "deprecated": false,
@@ -1037,6 +1037,17 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
+            "id": "def-common.ApiListExportProps.includeExpiredExceptions",
+            "type": "boolean",
+            "tags": [],
+            "label": "includeExpiredExceptions",
+            "description": [],
+            "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
             "id": "def-common.ApiListExportProps.listId",
@@ -1424,6 +1435,17 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
+            "id": "def-common.ExportExceptionListProps.includeExpiredExceptions",
+            "type": "boolean",
+            "tags": [],
+            "label": "includeExpiredExceptions",
+            "description": [],
+            "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
             "id": "def-common.ExportExceptionListProps.signal",
@@ -1589,7 +1611,7 @@
             "label": "exceptions",
             "description": [],
             "signature": [
-              "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]"
+              "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
             "deprecated": false,
@@ -1847,7 +1869,7 @@
             "label": "listItem",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
             "deprecated": false,
@@ -1945,7 +1967,7 @@
             "label": "exceptions",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
             ],
             "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts",
             "deprecated": false,
@@ -2602,7 +2624,7 @@
         "label": "CreateEndpointListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; expire_time?: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -2617,7 +2639,7 @@
         "label": "CreateEndpointListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Omit<{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"os_types\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Omit<{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; expire_time: string | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"expire_time\" | \"item_id\" | \"os_types\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; expire_time: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -2647,7 +2669,7 @@
         "label": "CreateExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -2662,7 +2684,7 @@
         "label": "CreateExceptionListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; expire_time: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"expire_time\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; expire_time: string | undefined; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -2767,7 +2789,7 @@
         "label": "CreateRuleExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; list_id?: undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; list_id?: undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; expire_time?: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts",
         "deprecated": false,
@@ -2782,7 +2804,7 @@
         "label": "CreateRuleExceptionListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; list_id: undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; list_id: undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; expire_time: string | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"expire_time\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; expire_time: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts",
         "deprecated": false,
@@ -3247,7 +3269,7 @@
         "label": "ExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -3344,6 +3366,21 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
+        "id": "def-common.ExpireTimeOrUndefined",
+        "type": "Type",
+        "tags": [],
+        "label": "ExpireTimeOrUndefined",
+        "description": [],
+        "signature": [
+          "string | undefined"
+        ],
+        "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
         "id": "def-common.ExportExceptionDetails",
@@ -3367,7 +3404,7 @@
         "label": "ExportExceptionListQuerySchema",
         "description": [],
         "signature": [
-          "{ id: string; list_id: string; namespace_type: \"single\" | \"agnostic\" | undefined; }"
+          "{ id: string; list_id: string; namespace_type: \"single\" | \"agnostic\" | undefined; include_expired_exceptions: \"false\" | \"true\" | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.ts",
         "deprecated": false,
@@ -3607,7 +3644,7 @@
         "label": "FoundExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }"
+          "{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -3682,7 +3719,7 @@
         "label": "GetExceptionFilterSchema",
         "description": [],
         "signature": [
-          "({ exception_list_ids: { exception_list_id: string; namespace_type: \"single\" | \"agnostic\"; }[]; type: \"exception_list_ids\"; } | { exceptions: ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]; type: \"exception_items\"; }) & { alias?: string | undefined; chunk_size?: number | undefined; exclude_exceptions?: boolean | undefined; }"
+          "({ exception_list_ids: { exception_list_id: string; namespace_type: \"single\" | \"agnostic\"; }[]; type: \"exception_list_ids\"; } | { exceptions: ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]; type: \"exception_items\"; }) & { alias?: string | undefined; chunk_size?: number | undefined; exclude_exceptions?: boolean | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/get_exception_filter_schema/index.ts",
         "deprecated": false,
@@ -3802,7 +3839,7 @@
         "label": "ImportExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; expire_time?: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts",
         "deprecated": false,
@@ -3817,7 +3854,7 @@
         "label": "ImportExceptionListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; expire_time?: string | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"expire_time\" | \"item_id\" | \"namespace_type\"> & { comments: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; expire_time: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts",
         "deprecated": false,
@@ -5077,7 +5114,7 @@
         "label": "UpdateEndpointListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; expire_time?: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -5092,7 +5129,7 @@
         "label": "UpdateEndpointListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; expire_time: string | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"expire_time\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; expire_time: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -5107,7 +5144,7 @@
         "label": "UpdateExceptionListItemSchema",
         "description": [],
         "signature": [
-          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -5122,7 +5159,7 @@
         "label": "UpdateExceptionListItemSchemaDecoded",
         "description": [],
         "signature": [
-          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"namespace_type\" | \"os_types\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }"
+          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time: string | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"expire_time\" | \"namespace_type\" | \"os_types\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; expire_time: string | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts",
         "deprecated": false,
@@ -5587,7 +5624,13 @@
           "UndefinedC",
           "]>; tags: ",
           "Type",
-          "<string[], string[] | undefined, unknown>; }>>]>"
+          "<string[], string[] | undefined, unknown>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; }>>]>"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -5689,7 +5732,13 @@
           "PartialC",
           "<{ comments: ",
           "Type",
-          "<{ comment: string; }[], { comment: string; }[], unknown>; item_id: ",
+          "<{ comment: string; }[], { comment: string; }[], unknown>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; item_id: ",
           "Type",
           "<string, string | undefined, unknown>; meta: ",
           "ObjectC",
@@ -5871,7 +5920,13 @@
           "UndefinedC",
           "]>; tags: ",
           "Type",
-          "<string[], string[] | undefined, unknown>; }>>]>"
+          "<string[], string[] | undefined, unknown>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; }>>]>"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts",
         "deprecated": false,
@@ -6890,7 +6945,13 @@
           "KeyofC",
           "<{ wildcard: null; }>; value: ",
           "Type",
-          "<string, string, unknown>; }>>]>>; id: ",
+          "<string, string, unknown>; }>>]>>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; id: ",
           "Type",
           "<string, string, unknown>; item_id: ",
           "Type",
@@ -7214,7 +7275,13 @@
           "KeyofC",
           "<{ wildcard: null; }>; value: ",
           "Type",
-          "<string, string, unknown>; }>>]>>; id: ",
+          "<string, string, unknown>; }>>]>>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; id: ",
           "Type",
           "<string, string, unknown>; item_id: ",
           "Type",
@@ -7264,7 +7331,13 @@
           "PartialC",
           "<{ comments: ",
           "Type",
-          "<{ comment: string; }[], { comment: string; }[], unknown>; item_id: ",
+          "<{ comment: string; }[], { comment: string; }[], unknown>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; item_id: ",
           "Type",
           "<string, string | undefined, unknown>; meta: ",
           "ObjectC",
@@ -7287,6 +7360,42 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
+        "id": "def-common.expireTime",
+        "type": "Object",
+        "tags": [],
+        "label": "expireTime",
+        "description": [],
+        "signature": [
+          "Type",
+          "<string, string, unknown>"
+        ],
+        "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
+        "id": "def-common.expireTimeOrUndefined",
+        "type": "Object",
+        "tags": [],
+        "label": "expireTimeOrUndefined",
+        "description": [],
+        "signature": [
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>"
+        ],
+        "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/securitysolution-io-ts-list-types",
         "id": "def-common.exportExceptionDetails",
@@ -7458,7 +7567,13 @@
           "Type",
           "<string, string, unknown>; namespace_type: ",
           "Type",
-          "<\"single\" | \"agnostic\", \"single\" | \"agnostic\" | undefined, unknown>; }>>"
+          "<\"single\" | \"agnostic\", \"single\" | \"agnostic\" | undefined, unknown>; include_expired_exceptions: ",
+          "UnionC",
+          "<[",
+          "KeyofC",
+          "<{ true: null; false: null; }>, ",
+          "UndefinedC",
+          "]>; }>>"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.ts",
         "deprecated": false,
@@ -7947,7 +8062,13 @@
           "KeyofC",
           "<{ wildcard: null; }>; value: ",
           "Type",
-          "<string, string, unknown>; }>>]>>; id: ",
+          "<string, string, unknown>; }>>]>>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; id: ",
           "Type",
           "<string, string, unknown>; item_id: ",
           "Type",
@@ -8483,7 +8604,13 @@
           "KeyofC",
           "<{ wildcard: null; }>; value: ",
           "Type",
-          "<string, string, unknown>; }>>]>>; id: ",
+          "<string, string, unknown>; }>>]>>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; id: ",
           "Type",
           "<string, string, unknown>; item_id: ",
           "Type",
@@ -8533,7 +8660,13 @@
           "PartialC",
           "<{ comments: ",
           "Type",
-          "<{ comment: string; }[], { comment: string; }[], unknown>; item_id: ",
+          "<{ comment: string; }[], { comment: string; }[], unknown>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; item_id: ",
           "Type",
           "<string, string | undefined, unknown>; meta: ",
           "ObjectC",
@@ -8848,7 +8981,13 @@
           "UndefinedC",
           "]>; tags: ",
           "Type",
-          "<string[], string[] | undefined, unknown>; }>>]>"
+          "<string[], string[] | undefined, unknown>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; }>>]>"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts",
         "deprecated": false,
@@ -10888,7 +11027,13 @@
           "UndefinedC",
           "]>; tags: ",
           "Type",
-          "<string[], string[] | undefined, unknown>; }>>]>"
+          "<string[], string[] | undefined, unknown>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; }>>]>"
         ],
         "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts",
         "deprecated": false,
@@ -10924,7 +11069,13 @@
           "StringC",
           "; comments: ",
           "Type",
-          "<({ comment: string; } & { id?: string | undefined; })[], ({ comment: string; } & { id?: string | undefined; })[], unknown>; id: ",
+          "<({ comment: string; } & { id?: string | undefined; })[], ({ comment: string; } & { id?: string | undefined; })[], unknown>; expire_time: ",
+          "UnionC",
+          "<[",
+          "Type",
+          "<string, string, unknown>, ",
+          "UndefinedC",
+          "]>; id: ",
           "Type",
           "<string, string, unknown>; item_id: ",
           "UnionC",
diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.mdx b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
index 87c025c2d59ea..0a6d48191c77c 100644
--- a/api_docs/kbn_securitysolution_io_ts_list_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-list-types
 title: "@kbn/securitysolution-io-ts-list-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-list-types plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-list-types']
 ---
 import kbnSecuritysolutionIoTsListTypesObj from './kbn_securitysolution_io_ts_list_types.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 511 | 1 | 498 | 0 |
+| 516 | 1 | 503 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_securitysolution_io_ts_types.mdx b/api_docs/kbn_securitysolution_io_ts_types.mdx
index dcec40a90dd20..20f250b74f1ce 100644
--- a/api_docs/kbn_securitysolution_io_ts_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-types
 title: "@kbn/securitysolution-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-types plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-types']
 ---
 import kbnSecuritysolutionIoTsTypesObj from './kbn_securitysolution_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_utils.mdx b/api_docs/kbn_securitysolution_io_ts_utils.mdx
index 5e447a827e7d4..05b26d868ca70 100644
--- a/api_docs/kbn_securitysolution_io_ts_utils.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-utils
 title: "@kbn/securitysolution-io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-utils']
 ---
 import kbnSecuritysolutionIoTsUtilsObj from './kbn_securitysolution_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_api.devdocs.json b/api_docs/kbn_securitysolution_list_api.devdocs.json
index cd8334e742dda..06ea8141f8bf8 100644
--- a/api_docs/kbn_securitysolution_list_api.devdocs.json
+++ b/api_docs/kbn_securitysolution_list_api.devdocs.json
@@ -82,7 +82,7 @@
             "section": "def-common.AddExceptionListItemProps",
             "text": "AddExceptionListItemProps"
           },
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
@@ -270,7 +270,7 @@
             "section": "def-common.ApiCallByIdProps",
             "text": "ApiCallByIdProps"
           },
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
@@ -357,10 +357,10 @@
         ],
         "label": "exportExceptionList",
         "description": [
-          "\nFetch an ExceptionList by providing a ExceptionList ID\n"
+          "\nExport an ExceptionList by providing a ExceptionList ID\n"
         ],
         "signature": [
-          "({ http, id, listId, namespaceType, signal, }: ",
+          "({ http, id, includeExpiredExceptions, listId, namespaceType, signal, }: ",
           {
             "pluginId": "@kbn/securitysolution-io-ts-list-types",
             "scope": "common",
@@ -379,7 +379,7 @@
             "id": "def-common.exportExceptionList.$1",
             "type": "Object",
             "tags": [],
-            "label": "{\n  http,\n  id,\n  listId,\n  namespaceType,\n  signal,\n}",
+            "label": "{\n  http,\n  id,\n  includeExpiredExceptions,\n  listId,\n  namespaceType,\n  signal,\n}",
             "description": [],
             "signature": [
               {
@@ -509,7 +509,7 @@
             "section": "def-common.ApiCallByIdProps",
             "text": "ApiCallByIdProps"
           },
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
@@ -556,7 +556,7 @@
             "section": "def-common.ApiCallByListIdProps",
             "text": "ApiCallByListIdProps"
           },
-          ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }>"
+          ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
@@ -1072,7 +1072,7 @@
             "section": "def-common.UpdateExceptionListItemProps",
             "text": "UpdateExceptionListItemProps"
           },
-          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+          ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
         ],
         "path": "packages/kbn-securitysolution-list-api/src/api/index.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_list_api.mdx b/api_docs/kbn_securitysolution_list_api.mdx
index 634ddd56b3b60..04608accb4089 100644
--- a/api_docs/kbn_securitysolution_list_api.mdx
+++ b/api_docs/kbn_securitysolution_list_api.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-api
 title: "@kbn/securitysolution-list-api"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-api plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-api']
 ---
 import kbnSecuritysolutionListApiObj from './kbn_securitysolution_list_api.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_constants.mdx b/api_docs/kbn_securitysolution_list_constants.mdx
index cdb41f0ccd69a..d7eb2f840a04c 100644
--- a/api_docs/kbn_securitysolution_list_constants.mdx
+++ b/api_docs/kbn_securitysolution_list_constants.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-constants
 title: "@kbn/securitysolution-list-constants"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-constants plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-constants']
 ---
 import kbnSecuritysolutionListConstantsObj from './kbn_securitysolution_list_constants.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_hooks.devdocs.json b/api_docs/kbn_securitysolution_list_hooks.devdocs.json
index befcfaaecfb13..17612ab74ada0 100644
--- a/api_docs/kbn_securitysolution_list_hooks.devdocs.json
+++ b/api_docs/kbn_securitysolution_list_hooks.devdocs.json
@@ -29,7 +29,7 @@
           "\nThis adds an id to the incoming exception item entries as ReactJS prefers to have\nan id added to them for use as a stable id. Later if we decide to change the data\nmodel to have id's within the array then this code should be removed. If not, then\nthis code should stay as an adapter for ReactJS.\n\nThis does break the type system slightly as we are lying a bit to the type system as we return\nthe same exceptionItem as we have previously but are augmenting the arrays with an id which TypeScript\ndoesn't mind us doing here. However, downstream you will notice that you have an id when the type\ndoes not indicate it. In that case use (ExceptionItem & { id: string }) temporarily if you're using the id. If you're not,\nyou can ignore the id and just use the normal TypeScript with ReactJS.\n"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -45,7 +45,7 @@
               "The exceptionItem to add an id to the threat matches."
             ],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -68,7 +68,7 @@
           "\nThis removes createdAt, createdBy from the exceptionItem if  a comment was added to\nthe Exception item, and return the comment message with id to prevent creating the commet\ntwice"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -84,7 +84,7 @@
               "The exceptionItem to remove createdAt, createdBy from the comments array."
             ],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -146,7 +146,7 @@
           "\nTransforms the output of rules to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the input called \"myNewTransform\" do it\nin the form of:\nflow(addIdToExceptionItemEntries, myNewTransform)(exceptionItem)\n"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -162,7 +162,7 @@
               "The exceptionItem to transform the output of"
             ],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -183,7 +183,7 @@
         "label": "transformNewItemOutput",
         "description": [],
         "signature": [
-          "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+          "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -197,7 +197,7 @@
             "label": "exceptionItem",
             "description": [],
             "signature": [
-              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+              "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -218,7 +218,7 @@
           "\nTransforms the output of exception items to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the output called \"myNewTransform\" do it\nin the form of:\nflow(removeIdFromExceptionItemsEntries, myNewTransform)(exceptionItem)\n"
         ],
         "signature": [
-          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+          "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
         "deprecated": false,
@@ -234,7 +234,7 @@
               "The exceptionItem to transform the output of"
             ],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts",
             "deprecated": false,
@@ -851,7 +851,7 @@
             "label": "addExceptionListItem",
             "description": [],
             "signature": [
-              "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
             "deprecated": false,
@@ -876,7 +876,7 @@
                     "label": "listItem",
                     "description": [],
                     "signature": [
-                      "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+                      "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
                     ],
                     "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
                     "deprecated": false,
@@ -895,7 +895,7 @@
             "label": "updateExceptionListItem",
             "description": [],
             "signature": [
-              "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
             "deprecated": false,
@@ -920,7 +920,7 @@
                     "label": "listItem",
                     "description": [],
                     "signature": [
-                      "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
+                      "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }"
                     ],
                     "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
                     "deprecated": false,
@@ -1039,7 +1039,7 @@
                 "section": "def-common.ApiCallMemoProps",
                 "text": "ApiCallMemoProps"
               },
-              " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }) => Promise<void>"
+              " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }) => Promise<void>"
             ],
             "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
             "deprecated": false,
@@ -1060,7 +1060,7 @@
                     "section": "def-common.ApiCallMemoProps",
                     "text": "ApiCallMemoProps"
                   },
-                  " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }"
+                  " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }"
                 ],
                 "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts",
                 "deprecated": false,
@@ -1423,7 +1423,7 @@
         "label": "ReturnPersistExceptionItem",
         "description": [],
         "signature": [
-          "[PersistReturnExceptionItem, React.Dispatch<({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | null>]"
+          "[PersistReturnExceptionItem, React.Dispatch<({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; expire_time?: string | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | null>]"
         ],
         "path": "packages/kbn-securitysolution-list-hooks/src/use_persist_exception_item/index.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_list_hooks.mdx b/api_docs/kbn_securitysolution_list_hooks.mdx
index 4710c86dc94f9..167947b91524a 100644
--- a/api_docs/kbn_securitysolution_list_hooks.mdx
+++ b/api_docs/kbn_securitysolution_list_hooks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-hooks
 title: "@kbn/securitysolution-list-hooks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-hooks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-hooks']
 ---
 import kbnSecuritysolutionListHooksObj from './kbn_securitysolution_list_hooks.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_utils.devdocs.json b/api_docs/kbn_securitysolution_list_utils.devdocs.json
index c986b7d4d909f..742d5ec178963 100644
--- a/api_docs/kbn_securitysolution_list_utils.devdocs.json
+++ b/api_docs/kbn_securitysolution_list_utils.devdocs.json
@@ -52,6 +52,102 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/securitysolution-list-utils",
+        "id": "def-common.buildShowActiveExceptionsFilter",
+        "type": "Function",
+        "tags": [],
+        "label": "buildShowActiveExceptionsFilter",
+        "description": [],
+        "signature": [
+          "(savedObjectPrefix: ",
+          {
+            "pluginId": "@kbn/securitysolution-list-utils",
+            "scope": "common",
+            "docId": "kibKbnSecuritysolutionListUtilsPluginApi",
+            "section": "def-common.SavedObjectType",
+            "text": "SavedObjectType"
+          },
+          "[]) => string"
+        ],
+        "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-list-utils",
+            "id": "def-common.buildShowActiveExceptionsFilter.$1",
+            "type": "Array",
+            "tags": [],
+            "label": "savedObjectPrefix",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-list-utils",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionListUtilsPluginApi",
+                "section": "def-common.SavedObjectType",
+                "text": "SavedObjectType"
+              },
+              "[]"
+            ],
+            "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-list-utils",
+        "id": "def-common.buildShowExpiredExceptionsFilter",
+        "type": "Function",
+        "tags": [],
+        "label": "buildShowExpiredExceptionsFilter",
+        "description": [],
+        "signature": [
+          "(savedObjectPrefix: ",
+          {
+            "pluginId": "@kbn/securitysolution-list-utils",
+            "scope": "common",
+            "docId": "kibKbnSecuritysolutionListUtilsPluginApi",
+            "section": "def-common.SavedObjectType",
+            "text": "SavedObjectType"
+          },
+          "[]) => string"
+        ],
+        "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-list-utils",
+            "id": "def-common.buildShowExpiredExceptionsFilter.$1",
+            "type": "Array",
+            "tags": [],
+            "label": "savedObjectPrefix",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-list-utils",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionListUtilsPluginApi",
+                "section": "def-common.SavedObjectType",
+                "text": "SavedObjectType"
+              },
+              "[]"
+            ],
+            "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/securitysolution-list-utils",
         "id": "def-common.containsValueListEntry",
@@ -2996,7 +3092,7 @@
         "label": "CreateExceptionListItemBuilderSchema",
         "description": [],
         "signature": [
-          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"entries\" | \"meta\" | \"list_id\" | \"namespace_type\"> & { meta: { temporaryUuid: string; }; entries: ",
+          "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"entries\" | \"meta\" | \"list_id\" | \"namespace_type\"> & { meta: { temporaryUuid: string; }; entries: ",
           {
             "pluginId": "@kbn/securitysolution-list-utils",
             "scope": "common",
@@ -3122,7 +3218,7 @@
         "label": "ExceptionListItemBuilderSchema",
         "description": [],
         "signature": [
-          "Omit<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }, \"entries\"> & { entries: ",
+          "Omit<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }, \"entries\"> & { entries: ",
           {
             "pluginId": "@kbn/securitysolution-list-utils",
             "scope": "common",
@@ -3189,7 +3285,7 @@
         "label": "ExceptionsBuilderReturnExceptionItem",
         "description": [],
         "signature": [
-          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; list_id?: undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })"
+          "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; expire_time?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; list_id?: undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; expire_time?: string | undefined; })"
         ],
         "path": "packages/kbn-securitysolution-list-utils/src/types/index.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_list_utils.mdx b/api_docs/kbn_securitysolution_list_utils.mdx
index e3c3832e66e49..ced8398dd4b36 100644
--- a/api_docs/kbn_securitysolution_list_utils.mdx
+++ b/api_docs/kbn_securitysolution_list_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-utils
 title: "@kbn/securitysolution-list-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-utils']
 ---
 import kbnSecuritysolutionListUtilsObj from './kbn_securitysolution_list_utils.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 202 | 10 | 155 | 0 |
+| 206 | 10 | 159 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_securitysolution_rules.mdx b/api_docs/kbn_securitysolution_rules.mdx
index 40ff524695859..b73302312431b 100644
--- a/api_docs/kbn_securitysolution_rules.mdx
+++ b/api_docs/kbn_securitysolution_rules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-rules
 title: "@kbn/securitysolution-rules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-rules plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-rules']
 ---
 import kbnSecuritysolutionRulesObj from './kbn_securitysolution_rules.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_t_grid.mdx b/api_docs/kbn_securitysolution_t_grid.mdx
index e000a16750235..f3fd855cab0d6 100644
--- a/api_docs/kbn_securitysolution_t_grid.mdx
+++ b/api_docs/kbn_securitysolution_t_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-t-grid
 title: "@kbn/securitysolution-t-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-t-grid plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-t-grid']
 ---
 import kbnSecuritysolutionTGridObj from './kbn_securitysolution_t_grid.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx
index a118ef42e9292..f2e5eab9d4bce 100644
--- a/api_docs/kbn_securitysolution_utils.mdx
+++ b/api_docs/kbn_securitysolution_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-utils
 title: "@kbn/securitysolution-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-utils']
 ---
 import kbnSecuritysolutionUtilsObj from './kbn_securitysolution_utils.devdocs.json';
diff --git a/api_docs/kbn_server_http_tools.mdx b/api_docs/kbn_server_http_tools.mdx
index 2471d185564e8..ac2de050d04f0 100644
--- a/api_docs/kbn_server_http_tools.mdx
+++ b/api_docs/kbn_server_http_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-http-tools
 title: "@kbn/server-http-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-http-tools plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-http-tools']
 ---
 import kbnServerHttpToolsObj from './kbn_server_http_tools.devdocs.json';
diff --git a/api_docs/kbn_server_route_repository.mdx b/api_docs/kbn_server_route_repository.mdx
index 46cc3e8022286..37600d05e54ef 100644
--- a/api_docs/kbn_server_route_repository.mdx
+++ b/api_docs/kbn_server_route_repository.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-route-repository
 title: "@kbn/server-route-repository"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-route-repository plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-route-repository']
 ---
 import kbnServerRouteRepositoryObj from './kbn_server_route_repository.devdocs.json';
diff --git a/api_docs/kbn_shared_svg.mdx b/api_docs/kbn_shared_svg.mdx
index a5a8e452b1a0b..ec3d5ee69d0a9 100644
--- a/api_docs/kbn_shared_svg.mdx
+++ b/api_docs/kbn_shared_svg.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-svg
 title: "@kbn/shared-svg"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-svg plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-svg']
 ---
 import kbnSharedSvgObj from './kbn_shared_svg.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_solution.mdx b/api_docs/kbn_shared_ux_avatar_solution.mdx
index a20ea41fd39b6..242fa9bde480a 100644
--- a/api_docs/kbn_shared_ux_avatar_solution.mdx
+++ b/api_docs/kbn_shared_ux_avatar_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-solution
 title: "@kbn/shared-ux-avatar-solution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-solution plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-solution']
 ---
 import kbnSharedUxAvatarSolutionObj from './kbn_shared_ux_avatar_solution.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
index 0e68addd6fccb..bff1ca51c1cf0 100644
--- a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
+++ b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-user-profile-components
 title: "@kbn/shared-ux-avatar-user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-user-profile-components plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-user-profile-components']
 ---
 import kbnSharedUxAvatarUserProfileComponentsObj from './kbn_shared_ux_avatar_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
index 0a13d89e8fa3a..746dc70ecdf1a 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen
 title: "@kbn/shared-ux-button-exit-full-screen"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen']
 ---
 import kbnSharedUxButtonExitFullScreenObj from './kbn_shared_ux_button_exit_full_screen.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
index eadbee884d434..7d6e9d90ef635 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen-mocks
 title: "@kbn/shared-ux-button-exit-full-screen-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen-mocks']
 ---
 import kbnSharedUxButtonExitFullScreenMocksObj from './kbn_shared_ux_button_exit_full_screen_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_toolbar.mdx b/api_docs/kbn_shared_ux_button_toolbar.mdx
index fc0abad984436..e19ae2898056c 100644
--- a/api_docs/kbn_shared_ux_button_toolbar.mdx
+++ b/api_docs/kbn_shared_ux_button_toolbar.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-toolbar
 title: "@kbn/shared-ux-button-toolbar"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-toolbar plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-toolbar']
 ---
 import kbnSharedUxButtonToolbarObj from './kbn_shared_ux_button_toolbar.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data.mdx b/api_docs/kbn_shared_ux_card_no_data.mdx
index 64ded261cbf82..915a5533e79d9 100644
--- a/api_docs/kbn_shared_ux_card_no_data.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data
 title: "@kbn/shared-ux-card-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data']
 ---
 import kbnSharedUxCardNoDataObj from './kbn_shared_ux_card_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
index 30d2b316ed83a..033e13e53ae8f 100644
--- a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data-mocks
 title: "@kbn/shared-ux-card-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data-mocks']
 ---
 import kbnSharedUxCardNoDataMocksObj from './kbn_shared_ux_card_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_context.mdx b/api_docs/kbn_shared_ux_file_context.mdx
index c82fcb1f119e7..8f1ccdacd9035 100644
--- a/api_docs/kbn_shared_ux_file_context.mdx
+++ b/api_docs/kbn_shared_ux_file_context.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-context
 title: "@kbn/shared-ux-file-context"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-context plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-context']
 ---
 import kbnSharedUxFileContextObj from './kbn_shared_ux_file_context.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image.mdx b/api_docs/kbn_shared_ux_file_image.mdx
index 1f29487e02a00..347c13b2eee30 100644
--- a/api_docs/kbn_shared_ux_file_image.mdx
+++ b/api_docs/kbn_shared_ux_file_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image
 title: "@kbn/shared-ux-file-image"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image']
 ---
 import kbnSharedUxFileImageObj from './kbn_shared_ux_file_image.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image_mocks.mdx b/api_docs/kbn_shared_ux_file_image_mocks.mdx
index b804cd4df130a..d9c4d8fca6aec 100644
--- a/api_docs/kbn_shared_ux_file_image_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_image_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image-mocks
 title: "@kbn/shared-ux-file-image-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image-mocks']
 ---
 import kbnSharedUxFileImageMocksObj from './kbn_shared_ux_file_image_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_mocks.mdx b/api_docs/kbn_shared_ux_file_mocks.mdx
index fc718ca3768b8..cde9d3b845bdf 100644
--- a/api_docs/kbn_shared_ux_file_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-mocks
 title: "@kbn/shared-ux-file-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-mocks']
 ---
 import kbnSharedUxFileMocksObj from './kbn_shared_ux_file_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_picker.mdx b/api_docs/kbn_shared_ux_file_picker.mdx
index 13b8d92994548..557c5b7d82e0f 100644
--- a/api_docs/kbn_shared_ux_file_picker.mdx
+++ b/api_docs/kbn_shared_ux_file_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-picker
 title: "@kbn/shared-ux-file-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-picker plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-picker']
 ---
 import kbnSharedUxFilePickerObj from './kbn_shared_ux_file_picker.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_upload.mdx b/api_docs/kbn_shared_ux_file_upload.mdx
index bc54d2cb82af9..e7a024233b3d6 100644
--- a/api_docs/kbn_shared_ux_file_upload.mdx
+++ b/api_docs/kbn_shared_ux_file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-upload
 title: "@kbn/shared-ux-file-upload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-upload plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-upload']
 ---
 import kbnSharedUxFileUploadObj from './kbn_shared_ux_file_upload.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_util.mdx b/api_docs/kbn_shared_ux_file_util.mdx
index 31b6d8bace03b..161e71ee47e14 100644
--- a/api_docs/kbn_shared_ux_file_util.mdx
+++ b/api_docs/kbn_shared_ux_file_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-util
 title: "@kbn/shared-ux-file-util"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-util plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-util']
 ---
 import kbnSharedUxFileUtilObj from './kbn_shared_ux_file_util.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app.mdx b/api_docs/kbn_shared_ux_link_redirect_app.mdx
index c95515ec57f6b..5597eaf399d4d 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app
 title: "@kbn/shared-ux-link-redirect-app"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app']
 ---
 import kbnSharedUxLinkRedirectAppObj from './kbn_shared_ux_link_redirect_app.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
index e5bb0c8195a4a..85897c68d5109 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app-mocks
 title: "@kbn/shared-ux-link-redirect-app-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app-mocks']
 ---
 import kbnSharedUxLinkRedirectAppMocksObj from './kbn_shared_ux_link_redirect_app_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown.mdx b/api_docs/kbn_shared_ux_markdown.mdx
index e2f86c1536432..e36ffd5463351 100644
--- a/api_docs/kbn_shared_ux_markdown.mdx
+++ b/api_docs/kbn_shared_ux_markdown.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown
 title: "@kbn/shared-ux-markdown"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown']
 ---
 import kbnSharedUxMarkdownObj from './kbn_shared_ux_markdown.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown_mocks.mdx b/api_docs/kbn_shared_ux_markdown_mocks.mdx
index c7b7f92125c2b..164d846bb0b86 100644
--- a/api_docs/kbn_shared_ux_markdown_mocks.mdx
+++ b/api_docs/kbn_shared_ux_markdown_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown-mocks
 title: "@kbn/shared-ux-markdown-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown-mocks']
 ---
 import kbnSharedUxMarkdownMocksObj from './kbn_shared_ux_markdown_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
index 1066381444291..80501cc72e5a9 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data
 title: "@kbn/shared-ux-page-analytics-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data']
 ---
 import kbnSharedUxPageAnalyticsNoDataObj from './kbn_shared_ux_page_analytics_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
index c309da0df8581..301a6e7457223 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data-mocks
 title: "@kbn/shared-ux-page-analytics-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data-mocks']
 ---
 import kbnSharedUxPageAnalyticsNoDataMocksObj from './kbn_shared_ux_page_analytics_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
index 7c06121b0a272..ac37ae176d9c5 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data
 title: "@kbn/shared-ux-page-kibana-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data']
 ---
 import kbnSharedUxPageKibanaNoDataObj from './kbn_shared_ux_page_kibana_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
index 2107f409250ff..7c2acbd47614e 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data-mocks
 title: "@kbn/shared-ux-page-kibana-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data-mocks']
 ---
 import kbnSharedUxPageKibanaNoDataMocksObj from './kbn_shared_ux_page_kibana_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template.mdx b/api_docs/kbn_shared_ux_page_kibana_template.mdx
index 9e71b8ea0b70f..ca6525bcf8b22 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template
 title: "@kbn/shared-ux-page-kibana-template"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template']
 ---
 import kbnSharedUxPageKibanaTemplateObj from './kbn_shared_ux_page_kibana_template.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
index 37b20f87221ba..8d99129e2076a 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template-mocks
 title: "@kbn/shared-ux-page-kibana-template-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template-mocks']
 ---
 import kbnSharedUxPageKibanaTemplateMocksObj from './kbn_shared_ux_page_kibana_template_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data.mdx b/api_docs/kbn_shared_ux_page_no_data.mdx
index f045d255aff50..248f6ef947986 100644
--- a/api_docs/kbn_shared_ux_page_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data
 title: "@kbn/shared-ux-page-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data']
 ---
 import kbnSharedUxPageNoDataObj from './kbn_shared_ux_page_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config.mdx b/api_docs/kbn_shared_ux_page_no_data_config.mdx
index 08e9ddc433bb1..796584a3c4fd7 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config
 title: "@kbn/shared-ux-page-no-data-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config']
 ---
 import kbnSharedUxPageNoDataConfigObj from './kbn_shared_ux_page_no_data_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
index d06493994b648..220f5d24cf56d 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config-mocks
 title: "@kbn/shared-ux-page-no-data-config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config-mocks']
 ---
 import kbnSharedUxPageNoDataConfigMocksObj from './kbn_shared_ux_page_no_data_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
index a8de8f722ecf4..be47361955cbe 100644
--- a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-mocks
 title: "@kbn/shared-ux-page-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-mocks']
 ---
 import kbnSharedUxPageNoDataMocksObj from './kbn_shared_ux_page_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_solution_nav.mdx b/api_docs/kbn_shared_ux_page_solution_nav.mdx
index 217d92ce69baf..958791ee219df 100644
--- a/api_docs/kbn_shared_ux_page_solution_nav.mdx
+++ b/api_docs/kbn_shared_ux_page_solution_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-solution-nav
 title: "@kbn/shared-ux-page-solution-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-solution-nav plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-solution-nav']
 ---
 import kbnSharedUxPageSolutionNavObj from './kbn_shared_ux_page_solution_nav.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
index 27a97daed7045..8b240abd7d4e1 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views
 title: "@kbn/shared-ux-prompt-no-data-views"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views']
 ---
 import kbnSharedUxPromptNoDataViewsObj from './kbn_shared_ux_prompt_no_data_views.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
index 0299e0620f636..a63046ec5578d 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views-mocks
 title: "@kbn/shared-ux-prompt-no-data-views-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views-mocks']
 ---
 import kbnSharedUxPromptNoDataViewsMocksObj from './kbn_shared_ux_prompt_no_data_views_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_not_found.mdx b/api_docs/kbn_shared_ux_prompt_not_found.mdx
index 79719bcf04711..a1d0769a40b4c 100644
--- a/api_docs/kbn_shared_ux_prompt_not_found.mdx
+++ b/api_docs/kbn_shared_ux_prompt_not_found.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-not-found
 title: "@kbn/shared-ux-prompt-not-found"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-not-found plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-not-found']
 ---
 import kbnSharedUxPromptNotFoundObj from './kbn_shared_ux_prompt_not_found.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router.mdx b/api_docs/kbn_shared_ux_router.mdx
index ce4f047e86ce4..822e4939de412 100644
--- a/api_docs/kbn_shared_ux_router.mdx
+++ b/api_docs/kbn_shared_ux_router.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router
 title: "@kbn/shared-ux-router"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router']
 ---
 import kbnSharedUxRouterObj from './kbn_shared_ux_router.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router_mocks.mdx b/api_docs/kbn_shared_ux_router_mocks.mdx
index b5420eaface8c..7e2b6cc1b1e2b 100644
--- a/api_docs/kbn_shared_ux_router_mocks.mdx
+++ b/api_docs/kbn_shared_ux_router_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router-mocks
 title: "@kbn/shared-ux-router-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router-mocks plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router-mocks']
 ---
 import kbnSharedUxRouterMocksObj from './kbn_shared_ux_router_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_config.mdx b/api_docs/kbn_shared_ux_storybook_config.mdx
index f163ac35cae58..d8475b719b692 100644
--- a/api_docs/kbn_shared_ux_storybook_config.mdx
+++ b/api_docs/kbn_shared_ux_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-config
 title: "@kbn/shared-ux-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-config plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-config']
 ---
 import kbnSharedUxStorybookConfigObj from './kbn_shared_ux_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_mock.mdx b/api_docs/kbn_shared_ux_storybook_mock.mdx
index 3b0b70d1e10c7..6e44723e8872e 100644
--- a/api_docs/kbn_shared_ux_storybook_mock.mdx
+++ b/api_docs/kbn_shared_ux_storybook_mock.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-mock
 title: "@kbn/shared-ux-storybook-mock"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-mock plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-mock']
 ---
 import kbnSharedUxStorybookMockObj from './kbn_shared_ux_storybook_mock.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_utility.mdx b/api_docs/kbn_shared_ux_utility.mdx
index 2f1dfe03c4afb..c788ee3d93b23 100644
--- a/api_docs/kbn_shared_ux_utility.mdx
+++ b/api_docs/kbn_shared_ux_utility.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-utility
 title: "@kbn/shared-ux-utility"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-utility plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-utility']
 ---
 import kbnSharedUxUtilityObj from './kbn_shared_ux_utility.devdocs.json';
diff --git a/api_docs/kbn_slo_schema.mdx b/api_docs/kbn_slo_schema.mdx
index e893afa2b9bec..bc7dc01ebbf12 100644
--- a/api_docs/kbn_slo_schema.mdx
+++ b/api_docs/kbn_slo_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-slo-schema
 title: "@kbn/slo-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/slo-schema plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/slo-schema']
 ---
 import kbnSloSchemaObj from './kbn_slo_schema.devdocs.json';
diff --git a/api_docs/kbn_some_dev_log.mdx b/api_docs/kbn_some_dev_log.mdx
index de9399bb42735..4bcb17ed3251d 100644
--- a/api_docs/kbn_some_dev_log.mdx
+++ b/api_docs/kbn_some_dev_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-some-dev-log
 title: "@kbn/some-dev-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/some-dev-log plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/some-dev-log']
 ---
 import kbnSomeDevLogObj from './kbn_some_dev_log.devdocs.json';
diff --git a/api_docs/kbn_std.mdx b/api_docs/kbn_std.mdx
index a03301f209b92..db8daa138177e 100644
--- a/api_docs/kbn_std.mdx
+++ b/api_docs/kbn_std.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-std
 title: "@kbn/std"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/std plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/std']
 ---
 import kbnStdObj from './kbn_std.devdocs.json';
diff --git a/api_docs/kbn_stdio_dev_helpers.mdx b/api_docs/kbn_stdio_dev_helpers.mdx
index d1da4dc55c50c..9b01f7a741a27 100644
--- a/api_docs/kbn_stdio_dev_helpers.mdx
+++ b/api_docs/kbn_stdio_dev_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-stdio-dev-helpers
 title: "@kbn/stdio-dev-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/stdio-dev-helpers plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/stdio-dev-helpers']
 ---
 import kbnStdioDevHelpersObj from './kbn_stdio_dev_helpers.devdocs.json';
diff --git a/api_docs/kbn_storybook.mdx b/api_docs/kbn_storybook.mdx
index 663d00c3d0b92..f30b44ac3c512 100644
--- a/api_docs/kbn_storybook.mdx
+++ b/api_docs/kbn_storybook.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-storybook
 title: "@kbn/storybook"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/storybook plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/storybook']
 ---
 import kbnStorybookObj from './kbn_storybook.devdocs.json';
diff --git a/api_docs/kbn_telemetry_tools.mdx b/api_docs/kbn_telemetry_tools.mdx
index bc6b9f06c7ac8..780521738ab3d 100644
--- a/api_docs/kbn_telemetry_tools.mdx
+++ b/api_docs/kbn_telemetry_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-telemetry-tools
 title: "@kbn/telemetry-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/telemetry-tools plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/telemetry-tools']
 ---
 import kbnTelemetryToolsObj from './kbn_telemetry_tools.devdocs.json';
diff --git a/api_docs/kbn_test.mdx b/api_docs/kbn_test.mdx
index 3fc06bc66273b..a434501c279b9 100644
--- a/api_docs/kbn_test.mdx
+++ b/api_docs/kbn_test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test
 title: "@kbn/test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test']
 ---
 import kbnTestObj from './kbn_test.devdocs.json';
diff --git a/api_docs/kbn_test_jest_helpers.mdx b/api_docs/kbn_test_jest_helpers.mdx
index 6fd89dad00365..1646650facb1a 100644
--- a/api_docs/kbn_test_jest_helpers.mdx
+++ b/api_docs/kbn_test_jest_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-jest-helpers
 title: "@kbn/test-jest-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-jest-helpers plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-jest-helpers']
 ---
 import kbnTestJestHelpersObj from './kbn_test_jest_helpers.devdocs.json';
diff --git a/api_docs/kbn_test_subj_selector.mdx b/api_docs/kbn_test_subj_selector.mdx
index 36785a240a316..6e1a066f22f19 100644
--- a/api_docs/kbn_test_subj_selector.mdx
+++ b/api_docs/kbn_test_subj_selector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-subj-selector
 title: "@kbn/test-subj-selector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-subj-selector plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-subj-selector']
 ---
 import kbnTestSubjSelectorObj from './kbn_test_subj_selector.devdocs.json';
diff --git a/api_docs/kbn_tooling_log.mdx b/api_docs/kbn_tooling_log.mdx
index 2edba2d696413..80e8fb8d38ebd 100644
--- a/api_docs/kbn_tooling_log.mdx
+++ b/api_docs/kbn_tooling_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-tooling-log
 title: "@kbn/tooling-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/tooling-log plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/tooling-log']
 ---
 import kbnToolingLogObj from './kbn_tooling_log.devdocs.json';
diff --git a/api_docs/kbn_ts_projects.mdx b/api_docs/kbn_ts_projects.mdx
index 406cee9f9e4e4..77e4aecd03ab5 100644
--- a/api_docs/kbn_ts_projects.mdx
+++ b/api_docs/kbn_ts_projects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ts-projects
 title: "@kbn/ts-projects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ts-projects plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ts-projects']
 ---
 import kbnTsProjectsObj from './kbn_ts_projects.devdocs.json';
diff --git a/api_docs/kbn_typed_react_router_config.mdx b/api_docs/kbn_typed_react_router_config.mdx
index c308e26fe8fe0..911782f53f833 100644
--- a/api_docs/kbn_typed_react_router_config.mdx
+++ b/api_docs/kbn_typed_react_router_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-typed-react-router-config
 title: "@kbn/typed-react-router-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/typed-react-router-config plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/typed-react-router-config']
 ---
 import kbnTypedReactRouterConfigObj from './kbn_typed_react_router_config.devdocs.json';
diff --git a/api_docs/kbn_ui_actions_browser.mdx b/api_docs/kbn_ui_actions_browser.mdx
index 2ddb3e143940a..b1151d3b94852 100644
--- a/api_docs/kbn_ui_actions_browser.mdx
+++ b/api_docs/kbn_ui_actions_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-actions-browser
 title: "@kbn/ui-actions-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-actions-browser plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-actions-browser']
 ---
 import kbnUiActionsBrowserObj from './kbn_ui_actions_browser.devdocs.json';
diff --git a/api_docs/kbn_ui_shared_deps_src.mdx b/api_docs/kbn_ui_shared_deps_src.mdx
index 4c992a0b7ba97..48e4bbf70b49c 100644
--- a/api_docs/kbn_ui_shared_deps_src.mdx
+++ b/api_docs/kbn_ui_shared_deps_src.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-shared-deps-src
 title: "@kbn/ui-shared-deps-src"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-shared-deps-src plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-shared-deps-src']
 ---
 import kbnUiSharedDepsSrcObj from './kbn_ui_shared_deps_src.devdocs.json';
diff --git a/api_docs/kbn_ui_theme.mdx b/api_docs/kbn_ui_theme.mdx
index b7cf721b289d8..5ff04426ef871 100644
--- a/api_docs/kbn_ui_theme.mdx
+++ b/api_docs/kbn_ui_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-theme
 title: "@kbn/ui-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-theme plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-theme']
 ---
 import kbnUiThemeObj from './kbn_ui_theme.devdocs.json';
diff --git a/api_docs/kbn_user_profile_components.mdx b/api_docs/kbn_user_profile_components.mdx
index b38dda89ff359..66c4133c15d99 100644
--- a/api_docs/kbn_user_profile_components.mdx
+++ b/api_docs/kbn_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-user-profile-components
 title: "@kbn/user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/user-profile-components plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/user-profile-components']
 ---
 import kbnUserProfileComponentsObj from './kbn_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_utility_types.mdx b/api_docs/kbn_utility_types.mdx
index d197cd04edbf7..e23696e0f2e05 100644
--- a/api_docs/kbn_utility_types.mdx
+++ b/api_docs/kbn_utility_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types
 title: "@kbn/utility-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types']
 ---
 import kbnUtilityTypesObj from './kbn_utility_types.devdocs.json';
diff --git a/api_docs/kbn_utility_types_jest.mdx b/api_docs/kbn_utility_types_jest.mdx
index 0feb47cbc6bc9..e2658da185277 100644
--- a/api_docs/kbn_utility_types_jest.mdx
+++ b/api_docs/kbn_utility_types_jest.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types-jest
 title: "@kbn/utility-types-jest"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types-jest plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types-jest']
 ---
 import kbnUtilityTypesJestObj from './kbn_utility_types_jest.devdocs.json';
diff --git a/api_docs/kbn_utils.mdx b/api_docs/kbn_utils.mdx
index 84096ebbc599e..12d938196b18e 100644
--- a/api_docs/kbn_utils.mdx
+++ b/api_docs/kbn_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utils
 title: "@kbn/utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utils']
 ---
 import kbnUtilsObj from './kbn_utils.devdocs.json';
diff --git a/api_docs/kbn_yarn_lock_validator.mdx b/api_docs/kbn_yarn_lock_validator.mdx
index 8637fad69054c..91bf4368988f7 100644
--- a/api_docs/kbn_yarn_lock_validator.mdx
+++ b/api_docs/kbn_yarn_lock_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-yarn-lock-validator
 title: "@kbn/yarn-lock-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/yarn-lock-validator plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/yarn-lock-validator']
 ---
 import kbnYarnLockValidatorObj from './kbn_yarn_lock_validator.devdocs.json';
diff --git a/api_docs/kibana_overview.mdx b/api_docs/kibana_overview.mdx
index 4bb00bbc43296..860c660198410 100644
--- a/api_docs/kibana_overview.mdx
+++ b/api_docs/kibana_overview.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaOverview
 title: "kibanaOverview"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaOverview plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaOverview']
 ---
 import kibanaOverviewObj from './kibana_overview.devdocs.json';
diff --git a/api_docs/kibana_react.mdx b/api_docs/kibana_react.mdx
index e1e393434e236..6e512ca05cf75 100644
--- a/api_docs/kibana_react.mdx
+++ b/api_docs/kibana_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaReact
 title: "kibanaReact"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaReact plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaReact']
 ---
 import kibanaReactObj from './kibana_react.devdocs.json';
diff --git a/api_docs/kibana_utils.mdx b/api_docs/kibana_utils.mdx
index b1808a5b8ea79..8c9d69a5879f0 100644
--- a/api_docs/kibana_utils.mdx
+++ b/api_docs/kibana_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaUtils
 title: "kibanaUtils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaUtils plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaUtils']
 ---
 import kibanaUtilsObj from './kibana_utils.devdocs.json';
diff --git a/api_docs/kubernetes_security.mdx b/api_docs/kubernetes_security.mdx
index c4a4435c11755..f96055486171a 100644
--- a/api_docs/kubernetes_security.mdx
+++ b/api_docs/kubernetes_security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kubernetesSecurity
 title: "kubernetesSecurity"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kubernetesSecurity plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kubernetesSecurity']
 ---
 import kubernetesSecurityObj from './kubernetes_security.devdocs.json';
diff --git a/api_docs/lens.devdocs.json b/api_docs/lens.devdocs.json
index ac39b1e6d687a..598494045f2c7 100644
--- a/api_docs/lens.devdocs.json
+++ b/api_docs/lens.devdocs.json
@@ -9027,8 +9027,6 @@
         "description": [],
         "signature": [
           "(",
-          "LensByReferenceInput",
-          " | ",
           {
             "pluginId": "lens",
             "scope": "public",
@@ -9036,6 +9034,8 @@
             "section": "def-public.TypedLensByValueInput",
             "text": "TypedLensByValueInput"
           },
+          " | ",
+          "LensByReferenceInput",
           ") & { withDefaultActions?: boolean | undefined; extraActions?: ",
           {
             "pluginId": "uiActions",
diff --git a/api_docs/lens.mdx b/api_docs/lens.mdx
index e3f29fec395bb..5cd7aa7dd47be 100644
--- a/api_docs/lens.mdx
+++ b/api_docs/lens.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lens
 title: "lens"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lens plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lens']
 ---
 import lensObj from './lens.devdocs.json';
diff --git a/api_docs/license_api_guard.mdx b/api_docs/license_api_guard.mdx
index 88da4e9c6f55a..f1baf92388b48 100644
--- a/api_docs/license_api_guard.mdx
+++ b/api_docs/license_api_guard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseApiGuard
 title: "licenseApiGuard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseApiGuard plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseApiGuard']
 ---
 import licenseApiGuardObj from './license_api_guard.devdocs.json';
diff --git a/api_docs/license_management.mdx b/api_docs/license_management.mdx
index 8d62bffef5c9e..bdd1d8715ebe5 100644
--- a/api_docs/license_management.mdx
+++ b/api_docs/license_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseManagement
 title: "licenseManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseManagement plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseManagement']
 ---
 import licenseManagementObj from './license_management.devdocs.json';
diff --git a/api_docs/licensing.mdx b/api_docs/licensing.mdx
index b445cf8518378..ffbefeaa0bbfa 100644
--- a/api_docs/licensing.mdx
+++ b/api_docs/licensing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licensing
 title: "licensing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licensing plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licensing']
 ---
 import licensingObj from './licensing.devdocs.json';
diff --git a/api_docs/lists.devdocs.json b/api_docs/lists.devdocs.json
index b8681cc8d97db..0ccba8e01b9be 100644
--- a/api_docs/lists.devdocs.json
+++ b/api_docs/lists.devdocs.json
@@ -345,7 +345,7 @@
             "label": "exceptionsToDelete",
             "description": [],
             "signature": [
-              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
+              "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]"
             ],
             "path": "x-pack/plugins/lists/public/exceptions/components/builder/exception_items_renderer.tsx",
             "deprecated": false,
@@ -622,7 +622,7 @@
             "signature": [
               "({ itemId, id, namespaceType, }: ",
               "GetExceptionListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -698,9 +698,9 @@
               "\nThis is the same as \"createListItem\" except it applies specifically to the agnostic endpoint list and will\nauto-call the \"createEndpointList\" for you so that you have the best chance of the agnostic endpoint\nbeing there and existing before the item is inserted into the agnostic endpoint list."
             ],
             "signature": [
-              "({ comments, description, entries, itemId, meta, name, osTypes, tags, type, }: ",
+              "({ comments, description, entries, expireTime, itemId, meta, name, osTypes, tags, type, }: ",
               "CreateEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -711,7 +711,7 @@
                 "id": "def-server.ExceptionListClient.createEndpointListItem.$1",
                 "type": "Object",
                 "tags": [],
-                "label": "{\n    comments,\n    description,\n    entries,\n    itemId,\n    meta,\n    name,\n    osTypes,\n    tags,\n    type,\n  }",
+                "label": "{\n    comments,\n    description,\n    entries,\n    expireTime,\n    itemId,\n    meta,\n    name,\n    osTypes,\n    tags,\n    type,\n  }",
                 "description": [],
                 "signature": [
                   "CreateEndpointListItemOptions"
@@ -774,9 +774,9 @@
               "\nThis is the same as \"updateExceptionListItem\" except it applies specifically to the endpoint list and will\nauto-call the \"createEndpointList\" for you so that you have the best chance of the endpoint\nbeing there if it did not exist before. If the list did not exist before, then creating it here will still cause a\nreturn of null but at least the list exists again."
             ],
             "signature": [
-              "({ _version, comments, description, entries, id, itemId, meta, name, osTypes, tags, type, }: ",
+              "({ _version, comments, description, entries, expireTime, id, itemId, meta, name, osTypes, tags, type, }: ",
               "UpdateEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -787,7 +787,7 @@
                 "id": "def-server.ExceptionListClient.updateEndpointListItem.$1",
                 "type": "Object",
                 "tags": [],
-                "label": "{\n    _version,\n    comments,\n    description,\n    entries,\n    id,\n    itemId,\n    meta,\n    name,\n    osTypes,\n    tags,\n    type,\n  }",
+                "label": "{\n    _version,\n    comments,\n    description,\n    entries,\n    expireTime,\n    id,\n    itemId,\n    meta,\n    name,\n    osTypes,\n    tags,\n    type,\n  }",
                 "description": [],
                 "signature": [
                   "UpdateEndpointListItemOptions"
@@ -814,7 +814,7 @@
             "signature": [
               "({ itemId, id, }: ",
               "GetEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -964,7 +964,7 @@
               "\nCreate an exception list item container"
             ],
             "signature": [
-              "({ comments, description, entries, itemId, listId, meta, name, namespaceType, osTypes, tags, type, }: ",
+              "({ comments, description, entries, expireTime, itemId, listId, meta, name, namespaceType, osTypes, tags, type, }: ",
               {
                 "pluginId": "lists",
                 "scope": "server",
@@ -972,7 +972,7 @@
                 "section": "def-server.CreateExceptionListItemOptions",
                 "text": "CreateExceptionListItemOptions"
               },
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -983,7 +983,7 @@
                 "id": "def-server.ExceptionListClient.createExceptionListItem.$1",
                 "type": "Object",
                 "tags": [],
-                "label": "{\n    comments,\n    description,\n    entries,\n    itemId,\n    listId,\n    meta,\n    name,\n    namespaceType,\n    osTypes,\n    tags,\n    type,\n  }",
+                "label": "{\n    comments,\n    description,\n    entries,\n    expireTime,\n    itemId,\n    listId,\n    meta,\n    name,\n    namespaceType,\n    osTypes,\n    tags,\n    type,\n  }",
                 "description": [],
                 "signature": [
                   {
@@ -1014,7 +1014,7 @@
               "\nUpdate an existing exception list item"
             ],
             "signature": [
-              "({ _version, comments, description, entries, id, itemId, meta, name, namespaceType, osTypes, tags, type, }: ",
+              "({ _version, comments, description, entries, expireTime, id, itemId, meta, name, namespaceType, osTypes, tags, type, }: ",
               {
                 "pluginId": "lists",
                 "scope": "server",
@@ -1022,7 +1022,7 @@
                 "section": "def-server.UpdateExceptionListItemOptions",
                 "text": "UpdateExceptionListItemOptions"
               },
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -1033,7 +1033,7 @@
                 "id": "def-server.ExceptionListClient.updateExceptionListItem.$1",
                 "type": "Object",
                 "tags": [],
-                "label": "{\n    _version,\n    comments,\n    description,\n    entries,\n    id,\n    itemId,\n    meta,\n    name,\n    namespaceType,\n    osTypes,\n    tags,\n    type,\n  }",
+                "label": "{\n    _version,\n    comments,\n    description,\n    entries,\n    expireTime,\n    id,\n    itemId,\n    meta,\n    name,\n    namespaceType,\n    osTypes,\n    tags,\n    type,\n  }",
                 "description": [],
                 "signature": [
                   {
@@ -1066,7 +1066,7 @@
             "signature": [
               "({ id, itemId, namespaceType, }: ",
               "DeleteExceptionListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -1140,7 +1140,7 @@
             "signature": [
               "({ id, itemId, }: ",
               "DeleteEndpointListItemOptions",
-              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
+              ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -1176,7 +1176,7 @@
             "signature": [
               "({ listId, filter, perPage, pit, page, search, searchAfter, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListItemOptions",
-              ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>"
+              ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -1214,7 +1214,7 @@
             "signature": [
               "({ listId, filter, perPage, pit, page, search, searchAfter, sortField, sortOrder, namespaceType, }: ",
               "FindExceptionListsItemOptions",
-              ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>"
+              ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -1252,7 +1252,7 @@
             "signature": [
               "({ perPage, pit, page, searchAfter, sortField, sortOrder, valueListId, }: ",
               "FindValueListExceptionListsItems",
-              ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>"
+              ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -1328,7 +1328,7 @@
             "signature": [
               "({ filter, perPage, page, pit, search, searchAfter, sortField, sortOrder, }: ",
               "FindEndpointListItemOptions",
-              ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>"
+              ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; expire_time: string | undefined; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>"
             ],
             "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts",
             "deprecated": false,
@@ -1364,7 +1364,7 @@
               "\nExport an exception list parent container and it's items"
             ],
             "signature": [
-              "({ listId, id, namespaceType, }: ",
+              "({ listId, id, namespaceType, includeExpiredExceptions, }: ",
               "ExportExceptionListAndItemsOptions",
               ") => Promise<",
               {
@@ -1385,7 +1385,7 @@
                 "id": "def-server.ExceptionListClient.exportExceptionListAndItems.$1",
                 "type": "Object",
                 "tags": [],
-                "label": "{\n    listId,\n    id,\n    namespaceType,\n  }",
+                "label": "{\n    listId,\n    id,\n    namespaceType,\n    includeExpiredExceptions,\n  }",
                 "description": [],
                 "signature": [
                   "ExportExceptionListAndItemsOptions"
@@ -3003,6 +3003,22 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "lists",
+            "id": "def-server.CreateExceptionListItemOptions.expireTime",
+            "type": "string",
+            "tags": [],
+            "label": "expireTime",
+            "description": [
+              "an optional datetime string with an expiration time"
+            ],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "lists",
             "id": "def-server.CreateExceptionListItemOptions.itemId",
@@ -3315,6 +3331,22 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "lists",
+            "id": "def-server.UpdateExceptionListItemOptions.expireTime",
+            "type": "string",
+            "tags": [],
+            "label": "expireTime",
+            "description": [
+              "an optional datetime string with an expiration time"
+            ],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "lists",
             "id": "def-server.UpdateExceptionListItemOptions.id",
diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx
index 9052518d9ee1e..44e9c1c6f2f23 100644
--- a/api_docs/lists.mdx
+++ b/api_docs/lists.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lists
 title: "lists"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lists plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lists']
 ---
 import listsObj from './lists.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Security detections response](https://github.com/orgs/elastic/teams/sec
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 206 | 0 | 93 | 51 |
+| 208 | 0 | 93 | 51 |
 
 ## Client
 
diff --git a/api_docs/management.mdx b/api_docs/management.mdx
index dccfbe6ead7c8..80aa1f2949a37 100644
--- a/api_docs/management.mdx
+++ b/api_docs/management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/management
 title: "management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the management plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'management']
 ---
 import managementObj from './management.devdocs.json';
diff --git a/api_docs/maps.mdx b/api_docs/maps.mdx
index b1fae75481fef..789ee9aa9ea2f 100644
--- a/api_docs/maps.mdx
+++ b/api_docs/maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/maps
 title: "maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the maps plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'maps']
 ---
 import mapsObj from './maps.devdocs.json';
diff --git a/api_docs/maps_ems.mdx b/api_docs/maps_ems.mdx
index 6dce3959c9b6a..16a9a6a081766 100644
--- a/api_docs/maps_ems.mdx
+++ b/api_docs/maps_ems.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/mapsEms
 title: "mapsEms"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the mapsEms plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mapsEms']
 ---
 import mapsEmsObj from './maps_ems.devdocs.json';
diff --git a/api_docs/ml.devdocs.json b/api_docs/ml.devdocs.json
index e7a6ab48c2dfc..d58430fd0174c 100644
--- a/api_docs/ml.devdocs.json
+++ b/api_docs/ml.devdocs.json
@@ -1630,7 +1630,7 @@
         "label": "ML_PAGES",
         "description": [],
         "signature": [
-          "{ readonly ANOMALY_DETECTION_JOBS_MANAGE: \"jobs\"; readonly ANOMALY_EXPLORER: \"explorer\"; readonly SINGLE_METRIC_VIEWER: \"timeseriesexplorer\"; readonly DATA_FRAME_ANALYTICS_JOBS_MANAGE: \"data_frame_analytics\"; readonly DATA_FRAME_ANALYTICS_SOURCE_SELECTION: \"data_frame_analytics/source_selection\"; readonly DATA_FRAME_ANALYTICS_CREATE_JOB: \"data_frame_analytics/new_job\"; readonly TRAINED_MODELS_MANAGE: \"trained_models\"; readonly TRAINED_MODELS_NODES: \"trained_models/nodes\"; readonly DATA_FRAME_ANALYTICS_EXPLORATION: \"data_frame_analytics/exploration\"; readonly DATA_FRAME_ANALYTICS_MAP: \"data_frame_analytics/map\"; readonly DATA_VISUALIZER: \"datavisualizer\"; readonly DATA_VISUALIZER_INDEX_SELECT: \"datavisualizer_index_select\"; readonly DATA_VISUALIZER_FILE: \"filedatavisualizer\"; readonly DATA_VISUALIZER_INDEX_VIEWER: \"jobs/new_job/datavisualizer\"; readonly ANOMALY_DETECTION_CREATE_JOB: \"jobs/new_job\"; readonly ANOMALY_DETECTION_CREATE_JOB_RECOGNIZER: \"jobs/new_job/recognize\"; readonly ANOMALY_DETECTION_CREATE_JOB_SINGLE_METRIC: \"jobs/new_job/single_metric\"; readonly ANOMALY_DETECTION_CREATE_JOB_MULTI_METRIC: \"jobs/new_job/multi_metric\"; readonly ANOMALY_DETECTION_CREATE_JOB_CONVERT_TO_MULTI_METRIC: \"jobs/new_job/convert_to_multi_metric\"; readonly ANOMALY_DETECTION_CREATE_JOB_ADVANCED: \"jobs/new_job/advanced\"; readonly ANOMALY_DETECTION_CREATE_JOB_POPULATION: \"jobs/new_job/population\"; readonly ANOMALY_DETECTION_CREATE_JOB_CATEGORIZATION: \"jobs/new_job/categorization\"; readonly ANOMALY_DETECTION_CREATE_JOB_RARE: \"jobs/new_job/rare\"; readonly ANOMALY_DETECTION_CREATE_JOB_GEO: \"jobs/new_job/geo\"; readonly ANOMALY_DETECTION_CREATE_JOB_CONVERT_TO_ADVANCED: \"jobs/new_job/convert_to_advanced\"; readonly ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE: \"jobs/new_job/step/job_type\"; readonly ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX: \"jobs/new_job/step/index_or_search\"; readonly ANOMALY_DETECTION_CREATE_JOB_FROM_LENS: \"jobs/new_job/from_lens\"; readonly ANOMALY_DETECTION_CREATE_JOB_FROM_MAP: \"jobs/new_job/from_map\"; readonly ANOMALY_DETECTION_MODULES_VIEW_OR_CREATE: \"/modules/check_view_or_create\"; readonly SETTINGS: \"settings\"; readonly CALENDARS_MANAGE: \"settings/calendars_list\"; readonly CALENDARS_NEW: \"settings/calendars_list/new_calendar\"; readonly CALENDARS_EDIT: \"settings/calendars_list/edit_calendar\"; readonly FILTER_LISTS_MANAGE: \"settings/filter_lists\"; readonly FILTER_LISTS_NEW: \"settings/filter_lists/new_filter_list\"; readonly FILTER_LISTS_EDIT: \"settings/filter_lists/edit_filter_list\"; readonly ACCESS_DENIED: \"access-denied\"; readonly OVERVIEW: \"overview\"; readonly NOTIFICATIONS: \"notifications\"; readonly AIOPS: \"aiops\"; readonly AIOPS_EXPLAIN_LOG_RATE_SPIKES: \"aiops/explain_log_rate_spikes\"; readonly AIOPS_EXPLAIN_LOG_RATE_SPIKES_INDEX_SELECT: \"aiops/explain_log_rate_spikes_index_select\"; readonly AIOPS_LOG_CATEGORIZATION: \"aiops/log_categorization\"; readonly AIOPS_LOG_CATEGORIZATION_INDEX_SELECT: \"aiops/log_categorization_index_select\"; readonly AIOPS_CHANGE_POINT_DETECTION: \"aiops/change_point_detection\"; readonly AIOPS_CHANGE_POINT_DETECTION_INDEX_SELECT: \"aiops/change_point_detection_index_select\"; }"
+          "{ readonly ANOMALY_DETECTION_JOBS_MANAGE: \"jobs\"; readonly ANOMALY_EXPLORER: \"explorer\"; readonly SINGLE_METRIC_VIEWER: \"timeseriesexplorer\"; readonly DATA_FRAME_ANALYTICS_JOBS_MANAGE: \"data_frame_analytics\"; readonly DATA_FRAME_ANALYTICS_SOURCE_SELECTION: \"data_frame_analytics/source_selection\"; readonly DATA_FRAME_ANALYTICS_CREATE_JOB: \"data_frame_analytics/new_job\"; readonly TRAINED_MODELS_MANAGE: \"trained_models\"; readonly MEMORY_USAGE: \"memory_usage\"; readonly DATA_FRAME_ANALYTICS_EXPLORATION: \"data_frame_analytics/exploration\"; readonly DATA_FRAME_ANALYTICS_MAP: \"data_frame_analytics/map\"; readonly DATA_VISUALIZER: \"datavisualizer\"; readonly DATA_VISUALIZER_INDEX_SELECT: \"datavisualizer_index_select\"; readonly DATA_VISUALIZER_FILE: \"filedatavisualizer\"; readonly DATA_VISUALIZER_INDEX_VIEWER: \"jobs/new_job/datavisualizer\"; readonly ANOMALY_DETECTION_CREATE_JOB: \"jobs/new_job\"; readonly ANOMALY_DETECTION_CREATE_JOB_RECOGNIZER: \"jobs/new_job/recognize\"; readonly ANOMALY_DETECTION_CREATE_JOB_SINGLE_METRIC: \"jobs/new_job/single_metric\"; readonly ANOMALY_DETECTION_CREATE_JOB_MULTI_METRIC: \"jobs/new_job/multi_metric\"; readonly ANOMALY_DETECTION_CREATE_JOB_CONVERT_TO_MULTI_METRIC: \"jobs/new_job/convert_to_multi_metric\"; readonly ANOMALY_DETECTION_CREATE_JOB_ADVANCED: \"jobs/new_job/advanced\"; readonly ANOMALY_DETECTION_CREATE_JOB_POPULATION: \"jobs/new_job/population\"; readonly ANOMALY_DETECTION_CREATE_JOB_CATEGORIZATION: \"jobs/new_job/categorization\"; readonly ANOMALY_DETECTION_CREATE_JOB_RARE: \"jobs/new_job/rare\"; readonly ANOMALY_DETECTION_CREATE_JOB_GEO: \"jobs/new_job/geo\"; readonly ANOMALY_DETECTION_CREATE_JOB_CONVERT_TO_ADVANCED: \"jobs/new_job/convert_to_advanced\"; readonly ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE: \"jobs/new_job/step/job_type\"; readonly ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX: \"jobs/new_job/step/index_or_search\"; readonly ANOMALY_DETECTION_CREATE_JOB_FROM_LENS: \"jobs/new_job/from_lens\"; readonly ANOMALY_DETECTION_CREATE_JOB_FROM_MAP: \"jobs/new_job/from_map\"; readonly ANOMALY_DETECTION_MODULES_VIEW_OR_CREATE: \"modules/check_view_or_create\"; readonly SETTINGS: \"settings\"; readonly CALENDARS_MANAGE: \"settings/calendars_list\"; readonly CALENDARS_NEW: \"settings/calendars_list/new_calendar\"; readonly CALENDARS_EDIT: \"settings/calendars_list/edit_calendar\"; readonly FILTER_LISTS_MANAGE: \"settings/filter_lists\"; readonly FILTER_LISTS_NEW: \"settings/filter_lists/new_filter_list\"; readonly FILTER_LISTS_EDIT: \"settings/filter_lists/edit_filter_list\"; readonly ACCESS_DENIED: \"access-denied\"; readonly OVERVIEW: \"overview\"; readonly NOTIFICATIONS: \"notifications\"; readonly AIOPS: \"aiops\"; readonly AIOPS_EXPLAIN_LOG_RATE_SPIKES: \"aiops/explain_log_rate_spikes\"; readonly AIOPS_EXPLAIN_LOG_RATE_SPIKES_INDEX_SELECT: \"aiops/explain_log_rate_spikes_index_select\"; readonly AIOPS_LOG_CATEGORIZATION: \"aiops/log_categorization\"; readonly AIOPS_LOG_CATEGORIZATION_INDEX_SELECT: \"aiops/log_categorization_index_select\"; readonly AIOPS_CHANGE_POINT_DETECTION: \"aiops/change_point_detection\"; readonly AIOPS_CHANGE_POINT_DETECTION_INDEX_SELECT: \"aiops/change_point_detection_index_select\"; }"
         ],
         "path": "x-pack/plugins/ml/common/constants/locator.ts",
         "deprecated": false,
diff --git a/api_docs/ml.mdx b/api_docs/ml.mdx
index eb06159f2f6ab..d67628094763a 100644
--- a/api_docs/ml.mdx
+++ b/api_docs/ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ml
 title: "ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ml plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ml']
 ---
 import mlObj from './ml.devdocs.json';
diff --git a/api_docs/monitoring.mdx b/api_docs/monitoring.mdx
index d05078fa193c1..5dd07978760fc 100644
--- a/api_docs/monitoring.mdx
+++ b/api_docs/monitoring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoring
 title: "monitoring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoring plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoring']
 ---
 import monitoringObj from './monitoring.devdocs.json';
diff --git a/api_docs/monitoring_collection.mdx b/api_docs/monitoring_collection.mdx
index 192d984ea3a5c..b5d70cb8c827b 100644
--- a/api_docs/monitoring_collection.mdx
+++ b/api_docs/monitoring_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoringCollection
 title: "monitoringCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoringCollection plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoringCollection']
 ---
 import monitoringCollectionObj from './monitoring_collection.devdocs.json';
diff --git a/api_docs/navigation.mdx b/api_docs/navigation.mdx
index b0d05d781f546..c5622f9a10683 100644
--- a/api_docs/navigation.mdx
+++ b/api_docs/navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/navigation
 title: "navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the navigation plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'navigation']
 ---
 import navigationObj from './navigation.devdocs.json';
diff --git a/api_docs/newsfeed.mdx b/api_docs/newsfeed.mdx
index 60c19eb9a71cc..5c631c7b93b76 100644
--- a/api_docs/newsfeed.mdx
+++ b/api_docs/newsfeed.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/newsfeed
 title: "newsfeed"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the newsfeed plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'newsfeed']
 ---
 import newsfeedObj from './newsfeed.devdocs.json';
diff --git a/api_docs/notifications.mdx b/api_docs/notifications.mdx
index 07f0428038f1e..6f06c2c2b066e 100644
--- a/api_docs/notifications.mdx
+++ b/api_docs/notifications.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/notifications
 title: "notifications"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the notifications plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'notifications']
 ---
 import notificationsObj from './notifications.devdocs.json';
diff --git a/api_docs/observability.devdocs.json b/api_docs/observability.devdocs.json
index df3ecc2382fd7..c1519112d0af0 100644
--- a/api_docs/observability.devdocs.json
+++ b/api_docs/observability.devdocs.json
@@ -12857,6 +12857,214 @@
               }
             ]
           },
+          {
+            "parentPluginId": "observability",
+            "id": "def-server.uiSettings.apmEnableServiceMetrics",
+            "type": "Object",
+            "tags": [],
+            "label": "[apmEnableServiceMetrics]",
+            "description": [],
+            "path": "x-pack/plugins/observability/server/ui_settings.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableServiceMetrics.category",
+                "type": "Array",
+                "tags": [],
+                "label": "category",
+                "description": [],
+                "signature": [
+                  "string[]"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableServiceMetrics.name",
+                "type": "Any",
+                "tags": [],
+                "label": "name",
+                "description": [],
+                "signature": [
+                  "any"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableServiceMetrics.value",
+                "type": "boolean",
+                "tags": [],
+                "label": "value",
+                "description": [],
+                "signature": [
+                  "true"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableServiceMetrics.description",
+                "type": "Any",
+                "tags": [],
+                "label": "description",
+                "description": [],
+                "signature": [
+                  "any"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableServiceMetrics.schema",
+                "type": "Object",
+                "tags": [],
+                "label": "schema",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.Type",
+                    "text": "Type"
+                  },
+                  "<boolean>"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableServiceMetrics.requiresPageReload",
+                "type": "boolean",
+                "tags": [],
+                "label": "requiresPageReload",
+                "description": [],
+                "signature": [
+                  "true"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
+          {
+            "parentPluginId": "observability",
+            "id": "def-server.uiSettings.apmEnableContinuousRollups",
+            "type": "Object",
+            "tags": [],
+            "label": "[apmEnableContinuousRollups]",
+            "description": [],
+            "path": "x-pack/plugins/observability/server/ui_settings.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableContinuousRollups.category",
+                "type": "Array",
+                "tags": [],
+                "label": "category",
+                "description": [],
+                "signature": [
+                  "string[]"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableContinuousRollups.name",
+                "type": "Any",
+                "tags": [],
+                "label": "name",
+                "description": [],
+                "signature": [
+                  "any"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableContinuousRollups.value",
+                "type": "boolean",
+                "tags": [],
+                "label": "value",
+                "description": [],
+                "signature": [
+                  "true"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableContinuousRollups.description",
+                "type": "Any",
+                "tags": [],
+                "label": "description",
+                "description": [],
+                "signature": [
+                  "any"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableContinuousRollups.schema",
+                "type": "Object",
+                "tags": [],
+                "label": "schema",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.Type",
+                    "text": "Type"
+                  },
+                  "<boolean>"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "observability",
+                "id": "def-server.uiSettings.apmEnableContinuousRollups.requiresPageReload",
+                "type": "boolean",
+                "tags": [],
+                "label": "requiresPageReload",
+                "description": [],
+                "signature": [
+                  "true"
+                ],
+                "path": "x-pack/plugins/observability/server/ui_settings.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
           {
             "parentPluginId": "observability",
             "id": "def-server.uiSettings.enableCriticalPath",
@@ -13493,6 +13701,36 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "observability",
+        "id": "def-common.apmEnableContinuousRollups",
+        "type": "string",
+        "tags": [],
+        "label": "apmEnableContinuousRollups",
+        "description": [],
+        "signature": [
+          "\"observability:apmEnableContinuousRollups\""
+        ],
+        "path": "x-pack/plugins/observability/common/ui_settings_keys.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "observability",
+        "id": "def-common.apmEnableServiceMetrics",
+        "type": "string",
+        "tags": [],
+        "label": "apmEnableServiceMetrics",
+        "description": [],
+        "signature": [
+          "\"observability:apmEnableServiceMetrics\""
+        ],
+        "path": "x-pack/plugins/observability/common/ui_settings_keys.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "observability",
         "id": "def-common.apmLabsButton",
diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx
index 961ee4c3532bd..1ef0957710d9c 100644
--- a/api_docs/observability.mdx
+++ b/api_docs/observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observability
 title: "observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observability plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observability']
 ---
 import observabilityObj from './observability.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Observability UI](https://github.com/orgs/elastic/teams/observability-u
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 598 | 39 | 592 | 32 |
+| 614 | 43 | 608 | 32 |
 
 ## Client
 
diff --git a/api_docs/osquery.mdx b/api_docs/osquery.mdx
index c104339237870..903035dd74eb5 100644
--- a/api_docs/osquery.mdx
+++ b/api_docs/osquery.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/osquery
 title: "osquery"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the osquery plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'osquery']
 ---
 import osqueryObj from './osquery.devdocs.json';
diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx
index 3e388c16b1d10..1b7df39170081 100644
--- a/api_docs/plugin_directory.mdx
+++ b/api_docs/plugin_directory.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsPluginDirectory
 slug: /kibana-dev-docs/api-meta/plugin-api-directory
 title: Directory
 description: Directory of public APIs available through plugins or packages.
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -15,13 +15,13 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Count | Plugins or Packages with a <br /> public API | Number of teams |
 |--------------|----------|------------------------|
-| 570 | 469 | 45 |
+| 571 | 470 | 45 |
 
 ### Public API health stats
 
 | API Count | Any Count | Missing comments | Missing exports |
 |--------------|----------|-----------------|--------|
-| 70199 | 525 | 59391 | 1218 |
+| 70277 | 529 | 59452 | 1221 |
 
 ## Plugin Directory
 
@@ -30,7 +30,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibActionsPluginApi" text="actions"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 256 | 8 | 251 | 24 |
 | <DocLink id="kibAdvancedSettingsPluginApi" text="advancedSettings"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 36 | 1 | 32 | 2 |
 | <DocLink id="kibAiopsPluginApi" text="aiops"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | AIOps plugin maintained by ML team. | 12 | 0 | 1 | 2 |
-| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 471 | 1 | 461 | 39 |
+| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 476 | 1 | 466 | 39 |
 | <DocLink id="kibApmPluginApi" text="apm"/> | [APM UI](https://github.com/orgs/elastic/teams/apm-ui) | The user interface for Elastic APM | 42 | 0 | 42 | 65 |
 | <DocLink id="kibBannersPluginApi" text="banners"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibBfetchPluginApi" text="bfetch"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Considering using bfetch capabilities when fetching large amounts of data. This services supports batching HTTP requests and streaming responses back. | 89 | 1 | 74 | 2 |
@@ -47,9 +47,9 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | cloudLinks | [Kibana Core](https://github.com/orgs/elastic/teams/@kibana-core) | Adds the links to the Elastic Cloud console | 0 | 0 | 0 | 0 |
 | <DocLink id="kibCloudSecurityPosturePluginApi" text="cloudSecurityPosture"/> | [Cloud Security Posture](https://github.com/orgs/elastic/teams/cloud-posture-security) | The cloud security posture plugin | 17 | 0 | 2 | 2 |
 | <DocLink id="kibConsolePluginApi" text="console"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 13 | 0 | 13 | 1 |
-| <DocLink id="kibContentManagementPluginApi" text="contentManagement"/> | [@elastic/kibana-global-experience](https://github.com/orgs/elastic/teams/@elastic/kibana-global-experience) | Content management app | 5 | 0 | 5 | 0 |
+| <DocLink id="kibContentManagementPluginApi" text="contentManagement"/> | [@elastic/kibana-global-experience](https://github.com/orgs/elastic/teams/@elastic/kibana-global-experience) | Content management app | 22 | 0 | 22 | 1 |
 | <DocLink id="kibControlsPluginApi" text="controls"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Controls Plugin contains embeddable components intended to create a simple query interface for end users, and a powerful editing suite that allows dashboard authors to build controls | 270 | 0 | 266 | 9 |
-| <DocLink id="kibCorePluginApi" text="core"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2845 | 17 | 1029 | 0 |
+| <DocLink id="kibCorePluginApi" text="core"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2848 | 17 | 1030 | 0 |
 | crossClusterReplication | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
 | customBranding | [global-experience](https://github.com/orgs/elastic/teams/kibana-global-experience) |  Enables customization of Kibana | 0 | 0 | 0 | 0 |
 | <DocLink id="kibCustomIntegrationsPluginApi" text="customIntegrations"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 107 | 0 | 88 | 1 |
@@ -91,7 +91,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibFileUploadPluginApi" text="fileUpload"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | The file upload plugin contains components and services for uploading a file, analyzing its data, and then importing the data into an Elasticsearch index. Supported file types include CSV, TSV, newline-delimited JSON and GeoJSON. | 62 | 0 | 62 | 2 |
 | <DocLink id="kibFilesPluginApi" text="files"/> | [@elastic/kibana-app-services](https://github.com/orgs/elastic/teams/team:AppServicesUx) | File upload, download, sharing, and serving over HTTP implementation in Kibana. | 254 | 1 | 45 | 5 |
 | <DocLink id="kibFilesManagementPluginApi" text="filesManagement"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/@elastic/appex-sharedux) | Simple UI for managing files in Kibana | 2 | 1 | 2 | 0 |
-| <DocLink id="kibFleetPluginApi" text="fleet"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1068 | 3 | 963 | 26 |
+| <DocLink id="kibFleetPluginApi" text="fleet"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1069 | 3 | 964 | 26 |
 | ftrApis | [Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibGlobalSearchPluginApi" text="globalSearch"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 68 | 0 | 14 | 5 |
 | globalSearchBar | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
@@ -117,7 +117,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibLicenseApiGuardPluginApi" text="licenseApiGuard"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 8 | 0 | 8 | 0 |
 | <DocLink id="kibLicenseManagementPluginApi" text="licenseManagement"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 3 | 0 | 3 | 0 |
 | <DocLink id="kibLicensingPluginApi" text="licensing"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 117 | 0 | 42 | 10 |
-| <DocLink id="kibListsPluginApi" text="lists"/> | [Security detections response](https://github.com/orgs/elastic/teams/security-detections-response) | - | 206 | 0 | 93 | 51 |
+| <DocLink id="kibListsPluginApi" text="lists"/> | [Security detections response](https://github.com/orgs/elastic/teams/security-detections-response) | - | 208 | 0 | 93 | 51 |
 | logstash | [Logstash](https://github.com/orgs/elastic/teams/logstash) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibManagementPluginApi" text="management"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 41 | 0 | 41 | 6 |
 | <DocLink id="kibMapsPluginApi" text="maps"/> | [GIS](https://github.com/orgs/elastic/teams/kibana-gis) | - | 267 | 0 | 266 | 27 |
@@ -128,7 +128,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibNavigationPluginApi" text="navigation"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 34 | 0 | 34 | 2 |
 | <DocLink id="kibNewsfeedPluginApi" text="newsfeed"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 17 | 0 | 17 | 0 |
 | <DocLink id="kibNotificationsPluginApi" text="notifications"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 2 | 0 | 2 | 1 |
-| <DocLink id="kibObservabilityPluginApi" text="observability"/> | [Observability UI](https://github.com/orgs/elastic/teams/observability-ui) | - | 598 | 39 | 592 | 32 |
+| <DocLink id="kibObservabilityPluginApi" text="observability"/> | [Observability UI](https://github.com/orgs/elastic/teams/observability-ui) | - | 614 | 43 | 608 | 32 |
 | <DocLink id="kibOsqueryPluginApi" text="osquery"/> | [Security asset management](https://github.com/orgs/elastic/teams/security-asset-management) | - | 24 | 0 | 24 | 7 |
 | painlessLab | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibPresentationUtilPluginApi" text="presentationUtil"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Presentation Utility Plugin is a set of common, shared components and toolkits for solutions within the Presentation space, (e.g. Dashboards, Canvas). | 217 | 7 | 161 | 11 |
@@ -169,7 +169,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibUiActionsPluginApi" text="uiActions"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds UI Actions service to Kibana | 134 | 2 | 92 | 9 |
 | <DocLink id="kibUiActionsEnhancedPluginApi" text="uiActionsEnhanced"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends UI Actions plugin with more functionality | 206 | 0 | 140 | 9 |
 | <DocLink id="kibUnifiedFieldListPluginApi" text="unifiedFieldList"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Contains functionality for the field list which can be integrated into apps | 267 | 0 | 242 | 7 |
-| <DocLink id="kibUnifiedHistogramPluginApi" text="unifiedHistogram"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | The `unifiedHistogram` plugin provides UI components to create a layout including a resizable histogram and a main display. | 63 | 0 | 16 | 1 |
+| <DocLink id="kibUnifiedHistogramPluginApi" text="unifiedHistogram"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | The `unifiedHistogram` plugin provides UI components to create a layout including a resizable histogram and a main display. | 61 | 0 | 23 | 1 |
 | <DocLink id="kibUnifiedSearchPluginApi" text="unifiedSearch"/> | [Visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | Contains all the key functionality of Kibana's unified search experience.Contains all the key functionality of Kibana's unified search experience. | 134 | 2 | 99 | 20 |
 | upgradeAssistant | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
 | urlDrilldown | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds drilldown implementations to Kibana | 0 | 0 | 0 | 0 |
@@ -200,6 +200,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnAiopsComponentsPluginApi" text="@kbn/aiops-components"/> | Machine Learning UI | React components for AIOps related efforts. | 6 | 0 | 6 | 0 |
 | <DocLink id="kibKbnAiopsUtilsPluginApi" text="@kbn/aiops-utils"/> | Machine Learning UI | Static utilities for AIOps related efforts. | 53 | 0 | 22 | 0 |
 | <DocLink id="kibKbnAlertsPluginApi" text="@kbn/alerts"/> | [Owner missing] | Alerts components and hooks | 9 | 1 | 9 | 0 |
+| <DocLink id="kibKbnAlertsUiSharedPluginApi" text="@kbn/alerts-ui-shared"/> | [Owner missing] | - | 5 | 0 | 4 | 0 |
 | <DocLink id="kibKbnAnalyticsPluginApi" text="@kbn/analytics"/> | Kibana Core | Kibana Analytics tool | 73 | 0 | 73 | 2 |
 | <DocLink id="kibKbnAnalyticsClientPluginApi" text="@kbn/analytics-client"/> | Kibana Core | - | 98 | 0 | 0 | 0 |
 | <DocLink id="kibKbnAnalyticsShippersElasticV3BrowserPluginApi" text="@kbn/analytics-shippers-elastic-v3-browser"/> | Kibana Core | - | 19 | 0 | 0 | 0 |
@@ -297,7 +298,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCoreHttpRouterServerInternalPluginApi" text="@kbn/core-http-router-server-internal"/> | Kibana Core | - | 25 | 5 | 25 | 1 |
 | <DocLink id="kibKbnCoreHttpRouterServerMocksPluginApi" text="@kbn/core-http-router-server-mocks"/> | Kibana Core | - | 7 | 0 | 7 | 1 |
 | <DocLink id="kibKbnCoreHttpServerPluginApi" text="@kbn/core-http-server"/> | Kibana Core | - | 403 | 1 | 160 | 0 |
-| <DocLink id="kibKbnCoreHttpServerInternalPluginApi" text="@kbn/core-http-server-internal"/> | Kibana Core | - | 54 | 0 | 48 | 6 |
+| <DocLink id="kibKbnCoreHttpServerInternalPluginApi" text="@kbn/core-http-server-internal"/> | Kibana Core | - | 55 | 0 | 49 | 6 |
 | <DocLink id="kibKbnCoreHttpServerMocksPluginApi" text="@kbn/core-http-server-mocks"/> | Kibana Core | - | 41 | 0 | 40 | 0 |
 | <DocLink id="kibKbnCoreI18nBrowserPluginApi" text="@kbn/core-i18n-browser"/> | Kibana Core | - | 4 | 0 | 2 | 0 |
 | <DocLink id="kibKbnCoreI18nBrowserMocksPluginApi" text="@kbn/core-i18n-browser-mocks"/> | Kibana Core | - | 3 | 0 | 3 | 0 |
@@ -355,7 +356,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCoreSavedObjectsImportExportServerMocksPluginApi" text="@kbn/core-saved-objects-import-export-server-mocks"/> | Kibana Core | - | 4 | 0 | 4 | 0 |
 | <DocLink id="kibKbnCoreSavedObjectsMigrationServerInternalPluginApi" text="@kbn/core-saved-objects-migration-server-internal"/> | Kibana Core | - | 112 | 0 | 79 | 45 |
 | <DocLink id="kibKbnCoreSavedObjectsMigrationServerMocksPluginApi" text="@kbn/core-saved-objects-migration-server-mocks"/> | Kibana Core | - | 12 | 0 | 12 | 0 |
-| <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" text="@kbn/core-saved-objects-server"/> | Kibana Core | - | 329 | 0 | 96 | 1 |
+| <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" text="@kbn/core-saved-objects-server"/> | Kibana Core | - | 358 | 0 | 104 | 1 |
 | <DocLink id="kibKbnCoreSavedObjectsServerInternalPluginApi" text="@kbn/core-saved-objects-server-internal"/> | Kibana Core | - | 69 | 0 | 69 | 4 |
 | <DocLink id="kibKbnCoreSavedObjectsServerMocksPluginApi" text="@kbn/core-saved-objects-server-mocks"/> | Kibana Core | - | 14 | 0 | 14 | 0 |
 | <DocLink id="kibKbnCoreSavedObjectsUtilsServerPluginApi" text="@kbn/core-saved-objects-utils-server"/> | Kibana Core | - | 108 | 1 | 84 | 0 |
@@ -367,7 +368,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCoreTestHelpersDeprecationsGettersPluginApi" text="@kbn/core-test-helpers-deprecations-getters"/> | Kibana Core | - | 11 | 0 | 11 | 0 |
 | <DocLink id="kibKbnCoreTestHelpersHttpSetupBrowserPluginApi" text="@kbn/core-test-helpers-http-setup-browser"/> | Kibana Core | - | 5 | 0 | 5 | 0 |
 | <DocLink id="kibKbnCoreTestHelpersKbnServerPluginApi" text="@kbn/core-test-helpers-kbn-server"/> | Kibana Core | - | 54 | 1 | 48 | 0 |
-| <DocLink id="kibKbnCoreTestHelpersSoTypeSerializerPluginApi" text="@kbn/core-test-helpers-so-type-serializer"/> | Kibana Core | - | 13 | 0 | 12 | 0 |
+| <DocLink id="kibKbnCoreTestHelpersSoTypeSerializerPluginApi" text="@kbn/core-test-helpers-so-type-serializer"/> | Kibana Core | - | 15 | 0 | 14 | 1 |
 | <DocLink id="kibKbnCoreTestHelpersTestUtilsPluginApi" text="@kbn/core-test-helpers-test-utils"/> | [Owner missing] | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibKbnCoreThemeBrowserPluginApi" text="@kbn/core-theme-browser"/> | Kibana Core | - | 6 | 0 | 4 | 0 |
 | <DocLink id="kibKbnCoreThemeBrowserInternalPluginApi" text="@kbn/core-theme-browser-internal"/> | Kibana Core | - | 2 | 0 | 1 | 0 |
@@ -407,7 +408,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnGeneratePluginApi" text="@kbn/generate"/> | [Owner missing] | - | 1 | 0 | 0 | 0 |
 | <DocLink id="kibKbnGetRepoFilesPluginApi" text="@kbn/get-repo-files"/> | [Owner missing] | - | 6 | 0 | 0 | 0 |
 | <DocLink id="kibKbnGuidedOnboardingPluginApi" text="@kbn/guided-onboarding"/> | [Owner missing] | - | 52 | 0 | 50 | 2 |
-| <DocLink id="kibKbnHandlebarsPluginApi" text="@kbn/handlebars"/> | [Owner missing] | - | 21 | 1 | 14 | 0 |
+| <DocLink id="kibKbnHandlebarsPluginApi" text="@kbn/handlebars"/> | [Owner missing] | - | 10 | 1 | 4 | 1 |
 | <DocLink id="kibKbnHapiMocksPluginApi" text="@kbn/hapi-mocks"/> | [Owner missing] | - | 3 | 0 | 3 | 0 |
 | <DocLink id="kibKbnHealthGatewayServerPluginApi" text="@kbn/health-gateway-server"/> | Kibana Core | - | 1 | 0 | 1 | 0 |
 | <DocLink id="kibKbnHomeSampleDataCardPluginApi" text="@kbn/home-sample-data-card"/> | [Owner missing] | - | 32 | 0 | 22 | 0 |
@@ -427,7 +428,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnManagedVscodeConfigPluginApi" text="@kbn/managed-vscode-config"/> | [Owner missing] | - | 6 | 0 | 1 | 1 |
 | <DocLink id="kibKbnMapboxGlPluginApi" text="@kbn/mapbox-gl"/> | [Owner missing] | - | 534 | 1 | 1 | 0 |
 | <DocLink id="kibKbnMlAggUtilsPluginApi" text="@kbn/ml-agg-utils"/> | Machine Learning UI | This package includes utility functions related to creating elasticsearch aggregation queries, data manipulation and verification. | 83 | 2 | 59 | 0 |
-| <DocLink id="kibKbnMlDatePickerPluginApi" text="@kbn/ml-date-picker"/> | [Owner missing] | - | 49 | 0 | 4 | 0 |
+| <DocLink id="kibKbnMlDatePickerPluginApi" text="@kbn/ml-date-picker"/> | [Owner missing] | - | 50 | 0 | 4 | 0 |
 | <DocLink id="kibKbnMlIsDefinedPluginApi" text="@kbn/ml-is-defined"/> | [Owner missing] | - | 2 | 0 | 0 | 0 |
 | <DocLink id="kibKbnMlIsPopulatedObjectPluginApi" text="@kbn/ml-is-populated-object"/> | Machine Learning UI | A type guard to check record like object structures. | 3 | 0 | 2 | 0 |
 | <DocLink id="kibKbnMlLocalStoragePluginApi" text="@kbn/ml-local-storage"/> | Machine Learning UI | Utilities to combine url state management with local storage. | 5 | 0 | 3 | 0 |
@@ -455,13 +456,13 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnSecuritysolutionExceptionListComponentsPluginApi" text="@kbn/securitysolution-exception-list-components"/> | [Owner missing] | - | 104 | 0 | 93 | 1 |
 | <DocLink id="kibKbnSecuritysolutionHookUtilsPluginApi" text="@kbn/securitysolution-hook-utils"/> | [Owner missing] | Security Solution utilities for React hooks | 15 | 0 | 7 | 0 |
 | <DocLink id="kibKbnSecuritysolutionIoTsAlertingTypesPluginApi" text="@kbn/securitysolution-io-ts-alerting-types"/> | [Owner missing] | io ts utilities and types to be shared with plugins from the security solution project | 138 | 0 | 119 | 0 |
-| <DocLink id="kibKbnSecuritysolutionIoTsListTypesPluginApi" text="@kbn/securitysolution-io-ts-list-types"/> | [Owner missing] | io ts utilities and types to be shared with plugins from the security solution project | 511 | 1 | 498 | 0 |
+| <DocLink id="kibKbnSecuritysolutionIoTsListTypesPluginApi" text="@kbn/securitysolution-io-ts-list-types"/> | [Owner missing] | io ts utilities and types to be shared with plugins from the security solution project | 516 | 1 | 503 | 0 |
 | <DocLink id="kibKbnSecuritysolutionIoTsTypesPluginApi" text="@kbn/securitysolution-io-ts-types"/> | [Owner missing] | io ts utilities and types to be shared with plugins from the security solution project | 65 | 0 | 36 | 0 |
 | <DocLink id="kibKbnSecuritysolutionIoTsUtilsPluginApi" text="@kbn/securitysolution-io-ts-utils"/> | [Owner missing] | io ts utilities and types to be shared with plugins from the security solution project | 28 | 0 | 21 | 0 |
 | <DocLink id="kibKbnSecuritysolutionListApiPluginApi" text="@kbn/securitysolution-list-api"/> | [Owner missing] | security solution list REST API | 67 | 0 | 64 | 0 |
 | <DocLink id="kibKbnSecuritysolutionListConstantsPluginApi" text="@kbn/securitysolution-list-constants"/> | [Owner missing] | security solution list constants to use across plugins such lists, security_solution, cases, etc... | 35 | 0 | 23 | 0 |
 | <DocLink id="kibKbnSecuritysolutionListHooksPluginApi" text="@kbn/securitysolution-list-hooks"/> | [Owner missing] | Security solution list ReactJS hooks | 60 | 0 | 47 | 0 |
-| <DocLink id="kibKbnSecuritysolutionListUtilsPluginApi" text="@kbn/securitysolution-list-utils"/> | [Owner missing] | security solution list utilities | 202 | 10 | 155 | 0 |
+| <DocLink id="kibKbnSecuritysolutionListUtilsPluginApi" text="@kbn/securitysolution-list-utils"/> | [Owner missing] | security solution list utilities | 206 | 10 | 159 | 0 |
 | <DocLink id="kibKbnSecuritysolutionRulesPluginApi" text="@kbn/securitysolution-rules"/> | [Owner missing] | security solution rule utilities to use across plugins | 26 | 0 | 23 | 0 |
 | <DocLink id="kibKbnSecuritysolutionTGridPluginApi" text="@kbn/securitysolution-t-grid"/> | [Owner missing] | security solution t-grid packages will allow sharing components between timelines and security_solution plugin until we transfer all functionality to timelines plugin | 120 | 0 | 116 | 0 |
 | <DocLink id="kibKbnSecuritysolutionUtilsPluginApi" text="@kbn/securitysolution-utils"/> | [Owner missing] | security solution utilities to use across plugins such lists, security_solution, cases, etc... | 31 | 2 | 29 | 0 |
diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx
index 03c1f4acb2680..2d00dd7fc3b7c 100644
--- a/api_docs/presentation_util.mdx
+++ b/api_docs/presentation_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/presentationUtil
 title: "presentationUtil"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the presentationUtil plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationUtil']
 ---
 import presentationUtilObj from './presentation_util.devdocs.json';
diff --git a/api_docs/profiling.devdocs.json b/api_docs/profiling.devdocs.json
index 035a78aebe58c..10f7adf5bc3bc 100644
--- a/api_docs/profiling.devdocs.json
+++ b/api_docs/profiling.devdocs.json
@@ -104,7 +104,7 @@
         "label": "getRoutePaths",
         "description": [],
         "signature": [
-          "() => { TopN: string; TopNContainers: string; TopNDeployments: string; TopNFunctions: string; TopNHosts: string; TopNThreads: string; TopNTraces: string; Flamechart: string; CacheExecutables: string; CacheStackFrames: string; }"
+          "() => { TopN: string; TopNContainers: string; TopNDeployments: string; TopNFunctions: string; TopNHosts: string; TopNThreads: string; TopNTraces: string; Flamechart: string; CacheExecutables: string; CacheStackFrames: string; HasSetupESResources: string; HasSetupDataCollection: string; SetupDataCollectionInstructions: string; }"
         ],
         "path": "x-pack/plugins/profiling/common/index.ts",
         "deprecated": false,
diff --git a/api_docs/profiling.mdx b/api_docs/profiling.mdx
index 4148815eefdf4..f94a329646a66 100644
--- a/api_docs/profiling.mdx
+++ b/api_docs/profiling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profiling
 title: "profiling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profiling plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profiling']
 ---
 import profilingObj from './profiling.devdocs.json';
diff --git a/api_docs/remote_clusters.mdx b/api_docs/remote_clusters.mdx
index e38dd73a1d13d..c291c3d708b5b 100644
--- a/api_docs/remote_clusters.mdx
+++ b/api_docs/remote_clusters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/remoteClusters
 title: "remoteClusters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the remoteClusters plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'remoteClusters']
 ---
 import remoteClustersObj from './remote_clusters.devdocs.json';
diff --git a/api_docs/reporting.mdx b/api_docs/reporting.mdx
index 17a918294935d..7d6ae021aa183 100644
--- a/api_docs/reporting.mdx
+++ b/api_docs/reporting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/reporting
 title: "reporting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the reporting plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'reporting']
 ---
 import reportingObj from './reporting.devdocs.json';
diff --git a/api_docs/rollup.mdx b/api_docs/rollup.mdx
index 1fc983ed105d5..f273be32bc2a7 100644
--- a/api_docs/rollup.mdx
+++ b/api_docs/rollup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/rollup
 title: "rollup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the rollup plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'rollup']
 ---
 import rollupObj from './rollup.devdocs.json';
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index 76d668d8caa65..2b4236d6a1553 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ruleRegistry
 title: "ruleRegistry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ruleRegistry plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ruleRegistry']
 ---
 import ruleRegistryObj from './rule_registry.devdocs.json';
diff --git a/api_docs/runtime_fields.mdx b/api_docs/runtime_fields.mdx
index 0c2f66b4944e2..a8252100dc1d6 100644
--- a/api_docs/runtime_fields.mdx
+++ b/api_docs/runtime_fields.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/runtimeFields
 title: "runtimeFields"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the runtimeFields plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'runtimeFields']
 ---
 import runtimeFieldsObj from './runtime_fields.devdocs.json';
diff --git a/api_docs/saved_objects.mdx b/api_docs/saved_objects.mdx
index cf7a001a620b2..c27003a30f94a 100644
--- a/api_docs/saved_objects.mdx
+++ b/api_docs/saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjects
 title: "savedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjects plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjects']
 ---
 import savedObjectsObj from './saved_objects.devdocs.json';
diff --git a/api_docs/saved_objects_finder.mdx b/api_docs/saved_objects_finder.mdx
index db78b1aabc68c..43b2a97ac3d03 100644
--- a/api_docs/saved_objects_finder.mdx
+++ b/api_docs/saved_objects_finder.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsFinder
 title: "savedObjectsFinder"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsFinder plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsFinder']
 ---
 import savedObjectsFinderObj from './saved_objects_finder.devdocs.json';
diff --git a/api_docs/saved_objects_management.mdx b/api_docs/saved_objects_management.mdx
index 4377f1beac2e2..e7c19ce3b9108 100644
--- a/api_docs/saved_objects_management.mdx
+++ b/api_docs/saved_objects_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsManagement
 title: "savedObjectsManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsManagement plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsManagement']
 ---
 import savedObjectsManagementObj from './saved_objects_management.devdocs.json';
diff --git a/api_docs/saved_objects_tagging.mdx b/api_docs/saved_objects_tagging.mdx
index 8c73088fa2659..b494ad068691d 100644
--- a/api_docs/saved_objects_tagging.mdx
+++ b/api_docs/saved_objects_tagging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTagging
 title: "savedObjectsTagging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTagging plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTagging']
 ---
 import savedObjectsTaggingObj from './saved_objects_tagging.devdocs.json';
diff --git a/api_docs/saved_objects_tagging_oss.mdx b/api_docs/saved_objects_tagging_oss.mdx
index cfe1398a962a6..c0a4a057dbfc9 100644
--- a/api_docs/saved_objects_tagging_oss.mdx
+++ b/api_docs/saved_objects_tagging_oss.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTaggingOss
 title: "savedObjectsTaggingOss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTaggingOss plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTaggingOss']
 ---
 import savedObjectsTaggingOssObj from './saved_objects_tagging_oss.devdocs.json';
diff --git a/api_docs/saved_search.mdx b/api_docs/saved_search.mdx
index 2ced43ac416dc..b2acb4a2cee7d 100644
--- a/api_docs/saved_search.mdx
+++ b/api_docs/saved_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedSearch
 title: "savedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedSearch plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedSearch']
 ---
 import savedSearchObj from './saved_search.devdocs.json';
diff --git a/api_docs/screenshot_mode.mdx b/api_docs/screenshot_mode.mdx
index 5dcdb0e78d97e..bece61ddeb3f3 100644
--- a/api_docs/screenshot_mode.mdx
+++ b/api_docs/screenshot_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotMode
 title: "screenshotMode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotMode plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotMode']
 ---
 import screenshotModeObj from './screenshot_mode.devdocs.json';
diff --git a/api_docs/screenshotting.mdx b/api_docs/screenshotting.mdx
index 370529b6a6a98..984bbfbcee17b 100644
--- a/api_docs/screenshotting.mdx
+++ b/api_docs/screenshotting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotting
 title: "screenshotting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotting plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotting']
 ---
 import screenshottingObj from './screenshotting.devdocs.json';
diff --git a/api_docs/security.mdx b/api_docs/security.mdx
index 78ff2f6aaff02..7a612da59190c 100644
--- a/api_docs/security.mdx
+++ b/api_docs/security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/security
 title: "security"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the security plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'security']
 ---
 import securityObj from './security.devdocs.json';
diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx
index cc4bdbfdcdc83..7146bc36bad15 100644
--- a/api_docs/security_solution.mdx
+++ b/api_docs/security_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolution
 title: "securitySolution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolution plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolution']
 ---
 import securitySolutionObj from './security_solution.devdocs.json';
diff --git a/api_docs/session_view.mdx b/api_docs/session_view.mdx
index c286437356f5b..fb819b9b9d84a 100644
--- a/api_docs/session_view.mdx
+++ b/api_docs/session_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/sessionView
 title: "sessionView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the sessionView plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sessionView']
 ---
 import sessionViewObj from './session_view.devdocs.json';
diff --git a/api_docs/share.mdx b/api_docs/share.mdx
index c698baa7152db..5e0ba91e52847 100644
--- a/api_docs/share.mdx
+++ b/api_docs/share.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/share
 title: "share"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the share plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'share']
 ---
 import shareObj from './share.devdocs.json';
diff --git a/api_docs/snapshot_restore.mdx b/api_docs/snapshot_restore.mdx
index 881af5e8dfa24..d9a745375314d 100644
--- a/api_docs/snapshot_restore.mdx
+++ b/api_docs/snapshot_restore.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/snapshotRestore
 title: "snapshotRestore"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the snapshotRestore plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'snapshotRestore']
 ---
 import snapshotRestoreObj from './snapshot_restore.devdocs.json';
diff --git a/api_docs/spaces.mdx b/api_docs/spaces.mdx
index 0e6ee0a35f11b..3173b3468d392 100644
--- a/api_docs/spaces.mdx
+++ b/api_docs/spaces.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/spaces
 title: "spaces"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the spaces plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'spaces']
 ---
 import spacesObj from './spaces.devdocs.json';
diff --git a/api_docs/stack_alerts.mdx b/api_docs/stack_alerts.mdx
index 6b1c54c5e45c9..3901be8abc82e 100644
--- a/api_docs/stack_alerts.mdx
+++ b/api_docs/stack_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackAlerts
 title: "stackAlerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackAlerts plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackAlerts']
 ---
 import stackAlertsObj from './stack_alerts.devdocs.json';
diff --git a/api_docs/stack_connectors.mdx b/api_docs/stack_connectors.mdx
index d52f86ad8d6ae..c884b8c8b6671 100644
--- a/api_docs/stack_connectors.mdx
+++ b/api_docs/stack_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackConnectors
 title: "stackConnectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackConnectors plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackConnectors']
 ---
 import stackConnectorsObj from './stack_connectors.devdocs.json';
diff --git a/api_docs/task_manager.mdx b/api_docs/task_manager.mdx
index 5d260a89bf443..0500a156b6786 100644
--- a/api_docs/task_manager.mdx
+++ b/api_docs/task_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/taskManager
 title: "taskManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the taskManager plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'taskManager']
 ---
 import taskManagerObj from './task_manager.devdocs.json';
diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx
index 01af319f3bda4..bb782eda7bfdd 100644
--- a/api_docs/telemetry.mdx
+++ b/api_docs/telemetry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetry
 title: "telemetry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetry plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetry']
 ---
 import telemetryObj from './telemetry.devdocs.json';
diff --git a/api_docs/telemetry_collection_manager.mdx b/api_docs/telemetry_collection_manager.mdx
index c86d8166f16f9..4df7964b466c0 100644
--- a/api_docs/telemetry_collection_manager.mdx
+++ b/api_docs/telemetry_collection_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionManager
 title: "telemetryCollectionManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionManager plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionManager']
 ---
 import telemetryCollectionManagerObj from './telemetry_collection_manager.devdocs.json';
diff --git a/api_docs/telemetry_collection_xpack.mdx b/api_docs/telemetry_collection_xpack.mdx
index 59e2d2847e0dd..421c6e80b9b14 100644
--- a/api_docs/telemetry_collection_xpack.mdx
+++ b/api_docs/telemetry_collection_xpack.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionXpack
 title: "telemetryCollectionXpack"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionXpack plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionXpack']
 ---
 import telemetryCollectionXpackObj from './telemetry_collection_xpack.devdocs.json';
diff --git a/api_docs/telemetry_management_section.mdx b/api_docs/telemetry_management_section.mdx
index 0594a57e39211..7cd17cdd23fef 100644
--- a/api_docs/telemetry_management_section.mdx
+++ b/api_docs/telemetry_management_section.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryManagementSection
 title: "telemetryManagementSection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryManagementSection plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryManagementSection']
 ---
 import telemetryManagementSectionObj from './telemetry_management_section.devdocs.json';
diff --git a/api_docs/threat_intelligence.mdx b/api_docs/threat_intelligence.mdx
index e2621fa11d1ab..080ca2a6d3ee5 100644
--- a/api_docs/threat_intelligence.mdx
+++ b/api_docs/threat_intelligence.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/threatIntelligence
 title: "threatIntelligence"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the threatIntelligence plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'threatIntelligence']
 ---
 import threatIntelligenceObj from './threat_intelligence.devdocs.json';
diff --git a/api_docs/timelines.devdocs.json b/api_docs/timelines.devdocs.json
index a0b03b6f182b4..1c87640cc7f23 100644
--- a/api_docs/timelines.devdocs.json
+++ b/api_docs/timelines.devdocs.json
@@ -2388,7 +2388,7 @@
             "label": "value",
             "description": [],
             "signature": [
-              "string | number | (string | number)[]"
+              "string | number | boolean | (string | number | boolean)[]"
             ],
             "path": "x-pack/plugins/timelines/common/types/timeline/data_provider/index.ts",
             "deprecated": false,
@@ -2402,7 +2402,7 @@
             "label": "displayValue",
             "description": [],
             "signature": [
-              "string | number | undefined"
+              "string | number | boolean | undefined"
             ],
             "path": "x-pack/plugins/timelines/common/types/timeline/data_provider/index.ts",
             "deprecated": false,
diff --git a/api_docs/timelines.mdx b/api_docs/timelines.mdx
index c8d8886c92dd1..12b767bcd392b 100644
--- a/api_docs/timelines.mdx
+++ b/api_docs/timelines.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/timelines
 title: "timelines"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the timelines plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'timelines']
 ---
 import timelinesObj from './timelines.devdocs.json';
diff --git a/api_docs/transform.mdx b/api_docs/transform.mdx
index d381c66753f23..dc044d96529bb 100644
--- a/api_docs/transform.mdx
+++ b/api_docs/transform.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/transform
 title: "transform"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the transform plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'transform']
 ---
 import transformObj from './transform.devdocs.json';
diff --git a/api_docs/triggers_actions_ui.devdocs.json b/api_docs/triggers_actions_ui.devdocs.json
index 727eba233d35b..9e7b341daabc3 100644
--- a/api_docs/triggers_actions_ui.devdocs.json
+++ b/api_docs/triggers_actions_ui.devdocs.json
@@ -8561,9 +8561,9 @@
           "description": [],
           "signature": [
             "(props: ",
-            "RulesListNotifyBadgeProps",
+            "RulesListNotifyBadgePropsWithApi",
             ") => React.ReactElement<",
-            "RulesListNotifyBadgeProps",
+            "RulesListNotifyBadgePropsWithApi",
             ", string | React.JSXElementConstructor<any>>"
           ],
           "path": "x-pack/plugins/triggers_actions_ui/public/plugin.ts",
@@ -8578,7 +8578,7 @@
               "label": "props",
               "description": [],
               "signature": [
-                "RulesListNotifyBadgeProps"
+                "RulesListNotifyBadgePropsWithApi"
               ],
               "path": "x-pack/plugins/triggers_actions_ui/public/plugin.ts",
               "deprecated": false,
diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx
index 1a60684e2242a..5e0415688da41 100644
--- a/api_docs/triggers_actions_ui.mdx
+++ b/api_docs/triggers_actions_ui.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/triggersActionsUi
 title: "triggersActionsUi"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the triggersActionsUi plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'triggersActionsUi']
 ---
 import triggersActionsUiObj from './triggers_actions_ui.devdocs.json';
diff --git a/api_docs/ui_actions.mdx b/api_docs/ui_actions.mdx
index ac0099c091616..2d2aea7f1e51a 100644
--- a/api_docs/ui_actions.mdx
+++ b/api_docs/ui_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActions
 title: "uiActions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActions plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActions']
 ---
 import uiActionsObj from './ui_actions.devdocs.json';
diff --git a/api_docs/ui_actions_enhanced.mdx b/api_docs/ui_actions_enhanced.mdx
index c94aa6bb6d19e..356d1ba0e4ea7 100644
--- a/api_docs/ui_actions_enhanced.mdx
+++ b/api_docs/ui_actions_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActionsEnhanced
 title: "uiActionsEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActionsEnhanced plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActionsEnhanced']
 ---
 import uiActionsEnhancedObj from './ui_actions_enhanced.devdocs.json';
diff --git a/api_docs/unified_field_list.mdx b/api_docs/unified_field_list.mdx
index 927c393480ae1..d2e0c28e81a43 100644
--- a/api_docs/unified_field_list.mdx
+++ b/api_docs/unified_field_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedFieldList
 title: "unifiedFieldList"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedFieldList plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedFieldList']
 ---
 import unifiedFieldListObj from './unified_field_list.devdocs.json';
diff --git a/api_docs/unified_histogram.devdocs.json b/api_docs/unified_histogram.devdocs.json
index a5555275c7b58..66a0bdd1a0fda 100644
--- a/api_docs/unified_histogram.devdocs.json
+++ b/api_docs/unified_histogram.devdocs.json
@@ -5,1104 +5,1044 @@
     "functions": [
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramLayout",
+        "id": "def-public.getBreakdownField",
         "type": "Function",
         "tags": [],
-        "label": "UnifiedHistogramLayout",
+        "label": "getBreakdownField",
         "description": [
-          "\nA resizable layout component with two panels that renders a histogram with a hits\ncounter in the top panel, and a main display (data table, etc.) in the bottom panel.\nIf all context props are left undefined, the layout will render in a single panel\nmode including only the main display."
+          "\nGet the breakdown field from local storage"
         ],
         "signature": [
-          "React.ForwardRefExoticComponent<",
+          "(storage: ",
           {
-            "pluginId": "unifiedHistogram",
+            "pluginId": "kibanaUtils",
             "scope": "public",
-            "docId": "kibUnifiedHistogramPluginApi",
-            "section": "def-public.UnifiedHistogramLayoutProps",
-            "text": "UnifiedHistogramLayoutProps"
+            "docId": "kibKibanaUtilsPluginApi",
+            "section": "def-public.Storage",
+            "text": "Storage"
           },
-          " & React.RefAttributes<{}>>"
+          ", localStorageKeyPrefix: string) => string | undefined"
         ],
-        "path": "src/plugins/unified_histogram/public/layout/index.tsx",
+        "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
         "deprecated": false,
         "trackAdoption": false,
-        "returnComment": [],
         "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayout.$1",
-            "type": "Uncategorized",
+            "id": "def-public.getBreakdownField.$1",
+            "type": "Object",
             "tags": [],
-            "label": "props",
+            "label": "storage",
             "description": [],
             "signature": [
-              "P"
+              {
+                "pluginId": "kibanaUtils",
+                "scope": "public",
+                "docId": "kibKibanaUtilsPluginApi",
+                "section": "def-public.Storage",
+                "text": "Storage"
+              }
             ],
-            "path": "node_modules/@types/react/index.d.ts",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "unifiedHistogram",
+            "id": "def-public.getBreakdownField.$2",
+            "type": "string",
+            "tags": [],
+            "label": "localStorageKeyPrefix",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
           }
         ],
+        "returnComment": [],
         "initialIsOpen": false
-      }
-    ],
-    "interfaces": [
+      },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramBreakdownContext",
-        "type": "Interface",
+        "id": "def-public.getChartHidden",
+        "type": "Function",
         "tags": [],
-        "label": "UnifiedHistogramBreakdownContext",
+        "label": "getChartHidden",
         "description": [
-          "\nContext object for the histogram breakdown"
+          "\nGet the chart hidden state from local storage"
         ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
+        "signature": [
+          "(storage: ",
+          {
+            "pluginId": "kibanaUtils",
+            "scope": "public",
+            "docId": "kibKibanaUtilsPluginApi",
+            "section": "def-public.Storage",
+            "text": "Storage"
+          },
+          ", localStorageKeyPrefix: string) => boolean | undefined"
+        ],
+        "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramBreakdownContext.field",
+            "id": "def-public.getChartHidden.$1",
             "type": "Object",
             "tags": [],
-            "label": "field",
-            "description": [
-              "\nThe field used for the breakdown"
-            ],
+            "label": "storage",
+            "description": [],
             "signature": [
               {
-                "pluginId": "dataViews",
-                "scope": "common",
-                "docId": "kibDataViewsPluginApi",
-                "section": "def-common.DataViewField",
-                "text": "DataViewField"
-              },
-              " | undefined"
+                "pluginId": "kibanaUtils",
+                "scope": "public",
+                "docId": "kibKibanaUtilsPluginApi",
+                "section": "def-public.Storage",
+                "text": "Storage"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "unifiedHistogram",
+            "id": "def-public.getChartHidden.$2",
+            "type": "string",
+            "tags": [],
+            "label": "localStorageKeyPrefix",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
           }
         ],
+        "returnComment": [],
         "initialIsOpen": false
       },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramChartContext",
-        "type": "Interface",
+        "id": "def-public.getTopPanelHeight",
+        "type": "Function",
         "tags": [],
-        "label": "UnifiedHistogramChartContext",
+        "label": "getTopPanelHeight",
         "description": [
-          "\nContext object for the chart"
+          "\nGet the top panel height from local storage"
         ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
+        "signature": [
+          "(storage: ",
+          {
+            "pluginId": "kibanaUtils",
+            "scope": "public",
+            "docId": "kibKibanaUtilsPluginApi",
+            "section": "def-public.Storage",
+            "text": "Storage"
+          },
+          ", localStorageKeyPrefix: string) => number | undefined"
+        ],
+        "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramChartContext.hidden",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "hidden",
-            "description": [
-              "\nControls whether or not the chart is hidden"
-            ],
-            "signature": [
-              "boolean | undefined"
-            ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramChartContext.timeInterval",
-            "type": "string",
+            "id": "def-public.getTopPanelHeight.$1",
+            "type": "Object",
             "tags": [],
-            "label": "timeInterval",
-            "description": [
-              "\nControls the time interval of the chart"
-            ],
+            "label": "storage",
+            "description": [],
             "signature": [
-              "string | undefined"
+              {
+                "pluginId": "kibanaUtils",
+                "scope": "public",
+                "docId": "kibKibanaUtilsPluginApi",
+                "section": "def-public.Storage",
+                "text": "Storage"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramChartContext.title",
+            "id": "def-public.getTopPanelHeight.$2",
             "type": "string",
             "tags": [],
-            "label": "title",
-            "description": [
-              "\nThe chart title -- sets the title property on the Lens chart input"
-            ],
+            "label": "localStorageKeyPrefix",
+            "description": [],
             "signature": [
-              "string | undefined"
+              "string"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
           }
         ],
+        "returnComment": [],
         "initialIsOpen": false
       },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramChartLoadEvent",
-        "type": "Interface",
+        "id": "def-public.setBreakdownField",
+        "type": "Function",
         "tags": [],
-        "label": "UnifiedHistogramChartLoadEvent",
+        "label": "setBreakdownField",
         "description": [
-          "\nEmitted when the histogram loading status changes"
+          "\nSet the breakdown field in local storage"
         ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
+        "signature": [
+          "(storage: ",
+          {
+            "pluginId": "kibanaUtils",
+            "scope": "public",
+            "docId": "kibKibanaUtilsPluginApi",
+            "section": "def-public.Storage",
+            "text": "Storage"
+          },
+          ", localStorageKeyPrefix: string, breakdownField: string | undefined) => false | void"
+        ],
+        "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramChartLoadEvent.adapters",
+            "id": "def-public.setBreakdownField.$1",
             "type": "Object",
             "tags": [],
-            "label": "adapters",
-            "description": [
-              "\nInspector adapters for the request"
-            ],
+            "label": "storage",
+            "description": [],
             "signature": [
-              "{ requests?: ",
-              {
-                "pluginId": "inspector",
-                "scope": "common",
-                "docId": "kibInspectorPluginApi",
-                "section": "def-common.RequestAdapter",
-                "text": "RequestAdapter"
-              },
-              " | undefined; tables?: ",
-              {
-                "pluginId": "expressions",
-                "scope": "common",
-                "docId": "kibExpressionsPluginApi",
-                "section": "def-common.TablesAdapter",
-                "text": "TablesAdapter"
-              },
-              " | undefined; expression?: ",
               {
-                "pluginId": "expressions",
-                "scope": "common",
-                "docId": "kibExpressionsPluginApi",
-                "section": "def-common.ExpressionsInspectorAdapter",
-                "text": "ExpressionsInspectorAdapter"
-              },
-              " | undefined; }"
+                "pluginId": "kibanaUtils",
+                "scope": "public",
+                "docId": "kibKibanaUtilsPluginApi",
+                "section": "def-public.Storage",
+                "text": "Storage"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "unifiedHistogram",
+            "id": "def-public.setBreakdownField.$2",
+            "type": "string",
+            "tags": [],
+            "label": "localStorageKeyPrefix",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "unifiedHistogram",
+            "id": "def-public.setBreakdownField.$3",
+            "type": "string",
+            "tags": [],
+            "label": "breakdownField",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": false
           }
         ],
+        "returnComment": [],
         "initialIsOpen": false
       },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramHitsContext",
-        "type": "Interface",
+        "id": "def-public.setChartHidden",
+        "type": "Function",
         "tags": [],
-        "label": "UnifiedHistogramHitsContext",
+        "label": "setChartHidden",
         "description": [
-          "\nContext object for the hits count"
+          "\nSet the chart hidden state in local storage"
         ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
+        "signature": [
+          "(storage: ",
+          {
+            "pluginId": "kibanaUtils",
+            "scope": "public",
+            "docId": "kibKibanaUtilsPluginApi",
+            "section": "def-public.Storage",
+            "text": "Storage"
+          },
+          ", localStorageKeyPrefix: string, chartHidden: boolean | undefined) => false | void"
+        ],
+        "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramHitsContext.status",
-            "type": "CompoundType",
+            "id": "def-public.setChartHidden.$1",
+            "type": "Object",
             "tags": [],
-            "label": "status",
-            "description": [
-              "\nThe fetch status of the hits count request"
-            ],
+            "label": "storage",
+            "description": [],
             "signature": [
               {
-                "pluginId": "unifiedHistogram",
+                "pluginId": "kibanaUtils",
                 "scope": "public",
-                "docId": "kibUnifiedHistogramPluginApi",
-                "section": "def-public.UnifiedHistogramFetchStatus",
-                "text": "UnifiedHistogramFetchStatus"
-              },
-              " | undefined"
+                "docId": "kibKibanaUtilsPluginApi",
+                "section": "def-public.Storage",
+                "text": "Storage"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramHitsContext.total",
-            "type": "number",
+            "id": "def-public.setChartHidden.$2",
+            "type": "string",
             "tags": [],
-            "label": "total",
-            "description": [
-              "\nThe total number of hits"
+            "label": "localStorageKeyPrefix",
+            "description": [],
+            "signature": [
+              "string"
             ],
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "unifiedHistogram",
+            "id": "def-public.setChartHidden.$3",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "chartHidden",
+            "description": [],
             "signature": [
-              "number | undefined"
+              "boolean | undefined"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": false
           }
         ],
+        "returnComment": [],
         "initialIsOpen": false
       },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramLayoutProps",
-        "type": "Interface",
+        "id": "def-public.setTopPanelHeight",
+        "type": "Function",
         "tags": [],
-        "label": "UnifiedHistogramLayoutProps",
-        "description": [],
+        "label": "setTopPanelHeight",
+        "description": [
+          "\nSet the top panel height in local storage"
+        ],
         "signature": [
+          "(storage: ",
           {
-            "pluginId": "unifiedHistogram",
+            "pluginId": "kibanaUtils",
             "scope": "public",
-            "docId": "kibUnifiedHistogramPluginApi",
-            "section": "def-public.UnifiedHistogramLayoutProps",
-            "text": "UnifiedHistogramLayoutProps"
+            "docId": "kibKibanaUtilsPluginApi",
+            "section": "def-public.Storage",
+            "text": "Storage"
           },
-          " extends { children?: React.ReactNode; }"
+          ", localStorageKeyPrefix: string, topPanelHeight: number | undefined) => false | void"
         ],
-        "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+        "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.className",
-            "type": "string",
+            "id": "def-public.setTopPanelHeight.$1",
+            "type": "Object",
             "tags": [],
-            "label": "className",
-            "description": [
-              "\nOptional class name to add to the layout container"
-            ],
+            "label": "storage",
+            "description": [],
             "signature": [
-              "string | undefined"
+              {
+                "pluginId": "kibanaUtils",
+                "scope": "public",
+                "docId": "kibKibanaUtilsPluginApi",
+                "section": "def-public.Storage",
+                "text": "Storage"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.services",
-            "type": "Object",
+            "id": "def-public.setTopPanelHeight.$2",
+            "type": "string",
             "tags": [],
-            "label": "services",
-            "description": [
-              "\nRequired services"
-            ],
+            "label": "localStorageKeyPrefix",
+            "description": [],
             "signature": [
-              {
-                "pluginId": "unifiedHistogram",
-                "scope": "public",
-                "docId": "kibUnifiedHistogramPluginApi",
-                "section": "def-public.UnifiedHistogramServices",
-                "text": "UnifiedHistogramServices"
-              }
+              "string"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": true
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.dataView",
-            "type": "Object",
+            "id": "def-public.setTopPanelHeight.$3",
+            "type": "number",
             "tags": [],
-            "label": "dataView",
-            "description": [
-              "\nThe current data view"
-            ],
+            "label": "topPanelHeight",
+            "description": [],
             "signature": [
-              {
-                "pluginId": "dataViews",
-                "scope": "common",
-                "docId": "kibDataViewsPluginApi",
-                "section": "def-common.DataView",
-                "text": "DataView"
-              }
+              "number | undefined"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/utils/local_storage_utils.ts",
             "deprecated": false,
-            "trackAdoption": false
+            "trackAdoption": false,
+            "isRequired": false
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "unifiedHistogram",
+        "id": "def-public.UnifiedHistogramContainer",
+        "type": "Function",
+        "tags": [],
+        "label": "UnifiedHistogramContainer",
+        "description": [
+          "\nA resizable layout component with two panels that renders a histogram with a hits\ncounter in the top panel, and a main display (data table, etc.) in the bottom panel.\nIf all context props are left undefined, the layout will render in a single panel\nmode including only the main display."
+        ],
+        "signature": [
+          "React.ForwardRefExoticComponent<Pick<",
+          {
+            "pluginId": "unifiedHistogram",
+            "scope": "public",
+            "docId": "kibUnifiedHistogramPluginApi",
+            "section": "def-public.UnifiedHistogramContainerProps",
+            "text": "UnifiedHistogramContainerProps"
           },
+          " & React.RefAttributes<",
           {
-            "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.query",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "query",
-            "description": [
-              "\nThe current query"
-            ],
-            "signature": [
-              {
-                "pluginId": "@kbn/es-query",
-                "scope": "common",
-                "docId": "kibKbnEsQueryPluginApi",
-                "section": "def-common.Query",
-                "text": "Query"
-              },
-              " | ",
-              {
-                "pluginId": "@kbn/es-query",
-                "scope": "common",
-                "docId": "kibKbnEsQueryPluginApi",
-                "section": "def-common.AggregateQuery",
-                "text": "AggregateQuery"
-              },
-              " | undefined"
-            ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-            "deprecated": false,
-            "trackAdoption": false
+            "pluginId": "unifiedHistogram",
+            "scope": "public",
+            "docId": "kibUnifiedHistogramPluginApi",
+            "section": "def-public.UnifiedHistogramApi",
+            "text": "UnifiedHistogramApi"
           },
+          ">, \"children\" | \"className\" | \"key\" | \"css\" | \"resizeRef\" | \"appendHitsCounter\"> & React.RefAttributes<{}>>"
+        ],
+        "path": "src/plugins/unified_histogram/public/container/index.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.filters",
-            "type": "Array",
+            "id": "def-public.UnifiedHistogramContainer.$1",
+            "type": "Uncategorized",
             "tags": [],
-            "label": "filters",
-            "description": [
-              "\nThe current filters"
-            ],
+            "label": "props",
+            "description": [],
             "signature": [
-              {
-                "pluginId": "@kbn/es-query",
-                "scope": "common",
-                "docId": "kibKbnEsQueryPluginApi",
-                "section": "def-common.Filter",
-                "text": "Filter"
-              },
-              "[] | undefined"
+              "P"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "node_modules/@types/react/index.d.ts",
             "deprecated": false,
             "trackAdoption": false
-          },
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "interfaces": [
+      {
+        "parentPluginId": "unifiedHistogram",
+        "id": "def-public.UnifiedHistogramChartLoadEvent",
+        "type": "Interface",
+        "tags": [],
+        "label": "UnifiedHistogramChartLoadEvent",
+        "description": [
+          "\nEmitted when the histogram loading status changes"
+        ],
+        "path": "src/plugins/unified_histogram/public/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.timeRange",
+            "id": "def-public.UnifiedHistogramChartLoadEvent.adapters",
             "type": "Object",
             "tags": [],
-            "label": "timeRange",
+            "label": "adapters",
             "description": [
-              "\nThe current time range"
+              "\nInspector adapters for the request"
             ],
             "signature": [
+              "{ requests?: ",
               {
-                "pluginId": "@kbn/es-query",
+                "pluginId": "inspector",
                 "scope": "common",
-                "docId": "kibKbnEsQueryPluginApi",
-                "section": "def-common.TimeRange",
-                "text": "TimeRange"
+                "docId": "kibInspectorPluginApi",
+                "section": "def-common.RequestAdapter",
+                "text": "RequestAdapter"
               },
-              " | undefined"
+              " | undefined; tables?: ",
+              {
+                "pluginId": "expressions",
+                "scope": "common",
+                "docId": "kibExpressionsPluginApi",
+                "section": "def-common.TablesAdapter",
+                "text": "TablesAdapter"
+              },
+              " | undefined; expression?: ",
+              {
+                "pluginId": "expressions",
+                "scope": "common",
+                "docId": "kibExpressionsPluginApi",
+                "section": "def-common.ExpressionsInspectorAdapter",
+                "text": "ExpressionsInspectorAdapter"
+              },
+              " | undefined; }"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
-          },
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "unifiedHistogram",
+        "id": "def-public.UnifiedHistogramServices",
+        "type": "Interface",
+        "tags": [],
+        "label": "UnifiedHistogramServices",
+        "description": [
+          "\nThe services required by the Unified Histogram components"
+        ],
+        "path": "src/plugins/unified_histogram/public/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.request",
+            "id": "def-public.UnifiedHistogramServices.data",
             "type": "Object",
             "tags": [],
-            "label": "request",
-            "description": [
-              "\nContext object for requests made by unified histogram components -- optional"
-            ],
+            "label": "data",
+            "description": [],
             "signature": [
               {
-                "pluginId": "unifiedHistogram",
+                "pluginId": "data",
                 "scope": "public",
-                "docId": "kibUnifiedHistogramPluginApi",
-                "section": "def-public.UnifiedHistogramRequestContext",
-                "text": "UnifiedHistogramRequestContext"
-              },
-              " | undefined"
+                "docId": "kibDataPluginApi",
+                "section": "def-public.DataPublicPluginStart",
+                "text": "DataPublicPluginStart"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.hits",
+            "id": "def-public.UnifiedHistogramServices.theme",
             "type": "Object",
             "tags": [],
-            "label": "hits",
-            "description": [
-              "\nContext object for the hits count -- leave undefined to hide the hits count"
-            ],
+            "label": "theme",
+            "description": [],
             "signature": [
-              {
-                "pluginId": "unifiedHistogram",
-                "scope": "public",
-                "docId": "kibUnifiedHistogramPluginApi",
-                "section": "def-public.UnifiedHistogramHitsContext",
-                "text": "UnifiedHistogramHitsContext"
-              },
-              " | undefined"
+              "{ readonly chartsDefaultTheme: ",
+              "RecursivePartial",
+              "<",
+              "Theme",
+              ">; readonly chartsDefaultBaseTheme: ",
+              "Theme",
+              "; chartsTheme$: ",
+              "Observable",
+              "<",
+              "RecursivePartial",
+              "<",
+              "Theme",
+              ">>; chartsBaseTheme$: ",
+              "Observable",
+              "<",
+              "Theme",
+              ">; readonly darkModeEnabled$: ",
+              "Observable",
+              "<boolean>; useDarkMode: () => boolean; useChartsTheme: () => ",
+              "RecursivePartial",
+              "<",
+              "Theme",
+              ">; useChartsBaseTheme: () => ",
+              "Theme",
+              "; }"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.chart",
+            "id": "def-public.UnifiedHistogramServices.uiActions",
             "type": "Object",
             "tags": [],
-            "label": "chart",
-            "description": [
-              "\nContext object for the chart -- leave undefined to hide the chart"
-            ],
+            "label": "uiActions",
+            "description": [],
             "signature": [
+              "{ readonly clear: () => void; readonly addTriggerAction: (triggerId: string, action: ",
               {
-                "pluginId": "unifiedHistogram",
+                "pluginId": "uiActions",
                 "scope": "public",
-                "docId": "kibUnifiedHistogramPluginApi",
-                "section": "def-public.UnifiedHistogramChartContext",
-                "text": "UnifiedHistogramChartContext"
+                "docId": "kibUiActionsPluginApi",
+                "section": "def-public.ActionDefinition",
+                "text": "ActionDefinition"
               },
-              " | undefined"
-            ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.breakdown",
-            "type": "Object",
-            "tags": [],
-            "label": "breakdown",
-            "description": [
-              "\nContext object for the breakdown -- leave undefined to hide the breakdown"
-            ],
-            "signature": [
+              "<any>) => void; readonly attachAction: (triggerId: string, actionId: string) => void; readonly detachAction: (triggerId: string, actionId: string) => void; readonly registerAction: <Context extends object>(definition: ",
               {
-                "pluginId": "unifiedHistogram",
+                "pluginId": "uiActions",
                 "scope": "public",
-                "docId": "kibUnifiedHistogramPluginApi",
-                "section": "def-public.UnifiedHistogramBreakdownContext",
-                "text": "UnifiedHistogramBreakdownContext"
+                "docId": "kibUiActionsPluginApi",
+                "section": "def-public.ActionDefinition",
+                "text": "ActionDefinition"
               },
-              " | undefined"
+              "<Context>) => ",
+              {
+                "pluginId": "uiActions",
+                "scope": "public",
+                "docId": "kibUiActionsPluginApi",
+                "section": "def-public.Action",
+                "text": "Action"
+              },
+              "<Context>; readonly registerTrigger: (trigger: ",
+              {
+                "pluginId": "uiActions",
+                "scope": "public",
+                "docId": "kibUiActionsPluginApi",
+                "section": "def-public.Trigger",
+                "text": "Trigger"
+              },
+              ") => void; readonly unregisterAction: (actionId: string) => void; readonly getTrigger: (triggerId: string) => ",
+              "TriggerContract",
+              "<object>; readonly hasAction: (actionId: string) => boolean; readonly getAction: (id: string) => ",
+              {
+                "pluginId": "uiActions",
+                "scope": "public",
+                "docId": "kibUiActionsPluginApi",
+                "section": "def-public.Action",
+                "text": "Action"
+              },
+              "<object>; readonly getTriggerActions: (triggerId: string) => ",
+              {
+                "pluginId": "uiActions",
+                "scope": "public",
+                "docId": "kibUiActionsPluginApi",
+                "section": "def-public.Action",
+                "text": "Action"
+              },
+              "<object>[]; readonly getTriggerCompatibleActions: (triggerId: string, context: object) => Promise<",
+              {
+                "pluginId": "uiActions",
+                "scope": "public",
+                "docId": "kibUiActionsPluginApi",
+                "section": "def-public.Action",
+                "text": "Action"
+              },
+              "<object>[]>; readonly executeTriggerActions: (triggerId: string, context: object) => Promise<void>; readonly fork: () => ",
+              {
+                "pluginId": "uiActions",
+                "scope": "public",
+                "docId": "kibUiActionsPluginApi",
+                "section": "def-public.UiActionsService",
+                "text": "UiActionsService"
+              },
+              "; }"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.resizeRef",
+            "id": "def-public.UnifiedHistogramServices.uiSettings",
             "type": "Object",
             "tags": [],
-            "label": "resizeRef",
-            "description": [
-              "\nRef to the element wrapping the layout which will be used for resize calculations"
-            ],
+            "label": "uiSettings",
+            "description": [],
             "signature": [
-              "React.RefObject<HTMLDivElement>"
+              {
+                "pluginId": "@kbn/core-ui-settings-browser",
+                "scope": "common",
+                "docId": "kibKbnCoreUiSettingsBrowserPluginApi",
+                "section": "def-common.IUiSettingsClient",
+                "text": "IUiSettingsClient"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.topPanelHeight",
-            "type": "number",
+            "id": "def-public.UnifiedHistogramServices.fieldFormats",
+            "type": "CompoundType",
             "tags": [],
-            "label": "topPanelHeight",
-            "description": [
-              "\nCurrent top panel height -- leave undefined to use the default"
-            ],
+            "label": "fieldFormats",
+            "description": [],
             "signature": [
-              "number | undefined"
+              "Omit<",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FieldFormatsRegistry",
+                "text": "FieldFormatsRegistry"
+              },
+              ", \"init\" | \"register\"> & { deserialize: ",
+              {
+                "pluginId": "fieldFormats",
+                "scope": "common",
+                "docId": "kibFieldFormatsPluginApi",
+                "section": "def-common.FormatFactory",
+                "text": "FormatFactory"
+              },
+              "; }"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.appendHitsCounter",
+            "id": "def-public.UnifiedHistogramServices.lens",
             "type": "Object",
             "tags": [],
-            "label": "appendHitsCounter",
-            "description": [
-              "\nAppend a custom element to the right of the hits count"
-            ],
+            "label": "lens",
+            "description": [],
             "signature": [
-              "React.ReactElement<any, string | React.JSXElementConstructor<any>> | undefined"
+              {
+                "pluginId": "lens",
+                "scope": "public",
+                "docId": "kibLensPluginApi",
+                "section": "def-public.LensPublicStart",
+                "text": "LensPublicStart"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.disableAutoFetching",
-            "type": "CompoundType",
+            "id": "def-public.UnifiedHistogramServices.storage",
+            "type": "Object",
             "tags": [],
-            "label": "disableAutoFetching",
-            "description": [
-              "\nDisable automatic refetching based on props changes, and instead wait for a `refetch` message"
-            ],
+            "label": "storage",
+            "description": [],
             "signature": [
-              "boolean | undefined"
+              {
+                "pluginId": "kibanaUtils",
+                "scope": "public",
+                "docId": "kibKibanaUtilsPluginApi",
+                "section": "def-public.Storage",
+                "text": "Storage"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/types.ts",
             "deprecated": false,
             "trackAdoption": false
-          },
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "unifiedHistogram",
+        "id": "def-public.UnifiedHistogramState",
+        "type": "Interface",
+        "tags": [],
+        "label": "UnifiedHistogramState",
+        "description": [
+          "\nThe current state of the container"
+        ],
+        "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.disableTriggers",
-            "type": "CompoundType",
+            "id": "def-public.UnifiedHistogramState.breakdownField",
+            "type": "string",
             "tags": [],
-            "label": "disableTriggers",
+            "label": "breakdownField",
             "description": [
-              "\nDisable triggers for the Lens embeddable"
+              "\nThe current field used for the breakdown"
             ],
             "signature": [
-              "boolean | undefined"
+              "string | undefined"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.disabledActions",
-            "type": "Array",
+            "id": "def-public.UnifiedHistogramState.chartHidden",
+            "type": "boolean",
             "tags": [],
-            "label": "disabledActions",
+            "label": "chartHidden",
             "description": [
-              "\nDisabled action IDs for the Lens embeddable"
+              "\nWhether or not the chart is hidden"
             ],
-            "signature": [
-              "string[] | undefined"
-            ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.input$",
+            "id": "def-public.UnifiedHistogramState.dataView",
             "type": "Object",
             "tags": [],
-            "label": "input$",
+            "label": "dataView",
             "description": [
-              "\nInput observable"
+              "\nThe current data view"
             ],
             "signature": [
-              "UnifiedHistogramInput",
-              "$ | undefined"
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.DataView",
+                "text": "DataView"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onTopPanelHeightChange",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.filters",
+            "type": "Array",
             "tags": [],
-            "label": "onTopPanelHeightChange",
+            "label": "filters",
             "description": [
-              "\nCallback to update the topPanelHeight prop when a resize is triggered"
+              "\nThe current filters"
             ],
             "signature": [
-              "((topPanelHeight: number | undefined) => void) | undefined"
-            ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
               {
-                "parentPluginId": "unifiedHistogram",
-                "id": "def-public.UnifiedHistogramLayoutProps.onTopPanelHeightChange.$1",
-                "type": "number",
-                "tags": [],
-                "label": "topPanelHeight",
-                "description": [],
-                "signature": [
-                  "number | undefined"
-                ],
-                "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": false
-              }
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.Filter",
+                "text": "Filter"
+              },
+              "[]"
             ],
-            "returnComment": []
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
+            "deprecated": false,
+            "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onEditVisualization",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.lensRequestAdapter",
+            "type": "Object",
             "tags": [],
-            "label": "onEditVisualization",
+            "label": "lensRequestAdapter",
             "description": [
-              "\nCallback to invoke when the user clicks the edit visualization button -- leave undefined to hide the button"
+              "\nThe current Lens request adapter"
             ],
             "signature": [
-              "((lensAttributes: LensAttributes<\"lnsXY\", ",
-              {
-                "pluginId": "lens",
-                "scope": "public",
-                "docId": "kibLensPluginApi",
-                "section": "def-public.XYState",
-                "text": "XYState"
-              },
-              "> | LensAttributes<\"lnsPie\", ",
-              {
-                "pluginId": "lens",
-                "scope": "common",
-                "docId": "kibLensPluginApi",
-                "section": "def-common.PieVisualizationState",
-                "text": "PieVisualizationState"
-              },
-              "> | LensAttributes<\"lnsDatatable\", ",
               {
-                "pluginId": "lens",
-                "scope": "public",
-                "docId": "kibLensPluginApi",
-                "section": "def-public.DatatableVisualizationState",
-                "text": "DatatableVisualizationState"
-              },
-              "> | LensAttributes<\"lnsLegacyMetric\", ",
-              {
-                "pluginId": "lens",
+                "pluginId": "inspector",
                 "scope": "common",
-                "docId": "kibLensPluginApi",
-                "section": "def-common.LegacyMetricState",
-                "text": "LegacyMetricState"
-              },
-              "> | LensAttributes<\"lnsMetric\", ",
-              "MetricVisualizationState",
-              "> | LensAttributes<\"lnsHeatmap\", ",
-              {
-                "pluginId": "lens",
-                "scope": "public",
-                "docId": "kibLensPluginApi",
-                "section": "def-public.HeatmapVisualizationState",
-                "text": "HeatmapVisualizationState"
-              },
-              "> | LensAttributes<\"lnsGauge\", ",
-              {
-                "pluginId": "lens",
-                "scope": "public",
-                "docId": "kibLensPluginApi",
-                "section": "def-public.GaugeVisualizationState",
-                "text": "GaugeVisualizationState"
+                "docId": "kibInspectorPluginApi",
+                "section": "def-common.RequestAdapter",
+                "text": "RequestAdapter"
               },
-              "> | LensAttributes<string, unknown>) => void) | undefined"
+              " | undefined"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "unifiedHistogram",
-                "id": "def-public.UnifiedHistogramLayoutProps.onEditVisualization.$1",
-                "type": "CompoundType",
-                "tags": [],
-                "label": "lensAttributes",
-                "description": [],
-                "signature": [
-                  "LensAttributes<\"lnsXY\", ",
-                  {
-                    "pluginId": "lens",
-                    "scope": "public",
-                    "docId": "kibLensPluginApi",
-                    "section": "def-public.XYState",
-                    "text": "XYState"
-                  },
-                  "> | LensAttributes<\"lnsPie\", ",
-                  {
-                    "pluginId": "lens",
-                    "scope": "common",
-                    "docId": "kibLensPluginApi",
-                    "section": "def-common.PieVisualizationState",
-                    "text": "PieVisualizationState"
-                  },
-                  "> | LensAttributes<\"lnsDatatable\", ",
-                  {
-                    "pluginId": "lens",
-                    "scope": "public",
-                    "docId": "kibLensPluginApi",
-                    "section": "def-public.DatatableVisualizationState",
-                    "text": "DatatableVisualizationState"
-                  },
-                  "> | LensAttributes<\"lnsLegacyMetric\", ",
-                  {
-                    "pluginId": "lens",
-                    "scope": "common",
-                    "docId": "kibLensPluginApi",
-                    "section": "def-common.LegacyMetricState",
-                    "text": "LegacyMetricState"
-                  },
-                  "> | LensAttributes<\"lnsMetric\", ",
-                  "MetricVisualizationState",
-                  "> | LensAttributes<\"lnsHeatmap\", ",
-                  {
-                    "pluginId": "lens",
-                    "scope": "public",
-                    "docId": "kibLensPluginApi",
-                    "section": "def-public.HeatmapVisualizationState",
-                    "text": "HeatmapVisualizationState"
-                  },
-                  "> | LensAttributes<\"lnsGauge\", ",
-                  {
-                    "pluginId": "lens",
-                    "scope": "public",
-                    "docId": "kibLensPluginApi",
-                    "section": "def-public.GaugeVisualizationState",
-                    "text": "GaugeVisualizationState"
-                  },
-                  "> | LensAttributes<string, unknown>"
-                ],
-                "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
+            "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onChartHiddenChange",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.query",
+            "type": "CompoundType",
             "tags": [],
-            "label": "onChartHiddenChange",
+            "label": "query",
             "description": [
-              "\nCallback to hide or show the chart -- should set {@link UnifiedHistogramChartContext.hidden} to chartHidden"
+              "\nThe current query"
             ],
             "signature": [
-              "((chartHidden: boolean) => void) | undefined"
-            ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
               {
-                "parentPluginId": "unifiedHistogram",
-                "id": "def-public.UnifiedHistogramLayoutProps.onChartHiddenChange.$1",
-                "type": "boolean",
-                "tags": [],
-                "label": "chartHidden",
-                "description": [],
-                "signature": [
-                  "boolean"
-                ],
-                "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.Query",
+                "text": "Query"
+              },
+              " | ",
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.AggregateQuery",
+                "text": "AggregateQuery"
               }
             ],
-            "returnComment": []
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
+            "deprecated": false,
+            "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onTimeIntervalChange",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.requestAdapter",
+            "type": "Object",
             "tags": [],
-            "label": "onTimeIntervalChange",
+            "label": "requestAdapter",
             "description": [
-              "\nCallback to update the time interval -- should set {@link UnifiedHistogramChartContext.timeInterval} to timeInterval"
+              "\nThe current request adapter used for non-Lens requests"
             ],
             "signature": [
-              "((timeInterval: string) => void) | undefined"
-            ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
               {
-                "parentPluginId": "unifiedHistogram",
-                "id": "def-public.UnifiedHistogramLayoutProps.onTimeIntervalChange.$1",
-                "type": "string",
-                "tags": [],
-                "label": "timeInterval",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              }
+                "pluginId": "inspector",
+                "scope": "common",
+                "docId": "kibInspectorPluginApi",
+                "section": "def-common.RequestAdapter",
+                "text": "RequestAdapter"
+              },
+              " | undefined"
             ],
-            "returnComment": []
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
+            "deprecated": false,
+            "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onBreakdownFieldChange",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.searchSessionId",
+            "type": "string",
             "tags": [],
-            "label": "onBreakdownFieldChange",
+            "label": "searchSessionId",
             "description": [
-              "\nCallback to update the breakdown field -- should set {@link UnifiedHistogramBreakdownContext.field} to breakdownField"
+              "\nThe current search session ID"
             ],
             "signature": [
-              "((breakdownField: ",
-              {
-                "pluginId": "dataViews",
-                "scope": "common",
-                "docId": "kibDataViewsPluginApi",
-                "section": "def-common.DataViewField",
-                "text": "DataViewField"
-              },
-              " | undefined) => void) | undefined"
+              "string | undefined"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "unifiedHistogram",
-                "id": "def-public.UnifiedHistogramLayoutProps.onBreakdownFieldChange.$1",
-                "type": "Object",
-                "tags": [],
-                "label": "breakdownField",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "dataViews",
-                    "scope": "common",
-                    "docId": "kibDataViewsPluginApi",
-                    "section": "def-common.DataViewField",
-                    "text": "DataViewField"
-                  },
-                  " | undefined"
-                ],
-                "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": false
-              }
-            ],
-            "returnComment": []
+            "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onTotalHitsChange",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.timeInterval",
+            "type": "string",
             "tags": [],
-            "label": "onTotalHitsChange",
+            "label": "timeInterval",
             "description": [
-              "\nCallback to update the total hits -- should set {@link UnifiedHistogramHitsContext.status} to status\nand {@link UnifiedHistogramHitsContext.total} to result"
-            ],
-            "signature": [
-              "((status: ",
-              {
-                "pluginId": "unifiedHistogram",
-                "scope": "public",
-                "docId": "kibUnifiedHistogramPluginApi",
-                "section": "def-public.UnifiedHistogramFetchStatus",
-                "text": "UnifiedHistogramFetchStatus"
-              },
-              ", result?: number | Error | undefined) => void) | undefined"
+              "\nThe current time interval of the chart"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "unifiedHistogram",
-                "id": "def-public.UnifiedHistogramLayoutProps.onTotalHitsChange.$1",
-                "type": "Enum",
-                "tags": [],
-                "label": "status",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "unifiedHistogram",
-                    "scope": "public",
-                    "docId": "kibUnifiedHistogramPluginApi",
-                    "section": "def-public.UnifiedHistogramFetchStatus",
-                    "text": "UnifiedHistogramFetchStatus"
-                  }
-                ],
-                "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "unifiedHistogram",
-                "id": "def-public.UnifiedHistogramLayoutProps.onTotalHitsChange.$2",
-                "type": "CompoundType",
-                "tags": [],
-                "label": "result",
-                "description": [],
-                "signature": [
-                  "number | Error | undefined"
-                ],
-                "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": false
-              }
-            ],
-            "returnComment": []
+            "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onChartLoad",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.timeRange",
+            "type": "Object",
             "tags": [],
-            "label": "onChartLoad",
+            "label": "timeRange",
             "description": [
-              "\nCalled when the histogram loading status changes"
-            ],
-            "signature": [
-              "((event: ",
-              {
-                "pluginId": "unifiedHistogram",
-                "scope": "public",
-                "docId": "kibUnifiedHistogramPluginApi",
-                "section": "def-public.UnifiedHistogramChartLoadEvent",
-                "text": "UnifiedHistogramChartLoadEvent"
-              },
-              ") => void) | undefined"
+              "\nThe current time range"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "unifiedHistogram",
-                "id": "def-public.UnifiedHistogramLayoutProps.onChartLoad.$1",
-                "type": "Object",
-                "tags": [],
-                "label": "event",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "unifiedHistogram",
-                    "scope": "public",
-                    "docId": "kibUnifiedHistogramPluginApi",
-                    "section": "def-public.UnifiedHistogramChartLoadEvent",
-                    "text": "UnifiedHistogramChartLoadEvent"
-                  }
-                ],
-                "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              }
+            "signature": [
+              "{ from: string; to: string; mode?: \"absolute\" | \"relative\" | undefined; }"
             ],
-            "returnComment": []
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
+            "deprecated": false,
+            "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onFilter",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.topPanelHeight",
+            "type": "number",
             "tags": [],
-            "label": "onFilter",
+            "label": "topPanelHeight",
             "description": [
-              "\nCallback to pass to the Lens embeddable to handle filter changes"
+              "\nThe current top panel height"
             ],
             "signature": [
-              "((data: { data: { table: Pick<",
-              {
-                "pluginId": "expressions",
-                "scope": "common",
-                "docId": "kibExpressionsPluginApi",
-                "section": "def-common.Datatable",
-                "text": "Datatable"
-              },
-              ", \"rows\" | \"columns\">; column: number; row: number; value: any; }[]; timeFieldName?: string | undefined; negate?: boolean | undefined; } | { data: { table: Pick<",
-              {
-                "pluginId": "expressions",
-                "scope": "common",
-                "docId": "kibExpressionsPluginApi",
-                "section": "def-common.Datatable",
-                "text": "Datatable"
-              },
-              ", \"rows\" | \"columns\">; column: number; value: any[]; }; timeFieldName?: string | undefined; negate?: boolean | undefined; }) => void) | undefined"
+              "number | undefined"
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramLayoutProps.onBrushEnd",
-            "type": "Function",
+            "id": "def-public.UnifiedHistogramState.totalHitsStatus",
+            "type": "Enum",
             "tags": [],
-            "label": "onBrushEnd",
+            "label": "totalHitsStatus",
             "description": [
-              "\nCallback to pass to the Lens embeddable to handle brush events"
+              "\nThe current fetch status of the hits count request"
             ],
             "signature": [
-              "((data: { table: ",
               {
-                "pluginId": "expressions",
-                "scope": "common",
-                "docId": "kibExpressionsPluginApi",
-                "section": "def-common.Datatable",
-                "text": "Datatable"
-              },
-              "; column: number; range: number[]; timeFieldName?: string | undefined; }) => void) | undefined"
+                "pluginId": "unifiedHistogram",
+                "scope": "public",
+                "docId": "kibUnifiedHistogramPluginApi",
+                "section": "def-public.UnifiedHistogramFetchStatus",
+                "text": "UnifiedHistogramFetchStatus"
+              }
             ],
-            "path": "src/plugins/unified_histogram/public/layout/layout.tsx",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
             "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramRefetchMessage",
-        "type": "Interface",
-        "tags": [],
-        "label": "UnifiedHistogramRefetchMessage",
-        "description": [
-          "\nMessage to refetch the chart and total hits"
-        ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
+          },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramRefetchMessage.type",
-            "type": "string",
+            "id": "def-public.UnifiedHistogramState.totalHitsResult",
+            "type": "CompoundType",
             "tags": [],
-            "label": "type",
-            "description": [],
+            "label": "totalHitsResult",
+            "description": [
+              "\nThe current result of the hits count request"
+            ],
             "signature": [
-              "\"refetch\""
+              "number | Error | undefined"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
             "trackAdoption": false
           }
@@ -1111,53 +1051,84 @@
       },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramRequestContext",
+        "id": "def-public.UnifiedHistogramStateOptions",
         "type": "Interface",
         "tags": [],
-        "label": "UnifiedHistogramRequestContext",
+        "label": "UnifiedHistogramStateOptions",
         "description": [
-          "\nContext object for requests made by unified histogram components"
+          "\nThe options used to initialize the comntainer state"
         ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
+        "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramRequestContext.searchSessionId",
+            "id": "def-public.UnifiedHistogramStateOptions.services",
+            "type": "Object",
+            "tags": [],
+            "label": "services",
+            "description": [
+              "\nThe services required by the Unified Histogram components"
+            ],
+            "signature": [
+              {
+                "pluginId": "unifiedHistogram",
+                "scope": "public",
+                "docId": "kibUnifiedHistogramPluginApi",
+                "section": "def-public.UnifiedHistogramServices",
+                "text": "UnifiedHistogramServices"
+              }
+            ],
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "unifiedHistogram",
+            "id": "def-public.UnifiedHistogramStateOptions.localStorageKeyPrefix",
             "type": "string",
             "tags": [],
-            "label": "searchSessionId",
+            "label": "localStorageKeyPrefix",
             "description": [
-              "\nCurrent search session ID"
+              "\nThe prefix for the keys used in local storage -- leave undefined to avoid using local storage"
             ],
             "signature": [
               "string | undefined"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramRequestContext.adapter",
-            "type": "Object",
+            "id": "def-public.UnifiedHistogramStateOptions.initialState",
+            "type": "CompoundType",
             "tags": [],
-            "label": "adapter",
+            "label": "initialState",
             "description": [
-              "\nThe adapter to use for requests (does not apply to Lens requests)"
+              "\nThe initial state of the container"
             ],
             "signature": [
+              "Partial<",
               {
-                "pluginId": "inspector",
-                "scope": "common",
-                "docId": "kibInspectorPluginApi",
-                "section": "def-common.RequestAdapter",
-                "text": "RequestAdapter"
+                "pluginId": "unifiedHistogram",
+                "scope": "public",
+                "docId": "kibUnifiedHistogramPluginApi",
+                "section": "def-public.UnifiedHistogramState",
+                "text": "UnifiedHistogramState"
               },
-              " | undefined"
+              "> & Pick<",
+              {
+                "pluginId": "unifiedHistogram",
+                "scope": "public",
+                "docId": "kibUnifiedHistogramPluginApi",
+                "section": "def-public.UnifiedHistogramState",
+                "text": "UnifiedHistogramState"
+              },
+              ", \"dataView\">"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/services/state_service.ts",
             "deprecated": false,
             "trackAdoption": false
           }
@@ -1166,144 +1137,80 @@
       },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramServices",
+        "id": "def-public.UnifiedHistogramUninitializedApi",
         "type": "Interface",
         "tags": [],
-        "label": "UnifiedHistogramServices",
+        "label": "UnifiedHistogramUninitializedApi",
         "description": [
-          "\nThe services required by the unified histogram components"
+          "\nThe uninitialized API exposed by the container"
         ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
+        "path": "src/plugins/unified_histogram/public/container/container.tsx",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramServices.data",
-            "type": "Object",
+            "id": "def-public.UnifiedHistogramUninitializedApi.initialized",
+            "type": "boolean",
             "tags": [],
-            "label": "data",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "data",
-                "scope": "public",
-                "docId": "kibDataPluginApi",
-                "section": "def-public.DataPublicPluginStart",
-                "text": "DataPublicPluginStart"
-              }
+            "label": "initialized",
+            "description": [
+              "\nWhether the container has been initialized"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramServices.theme",
-            "type": "Object",
-            "tags": [],
-            "label": "theme",
-            "description": [],
             "signature": [
-              "{ readonly chartsDefaultTheme: ",
-              "RecursivePartial",
-              "<",
-              "Theme",
-              ">; readonly chartsDefaultBaseTheme: ",
-              "Theme",
-              "; chartsTheme$: ",
-              "Observable",
-              "<",
-              "RecursivePartial",
-              "<",
-              "Theme",
-              ">>; chartsBaseTheme$: ",
-              "Observable",
-              "<",
-              "Theme",
-              ">; readonly darkModeEnabled$: ",
-              "Observable",
-              "<boolean>; useDarkMode: () => boolean; useChartsTheme: () => ",
-              "RecursivePartial",
-              "<",
-              "Theme",
-              ">; useChartsBaseTheme: () => ",
-              "Theme",
-              "; }"
+              "false"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/container.tsx",
             "deprecated": false,
             "trackAdoption": false
           },
           {
             "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramServices.uiSettings",
-            "type": "Object",
+            "id": "def-public.UnifiedHistogramUninitializedApi.initialize",
+            "type": "Function",
             "tags": [],
-            "label": "uiSettings",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "@kbn/core-ui-settings-browser",
-                "scope": "common",
-                "docId": "kibKbnCoreUiSettingsBrowserPluginApi",
-                "section": "def-common.IUiSettingsClient",
-                "text": "IUiSettingsClient"
-              }
+            "label": "initialize",
+            "description": [
+              "\nInitialize the container"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramServices.fieldFormats",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "fieldFormats",
-            "description": [],
             "signature": [
-              "Omit<",
-              {
-                "pluginId": "fieldFormats",
-                "scope": "common",
-                "docId": "kibFieldFormatsPluginApi",
-                "section": "def-common.FieldFormatsRegistry",
-                "text": "FieldFormatsRegistry"
-              },
-              ", \"init\" | \"register\"> & { deserialize: ",
+              "(options: ",
               {
-                "pluginId": "fieldFormats",
-                "scope": "common",
-                "docId": "kibFieldFormatsPluginApi",
-                "section": "def-common.FormatFactory",
-                "text": "FormatFactory"
+                "pluginId": "unifiedHistogram",
+                "scope": "public",
+                "docId": "kibUnifiedHistogramPluginApi",
+                "section": "def-public.UnifiedHistogramInitializeOptions",
+                "text": "UnifiedHistogramInitializeOptions"
               },
-              "; }"
+              ") => void"
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
+            "path": "src/plugins/unified_histogram/public/container/container.tsx",
             "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "unifiedHistogram",
-            "id": "def-public.UnifiedHistogramServices.lens",
-            "type": "Object",
-            "tags": [],
-            "label": "lens",
-            "description": [],
-            "signature": [
+            "trackAdoption": false,
+            "children": [
               {
-                "pluginId": "lens",
-                "scope": "public",
-                "docId": "kibLensPluginApi",
-                "section": "def-public.LensPublicStart",
-                "text": "LensPublicStart"
+                "parentPluginId": "unifiedHistogram",
+                "id": "def-public.UnifiedHistogramUninitializedApi.initialize.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "options",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "unifiedHistogram",
+                    "scope": "public",
+                    "docId": "kibUnifiedHistogramPluginApi",
+                    "section": "def-public.UnifiedHistogramInitializeOptions",
+                    "text": "UnifiedHistogramInitializeOptions"
+                  }
+                ],
+                "path": "src/plugins/unified_histogram/public/container/container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
               }
             ],
-            "path": "src/plugins/unified_histogram/public/types.ts",
-            "deprecated": false,
-            "trackAdoption": false
+            "returnComment": []
           }
         ],
         "initialIsOpen": false
@@ -1317,7 +1224,7 @@
         "tags": [],
         "label": "UnifiedHistogramFetchStatus",
         "description": [
-          "\nThe fetch status of a unified histogram request"
+          "\nThe fetch status of a Unified Histogram request"
         ],
         "path": "src/plugins/unified_histogram/public/types.ts",
         "deprecated": false,
@@ -1332,7 +1239,9 @@
         "type": "Type",
         "tags": [],
         "label": "UnifiedHistogramAdapters",
-        "description": [],
+        "description": [
+          "\nThe adapters passed up from Lens"
+        ],
         "signature": [
           "{ requests?: ",
           {
@@ -1367,49 +1276,91 @@
       },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramInput$",
+        "id": "def-public.UnifiedHistogramApi",
         "type": "Type",
         "tags": [],
-        "label": "UnifiedHistogramInput$",
+        "label": "UnifiedHistogramApi",
         "description": [
-          "\nUnified histogram input observable"
+          "\nThe API exposed by the container"
         ],
         "signature": [
-          "Subject",
-          "<",
           {
             "pluginId": "unifiedHistogram",
             "scope": "public",
             "docId": "kibUnifiedHistogramPluginApi",
-            "section": "def-public.UnifiedHistogramRefetchMessage",
-            "text": "UnifiedHistogramRefetchMessage"
+            "section": "def-public.UnifiedHistogramUninitializedApi",
+            "text": "UnifiedHistogramUninitializedApi"
           },
-          ">"
+          " | ",
+          {
+            "pluginId": "unifiedHistogram",
+            "scope": "public",
+            "docId": "kibUnifiedHistogramPluginApi",
+            "section": "def-public.UnifiedHistogramInitializedApi",
+            "text": "UnifiedHistogramInitializedApi"
+          }
         ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
+        "path": "src/plugins/unified_histogram/public/container/container.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "unifiedHistogram",
+        "id": "def-public.UnifiedHistogramContainerProps",
+        "type": "Type",
+        "tags": [],
+        "label": "UnifiedHistogramContainerProps",
+        "description": [
+          "\nThe props exposed by the container"
+        ],
+        "signature": [
+          "{ children?: React.ReactNode; className?: string | undefined; resizeRef: React.RefObject<HTMLDivElement>; appendHitsCounter?: React.ReactElement<any, string | React.JSXElementConstructor<any>> | undefined; }"
+        ],
+        "path": "src/plugins/unified_histogram/public/container/container.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "unifiedHistogram",
+        "id": "def-public.UnifiedHistogramInitializedApi",
+        "type": "Type",
+        "tags": [],
+        "label": "UnifiedHistogramInitializedApi",
+        "description": [
+          "\nThe initialized API exposed by the container"
+        ],
+        "signature": [
+          "{ initialized: true; refetch: () => void; } & Pick<",
+          "UnifiedHistogramStateService",
+          ", \"state$\" | \"setChartHidden\" | \"setTopPanelHeight\" | \"setBreakdownField\" | \"setTimeInterval\" | \"setRequestParams\" | \"setTotalHits\">"
+        ],
+        "path": "src/plugins/unified_histogram/public/container/container.tsx",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "unifiedHistogram",
-        "id": "def-public.UnifiedHistogramInputMessage",
+        "id": "def-public.UnifiedHistogramInitializeOptions",
         "type": "Type",
         "tags": [],
-        "label": "UnifiedHistogramInputMessage",
+        "label": "UnifiedHistogramInitializeOptions",
         "description": [
-          "\nUnified histogram input message"
+          "\nThe options used to initialize the container"
         ],
         "signature": [
           {
             "pluginId": "unifiedHistogram",
             "scope": "public",
             "docId": "kibUnifiedHistogramPluginApi",
-            "section": "def-public.UnifiedHistogramRefetchMessage",
-            "text": "UnifiedHistogramRefetchMessage"
-          }
+            "section": "def-public.UnifiedHistogramStateOptions",
+            "text": "UnifiedHistogramStateOptions"
+          },
+          " & Omit<LayoutProps, \"services\">"
         ],
-        "path": "src/plugins/unified_histogram/public/types.ts",
+        "path": "src/plugins/unified_histogram/public/container/container.tsx",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
diff --git a/api_docs/unified_histogram.mdx b/api_docs/unified_histogram.mdx
index eecbec56ea228..12a822294c9ff 100644
--- a/api_docs/unified_histogram.mdx
+++ b/api_docs/unified_histogram.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedHistogram
 title: "unifiedHistogram"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedHistogram plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedHistogram']
 ---
 import unifiedHistogramObj from './unified_histogram.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-disco
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 63 | 0 | 16 | 1 |
+| 61 | 0 | 23 | 1 |
 
 ## Client
 
diff --git a/api_docs/unified_search.mdx b/api_docs/unified_search.mdx
index 669425698a9dd..70a232a096925 100644
--- a/api_docs/unified_search.mdx
+++ b/api_docs/unified_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch
 title: "unifiedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch']
 ---
 import unifiedSearchObj from './unified_search.devdocs.json';
diff --git a/api_docs/unified_search_autocomplete.mdx b/api_docs/unified_search_autocomplete.mdx
index ebf92c69d8ada..2c15b06184fe4 100644
--- a/api_docs/unified_search_autocomplete.mdx
+++ b/api_docs/unified_search_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch-autocomplete
 title: "unifiedSearch.autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch.autocomplete plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch.autocomplete']
 ---
 import unifiedSearchAutocompleteObj from './unified_search_autocomplete.devdocs.json';
diff --git a/api_docs/url_forwarding.mdx b/api_docs/url_forwarding.mdx
index 04ca3c115c656..0bd32cbf4eb94 100644
--- a/api_docs/url_forwarding.mdx
+++ b/api_docs/url_forwarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/urlForwarding
 title: "urlForwarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the urlForwarding plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'urlForwarding']
 ---
 import urlForwardingObj from './url_forwarding.devdocs.json';
diff --git a/api_docs/usage_collection.mdx b/api_docs/usage_collection.mdx
index 510eb08b21d64..b45bd1c267651 100644
--- a/api_docs/usage_collection.mdx
+++ b/api_docs/usage_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/usageCollection
 title: "usageCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the usageCollection plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'usageCollection']
 ---
 import usageCollectionObj from './usage_collection.devdocs.json';
diff --git a/api_docs/ux.mdx b/api_docs/ux.mdx
index 179032e14f600..f235a323d406e 100644
--- a/api_docs/ux.mdx
+++ b/api_docs/ux.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ux
 title: "ux"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ux plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ux']
 ---
 import uxObj from './ux.devdocs.json';
diff --git a/api_docs/vis_default_editor.mdx b/api_docs/vis_default_editor.mdx
index d7b4887709063..c6cdde0be6849 100644
--- a/api_docs/vis_default_editor.mdx
+++ b/api_docs/vis_default_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visDefaultEditor
 title: "visDefaultEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visDefaultEditor plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visDefaultEditor']
 ---
 import visDefaultEditorObj from './vis_default_editor.devdocs.json';
diff --git a/api_docs/vis_type_gauge.mdx b/api_docs/vis_type_gauge.mdx
index 961d21d69ca6f..718274c1875d5 100644
--- a/api_docs/vis_type_gauge.mdx
+++ b/api_docs/vis_type_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeGauge
 title: "visTypeGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeGauge plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeGauge']
 ---
 import visTypeGaugeObj from './vis_type_gauge.devdocs.json';
diff --git a/api_docs/vis_type_heatmap.mdx b/api_docs/vis_type_heatmap.mdx
index 677e037635458..30b030530c5a6 100644
--- a/api_docs/vis_type_heatmap.mdx
+++ b/api_docs/vis_type_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeHeatmap
 title: "visTypeHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeHeatmap plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeHeatmap']
 ---
 import visTypeHeatmapObj from './vis_type_heatmap.devdocs.json';
diff --git a/api_docs/vis_type_pie.mdx b/api_docs/vis_type_pie.mdx
index 9f1bcb41f5a78..b3f3029be760c 100644
--- a/api_docs/vis_type_pie.mdx
+++ b/api_docs/vis_type_pie.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypePie
 title: "visTypePie"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypePie plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypePie']
 ---
 import visTypePieObj from './vis_type_pie.devdocs.json';
diff --git a/api_docs/vis_type_table.mdx b/api_docs/vis_type_table.mdx
index 4d666bac893e5..4f25f3eb5ab6f 100644
--- a/api_docs/vis_type_table.mdx
+++ b/api_docs/vis_type_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTable
 title: "visTypeTable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTable plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTable']
 ---
 import visTypeTableObj from './vis_type_table.devdocs.json';
diff --git a/api_docs/vis_type_timelion.mdx b/api_docs/vis_type_timelion.mdx
index d73d4e7a73228..64b90ee04bc45 100644
--- a/api_docs/vis_type_timelion.mdx
+++ b/api_docs/vis_type_timelion.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimelion
 title: "visTypeTimelion"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimelion plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimelion']
 ---
 import visTypeTimelionObj from './vis_type_timelion.devdocs.json';
diff --git a/api_docs/vis_type_timeseries.mdx b/api_docs/vis_type_timeseries.mdx
index 3bbbf5c0e3727..73c7dac395f32 100644
--- a/api_docs/vis_type_timeseries.mdx
+++ b/api_docs/vis_type_timeseries.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimeseries
 title: "visTypeTimeseries"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimeseries plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimeseries']
 ---
 import visTypeTimeseriesObj from './vis_type_timeseries.devdocs.json';
diff --git a/api_docs/vis_type_vega.mdx b/api_docs/vis_type_vega.mdx
index 54dc81ca6623b..1b9525efcb8bb 100644
--- a/api_docs/vis_type_vega.mdx
+++ b/api_docs/vis_type_vega.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVega
 title: "visTypeVega"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVega plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVega']
 ---
 import visTypeVegaObj from './vis_type_vega.devdocs.json';
diff --git a/api_docs/vis_type_vislib.mdx b/api_docs/vis_type_vislib.mdx
index 44af403e42b17..7d2ca4b17cdbf 100644
--- a/api_docs/vis_type_vislib.mdx
+++ b/api_docs/vis_type_vislib.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVislib
 title: "visTypeVislib"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVislib plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVislib']
 ---
 import visTypeVislibObj from './vis_type_vislib.devdocs.json';
diff --git a/api_docs/vis_type_xy.mdx b/api_docs/vis_type_xy.mdx
index 3a3e58d4118cf..65880960b2d79 100644
--- a/api_docs/vis_type_xy.mdx
+++ b/api_docs/vis_type_xy.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeXy
 title: "visTypeXy"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeXy plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeXy']
 ---
 import visTypeXyObj from './vis_type_xy.devdocs.json';
diff --git a/api_docs/visualizations.mdx b/api_docs/visualizations.mdx
index 2d09aebd2231a..8245eea38e0de 100644
--- a/api_docs/visualizations.mdx
+++ b/api_docs/visualizations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visualizations
 title: "visualizations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visualizations plugin
-date: 2023-02-07
+date: 2023-02-08
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visualizations']
 ---
 import visualizationsObj from './visualizations.devdocs.json';

From 1841fa7a5dcf17a063f61105786332c87b324a88 Mon Sep 17 00:00:00 2001
From: Shahzad <shahzad31comp@gmail.com>
Date: Wed, 8 Feb 2023 07:41:47 +0100
Subject: [PATCH 106/134] [Synthetics] Fix overview status query (#150285)

---
 .../observability_data_views.ts               |   7 +-
 .../synthetics_overview_status.ts             |  23 ++-
 .../common/runtime_types/ping/ping.ts         |  77 ++++----
 .../overview/overview/metric_item_icon.tsx    |   4 +-
 .../overview/overview/overview_grid_item.tsx  |  12 +-
 .../hooks/use_last_50_duration_chart.ts       |   3 +
 .../synthetics/hooks/use_last_x_checks.ts     |   4 +-
 .../alert_rules/status_rule/message_utils.ts  |   8 +-
 .../legacy_uptime/lib/alerts/status_check.ts  |   3 +-
 .../server/queries/query_monitor_status.ts    | 186 +++++++++---------
 .../plugins/synthetics/server/routes/index.ts |   2 +-
 .../overview_status.test.ts}                  |  10 +-
 .../overview_status.ts}                       |  11 +-
 .../synthetics_monitor/get_all_monitors.ts    |   6 +-
 .../project_monitor_formatter.ts              |   2 +-
 15 files changed, 207 insertions(+), 151 deletions(-)
 rename x-pack/plugins/synthetics/server/routes/{status/current_status.test.ts => overview_status/overview_status.test.ts} (98%)
 rename x-pack/plugins/synthetics/server/routes/{status/current_status.ts => overview_status/overview_status.ts} (96%)

diff --git a/x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts b/x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts
index 1dcd7707ec937..00552c0adc6f1 100644
--- a/x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts
+++ b/x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts
@@ -199,11 +199,14 @@ export class ObservabilityDataViews {
 
   async getDataView(app: AppDataType, indices?: string): Promise<DataView | undefined> {
     let appIndices = indices;
+    let hasData = false;
     if (!appIndices) {
-      appIndices = (await getDataTypeIndices(app)).indices;
+      const { indices: indicesT, hasData: hData } = await getDataTypeIndices(app);
+      hasData = hData;
+      appIndices = indicesT;
     }
 
-    if (appIndices) {
+    if (appIndices && (hasData || indices)) {
       try {
         const dataViewId = getAppDataViewId(app, appIndices);
         const dataViewTitle = getAppIndicesWithPattern(app, appIndices);
diff --git a/x-pack/plugins/synthetics/common/runtime_types/monitor_management/synthetics_overview_status.ts b/x-pack/plugins/synthetics/common/runtime_types/monitor_management/synthetics_overview_status.ts
index 046f030b4d712..027527a118d08 100644
--- a/x-pack/plugins/synthetics/common/runtime_types/monitor_management/synthetics_overview_status.ts
+++ b/x-pack/plugins/synthetics/common/runtime_types/monitor_management/synthetics_overview_status.ts
@@ -6,7 +6,23 @@
  */
 
 import * as t from 'io-ts';
-import { PingType } from '..';
+import { ErrorStateCodec } from '../ping/error_state';
+import { AgentType, MonitorType, ObserverType, PingErrorType, UrlType } from '..';
+
+export const OverviewPingCode = t.interface({
+  '@timestamp': t.string,
+  summary: t.partial({
+    down: t.number,
+    up: t.number,
+  }),
+  monitor: MonitorType,
+  observer: ObserverType,
+  config_id: t.string,
+  error: PingErrorType,
+  agent: AgentType,
+  url: UrlType,
+  state: ErrorStateCodec,
+});
 
 export const OverviewStatusMetaDataCodec = t.interface({
   monitorQueryId: t.string,
@@ -14,7 +30,7 @@ export const OverviewStatusMetaDataCodec = t.interface({
   status: t.string,
   location: t.string,
   timestamp: t.string,
-  ping: PingType,
+  ping: OverviewPingCode,
 });
 
 export const OverviewPendingStatusMetaDataCodec = t.intersection([
@@ -26,7 +42,7 @@ export const OverviewPendingStatusMetaDataCodec = t.intersection([
   }),
   t.partial({
     timestamp: t.string,
-    ping: PingType,
+    ping: OverviewPingCode,
   }),
 ]);
 
@@ -52,6 +68,7 @@ export const OverviewStatusStateCodec = t.intersection([
   }),
 ]);
 
+export type OverviewPing = t.TypeOf<typeof OverviewPingCode>;
 export type OverviewStatus = t.TypeOf<typeof OverviewStatusCodec>;
 export type OverviewStatusState = t.TypeOf<typeof OverviewStatusStateCodec>;
 export type OverviewStatusMetaData = t.TypeOf<typeof OverviewStatusMetaDataCodec>;
diff --git a/x-pack/plugins/synthetics/common/runtime_types/ping/ping.ts b/x-pack/plugins/synthetics/common/runtime_types/ping/ping.ts
index b15c47070911f..971c3116e2bf2 100644
--- a/x-pack/plugins/synthetics/common/runtime_types/ping/ping.ts
+++ b/x-pack/plugins/synthetics/common/runtime_types/ping/ping.ts
@@ -120,6 +120,45 @@ export const PingHeadersType = t.record(t.string, t.union([t.string, t.array(t.s
 
 export type PingHeaders = t.TypeOf<typeof PingHeadersType>;
 
+export const ObserverType = t.partial({
+  hostname: t.string,
+  ip: t.array(t.string),
+  mac: t.array(t.string),
+  geo: t.partial({
+    name: t.string,
+    continent_name: t.string,
+    city_name: t.string,
+    country_iso_code: t.string,
+    location: t.union([
+      t.string,
+      t.partial({ lat: t.number, lon: t.number }),
+      t.partial({ lat: t.string, lon: t.string }),
+    ]),
+  }),
+});
+
+export const AgentType = t.intersection([
+  t.type({
+    ephemeral_id: t.string,
+    id: t.string,
+    type: t.string,
+    version: t.string,
+  }),
+  t.partial({
+    name: t.string,
+    hostname: t.string,
+  }),
+]);
+
+// should this be partial?
+export const UrlType = t.partial({
+  domain: t.string,
+  full: t.string,
+  port: t.number,
+  scheme: t.string,
+  path: t.string,
+});
+
 export const PingType = t.intersection([
   t.type({
     timestamp: t.string,
@@ -127,18 +166,7 @@ export const PingType = t.intersection([
     docId: t.string,
   }),
   t.partial({
-    agent: t.intersection([
-      t.type({
-        ephemeral_id: t.string,
-        id: t.string,
-        type: t.string,
-        version: t.string,
-      }),
-      t.partial({
-        name: t.string,
-        hostname: t.string,
-      }),
-    ]),
+    agent: AgentType,
     container: t.partial({
       id: t.string,
       image: t.partial({
@@ -185,22 +213,7 @@ export const PingType = t.intersection([
         uid: t.string,
       }),
     }),
-    observer: t.partial({
-      hostname: t.string,
-      ip: t.array(t.string),
-      mac: t.array(t.string),
-      geo: t.partial({
-        name: t.string,
-        continent_name: t.string,
-        city_name: t.string,
-        country_iso_code: t.string,
-        location: t.union([
-          t.string,
-          t.partial({ lat: t.number, lon: t.number }),
-          t.partial({ lat: t.string, lon: t.string }),
-        ]),
-      }),
-    }),
+    observer: ObserverType,
     resolve: t.partial({
       ip: t.string,
       rtt: t.partial({
@@ -222,13 +235,7 @@ export const PingType = t.intersection([
     }),
     tls: TlsType,
     // should this be partial?
-    url: t.partial({
-      domain: t.string,
-      full: t.string,
-      port: t.number,
-      scheme: t.string,
-      path: t.string,
-    }),
+    url: UrlType,
     service: t.partial({
       name: t.string,
     }),
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/metric_item_icon.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/metric_item_icon.tsx
index 18d3ab61da901..b2ccd7b8680a1 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/metric_item_icon.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/metric_item_icon.tsx
@@ -23,7 +23,7 @@ import { i18n } from '@kbn/i18n';
 import { euiStyled } from '@kbn/kibana-react-plugin/common';
 import { selectErrorPopoverState, toggleErrorPopoverOpen } from '../../../../state';
 import { useErrorDetailsLink } from '../../../common/links/error_details_link';
-import { MonitorOverviewItem, Ping } from '../../../../../../../common/runtime_types';
+import { MonitorOverviewItem, OverviewPing } from '../../../../../../../common/runtime_types';
 import { manualTestRunSelector } from '../../../../state/manual_test_runs';
 import { useFormatTestRunAt } from '../../../../utils/monitor_test_result/test_time_formats';
 
@@ -46,7 +46,7 @@ export const MetricItemIcon = ({
   status: string;
   configIdByLocation: string;
   timestamp?: string;
-  ping?: Ping;
+  ping?: OverviewPing;
 }) => {
   const testNowRun = useSelector(manualTestRunSelector(monitor.configId));
   const isPopoverOpen = useSelector(selectErrorPopoverState);
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_grid_item.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_grid_item.tsx
index d2c14a746a9e5..de153cf01eca7 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_grid_item.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/overview_grid_item.tsx
@@ -6,7 +6,11 @@
  */
 import React from 'react';
 import { MetricItem } from './metric_item';
-import { useLast50DurationChart } from '../../../../hooks';
+import {
+  useLast50DurationChart,
+  useLocationName,
+  useStatusByLocationOverview,
+} from '../../../../hooks';
 import { MonitorOverviewItem } from '../../../../../../../common/runtime_types';
 
 export interface FlyoutParamProps {
@@ -23,9 +27,15 @@ export const OverviewGridItem = ({
   monitor: MonitorOverviewItem;
   onClick: (params: FlyoutParamProps) => void;
 }) => {
+  const locationName =
+    useLocationName({ locationId: monitor.location?.id })?.label || monitor.location?.id;
+
+  const { timestamp } = useStatusByLocationOverview(monitor.configId, locationName);
+
   const { data, averageDuration } = useLast50DurationChart({
     locationId: monitor.location?.id,
     monitorId: monitor.id,
+    timestamp,
   });
   return (
     <MetricItem data={data} monitor={monitor} averageDuration={averageDuration} onClick={onClick} />
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_last_50_duration_chart.ts b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_last_50_duration_chart.ts
index a543c146ec82b..78e4cc6cecbbf 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_last_50_duration_chart.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_last_50_duration_chart.ts
@@ -13,8 +13,10 @@ const fields = ['monitor.duration.us'];
 export function useLast50DurationChart({
   monitorId,
   locationId,
+  timestamp,
 }: {
   monitorId: string;
+  timestamp?: string;
   locationId: string;
 }) {
   const { hits, loading } = useLastXChecks<{
@@ -24,6 +26,7 @@ export function useLast50DurationChart({
     locationId,
     fields,
     size: 50,
+    timestamp,
   });
   const { data, averageDuration } = useMemo(() => {
     if (loading) {
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_last_x_checks.ts b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_last_x_checks.ts
index c64e78d6961a2..66f9e9dbf572d 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_last_x_checks.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_last_x_checks.ts
@@ -25,9 +25,11 @@ export function useLastXChecks<Fields>({
   locationId,
   fields = ['*'],
   size = 50,
+  timestamp,
 }: {
   monitorId: string;
   locationId: string;
+  timestamp?: string;
   fields?: string[];
   size?: number;
 }) {
@@ -63,7 +65,7 @@ export function useLastXChecks<Fields>({
 
   const { data } = useReduxEsSearch<Ping, typeof params>(params, [lastRefresh], {
     name: `zGetLastXMonitorRunsByLocation/${monitorId}/${locationId}`,
-    isRequestReady: locationsLoaded, // don't run query until locations are loaded
+    isRequestReady: locationsLoaded && Boolean(timestamp), // don't run query until locations are loaded
   });
 
   const dataAsJSON = JSON.stringify(data?.hits?.hits);
diff --git a/x-pack/plugins/synthetics/server/alert_rules/status_rule/message_utils.ts b/x-pack/plugins/synthetics/server/alert_rules/status_rule/message_utils.ts
index 233ea808c96e0..bd10aa2b34754 100644
--- a/x-pack/plugins/synthetics/server/alert_rules/status_rule/message_utils.ts
+++ b/x-pack/plugins/synthetics/server/alert_rules/status_rule/message_utils.ts
@@ -18,7 +18,7 @@ import {
   ERROR_MESSAGE,
   AGENT_NAME,
 } from '../../../common/field_names';
-import { Ping } from '../../../common/runtime_types';
+import { OverviewPing } from '../../../common/runtime_types';
 import { UNNAMED_LOCATION } from '../../../common/constants';
 import { ALERT_REASON_MSG } from '../../legacy_uptime/lib/alerts/action_variables';
 
@@ -37,14 +37,14 @@ export const getMonitorAlertDocument = (monitorSummary: MonitorSummaryStatusRule
 });
 
 export const getMonitorSummary = (
-  monitorInfo: Ping & { '@timestamp'?: string },
+  monitorInfo: OverviewPing,
   statusMessage: string,
   locationId: string,
   configId: string
 ): MonitorSummaryStatusRule => {
   const monitorName = monitorInfo.monitor?.name ?? monitorInfo.monitor?.id;
   const observerLocation = monitorInfo.observer?.geo?.name ?? UNNAMED_LOCATION;
-  const checkedAt = moment(monitorInfo['@timestamp'] ?? monitorInfo.timestamp).format('LLL');
+  const checkedAt = moment(monitorInfo['@timestamp']).format('LLL');
 
   return {
     checkedAt,
@@ -62,7 +62,7 @@ export const getMonitorSummary = (
       name: monitorName,
       location: observerLocation,
       status: statusMessage,
-      timestamp: monitorInfo['@timestamp'] ?? monitorInfo.timestamp,
+      timestamp: monitorInfo['@timestamp'],
     }),
   };
 };
diff --git a/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/status_check.ts b/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/status_check.ts
index 6dd200b11fda2..488a3ef2d284c 100644
--- a/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/status_check.ts
+++ b/x-pack/plugins/synthetics/server/legacy_uptime/lib/alerts/status_check.ts
@@ -20,6 +20,7 @@ import {
   StatusCheckFilters,
   Ping,
   GetMonitorAvailabilityParams,
+  OverviewPing,
 } from '../../../../common/runtime_types';
 import { CLIENT_ALERT_TYPES, MONITOR_STATUS } from '../../../../common/constants/uptime_alerts';
 import {
@@ -233,7 +234,7 @@ export const getStatusMessage = (
   return statusMessage + availabilityMessage;
 };
 
-export const getInstanceId = (monitorInfo: Ping, monIdByLoc: string) => {
+export const getInstanceId = (monitorInfo: Ping | OverviewPing, monIdByLoc: string) => {
   const normalizeText = (txt: string) => {
     // replace url and name special characters with -
     return txt.replace(/[^A-Z0-9]+/gi, '_').toLowerCase();
diff --git a/x-pack/plugins/synthetics/server/queries/query_monitor_status.ts b/x-pack/plugins/synthetics/server/queries/query_monitor_status.ts
index fef2eaa7be319..058d28d046c8a 100644
--- a/x-pack/plugins/synthetics/server/queries/query_monitor_status.ts
+++ b/x-pack/plugins/synthetics/server/queries/query_monitor_status.ts
@@ -4,23 +4,38 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
+import pMap from 'p-map';
+import times from 'lodash/times';
+import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { cloneDeep, intersection } from 'lodash';
-import { SearchRequest } from '@elastic/elasticsearch/lib/api/types';
 import { SUMMARY_FILTER } from '../../common/constants/client_defaults';
-import { UptimeEsClient } from '../legacy_uptime/lib/lib';
+import { createEsParams, UptimeEsClient } from '../legacy_uptime/lib/lib';
 import {
+  OverviewPendingStatusMetaData,
+  OverviewPing,
   OverviewStatus,
   OverviewStatusMetaData,
-  OverviewPendingStatusMetaData,
-  Ping,
 } from '../../common/runtime_types';
 
 const DEFAULT_MAX_ES_BUCKET_SIZE = 10000;
 
+const fields = [
+  '@timestamp',
+  'summary',
+  'monitor',
+  'observer',
+  'config_id',
+  'error',
+  'agent',
+  'url',
+  'state',
+];
+
 export async function queryMonitorStatus(
   esClient: UptimeEsClient,
   listOfLocations: string[],
-  range: { from: string | number; to: string },
+  range: { from: string; to: string },
   monitorQueryIds: string[],
   monitorLocationsMap: Record<string, string[]>,
   monitorQueryIdToConfigIdMap: Record<string, string>
@@ -36,77 +51,68 @@ export async function queryMonitorStatus(
 > {
   const idSize = Math.trunc(DEFAULT_MAX_ES_BUCKET_SIZE / listOfLocations.length || 1);
   const pageCount = Math.ceil(monitorQueryIds.length / idSize);
-  const promises: Array<Promise<any>> = [];
+  let up = 0;
+  let down = 0;
+  let pending = 0;
+  const upConfigs: Record<string, OverviewStatusMetaData> = {};
+  const downConfigs: Record<string, OverviewStatusMetaData> = {};
   const monitorsWithoutData = new Map(Object.entries(cloneDeep(monitorLocationsMap)));
-  for (let i = 0; i < pageCount; i++) {
-    const params: SearchRequest = {
-      size: 0,
-      query: {
-        bool: {
-          filter: [
-            SUMMARY_FILTER,
-            {
-              range: {
-                '@timestamp': {
-                  // @ts-ignore
-                  gte: range.from,
-                  // @ts-expect-error can't mix number and string in client definition
-                  lte: range.to,
-                },
-              },
-            },
-            {
-              terms: {
-                'monitor.id': (monitorQueryIds as string[]).slice(i * idSize, i * idSize + idSize),
-              },
-            },
-            ...(listOfLocations.length > 0
-              ? [
-                  {
-                    terms: {
-                      'observer.geo.name': listOfLocations,
+  const pendingConfigs: Record<string, OverviewPendingStatusMetaData> = {};
+
+  await pMap(
+    times(pageCount),
+    async (i) => {
+      const idsToQuery = (monitorQueryIds as string[]).slice(i * idSize, i * idSize + idSize);
+      const params = createEsParams({
+        body: {
+          size: 0,
+          query: {
+            bool: {
+              filter: [
+                SUMMARY_FILTER,
+                {
+                  range: {
+                    '@timestamp': {
+                      gte: range.from,
+                      lte: range.to,
                     },
                   },
-                ]
-              : []),
-          ],
-        },
-      },
-      aggs: {
-        id: {
-          terms: {
-            field: 'monitor.id',
-            size: idSize,
+                },
+                {
+                  terms: {
+                    'monitor.id': idsToQuery,
+                  },
+                },
+              ] as QueryDslQueryContainer[],
+            },
           },
           aggs: {
-            location: {
+            id: {
               terms: {
-                field: 'observer.geo.name',
-                size: listOfLocations.length || 100,
+                field: 'monitor.id',
+                size: idSize,
               },
               aggs: {
-                status: {
-                  top_hits: {
-                    size: 1,
-                    sort: [
-                      {
-                        '@timestamp': {
-                          order: 'desc',
+                location: {
+                  terms: {
+                    field: 'observer.geo.name',
+                    size: listOfLocations.length || 100,
+                  },
+                  aggs: {
+                    status: {
+                      top_hits: {
+                        size: 1,
+                        sort: [
+                          {
+                            '@timestamp': {
+                              order: 'desc',
+                            },
+                          },
+                        ],
+                        _source: {
+                          includes: fields,
                         },
                       },
-                    ],
-                    _source: {
-                      includes: [
-                        '@timestamp',
-                        'summary',
-                        'monitor',
-                        'observer',
-                        'config_id',
-                        'error',
-                        'agent',
-                        'url',
-                        'state',
-                      ],
                     },
                   },
                 },
@@ -114,27 +120,28 @@ export async function queryMonitorStatus(
             },
           },
         },
-      },
-    };
+      });
 
-    promises.push(esClient.search({ body: params }, 'getCurrentStatusOverview' + i));
-  }
-  let up = 0;
-  let down = 0;
-  let pending = 0;
-  const upConfigs: Record<string, OverviewStatusMetaData> = {};
-  const downConfigs: Record<string, OverviewStatusMetaData> = {};
-  const pendingConfigs: Record<string, OverviewPendingStatusMetaData> = {};
+      if (listOfLocations.length > 0) {
+        params.body.query.bool.filter.push({
+          terms: {
+            'observer.geo.name': listOfLocations,
+          },
+        });
+      }
 
-  for await (const response of promises) {
-    response.body.aggregations?.id.buckets.forEach(
-      ({ location, key: queryId }: { location: any; key: string }) => {
-        const locationSummaries = location.buckets.map(
-          ({ status, key: locationName }: { key: string; status: any }) => {
-            const ping = status.hits.hits[0]._source as Ping & { '@timestamp': string };
-            return { location: locationName, ping };
-          }
-        ) as Array<{ location: string; ping: Ping & { '@timestamp': string } }>;
+      const { body: result } = await esClient.search<OverviewPing, typeof params>(
+        params,
+        'getCurrentStatusOverview' + i
+      );
+
+      pending += idsToQuery.length - (result.aggregations?.id.buckets.length ?? 0);
+
+      result.aggregations?.id.buckets.forEach(({ location, key: queryId }) => {
+        const locationSummaries = location.buckets.map(({ status, key: locationName }) => {
+          const ping = status.hits.hits[0]._source;
+          return { location: locationName, ping };
+        });
 
         // discard any locations that are not in the monitorLocationsMap for the given monitor as well as those which are
         // in monitorLocationsMap but not in listOfLocations
@@ -185,11 +192,12 @@ export async function queryMonitorStatus(
             pending += 1;
           }
         });
-      }
-    );
-  }
+      });
+    },
+    { concurrency: 5 }
+  );
 
-  // identify the remaining monitos without data, to determine pending monitors
+  // identify the remaining monitors without data, to determine pending monitors
   for (const [queryId, locs] of monitorsWithoutData) {
     locs.forEach((loc) => {
       pendingConfigs[`${monitorQueryIdToConfigIdMap[queryId]}-${loc}`] = {
diff --git a/x-pack/plugins/synthetics/server/routes/index.ts b/x-pack/plugins/synthetics/server/routes/index.ts
index 5312074520ac9..69406cd5ff612 100644
--- a/x-pack/plugins/synthetics/server/routes/index.ts
+++ b/x-pack/plugins/synthetics/server/routes/index.ts
@@ -35,7 +35,7 @@ import { addSyntheticsMonitorRoute } from './monitor_cruds/add_monitor';
 import { addSyntheticsProjectMonitorRoute } from './monitor_cruds/add_monitor_project';
 import { addSyntheticsProjectMonitorRouteLegacy } from './monitor_cruds/add_monitor_project_legacy';
 import { syntheticsGetPingsRoute, syntheticsGetPingStatusesRoute } from './pings';
-import { createGetCurrentStatusRoute } from './status/current_status';
+import { createGetCurrentStatusRoute } from './overview_status/overview_status';
 import {
   SyntheticsRestApiRouteFactory,
   SyntheticsStreamingRouteFactory,
diff --git a/x-pack/plugins/synthetics/server/routes/status/current_status.test.ts b/x-pack/plugins/synthetics/server/routes/overview_status/overview_status.test.ts
similarity index 98%
rename from x-pack/plugins/synthetics/server/routes/status/current_status.test.ts
rename to x-pack/plugins/synthetics/server/routes/overview_status/overview_status.test.ts
index 484c556339d74..4679d555f6504 100644
--- a/x-pack/plugins/synthetics/server/routes/status/current_status.test.ts
+++ b/x-pack/plugins/synthetics/server/routes/overview_status/overview_status.test.ts
@@ -6,7 +6,7 @@
  */
 
 import { getUptimeESMockClient } from '../../legacy_uptime/lib/requests/test_helpers';
-import { periodToMs } from './current_status';
+import { periodToMs } from './overview_status';
 import { queryMonitorStatus } from '../../queries/query_monitor_status';
 import times from 'lodash/times';
 
@@ -170,7 +170,7 @@ describe('current status route', () => {
         await queryMonitorStatus(
           uptimeEsClient,
           ['Europe - Germany', 'Asia/Pacific - Japan'],
-          { from: 140000, to: 'now' },
+          { from: 'now-1d', to: 'now' },
           ['id1', 'id2'],
           { id1: ['Asia/Pacific - Japan'], id2: ['Europe - Germany', 'Asia/Pacific - Japan'] },
           {
@@ -335,7 +335,7 @@ describe('current status route', () => {
         await queryMonitorStatus(
           uptimeEsClient,
           [...concernedLocations, ...times(9997).map((n) => 'Europe - Germany' + n)],
-          { from: 2500, to: 'now' },
+          { from: 'now-24h', to: 'now' },
           ['id1', 'id2'],
           { id1: [concernedLocations[0]], id2: [concernedLocations[1], concernedLocations[2]] },
           {
@@ -498,7 +498,7 @@ describe('current status route', () => {
         await queryMonitorStatus(
           uptimeEsClient,
           ['Europe - Germany', 'Asia/Pacific - Japan'],
-          { from: 140000, to: 'now' },
+          { from: 'now-12h', to: 'now' },
           ['id1', 'id2', 'project-monitor-id', 'id4'],
           {
             id1: ['Asia/Pacific - Japan'],
@@ -514,7 +514,7 @@ describe('current status route', () => {
           }
         )
       ).toEqual({
-        pending: 0,
+        pending: 2,
         down: 1,
         enabledMonitorQueryIds: ['id1', 'id2', 'project-monitor-id', 'id4'],
         up: 2,
diff --git a/x-pack/plugins/synthetics/server/routes/status/current_status.ts b/x-pack/plugins/synthetics/server/routes/overview_status/overview_status.ts
similarity index 96%
rename from x-pack/plugins/synthetics/server/routes/status/current_status.ts
rename to x-pack/plugins/synthetics/server/routes/overview_status/overview_status.ts
index a07a250cd65bf..670ebcab2d73c 100644
--- a/x-pack/plugins/synthetics/server/routes/status/current_status.ts
+++ b/x-pack/plugins/synthetics/server/routes/overview_status/overview_status.ts
@@ -4,10 +4,11 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
 import { intersection } from 'lodash';
 import datemath, { Unit } from '@kbn/datemath';
 import { SavedObjectsClientContract } from '@kbn/core/server';
+import moment from 'moment';
+import { ConfigKey } from '../../../common/runtime_types';
 import {
   getAllMonitors,
   processMonitors,
@@ -19,7 +20,6 @@ import { UMServerLibs } from '../../legacy_uptime/uptime_server';
 import { SyntheticsRestApiRouteFactory } from '../../legacy_uptime/routes';
 import { UptimeEsClient } from '../../legacy_uptime/lib/lib';
 import { SyntheticsMonitorClient } from '../../synthetics_service/synthetics_monitor/synthetics_monitor_client';
-import { ConfigKey } from '../../../common/runtime_types';
 import { getMonitorFilters, OverviewStatusSchema, OverviewStatusQuery } from '../common';
 
 /**
@@ -92,10 +92,15 @@ export async function getStatus(
     ? intersection(listOfLocations, queryLocationsArray)
     : listOfLocations;
 
+  const range = {
+    from: moment().subtract(maxPeriod, 'milliseconds').subtract(20, 'minutes').toISOString(),
+    to: 'now',
+  };
+
   const { up, down, pending, upConfigs, downConfigs, pendingConfigs } = await queryMonitorStatus(
     uptimeEsClient,
     listOfLocationAfterFilter,
-    { from: maxPeriod, to: 'now' },
+    range,
     enabledMonitorQueryIds,
     monitorLocationMap,
     monitorQueryIdToConfigIdMap
diff --git a/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.ts b/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.ts
index 12fe8209e1bb7..c8518823af95f 100644
--- a/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.ts
+++ b/x-pack/plugins/synthetics/server/saved_objects/synthetics_monitor/get_all_monitors.ts
@@ -11,7 +11,7 @@ import {
   SavedObjectsFindResult,
 } from '@kbn/core-saved-objects-api-server';
 import pMap from 'p-map';
-import { periodToMs } from '../../routes/status/current_status';
+import { periodToMs } from '../../routes/overview_status/overview_status';
 import { UptimeServerSetup } from '../../legacy_uptime/lib/adapters';
 import { getAllLocations } from '../../synthetics_service/get_all_locations';
 import { syntheticsMonitorType } from '../../legacy_uptime/lib/saved_objects/synthetics_monitor';
@@ -28,8 +28,8 @@ export const getAllMonitors = async ({
   search,
   fields,
   filter,
-  sortField,
-  sortOrder,
+  sortField = 'name.keyword',
+  sortOrder = 'asc',
   searchFields,
 }: {
   soClient: SavedObjectsClientContract;
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/project_monitor_formatter.ts b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/project_monitor_formatter.ts
index a759041b1cb36..796b14307048c 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/project_monitor_formatter.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/project_monitor_formatter.ts
@@ -264,7 +264,7 @@ export class ProjectMonitorFormatter {
   public getProjectMonitorsForProject = async () => {
     const finder = this.savedObjectsClient.createPointInTimeFinder({
       type: syntheticsMonitorType,
-      perPage: 1000,
+      perPage: 5000,
       filter: this.projectFilter,
     });
 

From c3bab3eca94b0aa9645daeb29eee62fb96351bad Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Wed, 8 Feb 2023 09:06:18 +0200
Subject: [PATCH 107/134] [Unified search] Fixes ally issues (#150411)

## Summary

Closes https://github.com/elastic/kibana/issues/150368

Fixes ally issues on Unified search introduced by the new UI.
---
 .../public/filter_bar/filter_editor/phrase_value_input.tsx   | 4 ++++
 .../public/filter_bar/filter_editor/phrases_values_input.tsx | 4 ++++
 .../public/filter_bar/filter_editor/value_input_type.tsx     | 5 +++++
 .../public/filters_builder/filter_item/field_input.tsx       | 1 +
 .../public/filters_builder/filter_item/filter_item.tsx       | 1 +
 .../public/filters_builder/filter_item/operator_input.tsx    | 1 +
 6 files changed, 16 insertions(+)

diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_value_input.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_value_input.tsx
index ff5fbc97477ca..ae87024bb61a9 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_value_input.tsx
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_value_input.tsx
@@ -78,6 +78,10 @@ class PhraseValueInputUI extends PhraseSuggestorUI<PhraseValueInputProps> {
             id: 'unifiedSearch.filter.filterEditor.valueSelectPlaceholder',
             defaultMessage: 'Select a value',
           })}
+          aria-label={intl.formatMessage({
+            id: 'unifiedSearch.filter.filterEditor.valueSelectPlaceholder',
+            defaultMessage: 'Select a value',
+          })}
           options={options}
           getLabel={(option) => option}
           selectedOptions={value ? [valueAsStr] : []}
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx
index c1cb11f816535..336849c4ee65a 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx
@@ -54,6 +54,10 @@ class PhrasesValuesInputUI extends PhraseSuggestorUI<PhrasesValuesInputProps> {
             id: 'unifiedSearch.filter.filterEditor.valuesSelectPlaceholder',
             defaultMessage: 'Select values',
           })}
+          aria-label={intl.formatMessage({
+            id: 'unifiedSearch.filter.filterEditor.valuesSelectPlaceholder',
+            defaultMessage: 'Select values',
+          })}
           delimiter=","
           isCaseSensitive={true}
           options={options}
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx
index fc53c0e4631f7..f12c29897ff50 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx
@@ -50,6 +50,7 @@ class ValueInputTypeUI extends Component<Props> {
             disabled={this.props.disabled}
             fullWidth={this.props.fullWidth}
             placeholder={this.props.placeholder}
+            aria-label={this.props.placeholder}
             value={value}
             onChange={this.onChange}
             isInvalid={!validateParams(value, this.props.field)}
@@ -67,6 +68,7 @@ class ValueInputTypeUI extends Component<Props> {
             disabled={this.props.disabled}
             fullWidth={this.props.fullWidth}
             placeholder={this.props.placeholder}
+            aria-label={this.props.placeholder}
             value={this.getValueForNumberField(value)}
             onChange={this.onChange}
             controlOnly={this.props.controlOnly}
@@ -83,6 +85,7 @@ class ValueInputTypeUI extends Component<Props> {
             disabled={this.props.disabled}
             fullWidth={this.props.fullWidth}
             placeholder={this.props.placeholder}
+            aria-label={this.props.placeholder}
             value={value}
             onChange={this.onChange}
             onBlur={this.onBlur}
@@ -100,6 +103,7 @@ class ValueInputTypeUI extends Component<Props> {
             fullWidth={this.props.fullWidth}
             disabled={this.props.disabled}
             placeholder={this.props.placeholder}
+            aria-label={this.props.placeholder}
             value={value}
             onChange={this.onChange}
             isInvalid={!isEmpty(value) && !validateParams(value, this.props.field)}
@@ -132,6 +136,7 @@ class ValueInputTypeUI extends Component<Props> {
             ]}
             value={value}
             onChange={this.onBoolChange}
+            aria-label={this.props.placeholder}
             className={this.props.className}
             fullWidth={this.props.fullWidth}
             compressed={this.props.compressed}
diff --git a/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx b/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
index cbfe059b09263..7d2f3ac8cfa3d 100644
--- a/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
+++ b/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
@@ -84,6 +84,7 @@ export function FieldInput({ field, dataView, onHandleField }: FieldInputProps)
         placeholder={strings.getFieldSelectPlaceholderLabel()}
         sortMatchesBy="startsWith"
         singleSelection={{ asPlainText: true }}
+        aria-label={strings.getFieldSelectPlaceholderLabel()}
         isClearable={false}
         compressed
         fullWidth
diff --git a/src/plugins/unified_search/public/filters_builder/filter_item/filter_item.tsx b/src/plugins/unified_search/public/filters_builder/filter_item/filter_item.tsx
index b24429860d416..ac8fefa26a99f 100644
--- a/src/plugins/unified_search/public/filters_builder/filter_item/filter_item.tsx
+++ b/src/plugins/unified_search/public/filters_builder/filter_item/filter_item.tsx
@@ -240,6 +240,7 @@ export function FilterItem({
                       })}
                     >
                       <EuiFlexItem
+                        role="button"
                         grow={false}
                         aria-label={strings.getDragFilterAriaLabel()}
                         {...provided.dragHandleProps}
diff --git a/src/plugins/unified_search/public/filters_builder/filter_item/operator_input.tsx b/src/plugins/unified_search/public/filters_builder/filter_item/operator_input.tsx
index f7bcd9a910501..0945fbc1c4d08 100644
--- a/src/plugins/unified_search/public/filters_builder/filter_item/operator_input.tsx
+++ b/src/plugins/unified_search/public/filters_builder/filter_item/operator_input.tsx
@@ -51,6 +51,7 @@ export function OperatorInput<TParams = unknown>({
       compressed
       isDisabled={!field || disabled}
       placeholder={strings.getOperatorSelectPlaceholderSelectLabel()}
+      aria-label={strings.getOperatorSelectPlaceholderSelectLabel()}
       options={operators}
       selectedOptions={operator ? [operator] : []}
       getLabel={({ message }) => message}

From 064829675aeffddb5bcd4b66a3af7d6f3617a30d Mon Sep 17 00:00:00 2001
From: Achyut Jhunjhunwala <achyut.jhunjhunwala@elastic.co>
Date: Wed, 8 Feb 2023 09:33:22 +0100
Subject: [PATCH 108/134] [APM] switch get environment function to use
 terms_enum api (#150175)

Fixes https://github.com/elastic/kibana/issues/144544

## Summary

To get the list of Environments, aggregation was used on search api.
With this change, list of environments will now be retrieved using the
[Terms Enum
API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-terms-enum.html#search-terms-enum)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../public/hooks/use_environments_fetcher.tsx | 29 +++++-
 .../plugins/apm/public/hooks/use_fetcher.tsx  | 31 +++---
 .../routes/environments/get_environments.ts   |  2 +-
 .../apm/server/routes/environments/route.ts   |  7 +-
 .../tests/environment/generate_data.ts        | 67 +++++++++++++
 .../tests/environment/get_environment.spec.ts | 94 +++++++++++++++++++
 6 files changed, 210 insertions(+), 20 deletions(-)
 create mode 100644 x-pack/test/apm_api_integration/tests/environment/generate_data.ts
 create mode 100644 x-pack/test/apm_api_integration/tests/environment/get_environment.spec.ts

diff --git a/x-pack/plugins/apm/public/hooks/use_environments_fetcher.tsx b/x-pack/plugins/apm/public/hooks/use_environments_fetcher.tsx
index 50ad012e1aa02..4dc32754cbfe4 100644
--- a/x-pack/plugins/apm/public/hooks/use_environments_fetcher.tsx
+++ b/x-pack/plugins/apm/public/hooks/use_environments_fetcher.tsx
@@ -5,10 +5,14 @@
  * 2.0.
  */
 
+import { SERVICE_ENVIRONMENT } from '../../common/es_fields/apm';
 import { useFetcher } from './use_fetcher';
+import { Environment } from '../../common/environment_rt';
+import { APIReturnType } from '../services/rest/create_call_apm_api';
 
-const INITIAL_DATA = { environments: [] };
+type EnvironmentsAPIResponse = APIReturnType<'GET /internal/apm/environments'>;
 
+const INITIAL_DATA: EnvironmentsAPIResponse = { environments: [] };
 export function useEnvironmentsFetcher({
   serviceName,
   start,
@@ -20,7 +24,11 @@ export function useEnvironmentsFetcher({
 }) {
   const { data = INITIAL_DATA, status } = useFetcher(
     (callApmApi) => {
-      if (start && end) {
+      if (!start || !end) {
+        return;
+      }
+
+      if (serviceName) {
         return callApmApi('GET /internal/apm/environments', {
           params: {
             query: {
@@ -31,9 +39,24 @@ export function useEnvironmentsFetcher({
           },
         });
       }
+      return callApmApi('GET /internal/apm/suggestions', {
+        params: {
+          query: {
+            start,
+            end,
+            fieldName: SERVICE_ENVIRONMENT,
+            fieldValue: '',
+          },
+        },
+      }).then((response) => {
+        return { environments: response.terms };
+      });
     },
     [start, end, serviceName]
   );
 
-  return { environments: data.environments, status };
+  return {
+    environments: data.environments as Environment[],
+    status,
+  };
 }
diff --git a/x-pack/plugins/apm/public/hooks/use_fetcher.tsx b/x-pack/plugins/apm/public/hooks/use_fetcher.tsx
index 80f2451863b42..28e06341965f6 100644
--- a/x-pack/plugins/apm/public/hooks/use_fetcher.tsx
+++ b/x-pack/plugins/apm/public/hooks/use_fetcher.tsx
@@ -54,13 +54,28 @@ function getDetailsFromErrorResponse(
 }
 
 const createAutoAbortedAPMClient = (
-  signal: AbortSignal
+  signal: AbortSignal,
+  addInspectorRequest: <Data>(result: FetcherResult<Data>) => void
 ): AutoAbortedAPMClient => {
   return ((endpoint, options) => {
     return callApmApi(endpoint, {
       ...options,
       signal,
-    } as any);
+    } as any)
+      .catch((err) => {
+        addInspectorRequest({
+          status: FETCH_STATUS.FAILURE,
+          data: err.body?.attributes,
+        });
+        throw err;
+      })
+      .then((response) => {
+        addInspectorRequest({
+          data: response,
+          status: FETCH_STATUS.SUCCESS,
+        });
+        return response;
+      });
   }) as AutoAbortedAPMClient;
 };
 
@@ -102,7 +117,9 @@ export function useFetcher<TReturn>(
 
       const signal = controller.signal;
 
-      const promise = fn(createAutoAbortedAPMClient(signal));
+      const promise = fn(
+        createAutoAbortedAPMClient(signal, addInspectorRequest)
+      );
       // if `fn` doesn't return a promise it is a signal that data fetching was not initiated.
       // This can happen if the data fetching is conditional (based on certain inputs).
       // In these cases it is not desirable to invoke the global loading spinner, or change the status to success
@@ -179,14 +196,6 @@ export function useFetcher<TReturn>(
     /* eslint-enable react-hooks/exhaustive-deps */
   ]);
 
-  useEffect(() => {
-    if (result.error) {
-      addInspectorRequest({ ...result, data: result.error.body?.attributes });
-    } else {
-      addInspectorRequest(result);
-    }
-  }, [addInspectorRequest, result]);
-
   return useMemo(() => {
     return {
       ...result,
diff --git a/x-pack/plugins/apm/server/routes/environments/get_environments.ts b/x-pack/plugins/apm/server/routes/environments/get_environments.ts
index f04d67fe7d339..056bfa731880b 100644
--- a/x-pack/plugins/apm/server/routes/environments/get_environments.ts
+++ b/x-pack/plugins/apm/server/routes/environments/get_environments.ts
@@ -17,7 +17,7 @@ import { Environment } from '../../../common/environment_rt';
 import { APMEventClient } from '../../lib/helpers/create_es_client/create_apm_event_client';
 
 /**
- * This is used for getting the list of environments for the environments selector,
+ * This is used for getting the list of environments for the environment selector,
  * filtered by range.
  */
 export async function getEnvironments({
diff --git a/x-pack/plugins/apm/server/routes/environments/route.ts b/x-pack/plugins/apm/server/routes/environments/route.ts
index 32b7d2a5117d5..8757d7f99f544 100644
--- a/x-pack/plugins/apm/server/routes/environments/route.ts
+++ b/x-pack/plugins/apm/server/routes/environments/route.ts
@@ -7,6 +7,7 @@
 
 import * as t from 'io-ts';
 import { maxSuggestions } from '@kbn/observability-plugin/common';
+import { Environment } from '../../../common/environment_rt';
 import { getSearchTransactionsEvents } from '../../lib/helpers/transactions';
 import { getEnvironments } from './get_environments';
 import { rangeRt } from '../default_api_types';
@@ -27,11 +28,7 @@ const environmentsRoute = createApmServerRoute({
   handler: async (
     resources
   ): Promise<{
-    environments: Array<
-      | 'ENVIRONMENT_NOT_DEFINED'
-      | 'ENVIRONMENT_ALL'
-      | t.Branded<string, import('@kbn/io-ts-utils').NonEmptyStringBrand>
-    >;
+    environments: Environment[];
   }> => {
     const apmEventClient = await getApmEventClient(resources);
     const { context, params, config } = resources;
diff --git a/x-pack/test/apm_api_integration/tests/environment/generate_data.ts b/x-pack/test/apm_api_integration/tests/environment/generate_data.ts
new file mode 100644
index 0000000000000..6e9ae2831e6be
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/environment/generate_data.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { apm, timerange } from '@kbn/apm-synthtrace-client';
+import type { ApmSynthtraceEsClient } from '@kbn/apm-synthtrace';
+
+// Generate synthetic data for the environment test suite
+export async function generateData({
+  synthtraceEsClient,
+  start,
+  end,
+}: {
+  synthtraceEsClient: ApmSynthtraceEsClient;
+  start: number;
+  end: number;
+}) {
+  const environmentNames = ['production', 'development', 'staging'];
+  const serviceNames = ['go', 'java', 'node'];
+
+  const services = environmentNames.flatMap((environment) => {
+    return serviceNames.flatMap((serviceName) => {
+      return apm
+        .service({
+          name: serviceName,
+          environment,
+          agentName: serviceName,
+        })
+        .instance('instance-a');
+    });
+  });
+
+  const goServiceWithAdditionalEnvironment = apm
+    .service({
+      name: 'go',
+      environment: 'custom-go-environment',
+      agentName: 'go',
+    })
+    .instance('instance-a');
+
+  // Generate a transaction for each service
+  const docs = timerange(start, end)
+    .ratePerMinute(1)
+    .generator((timestamp) => {
+      const loopGeneratedDocs = services.flatMap((service) => {
+        return service
+          .transaction({ transactionName: 'GET /api/product/:id' })
+          .timestamp(timestamp)
+          .duration(1000);
+      });
+
+      const customDoc = goServiceWithAdditionalEnvironment
+        .transaction({
+          transactionName: 'GET /api/go/memory',
+          transactionType: 'custom-go-type',
+        })
+        .timestamp(timestamp)
+        .duration(1000);
+
+      return [...loopGeneratedDocs, customDoc];
+    });
+
+  await synthtraceEsClient.index(docs);
+}
diff --git a/x-pack/test/apm_api_integration/tests/environment/get_environment.spec.ts b/x-pack/test/apm_api_integration/tests/environment/get_environment.spec.ts
new file mode 100644
index 0000000000000..5a3e850c88d0a
--- /dev/null
+++ b/x-pack/test/apm_api_integration/tests/environment/get_environment.spec.ts
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+import { generateData } from './generate_data';
+
+const startNumber = new Date('2021-01-01T00:00:00.000Z').getTime();
+const endNumber = new Date('2021-01-01T00:05:00.000Z').getTime() - 1;
+
+const start = new Date(startNumber).toISOString();
+const end = new Date(endNumber).toISOString();
+
+export default function environmentsAPITests({ getService }: FtrProviderContext) {
+  const registry = getService('registry');
+  const apmApiClient = getService('apmApiClient');
+  const synthtraceEsClient = getService('synthtraceEsClient');
+
+  registry.when('environments when data is loaded', { config: 'basic', archives: [] }, async () => {
+    before(async () => {
+      await generateData({
+        synthtraceEsClient,
+        start: startNumber,
+        end: endNumber,
+      });
+    });
+
+    after(() => synthtraceEsClient.clean());
+
+    describe('get environments', () => {
+      describe('when service name is not specified', () => {
+        it('returns all environments', async () => {
+          const { body } = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/environments',
+            params: {
+              query: { start, end },
+            },
+          });
+          expect(body.environments.length).to.be.equal(4);
+          expectSnapshot(body.environments).toMatchInline(`
+            Array [
+              "development",
+              "production",
+              "staging",
+              "custom-go-environment",
+            ]
+          `);
+        });
+      });
+
+      describe('when service name is specified', () => {
+        it('returns service specific environments for go', async () => {
+          const { body } = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/environments',
+            params: {
+              query: { start, end, serviceName: 'go' },
+            },
+          });
+
+          expect(body.environments.length).to.be.equal(4);
+          expectSnapshot(body.environments).toMatchInline(`
+            Array [
+              "custom-go-environment",
+              "development",
+              "production",
+              "staging",
+            ]
+          `);
+        });
+
+        it('returns service specific environments for java', async () => {
+          const { body } = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/environments',
+            params: {
+              query: { start, end, serviceName: 'java' },
+            },
+          });
+
+          expect(body.environments.length).to.be.equal(3);
+          expectSnapshot(body.environments).toMatchInline(`
+            Array [
+              "development",
+              "production",
+              "staging",
+            ]
+          `);
+        });
+      });
+    });
+  });
+}

From c190a5f9141f96a15a4b30d285d2e121b3eb7651 Mon Sep 17 00:00:00 2001
From: Dzmitry Lemechko <dzmitry.lemechko@elastic.co>
Date: Wed, 8 Feb 2023 09:56:40 +0100
Subject: [PATCH 109/134] [ftr tests] split x-pack functional_with_es_ssl
 config (#150416)

## Summary

Splitting config as it takes over 40 minutes into smaller ones to
speedup CI

```
The following "Functional Tests" configs have durations that exceed the maximum amount of time desired for a single CI job. This is not an error, and if you don't own any of these configs then you can ignore this warning.If you own any of these configs please split them up ASAP and ask Operations if you have questions about how to do that.

x-pack/test/functional_with_es_ssl/config.ts: 40.6 minutes
```

Quick tests execution time
[analysis](https://buildkite.com/elastic/kibana-pull-request/builds/105995#01862b40-f797-4537-9e05-a56453173b6d):

/apps/triggers_actions_ui ~ 13 min
09:01:15 CEST - 09:14:10 CEST

/apps/discover ~ 6 min
09:14:10 CEST - 09:20:21 CEST

/apps/uptime. ~ 2 min
09:20:21 CEST - 09:22:08 CEST

/apps/ml ~1 min
09:22:08 CEST - 09:22:57 CEST

/apps/cases ~ 17 min
09:23:02 CEST - 09:40:19 CEST

Splitting into 3 groups:
x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/config.ts
12m 46s
x-pack/test/functional_with_es_ssl/apps/cases/config.ts 18m 07s
x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/config.ts 10m
38s

Splitting cases/config into 2 groups:
x-pack/test/functional_with_es_ssl/apps/cases/group1/config.ts 10m 18s
x-pack/test/functional_with_es_ssl/apps/cases/group2/config.ts 8m 58s
---
 .buildkite/ftr_configs.yml                    |  6 ++++-
 .github/CODEOWNERS                            |  6 ++---
 .../apps/cases/group1/config.ts               | 20 +++++++++++++++
 .../cases/{ => group1}/create_case_form.ts    |  6 ++---
 .../apps/cases/{ => group1}/deletion.ts       |  6 ++---
 .../apps/cases/group1/index.ts                | 16 ++++++++++++
 .../apps/cases/{ => group1}/view_case.ts      |  6 ++---
 .../{ => group2}/attachment_framework.ts      |  4 +--
 .../apps/cases/group2/config.ts               | 20 +++++++++++++++
 .../apps/cases/{ => group2}/configure.ts      |  2 +-
 .../apps/cases/{ => group2}/index.ts          |  5 +---
 .../apps/cases/{ => group2}/list_view.ts      |  6 ++---
 .../apps/cases/{ => group2}/upgrade.ts        |  4 +--
 .../apps/discover_ml_uptime/config.ts         | 25 +++++++++++++++++++
 .../discover/index.ts                         |  2 +-
 .../discover/search_source_alert.ts           |  2 +-
 .../ml/alert_flyout.ts                        |  2 +-
 .../apps/{ => discover_ml_uptime}/ml/index.ts |  2 +-
 .../uptime/alert_flyout.ts                    |  2 +-
 .../{ => discover_ml_uptime}/uptime/index.ts  |  2 +-
 .../uptime/simple_down_alert.ts               |  4 +--
 .../apps/triggers_actions_ui/config.ts        | 20 +++++++++++++++
 .../{config.ts => config.base.ts}             | 11 ++------
 23 files changed, 137 insertions(+), 42 deletions(-)
 create mode 100644 x-pack/test/functional_with_es_ssl/apps/cases/group1/config.ts
 rename x-pack/test/functional_with_es_ssl/apps/cases/{ => group1}/create_case_form.ts (93%)
 rename x-pack/test/functional_with_es_ssl/apps/cases/{ => group1}/deletion.ts (96%)
 create mode 100644 x-pack/test/functional_with_es_ssl/apps/cases/group1/index.ts
 rename x-pack/test/functional_with_es_ssl/apps/cases/{ => group1}/view_case.ts (98%)
 rename x-pack/test/functional_with_es_ssl/apps/cases/{ => group2}/attachment_framework.ts (98%)
 create mode 100644 x-pack/test/functional_with_es_ssl/apps/cases/group2/config.ts
 rename x-pack/test/functional_with_es_ssl/apps/cases/{ => group2}/configure.ts (96%)
 rename x-pack/test/functional_with_es_ssl/apps/cases/{ => group2}/index.ts (71%)
 rename x-pack/test/functional_with_es_ssl/apps/cases/{ => group2}/list_view.ts (99%)
 rename x-pack/test/functional_with_es_ssl/apps/cases/{ => group2}/upgrade.ts (98%)
 create mode 100644 x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/config.ts
 rename x-pack/test/functional_with_es_ssl/apps/{ => discover_ml_uptime}/discover/index.ts (86%)
 rename x-pack/test/functional_with_es_ssl/apps/{ => discover_ml_uptime}/discover/search_source_alert.ts (99%)
 rename x-pack/test/functional_with_es_ssl/apps/{ => discover_ml_uptime}/ml/alert_flyout.ts (98%)
 rename x-pack/test/functional_with_es_ssl/apps/{ => discover_ml_uptime}/ml/index.ts (94%)
 rename x-pack/test/functional_with_es_ssl/apps/{ => discover_ml_uptime}/uptime/alert_flyout.ts (99%)
 rename x-pack/test/functional_with_es_ssl/apps/{ => discover_ml_uptime}/uptime/index.ts (93%)
 rename x-pack/test/functional_with_es_ssl/apps/{ => discover_ml_uptime}/uptime/simple_down_alert.ts (96%)
 create mode 100644 x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/config.ts
 rename x-pack/test/functional_with_es_ssl/{config.ts => config.base.ts} (93%)

diff --git a/.buildkite/ftr_configs.yml b/.buildkite/ftr_configs.yml
index 5c3f6aef0271e..beb991bd19788 100644
--- a/.buildkite/ftr_configs.yml
+++ b/.buildkite/ftr_configs.yml
@@ -9,6 +9,7 @@ disabled:
   - x-pack/test/functional_enterprise_search/base_config.ts
   - x-pack/test/localization/config.base.ts
   - test/server_integration/config.base.js
+  - x-pack/test/functional_with_es_ssl/config.base.ts
 
   # QA suites that are run out-of-band
   - x-pack/test/stack_functional_integration/configs/config.stack_functional_integration_base.js
@@ -180,7 +181,10 @@ enabled:
   - x-pack/test/functional_embedded/config.ts
   - x-pack/test/functional_enterprise_search/without_host_configured.config.ts
   - x-pack/test/functional_execution_context/config.ts
-  - x-pack/test/functional_with_es_ssl/config.ts
+  - x-pack/test/functional_with_es_ssl/apps/cases/group1/config.ts
+  - x-pack/test/functional_with_es_ssl/apps/cases/group2/config.ts
+  - x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/config.ts
+  - x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/config.ts
   - x-pack/test/functional/apps/advanced_settings/config.ts
   - x-pack/test/functional/apps/aiops/config.ts
   - x-pack/test/functional/apps/api_keys/config.ts
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 547c8f5d33edd..e600849f8095e 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -13,7 +13,7 @@
 /src/plugins/saved_search/ @elastic/kibana-data-discovery
 /x-pack/plugins/discover_enhanced/ @elastic/kibana-data-discovery
 /x-pack/test/functional/apps/discover/ @elastic/kibana-data-discovery
-/x-pack/test/functional_with_es_ssl/apps/discover/ @elastic/kibana-data-discovery
+/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/ @elastic/kibana-data-discovery
 /test/functional/apps/discover/ @elastic/kibana-data-discovery
 /test/functional/apps/context/ @elastic/kibana-data-discovery
 /test/api_integration/apis/unified_field_list/ @elastic/kibana-data-discovery
@@ -184,7 +184,7 @@
 # Uptime
 /x-pack/plugins/synthetics @elastic/uptime
 /x-pack/plugins/ux @elastic/uptime
-/x-pack/test/functional_with_es_ssl/apps/uptime  @elastic/uptime
+/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/ @elastic/uptime
 /x-pack/test/functional/apps/uptime @elastic/uptime
 /x-pack/test/functional/es_archives/uptime @elastic/uptime
 /x-pack/test/functional/services/uptime @elastic/uptime
@@ -244,7 +244,7 @@
 /x-pack/test/functional/es_archives/ml/  @elastic/ml-ui
 /x-pack/test/functional/services/ml/  @elastic/ml-ui
 /x-pack/test/functional_basic/apps/ml/ @elastic/ml-ui
-/x-pack/test/functional_with_es_ssl/apps/ml/ @elastic/ml-ui
+/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/ @elastic/ml-ui
 /x-pack/test/alerting_api_integration/spaces_only/tests/alerting/ml_rule_types/ @elastic/ml-ui
 /x-pack/test/alerting_api_integration/spaces_only/tests/alerting/transform_rule_types/ @elastic/ml-ui
 /x-pack/test/screenshot_creation/apps/ml_docs @elastic/ml-ui
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/group1/config.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group1/config.ts
new file mode 100644
index 0000000000000..ee1fc48c1084f
--- /dev/null
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group1/config.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const baseConfig = await readConfigFile(require.resolve('../../../config.base.ts'));
+
+  return {
+    ...baseConfig.getAll(),
+    testFiles: [require.resolve('.')],
+    junit: {
+      reportName: 'Chrome X-Pack UI Functional Tests with ES SSL - Cases - group 1',
+    },
+  };
+}
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/create_case_form.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group1/create_case_form.ts
similarity index 93%
rename from x-pack/test/functional_with_es_ssl/apps/cases/create_case_form.ts
rename to x-pack/test/functional_with_es_ssl/apps/cases/group1/create_case_form.ts
index 4a744071cb694..40cbbc53c5596 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/create_case_form.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group1/create_case_form.ts
@@ -8,12 +8,12 @@
 import expect from '@kbn/expect';
 import { v4 as uuidv4 } from 'uuid';
 import { CaseSeverity } from '@kbn/cases-plugin/common/api';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 import {
   createUsersAndRoles,
   deleteUsersAndRoles,
-} from '../../../cases_api_integration/common/lib/authentication';
-import { users, roles, casesAllUser, casesAllUser2 } from './common';
+} from '../../../../cases_api_integration/common/lib/authentication';
+import { users, roles, casesAllUser, casesAllUser2 } from '../common';
 
 export default ({ getService, getPageObject }: FtrProviderContext) => {
   describe('Create case', function () {
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/deletion.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group1/deletion.ts
similarity index 96%
rename from x-pack/test/functional_with_es_ssl/apps/cases/deletion.ts
rename to x-pack/test/functional_with_es_ssl/apps/cases/group1/deletion.ts
index 4179c549484fb..f23d0d01867cf 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/deletion.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group1/deletion.ts
@@ -5,12 +5,12 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../ftr_provider_context';
-import { users, roles, casesReadDeleteUser, casesAllUser, casesNoDeleteUser } from './common';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { users, roles, casesReadDeleteUser, casesAllUser, casesNoDeleteUser } from '../common';
 import {
   createUsersAndRoles,
   deleteUsersAndRoles,
-} from '../../../cases_api_integration/common/lib/authentication';
+} from '../../../../cases_api_integration/common/lib/authentication';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const PageObjects = getPageObjects(['security', 'header']);
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/group1/index.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group1/index.ts
new file mode 100644
index 0000000000000..330bd820aea85
--- /dev/null
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group1/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export default ({ loadTestFile }: FtrProviderContext) => {
+  describe('Cases - group 1', function () {
+    loadTestFile(require.resolve('./create_case_form'));
+    loadTestFile(require.resolve('./view_case'));
+    loadTestFile(require.resolve('./deletion'));
+  });
+};
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/view_case.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group1/view_case.ts
similarity index 98%
rename from x-pack/test/functional_with_es_ssl/apps/cases/view_case.ts
rename to x-pack/test/functional_with_es_ssl/apps/cases/group1/view_case.ts
index e808aaa8a4463..ecd99ba459cdd 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/view_case.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group1/view_case.ts
@@ -9,12 +9,12 @@ import expect from '@kbn/expect';
 import { v4 as uuidv4 } from 'uuid';
 import { CaseStatuses } from '@kbn/cases-plugin/common';
 import { CaseSeverity } from '@kbn/cases-plugin/common/api';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 import {
   createUsersAndRoles,
   deleteUsersAndRoles,
-} from '../../../cases_api_integration/common/lib/authentication';
-import { users, roles, casesAllUser, casesAllUser2 } from './common';
+} from '../../../../cases_api_integration/common/lib/authentication';
+import { users, roles, casesAllUser, casesAllUser2 } from '../common';
 
 export default ({ getPageObject, getService }: FtrProviderContext) => {
   const header = getPageObject('header');
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/attachment_framework.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group2/attachment_framework.ts
similarity index 98%
rename from x-pack/test/functional_with_es_ssl/apps/cases/attachment_framework.ts
rename to x-pack/test/functional_with_es_ssl/apps/cases/group2/attachment_framework.ts
index 207434635829f..4e271da9e28d8 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/attachment_framework.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group2/attachment_framework.ts
@@ -17,8 +17,8 @@ import {
   deleteAllCaseItems,
   findCases,
   getCase,
-} from '../../../cases_api_integration/common/lib/utils';
-import { FtrProviderContext } from '../../ftr_provider_context';
+} from '../../../../cases_api_integration/common/lib/utils';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 const createLogStashDataView = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/group2/config.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group2/config.ts
new file mode 100644
index 0000000000000..8824daa639098
--- /dev/null
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group2/config.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const baseConfig = await readConfigFile(require.resolve('../../../config.base.ts'));
+
+  return {
+    ...baseConfig.getAll(),
+    testFiles: [require.resolve('.')],
+    junit: {
+      reportName: 'Chrome X-Pack UI Functional Tests with ES SSL - Cases - group 2',
+    },
+  };
+}
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/configure.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group2/configure.ts
similarity index 96%
rename from x-pack/test/functional_with_es_ssl/apps/cases/configure.ts
rename to x-pack/test/functional_with_es_ssl/apps/cases/group2/configure.ts
index 0c826baa252b1..b812bbaeb019b 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/configure.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group2/configure.ts
@@ -6,7 +6,7 @@
  */
 
 import expect from '@kbn/expect';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ getPageObject, getService }: FtrProviderContext) => {
   const common = getPageObject('common');
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/index.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group2/index.ts
similarity index 71%
rename from x-pack/test/functional_with_es_ssl/apps/cases/index.ts
rename to x-pack/test/functional_with_es_ssl/apps/cases/group2/index.ts
index 59f1dce3e947e..054d21a756fe1 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/index.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group2/index.ts
@@ -5,16 +5,13 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ loadTestFile }: FtrProviderContext) => {
   describe('Cases', function () {
-    loadTestFile(require.resolve('./create_case_form'));
-    loadTestFile(require.resolve('./view_case'));
     loadTestFile(require.resolve('./list_view'));
     loadTestFile(require.resolve('./configure'));
     loadTestFile(require.resolve('./attachment_framework'));
-    loadTestFile(require.resolve('./deletion'));
     loadTestFile(require.resolve('./upgrade'));
   });
 };
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/list_view.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group2/list_view.ts
similarity index 99%
rename from x-pack/test/functional_with_es_ssl/apps/cases/list_view.ts
rename to x-pack/test/functional_with_es_ssl/apps/cases/group2/list_view.ts
index a05c11940db7d..485f99f4db94a 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/list_view.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group2/list_view.ts
@@ -10,12 +10,12 @@ import { CaseStatuses } from '@kbn/cases-plugin/common';
 import { CaseSeverity } from '@kbn/cases-plugin/common/api';
 import { SeverityAll } from '@kbn/cases-plugin/common/ui';
 import { UserProfile } from '@kbn/user-profile-components';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 import {
   createUsersAndRoles,
   deleteUsersAndRoles,
-} from '../../../cases_api_integration/common/lib/authentication';
-import { users, roles, casesAllUser, casesAllUser2 } from './common';
+} from '../../../../cases_api_integration/common/lib/authentication';
+import { users, roles, casesAllUser, casesAllUser2 } from '../common';
 
 export default ({ getPageObject, getService }: FtrProviderContext) => {
   const header = getPageObject('header');
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/upgrade.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group2/upgrade.ts
similarity index 98%
rename from x-pack/test/functional_with_es_ssl/apps/cases/upgrade.ts
rename to x-pack/test/functional_with_es_ssl/apps/cases/group2/upgrade.ts
index 6186d949905e7..120af4b555821 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/upgrade.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group2/upgrade.ts
@@ -9,8 +9,8 @@ import expect from '@kbn/expect';
 import {
   getExternalServiceSimulatorPath,
   ExternalServiceSimulator,
-} from '../../../alerting_api_integration/common/plugins/actions_simulators/server/plugin';
-import { FtrProviderContext } from '../../ftr_provider_context';
+} from '../../../../alerting_api_integration/common/plugins/actions_simulators/server/plugin';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ getPageObject, getService }: FtrProviderContext) => {
   const cases = getService('cases');
diff --git a/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/config.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/config.ts
new file mode 100644
index 0000000000000..1b3e58492e7ae
--- /dev/null
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/config.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+import { resolve } from 'path';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const baseConfig = await readConfigFile(require.resolve('../../config.base.ts'));
+
+  return {
+    ...baseConfig.getAll(),
+    testFiles: [
+      resolve(__dirname, './discover'),
+      resolve(__dirname, './uptime'),
+      resolve(__dirname, './ml'),
+    ],
+    junit: {
+      reportName: 'Chrome X-Pack UI Functional Tests with ES SSL - Discover, Uptime, ML',
+    },
+  };
+}
diff --git a/x-pack/test/functional_with_es_ssl/apps/discover/index.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/index.ts
similarity index 86%
rename from x-pack/test/functional_with_es_ssl/apps/discover/index.ts
rename to x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/index.ts
index f876140dbc92a..47ab9c33ce1cf 100644
--- a/x-pack/test/functional_with_es_ssl/apps/discover/index.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/index.ts
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ loadTestFile, getService }: FtrProviderContext) => {
   describe('Discover alerting', function () {
diff --git a/x-pack/test/functional_with_es_ssl/apps/discover/search_source_alert.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/search_source_alert.ts
similarity index 99%
rename from x-pack/test/functional_with_es_ssl/apps/discover/search_source_alert.ts
rename to x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/search_source_alert.ts
index 853d568f89d96..bc8b39d4cecfd 100644
--- a/x-pack/test/functional_with_es_ssl/apps/discover/search_source_alert.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/search_source_alert.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 import { asyncForEach } from '@kbn/std';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const log = getService('log');
diff --git a/x-pack/test/functional_with_es_ssl/apps/ml/alert_flyout.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/alert_flyout.ts
similarity index 98%
rename from x-pack/test/functional_with_es_ssl/apps/ml/alert_flyout.ts
rename to x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/alert_flyout.ts
index 4676004d9eb89..de7a2e42fda01 100644
--- a/x-pack/test/functional_with_es_ssl/apps/ml/alert_flyout.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/alert_flyout.ts
@@ -7,7 +7,7 @@
 
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { DATAFEED_STATE } from '@kbn/ml-plugin/common/constants/states';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 function createTestJobAndDatafeed() {
   const timestamp = Date.now();
diff --git a/x-pack/test/functional_with_es_ssl/apps/ml/index.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/index.ts
similarity index 94%
rename from x-pack/test/functional_with_es_ssl/apps/ml/index.ts
rename to x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/index.ts
index 942416c73b357..ef104c74b820d 100644
--- a/x-pack/test/functional_with_es_ssl/apps/ml/index.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/ml/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ loadTestFile, getService }: FtrProviderContext) => {
   const ml = getService('ml');
diff --git a/x-pack/test/functional_with_es_ssl/apps/uptime/alert_flyout.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/alert_flyout.ts
similarity index 99%
rename from x-pack/test/functional_with_es_ssl/apps/uptime/alert_flyout.ts
rename to x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/alert_flyout.ts
index 140f85ff068ef..b68ecb3c08d9e 100644
--- a/x-pack/test/functional_with_es_ssl/apps/uptime/alert_flyout.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/alert_flyout.ts
@@ -8,7 +8,7 @@
 import expect from '@kbn/expect';
 import { setTimeout as setTimeoutAsync } from 'timers/promises';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
   describe('uptime alerts', () => {
diff --git a/x-pack/test/functional_with_es_ssl/apps/uptime/index.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/index.ts
similarity index 93%
rename from x-pack/test/functional_with_es_ssl/apps/uptime/index.ts
rename to x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/index.ts
index 2c39ef045972f..80d91ef96a904 100644
--- a/x-pack/test/functional_with_es_ssl/apps/uptime/index.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 const ARCHIVE = 'x-pack/test/functional/es_archives/uptime/full_heartbeat';
 
diff --git a/x-pack/test/functional_with_es_ssl/apps/uptime/simple_down_alert.ts b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/simple_down_alert.ts
similarity index 96%
rename from x-pack/test/functional_with_es_ssl/apps/uptime/simple_down_alert.ts
rename to x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/simple_down_alert.ts
index d9d37bcb76526..a0e041996f4bc 100644
--- a/x-pack/test/functional_with_es_ssl/apps/uptime/simple_down_alert.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/uptime/simple_down_alert.ts
@@ -7,8 +7,8 @@
 
 import expect from '@kbn/expect';
 import { MonitorStatusTranslations } from '@kbn/synthetics-plugin/common/translations';
-import { FtrProviderContext } from '../../ftr_provider_context';
-import { deleteUptimeSettingsObject } from '../../../functional/apps/uptime';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { deleteUptimeSettingsObject } from '../../../../functional/apps/uptime';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
   describe('uptime simple status alert', () => {
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/config.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/config.ts
new file mode 100644
index 0000000000000..14c7161df49f7
--- /dev/null
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/config.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const baseConfig = await readConfigFile(require.resolve('../../config.base.ts'));
+
+  return {
+    ...baseConfig.getAll(),
+    testFiles: [require.resolve('.')],
+    junit: {
+      reportName: 'Chrome X-Pack UI Functional Tests with ES SSL - Triggers Actions UI',
+    },
+  };
+}
diff --git a/x-pack/test/functional_with_es_ssl/config.ts b/x-pack/test/functional_with_es_ssl/config.base.ts
similarity index 93%
rename from x-pack/test/functional_with_es_ssl/config.ts
rename to x-pack/test/functional_with_es_ssl/config.base.ts
index 92d96a7a4ced5..8d8b32fc48463 100644
--- a/x-pack/test/functional_with_es_ssl/config.ts
+++ b/x-pack/test/functional_with_es_ssl/config.base.ts
@@ -6,7 +6,7 @@
  */
 
 import Fs from 'fs';
-import { resolve, join } from 'path';
+import { join } from 'path';
 import { CA_CERT_PATH } from '@kbn/dev-utils';
 import { FtrConfigProviderContext } from '@kbn/test';
 import { pageObjects } from './page_objects';
@@ -51,14 +51,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     ...xpackFunctionalConfig.getAll(),
     servers,
     pageObjects,
-    // list paths to the files that contain your plugins tests
-    testFiles: [
-      resolve(__dirname, './apps/triggers_actions_ui'),
-      resolve(__dirname, './apps/discover'),
-      resolve(__dirname, './apps/uptime'),
-      resolve(__dirname, './apps/ml'),
-      resolve(__dirname, './apps/cases'),
-    ],
+    // Don't list paths to the files that contain your plugins tests here
     apps: {
       ...xpackFunctionalConfig.get('apps'),
       triggersActions: {

From 67d1a4695f141d1b5f4f400a6185d4c4d6d9e537 Mon Sep 17 00:00:00 2001
From: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>
Date: Wed, 8 Feb 2023 10:12:40 +0100
Subject: [PATCH 110/134] [Fleet] refactor install registry and upload to
 extract common logic (#150444)

## Summary

Related to https://github.com/elastic/kibana/issues/148599

Closes https://github.com/elastic/kibana/issues/82007

Factored out common logic in `installPackageFromRegistry` and
`installPackageByUpload` to a new function. This improves the upload
flow as well to handle install failure.

We might want to introduce a `force` flag for the upload API to
reinstall a package, now the logic does not do anything if the installed
version package is uploaded again.
EDIT: found [here](https://github.com/elastic/kibana/issues/82007) that
upload should work with an implicit `force` flag, so will update that.

More manual and automated tests needed.


### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../services/epm/packages/install.test.ts     |  44 ++++
 .../server/services/epm/packages/install.ts   | 226 ++++++++++--------
 2 files changed, 169 insertions(+), 101 deletions(-)

diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
index d8f4f4a70adaa..5466c61313d97 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
@@ -233,6 +233,50 @@ describe('install', () => {
         expect.objectContaining({ installSource: 'upload' })
       );
     });
+
+    it('should fetch latest version if version not provided', async () => {
+      jest.spyOn(licenseService, 'hasAtLeast').mockReturnValue(true);
+      const response = await installPackage({
+        spaceId: DEFAULT_SPACE_ID,
+        installSource: 'registry',
+        pkgkey: 'test_package',
+        savedObjectsClient: savedObjectsClientMock.create(),
+        esClient: {} as ElasticsearchClient,
+      });
+
+      expect(response.status).toEqual('installed');
+
+      expect(sendTelemetryEvents).toHaveBeenCalledWith(
+        expect.anything(),
+        undefined,
+        expect.objectContaining({
+          newVersion: '1.3.0',
+        })
+      );
+    });
+
+    it('should do nothing if same version is installed', async () => {
+      jest.spyOn(obj, 'getInstallationObject').mockImplementationOnce(() =>
+        Promise.resolve({
+          attributes: {
+            version: '1.2.0',
+            install_status: 'installed',
+            installed_es: [],
+            installed_kibana: [],
+          },
+        } as any)
+      );
+      jest.spyOn(licenseService, 'hasAtLeast').mockReturnValue(true);
+      const response = await installPackage({
+        spaceId: DEFAULT_SPACE_ID,
+        installSource: 'registry',
+        pkgkey: 'apache-1.2.0',
+        savedObjectsClient: savedObjectsClientMock.create(),
+        esClient: {} as ElasticsearchClient,
+      });
+
+      expect(response.status).toEqual('already_installed');
+    });
   });
 
   describe('upload', () => {
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install.ts b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
index cf00ec4e3aed1..a3d087d828b01 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
@@ -30,6 +30,7 @@ import { FLEET_INSTALL_FORMAT_VERSION } from '../../../constants/fleet_es_assets
 import { generateESIndexPatterns } from '../elasticsearch/template/template';
 
 import type {
+  ArchivePackage,
   BulkInstallPackageInfo,
   EpmPackageInstallStatus,
   EsAssetReference,
@@ -293,15 +294,11 @@ async function installPackageFromRegistry({
   const logger = appContextService.getLogger();
   // TODO: change epm API to /packageName/version so we don't need to do this
   const { pkgName, pkgVersion: version } = Registry.splitPkgKey(pkgkey);
-  let pkgVersion = version;
-
-  // Workaround apm issue with async spans: https://github.com/elastic/apm-agent-nodejs/issues/2611
-  await Promise.resolve();
-  const span = apm.startSpan(`Install package from registry ${pkgName}@${pkgVersion}`, 'package');
+  let pkgVersion = version ?? '';
 
   // if an error happens during getInstallType, report that we don't know
   let installType: InstallType = 'unknown';
-
+  const installSource = 'registry';
   const telemetryEvent: PackageUpdateEvent = getTelemetryEvent(pkgName, pkgVersion);
 
   try {
@@ -309,11 +306,8 @@ async function installPackageFromRegistry({
     const installedPkg = await getInstallationObject({ savedObjectsClient, pkgName });
     installType = getInstallType({ pkgVersion, installedPkg });
 
-    span?.addLabels({
-      packageName: pkgName,
-      packageVersion: pkgVersion,
-      installType,
-    });
+    telemetryEvent.installType = installType;
+    telemetryEvent.currentVersion = installedPkg?.attributes.version || 'not_installed';
 
     const queryLatest = () =>
       Registry.fetchFindLatestPackageOrThrow(pkgName, {
@@ -340,6 +334,100 @@ async function installPackageFromRegistry({
     const installOutOfDateVersionOk =
       force || ['reinstall', 'reupdate', 'rollback'].includes(installType);
 
+    // if the requested version is out-of-date of the latest package version, check if we allow it
+    // if we don't allow it, return an error
+    if (semverLt(pkgVersion, latestPackage.version)) {
+      if (!installOutOfDateVersionOk) {
+        throw new PackageOutdatedError(
+          `${pkgkey} is out-of-date and cannot be installed or updated`
+        );
+      }
+      logger.debug(
+        `${pkgkey} is out-of-date, installing anyway due to ${
+          force ? 'force flag' : `install type ${installType}`
+        }`
+      );
+    }
+
+    return await installPackageCommon({
+      pkgName,
+      pkgVersion,
+      installSource,
+      installedPkg,
+      installType,
+      savedObjectsClient,
+      esClient,
+      spaceId,
+      force,
+      packageInfo,
+      paths,
+      verificationResult,
+    });
+  } catch (e) {
+    sendEvent({
+      ...telemetryEvent,
+      errorMessage: e.message,
+    });
+    return {
+      error: e,
+      installType,
+      installSource,
+    };
+  }
+}
+
+async function installPackageCommon(options: {
+  pkgName: string;
+  pkgVersion: string;
+  installSource: 'registry' | 'upload';
+  installedPkg?: SavedObject<Installation>;
+  installType: InstallType;
+  savedObjectsClient: SavedObjectsClientContract;
+  esClient: ElasticsearchClient;
+  spaceId: string;
+  force?: boolean;
+  packageInfo: ArchivePackage;
+  paths: string[];
+  verificationResult?: PackageVerificationResult;
+  telemetryEvent?: PackageUpdateEvent;
+}): Promise<InstallResult> {
+  const {
+    pkgName,
+    pkgVersion,
+    installSource,
+    installedPkg,
+    installType,
+    savedObjectsClient,
+    force,
+    esClient,
+    spaceId,
+    packageInfo,
+    paths,
+    verificationResult,
+  } = options;
+  let { telemetryEvent } = options;
+  const logger = appContextService.getLogger();
+
+  // Workaround apm issue with async spans: https://github.com/elastic/apm-agent-nodejs/issues/2611
+  await Promise.resolve();
+  const span = apm.startSpan(
+    `Install package from ${installSource} ${pkgName}@${pkgVersion}`,
+    'package'
+  );
+
+  if (!telemetryEvent) {
+    telemetryEvent = getTelemetryEvent(pkgName, pkgVersion);
+    telemetryEvent.installType = installType;
+    telemetryEvent.currentVersion = installedPkg?.attributes.version || 'not_installed';
+  }
+
+  try {
+    span?.addLabels({
+      packageName: pkgName,
+      packageVersion: pkgVersion,
+      installType,
+    });
+
     // if the requested version is the same as installed version, check if we allow it based on
     // current installed package status and force flag, if we don't allow it,
     // just return the asset references from the existing installation
@@ -348,7 +436,7 @@ async function installPackageFromRegistry({
       installedPkg?.attributes.install_status === 'installed'
     ) {
       if (!force) {
-        logger.debug(`${pkgkey} is already installed, skipping installation`);
+        logger.debug(`${pkgName}-${pkgVersion} is already installed, skipping installation`);
         return {
           assets: [
             ...installedPkg.attributes.installed_es,
@@ -356,36 +444,18 @@ async function installPackageFromRegistry({
           ],
           status: 'already_installed',
           installType,
-          installSource: 'registry',
+          installSource,
         };
       }
     }
 
-    telemetryEvent.installType = installType;
-    telemetryEvent.currentVersion = installedPkg?.attributes.version || 'not_installed';
-
-    // if the requested version is out-of-date of the latest package version, check if we allow it
-    // if we don't allow it, return an error
-    if (semverLt(pkgVersion, latestPackage.version)) {
-      if (!installOutOfDateVersionOk) {
-        throw new PackageOutdatedError(
-          `${pkgkey} is out-of-date and cannot be installed or updated`
-        );
-      }
-      logger.debug(
-        `${pkgkey} is out-of-date, installing anyway due to ${
-          force ? 'force flag' : `install type ${installType}`
-        }`
-      );
-    }
-
     if (!licenseService.hasAtLeast(packageInfo.license || 'basic')) {
       const err = new Error(`Requires ${packageInfo.license} license`);
       sendEvent({
         ...telemetryEvent,
         errorMessage: err.message,
       });
-      return { error: err, installType, installSource: 'registry' };
+      return { error: err, installType, installSource };
     }
 
     const savedObjectsImporter = appContextService
@@ -415,7 +485,7 @@ async function installPackageFromRegistry({
       installType,
       spaceId,
       verificationResult,
-      installSource: 'registry',
+      installSource,
     })
       .then(async (assets) => {
         await removeOldAssets({
@@ -424,10 +494,10 @@ async function installPackageFromRegistry({
           currentVersion: packageInfo.version,
         });
         sendEvent({
-          ...telemetryEvent,
+          ...telemetryEvent!,
           status: 'success',
         });
-        return { assets, status: 'installed', installType, installSource: 'registry' };
+        return { assets, status: 'installed', installType, installSource };
       })
       .catch(async (err: Error) => {
         logger.warn(`Failure to install package [${pkgName}]: [${err.toString()}]`);
@@ -441,10 +511,10 @@ async function installPackageFromRegistry({
           esClient,
         });
         sendEvent({
-          ...telemetryEvent,
+          ...telemetryEvent!,
           errorMessage: err.message,
         });
-        return { error: err, installType, installSource: 'registry' };
+        return { error: err, installType, installSource };
       });
   } catch (e) {
     sendEvent({
@@ -454,7 +524,7 @@ async function installPackageFromRegistry({
     return {
       error: e,
       installType,
-      installSource: 'registry',
+      installSource,
     };
   } finally {
     span?.end();
@@ -469,16 +539,12 @@ async function installPackageByUpload({
   spaceId,
   version,
 }: InstallUploadedArchiveParams): Promise<InstallResult> {
-  // Workaround apm issue with async spans: https://github.com/elastic/apm-agent-nodejs/issues/2611
-  await Promise.resolve();
-  const span = apm.startSpan(`Install package from upload`, 'package');
-
-  const logger = appContextService.getLogger();
   // if an error happens during getInstallType, report that we don't know
   let installType: InstallType = 'unknown';
-  const telemetryEvent: PackageUpdateEvent = getTelemetryEvent('', '');
+  const installSource = 'upload';
   try {
     const { packageInfo } = await generatePackageInfoFromArchiveBuffer(archiveBuffer, contentType);
+    const pkgName = packageInfo.name;
 
     // Allow for overriding the version in the manifest for cases where we install
     // stack-aligned bundled packages to support special cases around the
@@ -487,23 +553,11 @@ async function installPackageByUpload({
 
     const installedPkg = await getInstallationObject({
       savedObjectsClient,
-      pkgName: packageInfo.name,
+      pkgName,
     });
 
     installType = getInstallType({ pkgVersion, installedPkg });
 
-    span?.addLabels({
-      packageName: packageInfo.name,
-      packageVersion: pkgVersion,
-      installType,
-    });
-
-    telemetryEvent.packageName = packageInfo.name;
-    telemetryEvent.newVersion = pkgVersion;
-    telemetryEvent.installType = installType;
-    telemetryEvent.currentVersion = installedPkg?.attributes.version || 'not_installed';
-
-    const installSource = 'upload';
     // as we do not verify uploaded packages, we must invalidate the verification cache
     deleteVerificationResult(packageInfo);
     const paths = await unpackBufferToCache({
@@ -519,55 +573,25 @@ async function installPackageByUpload({
       packageInfo,
     });
 
-    const savedObjectsImporter = appContextService
-      .getSavedObjects()
-      .createImporter(savedObjectsClient);
-
-    const savedObjectTagAssignmentService = appContextService
-      .getSavedObjectsTagging()
-      .createInternalAssignmentService({ client: savedObjectsClient });
-
-    const savedObjectTagClient = appContextService
-      .getSavedObjectsTagging()
-      .createTagClient({ client: savedObjectsClient });
-
-    // @ts-expect-error status is string instead of InstallResult.status 'installed' | 'already_installed'
-    return await _installPackage({
+    return await installPackageCommon({
+      pkgName,
+      pkgVersion,
+      installSource,
+      installedPkg,
+      installType,
       savedObjectsClient,
-      savedObjectsImporter,
-      savedObjectTagAssignmentService,
-      savedObjectTagClient,
       esClient,
-      logger,
-      installedPkg,
+      spaceId,
+      force: true, // upload has implicit force
+      packageInfo,
       paths,
-      packageInfo: { ...packageInfo, version: pkgVersion },
+    });
+  } catch (e) {
+    return {
+      error: e,
       installType,
       installSource,
-      spaceId,
-    })
-      .then((assets) => {
-        sendEvent({
-          ...telemetryEvent,
-          status: 'success',
-        });
-        return { assets, status: 'installed', installType };
-      })
-      .catch(async (err: Error) => {
-        sendEvent({
-          ...telemetryEvent,
-          errorMessage: err.message,
-        });
-        return { error: err, installType };
-      });
-  } catch (e) {
-    sendEvent({
-      ...telemetryEvent,
-      errorMessage: e.message,
-    });
-    return { error: e, installType, installSource: 'upload' };
-  } finally {
-    span?.end();
+    };
   }
 }
 

From a2df4d6f85675b623900ad728d75b03be2eb20b4 Mon Sep 17 00:00:00 2001
From: Yngrid Coello <yngrid.coello@elastic.co>
Date: Wed, 8 Feb 2023 10:42:01 +0100
Subject: [PATCH 111/134] Making maxTransactionGroupsExceeded false by default
 (#150458)

Relates to https://github.com/elastic/kibana/issues/146648.

`maxTransactionGroupsExceeded` is currently `true` by default which is
causing a flickering in transactions page specifically for the table,
where we can see the callout for some milliseconds and then, after
getting results from endpoint, disappears.

### before this change


https://user-images.githubusercontent.com/1313018/217316916-e6434f4a-c4e6-4e12-ba2b-5f5ab0011984.mov
---
 .../apm/public/components/shared/transactions_table/index.tsx   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/apm/public/components/shared/transactions_table/index.tsx b/x-pack/plugins/apm/public/components/shared/transactions_table/index.tsx
index 4d80fff82c4fe..3990c0de33a47 100644
--- a/x-pack/plugins/apm/public/components/shared/transactions_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/transactions_table/index.tsx
@@ -49,7 +49,7 @@ const INITIAL_STATE: InitialState = {
   requestId: '',
   mainStatisticsData: {
     transactionGroups: [],
-    maxTransactionGroupsExceeded: true,
+    maxTransactionGroupsExceeded: false,
     transactionOverflowCount: 0,
     transactionGroupsTotalItems: 0,
   },

From 752f87b7de54684daa39414988e61af6af71317d Mon Sep 17 00:00:00 2001
From: Rickyanto Ang <rickyangwyn@gmail.com>
Date: Wed, 8 Feb 2023 02:28:13 -0800
Subject: [PATCH 112/134] [Cloud Posture][Bug]added fix for resource tab +
 small css fix on CSPM onboarding (#149997)

## Summary

- Added Fix for Resource tab has empty component
- Added small CSS fix for button on CSPM not centered

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../public/components/cloud_posture_page.tsx              | 8 +-------
 .../pages/findings/findings_flyout/resource_tab.tsx       | 2 +-
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/cloud_security_posture/public/components/cloud_posture_page.tsx b/x-pack/plugins/cloud_security_posture/public/components/cloud_posture_page.tsx
index 905d5ae8c2942..de9728d5d52b5 100644
--- a/x-pack/plugins/cloud_security_posture/public/components/cloud_posture_page.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/components/cloud_posture_page.tsx
@@ -14,7 +14,6 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiLink,
-  useEuiTheme,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { NoDataPage, NoDataPageProps } from '@kbn/kibana-react-plugin/public';
@@ -75,19 +74,14 @@ export const CspNoDataPage = ({
   actionDescription,
   testId,
 }: CspNoDataPageProps) => {
-  const { euiTheme } = useEuiTheme();
   return (
     <NoDataPage
       data-test-subj={testId}
       css={css`
-        div:nth-child(3) {
+        > :nth-child(3) {
           display: block;
           margin: auto;
           width: 450px;
-          button {
-            margin: 0 auto;
-            margin-top: ${euiTheme.size.base};
-          }
         }
       `}
       pageTitle={pageTitle}
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_flyout/resource_tab.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_flyout/resource_tab.tsx
index 771caa5a070d8..86ea3f67acd79 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_flyout/resource_tab.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_flyout/resource_tab.tsx
@@ -92,7 +92,7 @@ export const ResourceTab = ({ data }: { data: CspFinding }) => {
                 listItems={accordion.listItems}
                 type="column"
                 style={{
-                  marginTop: euiTheme.size.l,
+                  paddingTop: euiTheme.size.l,
                 }}
                 titleProps={{ style: { width: '35%' } }}
                 descriptionProps={{ style: { width: '65%' } }}

From ebc675095fdfe58dabab8bf41cfc645868626b59 Mon Sep 17 00:00:00 2001
From: Boris Kirov <boris.kirov@elastic.co>
Date: Wed, 8 Feb 2023 11:42:43 +0100
Subject: [PATCH 113/134] [APM] Removing the icon for tech preview and fixing
 some of the alert badges (#150528)

After a discussion with @maciejforcone and @grabowskit it was
recommended to remove the tech preview badge for the Alerts tab. We also
made small change in the alert badge in different areas in APM to make
easier to understand and align them with the actionable o11y team.

Before / After

![image](https://user-images.githubusercontent.com/13353203/217280187-939fbc76-d036-4fea-b1e8-50983738f73b.png)


![image](https://user-images.githubusercontent.com/13353203/217280566-ae5a2d00-c939-496d-9642-ba20735fc91b.png)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../service_group_card.tsx                    | 47 ++++++++++++-------
 .../service_inventory/service_list/index.tsx  | 38 ++++++++++-----
 .../templates/apm_service_template/index.tsx  | 20 +++++---
 3 files changed, 68 insertions(+), 37 deletions(-)

diff --git a/x-pack/plugins/apm/public/components/app/service_groups/service_groups_list/service_group_card.tsx b/x-pack/plugins/apm/public/components/app/service_groups/service_groups_list/service_group_card.tsx
index 26a642b39a911..1ac56f1867841 100644
--- a/x-pack/plugins/apm/public/components/app/service_groups/service_groups_list/service_group_card.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_groups/service_groups_list/service_group_card.tsx
@@ -4,6 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { EuiToolTip } from '@elastic/eui';
 import {
   EuiAvatar,
   EuiBadge,
@@ -62,10 +63,10 @@ export function ServiceGroupsCard({
               )}
           </EuiText>
         </EuiFlexItem>
-        <EuiFlexGroup>
+        <EuiFlexGroup alignItems="center">
           <ServiceStat loading={isLoading}>
             <EuiFlexItem>
-              <EuiText size="s" textAlign="left">
+              <EuiText size="xs" textAlign="left">
                 {serviceGroupCounts !== undefined &&
                   i18n.translate(
                     'xpack.apm.serviceGroups.cardsList.serviceCount',
@@ -80,25 +81,35 @@ export function ServiceGroupsCard({
           </ServiceStat>
           <ServiceStat loading={isLoading} grow={isLoading}>
             {serviceGroupCounts && serviceGroupCounts.alerts > 0 && (
-              <EuiBadge
-                iconType="alert"
-                color="danger"
-                href={activeAlertsHref}
-                {...({
-                  onClick(e: React.SyntheticEvent) {
-                    e.stopPropagation(); // prevents extra click thru to EuiCard's href destination
-                  },
-                } as object)} // workaround for type check that prevents href + onclick
-              >
-                {i18n.translate(
-                  'xpack.apm.serviceGroups.cardsList.alertCount',
+              <EuiToolTip
+                position="bottom"
+                content={i18n.translate(
+                  'xpack.apm.home.serviceGroups.tooltip.activeAlertsExplanation',
                   {
-                    defaultMessage:
-                      '{alertsCount} {alertsCount, plural, one {alert} other {alerts}}',
-                    values: { alertsCount: serviceGroupCounts.alerts },
+                    defaultMessage: 'Active alerts',
                   }
                 )}
-              </EuiBadge>
+              >
+                <EuiBadge
+                  iconType="alert"
+                  color="danger"
+                  href={activeAlertsHref}
+                  {...({
+                    onClick(e: React.SyntheticEvent) {
+                      e.stopPropagation(); // prevents extra click thru to EuiCard's href destination
+                    },
+                  } as object)} // workaround for type check that prevents href + onclick
+                >
+                  {i18n.translate(
+                    'xpack.apm.serviceGroups.cardsList.alertCount',
+                    {
+                      defaultMessage:
+                        '{alertsCount} {alertsCount, plural, one {alert} other {alerts}}',
+                      values: { alertsCount: serviceGroupCounts.alerts },
+                    }
+                  )}
+                </EuiBadge>
+              </EuiToolTip>
             )}
           </ServiceStat>
         </EuiFlexGroup>
diff --git a/x-pack/plugins/apm/public/components/app/service_inventory/service_list/index.tsx b/x-pack/plugins/apm/public/components/app/service_inventory/service_list/index.tsx
index 1938b2dfe0bda..0f7d64477b2f4 100644
--- a/x-pack/plugins/apm/public/components/app/service_inventory/service_list/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_inventory/service_list/index.tsx
@@ -82,8 +82,10 @@ export function getServiceColumns({
       ? [
           {
             field: ServiceInventoryFieldName.AlertsCount,
-            name: '',
-            width: `${unit * 5}px`,
+            name: i18n.translate('xpack.apm.servicesTable.alertsColumnLabel', {
+              defaultMessage: 'Active alerts',
+            }),
+            width: `${unit * 8}px`,
             sortable: true,
             render: (_, { serviceName, alertsCount }) => {
               if (!alertsCount) {
@@ -91,16 +93,26 @@ export function getServiceColumns({
               }
 
               return (
-                <EuiBadge
-                  iconType="alert"
-                  color="danger"
-                  href={link('/services/{serviceName}/alerts', {
-                    path: { serviceName },
-                    query,
-                  })}
+                <EuiToolTip
+                  position="bottom"
+                  content={i18n.translate(
+                    'xpack.apm.home.servicesTable.tooltip.activeAlertsExplanation',
+                    {
+                      defaultMessage: 'Active alerts',
+                    }
+                  )}
                 >
-                  {alertsCount}
-                </EuiBadge>
+                  <EuiBadge
+                    iconType="alert"
+                    color="danger"
+                    href={link('/services/{serviceName}/alerts', {
+                      path: { serviceName },
+                      query,
+                    })}
+                  >
+                    {alertsCount}
+                  </EuiBadge>
+                </EuiToolTip>
               );
             },
           } as ITableColumn<ServiceListItem>,
@@ -150,7 +162,7 @@ export function getServiceColumns({
                 defaultMessage: 'Environment',
               }
             ),
-            width: `${unit * 10}px`,
+            width: `${unit * 9}px`,
             sortable: true,
             render: (_, { environments }) => (
               <EnvironmentBadge environments={environments ?? []} />
@@ -166,7 +178,7 @@ export function getServiceColumns({
               'xpack.apm.servicesTable.transactionColumnLabel',
               { defaultMessage: 'Transaction type' }
             ),
-            width: `${unit * 10}px`,
+            width: `${unit * 8}px`,
             sortable: true,
           },
         ]
diff --git a/x-pack/plugins/apm/public/components/routing/templates/apm_service_template/index.tsx b/x-pack/plugins/apm/public/components/routing/templates/apm_service_template/index.tsx
index 6f5fd0f364d5b..02929c63e2e59 100644
--- a/x-pack/plugins/apm/public/components/routing/templates/apm_service_template/index.tsx
+++ b/x-pack/plugins/apm/public/components/routing/templates/apm_service_template/index.tsx
@@ -12,9 +12,10 @@ import {
   EuiPageHeaderProps,
   EuiSpacer,
   EuiTitle,
+  EuiToolTip,
+  EuiBadge,
 } from '@elastic/eui';
 import { useLocation } from 'react-router-dom';
-import { EuiBadge } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { enableAwsLambdaMetrics } from '@kbn/observability-plugin/common';
 import { omit } from 'lodash';
@@ -357,13 +358,20 @@ function useTabs({ selectedTab }: { selectedTab: Tab['key'] }) {
         path: { serviceName },
         query,
       }),
-      prepend:
+      append:
         serviceAlertsCount.alertsCount > 0 ? (
-          <EuiBadge iconType="alert" color="danger">
-            {serviceAlertsCount.alertsCount}
-          </EuiBadge>
+          <EuiToolTip
+            position="bottom"
+            content={i18n.translate(
+              'xpack.apm.home.serviceAlertsTable.tooltip.activeAlertsExplanation',
+              {
+                defaultMessage: 'Active alerts',
+              }
+            )}
+          >
+            <EuiBadge color="danger">{serviceAlertsCount.alertsCount}</EuiBadge>
+          </EuiToolTip>
         ) : null,
-      append: <TechnicalPreviewBadge icon="beaker" />,
       label: i18n.translate('xpack.apm.home.alertsTabLabel', {
         defaultMessage: 'Alerts',
       }),

From 9b82b6c65593152fbb011a32930c94f6a74a550d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yulia=20=C4=8Cech?=
 <6585477+yuliacech@users.noreply.github.com>
Date: Wed, 8 Feb 2023 12:48:50 +0100
Subject: [PATCH 114/134] [Guided onboarding] Fix requests not firing (#150427)

## Summary
I introduced a bug in https://github.com/elastic/kibana/pull/149528 that
prevents some requests from being sent if other guided onboarding
requests are in flight. That should not be the case, because it's
intended that some requests will be sent at the same time. For example,
the guide panel needs to load the plugin state and a config of the
guide. At the same time, if the user is on the landing page, its needs
to load the state of all guides.

### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../public/services/api.service.ts            | 18 +-----
 .../public/services/api.test.ts               | 56 +++++++++++++------
 2 files changed, 40 insertions(+), 34 deletions(-)

diff --git a/src/plugins/guided_onboarding/public/services/api.service.ts b/src/plugins/guided_onboarding/public/services/api.service.ts
index 398d1cf56a6a3..949002b19ea6a 100644
--- a/src/plugins/guided_onboarding/public/services/api.service.ts
+++ b/src/plugins/guided_onboarding/public/services/api.service.ts
@@ -123,18 +123,10 @@ export class ApiService implements GuidedOnboardingApi {
     if (!this.client) {
       throw new Error('ApiService has not be initialized.');
     }
-    // don't send a request if a request is already in flight
-    if (this.isLoading$.value) {
-      return undefined;
-    }
 
     try {
-      this.isLoading$.next(true);
-      const response = await this.client.get<{ state: GuideState[] }>(`${API_BASE_PATH}/guides`);
-      this.isLoading$.next(false);
-      return response;
+      return await this.client.get<{ state: GuideState[] }>(`${API_BASE_PATH}/guides`);
     } catch (error) {
-      this.isLoading$.next(false);
       throw error;
     }
   }
@@ -156,10 +148,6 @@ export class ApiService implements GuidedOnboardingApi {
     if (!this.client) {
       throw new Error('ApiService has not be initialized.');
     }
-    // don't send a request if a request is already in flight
-    if (this.isLoading$.value) {
-      return undefined;
-    }
 
     try {
       this.isLoading$.next(true);
@@ -482,10 +470,6 @@ export class ApiService implements GuidedOnboardingApi {
     if (!this.client) {
       throw new Error('ApiService has not be initialized.');
     }
-    // don't send a request if a request is already in flight
-    if (this.isLoading$.value) {
-      return undefined;
-    }
     this.isLoading$.next(true);
     const config = await this.configService.getGuideConfig(guideId);
     this.isLoading$.next(false);
diff --git a/src/plugins/guided_onboarding/public/services/api.test.ts b/src/plugins/guided_onboarding/public/services/api.test.ts
index 1b5a7b02d0bb3..41c6a93faf27e 100644
--- a/src/plugins/guided_onboarding/public/services/api.test.ts
+++ b/src/plugins/guided_onboarding/public/services/api.test.ts
@@ -114,6 +114,17 @@ describe('GuidedOnboarding ApiService', () => {
       expect(httpClient.get).toHaveBeenCalledTimes(1);
       expect(httpClient.get).toHaveBeenCalledWith(`${API_BASE_PATH}/guides`);
     });
+
+    it('a request to all guides state API is sent even when a fetch plugin state request is in flight at the same time', async () => {
+      httpClient.get.mockImplementationOnce(() => {
+        return new Promise((resolve) => setTimeout(resolve));
+      });
+      await apiService.fetchPluginState$().subscribe();
+      expect(apiService.isLoading$.value).toBe(true);
+      await apiService.fetchAllGuidesState();
+      expect(httpClient.get).toHaveBeenCalledTimes(2);
+      expect(httpClient.get).toHaveBeenCalledWith(`${API_BASE_PATH}/guides`);
+    });
   });
 
   describe('updatePluginState', () => {
@@ -132,6 +143,19 @@ describe('GuidedOnboarding ApiService', () => {
         body: JSON.stringify({ status: 'quit' }),
       });
     });
+
+    it('a request to update plugin state API is sent even when a fetch plugin state request is in flight at the same time', async () => {
+      httpClient.get.mockImplementationOnce(() => {
+        return new Promise((resolve) => setTimeout(resolve));
+      });
+      await apiService.fetchPluginState$().subscribe();
+      expect(apiService.isLoading$.value).toBe(true);
+      await apiService.updatePluginState({ guide: testGuideStep1InProgressState }, false);
+      expect(httpClient.put).toHaveBeenCalledTimes(1);
+      expect(httpClient.put).toHaveBeenCalledWith(`${API_BASE_PATH}/state`, {
+        body: JSON.stringify({ guide: testGuideStep1InProgressState }),
+      });
+    });
   });
 
   describe('activateGuide', () => {
@@ -627,8 +651,8 @@ describe('GuidedOnboarding ApiService', () => {
       });
     });
 
-    describe('is updated when fetching all guides state', () => {
-      it('true while request is in flight, false after the request completes', async () => {
+    describe('is not updated when fetching all guides state', () => {
+      it('false while request is in flight', async () => {
         httpClient.get.mockImplementation(() => {
           return new Promise((resolve) =>
             setTimeout(
@@ -644,20 +668,7 @@ describe('GuidedOnboarding ApiService', () => {
         // starting the request
         apiService.fetchAllGuidesState().then();
 
-        await testRequest();
-      });
-
-      it('true while request is in flight, false after the request fails', async () => {
-        httpClient.get.mockImplementation(() => {
-          return new Promise((resolve, reject) =>
-            setTimeout(() => reject(new Error('test')), 2000)
-          );
-        });
-        apiService.setup(httpClient, true);
-        // starting the request
-        apiService.fetchAllGuidesState().catch(() => {});
-
-        await testRequest(true);
+        expect(apiService.isLoading$.value).toBe(false);
       });
     });
 
@@ -735,7 +746,18 @@ describe('GuidedOnboarding ApiService', () => {
       apiService.setup(httpClient, true);
       await apiService.getGuideConfig(testGuideId);
       expect(httpClient.get).toHaveBeenCalledTimes(1);
-      expect(httpClient.get).toHaveBeenCalledWith(`${API_BASE_PATH}/configs/${testGuideId}`);
+      expect(httpClient.get).toHaveBeenLastCalledWith(`${API_BASE_PATH}/configs/${testGuideId}`);
+    });
+
+    it('a request to config API is sent even when a fetch plugin state request is in flight at the same time', async () => {
+      httpClient.get.mockImplementationOnce(() => {
+        return new Promise((resolve) => setTimeout(resolve));
+      });
+      await apiService.fetchPluginState$().subscribe();
+      expect(apiService.isLoading$.value).toBe(true);
+      await apiService.getGuideConfig(testGuideId);
+      expect(httpClient.get).toHaveBeenCalledTimes(2);
+      expect(httpClient.get).toHaveBeenLastCalledWith(`${API_BASE_PATH}/configs/${testGuideId}`);
     });
   });
 

From c5dfeba731d7d16bda7d34ef96ead4999f8c4aee Mon Sep 17 00:00:00 2001
From: Maryam Saeidi <maryam.saeidi@elastic.co>
Date: Wed, 8 Feb 2023 12:51:30 +0100
Subject: [PATCH 115/134] [AO] Improve loading state in Overview page (#150327)

Fixes #150305

## Summary

This PR fixes the loading state of the `infra_metrics` section.

I also tried to check why the `Log` section appears without any loading
state but it seems the API that returns if this section has data takes a
bit more time than the other APIs (@weltenwort please let me know if my
assumption is not correct or if you have suggestion about how to get the
hasData info for `Log` section quicker)

|Before|After|
|---|---|

|![image](https://user-images.githubusercontent.com/12370520/216984455-f9277a88-0759-4e5e-b8aa-6b8af745a82f.png)|![image](https://user-images.githubusercontent.com/12370520/216984578-a7392b90-3709-4487-9b9f-8bf70ddaffe5.png)|
---
 .../components/app/section/metrics/index.tsx  | 37 ++++++++++++-------
 .../components/app/section/ux/index.tsx       |  4 +-
 .../observability/public/context/constants.ts | 13 +++++++
 .../public/context/has_data_context.tsx       | 31 ++++++++++++----
 4 files changed, 61 insertions(+), 24 deletions(-)
 create mode 100644 x-pack/plugins/observability/public/context/constants.ts

diff --git a/x-pack/plugins/observability/public/components/app/section/metrics/index.tsx b/x-pack/plugins/observability/public/components/app/section/metrics/index.tsx
index ee82b80c3ace4..2d02a4cbb3566 100644
--- a/x-pack/plugins/observability/public/components/app/section/metrics/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/metrics/index.tsx
@@ -10,6 +10,7 @@ import {
   Direction,
   EuiBasicTable,
   EuiBasicTableColumn,
+  EuiLoadingChart,
   EuiTableSortingType,
 } from '@elastic/eui';
 import numeral from '@elastic/numeral';
@@ -99,14 +100,7 @@ export function MetricsSection({ bucketSize }: Props) {
   }
 
   const isLoading = status === FETCH_STATUS.LOADING;
-  const isPending = status === FETCH_STATUS.LOADING;
-  if (isLoading || isPending) {
-    return <pre>Loading</pre>;
-  }
-
-  if (!data) {
-    return <pre>No Data</pre>;
-  }
+  const isInitialLoad = isLoading && !data;
 
   const columns: Array<EuiBasicTableColumn<MetricsFetchDataSeries>> = [
     {
@@ -218,12 +212,27 @@ export function MetricsSection({ bucketSize }: Props) {
       }}
       hasError={status === FETCH_STATUS.FAILURE}
     >
-      <EuiBasicTable
-        onChange={handleTableChange}
-        sorting={sorting}
-        items={viewData?.series ?? []}
-        columns={columns}
-      />
+      {isInitialLoad ? (
+        <div
+          data-test-subj="loading"
+          style={{
+            height: 240,
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'center',
+          }}
+        >
+          <EuiLoadingChart size="l" />
+        </div>
+      ) : (
+        <EuiBasicTable
+          onChange={handleTableChange}
+          sorting={sorting}
+          items={viewData?.series ?? []}
+          columns={columns}
+          loading={isLoading}
+        />
+      )}
     </SectionContainer>
   );
 }
diff --git a/x-pack/plugins/observability/public/components/app/section/ux/index.tsx b/x-pack/plugins/observability/public/components/app/section/ux/index.tsx
index bdc783938211f..2bfc534c641db 100644
--- a/x-pack/plugins/observability/public/components/app/section/ux/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/ux/index.tsx
@@ -9,8 +9,8 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useKibana } from '@kbn/kibana-react-plugin/public';
 import { CoreStart } from '@kbn/core/public';
+import { UX_APP } from '../../../../context/constants';
 import { ObservabilityPublicPluginsStart } from '../../../..';
-import type { AppDataType } from '../../../shared/exploratory_view/types';
 import { SectionContainer } from '..';
 import { getDataHandler } from '../../../../data_handler';
 import { FETCH_STATUS, useFetcher } from '../../../../hooks/use_fetcher';
@@ -52,7 +52,7 @@ export function UXSection({ bucketSize }: Props) {
         [SERVICE_NAME]: ['ALL_VALUES'],
       },
       breakdown: SERVICE_NAME,
-      dataType: 'ux' as AppDataType,
+      dataType: UX_APP,
       selectedMetricField: TRANSACTION_DURATION,
       showPercentileAnnotations: false,
     },
diff --git a/x-pack/plugins/observability/public/context/constants.ts b/x-pack/plugins/observability/public/context/constants.ts
new file mode 100644
index 0000000000000..695febb81aff6
--- /dev/null
+++ b/x-pack/plugins/observability/public/context/constants.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const ALERT_APP = 'alert';
+export const UX_APP = 'ux';
+export const SYNTHETICS_APP = 'synthetics';
+export const APM_APP = 'apm';
+export const INFRA_LOGS_APP = 'infra_logs';
+export const INFRA_METRICS_APP = 'infra_metrics';
diff --git a/x-pack/plugins/observability/public/context/has_data_context.tsx b/x-pack/plugins/observability/public/context/has_data_context.tsx
index e5e281979ef2f..775b401b50866 100644
--- a/x-pack/plugins/observability/public/context/has_data_context.tsx
+++ b/x-pack/plugins/observability/public/context/has_data_context.tsx
@@ -10,6 +10,14 @@ import React, { createContext, useEffect, useState } from 'react';
 import { useRouteMatch } from 'react-router-dom';
 import { asyncForEach } from '@kbn/std';
 import { useKibana } from '@kbn/kibana-react-plugin/public';
+import {
+  ALERT_APP,
+  APM_APP,
+  INFRA_LOGS_APP,
+  INFRA_METRICS_APP,
+  SYNTHETICS_APP,
+  UX_APP,
+} from './constants';
 import { getDataHandler } from '../data_handler';
 import { FETCH_STATUS } from '../hooks/use_fetcher';
 import { useDatePickerContext } from '../hooks/use_date_picker_context';
@@ -40,7 +48,14 @@ export interface HasDataContextValue {
 
 export const HasDataContext = createContext({} as HasDataContextValue);
 
-const apps: DataContextApps[] = ['apm', 'synthetics', 'infra_logs', 'infra_metrics', 'ux', 'alert'];
+const apps: DataContextApps[] = [
+  APM_APP,
+  SYNTHETICS_APP,
+  INFRA_LOGS_APP,
+  INFRA_METRICS_APP,
+  UX_APP,
+  ALERT_APP,
+];
 
 export function HasDataContextProvider({ children }: { children: React.ReactNode }) {
   const { http } = useKibana<ObservabilityAppServices>().services;
@@ -76,7 +91,7 @@ export function HasDataContextProvider({ children }: { children: React.ReactNode
               }));
             };
             switch (app) {
-              case 'ux':
+              case UX_APP:
                 const params = { absoluteTime: { start: absoluteStart!, end: absoluteEnd! } };
                 const resultUx = await getDataHandler(app)?.hasData(params);
                 updateState({
@@ -85,24 +100,24 @@ export function HasDataContextProvider({ children }: { children: React.ReactNode
                   serviceName: resultUx?.serviceName as string,
                 });
                 break;
-              case 'synthetics':
+              case SYNTHETICS_APP:
                 const resultSy = await getDataHandler(app)?.hasData();
                 updateState({ hasData: resultSy?.hasData, indices: resultSy?.indices });
 
                 break;
-              case 'apm':
+              case APM_APP:
                 const resultApm = await getDataHandler(app)?.hasData();
                 updateState({ hasData: resultApm?.hasData, indices: resultApm?.indices });
 
                 break;
-              case 'infra_logs':
+              case INFRA_LOGS_APP:
                 const resultInfraLogs = await getDataHandler(app)?.hasData();
                 updateState({
                   hasData: resultInfraLogs?.hasData,
                   indices: resultInfraLogs?.indices,
                 });
                 break;
-              case 'infra_metrics':
+              case INFRA_METRICS_APP:
                 const resultInfraMetrics = await getDataHandler(app)?.hasData();
                 updateState({
                   hasData: resultInfraMetrics?.hasData,
@@ -131,7 +146,7 @@ export function HasDataContextProvider({ children }: { children: React.ReactNode
         const alerts = await getObservabilityAlerts({ http });
         setHasDataMap((prevState) => ({
           ...prevState,
-          alert: {
+          [ALERT_APP]: {
             hasData: alerts.length > 0,
             status: FETCH_STATUS.SUCCESS,
           },
@@ -139,7 +154,7 @@ export function HasDataContextProvider({ children }: { children: React.ReactNode
       } catch (e) {
         setHasDataMap((prevState) => ({
           ...prevState,
-          alert: {
+          [ALERT_APP]: {
             hasData: undefined,
             status: FETCH_STATUS.FAILURE,
           },

From 86e91b72ddc421964304788e44e46480144ce097 Mon Sep 17 00:00:00 2001
From: Marco Liberati <dej611@users.noreply.github.com>
Date: Wed, 8 Feb 2023 13:05:27 +0100
Subject: [PATCH 116/134] [Lens] Always use resolved time range when computing
 Top values order agg with timeshifts (#150418)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Fix #150313

This was a very tricky bug to discover but with a relative "easy"
solution: the main difference here between Lens and Dashboard was that
the former is always converting timeRange data into absolute dates,
while the latter keeps the original date format.
This difference in how dates are handled by the app triggers the bug
when a specific Lens configuration is used, as `moment` could not handle
a relative time range, as it's not an ISO format, which makes it
fallback into the `Date` constructor therefore a final `null` value:
this `null` is passed underneath to the aggs logic which 💥 when
traversing the object and find a `null` value where a timestamp was
expected instead.

As an example think of:

```ts
moment.tz("now-15m", "Europe/Rome").subtract(undefined || 0).toISOString();
```

this will produce a `new Date("now-15m")` and the `toISOString()` method
translates it into a `null` value.

All this to give some more debugging context of the work behind this
simple one-line fix. :)

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
---
 .../data/common/search/aggs/buckets/_terms_order_helper.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/plugins/data/common/search/aggs/buckets/_terms_order_helper.ts b/src/plugins/data/common/search/aggs/buckets/_terms_order_helper.ts
index c53e43acb37c4..fecfc94229208 100644
--- a/src/plugins/data/common/search/aggs/buckets/_terms_order_helper.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_terms_order_helper.ts
@@ -67,6 +67,9 @@ export const termsOrderAggParamDefinition: Partial<BucketAggParam<IBucketAggConf
 
     if (aggs?.hasTimeShifts() && Object.keys(aggs?.getTimeShifts()).length > 1 && aggs.timeRange) {
       const shift = orderAgg.getTimeShift();
+      // The timeRange can be either absolute or relative
+      // We need the absolute/resolved one for moment, so use the helper method
+      const timeRange = aggs.getResolvedTimeRange();
       orderAgg = aggs.createAggConfig(
         {
           type: 'filtered_metric',
@@ -84,11 +87,11 @@ export const termsOrderAggParamDefinition: Partial<BucketAggParam<IBucketAggConf
                         range: {
                           [aggs.timeFields![0]]: {
                             gte: moment
-                              .tz(aggs.timeRange.from, aggs.timeZone)
+                              .tz(timeRange?.min, aggs.timeZone)
                               .subtract(shift || 0)
                               .toISOString(),
                             lte: moment
-                              .tz(aggs.timeRange.to, aggs.timeZone)
+                              .tz(timeRange?.max, aggs.timeZone)
                               .subtract(shift || 0)
                               .toISOString(),
                           },

From e77045517319ddb68780ea0eea26f7f77286dad0 Mon Sep 17 00:00:00 2001
From: Jean-Louis Leysens <jeanlouis.leysens@elastic.co>
Date: Wed, 8 Feb 2023 13:15:48 +0100
Subject: [PATCH 117/134] [Saved Objects] Update `resolve` doc comment
 (#150540)

## Summary

Per title
---
 .../src/saved_objects_client.ts                    | 14 ++++++++++++--
 .../src/saved_objects_client.ts                    | 14 ++++++++++++--
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/packages/core/saved-objects/core-saved-objects-api-browser/src/saved_objects_client.ts b/packages/core/saved-objects/core-saved-objects-api-browser/src/saved_objects_client.ts
index fc4285406effe..d92b39f6c15a6 100644
--- a/packages/core/saved-objects/core-saved-objects-api-browser/src/saved_objects_client.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-browser/src/saved_objects_client.ts
@@ -129,7 +129,15 @@ export interface SavedObjectsClientContract {
   bulkGet(objects: SavedObjectTypeIdTuple[]): Promise<SavedObjectsBatchResponse<unknown>>;
 
   /**
-   * Resolves a single object
+   * Resolves a single object.
+   *
+   * After 8.0.0, saved objects are provided a unique ID _across_ spaces.
+   * A subset of existing saved objects may have IDs regenerated while upgrading to 8+.
+   * `.resolve` provides a way for clients with legacy IDs to still retrieve the correct
+   * saved object.
+   *
+   * An example of a client with a "legacy ID" is a bookmarked dashboard in a
+   * non-default space.
    *
    * @param {string} type - the type of the object to resolve
    * @param {string} id - the ID of the object to resolve
@@ -144,7 +152,9 @@ export interface SavedObjectsClientContract {
   resolve<T = unknown>(type: string, id: string): Promise<ResolvedSimpleSavedObject<T>>;
 
   /**
-   * Resolves an array of objects by id, using any legacy URL aliases if they exist
+   * Resolves an array of objects by id.
+   *
+   * See documentation for `.resolve`.
    *
    * @param objects - an array of objects containing id, type
    * @returns The bulk resolve result for the saved objects for the given types and ids.
diff --git a/packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts b/packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts
index de7fcfd19fc4b..a7ba3f2818971 100644
--- a/packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts
@@ -210,7 +210,9 @@ export interface SavedObjectsClientContract {
   ): Promise<SavedObject<T>>;
 
   /**
-   * Resolves an array of objects by id, using any legacy URL aliases if they exist
+   * Resolves an array of objects by id.
+   *
+   * See documentation for `.resolve`.
    *
    * @param objects - an array of objects to resolve (contains id and type)
    * @param options {@link SavedObjectsBaseOptions} - options for the bulk resolve operation
@@ -232,7 +234,15 @@ export interface SavedObjectsClientContract {
   ): Promise<SavedObjectsBulkResolveResponse<T>>;
 
   /**
-   * Resolves a single object, using any legacy URL alias if it exists
+   * Resolves a single object.
+   *
+   * After 8.0.0, saved objects are provided a unique ID _across_ spaces.
+   * A subset of existing saved objects may have IDs regenerated while upgrading to 8+.
+   * `.resolve` provides a way for clients with legacy IDs to still retrieve the correct
+   * saved object.
+   *
+   * An example of a client with a "legacy ID" is a bookmarked dashboard in a
+   * non-default space.
    *
    * @param type - The type of SavedObject to retrieve
    * @param id - The ID of the SavedObject to retrieve

From 1856323bbd343cbb8c45aafc8cb6b5050352fa0a Mon Sep 17 00:00:00 2001
From: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Date: Wed, 8 Feb 2023 08:10:09 -0500
Subject: [PATCH 118/134] [ResponseOps][Alerting] A redundant summary alert is
 shown on rule details alerts list (#150088)

Resolves https://github.com/elastic/kibana/issues/149824

## Summary

Added a filter to filter out logs that have an action set to
`execute-action` in the `alert_summary` route on the rules details
page.
Updated how we log summary alerts by removing the `alertId` and `group`
fields. I added a new summary field to `kibana.alerting` that includes
the counts for new, ongoing, and recovered alerts.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify

- Create a rule that has Alert Summary and let the rule run.
- Click on the rule to navigate to the rule details page and look at the
`Alerts` tab. Verify that the summary alert is not listed in the table.

**This is a screen shot of the table in the issue:**
We want to verify that the last row is no longer there.
<img width="1728" alt="Screen Shot 2023-02-01 at 3 02 21 PM"
src="https://user-images.githubusercontent.com/109488926/216150854-590e084d-3519-4785-8375-00a7455c319f.png">
---
 .../alerting_event_logger.ts                  |  8 +++++-
 ...eate_alert_event_log_record_object.test.ts | 16 ++++++++++++
 .../create_alert_event_log_record_object.ts   | 17 ++++++++++++-
 .../rules_client/methods/get_alert_summary.ts |  2 ++
 .../tests/get_alert_summary.test.ts           |  2 ++
 .../task_runner/execution_handler.test.ts     | 12 +++++++++
 .../server/task_runner/execution_handler.ts   |  7 ++++--
 .../plugins/event_log/generated/mappings.json | 25 +++++++++++++++++++
 x-pack/plugins/event_log/generated/schemas.ts | 19 ++++++++++++++
 x-pack/plugins/event_log/scripts/mappings.js  | 25 +++++++++++++++++++
 10 files changed, 129 insertions(+), 4 deletions(-)

diff --git a/x-pack/plugins/alerting/server/lib/alerting_event_logger/alerting_event_logger.ts b/x-pack/plugins/alerting/server/lib/alerting_event_logger/alerting_event_logger.ts
index fff026a358bc8..dd8c52bebc0e0 100644
--- a/x-pack/plugins/alerting/server/lib/alerting_event_logger/alerting_event_logger.ts
+++ b/x-pack/plugins/alerting/server/lib/alerting_event_logger/alerting_event_logger.ts
@@ -54,8 +54,13 @@ interface AlertOpts {
 interface ActionOpts {
   id: string;
   typeId: string;
-  alertId: string;
+  alertId?: string;
   alertGroup?: string;
+  alertSummary?: {
+    new: number;
+    ongoing: number;
+    recovered: number;
+  };
 }
 
 export class AlertingEventLogger {
@@ -278,6 +283,7 @@ export function createActionExecuteRecord(context: RuleContextOpts, action: Acti
       },
     ],
     ruleName: context.ruleName,
+    alertSummary: action.alertSummary,
   });
 }
 
diff --git a/x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.test.ts b/x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.test.ts
index 8f73ba3a56860..185aa098a49d7 100644
--- a/x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.test.ts
+++ b/x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.test.ts
@@ -191,6 +191,11 @@ describe('createAlertEventLogRecordObject', () => {
           },
         ],
         spaceId: 'default',
+        alertSummary: {
+          new: 2,
+          ongoing: 3,
+          recovered: 1,
+        },
       })
     ).toStrictEqual({
       event: {
@@ -214,6 +219,17 @@ describe('createAlertEventLogRecordObject', () => {
         alerting: {
           action_group_id: 'group 1',
           instance_id: 'test1',
+          summary: {
+            new: {
+              count: 2,
+            },
+            ongoing: {
+              count: 3,
+            },
+            recovered: {
+              count: 1,
+            },
+          },
         },
         saved_objects: [
           {
diff --git a/x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.ts b/x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.ts
index ea74cab5d11cf..280f498422fd0 100644
--- a/x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.ts
+++ b/x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.ts
@@ -36,6 +36,11 @@ interface CreateAlertEventLogRecordParams {
     relation?: string;
   }>;
   flapping?: boolean;
+  alertSummary?: {
+    new: number;
+    ongoing: number;
+    recovered: number;
+  };
 }
 
 export function createAlertEventLogRecordObject(params: CreateAlertEventLogRecordParams): Event {
@@ -52,13 +57,23 @@ export function createAlertEventLogRecordObject(params: CreateAlertEventLogRecor
     consumer,
     spaceId,
     flapping,
+    alertSummary,
   } = params;
   const alerting =
-    params.instanceId || group
+    params.instanceId || group || alertSummary
       ? {
           alerting: {
             ...(params.instanceId ? { instance_id: params.instanceId } : {}),
             ...(group ? { action_group_id: group } : {}),
+            ...(alertSummary
+              ? {
+                  summary: {
+                    new: { count: alertSummary.new },
+                    ongoing: { count: alertSummary.ongoing },
+                    recovered: { count: alertSummary.recovered },
+                  },
+                }
+              : {}),
           },
         }
       : undefined;
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/get_alert_summary.ts b/x-pack/plugins/alerting/server/rules_client/methods/get_alert_summary.ts
index e841423ad1949..8d194b850816b 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/get_alert_summary.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/get_alert_summary.ts
@@ -56,6 +56,8 @@ export async function getAlertSummary(
           start: parsedDateStart.toISOString(),
           sort: [{ sort_field: '@timestamp', sort_order: 'desc' }],
           end: dateNow.toISOString(),
+          // filter out execute-action event logs
+          filter: 'NOT event.action: execute-action AND event.provider: alerting',
         },
         rule.legacyId !== null ? [rule.legacyId] : undefined
       ),
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/get_alert_summary.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/get_alert_summary.test.ts
index f0f634538d6f7..cbf766bd482d5 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/get_alert_summary.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/get_alert_summary.test.ts
@@ -222,6 +222,7 @@ describe('getAlertSummary()', () => {
         ],
         Object {
           "end": "2019-02-12T21:01:22.479Z",
+          "filter": "NOT event.action: execute-action AND event.provider: alerting",
           "page": 1,
           "per_page": 10000,
           "sort": Array [
@@ -264,6 +265,7 @@ describe('getAlertSummary()', () => {
         ],
         Object {
           "end": "2019-02-12T21:01:22.479Z",
+          "filter": "NOT event.action: execute-action AND event.provider: alerting",
           "page": 1,
           "per_page": 10000,
           "sort": Array [
diff --git a/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts b/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts
index ed88a9ecb60c1..b41db1147f3b7 100644
--- a/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts
@@ -907,6 +907,11 @@ describe('Execution Handler', () => {
             ],
           ]
       `);
+    expect(alertingEventLogger.logAction).toBeCalledWith({
+      alertSummary: { new: 1, ongoing: 0, recovered: 0 },
+      id: '1',
+      typeId: 'testActionTypeId',
+    });
   });
 
   test('skips summary actions (per rule run) when there is no alerts', async () => {
@@ -946,6 +951,7 @@ describe('Execution Handler', () => {
 
     expect(getSummarizedAlertsMock).not.toHaveBeenCalled();
     expect(actionsClient.bulkEnqueueExecution).not.toHaveBeenCalled();
+    expect(alertingEventLogger.logAction).not.toHaveBeenCalled();
   });
 
   test('triggers summary actions (custom interval)', async () => {
@@ -1030,6 +1036,11 @@ describe('Execution Handler', () => {
             ],
           ]
       `);
+    expect(alertingEventLogger.logAction).toBeCalledWith({
+      alertSummary: { new: 1, ongoing: 0, recovered: 0 },
+      id: '1',
+      typeId: 'testActionTypeId',
+    });
   });
 
   test('does not trigger summary actions if it is still being throttled (custom interval)', async () => {
@@ -1075,6 +1086,7 @@ describe('Execution Handler', () => {
     );
     expect(getSummarizedAlertsMock).not.toHaveBeenCalled();
     expect(actionsClient.bulkEnqueueExecution).not.toHaveBeenCalled();
+    expect(alertingEventLogger.logAction).not.toHaveBeenCalled();
   });
 
   test('removes the obsolete actions from the task state', async () => {
diff --git a/x-pack/plugins/alerting/server/task_runner/execution_handler.ts b/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
index 8755d480621d7..d0784805c5942 100644
--- a/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
+++ b/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
@@ -239,8 +239,11 @@ export class ExecutionHandler<
           logActions.push({
             id: action.id,
             typeId: action.actionTypeId,
-            alertId: 'summary',
-            alertGroup: action.group,
+            alertSummary: {
+              new: summarizedAlerts.new.count,
+              ongoing: summarizedAlerts.ongoing.count,
+              recovered: summarizedAlerts.recovered.count,
+            },
           });
         } else {
           const executableAlert = alert!;
diff --git a/x-pack/plugins/event_log/generated/mappings.json b/x-pack/plugins/event_log/generated/mappings.json
index 1e3c5396927b7..a5212917393f8 100644
--- a/x-pack/plugins/event_log/generated/mappings.json
+++ b/x-pack/plugins/event_log/generated/mappings.json
@@ -271,6 +271,31 @@
                         "outcome": {
                             "type": "keyword",
                             "ignore_above": 1024
+                        },
+                        "summary": {
+                            "properties": {
+                                "new": {
+                                    "properties": {
+                                        "count": {
+                                            "type": "long"
+                                        }
+                                    }
+                                },
+                                "ongoing": {
+                                    "properties": {
+                                        "count": {
+                                            "type": "long"
+                                        }
+                                    }
+                                },
+                                "recovered": {
+                                    "properties": {
+                                        "count": {
+                                            "type": "long"
+                                        }
+                                    }
+                                }
+                            }
                         }
                     }
                 },
diff --git a/x-pack/plugins/event_log/generated/schemas.ts b/x-pack/plugins/event_log/generated/schemas.ts
index 430feda52f1fb..93ee9f2977a36 100644
--- a/x-pack/plugins/event_log/generated/schemas.ts
+++ b/x-pack/plugins/event_log/generated/schemas.ts
@@ -116,6 +116,25 @@ export const EventSchema = schema.maybe(
             action_subgroup: ecsString(),
             status: ecsString(),
             outcome: ecsString(),
+            summary: schema.maybe(
+              schema.object({
+                new: schema.maybe(
+                  schema.object({
+                    count: ecsStringOrNumber(),
+                  })
+                ),
+                ongoing: schema.maybe(
+                  schema.object({
+                    count: ecsStringOrNumber(),
+                  })
+                ),
+                recovered: schema.maybe(
+                  schema.object({
+                    count: ecsStringOrNumber(),
+                  })
+                ),
+              })
+            ),
           })
         ),
         alert: schema.maybe(
diff --git a/x-pack/plugins/event_log/scripts/mappings.js b/x-pack/plugins/event_log/scripts/mappings.js
index fc4d40ee9f774..36838a4208a87 100644
--- a/x-pack/plugins/event_log/scripts/mappings.js
+++ b/x-pack/plugins/event_log/scripts/mappings.js
@@ -54,6 +54,31 @@ exports.EcsCustomPropertyMappings = {
             type: 'keyword',
             ignore_above: 1024,
           },
+          summary: {
+            properties: {
+              new: {
+                properties: {
+                  count: {
+                    type: 'long',
+                  },
+                },
+              },
+              ongoing: {
+                properties: {
+                  count: {
+                    type: 'long',
+                  },
+                },
+              },
+              recovered: {
+                properties: {
+                  count: {
+                    type: 'long',
+                  },
+                },
+              },
+            },
+          },
         },
       },
       alert: {

From 9aae30e35fec6b9b10e92b7846ed02af9d04df2e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20G=C3=B3mez?=
 <alejandro.fernandez@elastic.co>
Date: Wed, 8 Feb 2023 14:15:53 +0100
Subject: [PATCH 119/134] [Synthetics UI] Add deprecation warnings for the
 synthetics integration monitors (#150437)

Closes #150287

## Summary

Adds or updates deprecation notices regarding the synthetics integration
when the user has monitors created through it.

## Screenshots

In the Uptime UI:

<img width="1280" alt="Screenshot 2023-02-07 at 15 10 37"
src="https://user-images.githubusercontent.com/57448/217268105-c2dcd6ad-556e-4c88-ace2-4f3be6fb9576.png">

When editing an integration:

<img width="1259" alt="Screenshot 2023-02-07 at 15 44 57"
src="https://user-images.githubusercontent.com/57448/217277804-c54cfcd0-b1e6-4b42-9f4a-b08167c8b2a1.png">
---
 .../synthetics/common/constants/rest_api.ts   |  2 +-
 .../plugins/synthetics/common/types/index.ts  |  2 +-
 ...recation.ts => integration_deprecation.ts} |  4 +-
 ...nthetics_policy_edit_extension_wrapper.tsx |  5 +-
 .../integration_deprecation/index.tsx         | 52 +++++++++++
 .../integration_deprecation.test.tsx}         | 38 ++++----
 .../integration_deprecation_callout.tsx       | 66 +++++++++++++
 .../overview/zip_url_deprecation/index.tsx    | 92 -------------------
 .../public/legacy_uptime/pages/overview.tsx   |  4 +-
 ...onitors.ts => has_integration_monitors.ts} |  9 +-
 .../fleet/get_has_integration_monitors.ts     | 24 +++++
 .../routes/fleet/get_has_zip_url_monitors.ts  | 31 -------
 .../plugins/synthetics/server/routes/index.ts |  4 +-
 .../translations/translations/fr-FR.json      |  4 -
 .../translations/translations/ja-JP.json      |  4 -
 .../translations/translations/zh-CN.json      |  4 -
 16 files changed, 179 insertions(+), 166 deletions(-)
 rename x-pack/plugins/synthetics/common/types/{zip_url_deprecation.ts => integration_deprecation.ts} (72%)
 create mode 100644 x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/index.tsx
 rename x-pack/plugins/synthetics/public/legacy_uptime/components/overview/{zip_url_deprecation/zip_url_deprecation.test.tsx => integration_deprecation/integration_deprecation.test.tsx} (56%)
 create mode 100644 x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/integration_deprecation_callout.tsx
 delete mode 100644 x-pack/plugins/synthetics/public/legacy_uptime/components/overview/zip_url_deprecation/index.tsx
 rename x-pack/plugins/synthetics/public/legacy_uptime/state/api/{has_zip_url_monitors.ts => has_integration_monitors.ts} (53%)
 create mode 100644 x-pack/plugins/synthetics/server/routes/fleet/get_has_integration_monitors.ts
 delete mode 100644 x-pack/plugins/synthetics/server/routes/fleet/get_has_zip_url_monitors.ts

diff --git a/x-pack/plugins/synthetics/common/constants/rest_api.ts b/x-pack/plugins/synthetics/common/constants/rest_api.ts
index eaf3ba8c36b14..552980758c3ec 100644
--- a/x-pack/plugins/synthetics/common/constants/rest_api.ts
+++ b/x-pack/plugins/synthetics/common/constants/rest_api.ts
@@ -45,7 +45,7 @@ export enum API_URLS {
   TRIGGER_MONITOR = '/internal/uptime/service/monitors/trigger',
   SERVICE_ALLOWED = '/internal/uptime/service/allowed',
   SYNTHETICS_APIKEY = '/internal/uptime/service/api_key',
-  SYNTHETICS_HAS_ZIP_URL_MONITORS = '/internal/uptime/fleet/has_zip_url_monitors',
+  SYNTHETICS_HAS_INTEGRATION_MONITORS = '/internal/uptime/fleet/has_integration_monitors',
 
   // Project monitor public endpoint
   SYNTHETICS_MONITORS_PROJECT = '/api/synthetics/project/{projectName}/monitors',
diff --git a/x-pack/plugins/synthetics/common/types/index.ts b/x-pack/plugins/synthetics/common/types/index.ts
index b26fcaccba881..6a864b700092d 100644
--- a/x-pack/plugins/synthetics/common/types/index.ts
+++ b/x-pack/plugins/synthetics/common/types/index.ts
@@ -8,4 +8,4 @@
 export * from './monitor_duration';
 export * from './synthetics_monitor';
 export * from './monitor_validation';
-export * from './zip_url_deprecation';
+export * from './integration_deprecation';
diff --git a/x-pack/plugins/synthetics/common/types/zip_url_deprecation.ts b/x-pack/plugins/synthetics/common/types/integration_deprecation.ts
similarity index 72%
rename from x-pack/plugins/synthetics/common/types/zip_url_deprecation.ts
rename to x-pack/plugins/synthetics/common/types/integration_deprecation.ts
index 793d1d35ddb97..951de85c046b6 100644
--- a/x-pack/plugins/synthetics/common/types/zip_url_deprecation.ts
+++ b/x-pack/plugins/synthetics/common/types/integration_deprecation.ts
@@ -5,6 +5,6 @@
  * 2.0.
  */
 
-export interface SyntheticsHasZipUrlMonitorsResponse {
-  hasZipUrlMonitors: boolean;
+export interface SyntheticsHasIntegrationMonitorsResponse {
+  hasIntegrationMonitors: boolean;
 }
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/fleet_package/synthetics_policy_edit_extension_wrapper.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/fleet_package/synthetics_policy_edit_extension_wrapper.tsx
index abe156475755d..5c1f6dd7c1159 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/fleet_package/synthetics_policy_edit_extension_wrapper.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/fleet_package/synthetics_policy_edit_extension_wrapper.tsx
@@ -8,7 +8,7 @@
 import React, { memo, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 import { PackagePolicyEditExtensionComponentProps } from '@kbn/fleet-plugin/public';
-import { EuiButton, EuiCallOut } from '@elastic/eui';
+import { EuiButton, EuiCallOut, EuiSpacer } from '@elastic/eui';
 import { useKibana } from '@kbn/kibana-react-plugin/public';
 import { PolicyConfig, MonitorFields } from './types';
 import { ConfigKey, DataStream, TLSFields } from './types';
@@ -22,6 +22,7 @@ import {
   TLSFieldsContextProvider,
 } from './contexts';
 import { normalizers } from './helpers/normalizers';
+import { IntegrationDeprecationCallout } from '../overview/integration_deprecation/integration_deprecation_callout';
 
 /**
  * Exports Synthetics-specific package policy instructions
@@ -124,6 +125,8 @@ export const SyntheticsPolicyEditExtensionWrapper = memo<PackagePolicyEditExtens
             <TCPContextProvider defaultValues={fullDefaultConfig?.[DataStream.TCP]}>
               <ICMPSimpleFieldsContextProvider defaultValues={fullDefaultConfig?.[DataStream.ICMP]}>
                 <BrowserContextProvider defaultValues={fullDefaultConfig?.[DataStream.BROWSER]}>
+                  <IntegrationDeprecationCallout />
+                  <EuiSpacer />
                   <SyntheticsPolicyEditExtension
                     newPolicy={newPolicy}
                     onChange={onChange}
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/index.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/index.tsx
new file mode 100644
index 0000000000000..0670da6c652ca
--- /dev/null
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/index.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState, useEffect } from 'react';
+import { EuiSpacer } from '@elastic/eui';
+import { useFetcher } from '@kbn/observability-plugin/public';
+import { useSelector } from 'react-redux';
+import { getHasIntegrationMonitors } from '../../../state/api/has_integration_monitors';
+import { monitorListSelector } from '../../../state/selectors';
+import { IntegrationDeprecationCallout } from './integration_deprecation_callout';
+
+export const INTEGRATION_DEPRECATION_SESSION_STORAGE_KEY =
+  'SYNTHETICS_INTEGRATION_DEPRECATION_HAS_BEEN_DISMISSED';
+
+export const IntegrationDeprecation = () => {
+  const monitorList = useSelector(monitorListSelector);
+  const noticeHasBeenDismissed =
+    window.sessionStorage.getItem(INTEGRATION_DEPRECATION_SESSION_STORAGE_KEY) === 'true';
+  const { data, loading } = useFetcher(() => {
+    // load it when list is loaded
+    if (!noticeHasBeenDismissed && monitorList.isLoaded) {
+      return getHasIntegrationMonitors();
+    }
+    return undefined;
+  }, [monitorList.isLoaded]);
+  const hasIntegrationMonitors = !loading && data && data.hasIntegrationMonitors;
+  const [shouldShowNotice, setShouldShowNotice] = useState(
+    Boolean(hasIntegrationMonitors && !noticeHasBeenDismissed)
+  );
+
+  const handleDismissDeprecationNotice = () => {
+    window.sessionStorage.setItem(INTEGRATION_DEPRECATION_SESSION_STORAGE_KEY, 'true');
+    setShouldShowNotice(false);
+  };
+
+  useEffect(() => {
+    setShouldShowNotice(Boolean(hasIntegrationMonitors && !noticeHasBeenDismissed));
+  }, [hasIntegrationMonitors, noticeHasBeenDismissed]);
+
+  return shouldShowNotice ? (
+    <>
+      <IntegrationDeprecationCallout
+        handleDismissDeprecationNotice={handleDismissDeprecationNotice}
+      />
+      <EuiSpacer size="s" />
+    </>
+  ) : null;
+};
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/zip_url_deprecation/zip_url_deprecation.test.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/integration_deprecation.test.tsx
similarity index 56%
rename from x-pack/plugins/synthetics/public/legacy_uptime/components/overview/zip_url_deprecation/zip_url_deprecation.test.tsx
rename to x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/integration_deprecation.test.tsx
index 2d49f529e0379..68373ad85ba6b 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/zip_url_deprecation/zip_url_deprecation.test.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/integration_deprecation.test.tsx
@@ -9,62 +9,64 @@ import userEvent from '@testing-library/user-event';
 import { StubBrowserStorage } from '@kbn/test-jest-helpers';
 import { screen } from '@testing-library/react';
 import { render } from '../../../lib/helper/rtl_helpers';
-import { ZipUrlDeprecation, ZIP_URL_DEPRECATION_SESSION_STORAGE_KEY } from '.';
+import { IntegrationDeprecation, INTEGRATION_DEPRECATION_SESSION_STORAGE_KEY } from '.';
 import * as observabilityPublic from '@kbn/observability-plugin/public';
 
 export const mockStorage = new StubBrowserStorage();
 jest.mock('@kbn/observability-plugin/public');
 
-describe('ZipUrlDeprecation', () => {
+const DEPRECATION_TITLE = 'Migrate your Elastic Synthetics integration monitors before Elastic 8.8';
+
+describe('IntegrationDeprecation', () => {
   const { FETCH_STATUS } = observabilityPublic;
-  it('shows deprecation notice when hasZipUrlMonitors is true', () => {
+  it('shows deprecation notice when hasIntegrationMonitors is true', () => {
     jest.spyOn(observabilityPublic, 'useFetcher').mockReturnValue({
       status: FETCH_STATUS.SUCCESS,
-      data: { hasZipUrlMonitors: true },
+      data: { hasIntegrationMonitors: true },
       refetch: () => null,
       loading: false,
     });
 
-    render(<ZipUrlDeprecation />);
-    expect(screen.getByText('Deprecation notice')).toBeInTheDocument();
+    render(<IntegrationDeprecation />);
+    expect(screen.getByText(DEPRECATION_TITLE)).toBeInTheDocument();
   });
 
-  it('does not show deprecation notice when hasZipUrlMonitors is false', () => {
+  it('does not show deprecation notice when hasIntegrationMonitors is false', () => {
     jest.spyOn(observabilityPublic, 'useFetcher').mockReturnValue({
       status: FETCH_STATUS.SUCCESS,
-      data: { hasZipUrlMonitors: false },
+      data: { hasIntegrationMonitors: false },
       refetch: () => null,
       loading: false,
     });
 
-    render(<ZipUrlDeprecation />);
-    expect(screen.queryByText('Deprecation notice')).not.toBeInTheDocument();
+    render(<IntegrationDeprecation />);
+    expect(screen.queryByText(DEPRECATION_TITLE)).not.toBeInTheDocument();
   });
 
   it('dismisses notification', () => {
     jest.spyOn(observabilityPublic, 'useFetcher').mockReturnValue({
       status: FETCH_STATUS.SUCCESS,
-      data: { hasZipUrlMonitors: true },
+      data: { hasIntegrationMonitors: true },
       refetch: () => null,
       loading: false,
     });
 
-    render(<ZipUrlDeprecation />);
-    expect(screen.getByText('Deprecation notice')).toBeInTheDocument();
+    render(<IntegrationDeprecation />);
+    expect(screen.getByText(DEPRECATION_TITLE)).toBeInTheDocument();
     userEvent.click(screen.getByText('Dismiss'));
-    expect(screen.queryByText('Deprecation notice')).not.toBeInTheDocument();
+    expect(screen.queryByText(DEPRECATION_TITLE)).not.toBeInTheDocument();
   });
 
   it('does not show notification when session storage key is true', () => {
     jest.spyOn(observabilityPublic, 'useFetcher').mockReturnValue({
       status: FETCH_STATUS.SUCCESS,
-      data: { hasZipUrlMonitors: true },
+      data: { hasIntegrationMonitors: true },
       refetch: () => null,
       loading: false,
     });
-    mockStorage.setItem(ZIP_URL_DEPRECATION_SESSION_STORAGE_KEY, 'true');
+    mockStorage.setItem(INTEGRATION_DEPRECATION_SESSION_STORAGE_KEY, 'true');
 
-    render(<ZipUrlDeprecation />);
-    expect(screen.queryByText('Deprecation notice')).not.toBeInTheDocument();
+    render(<IntegrationDeprecation />);
+    expect(screen.queryByText(DEPRECATION_TITLE)).not.toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/integration_deprecation_callout.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/integration_deprecation_callout.tsx
new file mode 100644
index 0000000000000..3a5e1ad9394f4
--- /dev/null
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/integration_deprecation/integration_deprecation_callout.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiButton, EuiCallOut, EuiFlexGroup, EuiFlexItem, EuiLink } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { getDocLinks } from '../../../../kibana_services';
+
+interface IntegrationDeprecationCalloutProps {
+  handleDismissDeprecationNotice?: () => void;
+}
+
+export function IntegrationDeprecationCallout({
+  handleDismissDeprecationNotice,
+}: IntegrationDeprecationCalloutProps) {
+  return (
+    <EuiCallOut
+      title={
+        <FormattedMessage
+          id="xpack.synthetics.integration.deprecation.title"
+          defaultMessage="Migrate your Elastic Synthetics integration monitors before Elastic 8.8"
+        />
+      }
+      color="warning"
+    >
+      <EuiFlexGroup alignItems="center" gutterSize="s">
+        <EuiFlexItem>
+          <span>
+            <FormattedMessage
+              id="xpack.synthetics.integration.deprecation.content"
+              defaultMessage="You have at least one monitor configured using the Elastic Synthetics integration. From Elastic 8.8, the integration will be deprecated and you will no longer be able to edit these monitors. To avoid this, migrate them to Project monitors or add them to the new Synthetics app directly available in Observability before the 8.8 update. Check our {link} for more details."
+              values={{
+                link: (
+                  <EuiLink
+                    target="_blank"
+                    href={getDocLinks()?.links?.observability?.syntheticsProjectMonitors}
+                    external
+                  >
+                    <FormattedMessage
+                      id="xpack.synthetics.integration.deprecation.link"
+                      defaultMessage="Synthetics migration docs"
+                    />
+                  </EuiLink>
+                ),
+              }}
+            />
+          </span>
+        </EuiFlexItem>
+        {handleDismissDeprecationNotice ? (
+          <EuiFlexItem grow={false}>
+            <EuiButton onClick={handleDismissDeprecationNotice} color="warning">
+              <FormattedMessage
+                id="xpack.synthetics.integration.deprecation.dismiss"
+                defaultMessage="Dismiss"
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        ) : null}
+      </EuiFlexGroup>
+    </EuiCallOut>
+  );
+}
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/zip_url_deprecation/index.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/zip_url_deprecation/index.tsx
deleted file mode 100644
index 3d1b3ce0719de..0000000000000
--- a/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/zip_url_deprecation/index.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useState, useEffect } from 'react';
-import { FormattedMessage } from '@kbn/i18n-react';
-import { EuiCallOut, EuiLink, EuiButton, EuiFlexItem, EuiFlexGroup, EuiSpacer } from '@elastic/eui';
-import { useFetcher } from '@kbn/observability-plugin/public';
-import { useSelector } from 'react-redux';
-import { getHasZipUrlMonitors } from '../../../state/api/has_zip_url_monitors';
-import { getDocLinks } from '../../../../kibana_services';
-import { monitorListSelector } from '../../../state/selectors';
-
-export const ZIP_URL_DEPRECATION_SESSION_STORAGE_KEY =
-  'SYNTHETICS_ZIP_URL_DEPRECATION_HAS_BEEN_DISMISSED';
-
-export const ZipUrlDeprecation = () => {
-  const monitorList = useSelector(monitorListSelector);
-  const noticeHasBeenDismissed =
-    window.sessionStorage.getItem(ZIP_URL_DEPRECATION_SESSION_STORAGE_KEY) === 'true';
-  const { data, loading } = useFetcher(() => {
-    // load it when list is loaded
-    if (!noticeHasBeenDismissed && monitorList.isLoaded) {
-      return getHasZipUrlMonitors();
-    }
-    return undefined;
-  }, [monitorList.isLoaded]);
-  const hasZipUrlMonitors = !loading && data && data.hasZipUrlMonitors;
-  const [shouldShowNotice, setShouldShowNotice] = useState(
-    Boolean(hasZipUrlMonitors && !noticeHasBeenDismissed)
-  );
-
-  const handleDismissDeprecationNotice = () => {
-    window.sessionStorage.setItem(ZIP_URL_DEPRECATION_SESSION_STORAGE_KEY, 'true');
-    setShouldShowNotice(false);
-  };
-
-  useEffect(() => {
-    setShouldShowNotice(Boolean(hasZipUrlMonitors && !noticeHasBeenDismissed));
-  }, [hasZipUrlMonitors, noticeHasBeenDismissed]);
-
-  return shouldShowNotice ? (
-    <>
-      <EuiCallOut
-        title={
-          <FormattedMessage
-            id="xpack.synthetics.browser.zipUrl.deprecation.title"
-            defaultMessage="Deprecation notice"
-          />
-        }
-        color="warning"
-      >
-        <EuiFlexGroup alignItems="center" gutterSize="s">
-          <EuiFlexItem>
-            <span>
-              <FormattedMessage
-                id="xpack.synthetics.browser.zipUrl.deprecation.content"
-                defaultMessage="Zip URL is deprecated and will be removed in a future version. Use project monitors instead to create monitors from a remote repository and to migrate existing Zip URL monitors. {link}"
-                values={{
-                  link: (
-                    <EuiLink
-                      target="_blank"
-                      href={getDocLinks()?.links?.observability?.syntheticsProjectMonitors}
-                      external
-                    >
-                      <FormattedMessage
-                        id="xpack.synthetics.browser.zipUrl.deprecation.link"
-                        defaultMessage="Learn more"
-                      />
-                    </EuiLink>
-                  ),
-                }}
-              />
-            </span>
-          </EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            <EuiButton onClick={handleDismissDeprecationNotice} color="warning">
-              <FormattedMessage
-                id="xpack.synthetics.browser.zipUrl.deprecation.dismiss"
-                defaultMessage="Dismiss"
-              />
-            </EuiButton>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </EuiCallOut>
-      <EuiSpacer size="s" />
-    </>
-  ) : null;
-};
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/pages/overview.tsx b/x-pack/plugins/synthetics/public/legacy_uptime/pages/overview.tsx
index 60a7ba30b3ec2..88d292a7e06cd 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/pages/overview.tsx
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/pages/overview.tsx
@@ -12,7 +12,7 @@ import styled from 'styled-components';
 import { useTrackPageview } from '@kbn/observability-plugin/public';
 import { useBreadcrumbs } from '../hooks/use_breadcrumbs';
 import { MonitorList } from '../components/overview/monitor_list/monitor_list_container';
-import { ZipUrlDeprecation } from '../components/overview/zip_url_deprecation';
+import { IntegrationDeprecation } from '../components/overview/integration_deprecation';
 import { StatusPanel } from '../components/overview/status_panel';
 import { QueryBar } from '../components/overview/query_bar/query_bar';
 import { MONITORING_OVERVIEW_LABEL } from '../routes';
@@ -40,7 +40,7 @@ export const OverviewPageComponent = () => {
     <>
       <EuiFlexGroup direction="column" gutterSize="none">
         <EuiFlexItem grow={true}>
-          <ZipUrlDeprecation />
+          <IntegrationDeprecation />
         </EuiFlexItem>
         <EuiFlexItem>
           <EuiFlexGroup gutterSize="xs" wrap responsive={false}>
diff --git a/x-pack/plugins/synthetics/public/legacy_uptime/state/api/has_zip_url_monitors.ts b/x-pack/plugins/synthetics/public/legacy_uptime/state/api/has_integration_monitors.ts
similarity index 53%
rename from x-pack/plugins/synthetics/public/legacy_uptime/state/api/has_zip_url_monitors.ts
rename to x-pack/plugins/synthetics/public/legacy_uptime/state/api/has_integration_monitors.ts
index 78f45620aad84..a376411adad09 100644
--- a/x-pack/plugins/synthetics/public/legacy_uptime/state/api/has_zip_url_monitors.ts
+++ b/x-pack/plugins/synthetics/public/legacy_uptime/state/api/has_integration_monitors.ts
@@ -6,9 +6,10 @@
  */
 
 import { API_URLS } from '../../../../common/constants';
-import { SyntheticsHasZipUrlMonitorsResponse } from '../../../../common/types/zip_url_deprecation';
+import { SyntheticsHasIntegrationMonitorsResponse } from '../../../../common/types/integration_deprecation';
 import { apiService } from './utils';
 
-export const getHasZipUrlMonitors = async (): Promise<SyntheticsHasZipUrlMonitorsResponse> => {
-  return await apiService.get(API_URLS.SYNTHETICS_HAS_ZIP_URL_MONITORS);
-};
+export const getHasIntegrationMonitors =
+  async (): Promise<SyntheticsHasIntegrationMonitorsResponse> => {
+    return await apiService.get(API_URLS.SYNTHETICS_HAS_INTEGRATION_MONITORS);
+  };
diff --git a/x-pack/plugins/synthetics/server/routes/fleet/get_has_integration_monitors.ts b/x-pack/plugins/synthetics/server/routes/fleet/get_has_integration_monitors.ts
new file mode 100644
index 0000000000000..966affd83b255
--- /dev/null
+++ b/x-pack/plugins/synthetics/server/routes/fleet/get_has_integration_monitors.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { API_URLS } from '../../../common/constants';
+import { SyntheticsRestApiRouteFactory } from '../../legacy_uptime/routes/types';
+
+export const getHasIntegrationMonitorsRoute: SyntheticsRestApiRouteFactory = () => ({
+  method: 'GET',
+  path: API_URLS.SYNTHETICS_HAS_INTEGRATION_MONITORS,
+  validate: {},
+  handler: async ({ savedObjectsClient, server }): Promise<any> => {
+    const monitors = await server.fleet.packagePolicyService.list(savedObjectsClient, {
+      kuery:
+        'ingest-package-policies.package.name:synthetics and not ingest-package-policies.is_managed:true',
+      perPage: 1,
+    });
+    return {
+      hasIntegrationMonitors: monitors.total > 0,
+    };
+  },
+});
diff --git a/x-pack/plugins/synthetics/server/routes/fleet/get_has_zip_url_monitors.ts b/x-pack/plugins/synthetics/server/routes/fleet/get_has_zip_url_monitors.ts
deleted file mode 100644
index 0527169b80ff4..0000000000000
--- a/x-pack/plugins/synthetics/server/routes/fleet/get_has_zip_url_monitors.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { API_URLS } from '../../../common/constants';
-import { ConfigKey } from '../../../common/runtime_types';
-import { SyntheticsRestApiRouteFactory } from '../../legacy_uptime/routes/types';
-
-export const getHasZipUrlMonitorRoute: SyntheticsRestApiRouteFactory = () => ({
-  method: 'GET',
-  path: API_URLS.SYNTHETICS_HAS_ZIP_URL_MONITORS,
-  validate: {},
-  handler: async ({ savedObjectsClient, server }): Promise<any> => {
-    const monitors = await server.fleet.packagePolicyService.list(savedObjectsClient, {
-      kuery: 'ingest-package-policies.package.name:synthetics',
-    });
-    const hasZipUrlMonitors = monitors.items.some((item) => {
-      const browserInput = item.inputs.find((input) => input.type === 'synthetics/browser');
-      const streams = browserInput?.streams || [];
-      return streams.find((stream) => stream.data_stream.dataset === 'browser')?.compiled_stream?.[
-        ConfigKey.SOURCE_ZIP_URL
-      ];
-    });
-    return {
-      hasZipUrlMonitors,
-      monitors: [],
-    };
-  },
-});
diff --git a/x-pack/plugins/synthetics/server/routes/index.ts b/x-pack/plugins/synthetics/server/routes/index.ts
index 69406cd5ff612..6978a38b2be46 100644
--- a/x-pack/plugins/synthetics/server/routes/index.ts
+++ b/x-pack/plugins/synthetics/server/routes/index.ts
@@ -40,7 +40,7 @@ import {
   SyntheticsRestApiRouteFactory,
   SyntheticsStreamingRouteFactory,
 } from '../legacy_uptime/routes';
-import { getHasZipUrlMonitorRoute } from './fleet/get_has_zip_url_monitors';
+import { getHasIntegrationMonitorsRoute } from './fleet/get_has_integration_monitors';
 import { addSyntheticsParamsRoute } from './settings/add_param';
 import { enableDefaultAlertingRoute } from './default_alerts/enable_default_alert';
 import { getDefaultAlertingRoute } from './default_alerts/get_default_alert';
@@ -66,7 +66,7 @@ export const syntheticsAppRestApiRoutes: SyntheticsRestApiRouteFactory[] = [
   getAPIKeySyntheticsRoute,
   syntheticsGetPingsRoute,
   syntheticsGetPingStatusesRoute,
-  getHasZipUrlMonitorRoute,
+  getHasIntegrationMonitorsRoute,
   createGetCurrentStatusRoute,
   getIndexSizesRoute,
   getSyntheticsParamsRoute,
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index 0e1aabfd937a5..df4eefe6efa18 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -32743,7 +32743,6 @@
     "xpack.synthetics.alerts.tls.validBeforeExpiredString": "valide depuis le {date}, il y a {relativeDate} jours.",
     "xpack.synthetics.alerts.tls.validBeforeExpiringString": "non valide jusqu'au {date}, dans {relativeDate} jours.",
     "xpack.synthetics.availabilityLabelText": "{value} %",
-    "xpack.synthetics.browser.zipUrl.deprecation.content": "L'URL du Zip est déclassée et sera supprimée dans une prochaine version. Utilisez les moniteurs de projet à la place pour créer des moniteurs à partir d'un référentiel distant et pour migrer les moniteurs d'URL de Zip existants. {link}",
     "xpack.synthetics.certificates.heading": "Certificats TLS ({total})",
     "xpack.synthetics.certificatesRoute.title": "Certificats | {baseTitle}",
     "xpack.synthetics.certs.status.ok.label": " {okRelativeDate}",
@@ -33028,9 +33027,6 @@
     "xpack.synthetics.browser.project.monitorIntegrationSettingsSectionTitle": "Paramètres du moniteur",
     "xpack.synthetics.browser.project.readOnly.callout.content": "Ce moniteur a été ajouté depuis un projet externe. La configuration est en lecture seule.",
     "xpack.synthetics.browser.project.readOnly.callout.title": "Lecture seule",
-    "xpack.synthetics.browser.zipUrl.deprecation.dismiss": "Rejeter",
-    "xpack.synthetics.browser.zipUrl.deprecation.link": "En savoir plus",
-    "xpack.synthetics.browser.zipUrl.deprecation.title": "Avis de déclassement",
     "xpack.synthetics.certificates.loading": "Chargement des certificats...",
     "xpack.synthetics.certificates.refresh": "Actualiser",
     "xpack.synthetics.certificatesPage.heading": "Certificats TLS",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 92cab0ec41d51..7cb33c2275dcc 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -32714,7 +32714,6 @@
     "xpack.synthetics.alerts.tls.validBeforeExpiredString": "{relativeDate}日前、{date}以降有効です。",
     "xpack.synthetics.alerts.tls.validBeforeExpiringString": "今から{relativeDate}日間、{date}まで無効です。",
     "xpack.synthetics.availabilityLabelText": "{value} %",
-    "xpack.synthetics.browser.zipUrl.deprecation.content": "Zip URLは廃止予定であり、将来のバージョンでは削除されます。リモートリポジトリからモニターを作成して、既存のZip URLモニターを移行するのではなく、プロジェクトモニターを使用してください。{link}",
     "xpack.synthetics.certificates.heading": "TLS証明書（{total}）",
     "xpack.synthetics.certificatesRoute.title": "証明書 | {baseTitle}",
     "xpack.synthetics.certs.status.ok.label": " for {okRelativeDate}",
@@ -32999,9 +32998,6 @@
     "xpack.synthetics.browser.project.monitorIntegrationSettingsSectionTitle": "モニター設定",
     "xpack.synthetics.browser.project.readOnly.callout.content": "この監視は外部プロジェクトから追加されました。構成は読み取り専用です。",
     "xpack.synthetics.browser.project.readOnly.callout.title": "読み取り専用",
-    "xpack.synthetics.browser.zipUrl.deprecation.dismiss": "閉じる",
-    "xpack.synthetics.browser.zipUrl.deprecation.link": "詳細",
-    "xpack.synthetics.browser.zipUrl.deprecation.title": "廃止通知",
     "xpack.synthetics.certificates.loading": "証明書を読み込んでいます...",
     "xpack.synthetics.certificates.refresh": "更新",
     "xpack.synthetics.certificatesPage.heading": "TLS証明書",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 67e7b522e1d1a..dde2c552434b2 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -32749,7 +32749,6 @@
     "xpack.synthetics.alerts.tls.validBeforeExpiredString": "自 {relativeDate} 天前，即 {date}开始生效。",
     "xpack.synthetics.alerts.tls.validBeforeExpiringString": "从现在到 {date}的 {relativeDate} 天里无效。",
     "xpack.synthetics.availabilityLabelText": "{value} %",
-    "xpack.synthetics.browser.zipUrl.deprecation.content": "Zip URL 已弃用，将在未来版本中移除。请改用项目监测以从远程存储库创建监测并迁移现有 Zip URL 监测。{link}",
     "xpack.synthetics.certificates.heading": "TLS 证书 ({total})",
     "xpack.synthetics.certificatesRoute.title": "证书 | {baseTitle}",
     "xpack.synthetics.certs.status.ok.label": " 对于 {okRelativeDate}",
@@ -33034,9 +33033,6 @@
     "xpack.synthetics.browser.project.monitorIntegrationSettingsSectionTitle": "监测设置",
     "xpack.synthetics.browser.project.readOnly.callout.content": "已从外部项目添加此监测。配置为只读状态。",
     "xpack.synthetics.browser.project.readOnly.callout.title": "只读",
-    "xpack.synthetics.browser.zipUrl.deprecation.dismiss": "关闭",
-    "xpack.synthetics.browser.zipUrl.deprecation.link": "了解详情",
-    "xpack.synthetics.browser.zipUrl.deprecation.title": "过时通知",
     "xpack.synthetics.certificates.loading": "正在加载证书......",
     "xpack.synthetics.certificates.refresh": "刷新",
     "xpack.synthetics.certificatesPage.heading": "TLS 证书",

From 6a617e4e11b62f4ed87bd38485c4d0b839f66a16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yulia=20=C4=8Cech?=
 <6585477+yuliacech@users.noreply.github.com>
Date: Wed, 8 Feb 2023 14:49:30 +0100
Subject: [PATCH 120/134] [Guided onboarding] Header button fix (#150445)

## Summary
Fixes https://github.com/elastic/kibana/issues/148912

This PR fixes the header button behaviour when a user clicks a card on
the landing page, views the guide in the dropdown checklist panel and
then closes the panel without clicking "start" in the 1st step. We
should not consider the guide "active" or "in_progress" in that case,
because the user probably doesn't expect to see this guide when they
click on the header button. They might be looking at several guides
without starting any of them. We should not display the last viewed
guide in the panel as "active" or "in_progress" but redirect the user
back to the landing page where they can click a card and start a guide
they want.

The fix adds more conditions to how the header button is rendered and it
leverages the state and status of `pluginState` and `guideState`. I
think these systems need to be refactored in the future so that such
situations can be described more cleaner and clearer.

### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 .../public/components/guide_button.tsx            | 15 +++++++++++++--
 .../public/components/guide_panel.test.tsx        | 10 ++++++++++
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/src/plugins/guided_onboarding/public/components/guide_button.tsx b/src/plugins/guided_onboarding/public/components/guide_button.tsx
index 3e2df70298c60..89849d22e7652 100644
--- a/src/plugins/guided_onboarding/public/components/guide_button.tsx
+++ b/src/plugins/guided_onboarding/public/components/guide_button.tsx
@@ -75,12 +75,23 @@ export const GuideButton = ({
     </EuiButton>
   );
   // if there is no active guide
-  if (!pluginState || !pluginState.activeGuide || !pluginState.activeGuide.isActive) {
+  if (
+    !pluginState ||
+    !pluginState.activeGuide ||
+    !pluginState.activeGuide.isActive ||
+    // the guide has not started yet when the user just looks at the guide
+    // see https://github.com/elastic/kibana/issues/148912 for more context
+    pluginState.activeGuide.status === 'not_started'
+  ) {
     // if still active period and the user has not started a guide or skipped the guide,
     // display the button that redirects to the landing page
     if (
       pluginState?.isActivePeriod &&
-      (pluginState?.status === 'not_started' || pluginState?.status === 'skipped')
+      (pluginState?.status === 'not_started' ||
+        pluginState?.status === 'skipped' ||
+        // plugin state 'in_progress' without an active guide is when the guide has not started yet
+        // see https://github.com/elastic/kibana/issues/148912 for context
+        pluginState.status === 'in_progress')
     ) {
       return (
         <EuiButton
diff --git a/src/plugins/guided_onboarding/public/components/guide_panel.test.tsx b/src/plugins/guided_onboarding/public/components/guide_panel.test.tsx
index de86ad4048478..233d9c348c436 100644
--- a/src/plugins/guided_onboarding/public/components/guide_panel.test.tsx
+++ b/src/plugins/guided_onboarding/public/components/guide_panel.test.tsx
@@ -168,6 +168,16 @@ describe('Guided setup', () => {
           expect(exists('guideButton')).toBe(false);
         });
 
+        test('shows redirect button when a guide has been viewed but not started', async () => {
+          const { exists } = await setupComponentWithPluginStateMock(httpClient, {
+            status: 'in_progress',
+            isActivePeriod: true,
+            activeGuide: { ...testGuideStep1InProgressState, status: 'not_started' },
+          });
+          expect(exists('guideButtonRedirect')).toBe(true);
+          expect(exists('guideButton')).toBe(false);
+        });
+
         test('shows redirect button when a user skipped on the landing page', async () => {
           const { exists } = await setupComponentWithPluginStateMock(httpClient, {
             status: 'skipped',

From 9bf320f8f6a4552f96ea470679f3835d16f7e31b Mon Sep 17 00:00:00 2001
From: Jonathan Buttner <56361221+jonathan-buttner@users.noreply.github.com>
Date: Wed, 8 Feb 2023 09:02:56 -0500
Subject: [PATCH 121/134] [Cases] Fix flaky delete case test (#150476)

This PR adds some `await` to functions that might have been causing
flakiness for some of our end to end tests.

Fixes: https://github.com/elastic/kibana/issues/145502

Flaky test run:
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/1878
---
 x-pack/test/functional/services/cases/api.ts | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/x-pack/test/functional/services/cases/api.ts b/x-pack/test/functional/services/cases/api.ts
index d2c0fdf9415ba..1b461e60e7e2b 100644
--- a/x-pack/test/functional/services/cases/api.ts
+++ b/x-pack/test/functional/services/cases/api.ts
@@ -36,8 +36,8 @@ export function CasesAPIServiceProvider({ getService }: FtrProviderContext) {
         ...generateRandomCaseWithoutConnector(),
         ...overwrites,
       } as CasePostRequest;
-      const res = await createCaseAPI(kbnSupertest, caseData);
-      return res;
+
+      return createCaseAPI(kbnSupertest, caseData);
     },
 
     async createNthRandomCases(amount: number = 3) {
@@ -45,17 +45,14 @@ export function CasesAPIServiceProvider({ getService }: FtrProviderContext) {
         { length: amount },
         () => generateRandomCaseWithoutConnector() as CasePostRequest
       );
-      await pMap(
-        cases,
-        (caseData) => {
-          return createCaseAPI(kbnSupertest, caseData);
-        },
-        { concurrency: 4 }
-      );
+
+      await pMap(cases, async (caseData) => createCaseAPI(kbnSupertest, caseData), {
+        concurrency: 4,
+      });
     },
 
     async deleteAllCases() {
-      deleteAllCaseItems(es);
+      await deleteAllCaseItems(es);
     },
 
     async createAttachment({

From 987dcbf77bbe67af6525eb7ab69fbb3a73b59200 Mon Sep 17 00:00:00 2001
From: Dominique Clarke <dominique.clarke@elastic.co>
Date: Wed, 8 Feb 2023 09:11:47 -0500
Subject: [PATCH 122/134] [Synthetics] project monitors - support custom
 namespace (#150388)

## Summary

Relates to https://github.com/elastic/synthetics/issues/697

Allows custom namespaces for project monitors.

Returns an error when the custom namepsace defined is not
fleet-compliant.
---
 .../monitor_types_project.ts                  |   1 +
 .../normalizers/browser_monitor.ts            |   4 +-
 .../normalizers/common_fields.ts              |  28 ++-
 .../normalizers/http_monitor.ts               |   5 +-
 .../normalizers/icmp_monitor.ts               |   5 +-
 .../normalizers/tcp_monitor.ts                |   5 +-
 .../apis/synthetics/add_monitor_project.ts    | 219 ++++++++++++++++++
 7 files changed, 259 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/synthetics/common/runtime_types/monitor_management/monitor_types_project.ts b/x-pack/plugins/synthetics/common/runtime_types/monitor_management/monitor_types_project.ts
index cdb583cc9f88c..78f14122157f1 100644
--- a/x-pack/plugins/synthetics/common/runtime_types/monitor_management/monitor_types_project.ts
+++ b/x-pack/plugins/synthetics/common/runtime_types/monitor_management/monitor_types_project.ts
@@ -46,6 +46,7 @@ export const ProjectMonitorCodec = t.intersection([
     max_redirects: t.string,
     wait: t.string,
     hash: t.string,
+    namespace: t.string,
   }),
 ]);
 
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/browser_monitor.ts b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/browser_monitor.ts
index aa4a9eba6ff58..b8c6448b9e6e0 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/browser_monitor.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/browser_monitor.ts
@@ -29,7 +29,7 @@ export const getNormalizeBrowserFields = ({
 }: NormalizedProjectProps): NormalizerResult<BrowserFields> => {
   const defaultFields = DEFAULT_FIELDS[DataStream.BROWSER];
 
-  const commonFields = getNormalizeCommonFields({
+  const { errors, normalizedFields: commonFields } = getNormalizeCommonFields({
     locations,
     privateLocations,
     monitor,
@@ -86,6 +86,6 @@ export const getNormalizeBrowserFields = ({
       ...normalizedFields,
     },
     unsupportedKeys: [],
-    errors: [],
+    errors,
   };
 };
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/common_fields.ts b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/common_fields.ts
index 6ae8027d55107..e84990f5ac43a 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/common_fields.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/common_fields.ts
@@ -7,6 +7,7 @@
 
 import { omit } from 'lodash';
 import { i18n } from '@kbn/i18n';
+import { isValidNamespace } from '@kbn/fleet-plugin/common';
 import { formatLocation } from '../../../../common/utils/location_formatter';
 import { formatKibanaNamespace } from '../../../../common/formatters';
 import {
@@ -50,8 +51,15 @@ export const getNormalizeCommonFields = ({
   monitor,
   projectId,
   namespace,
-}: NormalizedProjectProps): Partial<CommonFields> => {
+}: NormalizedProjectProps): { errors: Error[]; normalizedFields: Partial<CommonFields> } => {
   const defaultFields = DEFAULT_COMMON_FIELDS;
+  const errors = [];
+  if (monitor.namespace) {
+    const namespaceError = isValidNamespace(monitor.namespace).error;
+    if (namespaceError) {
+      errors.push(getInvalidNamespaceError(monitor, namespaceError));
+    }
+  }
   const normalizedFields = {
     [ConfigKey.JOURNEY_ID]: monitor.id || defaultFields[ConfigKey.JOURNEY_ID],
     [ConfigKey.MONITOR_SOURCE_TYPE]: SourceType.PROJECT,
@@ -67,7 +75,8 @@ export const getNormalizeCommonFields = ({
       publicLocations: locations,
     }),
     [ConfigKey.TAGS]: getOptionalListField(monitor.tags) || defaultFields[ConfigKey.TAGS],
-    [ConfigKey.NAMESPACE]: formatKibanaNamespace(namespace) || defaultFields[ConfigKey.NAMESPACE],
+    [ConfigKey.NAMESPACE]:
+      monitor.namespace || formatKibanaNamespace(namespace) || defaultFields[ConfigKey.NAMESPACE],
     [ConfigKey.ORIGINAL_SPACE]: namespace || defaultFields[ConfigKey.NAMESPACE],
     [ConfigKey.CUSTOM_HEARTBEAT_ID]: getCustomHeartbeatId(monitor, projectId, namespace),
     [ConfigKey.ENABLED]: monitor.enabled ?? defaultFields[ConfigKey.ENABLED],
@@ -76,7 +85,7 @@ export const getNormalizeCommonFields = ({
       : defaultFields[ConfigKey.TIMEOUT],
     [ConfigKey.CONFIG_HASH]: monitor.hash || defaultFields[ConfigKey.CONFIG_HASH],
   };
-  return normalizedFields;
+  return { normalizedFields, errors };
 };
 
 export const getCustomHeartbeatId = (
@@ -128,6 +137,13 @@ const INVALID_CONFIGURATION_TITLE = i18n.translate(
   }
 );
 
+const INVALID_NAMESPACE_TITLE = i18n.translate(
+  'xpack.synthetics.projectMonitorApi.validation.invalidNamespace.title',
+  {
+    defaultMessage: 'Invalid namespace',
+  }
+);
+
 export const getUnsupportedKeysError = (
   monitor: ProjectMonitor,
   unsupportedKeys: string[],
@@ -163,6 +179,12 @@ export const getInvalidUrlsOrHostsError = (
   ),
 });
 
+export const getInvalidNamespaceError = (monitor: ProjectMonitor, error: string) => ({
+  id: monitor.id,
+  reason: INVALID_NAMESPACE_TITLE,
+  details: error,
+});
+
 export const getValueInSeconds = (value: string) => {
   const keyMap = {
     h: 60 * 60,
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.ts b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.ts
index 9d8585db686c0..cd7ac7a26f6dd 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.ts
@@ -37,7 +37,7 @@ export const getNormalizeHTTPFields = ({
   const defaultFields = DEFAULT_FIELDS[DataStream.HTTP];
   const errors = [];
   const { yamlConfig, unsupportedKeys } = normalizeYamlConfig(monitor);
-  const commonFields = getNormalizeCommonFields({
+  const { errors: commonErrors, normalizedFields: commonFields } = getNormalizeCommonFields({
     locations,
     privateLocations,
     monitor,
@@ -46,6 +46,9 @@ export const getNormalizeHTTPFields = ({
     version,
   });
 
+  // Add common erros to errors arary
+  errors.push(...commonErrors);
+
   /* Check if monitor has multiple urls */
   const urls = getOptionalListField(monitor.urls);
   if (urls.length !== 1) {
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/icmp_monitor.ts b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/icmp_monitor.ts
index e997fc3865298..b907c983d534b 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/icmp_monitor.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/icmp_monitor.ts
@@ -36,7 +36,7 @@ export const getNormalizeICMPFields = ({
   const errors = [];
   const { yamlConfig, unsupportedKeys } = normalizeYamlConfig(monitor);
 
-  const commonFields = getNormalizeCommonFields({
+  const { errors: commonErrors, normalizedFields: commonFields } = getNormalizeCommonFields({
     locations,
     privateLocations,
     monitor,
@@ -45,6 +45,9 @@ export const getNormalizeICMPFields = ({
     version,
   });
 
+  // Add common erros to errors arary
+  errors.push(...commonErrors);
+
   /* Check if monitor has multiple hosts */
   const hosts = getOptionalListField(monitor.hosts);
   if (hosts.length !== 1) {
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/tcp_monitor.ts b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/tcp_monitor.ts
index ecd8825f96f2a..9626937d98a7b 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/tcp_monitor.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/tcp_monitor.ts
@@ -37,7 +37,7 @@ export const getNormalizeTCPFields = ({
   const errors = [];
   const { yamlConfig, unsupportedKeys } = normalizeYamlConfig(monitor);
 
-  const commonFields = getNormalizeCommonFields({
+  const { errors: commonErrors, normalizedFields: commonFields } = getNormalizeCommonFields({
     locations,
     privateLocations,
     monitor,
@@ -46,6 +46,9 @@ export const getNormalizeTCPFields = ({
     version,
   });
 
+  // Add common erros to errors arary
+  errors.push(...commonErrors);
+
   /* Check if monitor has multiple hosts */
   const hosts = getOptionalListField(monitor.hosts);
   if (hosts.length !== 1) {
diff --git a/x-pack/test/api_integration/apis/synthetics/add_monitor_project.ts b/x-pack/test/api_integration/apis/synthetics/add_monitor_project.ts
index 0ac7d13808a2a..ba98b589f83b1 100644
--- a/x-pack/test/api_integration/apis/synthetics/add_monitor_project.ts
+++ b/x-pack/test/api_integration/apis/synthetics/add_monitor_project.ts
@@ -763,6 +763,225 @@ export default function ({ getService }: FtrProviderContext) {
       }
     });
 
+    it('project monitors - browser - handles custom namespace', async () => {
+      const project = `test-project-${uuidv4()}`;
+      const username = 'admin';
+      const roleName = `synthetics_admin`;
+      const password = `${username}-password`;
+      const SPACE_ID = `test-space-${uuidv4()}`;
+      const SPACE_NAME = `test-space-name ${uuidv4()}`;
+      const customNamespace = 'custom.namespace';
+      await kibanaServer.spaces.create({ id: SPACE_ID, name: SPACE_NAME });
+      try {
+        await security.role.create(roleName, {
+          kibana: [
+            {
+              feature: {
+                uptime: ['all'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        });
+        await security.user.create(username, {
+          password,
+          roles: [roleName],
+          full_name: 'a kibana user',
+        });
+        await supertestWithoutAuth
+          .put(
+            `/s/${SPACE_ID}${API_URLS.SYNTHETICS_MONITORS_PROJECT_UPDATE.replace(
+              '{projectName}',
+              project
+            )}`
+          )
+          .auth(username, password)
+          .set('kbn-xsrf', 'true')
+          .send({ monitors: [{ ...projectMonitors.monitors[0], namespace: customNamespace }] })
+          .expect(200);
+        // expect monitor not to have been deleted
+        const getResponse = await supertestWithoutAuth
+          .get(`/s/${SPACE_ID}${API_URLS.SYNTHETICS_MONITORS}`)
+          .auth(username, password)
+          .query({
+            filter: `${syntheticsMonitorType}.attributes.journey_id: ${projectMonitors.monitors[0].id}`,
+          })
+          .set('kbn-xsrf', 'true')
+          .expect(200);
+        const { monitors } = getResponse.body;
+        expect(monitors.length).eql(1);
+        expect(monitors[0].attributes[ConfigKey.NAMESPACE]).eql(customNamespace);
+      } finally {
+        await deleteMonitor(projectMonitors.monitors[0].id, project, SPACE_ID);
+        await security.user.delete(username);
+        await security.role.delete(roleName);
+      }
+    });
+
+    it('project monitors - lightweight - handles custom namespace', async () => {
+      const project = `test-project-${uuidv4()}`;
+      const username = 'admin';
+      const roleName = `synthetics_admin`;
+      const password = `${username}-password`;
+      const SPACE_ID = `test-space-${uuidv4()}`;
+      const SPACE_NAME = `test-space-name ${uuidv4()}`;
+      const customNamespace = 'custom.namespace';
+      await kibanaServer.spaces.create({ id: SPACE_ID, name: SPACE_NAME });
+      try {
+        await security.role.create(roleName, {
+          kibana: [
+            {
+              feature: {
+                uptime: ['all'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        });
+        await security.user.create(username, {
+          password,
+          roles: [roleName],
+          full_name: 'a kibana user',
+        });
+        await supertestWithoutAuth
+          .put(
+            `/s/${SPACE_ID}${API_URLS.SYNTHETICS_MONITORS_PROJECT_UPDATE.replace(
+              '{projectName}',
+              project
+            )}`
+          )
+          .auth(username, password)
+          .set('kbn-xsrf', 'true')
+          .send({ monitors: [{ ...httpProjectMonitors.monitors[1], namespace: customNamespace }] })
+          .expect(200);
+
+        // expect monitor not to have been deleted
+        const getResponse = await supertestWithoutAuth
+          .get(`/s/${SPACE_ID}${API_URLS.SYNTHETICS_MONITORS}`)
+          .auth(username, password)
+          .query({
+            filter: `${syntheticsMonitorType}.attributes.journey_id: ${httpProjectMonitors.monitors[1].id}`,
+          })
+          .set('kbn-xsrf', 'true')
+          .expect(200);
+        const { monitors } = getResponse.body;
+        expect(monitors.length).eql(1);
+        expect(monitors[0].attributes[ConfigKey.NAMESPACE]).eql(customNamespace);
+      } finally {
+        await deleteMonitor(httpProjectMonitors.monitors[1].id, project, SPACE_ID);
+        await security.user.delete(username);
+        await security.role.delete(roleName);
+      }
+    });
+
+    it('project monitors - browser - handles custom namespace errors', async () => {
+      const project = `test-project-${uuidv4()}`;
+      const username = 'admin';
+      const roleName = `synthetics_admin`;
+      const password = `${username}-password`;
+      const SPACE_ID = `test-space-${uuidv4()}`;
+      const SPACE_NAME = `test-space-name ${uuidv4()}`;
+      const customNamespace = 'custom-namespace';
+      await kibanaServer.spaces.create({ id: SPACE_ID, name: SPACE_NAME });
+      try {
+        await security.role.create(roleName, {
+          kibana: [
+            {
+              feature: {
+                uptime: ['all'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        });
+        await security.user.create(username, {
+          password,
+          roles: [roleName],
+          full_name: 'a kibana user',
+        });
+        const { body } = await supertestWithoutAuth
+          .put(
+            `/s/${SPACE_ID}${API_URLS.SYNTHETICS_MONITORS_PROJECT_UPDATE.replace(
+              '{projectName}',
+              project
+            )}`
+          )
+          .auth(username, password)
+          .set('kbn-xsrf', 'true')
+          .send({ monitors: [{ ...projectMonitors.monitors[0], namespace: customNamespace }] })
+          .expect(200);
+        // expect monitor not to have been deleted
+        expect(body).to.eql({
+          createdMonitors: [],
+          failedMonitors: [
+            {
+              details: 'Namespace contains invalid characters',
+              id: projectMonitors.monitors[0].id,
+              reason: 'Invalid namespace',
+            },
+          ],
+          updatedMonitors: [],
+        });
+      } finally {
+        await security.user.delete(username);
+        await security.role.delete(roleName);
+      }
+    });
+
+    it('project monitors - lightweight - handles custom namespace errors', async () => {
+      const project = `test-project-${uuidv4()}`;
+      const username = 'admin';
+      const roleName = `synthetics_admin`;
+      const password = `${username}-password`;
+      const SPACE_ID = `test-space-${uuidv4()}`;
+      const SPACE_NAME = `test-space-name ${uuidv4()}`;
+      const customNamespace = 'custom-namespace';
+      await kibanaServer.spaces.create({ id: SPACE_ID, name: SPACE_NAME });
+      try {
+        await security.role.create(roleName, {
+          kibana: [
+            {
+              feature: {
+                uptime: ['all'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        });
+        await security.user.create(username, {
+          password,
+          roles: [roleName],
+          full_name: 'a kibana user',
+        });
+        const { body } = await supertestWithoutAuth
+          .put(
+            `/s/${SPACE_ID}${API_URLS.SYNTHETICS_MONITORS_PROJECT_UPDATE.replace(
+              '{projectName}',
+              project
+            )}`
+          )
+          .auth(username, password)
+          .set('kbn-xsrf', 'true')
+          .send({ monitors: [{ ...httpProjectMonitors.monitors[1], namespace: customNamespace }] })
+          .expect(200);
+        // expect monitor not to have been deleted
+        expect(body).to.eql({
+          createdMonitors: [],
+          failedMonitors: [
+            {
+              details: 'Namespace contains invalid characters',
+              id: httpProjectMonitors.monitors[1].id,
+              reason: 'Invalid namespace',
+            },
+          ],
+          updatedMonitors: [],
+        });
+      } finally {
+        await security.user.delete(username);
+        await security.role.delete(roleName);
+      }
+    });
+
     it('project monitors - handles editing with spaces', async () => {
       const project = `test-project-${uuidv4()}`;
       const username = 'admin';

From 1bd6b370ab97ba08b8a52b02731a8f29199c81a1 Mon Sep 17 00:00:00 2001
From: Rodney Norris <rodney.norris@elastic.co>
Date: Wed, 8 Feb 2023 08:15:50 -0600
Subject: [PATCH 123/134] [Enterprise Search] remove link to engine schema page
 (#150498)

## Summary

Removing the link from the overview page fields stat to the schema page
since the schema page has not been added yet.
---
 .../components/engine/engine_overview.tsx     | 34 +++++++------------
 1 file changed, 13 insertions(+), 21 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview.tsx
index 83312c8290e21..20e60db46db80 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_overview.tsx
@@ -79,27 +79,19 @@ export const EngineOverview: React.FC = () => {
               </EuiFlexGroup>
             </EuiFlexItem>
             <EuiFlexItem>
-              <EuiLinkTo
-                to={generateEncodedPath(ENGINE_TAB_PATH, {
-                  engineName,
-                  tabId: EngineViewTabs.SCHEMA,
-                })}
-                color="text"
-              >
-                <EuiFlexGroup alignItems="center">
-                  <EuiIcon size="xxl" type="documents" color="#98A2B3" />
-                  <EuiStat
-                    titleSize="l"
-                    isLoading={false}
-                    title={fieldsCount.toLocaleString()}
-                    description={i18n.translate(
-                      'xpack.enterpriseSearch.content.engine.overview.fieldsDescription',
-                      { defaultMessage: 'Fields' }
-                    )}
-                    titleColor="primary"
-                  />
-                </EuiFlexGroup>
-              </EuiLinkTo>
+              <EuiFlexGroup alignItems="center">
+                <EuiIcon size="xxl" type="documents" color="#98A2B3" />
+                <EuiStat
+                  titleSize="l"
+                  isLoading={false}
+                  title={fieldsCount.toLocaleString()}
+                  description={i18n.translate(
+                    'xpack.enterpriseSearch.content.engine.overview.fieldsDescription',
+                    { defaultMessage: 'Fields' }
+                  )}
+                  titleColor="primary"
+                />
+              </EuiFlexGroup>
             </EuiFlexItem>
           </EuiFlexGroup>
         </EuiPanel>

From 91ff71005081f34ebcf7eeadbec2f0ea4405dcab Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@elastic.co>
Date: Wed, 8 Feb 2023 15:17:39 +0100
Subject: [PATCH 124/134] Preliminary DocumentMigrator cleanup (#150529)

Related to https://github.com/elastic/kibana/issues/150301

This PR tend to do some preliminary cleanup before diving into the
actual implementation. I'm mostly extracting things from the (way too
big and hard to read) document migrator, to increase readability,
maintainability and testability (note: I did not add additional unit
test for the extracted files, as I did not change the impl and as we'll
be rewriting them all soon enough - it would just have been a loss of
time)

- Move the document migrator from
`packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core`
to it's dedicated folder `document_migrator` folder
- Extract all the bits not directly performing the document
transformation (e.g building the migration map, validation, utils) to
their dedicated files
- Only moving things around. No concrete code (apart from types) was
modified, to ease managing conflicts with
https://github.com/elastic/kibana/pull/150443
---
 .../index.ts                                  |   2 +-
 .../src/core/index.ts                         |   2 +-
 .../src/core/migrate_raw_docs.ts              |   2 +-
 .../src/core/regenerate_object_id.ts          |  21 +
 .../build_active_migrations.ts                |  72 ++++
 .../document_migrator.test.mock.ts            |   0
 .../document_migrator.test.ts                 |   2 +-
 .../document_migrator.ts                      | 393 +-----------------
 .../src/document_migrator/index.ts            |   9 +
 .../document_migrator/internal_transforms.ts  | 115 +++++
 .../src/document_migrator/types.ts            |  73 ++++
 .../src/document_migrator/utils.ts            |  78 ++++
 .../document_migrator/validate_migrations.ts  | 121 ++++++
 .../src/index.ts                              |   2 +-
 .../src/kibana_migrator.test.ts               |   6 +-
 .../src/kibana_migrator.ts                    |   2 +-
 16 files changed, 502 insertions(+), 398 deletions(-)
 create mode 100644 packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/regenerate_object_id.ts
 create mode 100644 packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/build_active_migrations.ts
 rename packages/core/saved-objects/core-saved-objects-migration-server-internal/src/{core => document_migrator}/document_migrator.test.mock.ts (100%)
 rename packages/core/saved-objects/core-saved-objects-migration-server-internal/src/{core => document_migrator}/document_migrator.test.ts (99%)
 rename packages/core/saved-objects/core-saved-objects-migration-server-internal/src/{core => document_migrator}/document_migrator.ts (53%)
 create mode 100644 packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/index.ts
 create mode 100644 packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/internal_transforms.ts
 create mode 100644 packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/types.ts
 create mode 100644 packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/utils.ts
 create mode 100644 packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/validate_migrations.ts

diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/index.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/index.ts
index 1913a1c3de05e..21fbd6f8b5329 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/index.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/index.ts
@@ -52,9 +52,9 @@ export {
   isWriteBlockException,
   isIndexNotFoundException,
 } from './src/actions/es_errors';
-export { deterministicallyRegenerateObjectId } from './src/core/document_migrator';
 export {
   REMOVED_TYPES,
+  deterministicallyRegenerateObjectId,
   type DocumentsTransformFailed,
   type DocumentsTransformSuccess,
 } from './src/core';
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/index.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/index.ts
index 2b1cd0e955b43..81bacea4a0cbd 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/index.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/index.ts
@@ -6,11 +6,11 @@
  * Side Public License, v 1.
  */
 
-export { DocumentMigrator } from './document_migrator';
 export { buildActiveMappings } from './build_active_mappings';
 export type { LogFn } from './migration_logger';
 export { excludeUnusedTypesQuery, REMOVED_TYPES } from './unused_types';
 export { TransformSavedObjectDocumentError } from './transform_saved_object_document_error';
+export { deterministicallyRegenerateObjectId } from './regenerate_object_id';
 export type {
   DocumentsTransformFailed,
   DocumentsTransformSuccess,
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/migrate_raw_docs.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/migrate_raw_docs.ts
index d1ca65f1dd103..5c8ca0132ebf8 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/migrate_raw_docs.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/migrate_raw_docs.ts
@@ -17,7 +17,7 @@ import type {
   SavedObjectUnsanitizedDoc,
 } from '@kbn/core-saved-objects-server';
 import { SavedObjectsSerializer } from '@kbn/core-saved-objects-base-server-internal';
-import { MigrateAndConvertFn } from './document_migrator';
+import type { MigrateAndConvertFn } from '../document_migrator/document_migrator';
 import { TransformSavedObjectDocumentError } from '.';
 
 export interface DocumentsTransformFailed {
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/regenerate_object_id.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/regenerate_object_id.ts
new file mode 100644
index 0000000000000..eb6eec2dbb1c8
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/regenerate_object_id.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { v5 as uuidv5 } from 'uuid';
+
+/**
+ * Deterministically regenerates a saved object's ID based upon it's current namespace, type, and ID. This ensures that we can regenerate
+ * any existing object IDs without worrying about collisions if two objects that exist in different namespaces share an ID. It also ensures
+ * that we can later regenerate any inbound object references to match.
+ *
+ * @note This is only intended to be used when single-namespace object types are converted into multi-namespace object types.
+ * @internal
+ */
+export function deterministicallyRegenerateObjectId(namespace: string, type: string, id: string) {
+  return uuidv5(`${namespace}:${type}:${id}`, uuidv5.DNS); // the uuidv5 namespace constant (uuidv5.DNS) is arbitrary
+}
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/build_active_migrations.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/build_active_migrations.ts
new file mode 100644
index 0000000000000..e46dbac99ef01
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/build_active_migrations.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import _ from 'lodash';
+import type { Logger } from '@kbn/logging';
+import type { ISavedObjectTypeRegistry } from '@kbn/core-saved-objects-server';
+import type { Transform, ActiveMigrations } from './types';
+import { getReferenceTransforms, getConversionTransforms } from './internal_transforms';
+import { validateMigrationsMapObject } from './validate_migrations';
+import { transformComparator, wrapWithTry } from './utils';
+
+/**
+ * Converts migrations from a format that is convenient for callers to a format that
+ * is convenient for our internal usage:
+ * From: { type: { version: fn } }
+ * To:   { type: { latestMigrationVersion?: string; latestCoreMigrationVersion?: string; transforms: [{ version: string, transform: fn }] } }
+ */
+export function buildActiveMigrations(
+  typeRegistry: ISavedObjectTypeRegistry,
+  kibanaVersion: string,
+  log: Logger
+): ActiveMigrations {
+  const referenceTransforms = getReferenceTransforms(typeRegistry);
+
+  return typeRegistry.getAllTypes().reduce((migrations, type) => {
+    const migrationsMap =
+      typeof type.migrations === 'function' ? type.migrations() : type.migrations;
+    validateMigrationsMapObject(type.name, kibanaVersion, migrationsMap);
+
+    const migrationTransforms = Object.entries(migrationsMap ?? {}).map<Transform>(
+      ([version, transform]) => ({
+        version,
+        transform: wrapWithTry(version, type, transform, log),
+        transformType: 'migrate',
+      })
+    );
+    const conversionTransforms = getConversionTransforms(type);
+    const transforms = [
+      ...referenceTransforms,
+      ...conversionTransforms,
+      ...migrationTransforms,
+    ].sort(transformComparator);
+
+    if (!transforms.length) {
+      return migrations;
+    }
+
+    const migrationVersionTransforms: Transform[] = [];
+    const coreMigrationVersionTransforms: Transform[] = [];
+    transforms.forEach((x) => {
+      if (x.transformType === 'migrate' || x.transformType === 'convert') {
+        migrationVersionTransforms.push(x);
+      } else {
+        coreMigrationVersionTransforms.push(x);
+      }
+    });
+
+    return {
+      ...migrations,
+      [type.name]: {
+        latestMigrationVersion: _.last(migrationVersionTransforms)?.version,
+        latestCoreMigrationVersion: _.last(coreMigrationVersionTransforms)?.version,
+        transforms,
+      },
+    };
+  }, {} as ActiveMigrations);
+}
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/document_migrator.test.mock.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/document_migrator.test.mock.ts
similarity index 100%
rename from packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/document_migrator.test.mock.ts
rename to packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/document_migrator.test.mock.ts
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/document_migrator.test.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/document_migrator.test.ts
similarity index 99%
rename from packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/document_migrator.test.ts
rename to packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/document_migrator.test.ts
index dd64014f815bd..46ca8286d44a5 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/document_migrator.test.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/document_migrator.test.ts
@@ -15,7 +15,7 @@ import {
   LEGACY_URL_ALIAS_TYPE,
 } from '@kbn/core-saved-objects-base-server-internal';
 import { DocumentMigrator } from './document_migrator';
-import { TransformSavedObjectDocumentError } from './transform_saved_object_document_error';
+import { TransformSavedObjectDocumentError } from '../core/transform_saved_object_document_error';
 import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
 
 const mockLoggerFactory = loggingSystemMock.create();
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/document_migrator.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/document_migrator.ts
similarity index 53%
rename from packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/document_migrator.ts
rename to packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/document_migrator.ts
index ae50d7fac643a..c9c84cba261c1 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/document_migrator.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/document_migrator.ts
@@ -42,45 +42,22 @@
  */
 
 import Boom from '@hapi/boom';
-import { v5 as uuidv5 } from 'uuid';
 import { set } from '@kbn/safer-lodash-set';
 import _ from 'lodash';
 import Semver from 'semver';
 import type { Logger } from '@kbn/logging';
-import type {
-  SavedObjectsMigrationVersion,
-  SavedObjectsNamespaceType,
-} from '@kbn/core-saved-objects-common';
+import type { SavedObjectsMigrationVersion } from '@kbn/core-saved-objects-common';
 import type {
   SavedObjectUnsanitizedDoc,
-  SavedObjectsType,
   ISavedObjectTypeRegistry,
-  SavedObjectMigrationFn,
-  SavedObjectMigrationMap,
 } from '@kbn/core-saved-objects-server';
-import { DEFAULT_NAMESPACE_STRING, SavedObjectsUtils } from '@kbn/core-saved-objects-utils-server';
-import {
-  type LegacyUrlAlias,
-  LEGACY_URL_ALIAS_TYPE,
-} from '@kbn/core-saved-objects-base-server-internal';
-import { MigrationLogger } from './migration_logger';
-import { TransformSavedObjectDocumentError } from '.';
+import type { ActiveMigrations, TransformResult } from './types';
+import { buildActiveMigrations } from './build_active_migrations';
+import { validateMigrationDefinition } from './validate_migrations';
 
 export type MigrateFn = (doc: SavedObjectUnsanitizedDoc) => SavedObjectUnsanitizedDoc;
 export type MigrateAndConvertFn = (doc: SavedObjectUnsanitizedDoc) => SavedObjectUnsanitizedDoc[];
 
-interface TransformResult {
-  /**
-   * This is the original document that has been transformed.
-   */
-  transformedDoc: SavedObjectUnsanitizedDoc;
-  /**
-   * These are any new document(s) that have been created during the transformation process; these are not transformed, but they are marked
-   * as up-to-date. Only conversion transforms generate additional documents.
-   */
-  additionalDocs: SavedObjectUnsanitizedDoc[];
-}
-
 type ApplyTransformsFn = (
   doc: SavedObjectUnsanitizedDoc,
   options?: TransformOptions
@@ -97,35 +74,6 @@ interface DocumentMigratorOptions {
   log: Logger;
 }
 
-interface ActiveMigrations {
-  [type: string]: {
-    /** Derived from `migrate` transforms and `convert` transforms */
-    latestMigrationVersion?: string;
-    /** Derived from `reference` transforms */
-    latestCoreMigrationVersion?: string;
-    transforms: Transform[];
-  };
-}
-
-interface Transform {
-  version: string;
-  transform: (doc: SavedObjectUnsanitizedDoc) => TransformResult;
-  /**
-   * There are two "migrationVersion" transform types:
-   *   * `migrate` - These transforms are defined and added by consumers using the type registry; each is applied to a single object type
-   *     based on an object's `migrationVersion[type]` field. These are applied during index migrations and document migrations.
-   *   * `convert` - These transforms are defined by core and added by consumers using the type registry; each is applied to a single object
-   *     type based on an object's `migrationVersion[type]` field. These are applied during index migrations, NOT document migrations.
-   *
-   * There is one "coreMigrationVersion" transform type:
-   *   * `reference` - These transforms are defined by core and added by consumers using the type registry; they are applied to all object
-   *     types based on their `coreMigrationVersion` field. These are applied during index migrations, NOT document migrations.
-   *
-   * If any additional transform types are added, the functions below should be updated to account for them.
-   */
-  transformType: 'migrate' | 'convert' | 'reference';
-}
-
 /**
  * Manages migration of individual documents.
  */
@@ -156,7 +104,6 @@ export class DocumentMigrator implements VersionedTransformer {
    */
   constructor({ typeRegistry, kibanaVersion, convertVersion, log }: DocumentMigratorOptions) {
     validateMigrationDefinition(typeRegistry, kibanaVersion, convertVersion);
-
     this.documentMigratorOptions = { typeRegistry, kibanaVersion, log };
   }
 
@@ -241,170 +188,6 @@ export class DocumentMigrator implements VersionedTransformer {
   };
 }
 
-function validateMigrationsMapObject(
-  name: string,
-  kibanaVersion: string,
-  migrationsMap?: SavedObjectMigrationMap
-) {
-  function assertObject(obj: any, prefix: string) {
-    if (!obj || typeof obj !== 'object') {
-      throw new Error(`${prefix} Got ${obj}.`);
-    }
-  }
-
-  function assertValidSemver(version: string, type: string) {
-    if (!Semver.valid(version)) {
-      throw new Error(
-        `Invalid migration for type ${type}. Expected all properties to be semvers, but got ${version}.`
-      );
-    }
-    if (Semver.gt(version, kibanaVersion)) {
-      throw new Error(
-        `Invalid migration for type ${type}. Property '${version}' cannot be greater than the current Kibana version '${kibanaVersion}'.`
-      );
-    }
-  }
-
-  function assertValidTransform(fn: any, version: string, type: string) {
-    if (typeof fn !== 'function') {
-      throw new Error(`Invalid migration ${type}.${version}: expected a function, but got ${fn}.`);
-    }
-  }
-
-  if (migrationsMap) {
-    assertObject(
-      migrationsMap,
-      `Migrations map for type ${name} should be an object like { '2.0.0': (doc) => doc }.`
-    );
-
-    Object.entries(migrationsMap).forEach(([version, fn]) => {
-      assertValidSemver(version, name);
-      assertValidTransform(fn, version, name);
-    });
-  }
-}
-
-/**
- * Basic validation that the migration definition matches our expectations. We can't
- * rely on TypeScript here, as the caller may be JavaScript / ClojureScript / any compile-to-js
- * language. So, this is just to provide a little developer-friendly error messaging. Joi was
- * giving weird errors, so we're just doing manual validation.
- */
-function validateMigrationDefinition(
-  registry: ISavedObjectTypeRegistry,
-  kibanaVersion: string,
-  convertVersion?: string
-) {
-  function assertObjectOrFunction(entity: any, prefix: string) {
-    if (!entity || (typeof entity !== 'function' && typeof entity !== 'object')) {
-      throw new Error(`${prefix} Got! ${typeof entity}, ${JSON.stringify(entity)}.`);
-    }
-  }
-
-  function assertValidConvertToMultiNamespaceType(
-    namespaceType: SavedObjectsNamespaceType,
-    convertToMultiNamespaceTypeVersion: string,
-    type: string
-  ) {
-    if (namespaceType !== 'multiple' && namespaceType !== 'multiple-isolated') {
-      throw new Error(
-        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Expected namespaceType to be 'multiple' or 'multiple-isolated', but got '${namespaceType}'.`
-      );
-    } else if (!Semver.valid(convertToMultiNamespaceTypeVersion)) {
-      throw new Error(
-        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Expected value to be a semver, but got '${convertToMultiNamespaceTypeVersion}'.`
-      );
-    } else if (convertVersion && Semver.neq(convertToMultiNamespaceTypeVersion, convertVersion)) {
-      throw new Error(
-        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Value '${convertToMultiNamespaceTypeVersion}' cannot be any other than '${convertVersion}'.`
-      );
-    } else if (Semver.gt(convertToMultiNamespaceTypeVersion, kibanaVersion)) {
-      throw new Error(
-        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Value '${convertToMultiNamespaceTypeVersion}' cannot be greater than the current Kibana version '${kibanaVersion}'.`
-      );
-    } else if (Semver.patch(convertToMultiNamespaceTypeVersion)) {
-      throw new Error(
-        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Value '${convertToMultiNamespaceTypeVersion}' cannot be used on a patch version (must be like 'x.y.0').`
-      );
-    }
-  }
-
-  registry.getAllTypes().forEach((type) => {
-    const { name, migrations, convertToMultiNamespaceTypeVersion, namespaceType } = type;
-    if (migrations) {
-      assertObjectOrFunction(
-        type.migrations,
-        `Migration for type ${name} should be an object or a function returning an object like { '2.0.0': (doc) => doc }.`
-      );
-    }
-    if (convertToMultiNamespaceTypeVersion) {
-      // CHECKPOINT 1
-      assertValidConvertToMultiNamespaceType(
-        namespaceType,
-        convertToMultiNamespaceTypeVersion,
-        name
-      );
-    }
-  });
-}
-
-/**
- * Converts migrations from a format that is convenient for callers to a format that
- * is convenient for our internal usage:
- * From: { type: { version: fn } }
- * To:   { type: { latestMigrationVersion?: string; latestCoreMigrationVersion?: string; transforms: [{ version: string, transform: fn }] } }
- */
-function buildActiveMigrations(
-  typeRegistry: ISavedObjectTypeRegistry,
-  kibanaVersion: string,
-  log: Logger
-): ActiveMigrations {
-  const referenceTransforms = getReferenceTransforms(typeRegistry);
-
-  return typeRegistry.getAllTypes().reduce((migrations, type) => {
-    const migrationsMap =
-      typeof type.migrations === 'function' ? type.migrations() : type.migrations;
-    validateMigrationsMapObject(type.name, kibanaVersion, migrationsMap);
-
-    const migrationTransforms = Object.entries(migrationsMap ?? {}).map<Transform>(
-      ([version, transform]) => ({
-        version,
-        transform: wrapWithTry(version, type, transform, log),
-        transformType: 'migrate',
-      })
-    );
-    const conversionTransforms = getConversionTransforms(type);
-    const transforms = [
-      ...referenceTransforms,
-      ...conversionTransforms,
-      ...migrationTransforms,
-    ].sort(transformComparator);
-
-    if (!transforms.length) {
-      return migrations;
-    }
-
-    const migrationVersionTransforms: Transform[] = [];
-    const coreMigrationVersionTransforms: Transform[] = [];
-    transforms.forEach((x) => {
-      if (x.transformType === 'migrate' || x.transformType === 'convert') {
-        migrationVersionTransforms.push(x);
-      } else {
-        coreMigrationVersionTransforms.push(x);
-      }
-    });
-
-    return {
-      ...migrations,
-      [type.name]: {
-        latestMigrationVersion: _.last(migrationVersionTransforms)?.version,
-        latestCoreMigrationVersion: _.last(coreMigrationVersionTransforms)?.version,
-        transforms,
-      },
-    };
-  }, {} as ActiveMigrations);
-}
-
 /**
  * Creates a function which migrates and validates any document that is passed to it.
  */
@@ -528,162 +311,6 @@ function markAsUpToDate(
   };
 }
 
-/**
- * Converts a single-namespace object to a multi-namespace object. This primarily entails removing the `namespace` field and adding the
- * `namespaces` field.
- *
- * If the object does not exist in the default namespace (undefined), its ID is also regenerated, and an "originId" is added to preserve
- * legacy import/copy behavior.
- */
-function convertNamespaceType(doc: SavedObjectUnsanitizedDoc) {
-  const { namespace, ...otherAttrs } = doc;
-  const additionalDocs: SavedObjectUnsanitizedDoc[] = [];
-
-  // If this object exists in the default namespace, return it with the appropriate `namespaces` field without changing its ID.
-  if (namespace === undefined) {
-    return {
-      transformedDoc: { ...otherAttrs, namespaces: [DEFAULT_NAMESPACE_STRING] },
-      additionalDocs,
-    };
-  }
-
-  const { id: originId, type } = otherAttrs;
-  const id = SavedObjectsUtils.getConvertedObjectId(namespace, type, originId!);
-  const legacyUrlAlias: SavedObjectUnsanitizedDoc<LegacyUrlAlias> = {
-    id: `${namespace}:${type}:${originId}`,
-    type: LEGACY_URL_ALIAS_TYPE,
-    attributes: {
-      // NOTE TO MAINTAINERS: If a saved object migration is added in `src/core/server/saved_objects/object_types/registration.ts`, these
-      // values must be updated accordingly. That's because a user can upgrade Kibana from 7.17 to 8.x, and any defined migrations will not
-      // be applied to aliases that are created during the conversion process.
-      sourceId: originId,
-      targetNamespace: namespace,
-      targetType: type,
-      targetId: id,
-      purpose: 'savedObjectConversion',
-    },
-  };
-  additionalDocs.push(legacyUrlAlias);
-  return {
-    transformedDoc: { ...otherAttrs, id, originId, namespaces: [namespace] },
-    additionalDocs,
-  };
-}
-
-/**
- * Returns all applicable conversion transforms for a given object type.
- */
-function getConversionTransforms(type: SavedObjectsType): Transform[] {
-  const { convertToMultiNamespaceTypeVersion } = type;
-  if (!convertToMultiNamespaceTypeVersion) {
-    return [];
-  }
-  return [
-    {
-      version: convertToMultiNamespaceTypeVersion,
-      transform: convertNamespaceType,
-      transformType: 'convert',
-    },
-  ];
-}
-
-/**
- * Returns all applicable reference transforms for all object types.
- */
-function getReferenceTransforms(typeRegistry: ISavedObjectTypeRegistry): Transform[] {
-  const transformMap = typeRegistry
-    .getAllTypes()
-    .filter((type) => type.convertToMultiNamespaceTypeVersion)
-    .reduce((acc, { convertToMultiNamespaceTypeVersion: version, name }) => {
-      const types = acc.get(version!) ?? new Set();
-      return acc.set(version!, types.add(name));
-    }, new Map<string, Set<string>>());
-
-  return Array.from(transformMap, ([version, types]) => ({
-    version,
-    transform: (doc) => {
-      const { namespace, references } = doc;
-      if (namespace && references?.length) {
-        return {
-          transformedDoc: {
-            ...doc,
-            references: references.map(({ type, id, ...attrs }) => ({
-              ...attrs,
-              type,
-              id: types.has(type)
-                ? SavedObjectsUtils.getConvertedObjectId(namespace, type, id)
-                : id,
-            })),
-          },
-          additionalDocs: [],
-        };
-      }
-      return { transformedDoc: doc, additionalDocs: [] };
-    },
-    transformType: 'reference',
-  }));
-}
-
-/**
- * Transforms are sorted in ascending order by version. One version may contain multiple transforms; 'reference' transforms always run
- * first, 'convert' transforms always run second, and 'migrate' transforms always run last. This is because:
- *  1. 'convert' transforms get rid of the `namespace` field, which must be present for 'reference' transforms to function correctly.
- *  2. 'migrate' transforms are defined by the consumer, and may change the object type or migrationVersion which resets the migration loop
- *     and could cause any remaining transforms for this version to be skipped.
- */
-function transformComparator(a: Transform, b: Transform) {
-  const semver = Semver.compare(a.version, b.version);
-  if (semver !== 0) {
-    return semver;
-  } else if (a.transformType !== b.transformType) {
-    if (a.transformType === 'migrate') {
-      return 1;
-    } else if (b.transformType === 'migrate') {
-      return -1;
-    } else if (a.transformType === 'convert') {
-      return 1;
-    } else if (b.transformType === 'convert') {
-      return -1;
-    }
-  }
-  return 0;
-}
-
-/**
- * If a specific transform function fails, this tacks on a bit of information
- * about the document and transform that caused the failure.
- */
-function wrapWithTry(
-  version: string,
-  type: SavedObjectsType,
-  migrationFn: SavedObjectMigrationFn,
-  log: Logger
-) {
-  const context = Object.freeze({
-    log: new MigrationLogger(log),
-    migrationVersion: version,
-    convertToMultiNamespaceTypeVersion: type.convertToMultiNamespaceTypeVersion,
-    isSingleNamespaceType: type.namespaceType === 'single',
-  });
-
-  return function tryTransformDoc(doc: SavedObjectUnsanitizedDoc) {
-    try {
-      const result = migrationFn(doc, context);
-
-      // A basic check to help migration authors detect basic errors
-      // (e.g. forgetting to return the transformed doc)
-      if (!result || !result.type) {
-        throw new Error(`Invalid saved object returned from migration ${type.name}:${version}.`);
-      }
-
-      return { transformedDoc: result, additionalDocs: [] };
-    } catch (error) {
-      log.error(error);
-      throw new TransformSavedObjectDocumentError(error, version);
-    }
-  };
-}
-
 /**
  * Determines whether or not a document has any pending transforms that should be applied based on its coreMigrationVersion field.
  * Currently, only reference transforms qualify.
@@ -834,15 +461,3 @@ function assertNoDowngrades(
     );
   }
 }
-
-/**
- * Deterministically regenerates a saved object's ID based upon it's current namespace, type, and ID. This ensures that we can regenerate
- * any existing object IDs without worrying about collisions if two objects that exist in different namespaces share an ID. It also ensures
- * that we can later regenerate any inbound object references to match.
- *
- * @note This is only intended to be used when single-namespace object types are converted into multi-namespace object types.
- * @internal
- */
-export function deterministicallyRegenerateObjectId(namespace: string, type: string, id: string) {
-  return uuidv5(`${namespace}:${type}:${id}`, uuidv5.DNS); // the uuidv5 namespace constant (uuidv5.DNS) is arbitrary
-}
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/index.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/index.ts
new file mode 100644
index 0000000000000..f34053388d764
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { DocumentMigrator, type VersionedTransformer } from './document_migrator';
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/internal_transforms.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/internal_transforms.ts
new file mode 100644
index 0000000000000..d94865f23677b
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/internal_transforms.ts
@@ -0,0 +1,115 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import {
+  ISavedObjectTypeRegistry,
+  SavedObjectsType,
+  SavedObjectUnsanitizedDoc,
+} from '@kbn/core-saved-objects-server';
+import { DEFAULT_NAMESPACE_STRING, SavedObjectsUtils } from '@kbn/core-saved-objects-utils-server';
+import {
+  LEGACY_URL_ALIAS_TYPE,
+  LegacyUrlAlias,
+} from '@kbn/core-saved-objects-base-server-internal';
+import type { Transform } from './types';
+
+/**
+ * Returns all applicable conversion transforms for a given object type.
+ */
+export function getConversionTransforms(type: SavedObjectsType): Transform[] {
+  const { convertToMultiNamespaceTypeVersion } = type;
+  if (!convertToMultiNamespaceTypeVersion) {
+    return [];
+  }
+  return [
+    {
+      version: convertToMultiNamespaceTypeVersion,
+      transform: convertNamespaceType,
+      transformType: 'convert',
+    },
+  ];
+}
+
+/**
+ * Returns all applicable reference transforms for all object types.
+ */
+export function getReferenceTransforms(typeRegistry: ISavedObjectTypeRegistry): Transform[] {
+  const transformMap = typeRegistry
+    .getAllTypes()
+    .filter((type) => type.convertToMultiNamespaceTypeVersion)
+    .reduce((acc, { convertToMultiNamespaceTypeVersion: version, name }) => {
+      const types = acc.get(version!) ?? new Set();
+      return acc.set(version!, types.add(name));
+    }, new Map<string, Set<string>>());
+
+  return Array.from(transformMap, ([version, types]) => ({
+    version,
+    transform: (doc) => {
+      const { namespace, references } = doc;
+      if (namespace && references?.length) {
+        return {
+          transformedDoc: {
+            ...doc,
+            references: references.map(({ type, id, ...attrs }) => ({
+              ...attrs,
+              type,
+              id: types.has(type)
+                ? SavedObjectsUtils.getConvertedObjectId(namespace, type, id)
+                : id,
+            })),
+          },
+          additionalDocs: [],
+        };
+      }
+      return { transformedDoc: doc, additionalDocs: [] };
+    },
+    transformType: 'reference',
+  }));
+}
+
+/**
+ * Converts a single-namespace object to a multi-namespace object. This primarily entails removing the `namespace` field and adding the
+ * `namespaces` field.
+ *
+ * If the object does not exist in the default namespace (undefined), its ID is also regenerated, and an "originId" is added to preserve
+ * legacy import/copy behavior.
+ */
+function convertNamespaceType(doc: SavedObjectUnsanitizedDoc) {
+  const { namespace, ...otherAttrs } = doc;
+  const additionalDocs: SavedObjectUnsanitizedDoc[] = [];
+
+  // If this object exists in the default namespace, return it with the appropriate `namespaces` field without changing its ID.
+  if (namespace === undefined) {
+    return {
+      transformedDoc: { ...otherAttrs, namespaces: [DEFAULT_NAMESPACE_STRING] },
+      additionalDocs,
+    };
+  }
+
+  const { id: originId, type } = otherAttrs;
+  const id = SavedObjectsUtils.getConvertedObjectId(namespace, type, originId!);
+  const legacyUrlAlias: SavedObjectUnsanitizedDoc<LegacyUrlAlias> = {
+    id: `${namespace}:${type}:${originId}`,
+    type: LEGACY_URL_ALIAS_TYPE,
+    attributes: {
+      // NOTE TO MAINTAINERS: If a saved object migration is added in `src/core/server/saved_objects/object_types/registration.ts`, these
+      // values must be updated accordingly. That's because a user can upgrade Kibana from 7.17 to 8.x, and any defined migrations will not
+      // be applied to aliases that are created during the conversion process.
+      sourceId: originId,
+      targetNamespace: namespace,
+      targetType: type,
+      targetId: id,
+      purpose: 'savedObjectConversion',
+    },
+  };
+  additionalDocs.push(legacyUrlAlias);
+  return {
+    transformedDoc: { ...otherAttrs, id, originId, namespaces: [namespace] },
+    additionalDocs,
+  };
+}
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/types.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/types.ts
new file mode 100644
index 0000000000000..3c9c836923caa
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/types.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { SavedObjectUnsanitizedDoc } from '@kbn/core-saved-objects-server';
+
+/**
+ * Map containing all the info to convert types
+ */
+export interface ActiveMigrations {
+  [type: string]: TypeConversion;
+}
+
+/**
+ * Structure containing all the required info to perform a type's conversion
+ */
+export interface TypeConversion {
+  /** Derived from `migrate` transforms and `convert` transforms */
+  latestMigrationVersion?: string;
+  /** Derived from `reference` transforms */
+  latestCoreMigrationVersion?: string;
+  /** List of transforms registered for the type **/
+  transforms: Transform[];
+}
+
+/**
+ * Internal representation of a document transformation
+ */
+export interface Transform {
+  /** The version this transform is registered for */
+  version: string;
+  /** The transformation function */
+  transform: TransformFn;
+  /** The type of this transform */
+  transformType: TransformType;
+}
+
+/**
+ * There are two "migrationVersion" transform types:
+ *   * `migrate` - These transforms are defined and added by consumers using the type registry; each is applied to a single object type
+ *     based on an object's `migrationVersion[type]` field. These are applied during index migrations and document migrations.
+ *   * `convert` - These transforms are defined by core and added by consumers using the type registry; each is applied to a single object
+ *     type based on an object's `migrationVersion[type]` field. These are applied during index migrations, NOT document migrations.
+ *
+ * There is one "coreMigrationVersion" transform type:
+ *   * `reference` - These transforms are defined by core and added by consumers using the type registry; they are applied to all object
+ *     types based on their `coreMigrationVersion` field. These are applied during index migrations, NOT document migrations.
+ */
+export type TransformType = 'migrate' | 'convert' | 'reference';
+
+/**
+ * Transformation function for a {@link Transform}
+ */
+export type TransformFn = (doc: SavedObjectUnsanitizedDoc) => TransformResult;
+
+/**
+ * Return type for a {@link TransformFn}
+ */
+export interface TransformResult {
+  /**
+   * This is the original document that has been transformed.
+   */
+  transformedDoc: SavedObjectUnsanitizedDoc;
+  /**
+   * These are any new document(s) that have been created during the transformation process; these are not transformed, but they are marked
+   * as up-to-date. Only conversion transforms generate additional documents.
+   */
+  additionalDocs: SavedObjectUnsanitizedDoc[];
+}
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/utils.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/utils.ts
new file mode 100644
index 0000000000000..a6a78a2c6baa8
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/utils.ts
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import Semver from 'semver';
+import {
+  SavedObjectMigrationFn,
+  SavedObjectsType,
+  SavedObjectUnsanitizedDoc,
+} from '@kbn/core-saved-objects-server';
+import { Logger } from '@kbn/logging';
+import { MigrationLogger } from '../core/migration_logger';
+import { TransformSavedObjectDocumentError } from '../core/transform_saved_object_document_error';
+import type { Transform, TransformFn } from './types';
+
+/**
+ * If a specific transform function fails, this tacks on a bit of information
+ * about the document and transform that caused the failure.
+ */
+export function wrapWithTry(
+  version: string,
+  type: SavedObjectsType,
+  migrationFn: SavedObjectMigrationFn,
+  log: Logger
+): TransformFn {
+  const context = Object.freeze({
+    log: new MigrationLogger(log),
+    migrationVersion: version,
+    convertToMultiNamespaceTypeVersion: type.convertToMultiNamespaceTypeVersion,
+    isSingleNamespaceType: type.namespaceType === 'single',
+  });
+
+  return function tryTransformDoc(doc: SavedObjectUnsanitizedDoc) {
+    try {
+      const result = migrationFn(doc, context);
+
+      // A basic check to help migration authors detect basic errors
+      // (e.g. forgetting to return the transformed doc)
+      if (!result || !result.type) {
+        throw new Error(`Invalid saved object returned from migration ${type.name}:${version}.`);
+      }
+
+      return { transformedDoc: result, additionalDocs: [] };
+    } catch (error) {
+      log.error(error);
+      throw new TransformSavedObjectDocumentError(error, version);
+    }
+  };
+}
+
+/**
+ * Transforms are sorted in ascending order by version. One version may contain multiple transforms; 'reference' transforms always run
+ * first, 'convert' transforms always run second, and 'migrate' transforms always run last. This is because:
+ *  1. 'convert' transforms get rid of the `namespace` field, which must be present for 'reference' transforms to function correctly.
+ *  2. 'migrate' transforms are defined by the consumer, and may change the object type or migrationVersion which resets the migration loop
+ *     and could cause any remaining transforms for this version to be skipped.
+ */
+export function transformComparator(a: Transform, b: Transform) {
+  const semver = Semver.compare(a.version, b.version);
+  if (semver !== 0) {
+    return semver;
+  } else if (a.transformType !== b.transformType) {
+    if (a.transformType === 'migrate') {
+      return 1;
+    } else if (b.transformType === 'migrate') {
+      return -1;
+    } else if (a.transformType === 'convert') {
+      return 1;
+    } else if (b.transformType === 'convert') {
+      return -1;
+    }
+  }
+  return 0;
+}
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/validate_migrations.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/validate_migrations.ts
new file mode 100644
index 0000000000000..463ee85ac1808
--- /dev/null
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/validate_migrations.ts
@@ -0,0 +1,121 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import Semver from 'semver';
+import type { SavedObjectsNamespaceType } from '@kbn/core-saved-objects-common';
+import type {
+  SavedObjectMigrationMap,
+  ISavedObjectTypeRegistry,
+} from '@kbn/core-saved-objects-server';
+
+/**
+ * Basic validation that the migration definition matches our expectations. We can't
+ * rely on TypeScript here, as the caller may be JavaScript / ClojureScript / any compile-to-js
+ * language. So, this is just to provide a little developer-friendly error messaging. Joi was
+ * giving weird errors, so we're just doing manual validation.
+ */
+export function validateMigrationDefinition(
+  registry: ISavedObjectTypeRegistry,
+  kibanaVersion: string,
+  convertVersion?: string
+) {
+  function assertObjectOrFunction(entity: any, prefix: string) {
+    if (!entity || (typeof entity !== 'function' && typeof entity !== 'object')) {
+      throw new Error(`${prefix} Got! ${typeof entity}, ${JSON.stringify(entity)}.`);
+    }
+  }
+
+  function assertValidConvertToMultiNamespaceType(
+    namespaceType: SavedObjectsNamespaceType,
+    convertToMultiNamespaceTypeVersion: string,
+    type: string
+  ) {
+    if (namespaceType !== 'multiple' && namespaceType !== 'multiple-isolated') {
+      throw new Error(
+        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Expected namespaceType to be 'multiple' or 'multiple-isolated', but got '${namespaceType}'.`
+      );
+    } else if (!Semver.valid(convertToMultiNamespaceTypeVersion)) {
+      throw new Error(
+        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Expected value to be a semver, but got '${convertToMultiNamespaceTypeVersion}'.`
+      );
+    } else if (convertVersion && Semver.neq(convertToMultiNamespaceTypeVersion, convertVersion)) {
+      throw new Error(
+        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Value '${convertToMultiNamespaceTypeVersion}' cannot be any other than '${convertVersion}'.`
+      );
+    } else if (Semver.gt(convertToMultiNamespaceTypeVersion, kibanaVersion)) {
+      throw new Error(
+        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Value '${convertToMultiNamespaceTypeVersion}' cannot be greater than the current Kibana version '${kibanaVersion}'.`
+      );
+    } else if (Semver.patch(convertToMultiNamespaceTypeVersion)) {
+      throw new Error(
+        `Invalid convertToMultiNamespaceTypeVersion for type ${type}. Value '${convertToMultiNamespaceTypeVersion}' cannot be used on a patch version (must be like 'x.y.0').`
+      );
+    }
+  }
+
+  registry.getAllTypes().forEach((type) => {
+    const { name, migrations, convertToMultiNamespaceTypeVersion, namespaceType } = type;
+    if (migrations) {
+      assertObjectOrFunction(
+        type.migrations,
+        `Migration for type ${name} should be an object or a function returning an object like { '2.0.0': (doc) => doc }.`
+      );
+    }
+    if (convertToMultiNamespaceTypeVersion) {
+      // CHECKPOINT 1
+      assertValidConvertToMultiNamespaceType(
+        namespaceType,
+        convertToMultiNamespaceTypeVersion,
+        name
+      );
+    }
+  });
+}
+
+export function validateMigrationsMapObject(
+  name: string,
+  kibanaVersion: string,
+  migrationsMap?: SavedObjectMigrationMap
+) {
+  function assertObject(obj: any, prefix: string) {
+    if (!obj || typeof obj !== 'object') {
+      throw new Error(`${prefix} Got ${obj}.`);
+    }
+  }
+
+  function assertValidSemver(version: string, type: string) {
+    if (!Semver.valid(version)) {
+      throw new Error(
+        `Invalid migration for type ${type}. Expected all properties to be semvers, but got ${version}.`
+      );
+    }
+    if (Semver.gt(version, kibanaVersion)) {
+      throw new Error(
+        `Invalid migration for type ${type}. Property '${version}' cannot be greater than the current Kibana version '${kibanaVersion}'.`
+      );
+    }
+  }
+
+  function assertValidTransform(fn: any, version: string, type: string) {
+    if (typeof fn !== 'function') {
+      throw new Error(`Invalid migration ${type}.${version}: expected a function, but got ${fn}.`);
+    }
+  }
+
+  if (migrationsMap) {
+    assertObject(
+      migrationsMap,
+      `Migrations map for type ${name} should be an object like { '2.0.0': (doc) => doc }.`
+    );
+
+    Object.entries(migrationsMap).forEach(([version, fn]) => {
+      assertValidSemver(version, name);
+      assertValidTransform(fn, version, name);
+    });
+  }
+}
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/index.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/index.ts
index 7f520531f22e6..b50f64a26620d 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/index.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/index.ts
@@ -9,4 +9,4 @@
 export { KibanaMigrator, mergeTypes } from './kibana_migrator';
 export type { KibanaMigratorOptions } from './kibana_migrator';
 export { buildActiveMappings } from './core';
-export { DocumentMigrator } from './core';
+export { DocumentMigrator } from './document_migrator';
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/kibana_migrator.test.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/kibana_migrator.test.ts
index 4e8dcdd7c7f54..655f164b831cf 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/kibana_migrator.test.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/kibana_migrator.test.ts
@@ -14,16 +14,16 @@ import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-m
 import type { SavedObjectsType } from '@kbn/core-saved-objects-server';
 import { SavedObjectTypeRegistry } from '@kbn/core-saved-objects-base-server-internal';
 import { type KibanaMigratorOptions, KibanaMigrator } from './kibana_migrator';
-import { DocumentMigrator } from './core/document_migrator';
+import { DocumentMigrator } from './document_migrator';
 import { ByteSizeValue } from '@kbn/config-schema';
 import { docLinksServiceMock } from '@kbn/core-doc-links-server-mocks';
 import { lastValueFrom } from 'rxjs';
 
-jest.mock('./core/document_migrator', () => {
+jest.mock('./document_migrator', () => {
   return {
     // Create a mock for spying on the constructor
     DocumentMigrator: jest.fn().mockImplementation((...args) => {
-      const { DocumentMigrator: RealDocMigrator } = jest.requireActual('./core/document_migrator');
+      const { DocumentMigrator: RealDocMigrator } = jest.requireActual('./document_migrator');
       return new RealDocMigrator(args[0]);
     }),
   };
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/kibana_migrator.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/kibana_migrator.ts
index 58a5a741a6163..fa0c88629758b 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/kibana_migrator.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/kibana_migrator.ts
@@ -32,7 +32,7 @@ import {
   type MigrationResult,
 } from '@kbn/core-saved-objects-base-server-internal';
 import { buildActiveMappings } from './core';
-import { DocumentMigrator, type VersionedTransformer } from './core/document_migrator';
+import { DocumentMigrator, type VersionedTransformer } from './document_migrator';
 import { createIndexMap } from './core/build_index_map';
 import { runResilientMigrator } from './run_resilient_migrator';
 import { migrateRawDocsSafely } from './core/migrate_raw_docs';

From 8b816c32ccd7c362a2e6609ac88076b0e7b9d616 Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Wed, 8 Feb 2023 16:47:58 +0200
Subject: [PATCH 125/134] [Convert2Lens] Do not carry filters/query from
 dashboard to the converted embeddable (#150526)

## Summary

Closes https://github.com/elastic/kibana/issues/150283

When a user navigates from another app to Lens with context (Discover,
legacy editors, dashboard convert to Lens action) then the filters and
query from the originating app are carried to Lens. This makes sense for
the first 2 but not for the latter as we don't want to carry the
dahsboard search context to the Lens editor.


![lens](https://user-images.githubusercontent.com/17003240/217473766-afe827a1-81db-4093-800f-450d33932507.gif)


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---
 x-pack/plugins/lens/public/app_plugin/mounter.tsx           | 6 ++++++
 .../apps/lens/open_in_lens/dashboard/dashboard.ts           | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/x-pack/plugins/lens/public/app_plugin/mounter.tsx b/x-pack/plugins/lens/public/app_plugin/mounter.tsx
index 916664feffd84..45de1597148a7 100644
--- a/x-pack/plugins/lens/public/app_plugin/mounter.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/mounter.tsx
@@ -310,6 +310,12 @@ export async function mountApp(
         if (!initialContext) {
           data.query.filterManager.setAppFilters([]);
         }
+        // if user comes from a dashboard to convert a legacy viz to a Lens chart
+        // we clear up the dashboard filters and query
+        if (initialContext && 'isEmbeddable' in initialContext && initialContext.isEmbeddable) {
+          data.query.filterManager.setAppFilters([]);
+          data.query.queryString.clearQuery();
+        }
         lensStore.dispatch(setState(getPreloadedState(storeDeps) as LensAppState));
         lensStore.dispatch(loadInitial({ redirectCallback, initialInput, history: props.history }));
       }, [initialInput, props.history, redirectCallback]);
diff --git a/x-pack/test/functional/apps/lens/open_in_lens/dashboard/dashboard.ts b/x-pack/test/functional/apps/lens/open_in_lens/dashboard/dashboard.ts
index b6c94a4f32969..47846ba3641a6 100644
--- a/x-pack/test/functional/apps/lens/open_in_lens/dashboard/dashboard.ts
+++ b/x-pack/test/functional/apps/lens/open_in_lens/dashboard/dashboard.ts
@@ -22,6 +22,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const retry = getService('retry');
   const panelActions = getService('dashboardPanelActions');
   const dashboardAddPanel = getService('dashboardAddPanel');
+  const filterBar = getService('filterBar');
 
   describe('Convert to Lens action on dashboard', function describeIndexTests() {
     before(async () => {
@@ -37,6 +38,9 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       await testSubjects.exists('visualizesaveAndReturnButton');
       await testSubjects.click('visualizesaveAndReturnButton');
       await dashboard.waitForRenderComplete();
+      // define a filter
+      await filterBar.addFilter({ field: 'geo.src', operation: 'is', value: 'CN' });
+      await dashboard.waitForRenderComplete();
       expect(await dashboard.isNotificationExists(0)).to.be(true);
     });
 
@@ -46,6 +50,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       await lens.waitForVisualization('xyVisChart');
       const lastBreadcrumbdcrumb = await testSubjects.getVisibleText('breadcrumb last');
       expect(lastBreadcrumbdcrumb).to.be('Converting Area visualization');
+      const filterCount = await filterBar.getFilterCount();
+      expect(filterCount).to.equal(0);
       await lens.replaceInDashboard();
 
       await retry.try(async () => {

From 44d483a569a31646283f65b4f383bbe81f201ee5 Mon Sep 17 00:00:00 2001
From: Emmanuelle Raffenne <97166868+emma-raffenne@users.noreply.github.com>
Date: Wed, 8 Feb 2023 14:55:51 +0000
Subject: [PATCH 126/134] Updating projectNext to 1.1.0 for AO actions
 (#150537)

After getting errors on action execution for adding issues labeled with
AO team to the corresponding project, we found out that we were using a
version of projectNext that relies on a deprecated API.

See [projectNext release
notes](/richkuz/projectnext-label-assigner/releases/tag/1.1.0) for
details.

This PR updates the action to use version 1.1.0 of `projectNext`
---
 .github/workflows/add-to-ao-project.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/add-to-ao-project.yml b/.github/workflows/add-to-ao-project.yml
index c89e8fcefb712..ea4b4fdeb1822 100644
--- a/.github/workflows/add-to-ao-project.yml
+++ b/.github/workflows/add-to-ao-project.yml
@@ -10,7 +10,7 @@ jobs:
       github.event.label.name == 'Team: Actionable Observability'
     steps:
       - name: Add
-        uses: richkuz/projectnext-label-assigner@1.0.2
+        uses: richkuz/projectnext-label-assigner@1.1.0
         id: add_to_projects
         with:
           config: |

From d87733160ced8273498940404766fdcd79dfb6c3 Mon Sep 17 00:00:00 2001
From: Boris Kirov <boris.kirov@elastic.co>
Date: Wed, 8 Feb 2023 15:57:50 +0100
Subject: [PATCH 127/134] Changing the Anomaly detection icon on APM (#150541)

## Summary

We use `alert` icon to communicate when Anomaly detection is not
enabled. This conflicts with the usage of the icon for alerting. So in
this small PR I'm swapping the icons with the `machineLearning` icon to
make the visual connection stronger. The ML icon is also used in their
app so things would make more sense that way.
<img width="250" alt="image"
src="https://user-images.githubusercontent.com/13353203/217507328-e5927f3c-d7cd-4671-88d1-ed4743470d77.png">


After / Before


![image](https://user-images.githubusercontent.com/13353203/217507185-44b7cb94-45d8-4c4e-824c-8ce0fb7adc7c.png)
---
 .../apm_header_action_menu/anomaly_detection_setup_link.tsx   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/anomaly_detection_setup_link.tsx b/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/anomaly_detection_setup_link.tsx
index 48a5b4e81f1d6..74757fb5fd2c2 100644
--- a/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/anomaly_detection_setup_link.tsx
+++ b/x-pack/plugins/apm/public/components/shared/apm_header_action_menu/anomaly_detection_setup_link.tsx
@@ -46,7 +46,7 @@ export function AnomalyDetectionSetupLink() {
         defaultMessage: 'Could not determine state of anomaly detection setup.',
       }
     );
-    icon = 'alert';
+    icon = 'machineLearningApp';
   } else if (
     anomalyDetectionSetupState === AnomalyDetectionSetupState.NoJobs ||
     anomalyDetectionSetupState ===
@@ -54,7 +54,7 @@ export function AnomalyDetectionSetupLink() {
   ) {
     color = 'warning';
     tooltipText = getNoJobsMessage(anomalyDetectionSetupState, environment);
-    icon = 'alert';
+    icon = 'machineLearningApp';
   } else if (
     anomalyDetectionSetupState === AnomalyDetectionSetupState.UpgradeableJobs
   ) {

From 031f67bb49a8a86303affb52a96d277807b8cdf7 Mon Sep 17 00:00:00 2001
From: Kyle Pollich <kyle.pollich@elastic.co>
Date: Wed, 8 Feb 2023 10:23:06 -0500
Subject: [PATCH 128/134] [Fleet] ON Week - Port Integrations UI to
 `@tanstack/query` (#146714)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Migrates data fetching in `applications/integrations` to
`@tanstack/query` - https://tanstack.com/query/latest

This migration gives us some powerful tools around data fetching and
state management in React, and follows suit with several other Kibana
plugins that have migrated to `react-query` in the recent months.

I took some time to write up some dev docs around this change in
https://github.com/elastic/kibana/blob/bf9527a2bfd5a5335d16c09acb81bc89e3e267db/x-pack/plugins/fleet/dev_docs/react_query.md
that should hopefully represent a good start in explaining the new data
fetching patterns in detail.

Note: I'm reviving this ON week PR from November after a few months, so
there might be non-RQ data fetching changes that have landed in `main`
since I initially filed these changes. If you find anything please let
me know and I'll happily migrate that too.

I'll also be doing some more manual testing of critical integrations UX
flows to make sure there's no regressions here, though everything I can
think of has looked good so far 🙂

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 packages/kbn-optimizer/limits.yml             |   2 +-
 x-pack/plugins/fleet/dev_docs/react_query.md  | 238 ++++++++++++++++++
 .../fleet/public/applications/fleet/app.tsx   |  31 ++-
 .../multi_page_layout/index.tsx               |   8 +-
 .../single_page_layout/index.test.tsx         |   8 +-
 .../single_page_layout/index.tsx              |   4 +-
 .../components/agent_dashboard_link.test.tsx  |  18 +-
 .../components/agent_dashboard_link.tsx       |   4 +-
 .../public/applications/integrations/app.tsx  |  51 ++--
 .../applications/integrations/hooks/index.ts  |   2 -
 .../integrations/hooks/use_categories.tsx     |  55 ----
 .../hooks/use_package_install.tsx             |   3 +
 .../integrations/hooks/use_packages.tsx       |  56 -----
 .../epm/screens/detail/hooks/index.ts         |   2 +-
 .../hooks/use_is_first_time_agent_user.ts     |  76 +++---
 .../sections/epm/screens/detail/index.tsx     |  55 ++--
 .../epm/screens/detail/overview/details.tsx   |   8 +-
 .../screens/detail/overview/license_modal.tsx |  30 +--
 .../detail/policies/package_policies.tsx      |   1 +
 .../epm/screens/detail/settings/settings.tsx  | 121 ++++-----
 .../screens/detail/settings/update_button.tsx | 112 ++++-----
 .../home/hooks/use_available_packages.tsx     |   6 +-
 .../sections/epm/screens/home/index.tsx       |  12 +-
 .../sections/epm/screens/policy/index.tsx     |   6 +-
 .../fleet/public/hooks/use_fleet_status.tsx   |   1 +
 .../hooks/use_package_installations.tsx       |  95 +++++++
 .../public/hooks/use_request/agent_policy.ts  |  15 +-
 .../fleet/public/hooks/use_request/agents.ts  |   8 +
 .../fleet/public/hooks/use_request/app.ts     |  15 +-
 .../fleet/public/hooks/use_request/epm.ts     |  98 +++++---
 .../hooks/use_request/package_policy.ts       |  67 ++++-
 .../public/hooks/use_request/settings.ts      |  14 +-
 .../public/hooks/use_request/use_request.ts   |  20 ++
 33 files changed, 822 insertions(+), 420 deletions(-)
 create mode 100644 x-pack/plugins/fleet/dev_docs/react_query.md
 delete mode 100644 x-pack/plugins/fleet/public/applications/integrations/hooks/use_categories.tsx
 delete mode 100644 x-pack/plugins/fleet/public/applications/integrations/hooks/use_packages.tsx
 create mode 100644 x-pack/plugins/fleet/public/hooks/use_package_installations.tsx

diff --git a/packages/kbn-optimizer/limits.yml b/packages/kbn-optimizer/limits.yml
index 79670e025b8dc..d53fed770d6ff 100644
--- a/packages/kbn-optimizer/limits.yml
+++ b/packages/kbn-optimizer/limits.yml
@@ -60,7 +60,7 @@ pageLoadAssetSize:
   files: 22673
   filesManagement: 18683
   fileUpload: 25664
-  fleet: 126917
+  fleet: 142263
   globalSearch: 29696
   globalSearchBar: 50403
   globalSearchProviders: 25554
diff --git a/x-pack/plugins/fleet/dev_docs/react_query.md b/x-pack/plugins/fleet/dev_docs/react_query.md
new file mode 100644
index 0000000000000..55eca8669c1ec
--- /dev/null
+++ b/x-pack/plugins/fleet/dev_docs/react_query.md
@@ -0,0 +1,238 @@
+# `@tanstack/query` Usage in Fleet + Integrations
+
+This document seeks to outline the Fleet + Integrations apps' usage of [`@tanstack/query`](https://tanstack.com/query/latest) - formally known generally as `react-query`. When we talk about the React-specific adapter for `@tanstack/query`, we'll use the library name `react-query`. Since Kibana doesn't have Vue, Solid, or Svelte plugins, we don't need to be worried about the other client implementations. This is a library for asynchronous state management that's most commonly utilized for data fetching logic. `@tanstack/query` helps developers write consistent state management logic around asynchronous operations, while providing end users with a performant, "jank-free" experience.
+
+## Helpful Links
+
+- `react-query` [docs](https://tanstack.com/query/latest/docs/react/overview)
+- [Practical React Query](https://tanstack.com/query/latest/docs/react/overview) by maintainer [TkDodo](https://github.com/tkdodo)
+  - This series is long but extremely helpful. A highly recommended read for anyone working with data fetching in Fleet/Integrations!
+- `@tanstack/query` source code on GitHub: https://github.com/TanStack/query
+
+## How Fleet/Integrations uses custom data fetching hooks
+
+Historically, Fleet/Integrations have used homegrown data fetching hooks in a common folder at [`public/hooks/use_request`](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/hooks/use_request). Each `.ts` file in this directory contains one or more data fetching hooks related to a particular resource or concept. For example, here's what some data fetching hooks for `packages` and `categories` might look like:
+
+```ts
+// use_request/epm.ts
+
+export const useGetCategories = (query: GetCategoriesRequest['query'] = {}) => {
+  return useRequest<GetCategoriesResponse>({
+    path: epmRouteService.getCategoriesPath(),
+    method: 'get',
+    query,
+  });
+};
+
+export const sendGetCategories = (query: GetCategoriesRequest['query'] = {}) => {
+  return sendRequest<GetCategoriesResponse>({
+    path: epmRouteService.getCategoriesPath(),
+    method: 'get',
+    query,
+  });
+};
+
+export const useGetPackages = (query: GetPackagesRequest['query'] = {}) => {
+  return useRequest<GetPackagesResponse>({
+    path: epmRouteService.getListPath(),
+    method: 'get',
+    query,
+  });
+};
+
+export const sendGetPackages = (query: GetPackagesRequest['query'] = {}) => {
+  return sendRequest<GetPackagesResponse>({
+    path: epmRouteService.getListPath(),
+    method: 'get',
+    query,
+  });
+};
+```
+
+<details>
+<summary>What are <code>useRequest</code> and <code>sendRequest</code>?</summary>
+
+The `useRequest` and `sendRequest` methods are common across all of these data fetching hooks, and use Kibana's provide `useRequest` hook and `sendRequest` helper with some additional logic on top. e.g.
+
+```ts
+// use_request/use_request.ts - excerpts for clarity
+
+import {
+  sendRequest as _sendRequest,
+  useRequest as _useRequest,
+} from '@kbn/es-ui-shared-plugin/public';
+
+export const sendRequest = <D = any, E = RequestError>(
+  config: SendRequestConfig
+): Promise<SendRequestResponse<D, E>> => {
+  if (!httpClient) {
+    throw new Error('sendRequest has no http client set');
+  }
+  return _sendRequest<D, E>(httpClient, config);
+};
+
+export const useRequest = <D = any, E = RequestError>(config: UseRequestConfig) => {
+  if (!httpClient) {
+    throw new Error('sendRequest has no http client set');
+  }
+  return _useRequest<D, E>(httpClient, config);
+};
+```
+
+</details>
+
+Consuming these data fetching hooks might look something like this
+
+```tsx
+// applications/integrations/sections/epm/screens/detail/settings/update_button.tsx
+const handleClickUpgradePolicies = useCallback(async () => {
+  if (isUpgradingPackagePolicies) {
+    return;
+  }
+
+  setIsUpdateModalVisible(false);
+  setIsUpgradingPackagePolicies(true);
+
+  await installPackage({ name, version, title });
+
+  await sendUpgradePackagePolicy(
+    // Only upgrade policies that don't have conflicts
+    packagePolicyIds.filter(
+      (id) => !dryRunData?.find((dryRunRecord) => dryRunRecord.diff?.[0].id === id)?.hasErrors
+    )
+  );
+
+  setIsUpgradingPackagePolicies(false);
+
+  notifications.toasts.addSuccess({
+    title: toMountPoint(
+      <FormattedMessage
+        id="xpack.fleet.integrations.packageUpdateSuccessTitle"
+        defaultMessage="Updated {title} and upgraded policies"
+        values={{ title }}
+      />,
+      { theme$ }
+    ),
+    text: toMountPoint(
+      <FormattedMessage
+        id="xpack.fleet.integrations.packageUpdateSuccessDescription"
+        defaultMessage="Successfully updated {title} and upgraded policies"
+        values={{ title }}
+      />,
+      { theme$ }
+    ),
+  });
+
+  navigateToNewSettingsPage();
+}, [
+  dryRunData,
+  installPackage,
+  isUpgradingPackagePolicies,
+  name,
+  navigateToNewSettingsPage,
+  notifications.toasts,
+  packagePolicyIds,
+  setIsUpgradingPackagePolicies,
+  title,
+  version,
+  theme$,
+]);
+```
+
+In the "custom data fetching" hooks world, there are a few big problems:
+
+1. Caching, cancellation, deduping/debouncing successive requests, and optimizations around re-renders are an afterthought
+2. Mutations in particular are extremely verbose, as we need to "wire up" all error/loading state, "post-mutation" operations, etc
+3. Revalidating queries from elsewhere in the component tree (e.g. update the agent policy table when a new agent policy is saved) is a tricky operation usually solved by intermittent polling or a `location.reload()`
+
+## How `react-query` helps
+
+`react-query` handles many of the "big problems" above out-of-the-box. By providing a basic key/value based cache for queries, consistent utilities around state transitions of async operations, and robust revalidation helpers, `react-query` makes working with the state around data fetching much more predictable and pleasant.
+
+### How Fleet/Integrations uses `react-query`
+
+There's a bit of setup involved to actually get `react-query` up and running. First and foremost, each Kibana application is wrapped in a `<QueryClientProvider>` that handles `react-query`'s internal query cache and various React context needs. e.g.
+
+```tsx
+//...
+
+<EuiThemeProvider darkMode={isDarkMode}>
+  <QueryClientProvider client={queryClient}>
+    <ReactQueryDevtools initialIsOpen={true} />
+    <UIExtensionsContext.Provider value={extensions}>
+      <FleetStatusProvider>
+        <Router history={history}>
+          <PackageInstallProvider notifications={startServices.notifications} theme$={theme$}>
+            <FlyoutContextProvider>{children}</FlyoutContextProvider>
+          </PackageInstallProvider>
+        </Router>
+      </FleetStatusProvider>
+    </UIExtensionsContext.Provider>
+  </QueryClientProvider>
+</EuiThemeProvider>
+```
+
+We also set up `react-query`'s [dev tools](https://tanstack.com/query/v4/docs/react/devtools), which provide a useful developer console for debugging query and mutation state across the whole application.
+
+Another step required to use `react-query` in Fleet/Integrations is the introduction of a specialized data fetching utility. `react-query` operations expect a slightly different structure than what Kibana's `useRequest` and `sendRequest` helpers. For this purpose, we introduce the `sendRequestForRq` helper, e.g.
+
+```ts
+// Sends requests with better ergonomics for React Query, e.g. throw error rather
+// than resolving with an `error` property in the result. Also returns `data` directly
+// as opposed to { data } in a response object.
+export const sendRequestForRq = async <D = any, E = RequestError>(
+  config: SendRequestConfig
+): Promise<D> => {
+  if (!httpClient) {
+    throw new Error('sendRequest has no http client set');
+  }
+
+  const response = await _sendRequest<D, E>(httpClient, config);
+
+  if (response.error) {
+    throw response.error;
+  }
+
+  // Data can't be null so long as `_sendRequest` did not throw
+  return response.data!;
+};
+```
+
+So, with those pieces of setup in mind, adding a new query or mutation looks like this:
+
+```ts
+export function useGetCategoriesQuery(query: GetCategoriesRequest['query'] = {}) {
+  return useQuery<GetCategoriesResponse, RequestError>(['categories', query], () =>
+    sendRequestForRq<GetCategoriesResponse>({
+      path: epmRouteService.getCategoriesPath(),
+      method: 'get',
+      query,
+    })
+  );
+}
+
+export const useGetPackagesQuery = (query: GetPackagesRequest['query']) => {
+  return useQuery<GetPackagesResponse, RequestError>(['get-packages', query.prerelease], () =>
+    sendRequestForRq<GetPackagesResponse>({
+      path: epmRouteService.getListPath(),
+      method: 'get',
+      query,
+    })
+  );
+};
+
+export const useUpdatePackageMutation = () => {
+  return useMutation<UpdatePackageResponse, RequestError, UpdatePackageArgs>(
+    ({ pkgName, pkgVersion, body }: UpdatePackageArgs) =>
+      sendRequestForRq<UpdatePackageResponse>({
+        path: epmRouteService.getUpdatePath(pkgName, pkgVersion),
+        method: 'put',
+        body,
+      })
+  );
+};
+```
+
+### `react-query` operation naming conventions
+
+For `react-query` operations defined in `use_request/`, try to use a naming convention along the lines of `use{Action}{Resource}{Query/Mutation}` for your hooks. This helps with consistency and makes the intent of every data fetching operation clear.
diff --git a/x-pack/plugins/fleet/public/applications/fleet/app.tsx b/x-pack/plugins/fleet/public/applications/fleet/app.tsx
index 9afe8c10e18c3..3f657ed174483 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/app.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/app.tsx
@@ -15,6 +15,8 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
 import styled from 'styled-components';
 import useObservable from 'react-use/lib/useObservable';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { ReactQueryDevtools } from '@tanstack/react-query-devtools';
 
 import type { TopNavMenuData } from '@kbn/navigation-plugin/public';
 
@@ -62,6 +64,8 @@ import { DebugPage } from './sections/debug';
 
 const FEEDBACK_URL = 'https://ela.st/fleet-feedback';
 
+const queryClient = new QueryClient();
+
 const ErrorLayout: FunctionComponent<{ isAddIntegrationsPath: boolean }> = ({
   isAddIntegrationsPath,
   children,
@@ -257,18 +261,21 @@ export const FleetAppContext: React.FC<{
                 <KibanaVersionContext.Provider value={kibanaVersion}>
                   <KibanaThemeProvider theme$={theme$}>
                     <EuiThemeProvider darkMode={isDarkMode}>
-                      <UIExtensionsContext.Provider value={extensions}>
-                        <FleetStatusProvider>
-                          <Router history={history}>
-                            <PackageInstallProvider
-                              notifications={startServices.notifications}
-                              theme$={theme$}
-                            >
-                              <FlyoutContextProvider>{children}</FlyoutContextProvider>
-                            </PackageInstallProvider>
-                          </Router>
-                        </FleetStatusProvider>
-                      </UIExtensionsContext.Provider>
+                      <QueryClientProvider client={queryClient}>
+                        <ReactQueryDevtools initialIsOpen={true} />
+                        <UIExtensionsContext.Provider value={extensions}>
+                          <FleetStatusProvider>
+                            <Router history={history}>
+                              <PackageInstallProvider
+                                notifications={startServices.notifications}
+                                theme$={theme$}
+                              >
+                                <FlyoutContextProvider>{children}</FlyoutContextProvider>
+                              </PackageInstallProvider>
+                            </Router>
+                          </FleetStatusProvider>
+                        </UIExtensionsContext.Provider>
+                      </QueryClientProvider>
                     </EuiThemeProvider>
                   </KibanaThemeProvider>
                 </KibanaVersionContext.Provider>
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/multi_page_layout/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/multi_page_layout/index.tsx
index b63fa1ede3dc5..707b8f0fc5871 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/multi_page_layout/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/multi_page_layout/index.tsx
@@ -10,7 +10,11 @@ import { i18n } from '@kbn/i18n';
 
 import { splitPkgKey } from '../../../../../../../common/services';
 
-import { useGetPackageInfoByKey, useLink, useFleetServerHostsForPolicy } from '../../../../hooks';
+import {
+  useGetPackageInfoByKeyQuery,
+  useLink,
+  useFleetServerHostsForPolicy,
+} from '../../../../hooks';
 
 import type { AddToPolicyParams, CreatePackagePolicyParams } from '../types';
 
@@ -70,7 +74,7 @@ export const CreatePackagePolicyMultiPage: CreatePackagePolicyParams = ({
     data: packageInfoData,
     error: packageInfoError,
     isLoading: isPackageInfoLoading,
-  } = useGetPackageInfoByKey(pkgName, pkgVersion, { prerelease, full: true });
+  } = useGetPackageInfoByKeyQuery(pkgName, pkgVersion, { prerelease, full: true });
 
   const {
     agentPolicy,
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.test.tsx
index 5c80b2276ae09..ee1be70ead43a 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.test.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.test.tsx
@@ -20,7 +20,7 @@ import {
   sendGetAgentStatus,
   useIntraAppState,
   useStartServices,
-  useGetPackageInfoByKey,
+  useGetPackageInfoByKeyQuery,
 } from '../../../../hooks';
 
 jest.mock('../../../../hooks', () => {
@@ -42,10 +42,10 @@ jest.mock('../../../../hooks', () => {
     sendGetOneAgentPolicy: jest.fn().mockResolvedValue({
       data: { item: { id: 'agent-policy-1', name: 'Agent policy 1', namespace: 'default' } },
     }),
+    useGetPackageInfoByKeyQuery: jest.fn(),
     sendGetSettings: jest.fn().mockResolvedValue({
       data: { item: {} },
     }),
-    useGetPackageInfoByKey: jest.fn(),
     sendCreatePackagePolicy: jest
       .fn()
       .mockResolvedValue({ data: { item: { id: 'policy-1', inputs: [] } } }),
@@ -186,7 +186,7 @@ describe('when on the package policy create page', () => {
       isLoading: false,
     };
 
-    (useGetPackageInfoByKey as jest.Mock).mockReturnValue(mockPackageInfo);
+    (useGetPackageInfoByKeyQuery as jest.Mock).mockReturnValue(mockPackageInfo);
   });
 
   describe('and Route state is provided via Fleet HashRouter', () => {
@@ -355,7 +355,7 @@ describe('when on the package policy create page', () => {
     });
 
     test('should create agent policy without sys monitoring when new hosts is selected for system integration', async () => {
-      (useGetPackageInfoByKey as jest.Mock).mockReturnValue({
+      (useGetPackageInfoByKeyQuery as jest.Mock).mockReturnValue({
         ...mockPackageInfo,
         data: {
           item: {
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.tsx
index 9a1c943763bd8..5ab6a7b0938d5 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.tsx
@@ -27,7 +27,7 @@ import { useCancelAddPackagePolicy } from '../hooks';
 import { splitPkgKey } from '../../../../../../../common/services';
 import { generateNewAgentPolicyWithDefaults } from '../../../../services';
 import type { NewAgentPolicy } from '../../../../types';
-import { useConfig, sendGetAgentStatus, useGetPackageInfoByKey } from '../../../../hooks';
+import { useConfig, sendGetAgentStatus, useGetPackageInfoByKeyQuery } from '../../../../hooks';
 import {
   Loading,
   Error as ErrorComponent,
@@ -97,7 +97,7 @@ export const CreatePackagePolicySinglePage: CreatePackagePolicyParams = ({
     data: packageInfoData,
     error: packageInfoError,
     isLoading: isPackageInfoLoading,
-  } = useGetPackageInfoByKey(pkgName, pkgVersion, { full: true, prerelease });
+  } = useGetPackageInfoByKeyQuery(pkgName, pkgVersion, { full: true, prerelease });
   const packageInfo = useMemo(() => {
     if (packageInfoData && packageInfoData.item) {
       return packageInfoData.item;
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx
index 6e425b53522a6..dbff5ac4375be 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx
@@ -9,12 +9,12 @@ import React from 'react';
 
 import { createFleetTestRendererMock } from '../../../../../../mock';
 import type { Agent, AgentPolicy } from '../../../../types';
-import { useGetPackageInfoByKey } from '../../../../../../hooks/use_request/epm';
+import { useGetPackageInfoByKeyQuery } from '../../../../../../hooks/use_request/epm';
 
 import { AgentDashboardLink } from './agent_dashboard_link';
 
-const mockedUseGetPackageInfoByKey = useGetPackageInfoByKey as jest.MockedFunction<
-  typeof useGetPackageInfoByKey
+const mockedUseGetPackageInfoByKeyQuery = useGetPackageInfoByKeyQuery as jest.MockedFunction<
+  typeof useGetPackageInfoByKeyQuery
 >;
 
 jest.mock('../../../../../../hooks/use_fleet_status', () => ({
@@ -27,14 +27,14 @@ jest.mock('../../../../../../hooks/use_request/epm');
 
 describe('AgentDashboardLink', () => {
   it('should enable the button if elastic_agent package is installed and policy has monitoring enabled', async () => {
-    mockedUseGetPackageInfoByKey.mockReturnValue({
+    mockedUseGetPackageInfoByKeyQuery.mockReturnValue({
       isLoading: false,
       data: {
         item: {
           status: 'installed',
         },
       },
-    } as ReturnType<typeof useGetPackageInfoByKey>);
+    } as ReturnType<typeof useGetPackageInfoByKeyQuery>);
     const testRenderer = createFleetTestRendererMock();
 
     const result = testRenderer.render(
@@ -57,14 +57,14 @@ describe('AgentDashboardLink', () => {
   });
 
   it('should not enable the button if elastic_agent package is not installed and policy has monitoring enabled', async () => {
-    mockedUseGetPackageInfoByKey.mockReturnValue({
+    mockedUseGetPackageInfoByKeyQuery.mockReturnValue({
       isLoading: false,
       data: {
         item: {
           status: 'not_installed',
         },
       },
-    } as ReturnType<typeof useGetPackageInfoByKey>);
+    } as ReturnType<typeof useGetPackageInfoByKeyQuery>);
     const testRenderer = createFleetTestRendererMock();
 
     const result = testRenderer.render(
@@ -88,14 +88,14 @@ describe('AgentDashboardLink', () => {
   });
 
   it('should link to the agent policy settings tab if logs and metrics are not enabled for that policy', async () => {
-    mockedUseGetPackageInfoByKey.mockReturnValue({
+    mockedUseGetPackageInfoByKeyQuery.mockReturnValue({
       isLoading: false,
       data: {
         item: {
           status: 'installed',
         },
       },
-    } as ReturnType<typeof useGetPackageInfoByKey>);
+    } as ReturnType<typeof useGetPackageInfoByKeyQuery>);
     const testRenderer = createFleetTestRendererMock();
 
     const result = testRenderer.render(
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx
index 93be90219cdc9..cad402e602543 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx
@@ -10,7 +10,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { EuiButton, EuiToolTip } from '@elastic/eui';
 import styled from 'styled-components';
 
-import { useGetPackageInfoByKey, useKibanaLink, useLink } from '../../../../hooks';
+import { useGetPackageInfoByKeyQuery, useKibanaLink, useLink } from '../../../../hooks';
 import type { Agent, AgentPolicy } from '../../../../types';
 import {
   FLEET_ELASTIC_AGENT_PACKAGE,
@@ -18,7 +18,7 @@ import {
 } from '../../../../../../../common/constants';
 
 function useAgentDashboardLink(agent: Agent) {
-  const { isLoading, data } = useGetPackageInfoByKey(FLEET_ELASTIC_AGENT_PACKAGE);
+  const { isLoading, data } = useGetPackageInfoByKeyQuery(FLEET_ELASTIC_AGENT_PACKAGE);
 
   const isInstalled = data?.item.status === 'installed';
 
diff --git a/x-pack/plugins/fleet/public/applications/integrations/app.tsx b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
index 3d47db8963d3f..c9e0d97a672b5 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/app.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
@@ -11,6 +11,8 @@ import { EuiErrorBoundary, EuiPortal } from '@elastic/eui';
 import type { History } from 'history';
 import { Router, Redirect, Route, Switch } from 'react-router-dom';
 import useObservable from 'react-use/lib/useObservable';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { ReactQueryDevtools } from '@tanstack/react-query-devtools';
 
 import { KibanaContextProvider, RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
 import { EuiThemeProvider } from '@kbn/kibana-react-plugin/common';
@@ -39,6 +41,8 @@ import { PackageInstallProvider, UIExtensionsContext, FlyoutContextProvider } fr
 import { IntegrationsHeader } from './components/header';
 import { AgentEnrollmentFlyout } from './components';
 
+const queryClient = new QueryClient();
+
 const EmptyContext = () => <></>;
 
 /**
@@ -79,28 +83,31 @@ export const IntegrationsAppContext: React.FC<{
                 <KibanaVersionContext.Provider value={kibanaVersion}>
                   <KibanaThemeProvider theme$={theme$}>
                     <EuiThemeProvider darkMode={isDarkMode}>
-                      <UIExtensionsContext.Provider value={extensions}>
-                        <FleetStatusProvider>
-                          <startServices.customIntegrations.ContextProvider>
-                            <CloudContext>
-                              <Router history={history}>
-                                <AgentPolicyContextProvider>
-                                  <PackageInstallProvider
-                                    notifications={startServices.notifications}
-                                    theme$={theme$}
-                                  >
-                                    <FlyoutContextProvider>
-                                      <IntegrationsHeader {...{ setHeaderActionMenu, theme$ }} />
-                                      {children}
-                                      <Chat />
-                                    </FlyoutContextProvider>
-                                  </PackageInstallProvider>
-                                </AgentPolicyContextProvider>
-                              </Router>
-                            </CloudContext>
-                          </startServices.customIntegrations.ContextProvider>
-                        </FleetStatusProvider>
-                      </UIExtensionsContext.Provider>
+                      <QueryClientProvider client={queryClient}>
+                        <ReactQueryDevtools initialIsOpen={true} />
+                        <UIExtensionsContext.Provider value={extensions}>
+                          <FleetStatusProvider>
+                            <startServices.customIntegrations.ContextProvider>
+                              <CloudContext>
+                                <Router history={history}>
+                                  <AgentPolicyContextProvider>
+                                    <PackageInstallProvider
+                                      notifications={startServices.notifications}
+                                      theme$={theme$}
+                                    >
+                                      <FlyoutContextProvider>
+                                        <IntegrationsHeader {...{ setHeaderActionMenu, theme$ }} />
+                                        {children}
+                                        <Chat />
+                                      </FlyoutContextProvider>
+                                    </PackageInstallProvider>
+                                  </AgentPolicyContextProvider>
+                                </Router>
+                              </CloudContext>
+                            </startServices.customIntegrations.ContextProvider>
+                          </FleetStatusProvider>
+                        </UIExtensionsContext.Provider>
+                      </QueryClientProvider>
                     </EuiThemeProvider>
                   </KibanaThemeProvider>
                 </KibanaVersionContext.Provider>
diff --git a/x-pack/plugins/fleet/public/applications/integrations/hooks/index.ts b/x-pack/plugins/fleet/public/applications/integrations/hooks/index.ts
index 76b6b49c8c5cb..5b6b19af169f0 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/hooks/index.ts
+++ b/x-pack/plugins/fleet/public/applications/integrations/hooks/index.ts
@@ -14,5 +14,3 @@ export * from './use_agent_policy_context';
 export * from './use_integrations_state';
 export * from './use_confirm_force_install';
 export * from './use_confirm_open_unverified';
-export * from './use_packages';
-export * from './use_categories';
diff --git a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_categories.tsx b/x-pack/plugins/fleet/public/applications/integrations/hooks/use_categories.tsx
deleted file mode 100644
index abc601a3ceeb2..0000000000000
--- a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_categories.tsx
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { useEffect, useCallback, useState } from 'react';
-
-import type { RequestError } from '../../fleet/hooks';
-import { sendGetCategories } from '../../fleet/hooks';
-import type { GetCategoriesResponse } from '../types';
-
-export function useCategories(prerelease?: boolean) {
-  const [data, setData] = useState<GetCategoriesResponse | undefined>();
-  const [error, setError] = useState<RequestError | undefined>();
-  const [isLoading, setIsLoading] = useState(true);
-  const [isPrereleaseEnabled, setIsPrereleaseEnabled] = useState(prerelease);
-
-  const fetchData = useCallback(async () => {
-    if (prerelease === undefined) {
-      return;
-    }
-    if (isPrereleaseEnabled === prerelease) {
-      return;
-    }
-    setIsPrereleaseEnabled(prerelease);
-    setIsLoading(true);
-    try {
-      const res = await sendGetCategories({
-        include_policy_templates: true,
-        prerelease,
-      });
-      if (res.error) {
-        throw res.error;
-      }
-      if (res.data) {
-        setData(res.data);
-      }
-    } catch (err) {
-      setError(err);
-    }
-    setIsLoading(false);
-  }, [prerelease, isPrereleaseEnabled]);
-
-  useEffect(() => {
-    fetchData();
-  }, [fetchData]);
-
-  return {
-    data,
-    error,
-    isLoading,
-  };
-}
diff --git a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx b/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx
index 9afc51d96077f..101de2a30cef5 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
+// TODO: Refactor this away from constate, which is unmaintained, as this is the only
+// usage of it across the Fleet codebase
 import createContainer from 'constate';
+
 import React, { useCallback, useState } from 'react';
 import { useHistory } from 'react-router-dom';
 import { FormattedMessage } from '@kbn/i18n-react';
diff --git a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_packages.tsx b/x-pack/plugins/fleet/public/applications/integrations/hooks/use_packages.tsx
deleted file mode 100644
index c2dfa7e7406fa..0000000000000
--- a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_packages.tsx
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { useEffect, useCallback, useState } from 'react';
-
-import type { RequestError } from '../../fleet/hooks';
-import { sendGetPackages } from '../../fleet/hooks';
-import type { GetPackagesResponse } from '../types';
-
-export function usePackages(prerelease?: boolean) {
-  const [data, setData] = useState<GetPackagesResponse | undefined>();
-  const [error, setError] = useState<RequestError | undefined>();
-  const [isLoading, setIsLoading] = useState(true);
-  const [isPrereleaseEnabled, setIsPrereleaseEnabled] = useState(prerelease);
-
-  const fetchData = useCallback(async () => {
-    if (prerelease === undefined) {
-      return;
-    }
-    if (isPrereleaseEnabled === prerelease) {
-      return;
-    }
-    setIsPrereleaseEnabled(prerelease);
-    setIsLoading(true);
-    try {
-      const res = await sendGetPackages({
-        category: '',
-        excludeInstallStatus: true,
-        prerelease,
-      });
-      if (res.error) {
-        throw res.error;
-      }
-      if (res.data) {
-        setData(res.data);
-      }
-    } catch (err) {
-      setError(err);
-    }
-    setIsLoading(false);
-  }, [prerelease, isPrereleaseEnabled]);
-
-  useEffect(() => {
-    fetchData();
-  }, [fetchData]);
-
-  return {
-    data,
-    error,
-    isLoading,
-  };
-}
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/hooks/index.ts b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/hooks/index.ts
index 997d3b0b48a53..6b2d3e80d259f 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/hooks/index.ts
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/hooks/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { useIsFirstTimeAgentUser } from './use_is_first_time_agent_user';
+export { useIsFirstTimeAgentUserQuery } from './use_is_first_time_agent_user';
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/hooks/use_is_first_time_agent_user.ts b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/hooks/use_is_first_time_agent_user.ts
index 5eaf7334f2f7f..7c7a6f6aa4ebf 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/hooks/use_is_first_time_agent_user.ts
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/hooks/use_is_first_time_agent_user.ts
@@ -5,50 +5,46 @@
  * 2.0.
  */
 
-import { useEffect, useState } from 'react';
-
-import { sendGetAgentPolicies, sendGetAgents } from '../../../../../hooks';
+import { useGetAgentPoliciesQuery, useGetAgentsQuery } from '../../../../../hooks';
 import { policyHasFleetServer } from '../../../../../services';
 
 interface UseIsFirstTimeAgentUserResponse {
-  isLoading: boolean;
   isFirstTimeAgentUser?: boolean;
+  isLoading?: boolean;
 }
 
-export const useIsFirstTimeAgentUser = (): UseIsFirstTimeAgentUserResponse => {
-  const [result, setResult] = useState<UseIsFirstTimeAgentUserResponse>({ isLoading: true });
-  useEffect(() => {
-    if (!result.isLoading) {
-      return;
-    }
-
-    const getIsFirstTimeAgentUser = async () => {
-      const { data: agentPoliciesData } = await sendGetAgentPolicies({
-        full: true,
-      });
-
-      // now get all agents that are NOT part of a fleet server policy
-      const serverPolicyIdsQuery = (agentPoliciesData?.items || [])
-        .filter((item) => policyHasFleetServer(item))
-        .map((p) => `policy_id:${p.id}`)
-        .join(' or ');
-
-      // get agents that are not unenrolled and not fleet server
-      const kuery =
-        `not (_exists_:"unenrolled_at")` +
-        (serverPolicyIdsQuery.length ? ` and not (${serverPolicyIdsQuery})` : '');
-
-      const { data: agentStatusData } = await sendGetAgents({
-        page: 1,
-        perPage: 1, // we only need to know if there is at least one non-fleet agent
-        showInactive: true,
-        kuery,
-      });
-      setResult({ isLoading: false, isFirstTimeAgentUser: agentStatusData?.total === 0 });
-    };
-
-    getIsFirstTimeAgentUser();
-  }, [result]);
-
-  return result;
+export const useIsFirstTimeAgentUserQuery = (): UseIsFirstTimeAgentUserResponse => {
+  const {
+    data: agentPolicies,
+    isLoading: areAgentPoliciesLoading,
+    isFetched: areAgentsFetched,
+  } = useGetAgentPoliciesQuery({
+    full: true,
+  });
+
+  // now get all agents that are NOT part of a fleet server policy
+  const serverPolicyIdsQuery = (agentPolicies?.items || [])
+    .filter((item) => policyHasFleetServer(item))
+    .map((p) => `policy_id:${p.id}`)
+    .join(' or ');
+
+  // get agents that are not unenrolled and not fleet server
+  const kuery =
+    `not (_exists_:"unenrolled_at")` +
+    (serverPolicyIdsQuery.length ? ` and not (${serverPolicyIdsQuery})` : '');
+
+  const { data: agents, isLoading: areAgentsLoading } = useGetAgentsQuery(
+    {
+      page: 1,
+      perPage: 1, // we only need to know if there is at least one non-fleet agent
+      showInactive: true,
+      kuery,
+    },
+    { enabled: areAgentsFetched } // don't run the query until agent policies are loaded
+  );
+
+  return {
+    isLoading: areAgentPoliciesLoading || areAgentsLoading,
+    isFirstTimeAgentUser: agents?.data?.total === 0,
+  };
 };
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
index dafe901121c54..63314d6fc936f 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
@@ -39,14 +39,14 @@ import {
   useBreadcrumbs,
   useStartServices,
   useAuthz,
-  usePermissionCheck,
+  usePermissionCheckQuery,
   useIntegrationsStateContext,
-  useGetSettings,
+  useGetSettingsQuery,
 } from '../../../../hooks';
 import { INTEGRATIONS_ROUTING_PATHS } from '../../../../constants';
 import { ExperimentalFeaturesService } from '../../../../services';
 import {
-  useGetPackageInfoByKey,
+  useGetPackageInfoByKeyQuery,
   useLink,
   useAgentPolicyContext,
   useIsGuidedOnboardingActive,
@@ -63,7 +63,7 @@ import {
 import type { WithHeaderLayoutProps } from '../../../../layouts';
 import { WithHeaderLayout } from '../../../../layouts';
 
-import { useIsFirstTimeAgentUser } from './hooks';
+import { useIsFirstTimeAgentUserQuery } from './hooks';
 import { getInstallPkgRouteOptions } from './utils';
 import {
   IntegrationAgentPolicyCount,
@@ -114,17 +114,24 @@ export function Detail() {
   const { getFromIntegrations } = useIntegrationsStateContext();
   const { pkgkey, panel } = useParams<DetailParams>();
   const { getHref, getPath } = useLink();
-  const canInstallPackages = useAuthz().integrations.installPackages;
-  const canReadPackageSettings = useAuthz().integrations.readPackageSettings;
-  const canReadIntegrationPolicies = useAuthz().integrations.readIntegrationPolicies;
-  const permissionCheck = usePermissionCheck();
-  const missingSecurityConfiguration =
-    !permissionCheck.data?.success && permissionCheck.data?.error === 'MISSING_SECURITY';
-  const userCanInstallPackages = canInstallPackages && permissionCheck.data?.success;
   const history = useHistory();
   const { pathname, search, hash } = useLocation();
   const queryParams = useMemo(() => new URLSearchParams(search), [search]);
   const integration = useMemo(() => queryParams.get('integration'), [queryParams]);
+
+  const canInstallPackages = useAuthz().integrations.installPackages;
+  const canReadPackageSettings = useAuthz().integrations.readPackageSettings;
+  const canReadIntegrationPolicies = useAuthz().integrations.readIntegrationPolicies;
+
+  const {
+    data: permissionCheck,
+    error: permissionCheckError,
+    isLoading: isPermissionCheckLoading,
+  } = usePermissionCheckQuery();
+  const missingSecurityConfiguration =
+    !permissionCheck?.success && permissionCheckError === 'MISSING_SECURITY';
+  const userCanInstallPackages = canInstallPackages && permissionCheck?.success;
+
   const services = useStartServices();
   const isCloud = !!services?.cloud?.cloudId;
   const { createPackagePolicyMultiPageLayout: isExperimentalAddIntegrationPageEnabled } =
@@ -163,7 +170,7 @@ export function Detail() {
     boolean | undefined
   >();
 
-  const { data: settings } = useGetSettings();
+  const { data: settings } = useGetSettingsQuery();
 
   useEffect(() => {
     const isEnabled = Boolean(settings?.item.prerelease_integrations_enabled);
@@ -176,9 +183,8 @@ export function Detail() {
     data: packageInfoData,
     error: packageInfoError,
     isLoading: packageInfoLoading,
-    isInitialRequest: packageIsInitialRequest,
-    resendRequest: refreshPackageInfo,
-  } = useGetPackageInfoByKey(pkgName, pkgVersion, {
+    refetch: refetchPackageInfo,
+  } = useGetPackageInfoByKeyQuery(pkgName, pkgVersion, {
     prerelease: prereleaseIntegrationsEnabled,
   });
 
@@ -186,7 +192,7 @@ export function Detail() {
   const [latestPrereleaseVersion, setLatestPrereleaseVersion] = useState<string | undefined>();
 
   // fetch latest GA version (prerelease=false)
-  const { data: packageInfoLatestGAData } = useGetPackageInfoByKey(pkgName, '', {
+  const { data: packageInfoLatestGAData } = useGetPackageInfoByKeyQuery(pkgName, '', {
     prerelease: false,
   });
 
@@ -199,7 +205,7 @@ export function Detail() {
   }, [packageInfoLatestGAData?.item]);
 
   // fetch latest Prerelease version (prerelease=true)
-  const { data: packageInfoLatestPrereleaseData } = useGetPackageInfoByKey(pkgName, '', {
+  const { data: packageInfoLatestPrereleaseData } = useGetPackageInfoByKeyQuery(pkgName, '', {
     prerelease: true,
   });
 
@@ -208,7 +214,7 @@ export function Detail() {
   }, [packageInfoLatestPrereleaseData?.item.version]);
 
   const { isFirstTimeAgentUser = false, isLoading: firstTimeUserLoading } =
-    useIsFirstTimeAgentUser();
+    useIsFirstTimeAgentUserQuery();
   const isGuidedOnboardingActive = useIsGuidedOnboardingActive(pkgName);
 
   // Refresh package info when status change
@@ -220,17 +226,14 @@ export function Detail() {
     }
     if (oldPackageInstallStatus === 'not_installed' && packageInstallStatus === 'installed') {
       setOldPackageStatus(packageInstallStatus);
-      refreshPackageInfo();
+      refetchPackageInfo();
     }
-  }, [packageInstallStatus, oldPackageInstallStatus, refreshPackageInfo]);
+  }, [packageInstallStatus, oldPackageInstallStatus, refetchPackageInfo]);
 
-  const isLoading =
-    (packageInfoLoading && !packageIsInitialRequest) ||
-    permissionCheck.isLoading ||
-    firstTimeUserLoading;
+  const isLoading = packageInfoLoading || isPermissionCheckLoading || firstTimeUserLoading;
 
   const showCustomTab =
-    useUIExtension(packageInfoData?.item.name ?? '', 'package-detail-custom') !== undefined;
+    useUIExtension(packageInfoData?.item?.name ?? '', 'package-detail-custom') !== undefined;
 
   // Track install status state
   useEffect(() => {
@@ -698,7 +701,7 @@ export function Detail() {
               defaultMessage="Error loading integration details"
             />
           }
-          error={packageInfoError}
+          error={packageInfoError.message}
         />
       ) : isLoading || !packageInfo ? (
         <Loading />
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/details.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/details.tsx
index 729975e8e8e37..94a2a223b122a 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/details.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/details.tsx
@@ -29,7 +29,7 @@ import type {
   KibanaAssetType,
 } from '../../../../../types';
 import { entries } from '../../../../../types';
-import { useGetCategories } from '../../../../../hooks';
+import { useGetCategoriesQuery } from '../../../../../hooks';
 import { AssetTitleMap, DisplayedAssets, ServiceTitleMap } from '../../../constants';
 
 import { NoticeModal } from './notice_modal';
@@ -59,10 +59,10 @@ const Replacements = euiStyled(EuiFlexItem)`
 `;
 
 export const Details: React.FC<Props> = memo(({ packageInfo }) => {
-  const { data: categoriesData, isLoading: isLoadingCategories } = useGetCategories();
+  const { data: categoriesData, isLoading: isLoadingCategories } = useGetCategoriesQuery();
   const packageCategories: string[] = useMemo(() => {
-    if (!isLoadingCategories && categoriesData && categoriesData.response) {
-      return categoriesData.response
+    if (!isLoadingCategories && categoriesData?.items) {
+      return categoriesData.items
         .filter((category) => packageInfo.categories?.includes(category.id as PackageSpecCategory))
         .map((category) => category.title);
     }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/license_modal.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/license_modal.tsx
index 51aa501b71b42..9ae4bace737a1 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/license_modal.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/license_modal.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useEffect, useState } from 'react';
+import React from 'react';
 import {
   EuiCodeBlock,
   EuiLoadingContent,
@@ -19,7 +19,7 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 
-import { sendGetFileByPath, useStartServices } from '../../../../../hooks';
+import { useGetFileByPathQuery, useStartServices } from '../../../../../hooks';
 
 interface Props {
   licenseName?: string;
@@ -33,23 +33,17 @@ export const LicenseModal: React.FunctionComponent<Props> = ({
   onClose,
 }) => {
   const { notifications } = useStartServices();
-  const [licenseText, setLicenseText] = useState<string | undefined>(undefined);
 
-  useEffect(() => {
-    async function fetchData() {
-      try {
-        const { data } = await sendGetFileByPath(licensePath);
-        setLicenseText(data || '');
-      } catch (err) {
-        notifications.toasts.addError(err, {
-          title: i18n.translate('xpack.fleet.epm.errorLoadingLicense', {
-            defaultMessage: 'Error loading license information',
-          }),
-        });
-      }
-    }
-    fetchData();
-  }, [licensePath, notifications]);
+  const { data: licenseText, error: licenseError } = useGetFileByPathQuery(licensePath);
+
+  if (licenseError) {
+    notifications.toasts.addError(licenseError, {
+      title: i18n.translate('xpack.fleet.epm.errorLoadingLicense', {
+        defaultMessage: 'Error loading license information',
+      }),
+    });
+  }
+
   return (
     <EuiModal maxWidth={true} onClose={onClose}>
       <EuiModalHeader>
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/policies/package_policies.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/policies/package_policies.tsx
index 3399f98515f57..647bb3715dcb0 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/policies/package_policies.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/policies/package_policies.tsx
@@ -99,6 +99,7 @@ export const PackagePoliciesPage = ({ name, version }: PackagePoliciesPanelProps
   const getPackageInstallStatus = useGetPackageInstallStatus();
   const packageInstallStatus = getPackageInstallStatus(name);
   const { pagination, pageSizeOptions, setPagination } = useUrlPagination();
+
   const {
     data,
     isLoading,
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
index b990f6994430a..29e3ea7c95c81 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { memo, useCallback, useEffect, useMemo, useState } from 'react';
+import React, { memo, useCallback, useMemo, useState } from 'react';
 import styled from 'styled-components';
 import { FormattedMessage } from '@kbn/i18n-react';
 import semverLt from 'semver/functions/lt';
@@ -25,15 +25,15 @@ import { i18n } from '@kbn/i18n';
 import type { Observable } from 'rxjs';
 import type { CoreTheme } from '@kbn/core/public';
 
-import type { PackageInfo, UpgradePackagePolicyDryRunResponse } from '../../../../../types';
+import type { PackageInfo } from '../../../../../types';
 import { InstallStatus } from '../../../../../types';
 import {
-  useGetPackagePolicies,
+  useGetPackagePoliciesQuery,
   useGetPackageInstallStatus,
   useLink,
-  sendUpgradePackagePolicyDryRun,
-  sendUpdatePackage,
   useStartServices,
+  useUpgradePackagePolicyDryRunQuery,
+  useUpdatePackageMutation,
 } from '../../../../../hooks';
 import {
   PACKAGE_POLICY_SAVED_OBJECT_TYPE,
@@ -100,15 +100,30 @@ interface Props {
 
 export const SettingsPage: React.FC<Props> = memo(({ packageInfo, theme$ }: Props) => {
   const { name, title, latestVersion, version, keepPoliciesUpToDate } = packageInfo;
-  const [dryRunData, setDryRunData] = useState<UpgradePackagePolicyDryRunResponse | null>();
   const [isUpgradingPackagePolicies, setIsUpgradingPackagePolicies] = useState<boolean>(false);
   const getPackageInstallStatus = useGetPackageInstallStatus();
-  const { data: packagePoliciesData } = useGetPackagePolicies({
+
+  const { data: packagePoliciesData } = useGetPackagePoliciesQuery({
     perPage: SO_SEARCH_LIMIT,
     page: 1,
     kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name:${name}`,
   });
 
+  const packagePolicyIds = useMemo(
+    () => packagePoliciesData?.items.map(({ id }) => id),
+    [packagePoliciesData]
+  );
+
+  const { data: dryRunData } = useUpgradePackagePolicyDryRunQuery(
+    packagePolicyIds ?? [],
+    latestVersion,
+    {
+      enabled: packagePolicyIds && packagePolicyIds.length > 0,
+    }
+  );
+
+  const updatePackageMutation = useUpdatePackageMutation();
+
   const { notifications } = useStartServices();
 
   const shouldShowKeepPoliciesUpToDateSwitch = useMemo(() => {
@@ -124,72 +139,60 @@ export const SettingsPage: React.FC<Props> = memo(({ packageInfo, theme$ }: Prop
   );
 
   const handleKeepPoliciesUpToDateSwitchChange = useCallback(() => {
-    const saveKeepPoliciesUpToDate = async () => {
-      try {
-        setKeepPoliciesUpToDateSwitchValue((prev) => !prev);
+    setKeepPoliciesUpToDateSwitchValue((prev) => !prev);
 
-        await sendUpdatePackage(packageInfo.name, packageInfo.version, {
+    updatePackageMutation.mutate(
+      {
+        pkgName: packageInfo.name,
+        pkgVersion: packageInfo.version,
+        body: {
           keepPoliciesUpToDate: !keepPoliciesUpToDateSwitchValue,
-        });
-
-        notifications.toasts.addSuccess({
-          title: i18n.translate('xpack.fleet.integrations.integrationSaved', {
-            defaultMessage: 'Integration settings saved',
-          }),
-          text: !keepPoliciesUpToDateSwitchValue
-            ? i18n.translate('xpack.fleet.integrations.keepPoliciesUpToDateEnabledSuccess', {
-                defaultMessage:
-                  'Fleet will automatically keep integration policies up to date for {title}',
-                values: { title },
-              })
-            : i18n.translate('xpack.fleet.integrations.keepPoliciesUpToDateDisabledSuccess', {
-                defaultMessage:
-                  'Fleet will not automatically keep integration policies up to date for {title}',
-                values: { title },
-              }),
-        });
-      } catch (error) {
-        notifications.toasts.addError(error, {
-          title: i18n.translate('xpack.fleet.integrations.integrationSavedError', {
-            defaultMessage: 'Error saving integration settings',
-          }),
-          toastMessage: i18n.translate('xpack.fleet.integrations.keepPoliciesUpToDateError', {
-            defaultMessage: 'Error saving integration settings for {title}',
-            values: { title },
-          }),
-        });
+        },
+      },
+      {
+        onSuccess: () => {
+          notifications.toasts.addSuccess({
+            title: i18n.translate('xpack.fleet.integrations.integrationSaved', {
+              defaultMessage: 'Integration settings saved',
+            }),
+            text: !keepPoliciesUpToDateSwitchValue
+              ? i18n.translate('xpack.fleet.integrations.keepPoliciesUpToDateEnabledSuccess', {
+                  defaultMessage:
+                    'Fleet will automatically keep integration policies up to date for {title}',
+                  values: { title },
+                })
+              : i18n.translate('xpack.fleet.integrations.keepPoliciesUpToDateDisabledSuccess', {
+                  defaultMessage:
+                    'Fleet will not automatically keep integration policies up to date for {title}',
+                  values: { title },
+                }),
+          });
+        },
+        onError: (error) => {
+          notifications.toasts.addError(error, {
+            title: i18n.translate('xpack.fleet.integrations.integrationSavedError', {
+              defaultMessage: 'Error saving integration settings',
+            }),
+            toastMessage: i18n.translate('xpack.fleet.integrations.keepPoliciesUpToDateError', {
+              defaultMessage: 'Error saving integration settings for {title}',
+              values: { title },
+            }),
+          });
+        },
       }
-    };
-
-    saveKeepPoliciesUpToDate();
+    );
   }, [
     keepPoliciesUpToDateSwitchValue,
     notifications.toasts,
     packageInfo.name,
     packageInfo.version,
     title,
+    updatePackageMutation,
   ]);
 
   const { status: installationStatus, version: installedVersion } = getPackageInstallStatus(name);
   const packageHasUsages = !!packagePoliciesData?.total;
 
-  const packagePolicyIds = useMemo(
-    () => packagePoliciesData?.items.map(({ id }) => id),
-    [packagePoliciesData]
-  );
-
-  useEffect(() => {
-    const fetchDryRunData = async () => {
-      if (packagePolicyIds && packagePolicyIds.length) {
-        const { data } = await sendUpgradePackagePolicyDryRun(packagePolicyIds, latestVersion);
-
-        setDryRunData(data);
-      }
-    };
-
-    fetchDryRunData();
-  }, [latestVersion, packagePolicyIds]);
-
   const updateAvailable =
     installedVersion && semverLt(installedVersion, latestVersion) ? true : false;
 
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/update_button.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/update_button.tsx
index 526c50aca1b96..800e77d687378 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/update_button.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/update_button.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
 import { useHistory } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
@@ -24,7 +24,6 @@ import type { CoreTheme } from '@kbn/core/public';
 import { toMountPoint } from '@kbn/kibana-react-plugin/public';
 
 import type {
-  GetAgentPoliciesResponse,
   PackageInfo,
   UpgradePackagePolicyDryRunResponse,
   PackagePolicy,
@@ -32,13 +31,13 @@ import type {
 import { InstallStatus } from '../../../../../types';
 import { AGENT_POLICY_SAVED_OBJECT_TYPE, SO_SEARCH_LIMIT } from '../../../../../constants';
 import {
-  sendGetAgentPolicies,
   useInstallPackage,
   useGetPackageInstallStatus,
-  sendUpgradePackagePolicy,
   useStartServices,
   useAuthz,
   useLink,
+  useUpgradePackagePoliciesMutation,
+  useGetAgentPoliciesQuery,
 } from '../../../../../hooks';
 
 interface UpdateButtonProps extends Pick<PackageInfo, 'name' | 'title' | 'version'> {
@@ -92,26 +91,17 @@ export const UpdateButton: React.FunctionComponent<UpdateButtonProps> = ({
 
   const [isUpdateModalVisible, setIsUpdateModalVisible] = useState<boolean>(false);
   const [upgradePackagePolicies, setUpgradePackagePolicies] = useState<boolean>(true);
-  const [agentPolicyData, setAgentPolicyData] = useState<GetAgentPoliciesResponse | null>();
-
-  useEffect(() => {
-    const fetchAgentPolicyData = async () => {
-      if (packagePolicyIds && packagePolicyIds.length > 0) {
-        const { data } = await sendGetAgentPolicies({
-          perPage: SO_SEARCH_LIMIT,
-          page: 1,
-          // Fetch all agent policies that include one of the eligible package policies
-          kuery: `${AGENT_POLICY_SAVED_OBJECT_TYPE}.package_policies:${packagePolicyIds
-            .map((id) => `"${id}"`)
-            .join(' or ')}`,
-        });
-
-        setAgentPolicyData(data);
-      }
-    };
 
-    fetchAgentPolicyData();
-  }, [packagePolicyIds]);
+  const { data: agentPolicyData } = useGetAgentPoliciesQuery({
+    perPage: SO_SEARCH_LIMIT,
+    page: 1,
+    // Fetch all agent policies that include one of the eligible package policies
+    kuery: packagePolicyIds.length
+      ? `${AGENT_POLICY_SAVED_OBJECT_TYPE}.package_policies:${packagePolicyIds
+          .map((id) => `"${id}"`)
+          .join(' or ')}`
+      : '',
+  });
 
   const packagePolicyCount = useMemo(() => packagePolicyIds.length, [packagePolicyIds]);
 
@@ -164,6 +154,8 @@ export const UpdateButton: React.FunctionComponent<UpdateButtonProps> = ({
     await installPackage({ name, version, title, fromUpdate: true });
   }, [installPackage, name, title, version]);
 
+  const upgradePackagePoliciesMutation = useUpgradePackagePoliciesMutation();
+
   const handleClickUpgradePolicies = useCallback(async () => {
     if (isUpgradingPackagePolicies) {
       return;
@@ -174,47 +166,51 @@ export const UpdateButton: React.FunctionComponent<UpdateButtonProps> = ({
 
     await installPackage({ name, version, title });
 
-    await sendUpgradePackagePolicy(
-      // Only upgrade policies that don't have conflicts
-      packagePolicyIds.filter(
-        (id) => !dryRunData?.find((dryRunRecord) => dryRunRecord.diff?.[0].id === id)?.hasErrors
-      )
-    );
-
-    setIsUpgradingPackagePolicies(false);
-
-    notifications.toasts.addSuccess({
-      title: toMountPoint(
-        <FormattedMessage
-          id="xpack.fleet.integrations.packageUpdateSuccessTitle"
-          defaultMessage="Updated {title} and upgraded policies"
-          values={{ title }}
-        />,
-        { theme$ }
-      ),
-      text: toMountPoint(
-        <FormattedMessage
-          id="xpack.fleet.integrations.packageUpdateSuccessDescription"
-          defaultMessage="Successfully updated {title} and upgraded policies"
-          values={{ title }}
-        />,
-        { theme$ }
-      ),
-    });
+    upgradePackagePoliciesMutation.mutate(
+      {
+        // Only upgrade policies that don't have conflicts
+        packagePolicyIds: packagePolicyIds.filter(
+          (id) => !dryRunData?.find((dryRunRecord) => dryRunRecord.diff?.[0].id === id)?.hasErrors
+        ),
+      },
+      {
+        onSuccess: () => {
+          notifications.toasts.addSuccess({
+            title: toMountPoint(
+              <FormattedMessage
+                id="xpack.fleet.integrations.packageUpdateSuccessTitle"
+                defaultMessage="Updated {title} and upgraded policies"
+                values={{ title }}
+              />,
+              { theme$ }
+            ),
+            text: toMountPoint(
+              <FormattedMessage
+                id="xpack.fleet.integrations.packageUpdateSuccessDescription"
+                defaultMessage="Successfully updated {title} and upgraded policies"
+                values={{ title }}
+              />,
+              { theme$ }
+            ),
+          });
 
-    navigateToNewSettingsPage();
+          navigateToNewSettingsPage();
+        },
+      }
+    );
   }, [
-    dryRunData,
-    installPackage,
     isUpgradingPackagePolicies,
-    name,
-    navigateToNewSettingsPage,
-    notifications.toasts,
-    packagePolicyIds,
     setIsUpgradingPackagePolicies,
-    title,
+    installPackage,
+    name,
     version,
+    title,
+    upgradePackagePoliciesMutation,
+    packagePolicyIds,
+    dryRunData,
+    notifications.toasts,
     theme$,
+    navigateToNewSettingsPage,
   ]);
 
   const updateModal = (
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/hooks/use_available_packages.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/hooks/use_available_packages.tsx
index b8d54b45759de..f11d82a9e20c3 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/hooks/use_available_packages.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/hooks/use_available_packages.tsx
@@ -11,7 +11,7 @@ import { uniq, xorBy } from 'lodash';
 import type { CustomIntegration } from '@kbn/custom-integrations-plugin/common';
 
 import type { IntegrationPreferenceType } from '../../../components/integration_preference';
-import { usePackages, useCategories } from '../../../../../hooks';
+import { useGetPackagesQuery, useGetCategoriesQuery } from '../../../../../hooks';
 import {
   useGetAppendCustomIntegrations,
   useGetReplacementCustomIntegrations,
@@ -130,7 +130,7 @@ export const useAvailablePackages = () => {
     data: eprPackages,
     isLoading: isLoadingAllPackages,
     error: eprPackageLoadingError,
-  } = usePackages(prereleaseIntegrationsEnabled);
+  } = useGetPackagesQuery({ prerelease: prereleaseIntegrationsEnabled });
 
   // Remove Kubernetes package granularity
   if (eprPackages?.items) {
@@ -185,7 +185,7 @@ export const useAvailablePackages = () => {
     data: eprCategoriesRes,
     isLoading: isLoadingCategories,
     error: eprCategoryLoadingError,
-  } = useCategories(prereleaseIntegrationsEnabled);
+  } = useGetCategoriesQuery({ prerelease: prereleaseIntegrationsEnabled });
 
   const eprCategories = useMemo(() => eprCategoriesRes?.items || [], [eprCategoriesRes]);
   // Subcategories
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
index d69fe175f0961..bbe61f2910210 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useMemo, useState } from 'react';
+import React, { useState } from 'react';
 import { Switch, Route } from 'react-router-dom';
 
 import type { CustomIntegration } from '@kbn/custom-integrations-plugin/common';
@@ -26,7 +26,7 @@ import type {
   IntegrationCardReleaseLabel,
 } from '../../../../../../../common/types/models';
 
-import { useGetPackages } from '../../../../hooks';
+import { useGetPackagesQuery } from '../../../../hooks';
 
 import type { CategoryFacet, ExtendedIntegrationCategory } from './category_facets';
 
@@ -115,14 +115,12 @@ export const EPMHomePage: React.FC = () => {
   const [prereleaseEnabled, setPrereleaseEnabled] = useState<boolean>(false);
 
   // loading packages to find installed ones
-  const { data: allPackages, isLoading } = useGetPackages({
+  const { data: allPackages, isLoading } = useGetPackagesQuery({
     prerelease: prereleaseEnabled,
   });
 
-  const installedPackages = useMemo(
-    () =>
-      (allPackages?.response || []).filter((pkg) => pkg.status === installationStatuses.Installed),
-    [allPackages?.response]
+  const installedPackages = (allPackages?.items || []).filter(
+    (pkg) => pkg.status === installationStatuses.Installed
   );
 
   const unverifiedPackageCount = installedPackages.filter(
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/policy/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/policy/index.tsx
index e78a2954a86d6..8eeb8622a56a7 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/policy/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/policy/index.tsx
@@ -10,17 +10,17 @@ import { useRouteMatch } from 'react-router-dom';
 
 // TODO: Needs to be moved
 import { EditPackagePolicyForm } from '../../../../../fleet/sections/agent_policy/edit_package_policy_page';
-import { useGetOnePackagePolicy, useUIExtension } from '../../../../hooks';
+import { useGetOnePackagePolicyQuery, useUIExtension } from '../../../../hooks';
 
 export const Policy = memo(() => {
   const {
     params: { packagePolicyId },
   } = useRouteMatch<{ packagePolicyId: string }>();
 
-  const packagePolicy = useGetOnePackagePolicy(packagePolicyId);
+  const { data: packagePolicyData } = useGetOnePackagePolicyQuery(packagePolicyId);
 
   const extensionView = useUIExtension(
-    packagePolicy.data?.item?.package?.name ?? '',
+    packagePolicyData?.item?.package?.name ?? '',
     'package-policy-edit'
   );
 
diff --git a/x-pack/plugins/fleet/public/hooks/use_fleet_status.tsx b/x-pack/plugins/fleet/public/hooks/use_fleet_status.tsx
index 29fa37f3b7270..95067a3158d25 100644
--- a/x-pack/plugins/fleet/public/hooks/use_fleet_status.tsx
+++ b/x-pack/plugins/fleet/public/hooks/use_fleet_status.tsx
@@ -44,6 +44,7 @@ export const FleetStatusProvider: React.FC = ({ children }) => {
     isReady: false,
   });
 
+  // TODO: Refactor to use react-query
   const sendGetStatus = useCallback(
     async function sendGetStatus() {
       try {
diff --git a/x-pack/plugins/fleet/public/hooks/use_package_installations.tsx b/x-pack/plugins/fleet/public/hooks/use_package_installations.tsx
new file mode 100644
index 0000000000000..f41bb9660f758
--- /dev/null
+++ b/x-pack/plugins/fleet/public/hooks/use_package_installations.tsx
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import semverLt from 'semver/functions/lt';
+
+import { installationStatuses } from '../../common/constants';
+import type { PackagePolicy } from '../types';
+
+import { useGetPackagesQuery } from './use_request/epm';
+import { useGetAgentPoliciesQuery } from './use_request/agent_policy';
+
+interface UpdatableIntegration {
+  currentVersion: string;
+  policiesToUpgrade: Array<{
+    id: string;
+    name: string;
+    agentsCount: number;
+    pkgPolicyId: string;
+    pkgPolicyName: string;
+    pkgPolicyIntegrationVersion: string;
+  }>;
+}
+
+export const usePackageInstallationsQuery = () => {
+  const { data: allPackages, isLoading: isLoadingPackages } = useGetPackagesQuery({
+    prerelease: true,
+  });
+
+  const { data: agentPolicyData, isLoading: isLoadingPolicies } = useGetAgentPoliciesQuery({
+    full: true,
+  });
+
+  const allInstalledPackages = useMemo(
+    () => (allPackages?.items || []).filter((pkg) => pkg.status === installationStatuses.Installed),
+    [allPackages?.items]
+  );
+
+  const updatablePackages = useMemo(
+    () =>
+      allInstalledPackages.filter(
+        (item) =>
+          'savedObject' in item && semverLt(item.savedObject.attributes.version, item.version)
+      ),
+    [allInstalledPackages]
+  );
+
+  const updatableIntegrations = useMemo<Map<string, UpdatableIntegration>>(
+    () =>
+      (agentPolicyData?.items || []).reduce((result, policy) => {
+        policy.package_policies?.forEach((pkgPolicy: PackagePolicy) => {
+          if (!pkgPolicy.package) return false;
+          const { name, version } = pkgPolicy.package;
+          const installedPackage = allInstalledPackages.find(
+            (installedPkg) =>
+              'savedObject' in installedPkg && installedPkg.savedObject.attributes.name === name
+          );
+          if (
+            installedPackage &&
+            'savedObject' in installedPackage &&
+            semverLt(version, installedPackage.savedObject.attributes.version)
+          ) {
+            const packageData = result.get(name) ?? {
+              currentVersion: installedPackage.savedObject.attributes.version,
+              policiesToUpgrade: [],
+            };
+            packageData.policiesToUpgrade.push({
+              id: policy.id,
+              name: policy.name,
+              agentsCount: policy.agents ?? 0,
+              pkgPolicyId: pkgPolicy.id,
+              pkgPolicyName: pkgPolicy.name,
+              pkgPolicyIntegrationVersion: version,
+            });
+            result.set(name, packageData);
+          }
+        });
+        return result;
+      }, new Map<string, UpdatableIntegration>()),
+    [allInstalledPackages, agentPolicyData]
+  );
+
+  return {
+    allPackages,
+    allInstalledPackages,
+    updatablePackages,
+    updatableIntegrations,
+    isLoadingPackages,
+    isLoadingPolicies,
+  };
+};
diff --git a/x-pack/plugins/fleet/public/hooks/use_request/agent_policy.ts b/x-pack/plugins/fleet/public/hooks/use_request/agent_policy.ts
index 248fb60f5bf70..39372fcc5c508 100644
--- a/x-pack/plugins/fleet/public/hooks/use_request/agent_policy.ts
+++ b/x-pack/plugins/fleet/public/hooks/use_request/agent_policy.ts
@@ -4,6 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { useQuery } from '@tanstack/react-query';
 
 import { agentPolicyRouteService } from '../../services';
 
@@ -22,8 +23,8 @@ import type {
   DeleteAgentPolicyResponse,
 } from '../../types';
 
-import { useRequest, sendRequest, useConditionalRequest } from './use_request';
-import type { SendConditionalRequestConfig } from './use_request';
+import { useRequest, sendRequest, useConditionalRequest, sendRequestForRq } from './use_request';
+import type { SendConditionalRequestConfig, RequestError } from './use_request';
 
 export const useGetAgentPolicies = (query?: GetAgentPoliciesRequest['query']) => {
   return useRequest<GetAgentPoliciesResponse>({
@@ -33,6 +34,16 @@ export const useGetAgentPolicies = (query?: GetAgentPoliciesRequest['query']) =>
   });
 };
 
+export const useGetAgentPoliciesQuery = (query?: GetAgentPoliciesRequest['query']) => {
+  return useQuery<GetAgentPoliciesResponse, RequestError>(['agentPolicies', query], () =>
+    sendRequestForRq<GetAgentPoliciesResponse>({
+      path: agentPolicyRouteService.getListPath(),
+      method: 'get',
+      query,
+    })
+  );
+};
+
 export const sendGetAgentPolicies = (query?: GetAgentPoliciesRequest['query']) => {
   return sendRequest<GetAgentPoliciesResponse>({
     path: agentPolicyRouteService.getListPath(),
diff --git a/x-pack/plugins/fleet/public/hooks/use_request/agents.ts b/x-pack/plugins/fleet/public/hooks/use_request/agents.ts
index 41e82bdf69015..ca53345bb5799 100644
--- a/x-pack/plugins/fleet/public/hooks/use_request/agents.ts
+++ b/x-pack/plugins/fleet/public/hooks/use_request/agents.ts
@@ -4,6 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { useQuery } from '@tanstack/react-query';
 
 import type {
   GetActionStatusResponse,
@@ -72,6 +73,13 @@ export function useGetAgents(query: GetAgentsRequest['query'], options?: Request
   });
 }
 
+export function useGetAgentsQuery(
+  query: GetAgentsRequest['query'],
+  options: Partial<{ enabled: boolean }> = {}
+) {
+  return useQuery(['agents', query], () => sendGetAgents(query), { enabled: options.enabled });
+}
+
 export function sendGetAgents(query: GetAgentsRequest['query'], options?: RequestOptions) {
   return sendRequest<GetAgentsResponse>({
     method: 'get',
diff --git a/x-pack/plugins/fleet/public/hooks/use_request/app.ts b/x-pack/plugins/fleet/public/hooks/use_request/app.ts
index 25c7a9cf1f046..5236356180d83 100644
--- a/x-pack/plugins/fleet/public/hooks/use_request/app.ts
+++ b/x-pack/plugins/fleet/public/hooks/use_request/app.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 
+import { useQuery } from '@tanstack/react-query';
+
 import { appRoutesService } from '../../services';
 import type { CheckPermissionsResponse, GenerateServiceTokenResponse } from '../../types';
 
-import { sendRequest, useRequest } from './use_request';
+import { sendRequest, sendRequestForRq, useRequest } from './use_request';
 
 export const sendGetPermissionsCheck = (fleetServerSetup?: boolean) => {
   return sendRequest<CheckPermissionsResponse>({
@@ -25,6 +27,17 @@ export const sendGenerateServiceToken = () => {
   });
 };
 
+export const usePermissionCheckQuery = () => {
+  return useQuery<CheckPermissionsResponse, CheckPermissionsResponse['error']>(
+    ['permissionsCheck'],
+    () =>
+      sendRequestForRq<CheckPermissionsResponse>({
+        path: appRoutesService.getCheckPermissionsPath(),
+        method: 'get',
+      })
+  );
+};
+
 export const usePermissionCheck = () => {
   return useRequest<CheckPermissionsResponse>({
     path: appRoutesService.getCheckPermissionsPath(),
diff --git a/x-pack/plugins/fleet/public/hooks/use_request/epm.ts b/x-pack/plugins/fleet/public/hooks/use_request/epm.ts
index f1a248c44c07b..dc3b5d1048e7f 100644
--- a/x-pack/plugins/fleet/public/hooks/use_request/epm.ts
+++ b/x-pack/plugins/fleet/public/hooks/use_request/epm.ts
@@ -6,8 +6,11 @@
  */
 
 import useAsync from 'react-use/lib/useAsync';
+import { useMutation, useQuery } from '@tanstack/react-query';
 
-import { useEffect, useState } from 'react';
+import { useState } from 'react';
+
+import type { SendRequestResponse } from '@kbn/es-ui-shared-plugin/public';
 
 import { epmRouteService, isVerificationError } from '../../services';
 import type {
@@ -28,7 +31,8 @@ import { getCustomIntegrations } from '../../services/custom_integrations';
 
 import { useConfirmOpenUnverified } from '../../applications/integrations/hooks/use_confirm_open_unverified';
 
-import { useRequest, sendRequest } from './use_request';
+import type { RequestError } from './use_request';
+import { useRequest, sendRequest, sendRequestForRq } from './use_request';
 
 export function useGetAppendCustomIntegrations() {
   const customIntegrations = getCustomIntegrations();
@@ -40,13 +44,15 @@ export function useGetReplacementCustomIntegrations() {
   return useAsync(customIntegrations.getReplacementCustomIntegrations, []);
 }
 
-export const useGetCategories = (query: GetCategoriesRequest['query'] = {}) => {
-  return useRequest<GetCategoriesResponse>({
-    path: epmRouteService.getCategoriesPath(),
-    method: 'get',
-    query,
-  });
-};
+export function useGetCategoriesQuery(query: GetCategoriesRequest['query'] = {}) {
+  return useQuery<GetCategoriesResponse, RequestError>(['categories', query], () =>
+    sendRequestForRq<GetCategoriesResponse>({
+      path: epmRouteService.getCategoriesPath(),
+      method: 'get',
+      query,
+    })
+  );
+}
 
 export const sendGetCategories = (query: GetCategoriesRequest['query'] = {}) => {
   return sendRequest<GetCategoriesResponse>({
@@ -64,6 +70,16 @@ export const useGetPackages = (query: GetPackagesRequest['query'] = {}) => {
   });
 };
 
+export const useGetPackagesQuery = (query: GetPackagesRequest['query']) => {
+  return useQuery<GetPackagesResponse, RequestError>(['get-packages', query], () =>
+    sendRequestForRq<GetPackagesResponse>({
+      path: epmRouteService.getListPath(),
+      method: 'get',
+      query,
+    })
+  );
+};
+
 export const sendGetPackages = (query: GetPackagesRequest['query'] = {}) => {
   return sendRequest<GetPackagesResponse>({
     path: epmRouteService.getListPath(),
@@ -79,7 +95,7 @@ export const useGetLimitedPackages = () => {
   });
 };
 
-export const useGetPackageInfoByKey = (
+export const useGetPackageInfoByKeyQuery = (
   pkgName: string,
   pkgVersion?: string,
   options?: {
@@ -92,30 +108,31 @@ export const useGetPackageInfoByKey = (
   const [ignoreUnverifiedQueryParam, setIgnoreUnverifiedQueryParam] = useState(
     options?.ignoreUnverified
   );
-  const res = useRequest<GetInfoResponse>({
-    path: epmRouteService.getInfoPath(pkgName, pkgVersion),
-    method: 'get',
-    query: {
-      ...options,
-      ...(ignoreUnverifiedQueryParam && { ignoreUnverified: ignoreUnverifiedQueryParam }),
-    },
-  });
 
-  useEffect(() => {
-    const confirm = async () => {
-      const forceInstall = await confirmOpenUnverified(pkgName);
+  const response = useQuery<GetInfoResponse, RequestError>([pkgName, pkgVersion, options], () =>
+    sendRequestForRq<GetInfoResponse>({
+      path: epmRouteService.getInfoPath(pkgName, pkgVersion),
+      method: 'get',
+      query: {
+        ...options,
+        ...(ignoreUnverifiedQueryParam && { ignoreUnverified: ignoreUnverifiedQueryParam }),
+      },
+    })
+  );
 
-      if (forceInstall) {
-        setIgnoreUnverifiedQueryParam(true);
-      }
-    };
+  const confirm = async () => {
+    const forceInstall = await confirmOpenUnverified(pkgName);
 
-    if (res.error && isVerificationError(res.error)) {
-      confirm();
+    if (forceInstall) {
+      setIgnoreUnverifiedQueryParam(true);
     }
-  }, [res.error, pkgName, pkgVersion, confirmOpenUnverified]);
+  };
 
-  return res;
+  if (response?.error && isVerificationError(response?.error)) {
+    confirm();
+  }
+
+  return response;
 };
 
 export const useGetPackageStats = (pkgName: string) => {
@@ -148,6 +165,12 @@ export const useGetFileByPath = (filePath: string) => {
   });
 };
 
+export const useGetFileByPathQuery = (filePath: string) => {
+  return useQuery<SendRequestResponse<string>, RequestError>(['get-file', filePath], () =>
+    sendRequest<string>({ path: epmRouteService.getFilePath(filePath), method: 'get' })
+  );
+};
+
 export const sendGetFileByPath = (filePath: string) => {
   return sendRequest<string>({
     path: epmRouteService.getFilePath(filePath),
@@ -184,6 +207,23 @@ export const sendRemovePackage = (pkgName: string, pkgVersion: string, force: bo
   });
 };
 
+interface UpdatePackageArgs {
+  pkgName: string;
+  pkgVersion: string;
+  body: UpdatePackageRequest['body'];
+}
+
+export const useUpdatePackageMutation = () => {
+  return useMutation<UpdatePackageResponse, RequestError, UpdatePackageArgs>(
+    ({ pkgName, pkgVersion, body }: UpdatePackageArgs) =>
+      sendRequestForRq<UpdatePackageResponse>({
+        path: epmRouteService.getUpdatePath(pkgName, pkgVersion),
+        method: 'put',
+        body,
+      })
+  );
+};
+
 export const sendUpdatePackage = (
   pkgName: string,
   pkgVersion: string,
diff --git a/x-pack/plugins/fleet/public/hooks/use_request/package_policy.ts b/x-pack/plugins/fleet/public/hooks/use_request/package_policy.ts
index 3e029f6257d2e..4a573bb5e5883 100644
--- a/x-pack/plugins/fleet/public/hooks/use_request/package_policy.ts
+++ b/x-pack/plugins/fleet/public/hooks/use_request/package_policy.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { useMutation, useQuery } from '@tanstack/react-query';
+
 import { packagePolicyRouteService } from '../../services';
 import type {
   CreatePackagePolicyRequest,
@@ -22,7 +24,8 @@ import type {
   UpgradePackagePolicyResponse,
 } from '../../../common/types/rest_spec';
 
-import { sendRequest, useRequest } from './use_request';
+import type { RequestError } from './use_request';
+import { sendRequest, sendRequestForRq, useRequest } from './use_request';
 
 export const sendCreatePackagePolicy = (body: CreatePackagePolicyRequest['body']) => {
   return sendRequest<CreatePackagePolicyResponse>({
@@ -51,6 +54,16 @@ export const sendDeletePackagePolicy = (body: DeletePackagePoliciesRequest['body
   });
 };
 
+export function useGetPackagePoliciesQuery(query: GetPackagePoliciesRequest['query']) {
+  return useQuery<GetPackagePoliciesResponse, RequestError>(['packagePolicies'], () =>
+    sendRequestForRq<GetPackagePoliciesResponse>({
+      method: 'get',
+      path: packagePolicyRouteService.getListPath(),
+      query,
+    })
+  );
+}
+
 export function useGetPackagePolicies(query: GetPackagePoliciesRequest['query']) {
   return useRequest<GetPackagePoliciesResponse>({
     method: 'get',
@@ -67,6 +80,17 @@ export const sendGetPackagePolicies = (query: GetPackagePoliciesRequest['query']
   });
 };
 
+export const useGetOnePackagePolicyQuery = (packagePolicyId: string) => {
+  return useQuery<GetOnePackagePolicyResponse, RequestError>(
+    ['packagePolicy', packagePolicyId],
+    () =>
+      sendRequestForRq<GetOnePackagePolicyResponse>({
+        method: 'get',
+        path: packagePolicyRouteService.getInfoPath(packagePolicyId),
+      })
+  );
+};
+
 export const useGetOnePackagePolicy = (packagePolicyId: string) => {
   return useRequest<GetOnePackagePolicyResponse>({
     path: packagePolicyRouteService.getInfoPath(packagePolicyId),
@@ -81,6 +105,31 @@ export const sendGetOnePackagePolicy = (packagePolicyId: string) => {
   });
 };
 
+export function useUpgradePackagePolicyDryRunQuery(
+  packagePolicyIds: string[],
+  packageVersion?: string,
+  { enabled }: Partial<{ enabled: boolean }> = {}
+) {
+  const body: { packagePolicyIds: string[]; packageVersion?: string } = {
+    packagePolicyIds,
+  };
+
+  if (packageVersion) {
+    body.packageVersion = packageVersion;
+  }
+
+  return useQuery<UpgradePackagePolicyDryRunResponse, RequestError>(
+    ['upgradePackagePolicyDryRun', packagePolicyIds, packageVersion],
+    () =>
+      sendRequestForRq<UpgradePackagePolicyDryRunResponse>({
+        path: packagePolicyRouteService.getDryRunPath(),
+        method: 'post',
+        body: JSON.stringify(body),
+      }),
+    { enabled }
+  );
+}
+
 export function sendUpgradePackagePolicyDryRun(
   packagePolicyIds: string[],
   packageVersion?: string
@@ -100,6 +149,22 @@ export function sendUpgradePackagePolicyDryRun(
   });
 }
 
+export function useUpgradePackagePoliciesMutation() {
+  return useMutation<
+    UpgradePackagePolicyDryRunResponse,
+    RequestError,
+    { packagePolicyIds: string[] }
+  >(({ packagePolicyIds }) =>
+    sendRequestForRq<UpgradePackagePolicyDryRunResponse>({
+      path: packagePolicyRouteService.getUpgradePath(),
+      method: 'post',
+      body: JSON.stringify({
+        packagePolicyIds,
+      }),
+    })
+  );
+}
+
 export function sendUpgradePackagePolicy(packagePolicyIds: string[]) {
   return sendRequest<UpgradePackagePolicyResponse>({
     path: packagePolicyRouteService.getUpgradePath(),
diff --git a/x-pack/plugins/fleet/public/hooks/use_request/settings.ts b/x-pack/plugins/fleet/public/hooks/use_request/settings.ts
index fdd6e87bdc02f..41131a32593de 100644
--- a/x-pack/plugins/fleet/public/hooks/use_request/settings.ts
+++ b/x-pack/plugins/fleet/public/hooks/use_request/settings.ts
@@ -5,10 +5,22 @@
  * 2.0.
  */
 
+import { useQuery } from '@tanstack/react-query';
+
 import { settingsRoutesService } from '../../services';
 import type { PutSettingsResponse, PutSettingsRequest, GetSettingsResponse } from '../../types';
 
-import { sendRequest, useRequest } from './use_request';
+import type { RequestError } from './use_request';
+import { sendRequest, sendRequestForRq, useRequest } from './use_request';
+
+export function useGetSettingsQuery() {
+  return useQuery<GetSettingsResponse, RequestError>(['settings'], () =>
+    sendRequestForRq<GetSettingsResponse>({
+      method: 'get',
+      path: settingsRoutesService.getInfoPath(),
+    })
+  );
+}
 
 export function useGetSettings() {
   return useRequest<GetSettingsResponse>({
diff --git a/x-pack/plugins/fleet/public/hooks/use_request/use_request.ts b/x-pack/plugins/fleet/public/hooks/use_request/use_request.ts
index 79afb6e2238da..9bd7d482e7e4a 100644
--- a/x-pack/plugins/fleet/public/hooks/use_request/use_request.ts
+++ b/x-pack/plugins/fleet/public/hooks/use_request/use_request.ts
@@ -42,6 +42,26 @@ export const sendRequest = <D = any, E = RequestError>(
   return _sendRequest<D, E>(httpClient, config);
 };
 
+// Sends requests with better ergonomics for React Query, e.g. throw error rather
+// than resolving with an `error` property in the result. Also returns `data` directly
+// as opposed to { data } in a response object.
+export const sendRequestForRq = async <D = any, E = RequestError>(
+  config: SendRequestConfig
+): Promise<D> => {
+  if (!httpClient) {
+    throw new Error('sendRequest has no http client set');
+  }
+
+  const response = await _sendRequest<D, E>(httpClient, config);
+
+  if (response.error) {
+    throw response.error;
+  }
+
+  // Data can't be null so long as `_sendRequest` did not throw
+  return response.data!;
+};
+
 export const useRequest = <D = any, E = RequestError>(config: UseRequestConfig) => {
   if (!httpClient) {
     throw new Error('sendRequest has no http client set');

From 84003d2a8b34d6e066d8551a670387b5dd97b55a Mon Sep 17 00:00:00 2001
From: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>
Date: Wed, 8 Feb 2023 16:25:27 +0100
Subject: [PATCH 129/134] [Fleet] disable reinstall with tooltip for uploaded
 packages (#150535)

## Summary

Disable Reinstall button and added tooltip to prevent clicking Reinstall
for uploaded packages.

Related to
https://github.com/elastic/kibana/issues/148599#issuecomment-1420869104

<img width="731" alt="image"
src="https://user-images.githubusercontent.com/90178898/217497440-e36bad4d-d4dc-4d1c-b434-b17f0a4ead0a.png">



### Checklist


- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
---
 .../detail/settings/reinstall_button.tsx      | 69 +++++++++++++------
 .../epm/screens/detail/settings/settings.tsx  |  9 ++-
 2 files changed, 55 insertions(+), 23 deletions(-)

diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/reinstall_button.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/reinstall_button.tsx
index c14e4eeb2edf6..5a63208d55e9c 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/reinstall_button.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/reinstall_button.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { EuiButton } from '@elastic/eui';
+import { EuiButton, EuiToolTip } from '@elastic/eui';
 import React, { Fragment, useCallback } from 'react';
 import { FormattedMessage } from '@kbn/i18n-react';
 
@@ -13,41 +13,66 @@ import type { PackageInfo } from '../../../../../types';
 import { InstallStatus } from '../../../../../types';
 import { useAuthz, useGetPackageInstallStatus, useInstallPackage } from '../../../../../hooks';
 
-type ReinstallationButtonProps = Pick<PackageInfo, 'name' | 'title' | 'version'>;
+type ReinstallationButtonProps = Pick<PackageInfo, 'name' | 'title' | 'version'> & {
+  installSource: string;
+};
 export function ReinstallButton(props: ReinstallationButtonProps) {
-  const { name, title, version } = props;
+  const { name, title, version, installSource } = props;
   const canInstallPackages = useAuthz().integrations.installPackages;
   const installPackage = useInstallPackage();
   const getPackageInstallStatus = useGetPackageInstallStatus();
   const { status: installationStatus } = getPackageInstallStatus(name);
 
   const isReinstalling = installationStatus === InstallStatus.reinstalling;
+  const isUploadedPackage = installSource === 'upload';
 
   const handleClickReinstall = useCallback(() => {
     installPackage({ name, version, title, isReinstall: true });
   }, [installPackage, name, title, version]);
 
+  const reinstallButton = (
+    <EuiButton
+      iconType="refresh"
+      isLoading={isReinstalling}
+      onClick={handleClickReinstall}
+      disabled={isUploadedPackage}
+    >
+      {isReinstalling ? (
+        <FormattedMessage
+          id="xpack.fleet.integrations.installPackage.reinstallingPackageButtonLabel"
+          defaultMessage="Reinstalling {title}"
+          values={{
+            title,
+          }}
+        />
+      ) : (
+        <FormattedMessage
+          id="xpack.fleet.integrations.installPackage.reinstallPackageButtonLabel"
+          defaultMessage="Reinstall {title}"
+          values={{
+            title,
+          }}
+        />
+      )}
+    </EuiButton>
+  );
+
   return canInstallPackages ? (
     <Fragment>
-      <EuiButton iconType="refresh" isLoading={isReinstalling} onClick={handleClickReinstall}>
-        {isReinstalling ? (
-          <FormattedMessage
-            id="xpack.fleet.integrations.installPackage.reinstallingPackageButtonLabel"
-            defaultMessage="Reinstalling {title}"
-            values={{
-              title,
-            }}
-          />
-        ) : (
-          <FormattedMessage
-            id="xpack.fleet.integrations.installPackage.reinstallPackageButtonLabel"
-            defaultMessage="Reinstall {title}"
-            values={{
-              title,
-            }}
-          />
-        )}
-      </EuiButton>
+      {isUploadedPackage ? (
+        <EuiToolTip
+          content={
+            <FormattedMessage
+              id="xpack.fleet.integrations.installPackage.uploadedTooltip"
+              defaultMessage="This integration was installed by upload and cannot be automatically reinstalled. Please upload it again to reinstall."
+            />
+          }
+        >
+          {reinstallButton}
+        </EuiToolTip>
+      ) : (
+        reinstallButton
+      )}
     </Fragment>
   ) : null;
 }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
index 29e3ea7c95c81..966b0419285ec 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
@@ -410,7 +410,14 @@ export const SettingsPage: React.FC<Props> = memo(({ packageInfo, theme$ }: Prop
                     </EuiFlexItem>
                     <EuiFlexItem grow={false}>
                       <div>
-                        <ReinstallButton {...packageInfo} />
+                        <ReinstallButton
+                          {...packageInfo}
+                          installSource={
+                            'savedObject' in packageInfo
+                              ? packageInfo.savedObject.attributes.install_source
+                              : ''
+                          }
+                        />
                       </div>
                     </EuiFlexItem>
                   </EuiFlexGroup>

From f2943a369afc62aab59d2d852aff2bde6713d5d5 Mon Sep 17 00:00:00 2001
From: Elastic Machine <elasticmachine@users.noreply.github.com>
Date: Thu, 9 Feb 2023 01:55:43 +1030
Subject: [PATCH 130/134] [main] Sync bundled packages with Package Storage
 (#150523)

Automated by
https://internal-ci.elastic.co/job/package_storage/job/sync-bundled-packages-job/job/main/1704/

Co-authored-by: apmmachine <infra-root+apmmachine@elastic.co>
---
 fleet_packages.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fleet_packages.json b/fleet_packages.json
index fcb628f52610f..109fa8e5da7dc 100644
--- a/fleet_packages.json
+++ b/fleet_packages.json
@@ -25,7 +25,7 @@
   },
   {
     "name": "elastic_agent",
-    "version": "1.5.0"
+    "version": "1.5.1"
   },
   {
     "name": "endpoint",

From f935d066f6b07b20f5bf76636a3d09dd70e06e32 Mon Sep 17 00:00:00 2001
From: Katerina Patticha <aikaterini.patticha@elastic.co>
Date: Wed, 8 Feb 2023 16:37:13 +0100
Subject: [PATCH 131/134] [APM] Fix sorting by transaction name (#150547)

Closes https://github.com/elastic/kibana/issues/99345


https://user-images.githubusercontent.com/3369346/217521154-012aca9a-5857-463c-8e56-bee44c2b002b.mov
---
 .../public/components/app/top_traces_overview/trace_list.tsx    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/apm/public/components/app/top_traces_overview/trace_list.tsx b/x-pack/plugins/apm/public/components/app/top_traces_overview/trace_list.tsx
index 76ec4720fa060..32044af7219b0 100644
--- a/x-pack/plugins/apm/public/components/app/top_traces_overview/trace_list.tsx
+++ b/x-pack/plugins/apm/public/components/app/top_traces_overview/trace_list.tsx
@@ -45,7 +45,7 @@ export function getTraceListColumns({
 }): Array<ITableColumn<TraceGroup>> {
   return [
     {
-      field: 'name',
+      field: 'transactionName',
       name: i18n.translate('xpack.apm.tracesTable.nameColumnLabel', {
         defaultMessage: 'Name',
       }),

From 5f43b49df31f1318f4bcee7dc1beb31b80db190e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Marcondes?=
 <55978943+cauemarcondes@users.noreply.github.com>
Date: Wed, 8 Feb 2023 11:26:10 -0500
Subject: [PATCH 132/134] [APM]Latency threshold rule's threshold context
 variable should use milliseconds instead of microseconds (#150234)

closes https://github.com/elastic/kibana/issues/125323

I couldn't test it yet, since alerts are firing with any context
variable. I'll hold on to merge this until I can fully test it.

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../register_transaction_duration_rule_type.test.ts           | 2 +-
 .../register_transaction_duration_rule_type.ts                | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.test.ts b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.test.ts
index 1066eb8a987d8..cebf71f1bad97 100644
--- a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.test.ts
+++ b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.test.ts
@@ -65,7 +65,7 @@ describe('registerTransactionDurationRuleType', () => {
         'Avg. latency is 5,500 ms in the last 5 mins for opbeans-java. Alert when > 3,000 ms.',
       transactionType: 'request',
       serviceName: 'opbeans-java',
-      threshold: 3000000,
+      threshold: 3000,
       triggerValue: '5,500 ms',
       viewInAppUrl:
         'http://localhost:5601/eyr/app/apm/services/opbeans-java?transactionType=request&environment=ENVIRONMENT_ALL',
diff --git a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts
index 75e1aef357088..803945568494b 100644
--- a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts
+++ b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts
@@ -281,7 +281,7 @@ export function registerTransactionDurationRuleType({
               [TRANSACTION_TYPE]: transactionType,
               [PROCESSOR_EVENT]: ProcessorEvent.transaction,
               [ALERT_EVALUATION_VALUE]: transactionDuration,
-              [ALERT_EVALUATION_THRESHOLD]: thresholdMicroseconds,
+              [ALERT_EVALUATION_THRESHOLD]: ruleParams.threshold,
               [ALERT_REASON]: reason,
               ...sourceFields,
             },
@@ -292,7 +292,7 @@ export function registerTransactionDurationRuleType({
             interval: `${ruleParams.windowSize}${ruleParams.windowUnit}`,
             reason,
             serviceName,
-            threshold: thresholdMicroseconds,
+            threshold: ruleParams.threshold,
             transactionType,
             triggerValue: transactionDurationFormatted,
             viewInAppUrl,

From 903173dff13bb2ac17f386a73ef97bb8812c1043 Mon Sep 17 00:00:00 2001
From: Lisa Cawley <lcawley@elastic.co>
Date: Wed, 8 Feb 2023 08:30:14 -0800
Subject: [PATCH 133/134] [DOCS] Add summary capabilities to the open API
 specification  (#149998)

---
 .../rules/rule-apis-passthru.asciidoc         |  86 ++++++++++-
 .../alerting/docs/openapi/bundled.json        | 143 +++++++++++++-----
 .../alerting/docs/openapi/bundled.yaml        | 130 +++++++++++-----
 .../examples/create_rule_request.yaml         |   4 +-
 .../examples/create_rule_response.yaml        |   5 +
 .../examples/update_rule_request.yaml         |  27 ++--
 .../examples/update_rule_response.yaml        |  26 +++-
 .../openapi/components/schemas/actions.yaml   |  21 +++
 .../schemas/create_rule_request.yaml          |   1 -
 .../schemas/rule_response_properties.yaml     |   4 +-
 .../schemas/update_rule_request.yaml          |   1 -
 11 files changed, 344 insertions(+), 104 deletions(-)

diff --git a/docs/api-generated/rules/rule-apis-passthru.asciidoc b/docs/api-generated/rules/rule-apis-passthru.asciidoc
index 0626e0e43a8bd..12515fba838ee 100644
--- a/docs/api-generated/rules/rule-apis-passthru.asciidoc
+++ b/docs/api-generated/rules/rule-apis-passthru.asciidoc
@@ -119,6 +119,7 @@ Any modifications made to this file will be overwritten.
   "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
   "rule_type_id" : "monitoring_alert_cluster_health",
   "tags" : [ "tags", "tags" ],
+  "running" : true,
   "api_key_owner" : "elastic",
   "schedule" : {
     "interval" : "1m"
@@ -141,12 +142,24 @@ Any modifications made to this file will be overwritten.
     "params" : {
       "key" : ""
     },
+    "connector_type_id" : ".server-log",
+    "frequency" : {
+      "summary" : true,
+      "throttle" : "10m",
+      "notify_when" : "onActiveAlert"
+    },
     "group" : "default"
   }, {
     "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
     "params" : {
       "key" : ""
     },
+    "connector_type_id" : ".server-log",
+    "frequency" : {
+      "summary" : true,
+      "throttle" : "10m",
+      "notify_when" : "onActiveAlert"
+    },
     "group" : "default"
   } ],
   "consumer" : "alerts"
@@ -402,6 +415,7 @@ Any modifications made to this file will be overwritten.
     "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
     "rule_type_id" : "monitoring_alert_cluster_health",
     "tags" : [ "tags", "tags" ],
+    "running" : true,
     "api_key_owner" : "elastic",
     "schedule" : {
       "interval" : "1m"
@@ -424,12 +438,24 @@ Any modifications made to this file will be overwritten.
       "params" : {
         "key" : ""
       },
+      "connector_type_id" : ".server-log",
+      "frequency" : {
+        "summary" : true,
+        "throttle" : "10m",
+        "notify_when" : "onActiveAlert"
+      },
       "group" : "default"
     }, {
       "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
       "params" : {
         "key" : ""
       },
+      "connector_type_id" : ".server-log",
+      "frequency" : {
+        "summary" : true,
+        "throttle" : "10m",
+        "notify_when" : "onActiveAlert"
+      },
       "group" : "default"
     } ],
     "consumer" : "alerts"
@@ -455,6 +481,7 @@ Any modifications made to this file will be overwritten.
     "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
     "rule_type_id" : "monitoring_alert_cluster_health",
     "tags" : [ "tags", "tags" ],
+    "running" : true,
     "api_key_owner" : "elastic",
     "schedule" : {
       "interval" : "1m"
@@ -477,12 +504,24 @@ Any modifications made to this file will be overwritten.
       "params" : {
         "key" : ""
       },
+      "connector_type_id" : ".server-log",
+      "frequency" : {
+        "summary" : true,
+        "throttle" : "10m",
+        "notify_when" : "onActiveAlert"
+      },
       "group" : "default"
     }, {
       "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
       "params" : {
         "key" : ""
       },
+      "connector_type_id" : ".server-log",
+      "frequency" : {
+        "summary" : true,
+        "throttle" : "10m",
+        "notify_when" : "onActiveAlert"
+      },
       "group" : "default"
     } ],
     "consumer" : "alerts"
@@ -638,6 +677,7 @@ Any modifications made to this file will be overwritten.
   "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
   "rule_type_id" : "monitoring_alert_cluster_health",
   "tags" : [ "tags", "tags" ],
+  "running" : true,
   "api_key_owner" : "elastic",
   "schedule" : {
     "interval" : "1m"
@@ -660,12 +700,24 @@ Any modifications made to this file will be overwritten.
     "params" : {
       "key" : ""
     },
+    "connector_type_id" : ".server-log",
+    "frequency" : {
+      "summary" : true,
+      "throttle" : "10m",
+      "notify_when" : "onActiveAlert"
+    },
     "group" : "default"
   }, {
     "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
     "params" : {
       "key" : ""
     },
+    "connector_type_id" : ".server-log",
+    "frequency" : {
+      "summary" : true,
+      "throttle" : "10m",
+      "notify_when" : "onActiveAlert"
+    },
     "group" : "default"
   } ],
   "consumer" : "alerts"
@@ -1983,6 +2035,7 @@ Any modifications made to this file will be overwritten.
   "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
   "rule_type_id" : "monitoring_alert_cluster_health",
   "tags" : [ "tags", "tags" ],
+  "running" : true,
   "api_key_owner" : "elastic",
   "schedule" : {
     "interval" : "1m"
@@ -2005,12 +2058,24 @@ Any modifications made to this file will be overwritten.
     "params" : {
       "key" : ""
     },
+    "connector_type_id" : ".server-log",
+    "frequency" : {
+      "summary" : true,
+      "throttle" : "10m",
+      "notify_when" : "onActiveAlert"
+    },
     "group" : "default"
   }, {
     "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
     "params" : {
       "key" : ""
     },
+    "connector_type_id" : ".server-log",
+    "frequency" : {
+      "summary" : true,
+      "throttle" : "10m",
+      "notify_when" : "onActiveAlert"
+    },
     "group" : "default"
   } ],
   "consumer" : "alerts"
@@ -2049,6 +2114,7 @@ Any modifications made to this file will be overwritten.
     <li><a href="#Legacy_update_alert_request_properties_actions_inner"><code>Legacy_update_alert_request_properties_actions_inner</code> - </a></li>
     <li><a href="#Legacy_update_alert_request_properties_schedule"><code>Legacy_update_alert_request_properties_schedule</code> - </a></li>
     <li><a href="#actions_inner"><code>actions_inner</code> - </a></li>
+    <li><a href="#actions_inner_frequency"><code>actions_inner_frequency</code> - </a></li>
     <li><a href="#alert_response_properties"><code>alert_response_properties</code> - Legacy alert response properties</a></li>
     <li><a href="#alert_response_properties_executionStatus"><code>alert_response_properties_executionStatus</code> - </a></li>
     <li><a href="#alert_response_properties_schedule"><code>alert_response_properties_schedule</code> - </a></li>
@@ -2177,11 +2243,22 @@ Any modifications made to this file will be overwritten.
     <h3><a name="actions_inner"><code>actions_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
     <div class='model-description'></div>
     <div class="field-items">
-      <div class="param">group (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The group name for the actions. If you don't need to group actions, set to <code>default</code>. </div>
+      <div class="param">connector_type_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. This property appears in responses but cannot be set in requests. </div>
+<div class="param">frequency (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner_frequency">actions_inner_frequency</a></span>  </div>
+<div class="param">group (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The group name for the actions. If you don't need to group actions, set to <code>default</code>. </div>
 <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector saved object. </div>
 <div class="param">params (optional)</div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the action, which are sent to the connector. The <code>params</code> are handled as Mustache templates and passed a default set of context. </div>
     </div>  <!-- field-items -->
   </div>
+  <div class="model">
+    <h3><a name="actions_inner_frequency"><code>actions_inner_frequency</code> - </a> <a class="up" href="#__Models">Up</a></h3>
+    <div class='model-description'>The parameters that affect how often actions are generated. NOTE: You cannot specify these parameters when <code>notify_when</code> or <code>throttle</code> are defined at the rule level.</div>
+    <div class="field-items">
+      <div class="param">notify_when </div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
+<div class="param">summary </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the action is a summary. </div>
+<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. It is specified in seconds, minutes, hours, or days. </div>
+    </div>  <!-- field-items -->
+  </div>
   <div class="model">
     <h3><a name="alert_response_properties"><code>alert_response_properties</code> - Legacy alert response properties</a> <a class="up" href="#__Models">Up</a></h3>
     <div class='model-description'></div>
@@ -2230,7 +2307,7 @@ Any modifications made to this file will be overwritten.
 <div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
 <div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
 <div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when </div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
+<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
 <div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the rule. </div>
 <div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. For example, <code>.es-query</code>, <code>.index-threshold</code>, <code>logs.alert.document.count</code>, <code>monitoring_alert_cluster_health</code>, <code>siem.thresholdRule</code>, or <code>xpack.ml.anomaly_detection_alert</code>. </div>
 <div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
@@ -2537,9 +2614,10 @@ Any modifications made to this file will be overwritten.
 <div class="param">mute_all </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
 <div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. </div>
 <div class="param">next_run (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">notify_when </div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
+<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
 <div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the rule. </div>
 <div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the type of rule. For example, <code>.es-query</code>, <code>.index-threshold</code>, <code>logs.alert.document.count</code>, <code>monitoring_alert_cluster_health</code>, <code>siem.thresholdRule</code>, or <code>xpack.ml.anomaly_detection_alert</code>. </div>
+<div class="param">running (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the rule is running. </div>
 <div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
 <div class="param">scheduled_task_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
 <div class="param">tags </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
@@ -2590,7 +2668,7 @@ Any modifications made to this file will be overwritten.
     <div class="field-items">
       <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
 <div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. </div>
-<div class="param">notify_when </div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
+<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
 <div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the rule. </div>
 <div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
 <div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
diff --git a/x-pack/plugins/alerting/docs/openapi/bundled.json b/x-pack/plugins/alerting/docs/openapi/bundled.json
index a245616abe461..e7fbc15c77c01 100644
--- a/x-pack/plugins/alerting/docs/openapi/bundled.json
+++ b/x-pack/plugins/alerting/docs/openapi/bundled.json
@@ -2500,6 +2500,23 @@
       }
     },
     "schemas": {
+      "notify_when": {
+        "type": "string",
+        "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met.\n",
+        "enum": [
+          "onActionGroupChange",
+          "onActiveAlert",
+          "onThrottleInterval"
+        ],
+        "example": "onActiveAlert"
+      },
+      "throttle": {
+        "type": "string",
+        "description": "The throttle interval, which defines how often an alert generates repeated actions. It is applicable only if `notify_when` is set to `onThrottleInterval`. It is specified in seconds, minutes, hours, or days.",
+        "nullable": true,
+        "default": null,
+        "example": "10m"
+      },
       "actions": {
         "type": "array",
         "default": [],
@@ -2512,6 +2529,32 @@
         "items": {
           "type": "object",
           "properties": {
+            "connector_type_id": {
+              "type": "string",
+              "description": "The type of connector. This property appears in responses but cannot be set in requests.",
+              "example": ".server-log",
+              "readOnly": true
+            },
+            "frequency": {
+              "type": "object",
+              "description": "The parameters that affect how often actions are generated. NOTE: You cannot specify these parameters when `notify_when` or `throttle` are defined at the rule level.\n",
+              "required": [
+                "notify_when",
+                "summary"
+              ],
+              "properties": {
+                "notify_when": {
+                  "$ref": "#/components/schemas/notify_when"
+                },
+                "summary": {
+                  "type": "boolean",
+                  "description": "Indicates whether the action is a summary."
+                },
+                "throttle": {
+                  "$ref": "#/components/schemas/throttle"
+                }
+              }
+            },
             "group": {
               "type": "string",
               "description": "The group name for the actions. If you don't need to group actions, set to `default`.",
@@ -2530,16 +2573,6 @@
           }
         }
       },
-      "notify_when": {
-        "type": "string",
-        "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met.\n",
-        "enum": [
-          "onActionGroupChange",
-          "onActiveAlert",
-          "onThrottleInterval"
-        ],
-        "example": "onActiveAlert"
-      },
       "schedule": {
         "type": "object",
         "description": "The check interval, which specifies how frequently the rule conditions are checked. The interval is specified in seconds, minutes, hours, or days.",
@@ -2558,13 +2591,6 @@
         },
         "default": []
       },
-      "throttle": {
-        "type": "string",
-        "description": "The throttle interval, which defines how often an alert generates repeated actions. It is applicable only if `notify_when` is set to `onThrottleInterval`. It is specified in seconds, minutes, hours, or days.",
-        "nullable": true,
-        "default": null,
-        "example": "10m"
-      },
       "rule_response_properties": {
         "title": "Rule response properties",
         "type": "object",
@@ -2580,7 +2606,6 @@
           "mute_all",
           "muted_alert_ids",
           "name",
-          "notify_when",
           "params",
           "rule_type_id",
           "schedule",
@@ -2714,6 +2739,10 @@
             "description": "The identifier for the type of rule. For example, `.es-query`, `.index-threshold`, `logs.alert.document.count`, `monitoring_alert_cluster_health`, `siem.thresholdRule`, or `xpack.ml.anomaly_detection_alert`.\n",
             "example": "monitoring_alert_cluster_health"
           },
+          "running": {
+            "type": "boolean",
+            "description": "Indicates whether the rule is running."
+          },
           "schedule": {
             "$ref": "#/components/schemas/schedule"
           },
@@ -2792,7 +2821,6 @@
         "type": "object",
         "required": [
           "name",
-          "notify_when",
           "params",
           "schedule"
         ],
@@ -2831,7 +2859,6 @@
         "required": [
           "consumer",
           "name",
-          "notify_when",
           "params",
           "rule_type_id",
           "schedule"
@@ -3064,30 +3091,42 @@
       "update_rule_request": {
         "summary": "Update an index threshold rule.",
         "value": {
-          "notify_when": "onActionGroupChange",
+          "actions": [
+            {
+              "frequency": {
+                "summary": false,
+                "notify_when": "onActionGroupChange"
+              },
+              "group": "threshold met",
+              "id": "96b668d0-a1b6-11ed-afdf-d39a49596974",
+              "params": {
+                "level": "info",
+                "message": "alert {{alertName}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
+              }
+            }
+          ],
           "params": {
+            "aggField": "sheet.version",
+            "aggType": "avg",
             "index": [
               ".test-index"
             ],
-            "timeField": "@timestamp",
             "groupBy": "top",
-            "aggType": "avg",
-            "timeWindowSize": 5,
-            "timeWindowUnit": "m",
-            "thresholdComparator": ">",
+            "termField": "name.keyword",
+            "termSize": 6,
             "threshold": [
               1000
             ],
-            "aggField": "sheet.version",
-            "termField": "name.keyword",
-            "termSize": 6
+            "thresholdComparator": ">",
+            "timeField": "@timestamp",
+            "timeWindowSize": 5,
+            "timeWindowUnit": "m"
           },
+          "name": "new name",
           "schedule": {
             "interval": "1m"
           },
-          "actions": [],
           "tags": [],
-          "name": "new name",
           "throttle": null
         }
       },
@@ -3100,8 +3139,9 @@
           "name": "new name",
           "enabled": true,
           "throttle": null,
+          "running": false,
           "schedule": {
-            "interval": "1m"
+            "interval": "10m"
           },
           "params": {
             "index": [
@@ -3125,17 +3165,31 @@
           "updated_by": "elastic",
           "rule_type_id": ".index-threshold",
           "scheduled_task_id": "4c5eda00-e74f-11ec-b72f-5b18752ff9ea",
-          "created_at": "2022-12-12T22:43:20.578Z",
-          "updated_at": "2022-12-12T22:44:21.783Z",
-          "notify_when": "onActionGroupChange",
+          "created_at": "2023-01-31T23:03:33.127Z",
+          "updated_at": "2023-01-31T23:55:27.314Z",
           "mute_all": false,
           "muted_alert_ids": [],
           "execution_status": {
             "status": "ok",
-            "last_execution_date": "2022-12-12T22:43:21.723Z",
-            "last_duration": 125
+            "last_execution_date": "2023-01-31T23:48:42.499Z",
+            "last_duration": 52
           },
-          "actions": [],
+          "actions": [
+            {
+              "group": "threshold met",
+              "params": {
+                "level": "info",
+                "message": "alert {{alertName}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}"
+              },
+              "id": "96b668d0-a1b6-11ed-afdf-d39a49596974",
+              "connector_type_id": ".server-log",
+              "frequency": {
+                "summary": false,
+                "throttle": null,
+                "notify_when": "onActionGroupChange"
+              }
+            }
+          ],
           "last_run": {
             "alerts_count": {
               "new": 0,
@@ -3147,7 +3201,7 @@
             "warning": null,
             "outcome": "succeeded"
           },
-          "next_run": "2022-12-12T22:44:21.653Z"
+          "next_run": "2023-01-31T23:49:42.432Z"
         }
       },
       "create_rule_request": {
@@ -3156,6 +3210,10 @@
           "actions": [
             {
               "id": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2",
+              "frequency": {
+                "notify_when": "onActionGroupChange",
+                "summary": false
+              },
               "group": "threshold met",
               "params": {
                 "level": "info",
@@ -3165,7 +3223,6 @@
           ],
           "consumer": "alerts",
           "name": "my rule",
-          "notify_when": "onActionGroupChange",
           "params": {
             "aggType": "avg",
             "termSize": 6,
@@ -3199,6 +3256,11 @@
             {
               "group": "threshold met",
               "id": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2",
+              "frequency": {
+                "notify_when": "onActionGroupChange",
+                "summary": false,
+                "throttle": null
+              },
               "params": {
                 "level": "info",
                 "message": "alert {{alertName}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
@@ -3237,6 +3299,7 @@
             "termField": "name.keyword"
           },
           "rule_type_id": ".index-threshold",
+          "running": false,
           "schedule": {
             "interval": "1m"
           },
diff --git a/x-pack/plugins/alerting/docs/openapi/bundled.yaml b/x-pack/plugins/alerting/docs/openapi/bundled.yaml
index ad2ea6a72f15a..a82f2156f3581 100644
--- a/x-pack/plugins/alerting/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/bundled.yaml
@@ -1583,6 +1583,21 @@ components:
         type: string
         example: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74
   schemas:
+    notify_when:
+      type: string
+      description: |
+        Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met.
+      enum:
+        - onActionGroupChange
+        - onActiveAlert
+        - onThrottleInterval
+      example: onActiveAlert
+    throttle:
+      type: string
+      description: The throttle interval, which defines how often an alert generates repeated actions. It is applicable only if `notify_when` is set to `onThrottleInterval`. It is specified in seconds, minutes, hours, or days.
+      nullable: true
+      default: null
+      example: 10m
     actions:
       type: array
       default: []
@@ -1594,6 +1609,26 @@ components:
       items:
         type: object
         properties:
+          connector_type_id:
+            type: string
+            description: The type of connector. This property appears in responses but cannot be set in requests.
+            example: .server-log
+            readOnly: true
+          frequency:
+            type: object
+            description: |
+              The parameters that affect how often actions are generated. NOTE: You cannot specify these parameters when `notify_when` or `throttle` are defined at the rule level.
+            required:
+              - notify_when
+              - summary
+            properties:
+              notify_when:
+                $ref: '#/components/schemas/notify_when'
+              summary:
+                type: boolean
+                description: Indicates whether the action is a summary.
+              throttle:
+                $ref: '#/components/schemas/throttle'
           group:
             type: string
             description: The group name for the actions. If you don't need to group actions, set to `default`.
@@ -1606,15 +1641,6 @@ components:
             type: object
             description: The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.
             additionalProperties: true
-    notify_when:
-      type: string
-      description: |
-        Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met.
-      enum:
-        - onActionGroupChange
-        - onActiveAlert
-        - onThrottleInterval
-      example: onActiveAlert
     schedule:
       type: object
       description: The check interval, which specifies how frequently the rule conditions are checked. The interval is specified in seconds, minutes, hours, or days.
@@ -1628,12 +1654,6 @@ components:
       items:
         type: string
       default: []
-    throttle:
-      type: string
-      description: The throttle interval, which defines how often an alert generates repeated actions. It is applicable only if `notify_when` is set to `onThrottleInterval`. It is specified in seconds, minutes, hours, or days.
-      nullable: true
-      default: null
-      example: 10m
     rule_response_properties:
       title: Rule response properties
       type: object
@@ -1649,7 +1669,6 @@ components:
         - mute_all
         - muted_alert_ids
         - name
-        - notify_when
         - params
         - rule_type_id
         - schedule
@@ -1752,6 +1771,9 @@ components:
           description: |
             The identifier for the type of rule. For example, `.es-query`, `.index-threshold`, `logs.alert.document.count`, `monitoring_alert_cluster_health`, `siem.thresholdRule`, or `xpack.ml.anomaly_detection_alert`.
           example: monitoring_alert_cluster_health
+        running:
+          type: boolean
+          description: Indicates whether the rule is running.
         schedule:
           $ref: '#/components/schemas/schedule'
         scheduled_task_id:
@@ -1808,7 +1830,6 @@ components:
       type: object
       required:
         - name
-        - notify_when
         - params
         - schedule
       properties:
@@ -1837,7 +1858,6 @@ components:
       required:
         - consumer
         - name
-        - notify_when
         - params
         - rule_type_id
         - schedule
@@ -2020,26 +2040,38 @@ components:
     update_rule_request:
       summary: Update an index threshold rule.
       value:
-        notify_when: onActionGroupChange
+        actions:
+          - frequency:
+              summary: false
+              notify_when: onActionGroupChange
+            group: threshold met
+            id: 96b668d0-a1b6-11ed-afdf-d39a49596974
+            params:
+              level: info
+              message: |-
+                alert {{alertName}} is active for group {{context.group}}:
+
+                - Value: {{context.value}}
+                - Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}
+                - Timestamp: {{context.date}}
         params:
+          aggField: sheet.version
+          aggType: avg
           index:
             - .test-index
-          timeField: '@timestamp'
           groupBy: top
-          aggType: avg
-          timeWindowSize: 5
-          timeWindowUnit: m
-          thresholdComparator: '>'
-          threshold:
-            - 1000
-          aggField: sheet.version
           termField: name.keyword
           termSize: 6
+          threshold:
+            - 1000
+          thresholdComparator: '>'
+          timeField: '@timestamp'
+          timeWindowSize: 5
+          timeWindowUnit: m
+        name: new name
         schedule:
           interval: 1m
-        actions: []
         tags: []
-        name: new name
         throttle: null
     update_rule_response:
       summary: The update rule API returns a JSON object that contains details about the rule.
@@ -2050,8 +2082,9 @@ components:
         name: new name
         enabled: true
         throttle: null
+        running: false
         schedule:
-          interval: 1m
+          interval: 10m
         params:
           index:
             - .updated-index
@@ -2071,16 +2104,30 @@ components:
         updated_by: elastic
         rule_type_id: .index-threshold
         scheduled_task_id: 4c5eda00-e74f-11ec-b72f-5b18752ff9ea
-        created_at: '2022-12-12T22:43:20.578Z'
-        updated_at: '2022-12-12T22:44:21.783Z'
-        notify_when: onActionGroupChange
+        created_at: '2023-01-31T23:03:33.127Z'
+        updated_at: '2023-01-31T23:55:27.314Z'
         mute_all: false
         muted_alert_ids: []
         execution_status:
           status: ok
-          last_execution_date: '2022-12-12T22:43:21.723Z'
-          last_duration: 125
-        actions: []
+          last_execution_date: '2023-01-31T23:48:42.499Z'
+          last_duration: 52
+        actions:
+          - group: threshold met
+            params:
+              level: info
+              message: |-
+                alert {{alertName}} is active for group {{context.group}}:
+
+                - Value: {{context.value}}
+                - Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}
+                - Timestamp: {{context.date}
+            id: 96b668d0-a1b6-11ed-afdf-d39a49596974
+            connector_type_id: .server-log
+            frequency:
+              summary: false
+              throttle: null
+              notify_when: onActionGroupChange
         last_run:
           alerts_count:
             new: 0
@@ -2090,12 +2137,15 @@ components:
           outcome_msg: null
           warning: null
           outcome: succeeded
-        next_run: '2022-12-12T22:44:21.653Z'
+        next_run: '2023-01-31T23:49:42.432Z'
     create_rule_request:
       summary: Create an index threshold rule.
       value:
         actions:
           - id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2
+            frequency:
+              notify_when: onActionGroupChange
+              summary: false
             group: threshold met
             params:
               level: info
@@ -2107,7 +2157,6 @@ components:
                 - Timestamp: {{context.date}}
         consumer: alerts
         name: my rule
-        notify_when: onActionGroupChange
         params:
           aggType: avg
           termSize: 6
@@ -2133,6 +2182,10 @@ components:
         actions:
           - group: threshold met
             id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2
+            frequency:
+              notify_when: onActionGroupChange
+              summary: false
+              throttle: null
             params:
               level: info
               message: |-
@@ -2169,6 +2222,7 @@ components:
           aggField: sheet.version
           termField: name.keyword
         rule_type_id: .index-threshold
+        running: false
         schedule:
           interval: 1m
         scheduled_task_id: 425b0800-6bca-11eb-9e0d-85d233e3ee35
diff --git a/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_request.yaml b/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_request.yaml
index da587ebc22e52..0ca040446cda6 100644
--- a/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_request.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_request.yaml
@@ -2,13 +2,15 @@ summary: Create an index threshold rule.
 value:
   actions:
     - id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2
+      frequency:
+        notify_when: onActionGroupChange
+        summary: false
       group: threshold met
       params:
         level: info
         message: "alert '{{alertName}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
   consumer: alerts
   name: my rule
-  notify_when: onActionGroupChange
   params:
     aggType: avg
     termSize: 6
diff --git a/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_response.yaml b/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_response.yaml
index 1a1b45199ba58..daef9b2e3a39b 100644
--- a/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_response.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_response.yaml
@@ -3,6 +3,10 @@ value:
   actions:
     - group: threshold met
       id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2
+      frequency:
+        notify_when: onActionGroupChange
+        summary: false
+        throttle: null
       params:
         level: info
         message: "alert {{alertName}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
@@ -34,6 +38,7 @@ value:
     aggField: sheet.version
     termField: name.keyword
   rule_type_id: .index-threshold
+  running: false
   schedule:
     interval: 1m
   scheduled_task_id: 425b0800-6bca-11eb-9e0d-85d233e3ee35
diff --git a/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml b/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml
index 464645358990a..20ee916284ed0 100644
--- a/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml
@@ -1,21 +1,28 @@
 summary: Update an index threshold rule.
 value:
-  notify_when: onActionGroupChange
+  actions:
+    - frequency:
+        summary: false
+        notify_when: onActionGroupChange
+      group: threshold met
+      id: 96b668d0-a1b6-11ed-afdf-d39a49596974
+      params:
+        level: info
+        message: "alert {{alertName}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
   params:
+    aggField: sheet.version
+    aggType: avg
     index: [".test-index"]
-    timeField: "@timestamp"
     groupBy: top
-    aggType: avg
-    timeWindowSize: 5
-    timeWindowUnit: m
-    thresholdComparator: ">"
-    threshold: [1000]
-    aggField: sheet.version
     termField: name.keyword
     termSize: 6
+    threshold: [1000]
+    thresholdComparator: ">"
+    timeField: "@timestamp"
+    timeWindowSize: 5
+    timeWindowUnit: m
+  name: new name
   schedule:
     interval: 1m
-  actions: []
   tags: []
-  name: new name
   throttle: null
\ No newline at end of file
diff --git a/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_response.yaml b/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_response.yaml
index 7bbdba73774ac..a2195d0e15947 100644
--- a/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_response.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_response.yaml
@@ -6,8 +6,9 @@ value:
   name: new name
   enabled: true
   throttle: null
+  running: false
   schedule:
-    interval: 1m
+    interval: 10m
   params:
     index: [".updated-index"]
     timeField: "@timestamp"
@@ -25,16 +26,25 @@ value:
   updated_by: elastic
   rule_type_id: .index-threshold
   scheduled_task_id: 4c5eda00-e74f-11ec-b72f-5b18752ff9ea
-  created_at: '2022-12-12T22:43:20.578Z'
-  updated_at: '2022-12-12T22:44:21.783Z'
-  notify_when: onActionGroupChange
+  created_at: '2023-01-31T23:03:33.127Z'
+  updated_at: '2023-01-31T23:55:27.314Z'
   mute_all: false
   muted_alert_ids: []
   execution_status:
     status: ok
-    last_execution_date: '2022-12-12T22:43:21.723Z'
-    last_duration: 125
-  actions: []
+    last_execution_date: '2023-01-31T23:48:42.499Z'
+    last_duration: 52
+  actions:
+    - group: threshold met
+      params:
+        level: info
+        message: "alert {{alertName}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}"
+      id: 96b668d0-a1b6-11ed-afdf-d39a49596974
+      connector_type_id: .server-log
+      frequency:
+        summary: false
+        throttle: null
+        notify_when: onActionGroupChange
   last_run:
     alerts_count:
       new: 0
@@ -44,4 +54,4 @@ value:
     outcome_msg: null
     warning: null
     outcome: succeeded
-  next_run: '2022-12-12T22:44:21.653Z'
\ No newline at end of file
+  next_run: '2023-01-31T23:49:42.432Z'
\ No newline at end of file
diff --git a/x-pack/plugins/alerting/docs/openapi/components/schemas/actions.yaml b/x-pack/plugins/alerting/docs/openapi/components/schemas/actions.yaml
index ae381d6b370f3..5d0d877a4c177 100644
--- a/x-pack/plugins/alerting/docs/openapi/components/schemas/actions.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/components/schemas/actions.yaml
@@ -8,6 +8,27 @@ nullable: true
 items:
   type: object
   properties:
+    connector_type_id:
+      type: string
+      description: The type of connector. This property appears in responses but cannot be set in requests.
+      example: .server-log
+      readOnly: true
+    frequency:
+      type: object
+      description: >
+        The parameters that affect how often actions are generated.
+        NOTE: You cannot specify these parameters when `notify_when` or `throttle` are defined at the rule level.
+      required:
+        - notify_when
+        - summary
+      properties:
+        notify_when:
+          $ref: 'notify_when.yaml'
+        summary:
+          type: boolean
+          description: Indicates whether the action is a summary.
+        throttle:
+          $ref: 'throttle.yaml'
     group:
       type: string
       description: The group name for the actions. If you don't need to group actions, set to `default`.
diff --git a/x-pack/plugins/alerting/docs/openapi/components/schemas/create_rule_request.yaml b/x-pack/plugins/alerting/docs/openapi/components/schemas/create_rule_request.yaml
index e916f02227ea0..ca143eeb51cd8 100644
--- a/x-pack/plugins/alerting/docs/openapi/components/schemas/create_rule_request.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/components/schemas/create_rule_request.yaml
@@ -5,7 +5,6 @@ type: object
 required:
   - consumer
   - name
-  - notify_when
   - params
   - rule_type_id
   - schedule
diff --git a/x-pack/plugins/alerting/docs/openapi/components/schemas/rule_response_properties.yaml b/x-pack/plugins/alerting/docs/openapi/components/schemas/rule_response_properties.yaml
index 39f35d97d846b..827e89938f8fd 100644
--- a/x-pack/plugins/alerting/docs/openapi/components/schemas/rule_response_properties.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/components/schemas/rule_response_properties.yaml
@@ -12,7 +12,6 @@ required:
   - mute_all
   - muted_alert_ids
   - name
-  - notify_when
   - params
   - rule_type_id
   - schedule
@@ -115,6 +114,9 @@ properties:
     description: >
       The identifier for the type of rule. For example, `.es-query`, `.index-threshold`, `logs.alert.document.count`, `monitoring_alert_cluster_health`, `siem.thresholdRule`, or `xpack.ml.anomaly_detection_alert`.
     example: monitoring_alert_cluster_health
+  running:
+    type: boolean
+    description: Indicates whether the rule is running.
   schedule:
     $ref: 'schedule.yaml'
   scheduled_task_id:
diff --git a/x-pack/plugins/alerting/docs/openapi/components/schemas/update_rule_request.yaml b/x-pack/plugins/alerting/docs/openapi/components/schemas/update_rule_request.yaml
index fb4bd9586ea1f..4d08574698888 100644
--- a/x-pack/plugins/alerting/docs/openapi/components/schemas/update_rule_request.yaml
+++ b/x-pack/plugins/alerting/docs/openapi/components/schemas/update_rule_request.yaml
@@ -4,7 +4,6 @@ description: >-
 type: object
 required:
       - name
-      - notify_when
       - params
       - schedule
 properties:

From 38cab322f092d148dc8bf483d76d7ae70a66118e Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Wed, 8 Feb 2023 11:32:55 -0500
Subject: [PATCH 134/134] skip failing test suite (#150561)

---
 .../functional/apps/dashboard/group3/reporting/download_csv.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/test/functional/apps/dashboard/group3/reporting/download_csv.ts b/x-pack/test/functional/apps/dashboard/group3/reporting/download_csv.ts
index d062eb8feb432..766d2ea500dc5 100644
--- a/x-pack/test/functional/apps/dashboard/group3/reporting/download_csv.ts
+++ b/x-pack/test/functional/apps/dashboard/group3/reporting/download_csv.ts
@@ -67,7 +67,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     await testSubjects.existOrFail('csvDownloadStarted'); // validate toast panel
   };
 
-  describe('Download CSV', () => {
+  // Failing: See https://github.com/elastic/kibana/issues/150561
+  describe.skip('Download CSV', () => {
     before('initialize tests', async () => {
       log.debug('ReportingPage:initTests');
       await browser.setWindowSize(1600, 850);